From 6128a4ef3ae77a33ae8be2d2ce1403d54e16f2b1 Mon Sep 17 00:00:00 2001 From: Brandyn / Techy Date: Sun, 1 Nov 2026 01:26:14 -0600 Subject: [PATCH] README: nested groups need a second scope mapping (managed profile mapping is direct-only and sticky on proxy providers) Co-Authored-By: Claude Fable 5.1 --- README.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index d4a9d37..8c69d41 100644 --- a/README.md +++ b/README.md @@ -271,7 +271,17 @@ Keep repo write access to trusted people. Auto Discovery URL `https://auth.HOST/application/o/gitea/.well-known/openid-configuration`, tick "Skip local 2FA", claim name for groups `groups`, administrator group claim value **`git-admins`**. Save. Authentik group nesting makes the admins inherit it: `authentik Admins` → parent `admins` → parent `git-admins` - (members of a child group count as members of the parent, in the `groups` claim and in Caddy's header checks). + (members of a child group count as members of the parent). **Inherited groups are not in the `groups` claim by + default**: the managed profile mapping uses `ak_groups` (direct memberships only), and proxy providers re-add + that mapping on every save, so it cannot be swapped out. Add a second scope mapping, Customization → Property + Mappings → Create → Scope Mapping, name `Vanguard profile (nested groups)`, scope `profile`, expression: + + direct = set(request.user.ak_groups.all()) + return {"groups": sorted(g.name for g in request.user.all_groups() if g not in direct)} + + and tick it (next to the default one) on the `Vanguard sites`, `Jellyfin` and `Gitea` providers → Advanced + protocol settings → Scopes. Claims from several mappings merge, so the header becomes direct + inherited groups + without duplicates. Takes effect on the next login. 3. compose (already set): registration only via external sources, auto-registration + account linking on, username from `preferred_username`. A first Discord login creates the Gitea user with no form. 4. Access = Authentik group **`git-users`**: Directory → Groups → create it (add a Discord role to it in the