Set OAuth2 grant_types so authorization_code login works #12

2026-07-28T22:10:01+10:00

unkinben commented

2026-07-28 22:10:01 +10:00

Why

All Authentik OIDC logins (ArgoCD, Grafana, Rancher, LiteLLM, NetBox) fail with invalid_request / "The request is otherwise malformed". Authentik 2026.5 added an explicit grant_types allow-list to the OAuth2 provider (model default = empty list, see the 2026.2->2026.5 note in models.py). Our module never set it, so every live provider has grant_types = [], and authorize.py rejects the authorization_code grant (if self.grant_type not in self.provider.grant_types) before any user auth. This is global, not per-app drift; it surfaced now because the last apply ran under the 2026.5 provider.

Change

modules/authentik: add a grant_types field to the providers_oauth2 variable, defaulting to ["authorization_code", "refresh_token"] (standard confidential web-app set), and wire it into authentik_provider_oauth2.

Plan

0 to add, 5 to change, 0 to destroy — each oauth2 provider's grant_types goes [] -> ["authorization_code", "refresh_token"]; no other attributes change. Baseline plan before the change was clean (no netbox/state drift; pipeline-42 objects are already in state).

Rollout

Merging triggers the woodpecker apply. Verified locally that the plan is clean; the local apply itself was left for CI. After apply, /application/o/authorize/?...response_type=code returns the login flow instead of the error.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why All Authentik OIDC logins (ArgoCD, Grafana, Rancher, LiteLLM, NetBox) fail with `invalid_request` / "The request is otherwise malformed". Authentik 2026.5 added an explicit `grant_types` allow-list to the OAuth2 provider (model default = empty list, see the 2026.2->2026.5 note in models.py). Our module never set it, so every live provider has `grant_types = []`, and authorize.py rejects the authorization_code grant (`if self.grant_type not in self.provider.grant_types`) before any user auth. This is global, not per-app drift; it surfaced now because the last apply ran under the 2026.5 provider. ## Change - **modules/authentik**: add a `grant_types` field to the `providers_oauth2` variable, defaulting to `["authorization_code", "refresh_token"]` (standard confidential web-app set), and wire it into `authentik_provider_oauth2`. ## Plan `0 to add, 5 to change, 0 to destroy` — each oauth2 provider's `grant_types` goes `[] -> ["authorization_code", "refresh_token"]`; no other attributes change. Baseline plan before the change was clean (no netbox/state drift; pipeline-42 objects are already in state). ## Rollout Merging triggers the woodpecker apply. Verified locally that the plan is clean; the local apply itself was left for CI. After apply, `/application/o/authorize/?...response_type=code` returns the login flow instead of the error. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-28 22:10:01 +10:00

Set OAuth2 grant_types so authorization_code login works

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

2b39450ae2

## Why

All Authentik OIDC logins (ArgoCD, Grafana, Rancher, LiteLLM, NetBox) fail
with `invalid_request` / "The request is otherwise malformed". Authentik
2026.5 added an explicit `grant_types` allow-list to the OAuth2 provider
(model default = empty list). Our module never set it, so every provider has
`grant_types = []`, and `authorize.py` rejects the authorization_code grant
(`if self.grant_type not in self.provider.grant_types`) before any user auth.

## Change

- modules/authentik: add a `grant_types` field to the `providers_oauth2`
  variable, defaulting to `["authorization_code", "refresh_token"]` (the
  standard confidential web-app set), and wire it into
  `authentik_provider_oauth2`.

## Plan

`0 to add, 5 to change, 0 to destroy` — each existing oauth2 provider's
`grant_types` goes `[] -> ["authorization_code", "refresh_token"]`; no other
attributes change. Baseline plan (pre-change) was clean (no netbox/state drift).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit a5a2f467a4 into main

2026-07-28 22:38:58 +10:00

benvin deleted branch benvin/oauth2-grant-types

2026-07-28 22:38:58 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#12