Skip to content

Commit 719c747

Browse files
CarlSchwanCarlSchwan
committed
fix: portal login with authentik
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
1 parent 72c3a17 commit 719c747

4 files changed

Lines changed: 160 additions & 151 deletions

File tree

‎authentik-blueprints/nextcloud_saml.yaml‎

Lines changed: 76 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ metadata:
44
blueprints.goauthentik.io/instantiate: "true"
55
context: {}
66
entries:
7+
8+
# SAML
9+
710
- attrs:
811
name: Authentik Nextcloud
912
certificate_data: |
@@ -90,7 +93,7 @@ entries:
9093
-----END RSA PRIVATE KEY-----
9194
model: authentik_crypto.certificatekeypair
9295
identifiers:
93-
name: authentik-cert
96+
name: authentik-cert-local
9497
- attrs:
9598
name: Nextcloud
9699
certificate_data: |
@@ -177,7 +180,7 @@ entries:
177180
-----END RSA PRIVATE KEY-----
178181
model: authentik_crypto.certificatekeypair
179182
identifiers:
180-
name: nextcloud-cert
183+
name: nextcloud-cert-local
181184
- attrs:
182185
acs_url: https://nextcloud.local/index.php/apps/user_saml/saml/acs
183186
assertion_valid_not_before: minutes=-5
@@ -189,7 +192,7 @@ entries:
189192
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
190193
issuer: https://nextcloud.local/index.php/apps/user_saml/saml/metadata
191194
logout_method: frontchannel_iframe
192-
name: nextcloud-saml
195+
name: nextcloud-saml-local
193196
name_id_mapping: !Find [authentik_providers_saml.samlpropertymapping, [managed, goauthentik.io/providers/saml/uid]]
194197
property_mappings:
195198
- !Find [authentik_providers_saml.samlpropertymapping, [managed, goauthentik.io/providers/saml/upn]]
@@ -202,97 +205,95 @@ entries:
202205
session_valid_not_on_or_after: minutes=86400
203206
sign_assertion: true
204207
signature_algorithm: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
205-
signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik-cert]]
208+
signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik-cert-local]]
206209
sls_binding: redirect
207210
sp_binding: post
208-
verification_kp: !Find [authentik_crypto.certificatekeypair, [name, nextcloud-cert]]
211+
verification_kp: !Find [authentik_crypto.certificatekeypair, [name, nextcloud-cert-local]]
209212
conditions: []
210213
identifiers:
211-
pk: 1
214+
name: nextcloud-saml-local
212215
model: authentik_providers_saml.samlprovider
213216
permissions: []
214217
state: present
215218
- attrs:
216-
name: Nextcloud
219+
name: Nextcloud SAML
217220
policy_engine_mode: any
218-
provider: 1
219-
slug: nextcloud
221+
provider: !Find [authentik_providers_saml.samlprovider, [name, nextcloud-saml-local]]
222+
slug: nextcloud-saml-local
220223
conditions: []
221224
identifiers:
222225
name: nextcloud
223226
model: authentik_core.application
224227
permissions: []
225228
state: present
229+
230+
# LDAP
231+
226232
- attrs:
227-
name: User Eleven
228-
email: user11@example.com
229-
password: user11
230-
model: authentik_core.user
231-
state: present
232-
identifiers:
233-
username: user11
234-
- attrs:
235-
name: User Twelve
236-
email: user12@example.com
237-
password: user12
238-
model: authentik_core.user
239-
state: present
240-
identifiers:
241-
username: user12
242-
- attrs:
243-
name: User Thirteen
244-
email: user13@example.com
245-
password: user13
246-
model: authentik_core.user
247-
state: present
248-
identifiers:
249-
username: user13
250-
- attrs:
251-
name: User Twenty One
252-
email: user21@example.com
253-
password: user21
254-
model: authentik_core.user
255-
state: present
256-
identifiers:
257-
username: user21
258-
- attrs:
259-
name: User Twenty Two
260-
email: user22@example.com
261-
password: user22
262-
model: authentik_core.user
263-
state: present
264-
identifiers:
265-
username: user22
266-
- attrs:
267-
name: User Twenty Three
268-
email: user23@example.com
269-
password: user23
270-
model: authentik_core.user
271-
state: present
272-
identifiers:
273-
username: user23
274-
- attrs:
275-
name: User Thirty One
276-
email: user31@example.com
277-
password: user31
278-
model: authentik_core.user
233+
authorization_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
234+
base_dn: DC=ldap,DC=goauthentik,DC=io
235+
bind_mode: cached
236+
gid_start_number: 4000
237+
invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
238+
mfa_support: true
239+
name: Provider for Nextcloud LDAP
240+
search_mode: cached
241+
uid_start_number: 2000
242+
conditions: []
243+
model: authentik_providers_ldap.ldapprovider
244+
permissions: []
279245
state: present
280246
identifiers:
281-
username: user31
247+
pk: 20
248+
282249
- attrs:
283-
name: User Thirty Two
284-
email: user32@example.com
285-
password: user32
286-
model: authentik_core.user
287-
state: present
250+
name: Nextcloud LDAP
251+
policy_engine_mode: any
252+
provider: 20
253+
slug: nextcloud-ldap
254+
conditions: []
288255
identifiers:
289-
username: user32
290-
- attrs:
291-
name: User Thirty Three
292-
email: user33@example.com
293-
password: user33
294-
model: authentik_core.user
256+
name: nextcloud-ldap
257+
model: authentik_core.application
258+
permissions: []
295259
state: present
296-
identifiers:
297-
username: user33
260+
261+
#- attrs:
262+
# config:
263+
# authentik_host: http://authentik.local/
264+
# authentik_host_browser: ''
265+
# authentik_host_insecure: false
266+
# container_image: null
267+
# docker_labels: null
268+
# docker_map_ports: true
269+
# docker_network: null
270+
# kubernetes_disabled_components: []
271+
# kubernetes_httproute_annotations: {}
272+
# kubernetes_httproute_parent_refs: []
273+
# kubernetes_image_pull_secrets: []
274+
# kubernetes_ingress_annotations: {}
275+
# kubernetes_ingress_class_name: null
276+
# kubernetes_ingress_path_type: null
277+
# kubernetes_ingress_secret_name: authentik-outpost-tls
278+
# kubernetes_json_patches: null
279+
# kubernetes_namespace: default
280+
# kubernetes_replicas: 1
281+
# kubernetes_service_type: ClusterIP
282+
# log_level: info
283+
# object_naming_template: ak-outpost-%(name)s
284+
# refresh_interval: minutes=5
285+
# managed: null
286+
# name: Nextcloud LDAP
287+
# providers:
288+
# - 20
289+
# service_connection: !Find [authentik_outposts.dockerserviceconnection, [name, Local Docker connection]]
290+
# type: ldap
291+
# conditions: []
292+
# model: authentik_outposts.outpost
293+
# permissions: []
294+
# state: present
295+
# identifiers:
296+
# pk: 82b825ba-dcb8-44dc-9519-2c4f4f2491c5
297+
298+
298299
version: 1

‎authentik-blueprints/portal_saml.yaml‎

Lines changed: 0 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -223,76 +223,4 @@ entries:
223223
model: authentik_core.application
224224
permissions: []
225225
state: present
226-
- attrs:
227-
name: User Eleven
228-
email: user11@example.com
229-
password: user11
230-
model: authentik_core.user
231-
state: present
232-
identifiers:
233-
username: user11
234-
- attrs:
235-
name: User Twelve
236-
email: user12@example.com
237-
password: user12
238-
model: authentik_core.user
239-
state: present
240-
identifiers:
241-
username: user12
242-
- attrs:
243-
name: User Thirteen
244-
email: user13@example.com
245-
password: user13
246-
model: authentik_core.user
247-
state: present
248-
identifiers:
249-
username: user13
250-
- attrs:
251-
name: User Twenty One
252-
email: user21@example.com
253-
password: user21
254-
model: authentik_core.user
255-
state: present
256-
identifiers:
257-
username: user21
258-
- attrs:
259-
name: User Twenty Two
260-
email: user22@example.com
261-
password: user22
262-
model: authentik_core.user
263-
state: present
264-
identifiers:
265-
username: user22
266-
- attrs:
267-
name: User Twenty Three
268-
email: user23@example.com
269-
password: user23
270-
model: authentik_core.user
271-
state: present
272-
identifiers:
273-
username: user23
274-
- attrs:
275-
name: User Thirty One
276-
email: user31@example.com
277-
password: user31
278-
model: authentik_core.user
279-
state: present
280-
identifiers:
281-
username: user31
282-
- attrs:
283-
name: User Thirty Two
284-
email: user32@example.com
285-
password: user32
286-
model: authentik_core.user
287-
state: present
288-
identifiers:
289-
username: user32
290-
- attrs:
291-
name: User Thirty Three
292-
email: user33@example.com
293-
password: user33
294-
model: authentik_core.user
295-
state: present
296-
identifiers:
297-
username: user33
298226
version: 1

‎authentik-blueprints/users.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
metadata:
2+
name: "nextcloud.local users"
3+
labels:
4+
blueprints.goauthentik.io/instantiate: "true"
5+
context: {}
6+
entries:
7+
8+
- attrs:
9+
name: User Eleven
10+
email: user11@example.com
11+
password: user11
12+
model: authentik_core.user
13+
state: present
14+
identifiers:
15+
username: user11
16+
- attrs:
17+
name: User Twelve
18+
email: user12@example.com
19+
password: user12
20+
model: authentik_core.user
21+
state: present
22+
identifiers:
23+
username: user12
24+
- attrs:
25+
name: User Thirteen
26+
email: user13@example.com
27+
password: user13
28+
model: authentik_core.user
29+
state: present
30+
identifiers:
31+
username: user13
32+
- attrs:
33+
name: User Twenty One
34+
email: user21@example.com
35+
password: user21
36+
model: authentik_core.user
37+
state: present
38+
identifiers:
39+
username: user21
40+
- attrs:
41+
name: User Twenty Two
42+
email: user22@example.com
43+
password: user22
44+
model: authentik_core.user
45+
state: present
46+
identifiers:
47+
username: user22
48+
- attrs:
49+
name: User Twenty Three
50+
email: user23@example.com
51+
password: user23
52+
model: authentik_core.user
53+
state: present
54+
identifiers:
55+
username: user23
56+
- attrs:
57+
name: User Thirty One
58+
email: user31@example.com
59+
password: user31
60+
model: authentik_core.user
61+
state: present
62+
identifiers:
63+
username: user31
64+
- attrs:
65+
name: User Thirty Two
66+
email: user32@example.com
67+
password: user32
68+
model: authentik_core.user
69+
state: present
70+
identifiers:
71+
username: user32
72+
- attrs:
73+
name: User Thirty Three
74+
email: user33@example.com
75+
password: user33
76+
model: authentik_core.user
77+
state: present
78+
identifiers:
79+
username: user33
80+
version: 1

‎docker/bin/bootstrap.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -143,8 +143,8 @@ configure_saml() {
143143
OCC saml:config:set 1 --idp-singleLogoutService.url 'http://authentik.local/if/session-end/portal/'
144144
OCC saml:config:set 1 --idp-entityId 'https://portal.local/index.php/apps/user_saml/saml/metadata'
145145
else
146-
OCC saml:config:set 1 --idp-singleSignOnService.url 'http://authentik.local/application/saml/nextcloud/sso/binding/redirect/'
147-
OCC saml:config:set 1 --idp-singleLogoutService.url 'http://authentik.local/if/session-end/nextcloud/'
146+
OCC saml:config:set 1 --idp-singleSignOnService.url 'http://authentik.local/application/saml/nextcloud-saml-local/sso/binding/redirect/'
147+
OCC saml:config:set 1 --idp-singleLogoutService.url 'http://authentik.local/if/session-end/nextcloud-saml-local/'
148148
OCC saml:config:set 1 --idp-entityId 'https://nextcloud.local/index.php/apps/user_saml/saml/metadata'
149149
fi
150150

@@ -191,7 +191,7 @@ EOF
191191
OCC app:enable globalsiteselector --force
192192
OCC config:system:set lookup_server --value "$LOOKUP_SERVER"
193193
OCC config:system:set gs.enabled --type boolean --value true
194-
OCC config:system:set gss.jwt.key --value 'random-key'
194+
OCC config:system:set gss.jwt.key --value 'random-key-but-super-long-because-this-is-required'
195195
OCC config:system:set gss.mode --value 'master'
196196
OCC config:system:set gss.master.admin 0 --value 'admin'
197197
OCC config:system:set gss.master.csp-allow 0 --value "*${DOMAIN_SUFFIX}"
@@ -208,7 +208,7 @@ EOF
208208
OCC config:system:set lookup_server --value "$LOOKUP_SERVER"
209209
OCC config:system:set gs.enabled --type boolean --value true
210210
OCC config:system:set gs.federation --value 'global'
211-
OCC config:system:set gss.jwt.key --value 'random-key'
211+
OCC config:system:set gss.jwt.key --value 'random-key-but-super-long-because-this-is-required'
212212
OCC config:system:set gss.mode --value 'slave'
213213
OCC config:system:set gss.master.url --value "$MASTER_SERVER"
214214
fi

0 commit comments

Comments
 (0)