From 314cf6dedbf914ad419724a7c0a8ca010bbe74fd Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Mon, 27 Jul 2026 22:53:03 +0200 Subject: [PATCH] fix: Repair matrix-invitation enrollment flow via Authentik Blueprint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The matrix-invitation flow only had Invite+Prompt stage bindings, both at order=0 (undefined order), missing the Write/Password/Login stages entirely — invited users were never written to the DB. Applied the fix live in-cluster (mirroring the working matrix-enrollment stage chain), and captured it as an Authentik Blueprint (ConfigMap, mounted via blueprints.configMaps) so the flow state is reproducible via GitOps instead of manual admin-UI clicks. --- apps/authentik/authentik-blueprints.yaml | 68 ++++++++++++++++++++++++ apps/authentik/authentik.yaml | 4 ++ apps/authentik/kustomization.yaml | 1 + docs/troubleshooting/README.md | 2 +- 4 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 apps/authentik/authentik-blueprints.yaml mode change 100644 => 100755 apps/authentik/authentik.yaml mode change 100644 => 100755 apps/authentik/kustomization.yaml mode change 100644 => 100755 docs/troubleshooting/README.md diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml new file mode 100644 index 0000000..eba7b98 --- /dev/null +++ b/apps/authentik/authentik-blueprints.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: authentik-blueprints + namespace: authentik +data: + matrix-invitation-flow.yaml: | + # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json + version: 1 + metadata: + name: matrix-invitation-flow + labels: + blueprints.goauthentik.io/instantiate: "true" + entries: + # Reaffirm the flow itself (already created manually; matched by slug) + - model: authentik_flows.flow + state: present + identifiers: + slug: matrix-invitation + id: matrix_invitation_flow + attrs: + name: matrix-invitation + title: matrix-invitation + designation: enrollment + + # Correct stage chain, mirroring the working matrix-enrollment flow: + # Invite -> Prompt (username/email/password) -> Write -> Password -> Login + # Root cause of the original bug: only Invite+Prompt were bound, both at + # order=0, so the flow never wrote the user to the DB or logged them in. + - model: authentik_flows.flowstagebinding + state: present + identifiers: + target: !KeyOf matrix_invitation_flow + order: 0 + attrs: + stage: !Find [authentik_stages_invitation.invitationstage, [name, matrix-enrollment-invitation]] + + - model: authentik_flows.flowstagebinding + state: present + identifiers: + target: !KeyOf matrix_invitation_flow + order: 1 + attrs: + stage: !Find [authentik_stages_prompt.promptstage, [name, matrix-invitation-prompt]] + + - model: authentik_flows.flowstagebinding + state: present + identifiers: + target: !KeyOf matrix_invitation_flow + order: 2 + attrs: + stage: !Find [authentik_stages_user_write.userwritestage, [name, default-source-enrollment-write]] + + - model: authentik_flows.flowstagebinding + state: present + identifiers: + target: !KeyOf matrix_invitation_flow + order: 3 + attrs: + stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]] + + - model: authentik_flows.flowstagebinding + state: present + identifiers: + target: !KeyOf matrix_invitation_flow + order: 4 + attrs: + stage: !Find [authentik_stages_user_login.userloginstage, [name, default-source-enrollment-login]] diff --git a/apps/authentik/authentik.yaml b/apps/authentik/authentik.yaml old mode 100644 new mode 100755 index c4ae458..70702f7 --- a/apps/authentik/authentik.yaml +++ b/apps/authentik/authentik.yaml @@ -52,6 +52,10 @@ spec: use_tls: true from: "Authentik " + blueprints: + configMaps: + - authentik-blueprints + server: ingress: enabled: false diff --git a/apps/authentik/kustomization.yaml b/apps/authentik/kustomization.yaml old mode 100644 new mode 100755 index a4dd447..860ee7a --- a/apps/authentik/kustomization.yaml +++ b/apps/authentik/kustomization.yaml @@ -4,6 +4,7 @@ resources: - namespace.yaml - helm-repo.yaml - authentik-secret.yaml + - authentik-blueprints.yaml - certificate.yaml - authentik.yaml - ingress.yaml diff --git a/docs/troubleshooting/README.md b/docs/troubleshooting/README.md old mode 100644 new mode 100755 index f1ae561..702be9f --- a/docs/troubleshooting/README.md +++ b/docs/troubleshooting/README.md @@ -86,7 +86,7 @@ Dieser Ordner enthält detaillierte Troubleshooting- und Reparaturanleitungen f |---------|--------|-------|--------| | Nur Standard Enrollment funktioniert | akadmin ✅ | - | Resolved | | User nur in Authentik, nicht in Synapse | Boje | `DIAGNOSTIK-AUTHENTIK-FLOW.md` | In Progress | -| Einladungslink-Fehler: "kein ausstehender benutzer" | Klaus | `AUTHENTIK-CREATE-INVITATION-FLOW.md` | In Progress | +| Einladungslink-Fehler: "kein ausstehender benutzer" | Klaus | `AUTHENTIK-CREATE-INVITATION-FLOW.md` | **Fixed (2026-07-27)** — `matrix-invitation` Flow hatte nur Invite+Prompt Stage-Bindings, beide auf `order=0`. Write/Password/Login-Stages fehlten komplett. Live gefixt + als Blueprint (`apps/authentik/authentik-blueprints.yaml`) reproduzierbar gemacht. | | OIDC-Integration unklar | General | `AUTHENTIK-FIX-TEMPLATE.md` | Reference | ---