Set explicit launch URL for the LiteLLM application #16

2026-07-31T20:47:02+10:00

unkinben commented

2026-07-31 20:47:02 +10:00

Why

Ben (akR-global-admin) does not see the LiteLLM tile on the Authentik user dashboard ("My applications"), while ArgoCD, Grafana and Rancher appear normally.

Live-API diagnosis showed LiteLLM is configured identically to the working apps:

the litellm application exists, with a valid (redirect-derived) launch URL, meta_hide=false, policy_engine_mode=any;
its access binding akP-litellm-admin -> litellm is present and enabled;
akR-global-admin nests akP-litellm-admin (bidirectionally — parents/children — same as grafana/argocd/rancher).

A CI-style plan against live state reports No changes — so this is not terraform-correctable drift, and a plain re-apply fixes nothing. Yet check_access for Ben returns passing=false for litellm and passing=true for the others: a stale cached access-policy result inside Authentik.

Change

Add an optional per-app launch_url to the providers_oauth2 config (default null, which keeps Authentik's redirect-derived URL) and wire it to the application's meta_launch_url.
Set launch_url for LiteLLM to its UI (https://litellm.k8s.syd1.au.unkin.net/).

This makes the dashboard tile deterministic and, on apply, re-saves the application, invalidating the stale access-policy cache so Ben's (already-correct) access re-evaluates and the tile appears.

Plan

Plan: 0 to add, 1 to change, 0 to destroy — a single in-place update:

# authentik_application.oauth2["litellm"] will be updated in-place
    + meta_launch_url = "https://litellm.k8s.syd1.au.unkin.net/"

Other OAuth2 apps are unaffected (launch_url defaults null).

Disjoint from #15 (which only touches provider signing_key wiring).

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why Ben (`akR-global-admin`) does not see the **LiteLLM** tile on the Authentik user dashboard ("My applications"), while ArgoCD, Grafana and Rancher appear normally. Live-API diagnosis showed LiteLLM is configured **identically** to the working apps: - the `litellm` application exists, with a valid (redirect-derived) launch URL, `meta_hide=false`, `policy_engine_mode=any`; - its access binding `akP-litellm-admin -> litellm` is present and enabled; - `akR-global-admin` nests `akP-litellm-admin` (bidirectionally — `parents`/`children` — same as grafana/argocd/rancher). A CI-style `plan` against live state reports **No changes** — so this is **not** terraform-correctable drift, and a plain re-apply fixes nothing. Yet `check_access` for Ben returns `passing=false` for `litellm` and `passing=true` for the others: a **stale cached access-policy result inside Authentik**. ## Change - Add an optional per-app `launch_url` to the `providers_oauth2` config (default `null`, which keeps Authentik's redirect-derived URL) and wire it to the application's `meta_launch_url`. - Set `launch_url` for LiteLLM to its UI (`https://litellm.k8s.syd1.au.unkin.net/`). This makes the dashboard tile deterministic and, on apply, **re-saves the application**, invalidating the stale access-policy cache so Ben's (already-correct) access re-evaluates and the tile appears. ## Plan `Plan: 0 to add, 1 to change, 0 to destroy` — a single in-place update: ``` # authentik_application.oauth2["litellm"] will be updated in-place + meta_launch_url = "https://litellm.k8s.syd1.au.unkin.net/" ``` Other OAuth2 apps are unaffected (`launch_url` defaults `null`). Disjoint from #15 (which only touches provider `signing_key` wiring). https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-31 20:47:03 +10:00

Set explicit launch URL for the LiteLLM application

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

a93205bc82

Ben (akR-global-admin) does not see the LiteLLM tile on the Authentik user
dashboard, while ArgoCD/Grafana/Rancher appear normally. The live API shows
LiteLLM is configured identically to those apps: the app exists, its access
binding akP-litellm-admin -> litellm is present, and akR-global-admin nests
akP-litellm-admin (bidirectionally, same as the others). A CI-style plan against
live state reports "No changes" -- so this is not terraform-correctable drift,
and a plain re-apply fixes nothing. Yet check_access for Ben returns
passing=false for litellm and passing=true for the rest: a stale cached access
policy result inside Authentik.

Add an optional per-app launch_url to the providers_oauth2 config (default null,
which keeps Authentik's redirect-derived URL) and wire it to the application's
meta_launch_url. Set it for LiteLLM to its UI. This makes the dashboard tile
deterministic and, on apply, re-saves the application -- invalidating the stale
access-policy cache so Ben's (already-correct) access re-evaluates and the tile
appears.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit 132da3cfc8 into main

2026-07-31 22:00:03 +10:00

benvin deleted branch benvin/litellm-app-visibility

2026-07-31 22:00:03 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#16