jhodgkin
461bd63804
The Authentik blueprint that provisions the OAuth2 Provider/Application only lived on CT121's filesystem via ad-hoc scp/pct push -- deploy/authentik/ is now the source of truth, with redeploy steps in docs/oidc-setup.md. Also documents two bugs found and fixed while implementing issue #19: the first RP-Initiated Logout attempt only ended the app-scoped session, and the provider had no property_mappings so the ID token's username claim was missing (fell back to a raw sub hash that looked like a leaked session token). Both are covered by new Playwright regression tests. The deep-check Fingerbank test now skips instead of failing when its target device (192.168.1.106) has since been manually labeled known via the dashboard, rather than assuming it stays unlabeled forever.
56 lines
3.0 KiB
YAML
56 lines
3.0 KiB
YAML
version: 1
|
|
metadata:
|
|
name: homelab-monitor-oidc
|
|
entries:
|
|
- model: authentik_providers_oauth2.oauth2provider
|
|
id: homelab-monitor-provider
|
|
identifiers:
|
|
name: homelab-monitor
|
|
attrs:
|
|
client_type: confidential
|
|
client_id: 91e5b20f5902319144cc1530559f5c8ba27e0027
|
|
# Real secret lives only in CT122's .env / Vaultwarden -- this
|
|
# blueprint file as deployed to CT121 has the real value baked in
|
|
# (Authentik blueprints don't support secret refs), but the copy
|
|
# tracked in this repo uses a placeholder. If re-deploying from
|
|
# scratch, pull the real secret from Vaultwarden ("Homelab Monitor -
|
|
# Authentik OIDC client") and substitute it before pushing to CT121.
|
|
client_secret: __SEE_VAULTWARDEN_HOMELAB_MONITOR_OIDC_CLIENT__
|
|
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
|
# default-invalidation-flow (full Authentik logout), not
|
|
# default-provider-invalidation-flow (app-scoped only). The app-scoped
|
|
# one leaves Authentik's own browser session cookie valid, so a
|
|
# subsequent "Sign in with Authentik" click silently re-authenticates
|
|
# with no prompt -- doesn't satisfy "sign out should sign out of
|
|
# Authentik too" (issue #19). Confirmed via a full Playwright
|
|
# click-through both ways before settling on this. Per-provider
|
|
# setting; doesn't affect any other app's logout behavior.
|
|
invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
|
|
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
|
|
sub_mode: hashed_user_id
|
|
# Without these, the ID token only ever carries the bare required
|
|
# claims (sub/iss/aud/exp/...) -- never preferred_username or email.
|
|
# The app's claim fallback chain (preferred_username ?? email ?? sub)
|
|
# landed on the raw sub hash, which rendered next to the sign-out
|
|
# button looking like a leaked session token. Confirmed root cause by
|
|
# decoding a real captured ID token before concluding this was it,
|
|
# rather than guessing.
|
|
property_mappings:
|
|
- !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'openid'"]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'profile'"]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'email'"]]
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://monitor.jerodrigged.com/api/auth/oidc/callback
|
|
- matching_mode: strict
|
|
url: http://192.168.1.103:8090/api/auth/oidc/callback
|
|
- model: authentik_core.application
|
|
id: homelab-monitor-app
|
|
identifiers:
|
|
slug: homelab-monitor
|
|
attrs:
|
|
name: Homelab Monitor
|
|
provider: !KeyOf homelab-monitor-provider
|
|
open_in_new_tab: false
|
|
meta_launch_url: https://monitor.jerodrigged.com
|