From ef2228fdfb35b24156e1d3790df5e472fdf13a2d Mon Sep 17 00:00:00 2001 From: rock Date: Sat, 5 Sep 2026 15:09:56 -0700 Subject: [PATCH] fix: use explicit-consent flow for kubernetes public OIDC client - Kubernetes provider now uses default-provider-authorization-explicit-consent instead of implicit-consent flow - Better handling for public clients like kubelogin (authcode grant) - Prevents fallback to password grant prompts --- scripts/iam/authentik-provision.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/iam/authentik-provision.py b/scripts/iam/authentik-provision.py index 431526e..6b6d406 100644 --- a/scripts/iam/authentik-provision.py +++ b/scripts/iam/authentik-provision.py @@ -716,6 +716,10 @@ for name, cfg in SERVICES.items(): # Redirect URI matches kubelogin's (int128/kubelogin) documented default; # adjust here if a different kubectl OIDC plugin/port is actually used. print("Ensuring public OAuth2 client 'kubernetes' for kubectl OIDC login...") +# Fetch explicit-consent flow for public authcode clients (kubelogin) +status, res = api("GET", "/api/v3/flows/instances/?slug=default-provider-authorization-explicit-consent") +k8s_authz_flow = res["results"][0]["pk"] if res["results"] else AUTHORIZATION_FLOW_PK + k8s_provider = get_or_create( "/api/v3/providers/oauth2/", "/api/v3/providers/oauth2/", "name=kubernetes", @@ -723,7 +727,7 @@ k8s_provider = get_or_create( "name": "kubernetes", "client_id": "kubernetes", "client_type": "public", - "authorization_flow": AUTHORIZATION_FLOW_PK, + "authorization_flow": k8s_authz_flow, "invalidation_flow": INVALIDATION_FLOW_PK, "signing_key": SIGNING_KEY_PK, "property_mappings": SCOPE_PKS,