providers/oauth2: add token exchange targeting - #24874
Conversation
BeryJu
added
the
backport/version-2026.8
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #24874 +/- ##
==========================================
+ Coverage 91.40% 91.42% +0.01%
==========================================
Files 1145 1145
Lines 71751 71865 +114
Branches 3875 3875
==========================================
+ Hits 65586 65701 +115
+ Misses 6130 6129 -1
Partials 35 35
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
|
authentik PR Installation instructions Instructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-dee88de9f191eb0e35ac6ebfee177af2d070f607
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-dee88de9f191eb0e35ac6ebfee177af2d070f607Afterwards, run the upgrade commands from the latest release notes. |
kensternberg-authentik
left a comment
kensternberg-authentik
left a comment
There was a problem hiding this comment.
Some suggestions.
| - `scope`: The scopes granted to the issued token | ||
|
|
||
| The issued token is a new access token for the requesting provider, carrying the identity of the user named by the subject token. | ||
| The issued token is a new access token carrying the identity of the user named by the subject token. It is issued for the requesting provider, unless [`audience`](#audience) names a different one. |
There was a problem hiding this comment.
"different one" what? Maybe "different provider"?
|
|
||
| ### Audience | ||
|
|
||
| By default the issued token is a token for the provider that performed the exchange. Set `audience` to receive a token for a different provider instead: |
There was a problem hiding this comment.
"By default the issued token is for the provider that performed the exchange."
| ### Scopes | ||
|
|
||
| The scopes granted to the issued token are the requested `scope` values, reduced to those the requesting provider is configured to issue. If `scope` is omitted, the issued token is granted no scopes. | ||
| The scopes granted to the issued token are the requested `scope` values, reduced to those the provider the token is issued for is configured to issue — the target provider when `audience` is set, otherwise the requesting provider. If `scope` is omitted, the issued token is granted no scopes. |
There was a problem hiding this comment.
"... the provider for which the token is issued." The two nouns in a row is confusing to parse.
Signed-off-by: Jens Langhammer <jens@goauthentik.io> # Conflicts: # authentik/providers/oauth2/views/token.py
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
3 participants
the last missing piece