From a2e2c5b1d0914de6f03f7093ee55bc2b9f34562c Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 26 Sep 2026 22:07:44 +0200 Subject: [PATCH] Send a direct Authelia sign-in to the account site. A visit to the sign-in portal with no follow-up now continues to https://users.coulomb.social. A provided follow-up still wins. The success screen cannot carry a custom link. Assistant: grok Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f --- sso-mfa/k8s/authelia/README.md | 2 ++ sso-mfa/k8s/authelia/configmap.yaml | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/sso-mfa/k8s/authelia/README.md b/sso-mfa/k8s/authelia/README.md index 8cf049e..9b47da8 100644 --- a/sso-mfa/k8s/authelia/README.md +++ b/sso-mfa/k8s/authelia/README.md @@ -46,6 +46,8 @@ Key config points: - `identity_providers.oidc.clients[0].redirect_uris` — must match CP-NK-004 (`kc.coulomb.social`) - `session.domain` — set to parent domain `coulomb.social` so cookies are valid across both `auth.coulomb.social` and `kc.coulomb.social` +- `default_redirection_url` — `https://users.coulomb.social` when the visitor + opened the portal with no follow-up. A provided `rd` still wins - `access_control.default_policy: one_factor` — fleet default; MFA is not Authelia’s job - `access_control.rules` — domain allowlists by LLDAP group (see below) diff --git a/sso-mfa/k8s/authelia/configmap.yaml b/sso-mfa/k8s/authelia/configmap.yaml index 7dc0691..cdcb98d 100644 --- a/sso-mfa/k8s/authelia/configmap.yaml +++ b/sso-mfa/k8s/authelia/configmap.yaml @@ -33,6 +33,12 @@ data: --- theme: dark + # A direct visit to the sign-in portal has no follow-up page. Send that + # sign-in to the account site. A requested follow-up still wins, including + # the return path an application or KeyCape sets. The success screen itself + # cannot carry a custom link. + default_redirection_url: https://users.coulomb.social + server: host: "0.0.0.0" port: 9091