From 58e17d5ae8b3520cc3f60c1f4c6401be50c127e6 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Wed, 15 Jul 2026 20:59:38 +1000 Subject: [PATCH] Add Rancher OAuth2/OIDC provider Extends Authentik SSO to Rancher (rancher.k8s.syd1.au.unkin.net) so cluster access uses Authentik identity and groups. - Add config/providers_oauth2/rancher.yaml: confidential OAuth2 provider + application (slug rancher), openid/email/profile scopes, /verify-auth redirect (Rancher's OIDC callback). client_secret read from Vault at kv/kubernetes/namespace/cattle-system/default/oauth-credentials. --- config/providers_oauth2/rancher.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 config/providers_oauth2/rancher.yaml diff --git a/config/providers_oauth2/rancher.yaml b/config/providers_oauth2/rancher.yaml new file mode 100644 index 0000000..9a02f03 --- /dev/null +++ b/config/providers_oauth2/rancher.yaml @@ -0,0 +1,18 @@ +# OAuth2/OIDC provider + application for Rancher +# (rancher.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed. +# Rancher's OIDC/Keycloak auth provider redirects back to /verify-auth. +name: Rancher +authorization_flow: default-provider-authorization-implicit-consent +invalidation_flow: default-provider-invalidation-flow +client_type: confidential +client_id: rancher +client_secret_vault: + mount: kv + path: kubernetes/namespace/cattle-system/default/oauth-credentials +scope_mappings: + - goauthentik.io/providers/oauth2/scope-openid + - goauthentik.io/providers/oauth2/scope-email + - goauthentik.io/providers/oauth2/scope-profile +redirect_uris: + - matching_mode: strict + url: https://rancher.k8s.syd1.au.unkin.net/verify-auth