riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects 1 Releases Wiki Activity

P3.2: Enable password grant on local-llm Authentik provider #7

New Issue
Closed
opened 2026-09-08 04:41:11 +00:00 by rock · 1 comment
rock commented 2026-09-08 04:41:11 +00:00
Owner
Copy Link
Copy Source

Summary

Update local-llm OAuth2 provider in Authentik to support password grant type with headless auth flow.

Config repo: rock/homelab — scripts/iam/authentik-provision.py

Changes

  • Add "password" to local-llm grant_types
  • Bind SA_AUTHENTICATION_FLOW_PK (headless: identification->password->login, no MFA)
  • Add roles + permissions scope mappings to property_mappings

Verification

curl -X POST https://authentik.riotpiao.com/application/o/token/ \
  -d "grant_type=password&client_id=local-llm&client_secret=$SECRET&username=rock&password=$PASS&scope=openid roles permissions"
# Expect JWT with roles/permissions claims

Review checklist

  • Headless flow bound (not default with MFA)
  • Idempotent on re-run (patch_existing)
  • client_secret not rotated
  • Wrong password returns proper error (not 500)

Blocked by

Nothing — this is the first task in the chain

## Summary Update `local-llm` OAuth2 provider in Authentik to support `password` grant type with headless auth flow. **Config repo:** `rock/homelab` — `scripts/iam/authentik-provision.py` ## Changes - Add `"password"` to `local-llm` grant_types - Bind `SA_AUTHENTICATION_FLOW_PK` (headless: identification->password->login, no MFA) - Add `roles` + `permissions` scope mappings to property_mappings ## Verification ```bash curl -X POST https://authentik.riotpiao.com/application/o/token/ \ -d "grant_type=password&client_id=local-llm&client_secret=$SECRET&username=rock&password=$PASS&scope=openid roles permissions" # Expect JWT with roles/permissions claims ``` ## Review checklist - [ ] Headless flow bound (not default with MFA) - [ ] Idempotent on re-run (patch_existing) - [ ] client_secret not rotated - [ ] Wrong password returns proper error (not 500) ## Blocked by Nothing — this is the first task in the chain
rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:41:11 +00:00
rock added the area/authentiktype/infrastatus/todopriority/high labels 2026-09-08 04:41:12 +00:00
rock self-assigned this 2026-09-08 04:41:12 +00:00
rock added this to the API-GW OAuth project 2026-09-08 04:43:46 +00:00
rock moved this to Todo in API-GW OAuth on 2026-09-08 04:44:39 +00:00
rock closed this issue 2026-09-08 22:50:28 +00:00
rock commented 2026-09-09 00:55:49 +00:00
Author
Owner
Copy Link
Copy Source

Closed manually — applied via scripts/iam/provision-rbac.py (not tracked). No PR.

Closed manually — applied via scripts/iam/provision-rbac.py (not tracked). No PR.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code (homelab-frontend)
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels area/authentik priority/high status/todo type/infra
Milestone
No items
No Milestone Phase 3: OAuth2 Token Exchange & Identity Propagation
Projects
Clear projects
No projects
API-GW OAuth
Todo
Assignees
Clear assignees
poimen rock (Rock)
No Assignees rock
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#7