riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

fix(paperless): align stale client-secret with the live OIDC secret #86

Merged
rock merged 1 commits from fix/paperless-oidc-secret-align into main 2026-10-31 21:10:28 +00:00
Conversation 0 Commits 1 Files Changed 1
+9 -9
rock commented 2026-10-31 21:00:07 +00:00
Owner
Copy Link
Copy Source

The paperless-oidc Secret stores the OIDC client secret twice: as client-secret and inside SOCIALACCOUNT_PROVIDERS_JSON (which is what allauth reads). Only the JSON copy was updated during the ZITADEL migration, so client-secret held a superseded rotation.

Invisible in normal use, but misleading when verifying: a token-endpoint probe using client-secret returns invalid secret while Paperless logs in correctly. Both keys now carry the same live value.

Verified: the re-encrypted SOPS file decrypts and both keys compare equal.

The `paperless-oidc` Secret stores the OIDC client secret twice: as `client-secret` and inside `SOCIALACCOUNT_PROVIDERS_JSON` (which is what allauth reads). Only the JSON copy was updated during the ZITADEL migration, so `client-secret` held a superseded rotation. Invisible in normal use, but misleading when verifying: a token-endpoint probe using `client-secret` returns `invalid secret` while Paperless logs in correctly. Both keys now carry the same live value. Verified: the re-encrypted SOPS file decrypts and both keys compare equal.
rock added 1 commit 2026-10-31 21:00:09 +00:00
fix(paperless): align the stale client-secret key with the live secret dc33b0e687 
The paperless-oidc Secret carries the OIDC client secret twice: once as
`client-secret` and once inside SOCIALACCOUNT_PROVIDERS_JSON, which is what
allauth actually reads. Only the JSON copy was updated during the ZITADEL
migration, so `client-secret` held a superseded rotation.

That is invisible in normal use but makes the Secret misleading to verify:
a token-endpoint probe using `client-secret` answers "invalid secret" while
Paperless itself logs in fine. Both keys now carry the same live value.
rock merged commit 894d746b0d into main 2026-10-31 21:10:28 +00:00
rock deleted branch fix/paperless-oidc-secret-align 2026-10-31 21:10:52 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/event-bus
Event routing and notification pipeline
 area/gateway
API gateway code (homelab-frontend)
 area/notifications
Gotify, SMTP, push notifications
 area/observer
Poimen goal-driven observation and pattern detection
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#86