From 666d4ea260782427877ea5a020c59fbf3ce65728 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Fri, 28 Apr 2023 13:56:28 -0400
Subject: [PATCH] Add privileged session config option to kratos config UI

---
 salt/kratos/defaults.yaml   | 3 +--
 salt/kratos/soc_kratos.yaml | 9 ++++-----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/salt/kratos/defaults.yaml b/salt/kratos/defaults.yaml
index b1572a5ff..8f7a72b00 100644
--- a/salt/kratos/defaults.yaml
+++ b/salt/kratos/defaults.yaml
@@ -5,8 +5,6 @@ kratos:
       whoami:
         required_aal: highest_available
     selfservice:
-      settings:
-        privileged_session_max_age: 5m
       methods:
         password:
           enabled: true
@@ -18,6 +16,7 @@ kratos:
             issuer: Security Onion
       flows:
         settings:
+          privileged_session_max_age: 5m
           ui_url: https://URL_BASE/?r=/settings
           required_aal: highest_available
         verification:
diff --git a/salt/kratos/soc_kratos.yaml b/salt/kratos/soc_kratos.yaml
index 4fefa0583..d08e3682b 100644
--- a/salt/kratos/soc_kratos.yaml
+++ b/salt/kratos/soc_kratos.yaml
@@ -12,11 +12,6 @@ kratos:
           advanced: True
           helpLink: kratos.html
     selfservice:
-      settings:
-        privileged_session_max_age:
-          description: The length of time after a successful authentication for a user's session to be elevated to a privileged session. Privileged sessions are able to change passwords and MFA settings for that user. If a session is no longer privileged then the user is sent to the login form first, before the security settings can be adjusted.
-          global: True
-          helpLink: kratos.html
       methods:
         password:
           enabled: 
@@ -43,6 +38,10 @@ kratos:
               helpLink: kratos.html
       flows:
         settings:
+          privileged_session_max_age:
+            description: The length of time after a successful authentication for a user's session to be elevated to a privileged session. Privileged sessions are able to change passwords and MFA settings for that user. If a session is no longer privileged then the user is sent to the login form first, before the security settings can be adjusted.
+            global: True
+            helpLink: kratos.html
           ui_url: 
             description: User accessible URL containing the user self-service profile and security settings. Leave as default to ensure proper operation.
             global: True