From de3b3251b307cac9622775bc16316f3ec6ee8945 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Fri, 22 May 2026 13:06:54 +0200 Subject: [PATCH 1/3] fix: Use different port for the authentik server Otherwise this conflicts with xdebug --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 656a4cb..a139069 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1331,7 +1331,7 @@ services: PROTOCOL: ${PROTOCOL:-https} image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2} ports: - - ${COMPOSE_PORT_HTTP:-9000}:9000 + - ${COMPOSE_PORT_HTTP:-9002}:9002 restart: unless-stopped volumes: - ./authentik-media:/media From 72c3a178940e28d780979baf5fa88eee175fa2b5 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Fri, 22 May 2026 13:07:19 +0200 Subject: [PATCH 2/3] fix(authentik): Change some names in the authentik blueprints --- authentik-blueprints/nextcloud_saml.yaml | 4 ++-- authentik-blueprints/portal_saml.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/authentik-blueprints/nextcloud_saml.yaml b/authentik-blueprints/nextcloud_saml.yaml index c13b5ef..acc73f8 100644 --- a/authentik-blueprints/nextcloud_saml.yaml +++ b/authentik-blueprints/nextcloud_saml.yaml @@ -5,7 +5,7 @@ metadata: context: {} entries: - attrs: - name: Authentik + name: Authentik Nextcloud certificate_data: | -----BEGIN CERTIFICATE----- MIIE5DCCAsygAwIBAgIQQwV9AoKySzWn+vejIypIhzANBgkqhkiG9w0BAQsFADAe @@ -213,7 +213,7 @@ entries: permissions: [] state: present - attrs: - name: Portal + name: Nextcloud policy_engine_mode: any provider: 1 slug: nextcloud diff --git a/authentik-blueprints/portal_saml.yaml b/authentik-blueprints/portal_saml.yaml index bbec8d0..66974e5 100644 --- a/authentik-blueprints/portal_saml.yaml +++ b/authentik-blueprints/portal_saml.yaml @@ -5,7 +5,7 @@ metadata: context: {} entries: - attrs: - name: Authentik + name: Authentik Portal certificate_data: | -----BEGIN CERTIFICATE----- MIIE5DCCAsygAwIBAgIQQwV9AoKySzWn+vejIypIhzANBgkqhkiG9w0BAQsFADAe From 719c747cc6f044f6e465938c72768ba68bb039c3 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Wed, 22 Jul 2026 15:53:46 +0200 Subject: [PATCH 3/3] fix: portal login with authentik Signed-off-by: Carl Schwan --- authentik-blueprints/nextcloud_saml.yaml | 151 ++++++++++++----------- authentik-blueprints/portal_saml.yaml | 72 ----------- authentik-blueprints/users.yaml | 80 ++++++++++++ docker/bin/bootstrap.sh | 8 +- 4 files changed, 160 insertions(+), 151 deletions(-) create mode 100644 authentik-blueprints/users.yaml diff --git a/authentik-blueprints/nextcloud_saml.yaml b/authentik-blueprints/nextcloud_saml.yaml index acc73f8..6bd3f0c 100644 --- a/authentik-blueprints/nextcloud_saml.yaml +++ b/authentik-blueprints/nextcloud_saml.yaml @@ -4,6 +4,9 @@ metadata: blueprints.goauthentik.io/instantiate: "true" context: {} entries: + +# SAML + - attrs: name: Authentik Nextcloud certificate_data: | @@ -90,7 +93,7 @@ entries: -----END RSA PRIVATE KEY----- model: authentik_crypto.certificatekeypair identifiers: - name: authentik-cert + name: authentik-cert-local - attrs: name: Nextcloud certificate_data: | @@ -177,7 +180,7 @@ entries: -----END RSA PRIVATE KEY----- model: authentik_crypto.certificatekeypair identifiers: - name: nextcloud-cert + name: nextcloud-cert-local - attrs: acs_url: https://nextcloud.local/index.php/apps/user_saml/saml/acs assertion_valid_not_before: minutes=-5 @@ -189,7 +192,7 @@ entries: invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] issuer: https://nextcloud.local/index.php/apps/user_saml/saml/metadata logout_method: frontchannel_iframe - name: nextcloud-saml + name: nextcloud-saml-local name_id_mapping: !Find [authentik_providers_saml.samlpropertymapping, [managed, goauthentik.io/providers/saml/uid]] property_mappings: - !Find [authentik_providers_saml.samlpropertymapping, [managed, goauthentik.io/providers/saml/upn]] @@ -202,97 +205,95 @@ entries: session_valid_not_on_or_after: minutes=86400 sign_assertion: true signature_algorithm: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 - signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik-cert]] + signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik-cert-local]] sls_binding: redirect sp_binding: post - verification_kp: !Find [authentik_crypto.certificatekeypair, [name, nextcloud-cert]] + verification_kp: !Find [authentik_crypto.certificatekeypair, [name, nextcloud-cert-local]] conditions: [] identifiers: - pk: 1 + name: nextcloud-saml-local model: authentik_providers_saml.samlprovider permissions: [] state: present - attrs: - name: Nextcloud + name: Nextcloud SAML policy_engine_mode: any - provider: 1 - slug: nextcloud + provider: !Find [authentik_providers_saml.samlprovider, [name, nextcloud-saml-local]] + slug: nextcloud-saml-local conditions: [] identifiers: name: nextcloud model: authentik_core.application permissions: [] state: present + +# LDAP + - attrs: - name: User Eleven - email: user11@example.com - password: user11 - model: authentik_core.user - state: present - identifiers: - username: user11 -- attrs: - name: User Twelve - email: user12@example.com - password: user12 - model: authentik_core.user - state: present - identifiers: - username: user12 -- attrs: - name: User Thirteen - email: user13@example.com - password: user13 - model: authentik_core.user - state: present - identifiers: - username: user13 -- attrs: - name: User Twenty One - email: user21@example.com - password: user21 - model: authentik_core.user - state: present - identifiers: - username: user21 -- attrs: - name: User Twenty Two - email: user22@example.com - password: user22 - model: authentik_core.user - state: present - identifiers: - username: user22 -- attrs: - name: User Twenty Three - email: user23@example.com - password: user23 - model: authentik_core.user - state: present - identifiers: - username: user23 -- attrs: - name: User Thirty One - email: user31@example.com - password: user31 - model: authentik_core.user + authorization_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]] + base_dn: DC=ldap,DC=goauthentik,DC=io + bind_mode: cached + gid_start_number: 4000 + invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]] + mfa_support: true + name: Provider for Nextcloud LDAP + search_mode: cached + uid_start_number: 2000 + conditions: [] + model: authentik_providers_ldap.ldapprovider + permissions: [] state: present identifiers: - username: user31 + pk: 20 + - attrs: - name: User Thirty Two - email: user32@example.com - password: user32 - model: authentik_core.user - state: present + name: Nextcloud LDAP + policy_engine_mode: any + provider: 20 + slug: nextcloud-ldap + conditions: [] identifiers: - username: user32 -- attrs: - name: User Thirty Three - email: user33@example.com - password: user33 - model: authentik_core.user + name: nextcloud-ldap + model: authentik_core.application + permissions: [] state: present - identifiers: - username: user33 + +#- attrs: +# config: +# authentik_host: http://authentik.local/ +# authentik_host_browser: '' +# authentik_host_insecure: false +# container_image: null +# docker_labels: null +# docker_map_ports: true +# docker_network: null +# kubernetes_disabled_components: [] +# kubernetes_httproute_annotations: {} +# kubernetes_httproute_parent_refs: [] +# kubernetes_image_pull_secrets: [] +# kubernetes_ingress_annotations: {} +# kubernetes_ingress_class_name: null +# kubernetes_ingress_path_type: null +# kubernetes_ingress_secret_name: authentik-outpost-tls +# kubernetes_json_patches: null +# kubernetes_namespace: default +# kubernetes_replicas: 1 +# kubernetes_service_type: ClusterIP +# log_level: info +# object_naming_template: ak-outpost-%(name)s +# refresh_interval: minutes=5 +# managed: null +# name: Nextcloud LDAP +# providers: +# - 20 +# service_connection: !Find [authentik_outposts.dockerserviceconnection, [name, Local Docker connection]] +# type: ldap +# conditions: [] +# model: authentik_outposts.outpost +# permissions: [] +# state: present +# identifiers: +# pk: 82b825ba-dcb8-44dc-9519-2c4f4f2491c5 + + version: 1 diff --git a/authentik-blueprints/portal_saml.yaml b/authentik-blueprints/portal_saml.yaml index 66974e5..1e43f66 100644 --- a/authentik-blueprints/portal_saml.yaml +++ b/authentik-blueprints/portal_saml.yaml @@ -223,76 +223,4 @@ entries: model: authentik_core.application permissions: [] state: present -- attrs: - name: User Eleven - email: user11@example.com - password: user11 - model: authentik_core.user - state: present - identifiers: - username: user11 -- attrs: - name: User Twelve - email: user12@example.com - password: user12 - model: authentik_core.user - state: present - identifiers: - username: user12 -- attrs: - name: User Thirteen - email: user13@example.com - password: user13 - model: authentik_core.user - state: present - identifiers: - username: user13 -- attrs: - name: User Twenty One - email: user21@example.com - password: user21 - model: authentik_core.user - state: present - identifiers: - username: user21 -- attrs: - name: User Twenty Two - email: user22@example.com - password: user22 - model: authentik_core.user - state: present - identifiers: - username: user22 -- attrs: - name: User Twenty Three - email: user23@example.com - password: user23 - model: authentik_core.user - state: present - identifiers: - username: user23 -- attrs: - name: User Thirty One - email: user31@example.com - password: user31 - model: authentik_core.user - state: present - identifiers: - username: user31 -- attrs: - name: User Thirty Two - email: user32@example.com - password: user32 - model: authentik_core.user - state: present - identifiers: - username: user32 -- attrs: - name: User Thirty Three - email: user33@example.com - password: user33 - model: authentik_core.user - state: present - identifiers: - username: user33 version: 1 diff --git a/authentik-blueprints/users.yaml b/authentik-blueprints/users.yaml new file mode 100644 index 0000000..793026d --- /dev/null +++ b/authentik-blueprints/users.yaml @@ -0,0 +1,80 @@ +metadata: + name: "nextcloud.local users" + labels: + blueprints.goauthentik.io/instantiate: "true" +context: {} +entries: + +- attrs: + name: User Eleven + email: user11@example.com + password: user11 + model: authentik_core.user + state: present + identifiers: + username: user11 +- attrs: + name: User Twelve + email: user12@example.com + password: user12 + model: authentik_core.user + state: present + identifiers: + username: user12 +- attrs: + name: User Thirteen + email: user13@example.com + password: user13 + model: authentik_core.user + state: present + identifiers: + username: user13 +- attrs: + name: User Twenty One + email: user21@example.com + password: user21 + model: authentik_core.user + state: present + identifiers: + username: user21 +- attrs: + name: User Twenty Two + email: user22@example.com + password: user22 + model: authentik_core.user + state: present + identifiers: + username: user22 +- attrs: + name: User Twenty Three + email: user23@example.com + password: user23 + model: authentik_core.user + state: present + identifiers: + username: user23 +- attrs: + name: User Thirty One + email: user31@example.com + password: user31 + model: authentik_core.user + state: present + identifiers: + username: user31 +- attrs: + name: User Thirty Two + email: user32@example.com + password: user32 + model: authentik_core.user + state: present + identifiers: + username: user32 +- attrs: + name: User Thirty Three + email: user33@example.com + password: user33 + model: authentik_core.user + state: present + identifiers: + username: user33 +version: 1 diff --git a/docker/bin/bootstrap.sh b/docker/bin/bootstrap.sh index 94174d5..403af4c 100755 --- a/docker/bin/bootstrap.sh +++ b/docker/bin/bootstrap.sh @@ -143,8 +143,8 @@ configure_saml() { OCC saml:config:set 1 --idp-singleLogoutService.url 'http://authentik.local/if/session-end/portal/' OCC saml:config:set 1 --idp-entityId 'https://portal.local/index.php/apps/user_saml/saml/metadata' else - OCC saml:config:set 1 --idp-singleSignOnService.url 'http://authentik.local/application/saml/nextcloud/sso/binding/redirect/' - OCC saml:config:set 1 --idp-singleLogoutService.url 'http://authentik.local/if/session-end/nextcloud/' + OCC saml:config:set 1 --idp-singleSignOnService.url 'http://authentik.local/application/saml/nextcloud-saml-local/sso/binding/redirect/' + OCC saml:config:set 1 --idp-singleLogoutService.url 'http://authentik.local/if/session-end/nextcloud-saml-local/' OCC saml:config:set 1 --idp-entityId 'https://nextcloud.local/index.php/apps/user_saml/saml/metadata' fi @@ -191,7 +191,7 @@ EOF OCC app:enable globalsiteselector --force OCC config:system:set lookup_server --value "$LOOKUP_SERVER" OCC config:system:set gs.enabled --type boolean --value true - OCC config:system:set gss.jwt.key --value 'random-key' + OCC config:system:set gss.jwt.key --value 'random-key-but-super-long-because-this-is-required' OCC config:system:set gss.mode --value 'master' OCC config:system:set gss.master.admin 0 --value 'admin' OCC config:system:set gss.master.csp-allow 0 --value "*${DOMAIN_SUFFIX}" @@ -208,7 +208,7 @@ EOF OCC config:system:set lookup_server --value "$LOOKUP_SERVER" OCC config:system:set gs.enabled --type boolean --value true OCC config:system:set gs.federation --value 'global' - OCC config:system:set gss.jwt.key --value 'random-key' + OCC config:system:set gss.jwt.key --value 'random-key-but-super-long-because-this-is-required' OCC config:system:set gss.mode --value 'slave' OCC config:system:set gss.master.url --value "$MASTER_SERVER" fi