fix(authelia): explicit custom attribute configuration

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/auth/authelia/locales/en/consent.json

@@ -44,8 +44,8 @@
     "updated_at": "Profile Update Time",
     "website": "Website URL",
     "zoneinfo": "Timezone",
-    "argocd": "Argo CD permissions",
-    "audiobookshelf": "Audiobookshelf permissions"
+    "argocd_claim": "Argo CD Membership",
+    "audiobookshelf": "Audiobookshelf Membership"
   },
   "scopes": {
     "address": "Access your address",
@@ -56,7 +56,7 @@
     "openid": "Use OpenID to verify your identity",
     "phone": "Access your phone number",
     "profile": "Access your profile information",
-    "argocd": "Argo CD",
-    "audiobookshelf": "Audiobookshelf"
+    "argocd_scope": "Access Argo CD memberships",
+    "audiobookshelf": "Access Audiobookshelf memberships"
   }
 }

k8s/infra/auth/authelia/values.yaml

@@ -88,10 +88,10 @@ configMap:
         allowed_origins_from_client_redirect_uris: true
         endpoints: [ userinfo, authorization, token, revocation, introspection ]
       claims_policies:
-        argocd:
-          custom_claims: { argocd: { attribute: argocd } }
+        argocd_policy:
+          custom_claims: { argocd_claim: { attribute: argocd } }
           # Argo CD requires the claims other than `groups` to be in the ID Token https://github.com/argoproj/argo-cd/issues/23768
-          id_token: [ email, name, preferred_username, argocd ]
+          id_token: [ email, email_verified, alt_emails, name, preferred_username, argocd_claim ]
         audiobookshelf:
           custom_claims: { audiobookshelf: { attribute: audiobookshelf } }
         # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
@@ -100,8 +100,8 @@ configMap:
         username_email:
           id_token: [ email, email_verified, alt_emails, name, preferred_username ]
       scopes:
-        argocd:
-          claims: [ argocd ]
+        argocd_scope:
+          claims: [ argocd_claim ]
         audiobookshelf:
           claims: [ audiobookshelf ]
       clients:
@@ -110,13 +110,13 @@ configMap:
           client_name: Argo CD
           public: false
           authorization_policy: two_factor
-          claims_policy: argocd
+          claims_policy: argocd_policy
           pre_configured_consent_duration: 1 month
-          require_pkce: true
+          require_pkce: false
           redirect_uris:
             - https://argocd.stonegarden.dev/auth/callback
             - https://argocd.stonegarden.dev/applications
-          scopes: [ openid, email, profile, offline_access, argocd ]
+          scopes: [ openid, email, profile, offline_access, argocd_scope ]
           grant_types: [ authorization_code, refresh_token ]
           userinfo_signed_response_alg: none
           id_token_signed_response_alg: ES256
@@ -126,10 +126,10 @@ configMap:
           client_name: Argo CD (CLI)
           public: true
           authorization_policy: two_factor
-          claims_policy: argocd
+          claims_policy: argocd_policy
           pre_configured_consent_duration: 1 month
           redirect_uris: [ http://localhost:8085/auth/callback ]
-          scopes: [ openid, email, profile, offline_access, argocd ]
+          scopes: [ openid, email, profile, offline_access, argocd_scope ]
           id_token_signed_response_alg: ES256
           access_token_signed_response_alg: ES256
           revocation_endpoint_auth_method: none

k8s/infra/controllers/argocd/values.yaml

@@ -13,14 +13,13 @@ configs:
       clientID: 'argocd'
       clientSecret: $oidc:authelia.clientSecret
       cliClientID: 'argocd-cli'
-      requestedScopes: [ 'openid' ]
+      requestedScopes: [ 'openid', 'offline_access' ]
       enableUserInfoGroups: true
       requestedIDTokenClaims: 
-        argocd: { essential: true }
-        email: { essential: false }
+        argocd_claim: { essential: true }
         name: { essential: false }
+        email: { essential: false }
         preferred_username: { essential: false }
-        offline_access: { essential: false }
       userInfoPath: /api/oidc/userinfo
       userInfoCacheExpiration: '5m'
 
@@ -35,10 +34,10 @@ configs:
     controller.diff.server.side: true
     server.insecure: true
   rbac:
-    scopes: '[ argocd ]'
+    scopes: '[ argocd_claim ]'
     policy.csv: |
       g, admin, role:admin
-      g, read, role:readonly
+      g, readonly, role:readonly
 
 crds:
   install: true