Fusion
50 lines
1.8 KiB
Markdown
50 lines
1.8 KiB
Markdown
# Simplify Authentik Auth Flow
|
|
|
|
## Problem
|
|
|
|
The current authentication implementation is overly complex for our needs:
|
|
|
|
- **Multiple layers**: OIDC token exchange, refresh token rotation, complex cookie management
|
|
- **Difficult to debug**: Many moving parts make deployment issues hard to diagnose
|
|
- **Over-engineered**: We don't need the full OIDC flow complexity for our use case
|
|
- **Maintenance burden**: The sophisticated approach requires deep understanding of OAuth2/OIDC internals
|
|
|
|
## Solution
|
|
|
|
Replace the current complex auth flow with a simplified approach:
|
|
|
|
1. **Authentik OAuth**: Keep OAuth2 authentication via Authentik
|
|
2. **Session-based**: Use simple session cookies instead of JWT + refresh tokens
|
|
3. **Authentik as source of truth**: User profiles synced from Authentik on login
|
|
4. **Simpler implementation**: Reduce auth-related code by ~70%
|
|
|
|
## Benefits
|
|
|
|
- **Easier to deploy**: Fewer configuration variables and moving parts
|
|
- **Easier to debug**: Clear flow: Login → Authentik → Session Cookie
|
|
- **Less code**: Remove JWT service, refresh token store, complex OIDC logic
|
|
- **Future-proof**: Still supports teams/groups via Authentik's user info endpoint
|
|
- **Better UX**: No token refresh issues, simpler logout
|
|
|
|
## Scope
|
|
|
|
### What stays:
|
|
- OAuth2 authentication via Authentik
|
|
- User model in database (synced from Authentik)
|
|
- Protected routes requiring authentication
|
|
- Frontend auth state management
|
|
|
|
### What goes:
|
|
- JWT access tokens
|
|
- Refresh token rotation
|
|
- Complex OIDC token verification
|
|
- Multiple cookie types (access_token, refresh_token)
|
|
- Token expiry/refresh logic
|
|
- JWKS fetching and validation
|
|
|
|
### What's new:
|
|
- Simple session cookie (httpOnly, secure, SameSite)
|
|
- Authentik user info endpoint integration
|
|
- Simplified auth middleware
|
|
- Cleaner logout (just delete session)
|