renstur@coopnet:~/blog$ ls -lt ./topics/identity-sso/
identity-sso/
Authentik in front of everything, OIDC quirks, and keeping a way in when SSO breaks.
-
Logging into Proxmox with Authentik
I added Authentik as an OpenID realm on Proxmox. Proxmox appends the realm to every group name, so the ACL goes on the suffixed name or users log in with no permissions. It also sends the redirect URI without a slash and adds openid itself. I kept the local root login.
-
Break glass access when your SSO lives behind your VPN
My SSO, its recovery mail and my password manager share one VM, and NetBird and Proxmox both sign in through it. So my way in depends on neither: Proxmox local accounts, servers on setup keys, long VPN sessions on admin devices, and printed backup codes.
-
Authentik as the front door to every app in my homelab
Authentik signs in every app I run over OIDC, and the login page was the easy part. MFA tied to a group can fall off silently, one shared home IP locked the house out, and recovery shared a VM with SSO. I added a checked weekly pg_dump and kept a break glass admin outside Authentik.
-
Two of three group mappings worked which is what made the third so hard to find
BookStack's OIDC group sync mapped Editor and Viewer but skipped Admin. It turns spaces into hyphens in incoming group names but not in a role's external auth ID, so wiki Admins never matched. I wrote the external auth ID as wiki-admins and it mapped.
-
Your Authentik login dies on 'not all parts available' and two different bugs produce it
Forgejo threw not all parts available on the Authentik callback for two reasons: the provider wasn't granting the openid scope, and an Encryption Key turned the id_token into a five part JWE. I added the openid mapping and cleared the Encryption Key. Counting the dots tells them apart.