dtoro/mule-image
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(sidecar): stop blocking Authentik OIDC login on the scoped proxy

Browse Source 
The scoped /api/v1 proxy let unauthenticated traffic through for a
guessed "oauth/" path prefix, but PhotoPrism's actual OIDC routes are
/api/v1/oidc/login and /api/v1/oidc/redirect. The Authentik callback
(oidc/redirect) has no session token yet — it IS what establishes one —
so it fell through to the authenticated branch and got rejected with
401 "invalid session" before the session existed. Since the sidecar
registers /api/v1/*rest as the catch-all for all PhotoPrism API
traffic, this broke SSO login entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-04 13:30:33 +02:00
parent 75008f238a
commit a239cece10
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
sidecar/handlers_ppproxy.go
View File

@@ -260,10 +260,15 @@ func handlePPProxy(cfg *Config, ppDb *gorm.DB) gin.HandlerFunc {
c.Request.URL.RawPath = "" c.Request.URL.RawPath = ""
method := c.Request.Method method := c.Request.Method
// Unauthenticated / token-in-URL surface: login+logout, client // Unauthenticated / token-in-URL surface: login+logout, OIDC
// config, hash-addressed media, websocket. // login+callback (PhotoPrism's actual routes are /api/v1/oidc/login
// and /api/v1/oidc/redirect — "oauth/" was never a real PhotoPrism
// path and left the Authentik callback with no valid token yet
// falling through to the authenticated branch below, producing a
// 401 "invalid session" before the session was even established),
// client config, hash-addressed media, websocket.
passUnscoped := rest == "session" || strings.HasPrefix(rest, "session/") || passUnscoped := rest == "session" || strings.HasPrefix(rest, "session/") ||
strings.HasPrefix(rest, "oauth/") || strings.HasPrefix(rest, "oidc/") ||
rest == "config" || rest == "ws" || rest == "config" || rest == "ws" ||
strings.HasPrefix(rest, "t/") || strings.HasPrefix(rest, "t/") ||
strings.HasPrefix(rest, "dl/") || strings.HasPrefix(rest, "dl/") ||