fix(web-arm): hash the deployed OIDC secrets for the onecli, warpgate and paperless clients #553

Merged

dominik.polakovics merged 1 commit from lab/20261026-1220 into main

2026-10-26 14:25:10 +01:00

dominik.polakovics commented

2026-10-26 13:22:53 +01:00

Owner

Refs #452. Follow-up to #548.

After #548 both logins reach Authelia's token endpoint and fail there, for OneCLI and Warpgate alike:

Access Request failed with error: Client authentication failed (...). The provided client secret did not match the registered client secret.

The onecli, warpgate and paperless clients were registered in Authelia (cde71e41) with digests of fresh secrets, but the plaintexts never reached hosts/fw/secrets.sops.yaml and hosts/web-arm/secrets.sops.yaml; those still hold the Keycloak-era values, which Keycloak reads from the same sops entries and which worked until the switch. The three digests here were generated from those existing plaintexts with authelia crypto hash generate pbkdf2, so no sops edit is needed and Keycloak keeps working as the rollback path.

Not verified: no dry-build ran. The pre-commit hook does not resolve in this lab worktree and the sops-nix fetch from GitHub is blocked here; the change is three string literals in the clients list, and the file parses. The file already fails nixpkgs-fmt --check on main, left untouched to keep the diff minimal.

After deploy: log in to OneCLI and Warpgate with an Administrators account. A non-admin account such as the superbros one is denied by the admin-only client policy, which is the configured behaviour.

🤖 Generated with Claude Code

Refs #452. Follow-up to #548. After #548 both logins reach Authelia's token endpoint and fail there, for OneCLI and Warpgate alike: ``` Access Request failed with error: Client authentication failed (...). The provided client secret did not match the registered client secret. ``` The onecli, warpgate and paperless clients were registered in Authelia (cde71e41) with digests of fresh secrets, but the plaintexts never reached `hosts/fw/secrets.sops.yaml` and `hosts/web-arm/secrets.sops.yaml`; those still hold the Keycloak-era values, which Keycloak reads from the same sops entries and which worked until the switch. The three digests here were generated from those existing plaintexts with `authelia crypto hash generate pbkdf2`, so no sops edit is needed and Keycloak keeps working as the rollback path. Not verified: no dry-build ran. The pre-commit hook does not resolve in this lab worktree and the sops-nix fetch from GitHub is blocked here; the change is three string literals in the `clients` list, and the file parses. The file already fails `nixpkgs-fmt --check` on main, left untouched to keep the diff minimal. After deploy: log in to OneCLI and Warpgate with an Administrators account. A non-admin account such as the superbros one is denied by the admin-only client policy, which is the configured behaviour. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-10-26 13:23:08 +01:00

fix(web-arm): hash the deployed OIDC secrets for the onecli, warpgate and paperless clients 3f4a36e62b

The three clients that moved from Keycloak to Authelia were registered
with digests of fresh secrets that never reached the sops files, so every
token request failed with invalid_client while the authorization step
already succeeded. The digests now match the plaintexts the hosts have
had all along, which Keycloak keeps using unchanged.

Refs #452

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

dominik.polakovics merged commit e0f32efb91 into main

2026-10-26 14:25:10 +01:00

dominik.polakovics deleted branch lab/20261026-1220

2026-10-26 14:25:10 +01:00

dominik.polakovics referenced this pull request from a commit

2026-10-26 14:25:12 +01:00

Merge pull request 'fix(web-arm): hash the deployed OIDC secrets for the onecli, warpgate and paperless clients' (#553) from lab/20261026-1220 into main