From b6e9b6b6b92d446b42d654a58b022b7276175270 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Fri, 31 Jul 2026 20:28:07 +1000 Subject: [PATCH] Default OAuth2 providers to RS256 ID token signing OAuth2 providers with no signing_key fall back to HS256, which RS256-only RP clients (argocd confirmed, and the rest) reject with "unexpected signature algorithm HS256; expected [RS256]", breaking OIDC login. - Add data.authentik_certificate_key_pair.signing, resolving the estate's RSA keypair by name (var.oauth2_signing_key_name, default the built-in "authentik Self-signed Certificate"). - Default every provider's signing_key to that keypair via coalesce, so all providers sign with RS256 while keeping the per-yaml signing_key override. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- modules/authentik/main.tf | 9 ++++++++- modules/authentik/variables.tf | 8 ++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/modules/authentik/main.tf b/modules/authentik/main.tf index 33c6fe4..7d2687e 100644 --- a/modules/authentik/main.tf +++ b/modules/authentik/main.tf @@ -142,6 +142,13 @@ data "vault_kv_secret_v2" "oauth2" { name = each.value.client_secret_vault.path } +# Default JWT signing key for OAuth2 providers. Without a signing_key Authentik +# signs ID tokens with HS256, which RS256-only RP clients (argocd, grafana, ...) +# reject. Look up the estate's RSA keypair by name so providers default to RS256. +data "authentik_certificate_key_pair" "signing" { + name = var.oauth2_signing_key_name +} + resource "authentik_provider_oauth2" "this" { for_each = var.providers_oauth2 @@ -156,7 +163,7 @@ resource "authentik_provider_oauth2" "this" { [authentik_property_mapping_provider_scope.groups_hierarchical.id], try([authentik_property_mapping_provider_scope.role[each.key].id], []), ) - signing_key = each.value.signing_key + signing_key = coalesce(each.value.signing_key, data.authentik_certificate_key_pair.signing.id) access_token_validity = each.value.access_token_validity allowed_redirect_uris = each.value.redirect_uris grant_types = each.value.grant_types diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf index b96d052..ba09e75 100644 --- a/modules/authentik/variables.tf +++ b/modules/authentik/variables.tf @@ -98,6 +98,14 @@ variable "providers_oauth2" { default = {} } +# Name of the RSA certificate keypair used to sign OAuth2 ID tokens (RS256) for +# every provider that does not set its own signing_key. Defaults to Authentik's +# built-in self-signed RSA keypair. +variable "oauth2_signing_key_name" { + type = string + default = "authentik Self-signed Certificate" +} + variable "providers_ldap" { type = map(object({ name = string -- 2.47.3