unkinben
a93205bc82
Ben (akR-global-admin) does not see the LiteLLM tile on the Authentik user dashboard, while ArgoCD/Grafana/Rancher appear normally. The live API shows LiteLLM is configured identically to those apps: the app exists, its access binding akP-litellm-admin -> litellm is present, and akR-global-admin nests akP-litellm-admin (bidirectionally, same as the others). A CI-style plan against live state reports "No changes" -- so this is not terraform-correctable drift, and a plain re-apply fixes nothing. Yet check_access for Ben returns passing=false for litellm and passing=true for the rest: a stale cached access policy result inside Authentik. Add an optional per-app launch_url to the providers_oauth2 config (default null, which keeps Authentik's redirect-derived URL) and wire it to the application's meta_launch_url. Set it for LiteLLM to its UI. This makes the dashboard tile deterministic and, on apply, re-saves the application -- invalidating the stale access-policy cache so Ben's (already-correct) access re-evaluates and the tile appears. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
terraform-authentik
Terraform configuration for managing the Authentik identity provider at identity.unkin.net.
Managed Resources
- Groups — roles and group hierarchy (users are invited manually)
- SAML providers — SAML application integrations
- OAuth2/OIDC providers — OAuth2 and OpenID Connect integrations
- LDAP providers — LDAP provider and outpost configuration
- Applications — application definitions linked to providers
Configuration
Resources are defined as YAML files under config/:
config/
├── groups/ # Group definitions
├── providers_saml/ # SAML provider definitions
├── providers_oauth2/ # OAuth2/OIDC provider definitions
└── providers_ldap/ # LDAP provider definitions
Usage
make plan # init + plan
make apply # init + plan + apply
make format # format all .tf and .hcl files
Authentication
Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes for CI.