Feat: Add authentik idp by Maddosaurus · Pull Request #8619 · SSSD/sssd

Maddosaurus · 2026-04-20T14:48:08Z

This PR add Authentik as an available IDP provider besides Entra and Keycloak.

From a quick look around the Authentik repo, it looks they do daily test runs against their Compose deployment (see this workflow).

For testing, starting from a fresh Authentik instance (Docker compose instructions), the following additional configuration is needed:

Create a default device flow: Authentik Docs
Create a new OAuth Client:
- Navigate to the Admin Interface
- Applications -> Providers -> Create -> Oauth2/OpenID Provider
  - Set a provider name (e.g. sssd-prod-prov) and auth flow (e.g. default-provider-authorization-implicit-consent (Authorize Application))
  - Open "Advanced protocol settings" and add the scope authentik default OAuth Mapping: authentik API access to "Selected Scopes"
  - Create Provider
- Applications -> Applications -> Create
  - Create a slug (e.g. sssd-prod-app and select the previously created provider (e.g. sssd-prod-prov)
  - Create Application
- Authentik creates a service account for this application if the device flow is used for the first time ([docs](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/machine_to_machine/#automatic-service-account-creation)), so let's get this created:
  - Start sssd with the new config and let it run - you likely get a 400. SSSD can be stopped.
  - It will have created a new service account (naming schema: ak-<application>-client_credentials)
- Open the newly created Application, navigate to "Policy/Group/User bindings", select "Bind existing...", switch to "User" and select the autogenerated user for your application (e.g. "ak-sssd-prod-prov-client_credentials"), and select "Create"
- Create a role to allow reading of users and groups: Directory -> Roles -> Create
  - Give it a name (e.g. authentik user goup read-only)
  - Open the created group -> Permissions -> Assign Permission
    - Under authentik Core select Can view Group and Can view User
  - Assign the Role to the ak service user of your application: Users -> $serviceaccout -> Roles -> Add to existing role -> select the created role

Combined with the following sssd.conf this will result in a running setup for ssh login and sudo management:

[domain/authentik]
id_provider = idp
idp_type = authentik:https://authentik.company/api/v3/core/
idp_client_id = myclient
idp_client_secret = YOUR-CLIENT-SCERET
idp_token_endpoint = https://authentik.company/application/o/token/
idp_userinfo_endpoint = https://authentik.company/application/o/userinfo/
idp_device_auth_endpoint = https://authentik.company/application/o/device/
idp_id_scope = goauthentik.io/api
idp_auth_scope = openid profile email offline_access

Note that authentik does not have application-specific endpoints for token, userinfo and device auth, but instead global endpoints. For example, the token endpoint for a given Authentik server would be https://prod.idp.tld.com/application/o/token (only authentik.company is a placeholder in this config).

Fixes #8613

gemini-code-assist

Code Review

This pull request introduces support for Authentik as an Identity Provider (IdP) in SSSD, including documentation, a new lookup implementation, and JSON parsing enhancements. Several critical issues were identified in the review: a syntax error due to missing parentheses in a conditional check, incorrect parameter types and redundant calls during URL encoding of device codes, and logic errors in identifying Authentik users and groups. Specifically, using 'pk' for both user and group identifiers prevents proper object differentiation, and the user lookup logic should be updated to check for the 'pk' attribute to align with Authentik's API.

alexey-tikhonov · 2026-04-20T15:10:53Z

/gemini review

gemini-code-assist

Code Review

This pull request adds support for Authentik as an Identity Provider, including documentation, a new lookup implementation, and enhanced JSON parsing. Feedback points out a potential crash in parse_result due to a missing NULL check when encoding the device_code and a typo in store_json_user where uid was used instead of uuid.

alexey-tikhonov · 2026-04-20T20:13:01Z

Review done using Claude Code / claude-opus-4-6

@Maddosaurus, take this with a grain of salt as some points might be off.

If you prefer, feel free to postpone addressing this until somebody from maintainers performs a review.
But if you are willing to read thru and address what makes sense, then you're welcome.

Maddosaurus · 2026-04-22T12:49:15Z

@alexey-tikhonov I'd appreciate a human review at this point, as it seems that recent changes on master resulted in this code not working when rebased against the latest master.
I'd be grateful for some pointers about the latest changes with regards to token handling and caching, as I suspect that to be the reason this PR stopped working.
Thanks :)

alexey-tikhonov · 2026-04-22T14:12:27Z

Could you please rebase on the top of the current 'master' branch?

Maddosaurus · 2026-04-23T08:13:54Z

I've rebased on master - to describe the current situation:
In the auth flow, SSSD correctly displays the device code & URL and waits for the user to click the link ("Press ENTER to continue"). When clicking the link and then pressing enter, the flow fails with the following log entries:

(2026-04-23 09:32:12): [oidc_child[2461436]] [parse_result] (0x0040): [RID#8] Failed to parse json data on line [1]: [invalid escape].
(2026-04-23 09:32:12): [oidc_child[2461436]] [main] (0x0040): [RID#8] Failed to parse device code reply.
(2026-04-23 09:32:12): [oidc_child[2461436]] [main] (0x3f7c0): [RID#8] oidc_child failed!
(2026-04-23 09:32:12): [be[atikdev]] [eval_access_token_buf] (0x0040): [RID#8] Missing input.
(2026-04-23 09:32:12): [be[atikdev]] [idp_auth_done] (0x0040): [RID#8] Failed to evaluate IdP reply.
(2026-04-23 09:32:12): [be[atikdev]] [child_sig_handler] (0x0020): [RID#8] child [2461436] failed with status [1].

Authentik uses random special characters for the device code, and loading/saving the JSON object in SSSD via the jansson lib strips some of the escaping. I suspect that the device code needs to be url sanitized when loaded from the buffer (eval_access_token_buf). Do you have a recommendation how to do that correctly in this codebase?

I suspect a3c506d to be one of the reasons for a change in behaviour.

This escaping of my change is not needed anymore because of improved URL data escaping, I will remove that.

alexey-tikhonov · 2026-04-23T08:22:28Z

This currently doesn't build:

src/oidc_child/oidc_child.c: In function ‘main’:
src/oidc_child/oidc_child.c:724:15: error: too few arguments to function ‘parse_result’; expected 2, have 1
  724 |         ret = parse_result(dc_ctx);
      |               ^~~~~~~~~~~~
In file included from src/oidc_child/oidc_child.c:31:
./src/oidc_child/oidc_child_util.h:138:9: note: declared here
  138 | errno_t parse_result(struct devicecode_ctx *dc_ctx, char *idp_type);
      |         ^~~~~~~~~~~~

Maddosaurus · 2026-04-23T14:46:50Z

I've removed the not needed function I mentioned earlier.
In this state, the code still produces the error in the logs I showed in my comment
#8619 (comment), which I marked here in the diff.

Could you advise what the best strategy would be to ensure proper url safe encoding of the token that is stored in buf and used in eval_access_token_buf?
I suspect that storing and/or loading the token (which was recently introduced) strips any escape sequences the device token might have had initially.

An example device token that Authentik returns:

<5'X!eDqr,Y5"Kt/]+tlIkc|X^%Xe7[qxA`:hz{LRQ|n~HUlBFG<"&e<yuk$}cYlnr}VVZo%HN*ff%=o&[vp,k2O,Bexgb++g`<vbY<K{cy6._0X_;)hj8@l*2~ZUzK*

sumit-bose · 2026-04-23T15:08:14Z

I've removed the not needed function I mentioned earlier. In this state, the code still produces the error in the logs I showed in my comment #8619 (comment), which I marked here in the diff.

Could you advise what the best strategy would be to ensure proper url safe encoding of the token that is stored in buf and used in eval_access_token_buf? I suspect that storing and/or loading the token (which was recently introduced) strips any escape sequences the device token might have had initially.

An example device token that Authentik returns:
<5'X!eDqr,Y5"Kt/]+tlIkc|X^%Xe7[qxA`:hz{LRQ|n~HUlBFG<"&e<yuk$}cYlnr}VVZo%HN*ff%=o&[vp,k2O,Bexgb++g`<vbY<K{cy6._0X_;)hj8@l*2~ZUzK*

Hi,

I'm a bit confused because the error in the logs you've send is coming from the oidc_child code while the code part you've highlighted is in the backend. The backend error is just a result of the error in oidc_child, imo.

Can you recompile after running configure with the --enable-sensitive-logs option and run the test again with debug_level = 9 in the [domain/...] section of sssd.conf? This should produce detailed logs with all the http data. Since the logs now might contain sensitive data like the client secret, fell free to send the logs to me directly.

bye,
Sumit

Maddosaurus · 2026-04-27T09:49:51Z

Hi,

I'm a bit confused because the error in the logs you've send is coming from the oidc_child code while the code part you've highlighted is in the backend. The backend error is just a result of the error in oidc_child, imo.

I see, thanks for the clarification. I'm not entirely sure where to escape the device code best after the recent changes. Any advice is appreciated.

Can you recompile after running configure with the --enable-sensitive-logs option and run the test again with debug_level = 9 in the [domain/...] section of sssd.conf? This should produce detailed logs with all the http data. Since the logs now might contain sensitive data like the client secret, fell free to send the logs to me directly.

bye, Sumit

You should find the logs in your inbox momentarily.
Thank you for taking a look.
Let me know if there's anything else you need.

Maddosaurus · 2026-04-29T12:39:13Z

@sumit-bose / @alexey-tikhonov From my point of view the PR is ready for a review. I can confirm that Authentik OIDC now works correctly.

alexey-tikhonov · 2026-04-29T14:22:43Z

@sumit-bose / @alexey-tikhonov From my point of view the PR is ready for a review. I can confirm that Authentik OIDC now works correctly.

Thank you.

Take a note it will take some time though, as we are going thru release cycle now.

alexey-tikhonov · 2026-05-18T18:58:49Z

Hi @Maddosaurus,

sorry for making you wait so long.

I did a first review round, going thru feedback provided by sssd-bot, and added as inline comments items that I find valid / need addressing.

alexey-tikhonov · 2026-05-22T18:08:55Z

    uuid = json_object_get(group, "id");
+    if (!json_is_string(uuid)) {
+        uuid = json_object_get(group, "pk");
+    }


This will go out of control very soon.
If SSSD is going to support very different IdP providers with different attribute names then there should be name maps (as LDAP based providers have).

I understand your point. Given the time this PR has been open, and the fact that I'm not very familiar with the codebase (yet), I'd be glad if we could not implement the name map in the context of this PR.
Let's address this in a follow up PR, either by me or a maintainer. How about that?

Not sure. Maybe we could have a dedicated feature branch.

Sure, we can do that. I want to get this current PR wrapped up soon, as it has been open for 2 months now.
I'd really like to land the current changes in SSSD and address improvements either in a feature branch or a follow up PR.

Hi,

there should be no changes to the general backend code. Please see my comments about setting id in authentik_lookup().

bye,
Sumit

alexey-tikhonov · 2026-05-22T18:20:29Z

+            char buffer[64];
+            json_int_t i_val = json_integer_value(tmp);
+            snprintf(buffer, sizeof(buffer), "%" JSON_INTEGER_FORMAT, i_val);
+            str = talloc_strdup(mem_ctx, buffer);


You could use single talloc_asprintf() instead.
But so far I don't understand why this fallback is needed at all.

alexey-tikhonov · 2026-06-03T17:41:59Z

+
+    switch (oidc_cmd) {
+    case GET_USER_GROUPS:
+        uri = talloc_asprintf(rest_ctx,


You need either to use tmp context and free it at function exit, or free 'uri' explicitly here before assigning new memory allocation.
Otherwise it will hang on 'rest_ctx'.

Before I do this: This part is functionally identical to
https://github.com/Maddosaurus/sssd/blob/d6c76c57a667f6cc8e768f852c58070ff3814279/src/oidc_child/oidc_child_id.c#L413-L416
and to
https://github.com/Maddosaurus/sssd/blob/d6c76c57a667f6cc8e768f852c58070ff3814279/src/oidc_child/oidc_child_id.c#L210-L213

That would apply there as well, correct?

I believe so

I've updated this only for the Authentik for now - in d75f932

alexey-tikhonov · 2026-06-08T13:59:06Z

@Maddosaurus, please git rebase, not merge.

:relnote: Add Authentik as an IDP integration option.

Maddosaurus · 2026-06-22T12:15:52Z

@alexey-tikhonov @sumit-bose given this PR has been open for over 2 months now, I would really like to focus on landing these changes in SSSD.
What of the open points is crucial to address in this PR?
Let's focus on clearing these, so we can merge the PR, and address improvements in a feature branch or follow up PR.

Please let me know what we need to address right away. Thanks!

alexey-tikhonov · 2026-06-22T14:59:35Z

@alexey-tikhonov @sumit-bose given this PR has been open for over 2 months now, I would really like to focus on landing these changes in SSSD. What of the open points is crucial to address in this PR? Let's focus on clearing these, so we can merge the PR, and address improvements in a feature branch or follow up PR.

Please let me know what we need to address right away. Thanks!

It's currently pending @sumit-bose's review.

But to set proper expectations: we are being "swamped" with PRs and requests to support new IdP types - authentik (this PR), Entra ID via himmelblau, Ahdapa IdP, Okta...

This creates a number of issues.
As every IdP type is a little bit different wrt objects lookup, code rapidly evolves into something unsupportable.
Moreover, once we merged something into upstream mainline, we are kind of committed to support / bugfix this, and this doesn't scale.
For those reasons we are considering to hold addition of all new IdP types before we find a solution to make this manageable.
One of the approaches being considered is to implement plugin support (either at 'id_provider' level or sub 'id_provider=idp' level) to allow clear logic separation and also community supported plugins (some of those might be hosted out of SSSD source tree and also downstream distributions would be free to select what support they want to package).

sumit-bose

Hi,

thank you for your patience. I was finally able to install the authentik containers (it looks like the real docker tools are needed here, I run into issues with the podman based ones coming with Fedora) and test your PR. It is working as expected, but see my comments in the code.

As mentioned otherwise we are thinking about a proper plugin interface e.g. to allow IdPs or other interested parties to provided their own plugins. For the time being I think it makes sense to include your code in the main SSSD tree. But after a first version of the plugin interface is available we might want to remove it from the main tree and host it in a dedicated repository.

bye,
Sumit

sumit-bose · 2026-07-13T16:21:29Z

-                                      : "\", \"verification_uri_complete\": \"",
-                dc_ctx->verification_uri_complete == NULL ? ""
-                                           : dc_ctx->verification_uri_complete);
+        tmp_json = json_pack("{s:s, s:i, s:i}",


Hi,

thank you for adding proper JSON support here. I would suggest to move the generation of the two output line to oidc_child_json.c so that here only a single fprintf() has to be called.

bye,
Sumit

sumit-bose · 2026-07-13T16:28:57Z

+ * https://api.goauthentik.io/ */
+errno_t authentik_lookup(TALLOC_CTX *mem_ctx, enum oidc_cmd oidc_cmd,
+                        char *base_url,
+                        char *input, enum search_str_type input_type,


Hi,

yes, basically input_type is a placeholder for lookups by id which might be available in future. If you want to avoid this warning you can add something like e.g.

if (input_type ==TYPE_OBJECT_ID) { ret = ENOTSUP; goto done; }

bye,
Sumit

sumit-bose · 2026-07-13T18:53:05Z

+        rest_ctx, get_http_data(rest_ctx), "results", "pk");
+
+    if (obj_id == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "Failed to read mandatory object id.\n");


Hi,

please read uid for users and pk for groups here and store the values as id in out. This way you cam remove the changes in idp_id_eval.c. It is expected that out contains besides posixUsername etc which are added inadd_posix_to_json() the id attribute which a unique identifier for the user or group object. Since this unique attribute is provider specific it is best to set it here instead of figuring it out in the backend.

Additionally, since you need the user's pk for the group-memberships I would suggest to create a get_str_attr_from_embed_json_int() to avoid the fallback in get_json_string().

bye,
Sumit

sumit-bose · 2026-07-13T18:57:28Z

    json_t *id_object = NULL;
    const char *user_identifier = NULL;
-    const char *id_attr_list[] = { "sub", "id", NULL };
+    const char *id_attr_list[4];


Hi,

what is the purpose of this change? I'm asking because it is changing the behavior of this function. If user_identifier_attr is given the function should only be successful if user_identifier_attr is present, there should be no fall back. Only if user_identifier_attr is not set sub and id should be checked.

bye,
Sumit

sumit-bose · 2026-07-13T18:59:01Z

    uuid = json_object_get(group, "id");
+    if (!json_is_string(uuid)) {
+        uuid = json_object_get(group, "pk");
+    }


Hi,

there should be no changes to the general backend code. Please see my comments about setting id in authentik_lookup().

bye,
Sumit

gemini-code-assist Bot reviewed Apr 20, 2026

View reviewed changes

Comment thread src/oidc_child/oidc_child_id.c Outdated

Comment thread src/oidc_child/oidc_child_json.c Outdated

Comment thread src/oidc_child/oidc_child_json.c Outdated

Comment thread src/providers/idp/idp_id_eval.c

alexey-tikhonov added the no-backport This should go to target branch only. label Apr 20, 2026

Maddosaurus mentioned this pull request Apr 20, 2026

Support for Authentik OIDC #8613

Open

Maddosaurus force-pushed the feat-authentik branch from e2158a2 to 3cdafa1 Compare April 20, 2026 15:08

gemini-code-assist Bot reviewed Apr 20, 2026

View reviewed changes

Comment thread src/oidc_child/oidc_child_json.c Outdated

Comment thread src/providers/idp/idp_id_eval.c

Maddosaurus force-pushed the feat-authentik branch from 3cdafa1 to 677e00c Compare April 20, 2026 15:23

alexey-tikhonov added the coverity Trigger a coverity scan label Apr 20, 2026

github-advanced-security AI found potential problems Apr 20, 2026

View reviewed changes

Comment thread src/oidc_child/oidc_child_id.c Dismissed

alexey-tikhonov reviewed Apr 20, 2026

View reviewed changes

Comment thread src/oidc_child/oidc_child_id.c Outdated

This comment was marked as outdated.

Sign in to view

Maddosaurus force-pushed the feat-authentik branch from 677e00c to bd08e60 Compare April 22, 2026 09:41

alexey-tikhonov reviewed Apr 22, 2026

View reviewed changes

Comment thread src/oidc_child/oidc_child.c Outdated

Maddosaurus force-pushed the feat-authentik branch from bd08e60 to f0a57c4 Compare April 22, 2026 11:45

Maddosaurus force-pushed the feat-authentik branch from 1c58c51 to ba1d25b Compare April 23, 2026 08:02

alexey-tikhonov removed the coverity Trigger a coverity scan label Apr 23, 2026

alexey-tikhonov requested a review from sumit-bose April 23, 2026 12:50

alexey-tikhonov assigned alexey-tikhonov and sumit-bose Apr 23, 2026

github-advanced-security AI found potential problems Apr 29, 2026

View reviewed changes

Comment thread src/providers/idp/idp_auth_eval.c Fixed

alexey-tikhonov added the Changes requested label May 18, 2026

alexey-tikhonov reviewed May 22, 2026

View reviewed changes

alexey-tikhonov reviewed Jun 3, 2026

View reviewed changes

Comment thread src/oidc_child/oidc_child_json.c

Maddosaurus force-pushed the feat-authentik branch from 87d6cd5 to 5307184 Compare June 9, 2026 12:31

alexey-tikhonov added Waiting for review and removed Changes requested labels Jun 9, 2026

Maddosaurus force-pushed the feat-authentik branch from 348ec8b to cc9aca9 Compare June 22, 2026 11:23

Maddosaurus added 13 commits June 22, 2026 11:37

idp: implement authentik idp

91cf935

:relnote: Add Authentik as an IDP integration option.

idp: manpage update for authentik idp

f5fd166

remove unused variable from decode_token

bf4443d

fix updated function signature

eeff250

Remove unused encoding function, add fixme

d10209c

Remove unused param to parse_result

3fff663

oidc_child: update reply encoding

93a3c87

Remove stray whitespaces and outdated FIXME comment

f1eeb1b

fix: address feedback

dfa4c00

fead: add pagination warning to authentik OIDC

a4374c8

oidc-child: fix memory leak

71fce4c

oidc-child: move json_decref

e61173a

oidc-child: free uri before reassignment

d75f932

Maddosaurus force-pushed the feat-authentik branch from cc9aca9 to d75f932 Compare June 22, 2026 11:40

sumit-bose requested changes Jul 13, 2026

View reviewed changes

alexey-tikhonov added Changes requested and removed Waiting for review labels Jul 17, 2026

Uh oh!

Conversation

Maddosaurus commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alexey-tikhonov commented Apr 20, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

alexey-tikhonov commented Apr 20, 2026

Uh oh!

Uh oh!

Maddosaurus commented Apr 22, 2026

Uh oh!

alexey-tikhonov commented Apr 22, 2026

Uh oh!

Maddosaurus commented Apr 23, 2026

Uh oh!

alexey-tikhonov commented Apr 23, 2026

Uh oh!

Maddosaurus commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sumit-bose commented Apr 23, 2026

Uh oh!

Maddosaurus commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Maddosaurus commented Apr 29, 2026

Uh oh!

alexey-tikhonov commented Apr 29, 2026

Uh oh!

Uh oh!

alexey-tikhonov commented May 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alexey-tikhonov commented Jun 8, 2026

Uh oh!

Maddosaurus commented Jun 22, 2026

Uh oh!

alexey-tikhonov commented Jun 22, 2026

Uh oh!

sumit-bose left a comment

Choose a reason for hiding this comment

Maddosaurus commented Apr 20, 2026 •

edited

Loading

Maddosaurus commented Apr 23, 2026 •

edited

Loading

Maddosaurus commented Apr 27, 2026 •

edited

Loading