From aa42d0530a7c787ab1b9f083710e4073bcd3d6ec Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Mon, 27 Jul 2026 23:40:56 +0200 Subject: [PATCH] fix: Set Brand.default_application so "/" doesn't dead-end at /if/user/ Several dead ends (TOTP/WebAuthn setup after an anonymous visit bounces through login and lands on "/") trace back to Brand.default_application being unset, which falls back to /if/user/ - blocked for type=external Matrix accounts. Set it to the matrix Application. Only changes the bare "/" fallback; explicit URLs like /if/admin/ are unaffected. --- apps/authentik/authentik-blueprints.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml index f5d62f6..731ad37 100644 --- a/apps/authentik/authentik-blueprints.yaml +++ b/apps/authentik/authentik-blueprints.yaml @@ -206,3 +206,23 @@ data: order: 10 attrs: stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]] + matrix-brand-default-app.yaml: | + # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json + version: 1 + metadata: + name: matrix-brand-default-app + labels: + blueprints.goauthentik.io/instantiate: "true" + entries: + # Root cause behind several dead ends: an authenticated user hitting "/" + # with no other destination (e.g. after logging in mid-way through the + # TOTP/WebAuthn setup flows) falls back to Brand.default_application: if + # unset, that's /if/user/, which type=external Matrix accounts can't + # open. Only affects the bare "/" fallback - explicit URLs like + # /if/admin/ are unaffected, so internal/staff access is unchanged. + - model: authentik_brands.brand + state: present + identifiers: + domain: authentik-default + attrs: + default_application: !Find [authentik_core.application, [slug, matrix]]