From c781e263fc81036384b96a6b1a8bca23fe4c8d9c Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Thu, 5 Nov 2026 13:02:10 +0100 Subject: [PATCH] fix(radius): wlan-setup authentik subrequests take large replies - subrequest_output_buffer_size 256k: users/me with groups, avatar and permissions exceeds the one-page default and was cut off. - proxy_pass_request_headers off: browser headers (Accept-Encoding, User-Agent, X-authentik-*) no longer reach authentik. - Random suffix on the app password identifier, so two installs in the same second do not collide. Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/authentik/wlan-setup-config.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kubernetes/apps/authentik/wlan-setup-config.yaml b/kubernetes/apps/authentik/wlan-setup-config.yaml index f611a227..8d8b52c4 100644 --- a/kubernetes/apps/authentik/wlan-setup-config.yaml +++ b/kubernetes/apps/authentik/wlan-setup-config.yaml @@ -175,6 +175,10 @@ data: location ~ ^/_ak(/.*)$ { internal; proxy_pass http://authentik$1; + # njs reads the whole reply from this buffer (default one page). + subrequest_output_buffer_size 256k; + # Only the headers set here reach authentik. + proxy_pass_request_headers off; proxy_set_header Host auth.renner.uno; proxy_set_header Cookie ""; proxy_set_header Authorization "$arg_scheme $arg_cred"; @@ -324,7 +328,7 @@ data: const now = new Date(); const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, ""); - const identifier = "wlan-android-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp; + const identifier = "wlan-android-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp + "-" + random().substring(0, 6).replace(/[^A-Za-z0-9]/g, "x"); const expires = new Date(now.getTime() + LIFETIME_DAYS * 86400000).toISOString(); await ak(r, "POST", "/api/v3/core/tokens/", "Bearer", access, JSON_CT, JSON.stringify({ identifier: identifier,