feat(hydra): add variable HYDRA_BCRYPT_COST

defaults/main.yml

@@ -53,6 +53,11 @@ hydra_public_cors_allowed_origins: []
 hydra_log_level: warn
 hydra_log_leak_sensitive_values: no
 
+# Durée de vie des "refresh_token"
+hydra_ttl_refresh_token: "24h"
+
+hydra_bcrypt_cost: 8
+
 # This value should not be changed after first deployment !
 hydra_secrets_seed: "{{ inventory_hostname }}"
 
@@ -166,9 +171,6 @@ hydra_saml_debug: no
 # Niveau de verbosité du service shibboleth-sp
 hydra_saml_sp_log_level: WARN
 
-# Durée de vie des "refresh_token"
-hydra_ttl_refresh_token: "24h"
-
 # Inclure les règles de cartographie des attributs SAML fournis  par défaut par le projet hydra-shibboleth-sp-v3
 hydra_saml_include_sp_default_attributes_mapping: "yes"
 

sso.schema.yml

@@ -89,6 +89,10 @@ properties:
   hydra_ttl_refresh_token:
     type: string
 
+  hydra_brypt_cost:
+    type: number
+    description: Coût CPU pour calculer des hachages de secret (4-31)
+
   # This value should not be changed after first deployment !
   hydra_secrets_seed:
     type: string

templates/cadoles-pod-hydra-v1.conf.j2

@@ -25,5 +25,6 @@ PODMAN_ARGS="\
     {% endif %}
     -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
     -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
+    -e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
     -v /etc/hydra/clients.d:/etc/hydra/clients.d \
 "