unkin/terraform-authentik
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Default OAuth2 providers to RS256 ID token signing #15

Merged
benvin merged 1 commits from benvin/oidc-rs256-signing into main 2026-07-31 21:19:47 +10:00
Conversation 0 Commits 1 Files Changed 2
+16 -1
unkinben commented 2026-07-31 20:28:26 +10:00
Owner
Copy Link
Copy Source

Why: OAuth2 providers with no signing_key sign ID tokens with HS256, which RS256-only RP clients reject (Failed to verify oidc token: unexpected signature algorithm "HS256"; expected ["RS256"]), breaking OIDC login for argocd/grafana/rancher/litellm/netbox/gitea.

How:

  • Add data.authentik_certificate_key_pair.signing resolving the estate's RSA keypair by name (var.oauth2_signing_key_name, default the built-in "authentik Self-signed Certificate", confirmed RSA with a private key).
  • Default every provider's signing_key to that keypair via coalesce, so all providers sign with RS256 while keeping the per-yaml signing_key override.

Plan: 0 to add, 6 to change, 0 to destroy - the 6 oauth2 providers (argocd, gitea, grafana, litellm, netbox, rancher) get signing_key set in-place; nothing else touched. On apply all OIDC apps switch to RS256, so a re-login is needed.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

Why: OAuth2 providers with no signing_key sign ID tokens with HS256, which RS256-only RP clients reject (`Failed to verify oidc token: unexpected signature algorithm "HS256"; expected ["RS256"]`), breaking OIDC login for argocd/grafana/rancher/litellm/netbox/gitea. How: - Add `data.authentik_certificate_key_pair.signing` resolving the estate's RSA keypair by name (`var.oauth2_signing_key_name`, default the built-in "authentik Self-signed Certificate", confirmed RSA with a private key). - Default every provider's `signing_key` to that keypair via `coalesce`, so all providers sign with RS256 while keeping the per-yaml `signing_key` override. Plan: 0 to add, 6 to change, 0 to destroy - the 6 oauth2 providers (argocd, gitea, grafana, litellm, netbox, rancher) get signing_key set in-place; nothing else touched. On apply all OIDC apps switch to RS256, so a re-login is needed. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben added 1 commit 2026-07-31 20:28:26 +10:00
Default OAuth2 providers to RS256 ID token signing
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
b6e9b6b6b9 
OAuth2 providers with no signing_key fall back to HS256, which RS256-only
RP clients (argocd confirmed, and the rest) reject with "unexpected
signature algorithm HS256; expected [RS256]", breaking OIDC login.

- Add data.authentik_certificate_key_pair.signing, resolving the estate's
  RSA keypair by name (var.oauth2_signing_key_name, default the built-in
  "authentik Self-signed Certificate").
- Default every provider's signing_key to that keypair via coalesce, so all
  providers sign with RS256 while keeping the per-yaml signing_key override.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin merged commit 819996b0c7 into main 2026-07-31 21:19:47 +10:00
benvin deleted branch benvin/oidc-rs256-signing 2026-07-31 21:19:47 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#15
Delete Branch "benvin/oidc-rs256-signing"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?