fix(health): token_broker probe uses token exchange (stops 400s every 5 min) #37

2026-10-16T12:55:37Z

KofTwentyTwo commented

2026-10-16 12:55:37 +00:00

(Migrated from github.com)

The token_broker health check probed grant_type=client_credentials. The kof22 broker provider only allows token exchange, so Authentik logged Invalid grant_type for provider with a 400 every 5 minutes. The broker itself was fine.

Now the probe sends token exchange with the broker's client credentials and no subject token, so nothing is issued and no user data is sent. Authentik 2026.8 checks the grant type, then the client secret, then the subject:

invalid_request (subject missing): credentials and grant are OK, so UP
invalid_client: bad secret, so DOWN
invalid_grant: the provider does not allow token exchange, so DOWN
anything else, including an issued token: DOWN

Exchange refusals now throw BrokerRefusedException (a QUserFacingException with the same message as before) carrying only the standard OAuth2 error code.

Part of the service-identity work (QRun-IO/qqq#1248). Tests: AuthentikHealthChecksTest 17/17; full unit suite 317/317.

🤖 Generated with Claude Code

The `token_broker` health check probed `grant_type=client_credentials`. The kof22 broker provider only allows token exchange, so Authentik logged `Invalid grant_type for provider` with a 400 every 5 minutes. The broker itself was fine. Now the probe sends token exchange with the broker's client credentials and no subject token, so nothing is issued and no user data is sent. Authentik 2026.8 checks the grant type, then the client secret, then the subject: - `invalid_request` (subject missing): credentials and grant are OK, so UP - `invalid_client`: bad secret, so DOWN - `invalid_grant`: the provider does not allow token exchange, so DOWN - anything else, including an issued token: DOWN Exchange refusals now throw `BrokerRefusedException` (a `QUserFacingException` with the same message as before) carrying only the standard OAuth2 error code. Part of the service-identity work (QRun-IO/qqq#1248). Tests: AuthentikHealthChecksTest 17/17; full unit suite 317/317. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-actions Bot referenced this issue from a commit

2026-11-05 11:43:17 +00:00

Merge develop into release/0.1 for 0.1.0-RC.8 (#37 broker probe, #38 maintenance service principal, #39 mapper drift message; QQQ RC.19)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#37