The Authentik upstream provider used claims_imports.localpart.on_conflict: add, which links a newly registered upstream identity to an EXISTING local account when the derived localpart collides. Combined with Authentik's case-sensitive username uniqueness, any holder of an invitation token could register a case variant of an existing name and be linked into that account, including service accounts (draupnir, alerts, maintenance-notify) that have no upstream link at all. Set on_conflict: fail so a colliding localpart aborts provisioning instead. Existing links are unaffected.
23 lines
3.3 KiB
YAML
23 lines
3.3 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ess-mas-values-secret
|
|
namespace: matrix
|
|
stringData:
|
|
values.yaml: ENC[AES256_GCM,data:jKArnf1jeZwgTcCoktZozMHJ8wBulzvI90G5yaY800E0wA0Fel14DDVpJ8u1kyRXKdT3A3YGGdDExuEEC5ZWfU+o6GGlkpLzJKu9MzQyDSsU56nrkn+QB90Ky5m3fFipoINaRjlycafuY2JWLQfdZH2is5phLTRW3vrZtLdnujFqkWKoAISPST3IaN4Ked2BxC/ZzrgTK46PAale1JC2vbxFAPtNTb2Qf0sZ4SGGJfO7NYumUtIc5Lq51x5gHHChRDmi2vBD4/EhPIglnodTW3opUOVZ8V/DIt0zev/10PNvn7zoWrCFRgWHcl1wkXL8RKwJohGf8u00Lom7D/YWaXCq4P6/ykMMLyf19MvMNDb0NJwhdPGnjZExkLmFYRL1kfH6yQVijv8Oj3ySVcvIISau9FWxPHQljhRIFTlpAjUPwZFD/mvg4nf9li5dFdU3RgOx9vgZayb5lM7UhP2ubvSvZqaYRrgBipx3jyNoj6CQ3/fhmpDQB2nOxwQx6OLkAgBDm87Pnxv40U+hO40DmLPtuv5h3KVwzf0Sagx44OevkEeNE1iYMgdWLk4In7Mj1gQe0jRBOE0Ys9sVJ3YiKqQEi4Ul8PlfrT+SFrbI/iZ+Q7NjyfiXLYIAvrAU2DW2RzVA6lO5poZ6lP3BhnA3LzolFgPZh1sE21U479fGY+aZwkdwpQCTAl126/CeN1f6SZXjfYUEBl9lOEL1kPZ0ujyt6HjuvzWJM3fMw+F6MkXayrN8KUBoln8Vn1ma1wxYhvRc8XjAUhU8/vrwTFzGK9b9mg/qLGB1G0CJN8ZV/RHEM0JMGW73Hqg/pYs51GmqQfcZGL4lUFKcdQwjEeWA32A4Eb69GZlRtnhtofgHjFTjSlOChMbBzRQFXV4pOCvc2rO4nPYu8FT6yIYmHaKezN2sVWdZ0dz3NUFZD8nHD62EcTnpYAPvtIeDuyL0dqnsiNeTfeYvWZh+562iQkPiIHSUKvwffrC/EnTEHwi4IBHjEYxGv/CQYcCU2BXw/vKKCJVVcZ5FB7l6PbofreruKxyDof5GWjSehhddYj2MItt6wm2G6tLrIm9zBW5QQVsMc+RSBR5XnglyVFsRXCdWbFfKdIOTBRITH+qpgKLozeh4cVGGSFao4QSzgLgIoEd8xUx9sc8tf65Wkb0Z/qNGRKhBOuwzSYKZSlJF9BvAip6mb9befEnGOOkz6NNWi9/mItLochsKru+V/WhjEykVdHRkxZy5uj4o7hyiRlkCax6e2oSHshH/0u0cv9gp4cNH07JFHiqnrr/OzSizyMHelQF6WLoQXliLzxhNdqiSTsFyxn7DfZLjUokJBk7HVKctO7Hg+PeOuQEXydhJAUhxSds4NQw2Gc3ArKF1NK0F2kjqSzNgtuk2MYZ5nLIqM4inkulWuAT3sZKO05k0kbV+gZftI1khKJ4EPD7+X3sOYYsuxYsNPP8afzQkNEpjKi70AI38i9CuZlZFkmaQ8XJpdfQqXYMecy0khWxTDeLP8qa4P6L8H95py5+fhEih/VkFJVYmeJdYbiz7/nPUh7kTKqE3/bCjj0y6TfrdJvzMm8FTCtQRglO5feUg1SKrEckL8VEvaTawDMHI4psuiCukFoDhs0YauAVYUIfYfzCj+KCp3yn09huCl0hZ79PMO5ddHOsLI+t6M16MXAEbQQzXmfVd008RG9/a1WNzYuc+oEq/hgQ/PtlaRRsLqRDWBBR97/MpedpE+cVAZoJs/pyiGepr+wC5mP8Vg1aRUHnetoARFX+cquqJ0N1VbSUE0QxmmJ/mCQTumY1LtRG1nWgw7NuJ/N7wXSXUkwVjLulsZGI6Cc1xt8xrUfgSky8EDR0zRd2ogPAN+Nm5talaHxxnmDau3wMHFufrsvLy8+pqqJHY/PEIBgf/8yZGk9PwLV4FkeeqAelVyYnGXDdqpsYI8WtgKOIr52TAoq4hKSpNGCJsT634nSP8ZNlZBrWpnrdYvNiWe7tqS+hIz+uY53baYNM8xZiRtvqSL9S3JUsqno49B7DreRCLtypKCSYjQlFFgPt6TlaN9rVWof1mSOtKTQnyOn0zlVgdO6+PB0wN4JcwYdYn5TG55/EE2BDZCceDMt9tryUGWmP6Yvhn0T3JD9mcRmeQxH9O1nipuWuPWQek,iv:YhS6z4F2E7EvhpY2A5rN9mnnllmiieDCUQQEBykJxUw=,tag:Z5i5cJ77CuxMt2ChVIYNaw==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsWDNpQm90aHZLR1MwendM
|
|
RC8rTE4rS3laK281THE2Mnp4b2hTdjhQVjFFClRGTExuWVFNVGZGTURWNyt1Qkxy
|
|
YnBEaytBTjJqS25zeG5rczVLR256OEUKLS0tIEdBdHNsWit6MjlVUDVSWmZJRjJM
|
|
NGN1S3hpNThQSERDZGFtRjBaWi9mYkkKSiRfp0qHxQ+CAKhAjJRhnHl30iteBQuS
|
|
Ha8G0sJNHDk/+vg4/3LR+D1hv2i6vbI/Mo0W85GiCpGBu0hajTxgbQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
|
|
encrypted_regex: ^(data|stringData)$
|
|
lastmodified: "2026-08-11T10:29:33Z"
|
|
mac: ENC[AES256_GCM,data:TPCj47C4tHcT71r4Y4BsTCFwRnj3/olDJKjpBW6cXUsV4ee10cmITt7NKoHXxkuux62VPMuL5SMv1Y0pETxVFVpXxIAvonedy/VpZkPbA605rQ7G0lNzcz/NRJVQt0mq5KKIhRsDtovRH8SD6/D3CjATNzvP77nfEaJZclvxSik=,iv:A6Y3ZdMYuB0qGTdJv3X4mr9/tva/7HHqzYRFvrorE3E=,tag:bhXI97dA2KSyZcF66R1nqw==,type:str]
|
|
version: 3.13.3
|