From cfe59e365209c16f894f072829bd7c91874c6c58 Mon Sep 17 00:00:00 2001 From: Kerim Atilgan Date: Sun, 27 Sep 2026 13:24:07 +0200 Subject: [PATCH] Setup-Skript: Grant-Types und Logout-Redirect beim Portal-Provider setzen Ohne grant_types lehnt Authentik jede Anmeldung mit "invalid_request / The request is otherwise malformed" ab. Co-Authored-By: Claude Opus 5.5 (1M context) --- scripts/authentik-setup.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/scripts/authentik-setup.py b/scripts/authentik-setup.py index 3b1fd65..9de1df8 100644 --- a/scripts/authentik-setup.py +++ b/scripts/authentik-setup.py @@ -118,10 +118,13 @@ def ensure_portal_app(apps): "authorization_flow": template["authorization_flow"], "invalidation_flow": template["invalidation_flow"], "client_type": "confidential", + # Neuere Authentik-Versionen setzen per API keine Standard-Grant-Types; + # ohne diese Liste lehnt Authentik jede Anmeldung als "malformed" ab. + "grant_types": ["authorization_code", "refresh_token"], "redirect_uris": [ - {"matching_mode": "strict", "url": f"{PORTAL_URL}/auth/callback"}, + {"matching_mode": "strict", "url": f"{PORTAL_URL}/auth/callback", "redirect_uri_type": "authorization"}, # Rücksprung nach dem Abmelden (post_logout_redirect_uri) - {"matching_mode": "strict", "url": f"{PORTAL_URL}/"}, + {"matching_mode": "strict", "url": f"{PORTAL_URL}/", "redirect_uri_type": "logout"}, ], "property_mappings": template["property_mappings"], "signing_key": template.get("signing_key"),