If the fixed and user part was working for you, it should be already in a good state.

The "easy" case
Under Admin > Directory > Users I select the user, and add the collective details:

preferred_username: my-username-in-collective
docspell_collective: my-collective

Now we need to create the scope:
Under Admin > Customisation > Property mappings

Create a new Scope Mapping
Fill the details:

Property	Detail
Name	Docspell Collective
Scope name	docspell_collective
description	anything
Expression	`return { "docspell_collective":request.user.attributes.get("docspell_collective", request.user.username),}`

Admin > Applications > Providers
Edit Docspell OIDC Provider
Under Advanced protocol settings Also select the "Docspell Collective" Property to be part of the selected mappings

My Docspell Config looks like this:

openid = [ 
		{ 
			enabled = true,
        		display = "Primboard Auth"
        		provider = {
          			provider-id = "authentik",
          			client-id = "f12799acf6a048b8d9d68cb240e9212a1f496e5b",
          			client-secret = "00f0342f3825110533532640be322a2491f28d3eb0f848926b35aa7c0c58299d3abef8669ec2b3cc0b6a1a0d2cd99b6bdfe8ecf2d10480a5ac0058f0ff297641",
          			scope = "docspell_collective profile openid email",
          			authorize-url = "https://auth.primboard.de/application/o/authorize/",
          			token-url = "https://auth.primboard.de/application/o/token/",
				user-url = "https://auth.primboard.de/application/o/userinfo/",
				sign-key = "",
				sig-algo = "RS256"
        		},
        		collective-key = "lookup:docspell_collective",
        		user-key = "preferred_username"
      		}
	]

Know you can test it with e.g. postman:

Create a new Get Request to https://auth.primboard.de/application/o/userinfo/
Goto Tab Authorization (directly below the url)
Select type OAuth 2.0 and "add authorization data to" to Request URL
Configure a new Token on the right side
4.1. Token Name Authentik
4.2. Grant Type Authorization Code
4.3. Callback URL should be grayed out
4.4. activate the checkbox Authorize using Browser
4.5. Auth URL use the one from docspell config
4.6. Access Token URL use the one from docspell config
4.7. ClientID use the one from docspell config
4.8. ClientSecret use the one from docspell config
4.9. Scope and State should be grayed out
4.10. Client Authentication send as basic auth header
Now you can press the Get New Access Token which will redirect you to the browser where you have to log in to the authentik and are beeing redirected to postman (enable popups if asking).
Scroll up in Postman and select the Token to be used during authentication Access Token and Header Prefix Bearer
Now the Request should work and Postman is imitating the docspell application.
When hitting the Send Button on the top right to https://auth.primboard.de/application/o/userinfo/ you will get the response in the body below:

{
    "docspell_collective": "my-collective",
    "email": "<email>",
    "email_verified": true,
    "name": "<Real Name>",
    "given_name": "<Real Name>",
    "family_name": "",
    "preferred_username": "my-username-in-collective",
    "nickname": "<loginname in authentik - could also be used as preferred username>",
    "groups": [
        ...
        ...
    ],
    "sub": "sefhwuw784378fg368gf76234gf287gf928hf982hf894fhg9237g4f937gf"
}

OIDC authentik login fails #1781

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions