fix(authentik-gate-sync): stop sweeping every gate as an OIDC client #1536

2026-11-01T10:12:59Z

hermes-bot commented

2026-11-01 10:12:59 +00:00

Outage fix: all 14 Authentik gates are removed and recreated on every pass since 10:11Z.

Cause: ProxyProvider is a subclass of OAuth2Provider (authentik 2026.8.4 providers/proxy/models.py), so GET providers/oauth2/ returns every proxy provider too. #1535's sweep therefore saw each gate a second time as an "OIDC client" that no OIDCClient wanted, and deleted it. Controller log, first pass of 2026-11-01-0959:

10:11:4x INFO ai-llama-server-62fa36: removed OIDC client from Authentik
... (14 gates)
10:11:42 INFO reconciled: 14 gates, 0 OIDC clients, 0 failed, 14 objects removed

Fix: from providers/oauth2/, the sweep and the OIDC provider lookup only take providers with meta_model_name == authentik_providers_oauth2.oauth2provider.

Verified: 57 unit tests pass. The fake API now lists proxy providers under providers/oauth2/ the way the real one does, and against the previous controller the new tests fail (gate-only stable over two passes, gate plus OIDC client stable).

After merge: the image builds on push and image automation scans every 30 min. Gates come back on the first pass of the new image.

**Outage fix: all 14 Authentik gates are removed and recreated on every pass since 10:11Z.** Cause: `ProxyProvider` is a subclass of `OAuth2Provider` (authentik 2026.8.4 `providers/proxy/models.py`), so `GET providers/oauth2/` returns every proxy provider too. #1535's sweep therefore saw each gate a second time as an "OIDC client" that no OIDCClient wanted, and deleted it. Controller log, first pass of `2026-11-01-0959`: ``` 10:11:4x INFO ai-llama-server-62fa36: removed OIDC client from Authentik ... (14 gates) 10:11:42 INFO reconciled: 14 gates, 0 OIDC clients, 0 failed, 14 objects removed ``` Fix: from `providers/oauth2/`, the sweep and the OIDC provider lookup only take providers with `meta_model_name == authentik_providers_oauth2.oauth2provider`. Verified: 57 unit tests pass. The fake API now lists proxy providers under `providers/oauth2/` the way the real one does, and against the previous controller the new tests fail (gate-only stable over two passes, gate plus OIDC client stable). After merge: the image builds on push and image automation scans every 30 min. Gates come back on the first pass of the new image.

hermes-bot added 1 commit 2026-11-01 10:12:59 +00:00

fix(authentik-gate-sync): stop sweeping every gate as an OIDC client

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

5e814c525a

Outage since 10:11Z: the first pass of image 2026-11-01-0959 (#1535)
removed all 14 gates ("removed OIDC client from Authentik", "14 objects
removed"), and every pass since recreates and removes them again.

ProxyProvider subclasses OAuth2Provider (authentik 2026.8.4
providers/proxy/models.py: class ProxyProvider(OutpostModel,
OAuth2Provider)), so GET providers/oauth2/ also lists every proxy
provider. owned_applications() yielded each gate a second time as an
OAuth2 application; it was not in the OIDC keep set, so the sweep
deleted its application and provider.

Both the sweep and ensure_oidc's provider lookup now take from
providers/oauth2/ only providers whose meta_model_name is
authentik_providers_oauth2.oauth2provider. The test fake now lists proxy
providers under providers/oauth2/ like the real API; the new tests
(gate-only and gate + OIDC client stable over two passes) fail against
the previous controller.

k.renner merged commit 60dfcf5382 into main

2026-11-01 10:13:55 +00:00

hermes-bot referenced this pull request

2026-11-01 10:44:24 +00:00

revert(authentik-gate-sync): roll back OIDC clients (#1535, #1536), gates are being deleted #1537

hermes-bot referenced this issue from a commit

2026-11-01 10:44:26 +00:00

Revert "Merge pull request 'fix(authentik-gate-sync): stop sweeping every gate as an OIDC client' (#1536) from fix/gate-sync-proxy-sweep into main"

k.renner referenced this issue from a commit

2026-11-01 10:59:31 +00:00

Merge pull request 'revert(authentik-gate-sync): roll back OIDC clients (#1535, #1536), gates are being deleted' (#1537) from revert/gate-sync-oidc into main

Sign in to join this conversation.