From de7e9bfe0980e2253230a7f7f19409fe108fbf90 Mon Sep 17 00:00:00 2001 From: mulatta <67085791+mulatta@users.noreply.github.com> Date: Fri, 13 Nov 2026 14:51:18 +0900 Subject: [PATCH] authentik: grant authorization code to oidc clients by default Provider 2026.8 stores an empty grant list when grant_types is null, so Authentik rejected every authorization request from Quorum with invalid_request. Clients created before the provider bump kept the old server default, which hid the problem. A shared default keeps new clients usable without each one repeating the list. Change-Id: Ibecdb0cbc8621356cbdff927f5b6349c091a7b82 --- terraform/authentik/oidc.tf | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/terraform/authentik/oidc.tf b/terraform/authentik/oidc.tf index f6ceb369..b4df5169 100644 --- a/terraform/authentik/oidc.tf +++ b/terraform/authentik/oidc.tf @@ -45,6 +45,10 @@ locals { } } + # Provider 2026.8 stores an empty grant list when grant_types is null, and + # Authentik then rejects every authorization request. + oidc_default_grant_types = ["authorization_code", "refresh_token"] + oidc_default_property_mappings = [ data.authentik_property_mapping_provider_scope.openid.id, data.authentik_property_mapping_provider_scope.email.id, @@ -58,7 +62,6 @@ locals { client_id = "neko-rho" client_secret = data.sops_file.neko_secrets.data["NEKO_OAUTH_CLIENT_SECRET"] client_type = "confidential" - grant_types = ["authorization_code", "refresh_token"] sub_mode = "hashed_user_id" meta_launch_url = "https://neko.sjanglab.org" allowed_redirect_uris = [ @@ -184,7 +187,7 @@ resource "authentik_provider_oauth2" "oidc" { client_id = each.value.client_id client_secret = each.value.client_secret client_type = each.value.client_type - grant_types = lookup(each.value, "grant_types", null) + grant_types = lookup(each.value, "grant_types", local.oidc_default_grant_types) sub_mode = each.value.sub_mode issuer_mode = "per_provider" include_claims_in_id_token = true