Merge pull request #398 from outis1one/claude/frigate-authelia-openid-0l1htj
Claude/frigate authelia openid 0l1htj
This commit is contained in:
Outis
@@ -493,7 +493,7 @@ right (Portainer, ntfy), not general familiarity with the product:
|
||||
| Service | Native OIDC? | Notes |
|
||||
|---|---|---|
|
||||
| `mealie` | Yes — wired up | Pure env vars (`OIDC_AUTH_ENABLED`, `OIDC_CLIENT_ID/SECRET`, `OIDC_CONFIGURATION_URL`), see `_mealie_offer_authelia_oidc()`. Redirect URI is `<BASE_URL>/login`. Needs a `--forwarded-allow-ips` entrypoint override when Caddy-fronted, or the generated redirect URI comes out `http://` even when actually served over `https://` — see the function's own comment. |
|
||||
| `homebox` | Yes — wired up | Pure env vars (`HBOX_OIDC_ENABLED`, `HBOX_OIDC_ISSUER_URL`, `HBOX_OIDC_CLIENT_ID/SECRET`, `HBOX_OIDC_SCOPE`), see `_homebox_offer_authelia_oidc()`. Confirmed against homebox.software's own OIDC docs and authelia.com's Homebox integration page — needs PKCE (unlike Mealie/ActualBudget). Redirect path is `/api/v1/users/login/oidc/callback`; issuer URL is reportedly sensitive to a trailing slash (a real upstream bug), so it's written from this repo's own portal-URL value as-is, never with one appended. The stock compose template didn't have `env_file: .env` (vars were listed individually in `environment:` instead) — added to the template, and patched onto any pre-existing install's compose file the first time this offer runs, or the written `.env` additions would silently never reach the container. `HBOX_OPTIONS_ALLOW_LOCAL_LOGIN=false`/`HBOX_OIDC_AUTO_REDIRECT=true` are real, documented env vars for fully replacing local login, offered as a separate step gated behind the same "have you tested the button first" confirmation as Mealie/Beszel. Unlike every other native-OIDC integration in this table, `HBOX_OIDC_SCOPE` needs a fourth scope, `groups`, alongside the usual `openid profile email` — Authelia's own Homebox integration page documents this. Confirmed live: requesting it without also granting it broke login outright (`invalid_scope: "The OAuth 2.0 Client is not allowed to request scope 'groups'"`), because Authelia enforces a per-client scopes allowlist independent of what the server supports overall — `_authelia_provision_oidc_client()` used to hardcode `openid`/`profile`/`email` for every caller with no way to add more. Fixed by giving it a 6th positional arg, `EXTRA_SCOPES` (space-separated, inserted right after `REQUIRE_PKCE`), that every other existing caller passes as `""` — Homebox's is the only caller that passes `"groups"`. |
|
||||
| `homebox` | Yes — wired up | Pure env vars (`HBOX_OIDC_ENABLED`, `HBOX_OIDC_ISSUER_URL`, `HBOX_OIDC_CLIENT_ID/SECRET`, `HBOX_OIDC_SCOPE`), see `_homebox_offer_authelia_oidc()`. Confirmed against homebox.software's own OIDC docs and authelia.com's Homebox integration page — needs PKCE (unlike Mealie/ActualBudget). Redirect path is `/api/v1/users/login/oidc/callback`; issuer URL is reportedly sensitive to a trailing slash (a real upstream bug), so it's written from this repo's own portal-URL value as-is, never with one appended. The stock compose template didn't have `env_file: .env` (vars were listed individually in `environment:` instead) — added to the template, and patched onto any pre-existing install's compose file the first time this offer runs, or the written `.env` additions would silently never reach the container. `HBOX_OPTIONS_ALLOW_LOCAL_LOGIN=false`/`HBOX_OIDC_AUTO_REDIRECT=true` are real, documented env vars for fully replacing local login, offered as a separate step gated behind the same "have you tested the button first" confirmation as Mealie/Beszel. Unlike every other native-OIDC integration in this table, `HBOX_OIDC_SCOPE` needs a fourth scope, `groups`, alongside the usual `openid profile email` — Authelia's own Homebox integration page documents this. Confirmed live: requesting it without also granting it broke login outright (`invalid_scope: "The OAuth 2.0 Client is not allowed to request scope 'groups'"`), because Authelia enforces a per-client scopes allowlist independent of what the server supports overall — `_authelia_provision_oidc_client()` used to hardcode `openid`/`profile`/`email` for every caller with no way to add more. Fixed by giving it a 6th positional arg, `EXTRA_SCOPES` (space-separated, inserted right after `REQUIRE_PKCE`), that every other existing caller passes as `""` — Homebox's is the only caller that passes `"groups"`. Separately, some Homebox collections hit an unrelated upstream bug (sysadminsmedia/homebox#1593): the default `Location`/`Item` entity types never get seeded for that collection, so the Create dialog's type dropdown comes up empty and creation fails with "Please select an entity type" regardless of Authelia. `_homebox_offer_entity_type_fix()` is the opt-in repair: entity types are scoped per collection with no unauthenticated read/write (confirmed against Homebox's own swagger doc — `GET`/`POST /v1/entity-types` both require a bearer token, and there's no documented endpoint to switch a token between a user's collections), so rather than baking in or storing any credential it prompts for a pasted API token at the moment it runs — same one-time, never-persisted trust model as `_immich_offer_authelia_oidc()`'s own admin-API-key prompt — checks for an existing `isLocation:true` type, and POSTs the two defaults only if none exist. Explicitly told upfront that fixing it only covers the one collection that token's account belongs to; a multi-collection user has to repeat the step once per collection. |
|
||||
| `actualbudget` | Yes — wired up | Pure env vars (`ACTUAL_OPENID_DISCOVERY_URL`, `ACTUAL_OPENID_CLIENT_ID/SECRET`, `ACTUAL_OPENID_SERVER_HOSTNAME`), see `_actualbudget_offer_authelia_oidc()`. Redirect path `/openid/callback` (matches the existing preset in `_authelia_add_oidc_client()`'s menu). First OIDC login becomes the server owner if none is set yet — Actual's own behavior. |
|
||||
| `immich` | Yes — wired up | Real OAuth2/OIDC settings under Administration → Settings, backed by `GET`/`PUT /api/system-config` — confirmed the exact JSON field names against Immich's own `config-file.md` and source directly (the `oauth` sub-object: `enabled`/`issuerUrl`/`clientId`/`clientSecret`/`scope`/`buttonText`, etc.), not guessed. See `_immich_offer_authelia_oidc()`. GET/PUT exchange the *whole* config object (no partial-patch endpoint), so it round-trips everything else — storage template, library settings — completely unchanged; the same shape already proven by `import-photos.sh`'s own storage-template step in this file. Needs an admin API key, which doesn't exist until the user creates their account on first web visit — this offer runs from both the fresh-install path (usually a no-op that first time) and the "update" rerun path, which is the realistic way most people finish this. |
|
||||
| `audiobookshelf` | Yes — wired up (Authelia side only) | Checked against audiobookshelf.org's own OIDC docs: config is UI-only (Settings → Authentication), no env var or config API — so `_audiobookshelf_offer_authelia_oidc()` registers the Authelia client (needs PKCE, confirmed via authelia.com's own integration page for it) and prints the exact individual-endpoint values to paste in, since Audiobookshelf wants those rather than a discovery URL. Three redirect URIs: web callback, mobile-redirect, and the `audiobookshelf://oauth` app-scheme callback. |
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
## "Please select an entity type" with an empty type dropdown
|
||||
|
||||
Some collections hit an upstream Homebox bug
|
||||
([sysadminsmedia/homebox#1593](https://github.com/sysadminsmedia/homebox/issues/1593)):
|
||||
the default `Location`/`Item` entity types never get seeded, so the Create
|
||||
dialog's type dropdown comes up empty and every Location/Item creation fails
|
||||
with "Please select an entity type."
|
||||
|
||||
### Option 1 — let the installer fix it
|
||||
|
||||
Re-run `sudo ./setup.sh homebox`, choose **update**, and say yes when asked
|
||||
"Hit 'Please select an entity type' with an empty type list...?" You'll need
|
||||
a Homebox API token (see step 2 below) — it's used once, right then, and
|
||||
never written to `.env` or disk.
|
||||
|
||||
This only fixes the ONE collection that token's account belongs to. Homebox
|
||||
has no documented way to switch a token between collections, so a
|
||||
multi-collection setup needs this repeated once per collection — not
|
||||
something the installer can do for you in one pass, and not really worth
|
||||
the trouble if you've only hit this on one collection already.
|
||||
|
||||
### Option 2 — fix it by hand in the UI
|
||||
|
||||
1. Log into Homebox (register first if you haven't — the first account
|
||||
becomes the admin).
|
||||
2. Click the **collection selector** (shows your current collection's name,
|
||||
near the top of the page) → **Collection options** (gear icon). This
|
||||
opens Collection Settings.
|
||||
3. Click the **Entity Types** tab (`/collection/entity-types`).
|
||||
4. Click **Create**, add:
|
||||
- Name: `Location`, with **Is Location** toggled **ON**
|
||||
- Name: `Item`, with **Is Location** toggled **OFF**
|
||||
5. Go back to the Create (+) dialog — "Select a type..." now lists both, so
|
||||
you can create Locations and Items normally.
|
||||
|
||||
If you use more than one collection, repeat step 2–4 once per collection —
|
||||
entity types are scoped per collection, not shared across your whole
|
||||
Homebox instance.
|
||||
|
||||
### Option 3 — fix it via the API directly
|
||||
|
||||
Needs an API token from your profile menu (**Create API Token**):
|
||||
|
||||
```bash
|
||||
curl -X POST "http://localhost:<port>/api/v1/entity-types" \
|
||||
-H "Authorization: Bearer <your-token>" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"name":"Location","isLocation":true}'
|
||||
|
||||
curl -X POST "http://localhost:<port>/api/v1/entity-types" \
|
||||
-H "Authorization: Bearer <your-token>" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"name":"Item","isLocation":false}'
|
||||
```
|
||||
@@ -319,6 +319,79 @@ _homebox_offer_disable_local_login() {
|
||||
|| log_warning "Restart failed — check: docker compose -f $DIR/docker-compose.yml logs"
|
||||
}
|
||||
|
||||
# Some Homebox installs hit an upstream bug (sysadminsmedia/homebox#1593): a
|
||||
# collection's default "Location"/"Item" entity types never get seeded, so
|
||||
# the Create dialog's type dropdown comes up empty and every Location/Item
|
||||
# creation fails with "Please select an entity type". There's no
|
||||
# unauthenticated way to detect or fix this — entity types are scoped per
|
||||
# collection (confirmed against Homebox's own swagger doc: GET/POST
|
||||
# /v1/entity-types both require a bearer token) — so this is opt-in and
|
||||
# asks for a token at the moment it runs, same trust model as Immich's
|
||||
# _immich_offer_authelia_oidc(): pasted once, used once, never written to
|
||||
# .env or disk.
|
||||
#
|
||||
# Args: DIR WEB_PORT
|
||||
_homebox_offer_entity_type_fix() {
|
||||
local DIR="$1" WEB_PORT="$2"
|
||||
local LOCAL_URL="http://localhost:${WEB_PORT}"
|
||||
|
||||
echo ""
|
||||
local _hit_bug=""
|
||||
prompt_yn " Hit \"Please select an entity type\" with an empty type list when creating a Location/Item? (y/n):" "n" _hit_bug
|
||||
[[ "$_hit_bug" =~ ^[Yy]$ ]] || return 0
|
||||
|
||||
echo ""
|
||||
log_info "That's a known upstream Homebox bug (sysadminsmedia/homebox#1593) — this"
|
||||
log_info "collection's default entity types were never seeded. Fixing it needs an"
|
||||
log_info "API token from an account that's already registered:"
|
||||
echo " 1. Log into Homebox in your browser (register first if you haven't)."
|
||||
echo " 2. Open your profile menu -> Create API Token."
|
||||
echo " 3. Paste it below — used once right now, never saved to disk."
|
||||
echo ""
|
||||
local HB_TOKEN=""
|
||||
prompt_text " Homebox API token:" "" HB_TOKEN
|
||||
if [ -z "$HB_TOKEN" ]; then
|
||||
log_info "Skipped. Re-run 'sudo ./setup.sh homebox' (choose update) once you have a token."
|
||||
return 0
|
||||
fi
|
||||
|
||||
local VERIFY_CODE
|
||||
VERIFY_CODE="$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $HB_TOKEN" "$LOCAL_URL/api/v1/users/self" 2>/dev/null)"
|
||||
if [ "$VERIFY_CODE" != "200" ]; then
|
||||
log_warning "Token didn't validate (HTTP $VERIFY_CODE) — skipping. Generate a fresh one and re-run."
|
||||
return 0
|
||||
fi
|
||||
|
||||
local EXISTING_TYPES
|
||||
EXISTING_TYPES="$(curl -s -H "Authorization: Bearer $HB_TOKEN" "$LOCAL_URL/api/v1/entity-types" 2>/dev/null)"
|
||||
if echo "$EXISTING_TYPES" | grep -q '"isLocation":[[:space:]]*true'; then
|
||||
log_success "This collection already has a location-type entity type — nothing to fix."
|
||||
return 0
|
||||
fi
|
||||
|
||||
local _created=0 _code
|
||||
_code="$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $HB_TOKEN" \
|
||||
-H "Content-Type: application/json" -d '{"name":"Location","isLocation":true}' \
|
||||
"$LOCAL_URL/api/v1/entity-types" 2>/dev/null)"
|
||||
[[ "$_code" == 20* ]] && _created=$((_created + 1))
|
||||
_code="$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $HB_TOKEN" \
|
||||
-H "Content-Type: application/json" -d '{"name":"Item","isLocation":false}' \
|
||||
"$LOCAL_URL/api/v1/entity-types" 2>/dev/null)"
|
||||
[[ "$_code" == 20* ]] && _created=$((_created + 1))
|
||||
|
||||
if [ "$_created" -eq 2 ]; then
|
||||
log_success "Created the missing 'Location' and 'Item' entity types — the Create dialog's type dropdown should be populated now."
|
||||
else
|
||||
log_warning "Something didn't go through cleanly — check the type dropdown in Homebox and retry if it's still empty."
|
||||
fi
|
||||
|
||||
echo ""
|
||||
log_info "This only fixes the ONE collection your token's account belongs to. Homebox"
|
||||
log_info "has no documented way to switch a token between collections, so if you use"
|
||||
log_info "more than one collection, log in as a member of each other one, generate a"
|
||||
log_info "token there, and re-run this step for it too."
|
||||
}
|
||||
|
||||
install_homebox() {
|
||||
require_docker || return 1
|
||||
log_info "Installing Homebox..."
|
||||
@@ -381,6 +454,14 @@ install_homebox() {
|
||||
|| log_warning "Refresh failed — check: docker compose -f $HB_DIR/docker-compose.yml logs"
|
||||
_homebox_offer_authelia_oidc "$HB_DIR" "$CONTAINER"
|
||||
_homebox_offer_disable_local_login "$HB_DIR"
|
||||
# WEB_PORT isn't persisted anywhere but the compose
|
||||
# file itself — re-derive it here the same way
|
||||
# services/immich.sh does for its own update-path
|
||||
# offer, rather than assuming the pre-scan default.
|
||||
local _EXISTING_PORT
|
||||
_EXISTING_PORT="$(grep -oP '^\s+- "?\K[0-9]+(?=:7745)' "$HB_DIR/docker-compose.yml" 2>/dev/null | head -1)"
|
||||
[ -n "$_EXISTING_PORT" ] && WEB_PORT="$_EXISTING_PORT"
|
||||
_homebox_offer_entity_type_fix "$HB_DIR" "$WEB_PORT"
|
||||
return 0
|
||||
;;
|
||||
cancel)
|
||||
@@ -475,6 +556,7 @@ HB_ENV
|
||||
configure_caddy_for_service "Homebox${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}" "${CONTAINER}:7745" "homebox${INSTANCE_SUFFIX:+-$INSTANCE_SUFFIX}"
|
||||
|
||||
_homebox_offer_authelia_oidc "$HB_DIR" "$CONTAINER"
|
||||
_homebox_offer_entity_type_fix "$HB_DIR" "$WEB_PORT"
|
||||
|
||||
write_readme "$HB_DIR" << MD
|
||||
# Homebox${INSTANCE_SUFFIX:+ — $INSTANCE_SUFFIX}
|
||||
|
||||
Reference in New Issue
Block a user