From 5faa2f84f6a61aa197672b3f593121ebd4da9b2a Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 12 Jul 2026 22:57:57 +1000 Subject: [PATCH] Fix perpetual redirect_uri drift on oauth2 providers authentik_provider_oauth2.allowed_redirect_uris is list(map(string)) and the API always stores a redirect_uri_type key on each entry. The module only set matching_mode and url, so every plan showed the Grafana provider being updated in-place (state map had 3 keys, config map had 2) and never converged. Add redirect_uri_type to the redirect_uris object, defaulting to "authorization". `terragrunt plan` now reports no changes. --- modules/authentik/variables.tf | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf index f08c87d..d2f5d0c 100644 --- a/modules/authentik/variables.tf +++ b/modules/authentik/variables.tf @@ -40,9 +40,12 @@ variable "providers_oauth2" { # Managed identifiers of scope property mappings (e.g. # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids. scope_mappings = optional(list(string), []) + # allowed_redirect_uris is list(map(string)); the API always stores a + # redirect_uri_type key, so it must be set here or every plan drifts. redirect_uris = optional(list(object({ - matching_mode = optional(string, "strict") - url = string + matching_mode = optional(string, "strict") + url = string + redirect_uri_type = optional(string, "authorization") })), []) signing_key = optional(string, null) access_token_validity = optional(string, "minutes=10")