Skip to content

Some fixes for authentik login in particular with Global Scale #486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
CarlSchwan wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Some fixes for authentik login in particular with Global Scale #486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
de3b325
fix: Use different port for the authentik server
CarlSchwan May 22, 2026
72c3a17
fix(authentik): Change some names in the authentik blueprints
CarlSchwan May 22, 2026
719c747
fix: portal login with authentik
CarlSchwan Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
153 changes: 77 additions & 76 deletions authentik-blueprints/nextcloud_saml.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,11 @@ metadata:
blueprints.goauthentik.io/instantiate: "true"
context: {}
entries:

# SAML

- attrs:
name: Authentik
name: Authentik Nextcloud
certificate_data: |
-----BEGIN CERTIFICATE-----
MIIE5DCCAsygAwIBAgIQQwV9AoKySzWn+vejIypIhzANBgkqhkiG9w0BAQsFADAe
Expand Down Expand Up @@ -90,7 +93,7 @@ entries:
-----END RSA PRIVATE KEY-----
model: authentik_crypto.certificatekeypair
identifiers:
name: authentik-cert
name: authentik-cert-local
- attrs:
name: Nextcloud
certificate_data: |
Expand Down Expand Up @@ -177,7 +180,7 @@ entries:
-----END RSA PRIVATE KEY-----
model: authentik_crypto.certificatekeypair
identifiers:
name: nextcloud-cert
name: nextcloud-cert-local
- attrs:
acs_url: https://nextcloud.local/index.php/apps/user_saml/saml/acs
assertion_valid_not_before: minutes=-5
Expand All @@ -189,7 +192,7 @@ entries:
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
issuer: https://nextcloud.local/index.php/apps/user_saml/saml/metadata
logout_method: frontchannel_iframe
name: nextcloud-saml
name: nextcloud-saml-local
name_id_mapping: !Find [authentik_providers_saml.samlpropertymapping, [managed, goauthentik.io/providers/saml/uid]]
property_mappings:
- !Find [authentik_providers_saml.samlpropertymapping, [managed, goauthentik.io/providers/saml/upn]]
Expand All @@ -202,97 +205,95 @@ entries:
session_valid_not_on_or_after: minutes=86400
sign_assertion: true
signature_algorithm: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik-cert]]
signing_kp: !Find [authentik_crypto.certificatekeypair, [name, authentik-cert-local]]
sls_binding: redirect
sp_binding: post
verification_kp: !Find [authentik_crypto.certificatekeypair, [name, nextcloud-cert]]
verification_kp: !Find [authentik_crypto.certificatekeypair, [name, nextcloud-cert-local]]
conditions: []
identifiers:
pk: 1
name: nextcloud-saml-local
model: authentik_providers_saml.samlprovider
permissions: []
state: present
- attrs:
name: Portal
name: Nextcloud SAML
policy_engine_mode: any
provider: 1
slug: nextcloud
provider: !Find [authentik_providers_saml.samlprovider, [name, nextcloud-saml-local]]
slug: nextcloud-saml-local
conditions: []
identifiers:
name: nextcloud
model: authentik_core.application
permissions: []
state: present

# LDAP

- attrs:
name: User Eleven
email: user11@example.com
password: user11
model: authentik_core.user
state: present
identifiers:
username: user11
- attrs:
name: User Twelve
email: user12@example.com
password: user12
model: authentik_core.user
state: present
identifiers:
username: user12
- attrs:
name: User Thirteen
email: user13@example.com
password: user13
model: authentik_core.user
state: present
identifiers:
username: user13
- attrs:
name: User Twenty One
email: user21@example.com
password: user21
model: authentik_core.user
state: present
identifiers:
username: user21
- attrs:
name: User Twenty Two
email: user22@example.com
password: user22
model: authentik_core.user
state: present
identifiers:
username: user22
- attrs:
name: User Twenty Three
email: user23@example.com
password: user23
model: authentik_core.user
state: present
identifiers:
username: user23
- attrs:
name: User Thirty One
email: user31@example.com
password: user31
model: authentik_core.user
authorization_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
base_dn: DC=ldap,DC=goauthentik,DC=io
bind_mode: cached
gid_start_number: 4000
invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
mfa_support: true
name: Provider for Nextcloud LDAP
search_mode: cached
uid_start_number: 2000
conditions: []
model: authentik_providers_ldap.ldapprovider
permissions: []
state: present
identifiers:
username: user31
pk: 20

- attrs:
name: User Thirty Two
email: user32@example.com
password: user32
model: authentik_core.user
state: present
name: Nextcloud LDAP
policy_engine_mode: any
provider: 20
slug: nextcloud-ldap
conditions: []
identifiers:
username: user32
- attrs:
name: User Thirty Three
email: user33@example.com
password: user33
model: authentik_core.user
name: nextcloud-ldap
model: authentik_core.application
permissions: []
state: present
identifiers:
username: user33

#- attrs:

@CarlSchwan CarlSchwan Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this is for LDAP + SAML but I didn't figure out yet the perfect working config

# config:
# authentik_host: http://authentik.local/
# authentik_host_browser: ''
# authentik_host_insecure: false
# container_image: null
# docker_labels: null
# docker_map_ports: true
# docker_network: null
# kubernetes_disabled_components: []
# kubernetes_httproute_annotations: {}
# kubernetes_httproute_parent_refs: []
# kubernetes_image_pull_secrets: []
# kubernetes_ingress_annotations: {}
# kubernetes_ingress_class_name: null
# kubernetes_ingress_path_type: null
# kubernetes_ingress_secret_name: authentik-outpost-tls
# kubernetes_json_patches: null
# kubernetes_namespace: default
# kubernetes_replicas: 1
# kubernetes_service_type: ClusterIP
# log_level: info
# object_naming_template: ak-outpost-%(name)s
# refresh_interval: minutes=5
# managed: null
# name: Nextcloud LDAP
# providers:
# - 20
# service_connection: !Find [authentik_outposts.dockerserviceconnection, [name, Local Docker connection]]
# type: ldap
# conditions: []
# model: authentik_outposts.outpost
# permissions: []
# state: present
# identifiers:
# pk: 82b825ba-dcb8-44dc-9519-2c4f4f2491c5


version: 1
74 changes: 1 addition & 73 deletions authentik-blueprints/portal_saml.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ metadata:
context: {}
entries:
- attrs:
name: Authentik
name: Authentik Portal
certificate_data: |
-----BEGIN CERTIFICATE-----
MIIE5DCCAsygAwIBAgIQQwV9AoKySzWn+vejIypIhzANBgkqhkiG9w0BAQsFADAe
Expand Down Expand Up @@ -223,76 +223,4 @@ entries:
model: authentik_core.application
permissions: []
state: present
- attrs:
name: User Eleven
email: user11@example.com
password: user11
model: authentik_core.user
state: present
identifiers:
username: user11
- attrs:
name: User Twelve
email: user12@example.com
password: user12
model: authentik_core.user
state: present
identifiers:
username: user12
- attrs:
name: User Thirteen
email: user13@example.com
password: user13
model: authentik_core.user
state: present
identifiers:
username: user13
- attrs:
name: User Twenty One
email: user21@example.com
password: user21
model: authentik_core.user
state: present
identifiers:
username: user21
- attrs:
name: User Twenty Two
email: user22@example.com
password: user22
model: authentik_core.user
state: present
identifiers:
username: user22
- attrs:
name: User Twenty Three
email: user23@example.com
password: user23
model: authentik_core.user
state: present
identifiers:
username: user23
- attrs:
name: User Thirty One
email: user31@example.com
password: user31
model: authentik_core.user
state: present
identifiers:
username: user31
- attrs:
name: User Thirty Two
email: user32@example.com
password: user32
model: authentik_core.user
state: present
identifiers:
username: user32
- attrs:
name: User Thirty Three
email: user33@example.com
password: user33
model: authentik_core.user
state: present
identifiers:
username: user33
version: 1
80 changes: 80 additions & 0 deletions authentik-blueprints/users.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
metadata:
name: "nextcloud.local users"
labels:
blueprints.goauthentik.io/instantiate: "true"
context: {}
entries:

- attrs:
name: User Eleven
email: user11@example.com
password: user11
model: authentik_core.user
state: present
identifiers:
username: user11
- attrs:
name: User Twelve
email: user12@example.com
password: user12
model: authentik_core.user
state: present
identifiers:
username: user12
- attrs:
name: User Thirteen
email: user13@example.com
password: user13
model: authentik_core.user
state: present
identifiers:
username: user13
- attrs:
name: User Twenty One
email: user21@example.com
password: user21
model: authentik_core.user
state: present
identifiers:
username: user21
- attrs:
name: User Twenty Two
email: user22@example.com
password: user22
model: authentik_core.user
state: present
identifiers:
username: user22
- attrs:
name: User Twenty Three
email: user23@example.com
password: user23
model: authentik_core.user
state: present
identifiers:
username: user23
- attrs:
name: User Thirty One
email: user31@example.com
password: user31
model: authentik_core.user
state: present
identifiers:
username: user31
- attrs:
name: User Thirty Two
email: user32@example.com
password: user32
model: authentik_core.user
state: present
identifiers:
username: user32
- attrs:
name: User Thirty Three
email: user33@example.com
password: user33
model: authentik_core.user
state: present
identifiers:
username: user33
version: 1
2 changes: 1 addition & 1 deletion docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1331,7 +1331,7 @@ services:
PROTOCOL: ${PROTOCOL:-https}
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
ports:
- ${COMPOSE_PORT_HTTP:-9000}:9000
- ${COMPOSE_PORT_HTTP:-9002}:9002
restart: unless-stopped
volumes:
- ./authentik-media:/media
Expand Down
Loading
Loading