From 278f6fc55fc6b82d0f082042f42dd456f13b1976 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Sat, 24 Oct 2026 13:04:33 +0200 Subject: [PATCH] authentik: limit personal apps to authentik Admins Actual Budget, Argo CD, FreshRSS, Stalwart and Vault had no policy binding, so any authentik user could sign in to them. Scouts Online members are about to get accounts in this authentik for immich; bind each app to the authentik Admins group, as Longhorn already was. --- authentik/blueprint-actualbudget-proxy.yaml | 9 +++++++++ authentik/blueprint-argocd-oidc.yaml | 9 +++++++++ authentik/blueprint-freshrss-oidc.yaml | 9 +++++++++ authentik/blueprint-mail-oidc.yaml | 9 +++++++++ authentik/blueprint-vault-oidc.yaml | 9 +++++++++ 5 files changed, 45 insertions(+) diff --git a/authentik/blueprint-actualbudget-proxy.yaml b/authentik/blueprint-actualbudget-proxy.yaml index 410d764..cd526f5 100644 --- a/authentik/blueprint-actualbudget-proxy.yaml +++ b/authentik/blueprint-actualbudget-proxy.yaml @@ -38,3 +38,12 @@ data: name: Actual Budget provider: !KeyOf actualbudget-provider meta_launch_url: https://ynab.rubenhensen.nl + # Only admins: Scouts Online members get accounts in this authentik + # too (for immich) and must not reach personal apps. + - model: authentik_policies.policybinding + state: present + identifiers: + order: 0 + target: !KeyOf actualbudget-app + attrs: + group: !Find [authentik_core.group, [name, "authentik Admins"]] diff --git a/authentik/blueprint-argocd-oidc.yaml b/authentik/blueprint-argocd-oidc.yaml index 61a0bed..2c5486e 100644 --- a/authentik/blueprint-argocd-oidc.yaml +++ b/authentik/blueprint-argocd-oidc.yaml @@ -38,3 +38,12 @@ data: name: ArgoCD provider: !KeyOf argocd-provider meta_launch_url: https://argocd.rubenhensen.nl + # Only admins: Scouts Online members get accounts in this authentik + # too (for immich) and must not reach personal apps. + - model: authentik_policies.policybinding + state: present + identifiers: + order: 0 + target: !KeyOf argocd-app + attrs: + group: !Find [authentik_core.group, [name, "authentik Admins"]] diff --git a/authentik/blueprint-freshrss-oidc.yaml b/authentik/blueprint-freshrss-oidc.yaml index 9c47ea3..65b88f7 100644 --- a/authentik/blueprint-freshrss-oidc.yaml +++ b/authentik/blueprint-freshrss-oidc.yaml @@ -40,3 +40,12 @@ data: name: FreshRSS provider: !KeyOf freshrss-provider meta_launch_url: https://rss.rubenhensen.nl + # Only admins: Scouts Online members get accounts in this authentik + # too (for immich) and must not reach personal apps. + - model: authentik_policies.policybinding + state: present + identifiers: + order: 0 + target: !KeyOf freshrss-app + attrs: + group: !Find [authentik_core.group, [name, "authentik Admins"]] diff --git a/authentik/blueprint-mail-oidc.yaml b/authentik/blueprint-mail-oidc.yaml index 1fe82b4..468a429 100644 --- a/authentik/blueprint-mail-oidc.yaml +++ b/authentik/blueprint-mail-oidc.yaml @@ -38,3 +38,12 @@ data: name: Stalwart Mail provider: !KeyOf stalwart-provider meta_launch_url: https://mail.rubenhensen.nl + # Only admins: Scouts Online members get accounts in this authentik + # too (for immich) and must not reach personal apps. + - model: authentik_policies.policybinding + state: present + identifiers: + order: 0 + target: !KeyOf stalwart-app + attrs: + group: !Find [authentik_core.group, [name, "authentik Admins"]] diff --git a/authentik/blueprint-vault-oidc.yaml b/authentik/blueprint-vault-oidc.yaml index dcdd204..93c4411 100644 --- a/authentik/blueprint-vault-oidc.yaml +++ b/authentik/blueprint-vault-oidc.yaml @@ -40,3 +40,12 @@ data: name: Vault provider: !KeyOf vault-provider meta_launch_url: https://vault.rubenhensen.nl + # Only admins: Scouts Online members get accounts in this authentik + # too (for immich) and must not reach personal apps. + - model: authentik_policies.policybinding + state: present + identifiers: + order: 0 + target: !KeyOf vault-app + attrs: + group: !Find [authentik_core.group, [name, "authentik Admins"]]