From 65aa8b0894f9addf0915923c660618841b0252f3 Mon Sep 17 00:00:00 2001 From: Brandyn / Techy Date: Sat, 31 Oct 2026 15:38:01 -0500 Subject: [PATCH] Docs: provider invalidation flow so every logout forces a full Discord re-login Co-Authored-By: Claude Fable 5.1 --- README.md | 7 +++++-- addCommunityMediaServer.sh | 3 ++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 67fbd90..ee0c46c 100644 --- a/README.md +++ b/README.md @@ -247,8 +247,11 @@ Design: **Authentik authenticates once for the whole domain; Caddy authorizes pe the matching access on next login; removing it removes it. copyparty additionally requires a header with a secret name that only Caddy adds (`idp-h-key`, `COPYPARTY_IDP_KEY` in `.env`), so identity headers cannot be forged even if copyparty were reached directly. - Logout: copyparty's logout link and the live portal's "Sign out" go to `/outpost.goauthentik.io/sign_out`, - which ends the Authentik session (a local app logout alone would be undone on the next request). + Logout: copyparty's logout link, the live portal's "Sign out" and the dock's "sign out" go through + `/outpost.goauthentik.io/sign_out`. Set the provider's **Invalidation flow** to + `default-provider-invalidation-flow` so that also ends the Authentik login: every logout then forces a full + Discord re-login on the next visit (and picks up group changes). Discord itself may approve silently if + you are still logged into Discord in that browser. 5. Debug: `https://HOST/whoami` prints the username/groups headers exactly as the apps receive them. Group changes in Authentik apply on the next login — log out at `https://auth.HOST/` and back in. 6. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` → 403 unless diff --git a/addCommunityMediaServer.sh b/addCommunityMediaServer.sh index c072d1f..09f061a 100755 --- a/addCommunityMediaServer.sh +++ b/addCommunityMediaServer.sh @@ -154,7 +154,8 @@ AUTHENTIK FORWARD-AUTH (gates https://$LIVE/ and https://$BOT/; later the main h 1. Applications -> Outposts -> edit "authentik Embedded Outpost" -> config: authentik_host: https://$AUTH 2. Applications -> Create with provider -> Application "Vanguard sites"; Proxy Provider, authorization flow implicit-consent, mode "Forward auth (domain level)", authentication URL https://$AUTH, - cookie domain ${BASE} -> then edit the Embedded Outpost -> Applications: add it -> Update + cookie domain ${BASE}, Invalidation flow default-provider-invalidation-flow (logout = full re-login) + -> then edit the Embedded Outpost -> Applications: add it -> Update 3. Per-host access is enforced by Caddy from X-Authentik-Groups: .env BOT_REQUIRE_GROUP=bot-users (default), LIVE_REQUIRE_GROUP= (empty = any logged-in member). ./configure.py apply regenerates. 4. Discord roles -> Authentik groups: Directory -> Groups: create bot-users (keep streamers/editors/admins);