From dc5a24e564e9f210a7a35f3fabd1145a9aea3fde Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 00:43:53 +1100 Subject: [PATCH] Make stalwart a public PKCE client with account and admin callbacks --- config/providers_oauth2/stalwart.yaml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/config/providers_oauth2/stalwart.yaml b/config/providers_oauth2/stalwart.yaml index d92c73a..e35a8bf 100644 --- a/config/providers_oauth2/stalwart.yaml +++ b/config/providers_oauth2/stalwart.yaml @@ -2,20 +2,19 @@ # https://mail.unkin.net in the mail namespace). Stalwart's OIDC directory # validates access tokens (JWT, userinfo fallback) and requires aud=stalwart # plus the openid+email scopes; it maps preferred_username/name from profile. -# client_secret is read from Vault (seeded out of band), never committed. +# public, no secret: the web UI uses PKCE; the strict redirect URIs are the control. name: stalwart authorization_flow: default-provider-authorization-implicit-consent invalidation_flow: default-provider-invalidation-flow -client_type: confidential +client_type: public client_id: stalwart launch_url: https://mail.unkin.net/ -client_secret_vault: - mount: kv - path: kubernetes/namespace/mail/default/oauth-credentials scope_mappings: - goauthentik.io/providers/oauth2/scope-openid - goauthentik.io/providers/oauth2/scope-email - goauthentik.io/providers/oauth2/scope-profile redirect_uris: - matching_mode: strict - url: https://mail.unkin.net/oauth2/callback + url: https://mail.unkin.net/account/oauth/callback + - matching_mode: strict + url: https://mail.unkin.net/admin/oauth/callback