fricloud/server-configs
2
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

authelia: update stopped providing claims in response

Browse source 
This adds the default claim policy, which can be used to provide the
past behaviour for this. Services that require this still needs to be identified.
This commit is contained in:
eyjhb 2025-05-29 16:22:28 +02:00
parent bb68927c6e
commit 8e5f22a87e
Signed by: eyjhb
GPG key ID: 609F508E3239F920
3 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
machines/gerd/services/authelia/authelia.nix
View file

@ -90,6 +90,20 @@ in {
user = config.mine.shared.settings.ldap.bind_dn;
};
};
# authelia have changed how the by-default handles auth, so in theory everything
# should contact the `userinfo` endpoint. but not everything does, which leads to us
# having to create a default policy for this
# https://github.com/pulsejet/nextcloud-oidc-login/issues/311#issuecomment-2763239352
identity_providers.oidc.claims_policies.default.id_token = [
"rat"
"groups"
"email"
"email_verified"
"alt_emails"
"preferred_username"
"name"
];
};
};

1
machines/gerd/services/nextcloud.nix
View file

@ -223,6 +223,7 @@ in {
client_secret = "$pbkdf2-sha512$310000$kLNQ/1A.uasSN4g8q94jUQ$8OKNUNNumHCh8dVG5/QWys7u.y1guqFXlrL.bMm7/HKTsWhpib/W.8qlU6VU7V1Be/h14Y.fJi3RLvbkEdo2kA";
consent_mode = "implicit";
redirect_uris = [ "https://${svc_domain}/apps/oidc_login/oidc" ];
claims_policy = "default";
scopes = [
"openid"
"profile"

1
machines/gerd/services/rallly/default.nix
View file

@ -106,6 +106,7 @@ in {
client_secret = "$pbkdf2-sha512$310000$KB4UqeuVr86lEOoISSE92w$i2YGpz3wRwceiRfYnMUhZ0MboutkDPPYVWnXqiw6tUt./mgZ5kfV1ES.kcdsHhMdavhCrJfWvVTPQRJKImuUrQ";
consent_mode = "implicit";
redirect_uris = [ "https://${svc_domain}/api/auth/callback/oidc" ];
claims_policy = "default";
scopes = [
"openid"
"email"