goauthentik / goauthentik/authentik

RSA signing key required for Synology DSM

Closed
#26,091 0 comments 0 reactions 2 assignees Claimed by @dewi-tik View on GitHub
triage
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

### Do you see an area that can be clarified or expanded, a technical inaccuracy, or a broken link?

I was going through the documentation steps of [Integrate with Synology DSM (DiskStation Manager)](https://integrations.goauthentik.io/infrastructure/synology-dsm/) and it was failing to connect during the last step [Configuration verification](https://integrations.goauthentik.io/infrastructure/synology-dsm/#configuration-verification) .
The message `Your SSO is not properly configured. Please check your settings or contact your system administrator.` kept being displayed.

So after some searching (thanks to gpt) through the logs of Synology `/var/log/packages/OAuthService.log` I noticed that my imported certificate keys in Authentik (from ISRG Root YE [(https://letsencrypt.org/certificates/ )](https://letsencrypt.org/certificates/#root-cas)) where `ECDSA P-384` . So the `/application/o/synology-dsm/.well-known/openid-configuration` was showing:

```json
"id_token_signing_alg_values_supported": [
"ES384"
],
```
And those ECDSA certificates don't work as a signing key on the Synology DSM!

So after creating a new RSA key (Generate Certificate-Key Pair), and assigning the RSA key as the **Signing Key** it started to work!

So please add a note to the documentation that signing key of the type RSA are required.

Secondly, I kept getting the `Your SSO is not properly configured. Please check your settings or contact your system administrator.` as I had to create a user that matches my `prefered_username` to be able to login.

So I ended up creating a scope mapping to use the desired existing usernames, thus not having to migrate years of data stored on the NAS:
```json
return {
"preferred_username": request.user.attributes.get("application_username", request.user.username),
}
```
So please add that to the documentation where the `prefered_username` must match an existing user and how to create a scope mapping to map existing users.

### Link

https://integrations.goauthentik.io/infrastructure/synology-dsm

### Solution

1. Creating note for the readers that they need to use a RSA key (Generate Certificate-Key Pair), and assigning the RSA key as the **Signing Key**
2. Create a section about User Management, where it explains:
a. The login will fail if the username does not match `prefered_username`, thus they need to create a user on the Synology NAS.
b. How to create scope mapping to manipulate the `prefered_username` to use a custom value to for existing users on the Synology NAS, like:
```json
return {
"preferred_username": request.user.attributes.get("application_username", request.user.username),
}
```

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.