From 1e1eab3d41ed69166cca8c6d62db5908b6a38bd8 Mon Sep 17 00:00:00 2001 From: Jerod Hodgkin Date: Mon, 20 Jul 2026 06:26:33 +0000 Subject: [PATCH] Fix authentik-setup.sh: managed__iexact filter silently ignored This is the actual production-breaking bug: the scope-mapping lookup used ?managed__iexact=..., which this Authentik version doesn't support as a filter - it silently returns the whole unfiltered list instead of erroring, so d['results'][0]['pk'] always grabbed the same first item (the "Proxy outpost" ak_proxy scope, not openid/profile/ email). Every run attached that single wrong scope to the provider, which meant every real login would fail at the userinfo step with a 403 ("Scope mismatch", token had zero of the required openid scope). Fixed by filtering on scope_name (the field that actually works) and added a hard failure if a lookup ever comes up empty, instead of silently proceeding with a broken scope list. Manually verified against the live dev-lisilou.jerodrigged.com OIDC login: full authorization-code+PKCE round trip against a disposable test user, confirmed valid session cookie with correct admin group claim. Also PATCHed the already-created provider's property_mappings directly on auth.jerodrigged.com so dev doesn't need to wait for a re-run to get the fix. --- scripts/authentik-setup.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/scripts/authentik-setup.sh b/scripts/authentik-setup.sh index d6e4429..8392c11 100644 --- a/scripts/authentik-setup.sh +++ b/scripts/authentik-setup.sh @@ -56,9 +56,13 @@ echo " Authentik $VERSION" AUTHZ_FLOW=$(api GET "/flows/instances/?slug=default-provider-authorization-implicit-consent" | jget - "d['results'][0]['pk']") INVALIDATION_FLOW=$(api GET "/flows/instances/?slug=default-provider-invalidation-flow" | jget - "d['results'][0]['pk']" 2>/dev/null || echo "") -SCOPES=$(api GET "/propertymappings/provider/scope/?managed__iexact=goauthentik.io/providers/oauth2/scope-openid" | jget - "d['results'][0]['pk']") -for s in profile email; do - SCOPES="$SCOPES,$(api GET "/propertymappings/provider/scope/?managed__iexact=goauthentik.io/providers/oauth2/scope-$s" | jget - "d['results'][0]['pk']")" +SCOPES="" +for s in openid profile email; do + # NOTE: managed__iexact is silently ignored by this endpoint (returns the + # unfiltered list) - scope_name is the field that actually filters. + PK=$(api GET "/propertymappings/provider/scope/?scope_name=$s" | jget - "d['results'][0]['pk']") + [ -n "$PK" ] || { echo " FATAL: no scope mapping found for scope_name=$s"; exit 1; } + SCOPES="${SCOPES:+$SCOPES,}$PK" done SCOPES_JSON=$(python3 -c "import sys;print(__import__('json').dumps(sys.argv[1].split(',')))" "$SCOPES")