Authentik events show login_failed at default-authentication-password stage. Suspected: the default password stage may require additional config for headless/ROPC flow vs browser flow.
client_credentials works for all service accounts. Only human user password grant is broken.
Acceptance Criteria
POST /auth/token accepts {"username":"...","password":"...","scope":"..."}
Proxies to Authentik token endpoint with grant_type=password
Returns JWT + refresh token
Unit tests
Depends on
P3.2 ✅ (done)
P3.7 (config wiring)
Password grant debugging (blocker)
## Summary
Gateway exposes `POST /auth/token` accepting username+password, exchanges with Authentik via `grant_type=password`, returns JWT + refresh token.
**Code repo:** `rock/homelab-frontend` — `internal/proxy/auth_endpoints.go`
## Blocker (2026-09-08)
Password grant on `api-gw` provider returns `invalid_grant` for user `rock` despite:
- Password reset and verified correct
- `rock` added to `api-gw-users` group
- Headless auth flow bound (identification → password → login)
- `password` in grant_types
Authentik events show `login_failed` at `default-authentication-password` stage. Suspected: the default password stage may require additional config for headless/ROPC flow vs browser flow.
**client_credentials works** for all service accounts. Only human user password grant is broken.
## Acceptance Criteria
- [ ] `POST /auth/token` accepts `{"username":"...","password":"...","scope":"..."}`
- [ ] Proxies to Authentik token endpoint with `grant_type=password`
- [ ] Returns JWT + refresh token
- [ ] Unit tests
## Depends on
- P3.2 ✅ (done)
- P3.7 (config wiring)
- Password grant debugging (blocker)
rock
added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:40:45 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Gateway exposes
POST /auth/tokenaccepting username+password, exchanges with Authentik viagrant_type=password, returns JWT + refresh token.Code repo:
rock/homelab-frontend—internal/proxy/auth_endpoints.goBlocker (2026-09-08)
Password grant on
api-gwprovider returnsinvalid_grantfor userrockdespite:rockadded toapi-gw-usersgrouppasswordin grant_typesAuthentik events show
login_failedatdefault-authentication-passwordstage. Suspected: the default password stage may require additional config for headless/ROPC flow vs browser flow.client_credentials works for all service accounts. Only human user password grant is broken.
Acceptance Criteria
POST /auth/tokenaccepts{"username":"...","password":"...","scope":"..."}grant_type=passwordDepends on
Closed by homelab-frontend PR #18: riotpiao-poimen/homelab-frontend#18