Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
2026-06-10 23:52:14 -05:00
parent 109cc0d5cb
commit 63889fc150
19 changed files with 424 additions and 94 deletions
@@ -0,0 +1,47 @@
+"""Switch homarr from forward-auth proxy provider to native OIDC (run: ak shell -c exec(open(...).read()))."""
+from authentik.core.models import Application
+from authentik.flows.models import Flow
+from authentik.outposts.models import Outpost
+from authentik.providers.oauth2.models import OAuth2Provider, RedirectURI, RedirectURIMatchingMode
+from authentik.providers.proxy.models import ProxyProvider
+
+AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
+INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
+
+REDIRECT = "https://homarr.ginnoir.com/api/auth/callback/oidc"
+
+provider, created = OAuth2Provider.objects.update_or_create(
+    name="homarr",
+    defaults={
+        "authorization_flow": AUTHZ,
+        "invalidation_flow": INVALID,
+        "redirect_uris": [
+            RedirectURI(matching_mode=RedirectURIMatchingMode.STRICT, url=REDIRECT),
+        ],
+        "access_code_validity": "minutes=1",
+        "access_token_validity": "hours=24",
+        "refresh_token_validity": "days=30",
+    },
+)
+# Required for Homarr profile parsing — without these, userinfo lacks name/email claims.
+default_mappings = OAuth2Provider.objects.get(name="famapp").property_mappings.all()
+provider.property_mappings.set(default_mappings)
+provider.save()
+print(f"oauth2 provider homarr created={created} client_id={provider.client_id}")
+
+app = Application.objects.get(slug="homarr")
+app.provider = provider
+app.save()
+print(f"application homarr -> OAuth2Provider homarr")
+
+# Drop homarr from the embedded proxy outpost (native OIDC replaces forward_auth here).
+try:
+    proxy = ProxyProvider.objects.get(name="homelab-homarr")
+    outpost = Outpost.objects.get(name="authentik Embedded Outpost")
+    outpost.providers.remove(proxy)
+    print("removed homelab-homarr from embedded outpost")
+except ProxyProvider.DoesNotExist:
+    print("homelab-homarr proxy provider not found (ok)")
+
+print(f"AUTH_OIDC_CLIENT_ID={provider.client_id}")
+print(f"AUTH_OIDC_CLIENT_SECRET={provider.client_secret}")