From fc3b85f97029ead233fc81e5327360aa2dddf825 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 20 Aug 2026 20:17:58 +0000 Subject: [PATCH] authelia: stop hardcoding "auth." as the portal subdomain for OIDC discovery MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _authelia_provision_oidc_client() gained a new out-param, OIDC_AUTHELIA_PORTAL_URL, read back from the instance's own configuration.yml (session.cookies[].authelia_url) — the actual source of truth for where the portal lives — instead of every caller separately assuming "https://auth.$domain". install_authelia() and add_authelia_domain() both still default new instances to "auth." as before (unchanged), but that's just a default, not a guarantee: it's plain text in configuration.yml and gets hand-edited on some boxes (e.g. a dedicated instance renamed to "authelia." to avoid colliding with another instance's "auth." on a different machine). Mealie, ActualBudget, and Gitea's native-OIDC wiring all independently hardcoded "auth." when building their discovery URL, so a renamed portal silently produced a discovery URL pointing at a host that doesn't serve Authelia — surfacing as an opaque 500 during the OIDC token exchange with no useful client-side error. Verified the new awk parse against both a default ("auth.") and a renamed ("authelia.") cookies block before trusting it. --- services/actualbudget.sh | 2 +- services/authelia.sh | 21 +++++++++++++++++++++ services/gitea.sh | 2 +- services/mealie.sh | 2 +- 4 files changed, 24 insertions(+), 3 deletions(-) diff --git a/services/actualbudget.sh b/services/actualbudget.sh index 373c599..928f34c 100644 --- a/services/actualbudget.sh +++ b/services/actualbudget.sh @@ -258,7 +258,7 @@ _actualbudget_offer_authelia_oidc() { return 0 fi - local _discovery_url="https://auth.${OIDC_AUTHELIA_DOMAIN}/.well-known/openid-configuration" + local _discovery_url="${OIDC_AUTHELIA_PORTAL_URL}/.well-known/openid-configuration" cat >> "$DIR/.env" << ENV # Written by services/actualbudget.sh's Authelia SSO step. The first OIDC diff --git a/services/authelia.sh b/services/authelia.sh index 0d3b26f..0a25d0a 100644 --- a/services/authelia.sh +++ b/services/authelia.sh @@ -1694,6 +1694,19 @@ _authelia_remove_oidc_client() { # caller must capture and use/display it now. # OIDC_AUTHELIA_DOMAIN this Authelia instance's apex domain, for # building discovery/authorization/token URLs. +# OIDC_AUTHELIA_PORTAL_URL the actual login-portal base URL (e.g. +# https://auth.example.com) — read back from this +# instance's own config rather than assumed, +# since the portal subdomain isn't always "auth." +# (install_authelia()/add_authelia_domain() both +# default to it, but it's plain text in +# configuration.yml and gets hand-edited on some +# boxes — e.g. a dedicated VPS instance renamed +# to "authelia." to avoid colliding with another +# instance's "auth." on a different machine). +# Use this, not a hardcoded "https://auth.$domain", +# when building a discovery/redirect URL for a +# native-OIDC app. # Returns 1 on failure (Authelia not installed, domain undeterminable, # secret generation failed) with the reason already logged. A client_id # that's already registered is NOT a failure — it gets replaced (see the @@ -1704,6 +1717,7 @@ _authelia_provision_oidc_client() { OIDC_CLIENT_SECRET_PLAIN="" OIDC_AUTHELIA_DOMAIN="" + OIDC_AUTHELIA_PORTAL_URL="" local AUTHELIA_DIR="$DOCKER_DIR/authelia" local CONFIG_FILE="$AUTHELIA_DIR/config/configuration.yml" @@ -1728,6 +1742,13 @@ _authelia_provision_oidc_client() { return 1 fi + # Read the real portal URL back from config instead of assuming the + # "auth." prefix — see the OIDC_AUTHELIA_PORTAL_URL out-param comment + # above for why this can't be hardcoded. Falls back to the "auth." + # default only if parsing somehow comes up empty. + OIDC_AUTHELIA_PORTAL_URL="$(awk '/^ cookies:$/{f=1; next} f && /authelia_url:/{print $2; exit}' "$CONFIG_FILE")" + [ -z "$OIDC_AUTHELIA_PORTAL_URL" ] && OIDC_AUTHELIA_PORTAL_URL="https://auth.${OIDC_AUTHELIA_DOMAIN}" + # A stale registration (e.g. from the interactive "Register an app" menu # run previously without ever finishing — its plaintext secret was shown # once and is gone, so the registration is dead weight either way) would diff --git a/services/gitea.sh b/services/gitea.sh index f9ce2a4..30c4f50 100644 --- a/services/gitea.sh +++ b/services/gitea.sh @@ -220,7 +220,7 @@ _gitea_offer_authelia_sso() { return 0 fi - local _discovery_url="https://auth.${OIDC_AUTHELIA_DOMAIN}/.well-known/openid-configuration" + local _discovery_url="${OIDC_AUTHELIA_PORTAL_URL}/.well-known/openid-configuration" log_info "Adding Authelia as an authentication source in Gitea..." if docker exec -u git gitea gitea admin auth add-oauth \ --name authelia --provider openidConnect \ diff --git a/services/mealie.sh b/services/mealie.sh index 20de5c1..ffb9baa 100644 --- a/services/mealie.sh +++ b/services/mealie.sh @@ -253,7 +253,7 @@ _mealie_offer_authelia_oidc() { return 0 fi - local _discovery_url="https://auth.${OIDC_AUTHELIA_DOMAIN}/.well-known/openid-configuration" + local _discovery_url="${OIDC_AUTHELIA_PORTAL_URL}/.well-known/openid-configuration" cat >> "$DIR/.env" << ENV # Written by services/mealie.sh's Authelia SSO step — adds "Sign in with