coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(authelia): use adapter's own client_id/redirect_uri in AuthorizeURL

Browse source 
The adapter was forwarding the downstream client's client_id and
redirect_uri to Authelia, which would always be rejected — Authelia
only recognises client_id=keycape and its registered callback URI.
Also removed downstream PKCE forwarding: KeyCape is a confidential
OIDC client to Authelia and authenticates via client_secret instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch 2026-03-25 03:15:36 +00:00
parent 18dbad68ed
commit a6af43b332
2 changed files with 22 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/internal/adapters/authelia/adapter.go
View file

@ -37,26 +37,20 @@ func New(cfg Config, httpClient HTTPClient) *AutheliaAdapter {
// AuthorizeURL builds the Authelia OIDC authorization URL to which the user
// should be redirected.
//
// KeyCape is a confidential OIDC client to Authelia. The adapter always uses
// its own registered client_id and redirect_uri — NOT the downstream client's
// values — and requests the full fixed scope set. PKCE is omitted because
// the confidential client_secret authenticates the token exchange instead.
func (a *AutheliaAdapter) AuthorizeURL(_ context.Context, req domain.AuthRequest) (string, error) {
base := strings.TrimRight(a.cfg.BaseURL, "/") + "/api/oidc/authorization"
q := url.Values{}
q.Set("client_id", req.ClientID)
q.Set("redirect_uri", req.RedirectURI)
q.Set("client_id", a.cfg.ClientID)
q.Set("redirect_uri", a.cfg.RedirectURI)
q.Set("response_type", "code")
q.Set("state", req.State)
if req.Nonce != "" {
q.Set("nonce", req.Nonce)
}
if len(req.Scopes) > 0 {
q.Set("scope", strings.Join(req.Scopes, " "))
} else {
q.Set("scope", "openid profile")
}
if req.PKCEChallenge != "" {
q.Set("code_challenge", req.PKCEChallenge)
q.Set("code_challenge_method", req.PKCEChallengeMethod)
}
q.Set("scope", "openid profile email groups")
return base + "?" + q.Encode(), nil
}