From 2b39450ae24d922de7593dfeac6a7f7026ba8483 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 22:09:06 +1000 Subject: [PATCH] Set OAuth2 grant_types so authorization_code login works MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why All Authentik OIDC logins (ArgoCD, Grafana, Rancher, LiteLLM, NetBox) fail with `invalid_request` / "The request is otherwise malformed". Authentik 2026.5 added an explicit `grant_types` allow-list to the OAuth2 provider (model default = empty list). Our module never set it, so every provider has `grant_types = []`, and `authorize.py` rejects the authorization_code grant (`if self.grant_type not in self.provider.grant_types`) before any user auth. ## Change - modules/authentik: add a `grant_types` field to the `providers_oauth2` variable, defaulting to `["authorization_code", "refresh_token"]` (the standard confidential web-app set), and wire it into `authentik_provider_oauth2`. ## Plan `0 to add, 5 to change, 0 to destroy` — each existing oauth2 provider's `grant_types` goes `[] -> ["authorization_code", "refresh_token"]`; no other attributes change. Baseline plan (pre-change) was clean (no netbox/state drift). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- modules/authentik/main.tf | 1 + modules/authentik/variables.tf | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/modules/authentik/main.tf b/modules/authentik/main.tf index 7eee5cf..33c6fe4 100644 --- a/modules/authentik/main.tf +++ b/modules/authentik/main.tf @@ -159,6 +159,7 @@ resource "authentik_provider_oauth2" "this" { signing_key = each.value.signing_key access_token_validity = each.value.access_token_validity allowed_redirect_uris = each.value.redirect_uris + grant_types = each.value.grant_types } resource "authentik_provider_ldap" "this" { diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf index 3395928..b96d052 100644 --- a/modules/authentik/variables.tf +++ b/modules/authentik/variables.tf @@ -67,6 +67,12 @@ variable "providers_oauth2" { # Managed identifiers of scope property mappings (e.g. # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids. scope_mappings = optional(list(string), []) + # OAuth2 grant types the provider permits. Authentik 2026.5 added this as an + # explicit allow-list on the provider (models default = empty); an empty list + # rejects every authorize request with "invalid_request / The request is + # otherwise malformed". Default to the standard confidential web-app set so + # authorization_code (login) and refresh_token (offline access) work. + grant_types = optional(list(string), ["authorization_code", "refresh_token"]) # allowed_redirect_uris is list(map(string)); the API always stores a # redirect_uri_type key, so it must be set here or every plan drifts. redirect_uris = optional(list(object({ -- 2.47.3