From c2c257aa124309babde9115e18e59cb1271e00e2 Mon Sep 17 00:00:00 2001 From: dtoro Date: Mon, 29 Jun 2026 08:48:52 +0200 Subject: [PATCH] docs(grimmory): correct Authentik OIDC setup notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OIDC config migrated from Booklore DB dump — Confidential client (not PKCE), credentials intact. offline_access scope added to Authentik provider. Backchannel logout URL set to permanent IP 192.168.8.213. Co-Authored-By: Claude Sonnet 4.6 --- containers/130-grimmory.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/containers/130-grimmory.md b/containers/130-grimmory.md index 038bdfa..0f5cd7f 100644 --- a/containers/130-grimmory.md +++ b/containers/130-grimmory.md @@ -36,16 +36,15 @@ Credentials live in `/opt/grimmory/.env` (untracked): ## Authentik OIDC -Grimmory uses **PKCE (Public client — no client secret required)**. +Uses Confidential client (client secret stored in Grimmory's DB — migrated from Booklore). The OIDC config carried over in the database dump; no manual re-entry needed. -- **Authentik provider:** `Grimmory` (updated from old `Booklore` provider — client type changed to Public) +- **Authentik provider:** `Provider for Grimmory` (renamed from `Provider for Booklore` on migration) +- **Client ID:** `L1u0eFsNhbKgiIvvFeIr2mvZdbtFyzidCq2h6thL` +- **Client type:** Confidential (client secret in `oidc_provider_details` in MariaDB `app_settings`) - **Redirect URI:** `https://books.hubris.network/oauth2-callback` - **Scopes:** openid, profile, email, offline_access - **Back-channel logout:** `http://192.168.8.213:6060/api/v1/auth/oidc/backchannel-logout` -- **Grimmory admin UI:** Settings → Authentication → OIDC - - Issuer URI: `https://auth.hubris.network/application/o//` (trailing slash required) - - Client ID: from Authentik provider - - Test Connection to verify reachability from within the container +- **Application slug:** `booklore` → Issuer URI: `https://auth.hubris.network/application/o/booklore/` ## Media permissions