fix(fw,web-arm): make the Warpgate and OneCLI SSO logins work against Authelia #548

Merged

dominik.polakovics merged 1 commit from lab/20261026-1220 into main

2026-10-26 12:37:16 +01:00

dominik.polakovics commented

2026-10-26 12:34:24 +01:00

Owner

Refs #452 (the Keycloak-to-Authelia switch; Keycloak retirement stays a follow-up).

Both SSO logins were still failing against Authelia, for different reasons.

Warpgate: the Authelia config never reached disk

The live process on fw has been running since Oct 7 and its SSO return still carries iss=https://sso.cloonar.com/realms/cloonar. The lib.mkForce ExecStart added for --enable-admin-token (cb254570) replaced upstream's start script, and that script is what copies the rendered config into /var/lib/warpgate/config.yaml on every start. Consequences:

the on-disk config has been frozen at the Keycloak settings since Oct 7;
the unit no longer references the rendered config, so a settings change does not restart it on switch (verified: no restart of warpgate.service in any bento activation since Oct 10).

Fix: render the settings with pkgs.formats.yaml and install that file in ExecStartPre before the existing secret injection. The store reference also makes settings changes restart the unit again. On 26.11 upstream does its own copy in ExecStartPre; ours then runs after it and is a harmless repeat.

OneCLI: Auth.js sends no `state`, Authelia rejects the request

Authelia's log for every attempt:

Authorization Request failed with error: The state is missing or does not have enough characters and is therefore considered too weak.

OneCLI reports that as OAuthCallbackError. Auth.js v5 defaults to checks: ["pkce"], so the authorization URL carries no state; Keycloak tolerated that, Authelia does not. Patch 01 now sets checks: ["pkce", "state"].

Deploy steps after merge

OneCLI image rebuild (manual): hosts/web-arm/modules/onecli/update.sh on a machine with root on web-arm. The suffix is bumped to cl7; the script rebuilds, pushes and repins the digest in default.nix. The pin in this PR is still cl6, so the OneCLI half only takes effect once that repin is committed. The lab could not do this: GitHub is blocked by the credential gateway and only the read-only Diag channel reaches web-arm.
fw picks up the Warpgate change via bento; the unit text changes, so Warpgate restarts and re-reads the Authelia issuer.
Both apps keep their existing client secrets, which were copied into Authelia's hashes.

Side observation, not touched here: every Warpgate SSO login logs SSO role mapping references non-existent role "warpgate:admin", skipping.

Verification: the patch's hunk counts were re-checked arithmetically; pre-commit dry-build ran on commit.

🤖 Generated with Claude Code

Refs #452 (the Keycloak-to-Authelia switch; Keycloak retirement stays a follow-up). Both SSO logins were still failing against Authelia, for different reasons. ## Warpgate: the Authelia config never reached disk The live process on fw has been running since Oct 7 and its SSO return still carries `iss=https://sso.cloonar.com/realms/cloonar`. The `lib.mkForce` ExecStart added for `--enable-admin-token` (cb254570) replaced upstream's start script, and that script is what copies the rendered config into `/var/lib/warpgate/config.yaml` on every start. Consequences: - the on-disk config has been frozen at the Keycloak settings since Oct 7; - the unit no longer references the rendered config, so a `settings` change does not restart it on switch (verified: no restart of warpgate.service in any bento activation since Oct 10). Fix: render the settings with `pkgs.formats.yaml` and install that file in `ExecStartPre` before the existing secret injection. The store reference also makes settings changes restart the unit again. On 26.11 upstream does its own copy in `ExecStartPre`; ours then runs after it and is a harmless repeat. ## OneCLI: Auth.js sends no `state`, Authelia rejects the request Authelia's log for every attempt: ``` Authorization Request failed with error: The state is missing or does not have enough characters and is therefore considered too weak. ``` OneCLI reports that as `OAuthCallbackError`. Auth.js v5 defaults to `checks: ["pkce"]`, so the authorization URL carries no `state`; Keycloak tolerated that, Authelia does not. Patch 01 now sets `checks: ["pkce", "state"]`. ## Deploy steps after merge 1. **OneCLI image rebuild (manual):** `hosts/web-arm/modules/onecli/update.sh` on a machine with root on web-arm. The suffix is bumped to `cl7`; the script rebuilds, pushes and repins the digest in `default.nix`. The pin in this PR is still `cl6`, so the OneCLI half only takes effect once that repin is committed. The lab could not do this: GitHub is blocked by the credential gateway and only the read-only Diag channel reaches web-arm. 2. fw picks up the Warpgate change via bento; the unit text changes, so Warpgate restarts and re-reads the Authelia issuer. 3. Both apps keep their existing client secrets, which were copied into Authelia's hashes. Side observation, not touched here: every Warpgate SSO login logs `SSO role mapping references non-existent role "warpgate:admin", skipping`. Verification: the patch's hunk counts were re-checked arithmetically; pre-commit dry-build ran on commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-10-26 12:34:24 +01:00

fix(fw,web-arm): make the Warpgate and OneCLI SSO logins work against Authelia a79b04c4e2

Warpgate never picked up the Authelia issuer: the forced ExecStart that
adds --enable-admin-token replaced upstream's start script, which is what
copied the rendered config into /var/lib/warpgate on every start. The
on-disk config.yaml has been frozen at the Keycloak settings since then,
and with no store reference left in the unit a `settings` change no longer
restarts it either. ExecStartPre now installs the rendered config before
injecting the client secret.

OneCLI's authorization request was rejected by Authelia outright: Auth.js
sends only PKCE by default and Authelia requires a state parameter, which
Keycloak tolerated missing. The OIDC provider now asks for both checks;
the image needs a rebuild via update.sh (suffix bumped to cl7) and repin.

Refs #452

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

dominik.polakovics merged commit aab00b44df into main

2026-10-26 12:37:16 +01:00

dominik.polakovics deleted branch lab/20261026-1220

2026-10-26 12:37:16 +01:00

dominik.polakovics referenced this pull request from a commit

2026-10-26 12:37:17 +01:00

Merge pull request 'fix(fw,web-arm): make the Warpgate and OneCLI SSO logins work against Authelia' (#548) from lab/20261026-1220 into main

dominik.polakovics referenced this pull request

2026-10-26 13:22:53 +01:00

fix(web-arm): hash the deployed OIDC secrets for the onecli, warpgate and paperless clients #553