defaults/main.yml

@@ -56,6 +56,8 @@ hydra_log_leak_sensitive_values: no
 # Durée de vie des "refresh_token"
 hydra_ttl_refresh_token: "24h"
 
+hydra_bcrypt_cost: 8
+
 # This value should not be changed after first deployment !
 hydra_secrets_seed: "{{ inventory_hostname }}"
 

sso.schema.yml

@@ -89,6 +89,10 @@ properties:
   hydra_ttl_refresh_token:
     type: string
 
+  hydra_brypt_cost:
+    type: number
+    description: Coût CPU pour calculer des hachages de secret (4-31)
+
   # This value should not be changed after first deployment !
   hydra_secrets_seed:
     type: string

templates/cadoles-pod-hydra-v1.conf.j2

@@ -25,5 +25,6 @@ PODMAN_ARGS="\
     {% endif %}
     -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
     -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
+    -e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
     -v /etc/hydra/clients.d:/etc/hydra/clients.d \
 "