ginnoir/homelabstack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(claude): correct Authentik provider template scope PKs and grant_types

Browse Source 
grant_types must be set explicitly ([] = all auth rejected). Scope PKs
were truncated placeholders — replaced with actual UUIDs from this
Authentik instance. Signing key was already correct.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
ginnoir
2026-06-15 23:17:06 -05:00
co-authored by Claude Sonnet 4.6
parent ba6724a1c3
commit 2cf48222b8
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+3 -3
View File
@@ -113,13 +113,13 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
"redirect_uris": [{"matching_mode": "strict", "url": "https://<slug>.ginnoir.com/auth/callback"}],
"authorization_flow": "b88daebc-c54d-4e85-ae27-8b47384d5d74",
"invalidation_flow": "3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3",
"property_mappings": ["718abef2-...", "19491dd8-...", "ca45a8da-..."],
"property_mappings": ["718abef2-504c-452c-9ff0-329eda8031c7", "19491dd8-d239-41a4-aa48-030c1471779d", "ca45a8da-db62-41ba-b1c4-e669bf3c9a82"],
"sub_mode": "hashed_user_id",
"grant_types": ["authorization_code", "hybrid", "implicit", "client_credentials", "password", "urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
"grant_types": ["authorization_code", "refresh_token"],
"signing_key": "dc7cbd9e-c6d2-4168-b402-e7570bcb59d1"
}
```
**IMPORTANT:** `grant_types` and `signing_key` must be set explicitly — the API defaults `grant_types` to `[]` (empty = all auth requests rejected as `invalid_request`) and leaves `signing_key` null (tokens can't be signed).
**IMPORTANT:** `grant_types` and `signing_key` must be set explicitly — the API defaults `grant_types` to `[]` (empty = all auth requests rejected as `invalid_request`) and leaves `signing_key` null (tokens can't be signed). Use `UpdateOauth2Provider` to fix an existing broken provider.
Note the returned `pk`, `client_id`, and `client_secret`.
2. **Create an Authentik application** → `POST /api/v3/core/applications/`: