coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Restore login compatibility with deployed Authelia 4.38

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-16 01:51:38 +02:00
parent 3f1c9ecd8a
commit cbea539d08
4 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
deploy/t03-admission.json
View file

@ -1,5 +1,5 @@
{
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:d08bdced387a3f24bac0c735d91ad4e2d0ed50cd96e58431343a60eee6421d82",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ef6fdd61209863654be3adba070661645a2714e86cb4b7f4e847540291b55f07",
"policy": {
"origin": "http://flex-auth-informed-decision-t03.flex-auth.svc.cluster.local:8080",
"package": "informed-decision.t03-review",

9
docs/evidence/2026-09-16-fresh-login-compatibility-rollback.json Normal file
View file

@ -0,0 +1,9 @@
{
"task": "SECRETS-WP-0010-T03",
"supersedes": "2026-09-16-review-fresh-authentication.json",
"finding": "Authelia 4.38 rejects prompt=login even after fresh login: at 23:48:28 auth_time 23:48:27 precedes request 23:48:27.926758234. Upstream issue 2596 implements support in 4.39. Prior forced-login change introduced a production regression.",
"source": "https://github.com/authelia/authelia/issues/2596",
"action": "Restore prior working image with memo-input fix. Remove incompatible prompt/max_age from review login. Do not relax MFA age policy.",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ef6fdd61209863654be3adba070661645a2714e86cb4b7f4e847540291b55f07",
"remaining": "Automated fresh sign-in requires a separately validated Authelia upgrade including changed ID-token claims behavior. Native human review retry remains necessary."
}

4
informed_decision/oidc.py
View file

@ -78,8 +78,8 @@ class KeyCapeLogin:
return self.issuer + "/authorize?" + urlencode({
"response_type": "code", "client_id": CLIENT_ID, "redirect_uri": CALLBACK,
"scope": " ".join(REQUIRED_SCOPES), "state": state, "nonce": nonce,
# Review policy requires recent MFA; a reused SSO session may be older.
"prompt": "login", "max_age": "0",
# Authelia 4.38 cannot complete prompt=login/max_age=0.
# Review policy still enforces the signed MFA authentication age.
"code_challenge": challenge, "code_challenge_method": "S256",
}), browser

4
tests/test_browser_auth.py
View file

@ -101,8 +101,8 @@ def test_pkce_nonce_scope_and_imported_human_session(login):
assert session.access_token not in repr(session)
assert login[1].params["scope"] == "openid approval:read approval:approve"
assert login[1].params["code_challenge_method"] == "S256"
assert login[1].params["prompt"] == "login"
assert login[1].params["max_age"] == "0"
assert "prompt" not in login[1].params
assert "max_age" not in login[1].params
assert login[1].params["nonce"] != login[1].params["state"]