feat(permissions): Authentik permissions for automated sessions #22

2026-10-14T00:48:44Z

KofTwentyTwo commented

2026-10-14 00:48:44 +00:00

(Migrated from github.com)

AuthentikGroupPermissionMapper now implements customizeAutomatedSessionForUser, which OAuth2AuthenticationModule.createAutomatedSessionForUser calls.

Why. Server-minted sessions carry no token, so they got no Authentik permissions. There are two callers:

core scheduled saved reports;
qbit-file-gateway, which mints a session for an SSH-key user and calls /qqq/v1 with it.

Rule (agreed with the qbit-authentik token agent):

userId is the email idReference (kof22 uses sub_mode: user_email).
It must match exactly ONE active Authentik user. The match is trimmed and case-insensitive, and a lookup that may have been truncated doesn't count as a match.
That user's direct groups, plus their ancestors, go through the same resolve(...), static fallbacks and cut-over guard floor as sign-in.
Service accounts follow the same rule.
Bootstrap grants match immutable ids only, and email verification is never assumed.
Unknown, duplicate or inactive users, or an unreadable API, get only the static fallbacks. It never grants everything.
Existing session permissions are kept.
customizeSession is unchanged; the token-scope work is in flight there.

Tests: 19 mapper cases, including match, unknown, duplicate, inactive, API down, service account, kept permissions and guard blocking. ./mvnw verify passes: 224 tests, checkstyle and JaCoCo. The 44 Docker contract tests skip locally.

🤖 Generated with Claude Code

`AuthentikGroupPermissionMapper` now implements `customizeAutomatedSessionForUser`, which `OAuth2AuthenticationModule.createAutomatedSessionForUser` calls. **Why.** Server-minted sessions carry no token, so they got no Authentik permissions. There are two callers: - core scheduled saved reports; - qbit-file-gateway, which mints a session for an SSH-key user and calls `/qqq/v1` with it. **Rule** (agreed with the qbit-authentik token agent): - `userId` is the email idReference (kof22 uses `sub_mode: user_email`). - It must match exactly ONE active Authentik user. The match is trimmed and case-insensitive, and a lookup that may have been truncated doesn't count as a match. - That user's direct groups, plus their ancestors, go through the same `resolve(...)`, static fallbacks and cut-over guard floor as sign-in. - Service accounts follow the same rule. - Bootstrap grants match immutable ids only, and email verification is never assumed. - Unknown, duplicate or inactive users, or an unreadable API, get only the static fallbacks. It never grants everything. - Existing session permissions are kept. - `customizeSession` is unchanged; the token-scope work is in flight there. **Tests:** 19 mapper cases, including match, unknown, duplicate, inactive, API down, service account, kept permissions and guard blocking. `./mvnw verify` passes: 224 tests, checkstyle and JaCoCo. The 44 Docker contract tests skip locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#22