From 481b224f22010c94035cedb4fc2157ff457c8637 Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@stonegarden.dev>
Date: Sun, 30 Mar 2025 15:48:12 +0200
Subject: [PATCH] feat(authelia): upgrade to 4.39 and fix OIDC configuration

Signed-off-by: Vegard Hagen <vegard@stonegarden.dev>
---
 k8s/infra/auth/authelia/kustomization.yaml    |  2 +-
 k8s/infra/auth/authelia/values.yaml           | 23 ++++++++++++-------
 k8s/infra/controllers/argocd/values.yaml      |  5 ++++
 .../kubernetes/kubernetes_volumes.auto.tfvars |  4 ----
 4 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/k8s/infra/auth/authelia/kustomization.yaml b/k8s/infra/auth/authelia/kustomization.yaml
index 7516feb..e715d8b 100644
--- a/k8s/infra/auth/authelia/kustomization.yaml
+++ b/k8s/infra/auth/authelia/kustomization.yaml
@@ -19,7 +19,7 @@ helmCharts:
     repo: https://charts.authelia.com
     releaseName: authelia
     namespace: authelia
-    version: 0.9.15
+    version: 0.10.4
     valuesFile: values.yaml
 
 patches:
diff --git a/k8s/infra/auth/authelia/values.yaml b/k8s/infra/auth/authelia/values.yaml
index 75932ec..45b5332 100644
--- a/k8s/infra/auth/authelia/values.yaml
+++ b/k8s/infra/auth/authelia/values.yaml
@@ -2,7 +2,7 @@
 image:
   registry: ghcr.io
   repository: authelia/authelia
-  tag: 4.38.18 # renovate: docker=ghcr.io/authelia/authelia
+  tag: 4.39.1 # renovate: docker=ghcr.io/authelia/authelia
   pullPolicy: IfNotPresent
 
 pod:
@@ -79,8 +79,13 @@ configMap:
       cors:
         allowed_origins_from_client_redirect_uris: true
         endpoints: [ userinfo, authorization, token, revocation, introspection ]
+      claims_policies:
+        # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
+        default:
+          id_token: [ groups, email, email_verified, alt_emails, preferred_username, name ]
+        username_email:
+          id_token: [ email, email_verified, alt_emails, preferred_username, name ]
       clients:
-
         - client_id: argocd
           client_secret: { path: /secrets/client-argocd/client_secret.txt }
           client_name: Argo CD
@@ -104,27 +109,29 @@ configMap:
           scopes: [ openid, groups, email, profile, offline_access ]
           id_token_signed_response_alg: ES256
           access_token_signed_response_alg: ES256
-          #revocation_endpoint_auth_method: none
-          #introspection_endpoint_auth_method: none
-          #pushed_authorization_request_endpoint_auth_method: none
+          revocation_endpoint_auth_method: none
+          introspection_endpoint_auth_method: none
+          pushed_authorization_request_endpoint_auth_method: none
 
         - client_id: kubectl
           client_name: kubectl
           public: true
           authorization_policy: two_factor
+          claims_policy: default
           pre_configured_consent_duration: 1 month
           require_pkce: true
           redirect_uris: [ http://localhost:8000, http://localhost:18000 ]
           scopes: [ openid, groups, email, profile, offline_access ]
-          #revocation_endpoint_auth_method: none
-          #introspection_endpoint_auth_method: none
-          #pushed_authorization_request_endpoint_auth_method: none
+          revocation_endpoint_auth_method: none
+          introspection_endpoint_auth_method: none
+          pushed_authorization_request_endpoint_auth_method: none
 
         - client_id: netbird
           client_secret: { path: /secrets/client-netbird/client_secret.txt }
           client_name: NetBird
           public: false
           authorization_policy: two_factor
+          claims_policy: username_email
           pre_configured_consent_duration: 1 month
           require_pkce: true
           pkce_challenge_method: S256
diff --git a/k8s/infra/controllers/argocd/values.yaml b/k8s/infra/controllers/argocd/values.yaml
index 644cac3..7c66220 100644
--- a/k8s/infra/controllers/argocd/values.yaml
+++ b/k8s/infra/controllers/argocd/values.yaml
@@ -6,6 +6,7 @@ configs:
     admin.enabled: false
     url: https://argocd.stonegarden.dev
     # https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets
+    # https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#retrieving-group-claims-when-not-in-the-token
     oidc.config: |
       name: 'Authelia'
       issuer: 'https://authelia.stonegarden.dev'
@@ -13,6 +14,10 @@ configs:
       clientSecret: $oidc:authelia.clientSecret
       cliClientID: 'argocd-cli'
       requestedScopes: [ 'openid', 'profile', 'email', 'groups', 'offline_access' ]
+      enableUserInfoGroups: true
+      userInfoPath: /api/oidc/userinfo
+      userInfoCacheExpiration: '5m'
+
   cmp:
     create: true
     plugins:
diff --git a/tofu/kubernetes/kubernetes_volumes.auto.tfvars b/tofu/kubernetes/kubernetes_volumes.auto.tfvars
index 65c971c..84de9dc 100644
--- a/tofu/kubernetes/kubernetes_volumes.auto.tfvars
+++ b/tofu/kubernetes/kubernetes_volumes.auto.tfvars
@@ -35,10 +35,6 @@ kubernetes_volumes = {
     node = "euclid"
     size = "2G"
   }
-  pv-jellyfin = {
-    node = "euclid"
-    size = "12G"
-  }
   pv-jellyfin-config = {
     node = "euclid"
     size = "12G"