Test identity provider (Authentik)

Why

JANUS_DEV_AUTH bypasses the identity provider entirely, which means the OIDC group-sync and group-based auto-grant paths never run. To exercise them without an enterprise IdP, the reference compose file ships an optional Authentik instance behind the idp profile. It is an evaluation aid: keep it on localhost and never treat it as production identity.

cd deploy/compose
# .env additions (see .env.example): AUTHENTIK_SECRET_KEY and
# AUTHENTIK_POSTGRES_PASSWORD are required, both via openssl rand -hex 32.
docker compose --profile idp up -d
# Authentik UI: http://localhost:9000 (akadmin / AUTHENTIK_BOOTSTRAP_PASSWORD)

Create the OIDC application in Authentik

Sign in as akadmin, then under Applications → Providers create an OAuth2/OpenID provider: authorization code flow, confidential client, redirect URI set to JANUS_PUBLIC_URL + /auth/callback (for the default compose setup that is http://localhost:8080/auth/callback). Leave the default scope mappings — Authentik includes group membership in the standard profile scope.

Then under Applications → Applications create an application named janus with slug janus and attach the provider. The issuer URL Janus needs is the provider’s "OpenID configuration issuer", which for slug janus is http://localhost:9000/application/o/janus/.

Create a few groups (Admin → Directory → Groups) and users, and add the users to groups. On sign-in Janus syncs each user’s group list from the ID token, creates missing groups, and applies any model grants an administrator attached to those groups — this is the auto-grant path.

Point Janus at it

Set the JANUS_OIDC_* variables and unset JANUS_DEV_AUTH. Authentik has no separate groups scope (groups ride in profile), so narrow JANUS_OIDC_SCOPES accordingly; the groups claim name is the default "groups", so no claim override is needed.

Janus verifies ID-token signatures itself and accepts RS256/RS384/RS512 (RSA) and ES256/ES384/ES512 (ECDSA) signing algorithms. EdDSA-only providers are rejected fail-closed; if sign-in fails with an unsupported-algorithm error, switch the identity provider’s signing key to RS256 (the OIDC default).

Restart Janus and open the sign-in page: you are redirected to Authentik, and after authenticating, your Janus profile shows the synced groups. Removing a user from a group in Authentik is reflected on their next sign-in.

JANUS_DEV_AUTH=false
JANUS_OIDC_PROVIDER_URL=http://localhost:9000/application/o/janus/
JANUS_OIDC_CLIENT_ID=<client id from the provider page>
JANUS_OIDC_CLIENT_SECRET=<client secret from the provider page>
JANUS_OIDC_SCOPES=openid,profile,email

What to verify

Sign-in round-trip: an Authentik user lands in Janus with their email, name, and groups populated (Admin → People shows the synced groups).

Group sync: change a user’s groups in Authentik, sign them out and back in, and confirm the Janus group list follows.

Auto-grants: attach a model grant to a group in Janus (Admin → Grants), then confirm a group member’s GET /v1/models includes the model with grant_source group.