unkin/terraform-authentik
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Onboard OpenBao as an Authentik OIDC client #33

Merged
benvin merged 1 commits from benvin/vault-oidc-provider into main 2026-08-30 22:17:39 +10:00
Conversation 0 Commits 1 Files Changed 7
+114 -4
unkin-agent commented 2026-08-30 21:26:10 +10:00
Member
Copy Link
Copy Source

Why

OpenBao has no SSO: human operators log in with long-lived tokens or shared credentials.

How

  • Add OAuth2 provider + application vault: confidential client, openid/email/profile scopes, redirect URIs for the bao login -method=oidc local listener and both Vault UI hosts.
  • Add client_secret_vault.generate to the authentik module: when set, generate a 64-char random_password and write {client_id, client_secret} to the kv-v2 path; providers without the flag keep the existing read path.
  • Add permission group akP-vault-admin, bound to the vault application, and nest it under akR-global-admin.

Companion terraform-vault PRs consume kv/service/authentik/oidc-vault.

## Why OpenBao has no SSO: human operators log in with long-lived tokens or shared credentials. ## How - Add OAuth2 provider + application `vault`: confidential client, openid/email/profile scopes, redirect URIs for the `bao login -method=oidc` local listener and both Vault UI hosts. - Add `client_secret_vault.generate` to the authentik module: when set, generate a 64-char `random_password` and write `{client_id, client_secret}` to the kv-v2 path; providers without the flag keep the existing read path. - Add permission group `akP-vault-admin`, bound to the vault application, and nest it under `akR-global-admin`. Companion terraform-vault PRs consume `kv/service/authentik/oidc-vault`.
unkin-agent added 1 commit 2026-08-30 21:26:10 +10:00
Onboard OpenBao as an Authentik OIDC client
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
230db5ad7e 
Adds config/providers_oauth2/vault.yaml so human logins to OpenBao go
through Authentik SSO (bao CLI and the web UI). Machine auth (approle,
kubernetes, CI) and break-glass are unchanged and stay on the OpenBao side.

Extends the oauth2 provider module so a config may generate its own client
secret instead of reading a pre-seeded one: client_secret_vault.generate
creates a random_password and writes {client_id, client_secret} to the given
kv-v2 path. Providers without the flag keep the existing read-only data source
behaviour. This is what lets the provider land with no manual Vault seed.

Gates the new application with akP-vault-admin and nests it in
akR-global-admin, matching how every other app in this repo is bound.
benvin merged commit 6d014ce913 into main 2026-08-30 22:17:39 +10:00
benvin deleted branch benvin/vault-oidc-provider 2026-08-30 22:17:40 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#33
Delete Branch "benvin/vault-oidc-provider"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?