diff --git a/authentik/outposts/management/__init__.py b/authentik/outposts/management/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/authentik/outposts/management/commands/__init__.py b/authentik/outposts/management/commands/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/authentik/outposts/management/commands/repair_permissions.py b/authentik/outposts/management/commands/repair_permissions.py new file mode 100644 index 000000000..3f220ae37 --- /dev/null +++ b/authentik/outposts/management/commands/repair_permissions.py @@ -0,0 +1,15 @@ +"""Repair missing permissions""" +from django.core.management.base import BaseCommand, no_translations +from django.apps import apps +from django.contrib.auth.management import create_permissions + + +class Command(BaseCommand): # pragma: no cover + """Repair missing permissions""" + + @no_translations + def handle(self, *args, **options): + """Check permissions for all apps""" + for app in apps.get_app_configs(): + self.stdout.write(f"Checking app {app.name} ({app.label})\n") + create_permissions(app, verbosity=0) diff --git a/authentik/outposts/models.py b/authentik/outposts/models.py index 7567b245d..80a17bfea 100644 --- a/authentik/outposts/models.py +++ b/authentik/outposts/models.py @@ -371,7 +371,11 @@ class Outpost(ManagedModel): ) Event.new( action=EventAction.SYSTEM_EXCEPTION, - message=exception_to_string(exc), + message=( + "While setting the permissions for the service-account, a permission " + "was not found: " + "Check https://goauthentik.io/docs/troubleshooting/missing_permission" + ) + exception_to_string(exc), ).set_user(user).save() else: app_label, perm = model_or_perm.split(".") diff --git a/website/docs/troubleshooting/missing_permission.md b/website/docs/troubleshooting/missing_permission.md new file mode 100644 index 000000000..23c2890ba --- /dev/null +++ b/website/docs/troubleshooting/missing_permission.md @@ -0,0 +1,17 @@ +--- +title: Missing Permissions system_exception events +--- + +This error can occur during initial setup, when authentik bootstraps the embedded Outpost, while the database migrations are not finished yet. + +The error should be temporary and not occur after initial installation. + +If it does, you can run the following command to ensure all permissions exist: + +``` +docker-compose run --rm worker repair_permissions +# Or for kubernetes +kubectl exec -it authentik-worker-.... -- ak repair_permissions +``` + +If the error persists after running this command, please open an Issue on [GitHub](https://github.com/goauthentik/authentik/issues/) diff --git a/website/sidebars.js b/website/sidebars.js index 385e85203..5dfa06d75 100644 --- a/website/sidebars.js +++ b/website/sidebars.js @@ -204,6 +204,7 @@ module.exports = { "troubleshooting/emails", "troubleshooting/login", "troubleshooting/image_upload_backup", + "troubleshooting/missing_permission", ], }, ],