dank
aa57c1a894
The mobile-redirect URI was registered on the LAN origin only, because the phone had to be configured with the LAN address while the vhost was guarded. Now that the app rides the public name it sends the public mobile-redirect URI, and the RP's STRICT matching answers an unregistered one with "Redirect URI Error" — a phone locked out at the last step of a login that looked healthy. Both callback URIs are now emitted for every entry in BASES.
265 lines
15 KiB
Bash
Executable File
265 lines
15 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# authentik-audiobookshelf-sso.sh — provision the authentik side of Audiobookshelf SSO.
|
|
#
|
|
# Why a script: this state lives in authentik's DATABASE, not in any repo file, and a
|
|
# blueprint re-import or a rebuild-from-scratch reverts hand-made provider rows
|
|
# silently. Same reasoning (and same door) as
|
|
# authentik-set-login-session-duration.sh: ssh into Dankclaw, `ak shell` from stdin.
|
|
# Re-run this after such a rebuild.
|
|
#
|
|
# The contract with Audiobookshelf, read off the pinned image (2.37.2,
|
|
# dist-server/server/auth/OidcAuthStrategy.js + objects/settings/ServerSettings.js)
|
|
# rather than a forum, because each of these is a dead-login trap:
|
|
#
|
|
# * Two URIs per origin ABS is reached at — <base>/auth/openid/callback and
|
|
# <base>/auth/openid/mobile-redirect — for EVERY entry in BASES (the LAN address
|
|
# and the public vhost). ABS SWAPS the app's own audiobookshelf://oauth for the
|
|
# mobile-redirect URL before the IdP ever sees a redirect_uri, so registering the
|
|
# app scheme with authentik — the obvious move — is what makes phone logins fail.
|
|
# The app scheme belongs in ABS's authOpenIDMobileRedirectURIs list (its built-in
|
|
# default), not here. The mobile URI exists on every origin because the app sends
|
|
# the one belonging to the door it was configured with: the vhost started serving
|
|
# non-browser clients on 2026-11-03 (it left the guard chain), so a phone pointed
|
|
# at the public name sends the public mobile-redirect URI, and STRICT matching
|
|
# answers an unregistered one with "Redirect URI Error".
|
|
# * <base> CARRIES THE BASE PATH. ABS builds redirect_uri as
|
|
# <origin><authOpenIDSubfolderForRedirectURLs>/auth/openid/callback, and that subfolder is
|
|
# the ROUTER_BASE_PATH the container is mounted at — /audiobookshelf, which is also the only
|
|
# base path the shipped SPA can boot under. Left unset (the fresh-DB default) the URL
|
|
# becomes "/undefined/…"; a provider registered without the prefix mismatches the same way
|
|
# (measured 2026-11-02, "Redirect URI Error"). audiobookshelf-init.sh derives its copy from
|
|
# ABS_URL, so the two sides each move with one variable.
|
|
# * ABS requests the scopes "openid profile email <GroupClaim> [<PermsClaim>]": the
|
|
# CLAIM NAME is a scope name. So authentik needs a scope mapping whose scope_name
|
|
# is exactly the claim name, or the claim never arrives and the callback dies on
|
|
# "Group claim <name> not found in userinfo".
|
|
# * the claim's VALUES must be ABS role names — the callback picks the first of
|
|
# ['admin','user','guest'] present in the list. Group names like
|
|
# audiobookshelf_admins are therefore translated by the mapping, never passed
|
|
# through. A user in neither group gets [] and is denied (fail closed).
|
|
# * tokens are HS256 here: no provider on this box carries a signing_key (census
|
|
# 2026-11-02), which makes the client secret the signature key. ABS's own default
|
|
# is RS256, so the ABS side MUST be set to HS256 or every id_token fails
|
|
# verification.
|
|
# * provider.authorization_flow must be non-NULL or /application/o/authorize/
|
|
# answers a 500 with 'NoneType' object has no attribute 'slug' (measured on
|
|
# grafana, same authentik build).
|
|
# * provider.grant_types MUST contain authorization_code. authentik 2026.8 defaults an
|
|
# ORM-created provider to the EMPTY list, and /application/o/authorize/ then refuses the
|
|
# code flow with oauthlib's generic "The request is otherwise malformed"; the only line
|
|
# that names the cause is the server log's 'Invalid grant_type for provider'. The
|
|
# redirect-URI check runs FIRST, so a provider carrying both faults shows only the URI
|
|
# error until the URI is fixed (measured 2026-11-02, where the login survived the URI fix
|
|
# and died here).
|
|
# * property_mappings must carry the built-in OpenID scope mappings ('openid', 'profile',
|
|
# 'email') alongside the claim mapping. A provider holding only the claim mapping grants a
|
|
# token scoped shorter than the scopes ABS requests, and ABS's /userinfo call then dies
|
|
# 'insufficient_scope (The request requires higher privileges than provided by the access
|
|
# token)' after authentik has already issued a good code (measured 2026-11-02).
|
|
#
|
|
# Idempotent: every object is created or asserted. Safe to re-run.
|
|
#
|
|
# usage: ABS_OIDC_CLIENT_SECRET=<secret> authentik-audiobookshelf-sso.sh
|
|
# (the secret is the value stored in
|
|
# /home/dank/.config/secrets/audiobookshelf on Dankserver — get it with
|
|
# ssh dankserver awk -F= '/^ABS_OIDC_CLIENT_SECRET=/{print $2}' \
|
|
# ~/.config/secrets/audiobookshelf)
|
|
#
|
|
# environment:
|
|
# ABS_OIDC_CLIENT_SECRET REQUIRED. The provider's client secret.
|
|
# ABS_OIDC_CLIENT_ID provider/client id (audiobookshelf)
|
|
# ABS_OIDC_GROUPS_CLAIM claim ABS reads for roles (abs_groups)
|
|
# ABS_OIDC_USERNAME authentik user made admin (akadmin)
|
|
# ABS_OIDC_USERS space-separated authentik usernames given the USER group
|
|
# (default: nobody — an empty list is fail-closed, and the
|
|
# household decides who listens to audiobooks)
|
|
# ABS_E2E_ADMIN authentik user kept in the ADMIN group for the Playwright gate
|
|
# (qa-e2e-admin — tests/e2e/specs/23-audiobookshelf-sso.spec.ts
|
|
# signs in as this identity, so a re-run restores the fixture)
|
|
# ABS_BASE ABS URL as the browser sees it, base path included
|
|
# (http://192.168.0.235:8000/audiobookshelf — the LAN
|
|
# origin, reached directly, which is also what the phone
|
|
# app is configured with)
|
|
# ABS_EXTRA_BASES space-separated additional origins, base path included
|
|
# (default: https://audiobooks.franksdank.cloud/audiobookshelf
|
|
# — the guarded vhost, dankclaw/Caddyfile).
|
|
# ABS builds its redirect_uri from the ORIGIN of the
|
|
# request, so each origin the app is served at needs its
|
|
# own registered URI — an unregistered origin is a
|
|
# redirect_uri_mismatch at the IdP, before any credential.
|
|
# Set it empty to register the LAN origin alone.
|
|
# AUTHENTIK_HOST ssh target (dankclaw)
|
|
set -euo pipefail
|
|
|
|
SECRET="${ABS_OIDC_CLIENT_SECRET:?set ABS_OIDC_CLIENT_SECRET (see the header)}"
|
|
[ "${#SECRET}" -ge 32 ] || { echo "refused: ABS_OIDC_CLIENT_SECRET is too short to be a secret" >&2; exit 2; }
|
|
|
|
CLIENT_ID="${ABS_OIDC_CLIENT_ID:-audiobookshelf}"
|
|
CLAIM="${ABS_OIDC_GROUPS_CLAIM:-abs_groups}"
|
|
ADMIN_GROUP="audiobookshelf_admins"
|
|
USER_GROUP="audiobookshelf_users"
|
|
SSO_USER="${ABS_OIDC_USERNAME:-akadmin}"
|
|
MEMBERS="${ABS_OIDC_USERS:-}"
|
|
E2E_ADMIN="${ABS_E2E_ADMIN:-qa-e2e-admin}"
|
|
BASE="${ABS_BASE:-http://192.168.0.235:8000/audiobookshelf}"
|
|
EXTRA_BASES="${ABS_EXTRA_BASES:-https://audiobooks.franksdank.cloud/audiobookshelf}"
|
|
HOST="${AUTHENTIK_HOST:-dankclaw}"
|
|
|
|
# The claim expression: translate group membership into ABS role names. It is stored
|
|
# verbatim so a later read of the provider shows exactly this policy.
|
|
read -r -d '' EXPR <<PYEXPR || true
|
|
groups = {g.name for g in user.groups.all()}
|
|
roles = []
|
|
if "$ADMIN_GROUP" in groups:
|
|
roles.append("admin")
|
|
if groups & {"$ADMIN_GROUP", "$USER_GROUP"}:
|
|
roles.append("user")
|
|
return {"$CLAIM": roles}
|
|
PYEXPR
|
|
|
|
ssh "$HOST" 'podman exec -i authentik-server ak shell' <<PYEOF
|
|
from authentik.core.models import Application, Group, User
|
|
from authentik.flows.models import Flow
|
|
from authentik.providers.oauth2.models import (
|
|
ClientType, OAuth2Provider, RedirectURI, RedirectURIMatchingMode, RedirectURIType, ScopeMapping)
|
|
|
|
ADMIN_GROUP, USER_GROUP = "$ADMIN_GROUP", "$USER_GROUP"
|
|
CLAIM, CLIENT_ID, SECRET, BASE = "$CLAIM", "$CLIENT_ID", "$SECRET", "$BASE"
|
|
BASES = [BASE] + """$EXTRA_BASES""".split()
|
|
SSO_USER, E2E_ADMIN = "$SSO_USER", "$E2E_ADMIN"
|
|
MEMBERS = """$MEMBERS""".split()
|
|
EXPR = '''$EXPR'''
|
|
# The expression reads user.groups, NOT user.ak_groups: authentik 2026.8 logs
|
|
# "User.ak_groups is deprecated … use User.groups" on every evaluation of the old
|
|
# name (measured on this run), and a stored mapping that leans on a deprecated
|
|
# accessor is a future upgrade failure sitting inside the login path.
|
|
|
|
for name in (ADMIN_GROUP, USER_GROUP):
|
|
Group.objects.get_or_create(name=name)
|
|
admin_g, user_g = Group.objects.get(name=ADMIN_GROUP), Group.objects.get(name=USER_GROUP)
|
|
|
|
# --- the claim mapping (scope_name IS the claim name ABS requests) ---------------
|
|
mapping = ScopeMapping.objects.filter(name="audiobookshelf-groups").first()
|
|
if mapping is None:
|
|
mapping = ScopeMapping.objects.create(name="audiobookshelf-groups", scope_name=CLAIM,
|
|
expression=EXPR,
|
|
description="Audiobookshelf role names from group membership")
|
|
print("mapping: created (scope_name %s)" % CLAIM)
|
|
elif mapping.scope_name != CLAIM or mapping.expression != EXPR:
|
|
mapping.scope_name, mapping.expression = CLAIM, EXPR
|
|
mapping.save(update_fields=["scope_name", "expression"])
|
|
print("mapping: scope/expression updated (scope_name %s)" % CLAIM)
|
|
else:
|
|
print("mapping: already current")
|
|
|
|
# Prove the expression runs and yields an ABS role BEFORE anyone tries to log in:
|
|
# authentik execs the expression inside a function whose context has `user`.
|
|
_src = "def _probe(user, request=None):\n" + "".join(" %s\n" % ln for ln in EXPR.splitlines())
|
|
_ns = {}
|
|
exec(_src, _ns)
|
|
|
|
# --- provider --------------------------------------------------------------------
|
|
# One callback pair per origin (LAN address and the public vhost): ABS derives the
|
|
# browser callback from the request origin and the mobile callback from the door the
|
|
# app was configured with, so each origin needs both or that door cannot sign in.
|
|
uris = [RedirectURI(matching_mode=RedirectURIMatchingMode.STRICT, url="%s%s" % (b, p))
|
|
for b in BASES
|
|
for p in ("/auth/openid/callback", "/auth/openid/mobile-redirect")]
|
|
authz_flow = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
|
|
|
|
# Three things beyond the name, each one a silent dead login: the grant-type list (2026.8
|
|
# defaults it empty), the built-in OpenID scope mappings beside the claim mapping, and the
|
|
# redirect URIs with the base path baked in.
|
|
GRANTS = ["authorization_code", "refresh_token"]
|
|
BUILTIN_SCOPES = ["authentik default OAuth Mapping: OpenID 'openid'",
|
|
"authentik default OAuth Mapping: OpenID 'profile'",
|
|
"authentik default OAuth Mapping: OpenID 'email'"]
|
|
scoped = {m.pk: m for m in ScopeMapping.objects.filter(name__in=BUILTIN_SCOPES)}
|
|
scoped[mapping.pk] = mapping
|
|
_have = {m.name for m in scoped.values()}
|
|
if len(_have) < len(BUILTIN_SCOPES):
|
|
print("scope mappings: NOT PROVIDED by this authentik install: %s"
|
|
% ", ".join(sorted(set(BUILTIN_SCOPES) - _have)))
|
|
|
|
p = OAuth2Provider.objects.filter(name="audiobookshelf").first()
|
|
if p is None:
|
|
p = OAuth2Provider(name="audiobookshelf", client_id=CLIENT_ID,
|
|
client_type=ClientType.CONFIDENTIAL, client_secret=SECRET,
|
|
authorization_flow=authz_flow, grant_types=list(GRANTS))
|
|
p.redirect_uris = uris
|
|
p.save()
|
|
p.property_mappings.set(list(scoped.values()))
|
|
print("provider: created (grant_types %s)" % GRANTS)
|
|
else:
|
|
changed = []
|
|
if p.client_id != CLIENT_ID:
|
|
p.client_id = CLIENT_ID
|
|
changed.append("client_id")
|
|
if p.client_secret != SECRET:
|
|
p.client_secret = SECRET
|
|
changed.append("client_secret")
|
|
if p.authorization_flow_id != authz_flow.pk:
|
|
p.authorization_flow = authz_flow
|
|
changed.append("authorization_flow")
|
|
if list(p.grant_types) != GRANTS:
|
|
p.grant_types = list(GRANTS)
|
|
changed.append("grant_types")
|
|
if [(u.url, str(u.matching_mode)) for u in p.redirect_uris] != \
|
|
[(u.url, str(u.matching_mode)) for u in uris]:
|
|
p.redirect_uris = uris
|
|
changed.append("redirect_uris")
|
|
if changed:
|
|
p.save()
|
|
if sorted(m.pk for m in p.property_mappings.all()) != sorted(scoped):
|
|
p.property_mappings.set(list(scoped.values()))
|
|
changed.append("property_mappings")
|
|
print("provider: asserted (%s)" % (", ".join(changed) or "nothing to change"))
|
|
|
|
# --- application (the launchpad entry; binds the provider) ------------------------
|
|
app = Application.objects.filter(slug="audiobookshelf").first()
|
|
if app is None:
|
|
app = Application.objects.create(name="audiobookshelf", slug="audiobookshelf",
|
|
provider=p, meta_launch_url=BASE)
|
|
print("application: created")
|
|
elif app.provider_id != p.pk or app.meta_launch_url != BASE:
|
|
app.provider, app.meta_launch_url = p, BASE
|
|
app.save(update_fields=["provider", "meta_launch_url"])
|
|
print("application: asserted")
|
|
else:
|
|
print("application: already bound")
|
|
|
|
# --- membership --------------------------------------------------------------------
|
|
root = User.objects.get(username=SSO_USER)
|
|
root.groups.add(admin_g)
|
|
# The deploy gate's Playwright spec signs in as this identity, so the admin fixture is
|
|
# provisioned with the rest: a blueprint re-import that drops it fails the gate, not a phone.
|
|
e2e = User.objects.filter(username=E2E_ADMIN).first()
|
|
if e2e is None:
|
|
print("e2e fixture: authentik user %s absent — the e2e SSO spec will fail" % E2E_ADMIN)
|
|
else:
|
|
e2e.groups.add(admin_g)
|
|
print("e2e fixture: %s in %s" % (E2E_ADMIN, ADMIN_GROUP))
|
|
print("admin: %s in %s" % (SSO_USER, ADMIN_GROUP))
|
|
for name in MEMBERS:
|
|
u = User.objects.get(username=name)
|
|
u.groups.add(user_g)
|
|
print("users: %s in %s" % (", ".join(MEMBERS) or "(none — fail closed)", USER_GROUP))
|
|
|
|
# --- verification: the claim the callback will actually receive ---------------------
|
|
for probe in [root] + ([e2e] if e2e else []) + [User.objects.get(username=n) for n in MEMBERS]:
|
|
print("claim for %s -> %s" % (probe.username, _ns["_probe"](user=probe, request=None)))
|
|
p.refresh_from_db()
|
|
print("provider %s | client_id %s | flow %s | grants %s | uris %s" % (
|
|
p.name, p.client_id, p.authorization_flow.slug, list(p.grant_types),
|
|
[u.url for u in p.redirect_uris]))
|
|
print("scopes: %s" % sorted(m.scopemapping.scope_name for m in p.property_mappings.all()))
|
|
PYEOF
|
|
|
|
cat <<DONE
|
|
|
|
Next: arm the Audiobookshelf side (issuer, client, HS256, claim) —
|
|
ssh dankserver 'ABS_OIDC=1 bash /home/dank/serverAppConfigs/scripts/audiobookshelf-init.sh'
|
|
It reads the same secret from /home/dank/.config/secrets/audiobookshelf and verifies
|
|
/status answers openid among its auth methods.
|
|
DONE
|