After enabling OIDC and authenticating via Authentik I lost admin ability #627

New Issue

OVERLORD · 2026-02-04T20:36:36+03:00

OVERLORD commented

2026-02-04 20:36:36 +03:00

Originally created by @the-bort-the on GitHub (Jan 9, 2025).

Before enabling OIDC and integrating Authentik, I used the demo user to create a new admin user. I then disabled the demo user and had been using the basic auth for this new admin user.

After configuring OIDC I am able to log into Planka, but after doing so, I noticed my admin user was overwritten by my Authentik user. While this isn't the end of the world, I did noticed I lost my admin capabilities. Looking to the database I tried to update the column is_admin to t within the user_account table.

This worked until I restarted the container. Is there something else needed to permanently provide myself admin? It also seems since I enabled OIDC, I cannot comment out the OIDC variables within docker-compose.yml. It says I need to use SSO. I wonder if I'm locked into SSO now?

  #- OIDC_ISSUER=https://auth.example.com/application/o/planka/
  #- OIDC_CLIENT_ID=$client_id
  #- OIDC_CLIENT_SECRET=$client_secret

Originally created by @the-bort-the on GitHub (Jan 9, 2025). Before enabling OIDC and integrating Authentik, I used the demo user to create a new admin user. I then disabled the demo user and had been using the basic auth for this new admin user. After configuring OIDC I am able to log into Planka, but after doing so, I noticed my admin user was overwritten by my Authentik user. While this isn't the end of the world, I did noticed I lost my admin capabilities. Looking to the database I tried to update the column `is_admin` to `t` within the `user_account` table. This worked until I restarted the container. Is there something else needed to permanently provide myself admin? It also seems since I enabled OIDC, I cannot comment out the OIDC variables within docker-compose.yml. It says I need to use SSO. I wonder if I'm `locked into` SSO now? #- OIDC_ISSUER=https://auth.example.com/application/o/planka/ #- OIDC_CLIENT_ID=$client_id #- OIDC_CLIENT_SECRET=$client_secret

OVERLORD closed this issue

2026-02-04 20:36:37 +03:00

OVERLORD commented

2026-02-04 20:36:40 +03:00

@the-bort-the commented on GitHub (Jan 10, 2025):

Even a logout / login will change that boolean flag back to false for is_admin

@the-bort-the commented on GitHub (Jan 10, 2025): Even a logout / login will change that boolean flag back to false for is_admin

OVERLORD commented

2026-02-04 20:36:49 +03:00

@meltyshev commented on GitHub (Jan 17, 2025):

Hi!

To ensure you always have admin privileges, you need to either uncomment OIDC_IGNORE_ROLES=true and modify the role directly in the database, or configure OIDC groups and set OIDC_ADMIN_ROLES=admin with OIDC_ROLES_ATTRIBUTE=groups.

Regarding SSO locking, it can't currently be modified through the UI. However, you can update the is_sso field for a specific user directly in the database.

@meltyshev commented on GitHub (Jan 17, 2025): Hi! To ensure you always have admin privileges, you need to either uncomment `OIDC_IGNORE_ROLES=true` and modify the role directly in the database, or configure OIDC groups and set `OIDC_ADMIN_ROLES=admin` with `OIDC_ROLES_ATTRIBUTE=groups`. Regarding SSO locking, it can't currently be modified through the UI. However, you can update the `is_sso` field for a specific user directly in the database.

OVERLORD commented

2026-02-04 20:36:55 +03:00

@the-bort-the commented on GitHub (Jan 20, 2025):

If I uncomment OIDC_IGNORE_ROLES=true and alter the table in the database, I see the is_admin stay enabled. However, when I comment OIDC_ADMIN_ROLES=admin with OIDC_ROLES_ATTRIBUTE=groups I am still seeing the behavior in my original comments.

I would like to clarify when using OIDC_ADMIN_ROLES=admin with OIDC_ROLES_ATTRIBUTE=groups am I also supposed to use an account within Authentik with both a name and username of "admin"? I see in the user_account table, there are two columns; one for name and another for username. The values for those are currently authentik Default Admin and akadmin respectively.

@the-bort-the commented on GitHub (Jan 20, 2025): If I uncomment `OIDC_IGNORE_ROLES=true` and alter the table in the database, I see the `is_admin` stay enabled. However, when I comment `OIDC_ADMIN_ROLES=admin` with `OIDC_ROLES_ATTRIBUTE=groups` I am still seeing the behavior in my original comments. I would like to clarify when using `OIDC_ADMIN_ROLES=admin` with `OIDC_ROLES_ATTRIBUTE=groups` am I also supposed to use an account within Authentik with both a name and username of "admin"? I see in the `user_account` table, there are two columns; one for name and another for username. The values for those are currently `authentik Default Admin` and `akadmin` respectively.

OVERLORD commented

2026-02-04 20:36:57 +03:00

@meltyshev commented on GitHub (Jan 20, 2025):

I would like to clarify when using OIDC_ADMIN_ROLES=admin with OIDC_ROLES_ATTRIBUTE=groups am I also supposed to use an account within Authentik with both a name and username of "admin"? I see in the user_account table, there are two columns; one for name and another for username. The values for those are currently authentik Default Admin and akadmin respectively.

I just checked on my test Authentik instance, and the default admin group name is authentik Admins (Directory -> Users -> Groups). If I set OIDC_ADMIN_ROLES=authentik Admins, the user will become an admin upon logging in. Alternatively, you can create a new group under Directory -> Groups, assign it to a user, and then specify it in OIDC_ADMIN_ROLES.

@meltyshev commented on GitHub (Jan 20, 2025): > I would like to clarify when using `OIDC_ADMIN_ROLES=admin` with `OIDC_ROLES_ATTRIBUTE=groups` am I also supposed to use an account within Authentik with both a name and username of "admin"? I see in the `user_account` table, there are two columns; one for name and another for username. The values for those are currently `authentik Default Admin` and `akadmin` respectively. I just checked on my test Authentik instance, and the default admin group name is `authentik Admins` (Directory -> Users -> Groups). If I set `OIDC_ADMIN_ROLES=authentik Admins`, the user will become an admin upon logging in. Alternatively, you can create a new group under Directory -> Groups, assign it to a user, and then specify it in `OIDC_ADMIN_ROLES`.

OVERLORD commented

2026-02-04 20:37:00 +03:00

@the-bort-the commented on GitHub (Jan 20, 2025):

That was the fix, thank you! I set OIDC_ADMIN_ROLES=authentik Admins and it persisted the admin role when logging in.

@the-bort-the commented on GitHub (Jan 20, 2025): That was the fix, thank you! I set `OIDC_ADMIN_ROLES=authentik Admins` and it persisted the admin role when logging in.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/planka#627