Allow Social login configuration through Terraform

[NigelVanHattum]

Problem definition I am following this guide: https://goauthentik.io/integrations/sources/general#add-sources-to-default-login-page in order to add a social login to my Authentik installation. I am unable to change the "default-authentication-flow" through the Terraform provider in order to add the social login to the default login screen.

What would I expect A change to the "authentik_flow_stage_binding" resource that would allow for me to add the new sources as an option.

[rissson]

You can have an authentik_stage_identification resource, terraform import it and then make the changes you require to it:

resource "authentik_stage_identification" "default-authentication-identification" {
  name           = "default-authentication-identification"
  user_fields    = ["username", "email"]
  sources        = [authentik_source_oauth.name.uuid] # this needs to exists above somehow
}

And then terraform import authentik_stage_identification.default-authentication-identification <the UUID of the stage (which you can find using the API)>.

And finally terraform apply to make the modifications you need

[NigelVanHattum]

Hi @rissson,

Sorry for the somewhat delayed reply, but I did some more trial an error. I would like to manage my whole Authentik deployment & configuration through one single Terraform apply command.

I am deploying my whole cluster, including authentik and all other application via a single command. Using an extra step in this proces to manually import a single resource in order to add an extra IDP to the login screen feels like an oversight.

[rissson]

I see. In that case, I would recommend using blueprints which allow you to manage authentik objects as code directly within authentik.

The included blueprints are available at https://github.com/goauthentik/authentik/tree/main/blueprints and are copied as-is in the container at /blueprints.

For your usecase, you'll need to override https://github.com/goauthentik/authentik/blob/main/blueprints/default/flow-default-authentication-flow.yaml and add a sources attribute to the id: default-authentication-identification item. You'll also need to create the source in another blueprint.

If your other blueprint is called Source - Social and you have a source called social, you can do the following:

# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
---
version: 1
metadata:
  name: Default - Authentication flow
entries:
  # Ensures your source is created before this blueprint is applied
  - model: authentik_blueprints.metaapplyblueprint
    attrs:
      identifiers:
        name: Source - Social
      required: true

  - id: default-authentication-identification
    model: authentik_stages_identification.identificationstage
    identifiers:
      name: default-authentication-identification
    attrs:
      sources:
        - !Find [authentik_core.source, [slug, "authentik-built-in"]]
        - !Find [authentik_core.source, [slug, "social"]]
      show_source_labels: true
      # other attributes omitted for brevity

# other resources that are present in the included blueprint omitted for brevity

We currently don't publish the blueprints we use internally but we plan on creating more resources for users to know what they are, how they work, how to use them and examples based on the documentation provided in https://goauthentik.io/integrations/. Meanwhile, I can direct you to my personal blueprints which should help you as a starting point.

In any case, we won't be modifying the Terraform provider to add that functionality as attaching a source to the identification stage involves modifying the stage itself, which shouldn't be an additional resource. If you still want to go the Terraform route, I recommend you create a new flow instead of the included default one and use that one.