Merge pull request 'authentik: Passkey-only Login für Audiobookshelf und Immich' (#119) from feat/authentik-passkey-abs-immich into master

Reviewed-on: gitea_admin/homelab#119
2026-07-07 10:38:22 +02:00
parent 5698990a78 eac9a6cd6f
commit 78368ea4ea
1 changed files with 61 additions and 0 deletions
@@ -803,3 +803,64 @@ data:
              matching_mode: strict
            - url: 'https://netbird\.renner\.uno(/.*)?'
              matching_mode: regex
+
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Audiobookshelf
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: https://audiobooks.renner.uno/auth/openid/callback
+              matching_mode: strict
+            - url: https://audiobooks.renner.uno/auth/openid/mobile-redirect
+              matching_mode: strict
+
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: immich-oauth-provider
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: app.immich:///oauth-callback
+              matching_mode: strict
+            - url: https://immich.renner.uno/auth/login
+              matching_mode: strict
+            - url: https://immich.renner.uno/user-settings
+              matching_mode: strict
+
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Provider for Gittea
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: https://gitea.renner.uno/user/oauth2/authentik/callback
+              matching_mode: strict
+
+      # PVE, PBS and paperless-gate deliberately stay on the default
+      # implicit-consent flow (password + MFA) — passkey-only covers
+      # the daily-driver apps above.
+      - model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: Provider for Grafana
+        state: present
+        attrs:
+          authentication_flow: !KeyOf passkey-passwordless-flow
+          authorization_flow: !KeyOf passkey-stepup-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          redirect_uris:
+            - url: https://dash.renner.uno/login/generic_oauth
+              matching_mode: strict