From b89afb50d2d04c4097be018bf2ce43d0e98daa28 Mon Sep 17 00:00:00 2001 From: Brandyn / Techy Date: Sat, 31 Oct 2026 15:08:16 -0500 Subject: [PATCH] Caddy: /whoami on the main host echoes the Authentik identity headers for debugging Co-Authored-By: Claude Fable 5.1 --- README.md | 4 +++- configure.py | 9 +++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 4840101..bca7fa6 100644 --- a/README.md +++ b/README.md @@ -237,7 +237,9 @@ Design: **Authentik authenticates once for the whole domain; Caddy authorizes pe role-id → group table). Bind it to `default-source-enrollment` **and** `default-source-authentication` (engine mode `all`, after `discord-guild-member`). From then on giving someone a Discord role gives them the matching access on next login; removing it removes it. -5. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` → 403 unless +5. Debug: `https://HOST/whoami` prints the username/groups headers exactly as the apps receive them. + Group changes in Authentik apply on the next login — log out at `https://auth.HOST/` and back in. +6. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` → 403 unless you hold the bot role; `https://live.HOST/me/stream-key` shows your username. Jellyfin and Gitea use OIDC providers instead, not this. diff --git a/configure.py b/configure.py index 995b36f..6336d02 100755 --- a/configure.py +++ b/configure.py @@ -240,6 +240,15 @@ def write_caddy(domain, auth_host="", watch_host="", git_host="", bot_host="", l {domain} {{ encode zstd gzip {AUTHENTIK_FORWARD_AUTH} + # who does Authentik say I am? (debug: shows exactly the identity headers the apps receive) + handle /whoami {{ + header Content-Type text/plain + respond "user: {{http.request.header.X-Authentik-Username}} +groups: {{http.request.header.X-Authentik-Groups}} +email: {{http.request.header.X-Authentik-Email}} +name: {{http.request.header.X-Authentik-Name}}" + }} + # dump endpoint (python service on the host; identity from the X-Authentik-* headers Caddy just set) handle /dump* {{ reverse_proxy 127.0.0.1:8080