ginnoir
63889fc150
Deploy to valhalla / deploy (push) Has been cancelled
Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.
48 lines
2.0 KiB
Python
48 lines
2.0 KiB
Python
"""Switch homarr from forward-auth proxy provider to native OIDC (run: ak shell -c exec(open(...).read()))."""
|
|
from authentik.core.models import Application
|
|
from authentik.flows.models import Flow
|
|
from authentik.outposts.models import Outpost
|
|
from authentik.providers.oauth2.models import OAuth2Provider, RedirectURI, RedirectURIMatchingMode
|
|
from authentik.providers.proxy.models import ProxyProvider
|
|
|
|
AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
|
|
INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
|
|
|
|
REDIRECT = "https://homarr.ginnoir.com/api/auth/callback/oidc"
|
|
|
|
provider, created = OAuth2Provider.objects.update_or_create(
|
|
name="homarr",
|
|
defaults={
|
|
"authorization_flow": AUTHZ,
|
|
"invalidation_flow": INVALID,
|
|
"redirect_uris": [
|
|
RedirectURI(matching_mode=RedirectURIMatchingMode.STRICT, url=REDIRECT),
|
|
],
|
|
"access_code_validity": "minutes=1",
|
|
"access_token_validity": "hours=24",
|
|
"refresh_token_validity": "days=30",
|
|
},
|
|
)
|
|
# Required for Homarr profile parsing — without these, userinfo lacks name/email claims.
|
|
default_mappings = OAuth2Provider.objects.get(name="famapp").property_mappings.all()
|
|
provider.property_mappings.set(default_mappings)
|
|
provider.save()
|
|
print(f"oauth2 provider homarr created={created} client_id={provider.client_id}")
|
|
|
|
app = Application.objects.get(slug="homarr")
|
|
app.provider = provider
|
|
app.save()
|
|
print(f"application homarr -> OAuth2Provider homarr")
|
|
|
|
# Drop homarr from the embedded proxy outpost (native OIDC replaces forward_auth here).
|
|
try:
|
|
proxy = ProxyProvider.objects.get(name="homelab-homarr")
|
|
outpost = Outpost.objects.get(name="authentik Embedded Outpost")
|
|
outpost.providers.remove(proxy)
|
|
print("removed homelab-homarr from embedded outpost")
|
|
except ProxyProvider.DoesNotExist:
|
|
print("homelab-homarr proxy provider not found (ok)")
|
|
|
|
print(f"AUTH_OIDC_CLIENT_ID={provider.client_id}")
|
|
print(f"AUTH_OIDC_CLIENT_SECRET={provider.client_secret}")
|