From 48b0873ca3968070e71cbd056007955075cd8344 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Sat, 24 Oct 2026 13:19:52 +0200 Subject: [PATCH] authentik: add an OIDC provider for immich The Scouting MBG photos (immich) will log in through this authentik, which later passes on Scouts Online. The provider issues immich_role and immich_quota: admins and the members of "MBG kader" may upload (-1), everyone else gets a quota of 0, which makes immich refuse uploads. "MBG leden" and "MBG kader" are filled by the Scouts Online source in a next step; until then only authentik Admins can use the app. The scouting blueprints and their secrets are mounted as directories rather than with subPath, and the blueprint reads the client secret with !File instead of !Env, so later changes reach authentik without a restart. --- apps/templates/authentik-helm.yaml | 40 +++++++++++++ authentik/blueprint-scouting.yaml | 95 ++++++++++++++++++++++++++++++ authentik/external-secret.yaml | 19 ++++++ 3 files changed, 154 insertions(+) create mode 100644 authentik/blueprint-scouting.yaml diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml index 11006fd..1602511 100644 --- a/apps/templates/authentik-helm.yaml +++ b/apps/templates/authentik-helm.yaml @@ -127,6 +127,21 @@ spec: - name: blueprint-longhorn configMap: name: authentik-blueprint-longhorn + # Directory mounts, not subPath, so changes reach the pods + # without a restart. The secrets are optional: a blueprint + # that needs a missing one fails until it shows up. + - name: blueprint-scouting + configMap: + name: authentik-blueprint-scouting + - name: scouting-secrets + projected: + sources: + - secret: + name: immich-oidc-client-secret + optional: true + items: + - key: client_secret + path: immich-oidc-client-secret volumeMounts: - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml @@ -152,6 +167,11 @@ spec: - name: blueprint-longhorn mountPath: /blueprints/custom/longhorn-oidc.yaml subPath: longhorn-oidc.yaml + - name: blueprint-scouting + mountPath: /blueprints/custom/scouting + - name: scouting-secrets + mountPath: /secrets/scouting + readOnly: true - name: patched-ca-bundle mountPath: /etc/ssl/certs readOnly: true @@ -184,6 +204,21 @@ spec: - name: blueprint-longhorn configMap: name: authentik-blueprint-longhorn + # Directory mounts, not subPath, so changes reach the pods + # without a restart. The secrets are optional: a blueprint + # that needs a missing one fails until it shows up. + - name: blueprint-scouting + configMap: + name: authentik-blueprint-scouting + - name: scouting-secrets + projected: + sources: + - secret: + name: immich-oidc-client-secret + optional: true + items: + - key: client_secret + path: immich-oidc-client-secret volumeMounts: - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml @@ -209,6 +244,11 @@ spec: - name: blueprint-longhorn mountPath: /blueprints/custom/longhorn-oidc.yaml subPath: longhorn-oidc.yaml + - name: blueprint-scouting + mountPath: /blueprints/custom/scouting + - name: scouting-secrets + mountPath: /secrets/scouting + readOnly: true - name: patched-ca-bundle mountPath: /etc/ssl/certs readOnly: true diff --git a/authentik/blueprint-scouting.yaml b/authentik/blueprint-scouting.yaml new file mode 100644 index 0000000..d83bfc3 --- /dev/null +++ b/authentik/blueprint-scouting.yaml @@ -0,0 +1,95 @@ +# Login for the Scouting MBG photos (immich on foto.scoutingmbg.nl). +# Mounted as a directory, unlike the other blueprints, so authentik picks up +# changes without a restart; secrets come from files in /secrets/scouting +# for the same reason (see apps/templates/authentik-helm.yaml). +apiVersion: v1 +kind: ConfigMap +metadata: + name: authentik-blueprint-scouting +data: + immich-oidc.yaml: | + version: 1 + metadata: + name: immich OIDC + entries: + # Filled by the Scouts Online source on every login: every member, and + # the members with an active Kaderlid role. + - model: authentik_core.group + id: mbg-leden + state: present + identifiers: + name: MBG leden + - model: authentik_core.group + id: mbg-kader + state: present + identifiers: + name: MBG kader + # immich syncs both claims on every login. A quota of 0 makes immich + # refuse uploads, -1 means unlimited. + - model: authentik_providers_oauth2.scopemapping + id: immich-scope + state: present + identifiers: + name: "immich: role and quota" + attrs: + name: "immich: role and quota" + scope_name: immich + description: Upload rights in the Scouting MBG photos + expression: | + admin = ak_is_group_member(request.user, name="authentik Admins") + uploader = admin or ak_is_group_member(request.user, name="MBG kader") + return { + "immich_role": "admin" if admin else "user", + "immich_quota": -1 if uploader else 0, + } + - model: authentik_providers_oauth2.oauth2provider + id: immich-provider + state: present + identifiers: + name: immich + attrs: + name: immich + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: confidential + client_id: immich + client_secret: !File /secrets/scouting/immich-oidc-client-secret + redirect_uris: + - matching_mode: strict + url: https://foto.scoutingmbg.nl/auth/login + # "Link to OAuth" in immich's account settings + - matching_mode: strict + url: https://foto.scoutingmbg.nl/user-settings + - matching_mode: strict + url: app.immich:///oauth-callback + signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]] + property_mappings: + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] + - !KeyOf immich-scope + - model: authentik_core.application + id: immich-app + state: present + identifiers: + slug: immich + attrs: + name: Scouting MBG foto's + provider: !KeyOf immich-provider + meta_launch_url: https://foto.scoutingmbg.nl + policy_engine_mode: any + - model: authentik_policies.policybinding + state: present + identifiers: + order: 0 + target: !KeyOf immich-app + attrs: + group: !KeyOf mbg-leden + - model: authentik_policies.policybinding + state: present + identifiers: + order: 1 + target: !KeyOf immich-app + attrs: + group: !Find [authentik_core.group, [name, "authentik Admins"]] diff --git a/authentik/external-secret.yaml b/authentik/external-secret.yaml index d4e10ec..d70dd54 100644 --- a/authentik/external-secret.yaml +++ b/authentik/external-secret.yaml @@ -153,3 +153,22 @@ spec: remoteRef: key: kv/longhorn-oidc property: client_secret +--- +# Mounted as a file for blueprint-scouting.yaml, not as an env variable. +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: immich-oidc-client-secret +spec: + secretStoreRef: + name: vault-backend + kind: ClusterSecretStore + refreshInterval: 15m + target: + name: immich-oidc-client-secret + creationPolicy: Owner + data: + - secretKey: client_secret + remoteRef: + key: kv/immich-oidc + property: client_secret