From b01e4c32419891f55573201ad4c39761815977b8 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 16:10:30 +1000 Subject: [PATCH] Rewrite slash-less Authentik token endpoint to the canonical path (#478) Authentik advertises the token endpoint with a trailing slash, but some OIDC clients (the ArgoCD iOS app) POST to /application/o/token without one; Django's APPEND_SLASH will not redirect a POST, so the token exchange gets 405 and login fails. - Add an exact-match rule on /application/o/token to the authentik and authentik-internal HTTPRoutes. - Rewrite it to /application/o/token/ with a URLRewrite ReplaceFullPath filter, preserving the method and the authentik-server backend. - Leave the catch-all PathPrefix rule untouched; exact matches outrank it in Gateway API precedence. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/478 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/authentik/httproute.yaml | 32 ++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/apps/base/authentik/httproute.yaml b/apps/base/authentik/httproute.yaml index 3e85185..d88f6ce 100644 --- a/apps/base/authentik/httproute.yaml +++ b/apps/base/authentik/httproute.yaml @@ -37,6 +37,22 @@ spec: name: authentik sectionName: https rules: + - backendRefs: + - group: "" + kind: Service + name: authentik-server + port: 80 + weight: 1 + filters: + - type: URLRewrite + urlRewrite: + path: + type: ReplaceFullPath + replaceFullPath: /application/o/token/ + matches: + - path: + type: Exact + value: /application/o/token - backendRefs: - group: "" kind: Service @@ -86,6 +102,22 @@ spec: name: authentik-internal sectionName: https rules: + - backendRefs: + - group: "" + kind: Service + name: authentik-server + port: 80 + weight: 1 + filters: + - type: URLRewrite + urlRewrite: + path: + type: ReplaceFullPath + replaceFullPath: /application/o/token/ + matches: + - path: + type: Exact + value: /application/o/token - backendRefs: - group: "" kind: Service