Fix perpetual redirect_uri drift on oauth2 providers #5

2026-07-12T22:58:11+10:00

unkinben commented

2026-07-12 22:58:11 +10:00

Why

Every plan showed authentik_provider_oauth2.this["grafana"] being updated in-place, replacing the allowed_redirect_uris entry with an identical-looking one — and it never converged (re-appeared after every apply):

~ allowed_redirect_uris = [
    - { matching_mode = "strict", redirect_uri_type = "authorization", url = "…/login/generic_oauth" },
    + { matching_mode = "strict", url = "…/login/generic_oauth" },
  ]

The provider schema types allowed_redirect_uris as list(map(string)), and the API always stores a redirect_uri_type key on each entry. The module only set matching_mode + url, so the state map (3 keys) never matched the config map (2 keys).

Change

Add redirect_uri_type to the redirect_uris object, defaulting to "authorization". No per-provider config change needed (grafana/argocd inherit the default).

Validation

terragrunt run --all plan now reports **"No changes. Your infrastructure matches the configuration."`

## Why Every `plan` showed `authentik_provider_oauth2.this["grafana"]` being updated in-place, replacing the `allowed_redirect_uris` entry with an identical-looking one — and it never converged (re-appeared after every apply): ``` ~ allowed_redirect_uris = [ - { matching_mode = "strict", redirect_uri_type = "authorization", url = "…/login/generic_oauth" }, + { matching_mode = "strict", url = "…/login/generic_oauth" }, ] ``` The provider schema types `allowed_redirect_uris` as `list(map(string))`, and the API always stores a `redirect_uri_type` key on each entry. The module only set `matching_mode` + `url`, so the state map (3 keys) never matched the config map (2 keys). ## Change Add `redirect_uri_type` to the `redirect_uris` object, defaulting to `"authorization"`. No per-provider config change needed (grafana/argocd inherit the default). ## Validation `terragrunt run --all plan` now reports **"No changes. Your infrastructure matches the configuration."`

unkinben added 1 commit 2026-07-12 22:58:11 +10:00

Fix perpetual redirect_uri drift on oauth2 providers

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

5faa2f84f6

authentik_provider_oauth2.allowed_redirect_uris is list(map(string)) and the
API always stores a redirect_uri_type key on each entry. The module only set
matching_mode and url, so every plan showed the Grafana provider being updated
in-place (state map had 3 keys, config map had 2) and never converged.

Add redirect_uri_type to the redirect_uris object, defaulting to
"authorization". `terragrunt plan` now reports no changes.

unkinben referenced this pull request

2026-07-12 22:59:23 +10:00

Add ArgoCD OAuth2/OIDC provider #3

benvin merged commit 3af322dff3 into main

2026-07-12 23:02:09 +10:00

benvin deleted branch benvin/fix-redirect-uri-type

2026-07-12 23:02:09 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#5