From dc099b99f9568058aedcb199a2de304c7a8f12be Mon Sep 17 00:00:00 2001 From: chrisfu Date: Thu, 28 May 2026 07:11:13 -0700 Subject: [PATCH] fix(knoe-auth): wire Google Workspace login for prole.org - Add KNOE_AUTH_BASE_URL=https://api.prole.org/auth to knoe-auth deployment; LoginController.java defaulted to api.0.knoe.dev causing redirect_uri mismatch on every Google login attempt - Update oauth2-proxy-deployment-prole.yaml to reflect live config: --provider=oidc --oidc-issuer-url=https://api.prole.org/auth (was stale --provider=google; live deployment already switched to OIDC) - Fix redirect URIs in knoe-auth-google-prole-secret.example.yaml: remove spurious double /auth/auth/ prefix (Kong strip_path=false so Spring @RequestMapping(/auth) gives /auth/callback/google not /auth/auth/callback/google) Co-Authored-By: Claude Sonnet 4.6 --- .../opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml | 7 ++++++- .../knoe/knoe-auth-google-prole-secret.example.yaml | 4 ++-- .../k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml | 6 +++++- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml index cc36768..ae4c763 100644 --- a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml +++ b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml @@ -196,9 +196,14 @@ spec: name: knoe-auth-google-oidc key: hosted_domain optional: true # blank = any Google account; set to restrict to Workspace domain + # ── prole.org base URL (used for Google OAuth2 redirect_uri) ──────── + # LoginController.java: @Value("${KNOE_AUTH_BASE_URL:https://api.0.knoe.dev/auth}") + # Must be set to the public-facing auth prefix for this cluster. + - name: KNOE_AUTH_BASE_URL + value: "https://api.prole.org/auth" # ── prole.org Google OAuth2 login (Path A) ─────────────────────── # Real values: bao/kv/knoe/oauth2/google-prole-org - # Secret template: deploy/opentofu/k3s/manifests/knoe/knoe-auth-http-keytab-secret.example.yaml + # Secret template: deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml - name: GOOGLE_PROLE_CLIENT_ID valueFrom: secretKeyRef: diff --git a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml index c555703..9a03262 100644 --- a/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml +++ b/deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml @@ -11,8 +11,8 @@ metadata: # https://console.cloud.google.com/apis/credentials # Application type: Web application # Authorized redirect URIs: -# https://api.prole.org/auth/auth/callback/google -# https://api.prole.org/auth/auth/enroll/google-callback +# https://api.prole.org/auth/callback/google +# https://api.prole.org/auth/enroll/google-callback # # 2. Store real values in OpenBao: # bao kv put knoe/oauth2/google-prole-org \ diff --git a/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml b/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml index 46c6c0b..de07746 100644 --- a/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml +++ b/deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml @@ -80,7 +80,11 @@ spec: image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2 imagePullPolicy: IfNotPresent args: - - --provider=google + # Switched from --provider=google to OIDC via knoe-auth (Phase 2). + # Authentication flow: oauth2-proxy → knoe-auth /authorize → Google → knoe-auth /callback/google → oauth2-proxy /callback + # The db-prole-org Google OAuth client (https://db.prole.org/oauth2/callback) is now unused. + - --provider=oidc + - --oidc-issuer-url=https://api.prole.org/auth - --email-domain=prole.org - --upstream=http://supabase-kong:8000 - --http-address=0.0.0.0:4180