feat(audiobookshelf): provision authentik SSO and send the redirect subfolder
The live round trip died on authentik with Redirect URI Error. ABS builds redirect_uri as <origin><authOpenIDSubfolderForRedirectURLs>/auth/openid/callback, and that key is unset on a database created before SSO (the 2.17.4 migration only fills a DB that already had OIDC enabled), so the URL carried the literal string undefined. Arming through the API therefore has to send the value; it is the mounted base path, so it is derived from ABS_URL rather than becoming a second knob an operator has to keep in sync. authentik-audiobookshelf-sso.sh is the IdP half kept in git: provider, groups, the abs_groups scope mapping and the redirect URIs. That state lives in authentik's database, and a blueprint re-import reverts hand-made rows silently, so it needs a re-runnable door. Tokens are HS256 because no provider on the fleet carries a signing key, which makes the client secret the signature key. The stub server now records the auth-settings PATCH body, so the seam asserts the subfolder that reaches the wire follows ABS_URL for both the prefixed and root shapes, and a second seam pins that the provider script and the bootstrapper build the same redirect path.
This commit is contained in:
Frank committed
1 parent
cfdd3435bc
commit
393b77dfd2
3 files changed
+408
-8
No files matched your search
@@ -17,6 +17,10 @@
|
||||
# reported as success (a green deploy over a dead API is a lie);
|
||||
# 5. ABS_SCAN outside 0/1 is a usage error raised before anything is touched;
|
||||
# 6. the deployer runs the bootstrapper only after the health gate answered.
|
||||
# 7. the SSO arm sends the base path: ABS builds its redirect_uri as
|
||||
# <origin><authOpenIDSubfolderForRedirectURLs>/auth/openid/callback, and the
|
||||
# value must be the path the app is mounted under — never the literal
|
||||
# "undefined" a fresh database leaves there.
|
||||
|
||||
load helpers
|
||||
|
||||
@@ -29,7 +33,7 @@ import json, sys
|
||||
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
||||
|
||||
port, logf = int(sys.argv[1]), sys.argv[2]
|
||||
state = {"init": False, "user": None, "pw": None, "libs": []}
|
||||
state = {"init": False, "user": None, "pw": None, "libs": [], "oidc": None}
|
||||
|
||||
|
||||
def log(line):
|
||||
@@ -37,6 +41,12 @@ def log(line):
|
||||
f.write(line + "\n")
|
||||
|
||||
|
||||
def norm(p):
|
||||
# ABS mounts every route under ROUTER_BASE_PATH. The stub accepts the API at the
|
||||
# root or under that prefix, so a test can still assert which one the client used.
|
||||
return p[len("/audiobookshelf"):] if p.startswith("/audiobookshelf") else p
|
||||
|
||||
|
||||
class H(BaseHTTPRequestHandler):
|
||||
def log_message(self, *a):
|
||||
pass
|
||||
@@ -57,20 +67,24 @@ class H(BaseHTTPRequestHandler):
|
||||
return self.headers.get("Authorization") == "Bearer stub-token"
|
||||
|
||||
def do_GET(self):
|
||||
path = self.path.split("?")[0]
|
||||
path = norm(self.path.split("?")[0])
|
||||
log("GET %s auth=%s" % (self.path, "yes" if self.headers.get("Authorization") else "no"))
|
||||
if path == "/status":
|
||||
return self.send(200, {"app": "audiobookshelf", "isInit": state["init"]}, True)
|
||||
methods = ["local", "openid"] if state["oidc"] else ["local"]
|
||||
return self.send(200, {"app": "audiobookshelf", "isInit": state["init"],
|
||||
"authMethods": methods}, True)
|
||||
if not self.authed():
|
||||
return self.send(401, "Unauthorized")
|
||||
if path == "/api/libraries":
|
||||
return self.send(200, {"libraries": state["libs"]}, True)
|
||||
if path == "/api/auth-settings":
|
||||
return self.send(200, state["oidc"] or {}, True)
|
||||
if path.endswith("/items"):
|
||||
return self.send(200, {"total": 42, "results": []}, True)
|
||||
return self.send(404, "nope")
|
||||
|
||||
def do_POST(self):
|
||||
path = self.path.split("?")[0]
|
||||
path = norm(self.path.split("?")[0])
|
||||
payload = self.body()
|
||||
log("POST %s auth=%s" % (self.path, "yes" if self.headers.get("Authorization") else "no"))
|
||||
if path == "/init":
|
||||
@@ -101,6 +115,21 @@ class H(BaseHTTPRequestHandler):
|
||||
return self.send(200, "OK")
|
||||
return self.send(404, "nope")
|
||||
|
||||
def do_PATCH(self):
|
||||
path = norm(self.path.split("?")[0])
|
||||
payload = self.body()
|
||||
log("PATCH %s auth=%s" % (self.path, "yes" if self.headers.get("Authorization") else "no"))
|
||||
if not self.authed():
|
||||
return self.send(401, "Unauthorized")
|
||||
if path == "/api/auth-settings":
|
||||
# Stored and echoed verbatim: the test asserts the wire, not the stub's
|
||||
# opinion about which keys are patchable.
|
||||
state["oidc"] = payload
|
||||
for k in sorted(payload):
|
||||
log("OIDCFG %s=%r" % (k, payload[k]))
|
||||
return self.send(200, payload, True)
|
||||
return self.send(404, "nope")
|
||||
|
||||
|
||||
ThreadingHTTPServer(("127.0.0.1", port), H).serve_forever()
|
||||
PY
|
||||
@@ -198,3 +227,50 @@ boot() {
|
||||
/audiobookshelf-init\.sh/ { init = NR }
|
||||
END { exit !(health && init && init > health) }'
|
||||
}
|
||||
|
||||
@test "the SSO arm sends the base path as the redirect subfolder" {
|
||||
# What authentik has registered must equal what ABS builds:
|
||||
# <origin><authOpenIDSubfolderForRedirectURLs>/auth/openid/callback. A database
|
||||
# created before SSO leaves that key unset and ABS then sends the literal
|
||||
# "/undefined/auth/openid/callback" — measured 2026-11-02, where the live login died
|
||||
# on authentik's "Redirect URI Error" page. So the value has to reach the wire, and
|
||||
# it has to be the path the app is served under.
|
||||
umask 077
|
||||
cat > "$TMP/cred" <<'CRED'
|
||||
ABS_ADMIN_USER=frank
|
||||
ABS_ADMIN_PASSWORD=0123456789abcdef0123456789
|
||||
ABS_OIDC_CLIENT_SECRET=0123456789abcdef0123456789abcdef0123456789abcdef0123456789
|
||||
CRED
|
||||
run env ABS_URL="http://127.0.0.1:$PORT/audiobookshelf" ABS_SECRET="$TMP/cred" \
|
||||
ABS_SCAN=0 bash "$INIT"
|
||||
[ "$status" -eq 0 ]
|
||||
printf '%s\n' "${lines[@]}" | grep -q "^oidc: armed"
|
||||
grep -q "^OIDCFG authOpenIDSubfolderForRedirectURLs='/audiobookshelf'$" "$TMP/requests.log"
|
||||
# every route the bootstrapper calls rides under the same prefix it armed with
|
||||
grep -q "^POST /audiobookshelf/init auth=no$" "$TMP/requests.log"
|
||||
grep -q "^GET /audiobookshelf/api/auth-settings auth=yes$" "$TMP/requests.log"
|
||||
|
||||
# A root-mounted deployment sends the EMPTY subfolder (the value the 2.17.4 upgrade
|
||||
# uses), not whatever the last URL happened to carry.
|
||||
run env ABS_URL="http://127.0.0.1:$PORT" ABS_SECRET="$TMP/cred" ABS_SCAN=0 bash "$INIT"
|
||||
[ "$status" -eq 0 ]
|
||||
[ "$(grep "^OIDCFG authOpenIDSubfolderForRedirectURLs=" "$TMP/requests.log" | tail -1)" \
|
||||
= "OIDCFG authOpenIDSubfolderForRedirectURLs=''" ]
|
||||
}
|
||||
|
||||
@test "the app and the IdP provider script build the same redirect path" {
|
||||
# The provider row is written by scripts/authentik-audiobookshelf-sso.sh from
|
||||
# ABS_BASE; the app builds its redirect_uri from the base path the deployer hands
|
||||
# audiobookshelf-init.sh, which comes from the unit. Drift between the two is a
|
||||
# redirect_uri mismatch — the login dies at the IdP before any credential is issued.
|
||||
unit="$REPO_ROOT/dankserver/audiobookshelf/quadlet/audiobookshelf.container"
|
||||
mounted=$(awk -F= '/^Environment=ROUTER_BASE_PATH=/{print $3}' "$unit")
|
||||
[ -n "$mounted" ]
|
||||
provider=$(grep -m1 '^BASE=' "$REPO_ROOT/scripts/authentik-audiobookshelf-sso.sh" \
|
||||
| grep -oE 'https?://[^"}]+')
|
||||
bootstrapper=$(grep -m1 '^ABS_URL=' "$INIT" | grep -oE 'https?://[^"}]+')
|
||||
# Origins legitimately differ (LAN address vs loopback); the PATH must not.
|
||||
[ "${provider#http://192.168.0.235:8000}/auth/openid/callback" \
|
||||
= "${bootstrapper#http://127.0.0.1:8000}/auth/openid/callback" ]
|
||||
[ "${bootstrapper#http://127.0.0.1:8000}" = "$mounted" ]
|
||||
}
|
||||
Reference in new issue
Block a user