From 65dec6a80e8519e2eda4553bf3736502615eb17e Mon Sep 17 00:00:00 2001 From: Frank Date: Fri, 9 Oct 2026 11:49:58 -0700 Subject: [PATCH] docs(authentik): provision kirby/ry/nic/debo/freya (pk 17-21); OWU pending-role first-login flip law --- serverAppConfigs-docs/Dankclaw/OpenWebUI.md | 12 ++++++++++++ .../Infrastructure/Authentik.md | 5 +++-- serverAppConfigs-docs/log.md | 19 +++++++++++++++++++ 3 files changed, 34 insertions(+), 2 deletions(-) diff --git a/serverAppConfigs-docs/Dankclaw/OpenWebUI.md b/serverAppConfigs-docs/Dankclaw/OpenWebUI.md index d895813..cb70044 100644 --- a/serverAppConfigs-docs/Dankclaw/OpenWebUI.md +++ b/serverAppConfigs-docs/Dankclaw/OpenWebUI.md @@ -184,6 +184,18 @@ browser-driven and only touches the two exempt vhosts (`ai.` and `auth.`). into the existing local account with the same email — the pre-SSO admin (frank8465@protonmail.com) keeps its data. `ENABLE_OAUTH_SIGNUP=true` lets other `openwebui_users` create accounts on first login. +- **First login mints role `pending`.** `ui.default_user_role=pending` (config + DB, verified 2026-10-09), so a freshly-provisioned `openwebui_users` account + completes SSO and then cannot chat (picker empty) until its role is flipped: + `UPDATE "user" SET role='user' WHERE email='@franksdank.cloud';` — + run with host `python3` over ssh against + `/home/dank/Containers/open-webui/data/webui.db` (no `sqlite3` CLI on + Dankclaw; table is `user`, singular; no `active` column). No per-user model + grant is needed: the picker model `frank-secondary` carries the global + `access_grant` row `(model, frank-secondary, user, *, read)`, so any + `role='user'` account sees it. Flip on FIRST-LOGIN SIGHTING — the row does + not exist until the account signs in (2026-10-09: five provisioned accounts + had no row). - **IdP reachability:** the container is on its own bridge (10.89.3.0/24) and cannot reach `authentik-server:9000` by name. It reaches the IdP over the public URL `https://auth.franksdank.cloud` — Caddy publishes `0.0.0.0:443` diff --git a/serverAppConfigs-docs/Infrastructure/Authentik.md b/serverAppConfigs-docs/Infrastructure/Authentik.md index 9fc8f26..851a407 100644 --- a/serverAppConfigs-docs/Infrastructure/Authentik.md +++ b/serverAppConfigs-docs/Infrastructure/Authentik.md @@ -451,8 +451,9 @@ access is decided entirely by GROUP MEMBERSHIP consumed downstream — (filter `(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`). - `Non-Admin Users` = the plain-user marker group (precedents: qa-e2e, and every human account). -- **The human-user template** (ridley, kassie, alex, artem — kassie and alex - created 2026-10-08, artem (pk 16) created 2026-10-07): `username` + +- **The human-user template** (ridley, kassie, alex, artem, kirby, ry, nic, + debo, freya — kirby/ry/nic/debo/freya (pk 17–21) created 2026-10-09, kassie + and alex created 2026-10-08, artem (pk 16) created 2026-10-07): `username` + `@franksdank.cloud` + display name + `is_active=True` + the password set via `set_password`, membership in `Non-Admin Users` + `jellyfin_users` + `openwebui_users`. `alex` was diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md index f06208b..e494c25 100644 --- a/serverAppConfigs-docs/log.md +++ b/serverAppConfigs-docs/log.md @@ -1,5 +1,24 @@ # Bundle Change Log +## 2026-10-09 +- **Live — five authentik human accounts provisioned (Dankclaw, `ak shell` + ORM, no repo objects):** kirby (pk 17), ry (18), nic (19), debo (20), + freya (21), each `@franksdank.cloud` in the human-user template shape + (`is_active=True`, password via `set_password` on stdin only, groups + `Non-Admin Users` + `jellyfin_users` + `openwebui_users`). Verified through + the exact PasswordStage code path (`authenticate()` accepts each password and + rejects a wrong one) and `app_entitlements(open-webui)` → `Open WebUI Users` + for all five (identical to the ridley precedent). No `proxysession` rows + existed for them — groups were set before any login, so no claim purge was + due. Downstream: Jellyfin visibility rides the LDAP outpost cache (expect + lag); OpenWebUI mints their accounts as role `pending` on first login. +- `/serverAppConfigs-docs/Infrastructure/Authentik.md` — human-user template + census extended with pk 17–21. +- `/serverAppConfigs-docs/Dankclaw/OpenWebUI.md` — new SSO bullet: first login + lands as role `pending` (`ui.default_user_role=pending` in the config DB), + the role-flip SQL, and the global `access_grant` (`principal_id='*'`) fact + that makes the picker model visible to every `role='user'` account. + ## 2026-10-08 - **frank-primary (Dankserver): Swift1.5-Qwen3.8-Flash-Next GPTQ w4 — the radiance quantization campaign.** ukisai's BF16 checkpoint (335.3