goauthentik / goauthentik/authentik
RSA signing key required for Synology DSM
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
### Do you see an area that can be clarified or expanded, a technical inaccuracy, or a broken link?
I was going through the documentation steps of [Integrate with Synology DSM (DiskStation Manager)](https://integrations.goauthentik.io/infrastructure/synology-dsm/) and it was failing to connect during the last step [Configuration verification](https://integrations.goauthentik.io/infrastructure/synology-dsm/#configuration-verification) .
The message `Your SSO is not properly configured. Please check your settings or contact your system administrator.` kept being displayed.
So after some searching (thanks to gpt) through the logs of Synology `/var/log/packages/OAuthService.log` I noticed that my imported certificate keys in Authentik (from ISRG Root YE [(https://letsencrypt.org/certificates/ )](https://letsencrypt.org/certificates/#root-cas)) where `ECDSA P-384` . So the `/application/o/synology-dsm/.well-known/openid-configuration` was showing:
```json
"id_token_signing_alg_values_supported": [
"ES384"
],
```
And those ECDSA certificates don't work as a signing key on the Synology DSM!
So after creating a new RSA key (Generate Certificate-Key Pair), and assigning the RSA key as the **Signing Key** it started to work!
So please add a note to the documentation that signing key of the type RSA are required.
Secondly, I kept getting the `Your SSO is not properly configured. Please check your settings or contact your system administrator.` as I had to create a user that matches my `prefered_username` to be able to login.
So I ended up creating a scope mapping to use the desired existing usernames, thus not having to migrate years of data stored on the NAS:
```json
return {
"preferred_username": request.user.attributes.get("application_username", request.user.username),
}
```
So please add that to the documentation where the `prefered_username` must match an existing user and how to create a scope mapping to map existing users.
### Link
https://integrations.goauthentik.io/infrastructure/synology-dsm
### Solution
1. Creating note for the readers that they need to use a RSA key (Generate Certificate-Key Pair), and assigning the RSA key as the **Signing Key**
2. Create a section about User Management, where it explains:
a. The login will fail if the username does not match `prefered_username`, thus they need to create a user on the Synology NAS.
b. How to create scope mapping to manipulate the `prefered_username` to use a custom value to for existing users on the Synology NAS, like:
```json
return {
"preferred_username": request.user.attributes.get("application_username", request.user.username),
}
```
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.