From 2e1fca808c43b268a478aaa3869407a3936be4d2 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 19 Sep 2026 15:58:12 +1000
Subject: [PATCH] Rewrite slash-less Authentik token endpoint to the canonical
 path

Add an exact-match URLRewrite rule on both identity HTTPRoutes so a POST to
/application/o/token reaches the handler instead of Django's 405.
---
 apps/base/authentik/httproute.yaml | 32 ++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/apps/base/authentik/httproute.yaml b/apps/base/authentik/httproute.yaml
index 3e85185..d88f6ce 100644
--- a/apps/base/authentik/httproute.yaml
+++ b/apps/base/authentik/httproute.yaml
@@ -37,6 +37,22 @@ spec:
       name: authentik
       sectionName: https
   rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /application/o/token/
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
     - backendRefs:
         - group: ""
           kind: Service
@@ -86,6 +102,22 @@ spec:
       name: authentik-internal
       sectionName: https
   rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /application/o/token/
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
     - backendRefs:
         - group: ""
           kind: Service
-- 
2.47.3