From e2e45b2b86e5bf7f60f7482e4c7ec6bf7319c5b8 Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Sun, 4 Oct 2026 21:19:26 +0000 Subject: [PATCH] fix(authentik): allow authorization_code for matrix-mas (REN-567) Authentik 2026.5 checks each authorize against the provider's grant_types, and a provider created by a blueprint starts with an empty list. Every Matrix login through Authentik failed with invalid_request (log: "Invalid grant_type for provider", grant_type=authorization_code). Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/authentik/blueprints-configmap.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 6e186e58..66ecbae4 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -2149,6 +2149,13 @@ data: invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] client_type: public client_id: matrix-mas + # Authentik 2026.5 checks the grant type against this list, and a + # provider created by a blueprint starts with it empty, so every + # authorize fails with invalid_request ("Invalid grant_type for + # provider"). Providers made in the UI get the defaults. + grant_types: + - authorization_code + - refresh_token signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]] property_mappings: - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] -- 2.54.0