From 9772441fe0f25140f05e6153ec25f358d265ddf2 Mon Sep 17 00:00:00 2001 From: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:32:54 +0300 Subject: [PATCH 1/7] fix(authentik): align docker-compose authentik image to 2026.5.5 (#555) Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index e49e018e..969870c1 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -206,7 +206,7 @@ services: # AUTHENTIK OIDC/OAuth2 AUTHENTICATION # ================================ authentik-server: - image: ghcr.io/goauthentik/server:2024.12.3 + image: ghcr.io/goauthentik/server:2026.5.5 container_name: fuzefront-authentik-server command: server environment: @@ -262,7 +262,7 @@ services: - 'traefik.http.routers.authentik.tls=false' authentik-worker: - image: ghcr.io/goauthentik/server:2024.12.3 + image: ghcr.io/goauthentik/server:2026.5.5 container_name: fuzefront-authentik-worker command: worker environment: From a234261448db78b6070cc5e6c0ed3eaa646d728f Mon Sep 17 00:00:00 2001 From: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:33:38 +0300 Subject: [PATCH 2/7] docs(authentik): update provision script comments to 2026.5.5 (#555) Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba --- deploy/e2e/provision-authentik-oidc.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/e2e/provision-authentik-oidc.sh b/deploy/e2e/provision-authentik-oidc.sh index fc5fdc7f..8366bf7a 100755 --- a/deploy/e2e/provision-authentik-oidc.sh +++ b/deploy/e2e/provision-authentik-oidc.sh @@ -32,7 +32,7 @@ else fi # ── Resolve the implicit-consent authorization flow via the Django ORM ──────── -# Prefer Authentik 2024.12.3's built-in flow: Authentik itself configures the +# Prefer Authentik 2026.5.5's built-in flow: Authentik itself configures the # ConsentStage correctly (the valid mode is 'permanent', NOT 'never_require'). echo "Resolving implicit-consent authorization flow via Python ORM..." FLOW_OUTPUT=$($COMPOSE exec -T authentik-worker python - <<'PYEOF' @@ -106,7 +106,7 @@ fi # ── Scope mappings via the Django ORM ───────────────────────────────────────── # /api/v3/propertymappings/scope/ returns 405 for POST and 404 for GET in this -# Authentik 2024.12.3 setup — the URL pattern is not registered at the Django +# Authentik 2026.5.5 setup — the URL pattern is not registered at the Django # routing layer. Bypass REST entirely and use the ORM. echo "Getting scope mapping PKs via Python ORM..." SCOPE_OUTPUT=$($COMPOSE exec -T authentik-worker python - <<'PYEOF' @@ -139,7 +139,7 @@ if [ -z "$SCOPE_OPENID" ] || [ -z "$SCOPE_EMAIL" ] || [ -z "$SCOPE_PROFILE" ]; t fi echo "Scope mapping PKs: openid=$SCOPE_OPENID email=$SCOPE_EMAIL profile=$SCOPE_PROFILE" -# ── Invalidation flow (required on the OAuth2 provider in 2024.12.3) ────────── +# ── Invalidation flow (required on the OAuth2 provider in 2026.5.5) ────────── INV_FLOW_RAW=$(curl -s -H "$AUTH" "$BASE/flows/instances/?designation=invalidation") INV_FLOW_PK=$(echo "$INV_FLOW_RAW" | jq -r '.results[0].pk // empty' 2>/dev/null || true) echo "Invalidation flow lookup: pk=${INV_FLOW_PK:-NOT_FOUND}" From 58041162800e6c17ff87170d753a50c5689e80f3 Mon Sep 17 00:00:00 2001 From: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:34:23 +0300 Subject: [PATCH 3/7] fix(authentik): roll chart image forward to 2026.5.5 to match migrated prod DB (#555) Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba --- deploy/helm/fuzefront/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/helm/fuzefront/values.yaml b/deploy/helm/fuzefront/values.yaml index fe46b4d2..aaaabd7f 100644 --- a/deploy/helm/fuzefront/values.yaml +++ b/deploy/helm/fuzefront/values.yaml @@ -548,7 +548,7 @@ authentik: enabled: true image: repository: ghcr.io/goauthentik/server - tag: "2024.12.3" + tag: "2026.5.5" host: auth.fuzefront.dev.local dbName: authentik # must pre-exist in the FuzeInfra Postgres cookieDomain: fuzefront.dev.local From 6f6ca3453f3ed3e006ccdabb7e09029a82fa3cae Mon Sep 17 00:00:00 2001 From: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:34:44 +0300 Subject: [PATCH 4/7] fix(authentik): align e2e compose authentik image to 2026.5.5 (#555) Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba --- docker-compose.e2e.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.e2e.yml b/docker-compose.e2e.yml index 47d4c410..f30ec988 100644 --- a/docker-compose.e2e.yml +++ b/docker-compose.e2e.yml @@ -76,7 +76,7 @@ services: # ── Authentik worker (applies blueprints, including Google source + OIDC provider) ─ authentik-worker: - image: ghcr.io/goauthentik/server:2024.12.3 + image: ghcr.io/goauthentik/server:2026.5.5 command: worker environment: AUTHENTIK_REDIS__HOST: redis @@ -116,7 +116,7 @@ services: # ── Authentik server ────────────────────────────────────────────────────── authentik-server: - image: ghcr.io/goauthentik/server:2024.12.3 + image: ghcr.io/goauthentik/server:2026.5.5 command: server environment: AUTHENTIK_REDIS__HOST: redis From 0532af68aa982fba6774999970affd5735b38e99 Mon Sep 17 00:00:00 2001 From: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:53:49 +0300 Subject: [PATCH 5/7] =?UTF-8?q?revert(authentik):=20keep=20docker-compose?= =?UTF-8?q?=20on=202024.12.3=20=E2=80=94=202026.5.5=20headless=20sign-in?= =?UTF-8?q?=20needs=20a=20security-service=20flow-driver=20update=20(out?= =?UTF-8?q?=20of=20scope=20for=20#555)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 969870c1..e49e018e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -206,7 +206,7 @@ services: # AUTHENTIK OIDC/OAuth2 AUTHENTICATION # ================================ authentik-server: - image: ghcr.io/goauthentik/server:2026.5.5 + image: ghcr.io/goauthentik/server:2024.12.3 container_name: fuzefront-authentik-server command: server environment: @@ -262,7 +262,7 @@ services: - 'traefik.http.routers.authentik.tls=false' authentik-worker: - image: ghcr.io/goauthentik/server:2026.5.5 + image: ghcr.io/goauthentik/server:2024.12.3 container_name: fuzefront-authentik-worker command: worker environment: From 3f7e30d1bee6860d341a412452848dbea318d2a6 Mon Sep 17 00:00:00 2001 From: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:54:08 +0300 Subject: [PATCH 6/7] =?UTF-8?q?revert(authentik):=20keep=20e2e=20compose?= =?UTF-8?q?=20on=202024.12.3=20=E2=80=94=202026.5.5=20breaks=20the=20headl?= =?UTF-8?q?ess=20OIDC=20E2E=20(security-service=20incompatibility);=20trac?= =?UTF-8?q?ked=20as=20follow-up=20(#555)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba --- docker-compose.e2e.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.e2e.yml b/docker-compose.e2e.yml index f30ec988..47d4c410 100644 --- a/docker-compose.e2e.yml +++ b/docker-compose.e2e.yml @@ -76,7 +76,7 @@ services: # ── Authentik worker (applies blueprints, including Google source + OIDC provider) ─ authentik-worker: - image: ghcr.io/goauthentik/server:2026.5.5 + image: ghcr.io/goauthentik/server:2024.12.3 command: worker environment: AUTHENTIK_REDIS__HOST: redis @@ -116,7 +116,7 @@ services: # ── Authentik server ────────────────────────────────────────────────────── authentik-server: - image: ghcr.io/goauthentik/server:2026.5.5 + image: ghcr.io/goauthentik/server:2024.12.3 command: server environment: AUTHENTIK_REDIS__HOST: redis From 2a4a5e97910b69f3397767c04b419e78e5062ece Mon Sep 17 00:00:00 2001 From: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:54:26 +0300 Subject: [PATCH 7/7] revert(authentik): restore provision-script comments to 2024.12.3 to match the e2e image (#555) Claude-Session-Id: 939d3fb6-7af2-4a38-9f26-f94ed9d0bcba --- deploy/e2e/provision-authentik-oidc.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/e2e/provision-authentik-oidc.sh b/deploy/e2e/provision-authentik-oidc.sh index 8366bf7a..fc5fdc7f 100755 --- a/deploy/e2e/provision-authentik-oidc.sh +++ b/deploy/e2e/provision-authentik-oidc.sh @@ -32,7 +32,7 @@ else fi # ── Resolve the implicit-consent authorization flow via the Django ORM ──────── -# Prefer Authentik 2026.5.5's built-in flow: Authentik itself configures the +# Prefer Authentik 2024.12.3's built-in flow: Authentik itself configures the # ConsentStage correctly (the valid mode is 'permanent', NOT 'never_require'). echo "Resolving implicit-consent authorization flow via Python ORM..." FLOW_OUTPUT=$($COMPOSE exec -T authentik-worker python - <<'PYEOF' @@ -106,7 +106,7 @@ fi # ── Scope mappings via the Django ORM ───────────────────────────────────────── # /api/v3/propertymappings/scope/ returns 405 for POST and 404 for GET in this -# Authentik 2026.5.5 setup — the URL pattern is not registered at the Django +# Authentik 2024.12.3 setup — the URL pattern is not registered at the Django # routing layer. Bypass REST entirely and use the ORM. echo "Getting scope mapping PKs via Python ORM..." SCOPE_OUTPUT=$($COMPOSE exec -T authentik-worker python - <<'PYEOF' @@ -139,7 +139,7 @@ if [ -z "$SCOPE_OPENID" ] || [ -z "$SCOPE_EMAIL" ] || [ -z "$SCOPE_PROFILE" ]; t fi echo "Scope mapping PKs: openid=$SCOPE_OPENID email=$SCOPE_EMAIL profile=$SCOPE_PROFILE" -# ── Invalidation flow (required on the OAuth2 provider in 2026.5.5) ────────── +# ── Invalidation flow (required on the OAuth2 provider in 2024.12.3) ────────── INV_FLOW_RAW=$(curl -s -H "$AUTH" "$BASE/flows/instances/?designation=invalidation") INV_FLOW_PK=$(echo "$INV_FLOW_RAW" | jq -r '.results[0].pk // empty' 2>/dev/null || true) echo "Invalidation flow lookup: pk=${INV_FLOW_PK:-NOT_FOUND}"