GLPI 11 encrypts api/app tokens at rest and decrypts before comparing;
the DB ciphertext never authenticates. Document the working
initSession?user_token+app_token recipe, per-user token minting via
GLPIKey, REST account provisioning, and the singlesignon plugin
callback breakage.
https://projects.knownelement.com/issues/947#note-5519
The fallback hardcoded username/password/uri/totp_seed and silently
destroyed live API-key fields on any enroll (bit vpentops 2026-09-09).
Rebuilds the full field set from the item JSON now.
https://projects.knownelement.com/issues/942#note-5514
Each script: full OIDC webflow per app (gitea /user/oauth2/cloudron,
redmine /oauth?oauth_provider=1 GET-form, discourse /auth/oidc with
CSRF + confirm-page token), TOTP from vault seed, session verify.
Ran fleet-wide 2026-09-09: accounts created for all 32 org identities;
gitea tokens + redmine/discourse api keys minted via admin levers and
stored per identity in the vault.
https://projects.knownelement.com/issues/942
- sed kept the URL prefix in the auth-code extraction; the garbage code
was the cause of every invalid_grant on the token exchange
- enrollment now uses the Cloudron 10 profile-scoped routes mined from
the dashboard bundle: POST /api/v1/profile/totp_secret and
POST /api/v1/profile/totp_enable
- seed storage verifies the setfield write and falls back to a full
vault item recreate (smcli setfield 400s on some ciphers)
- prompt=login added to the auth URL for session-switch flows
Verified: 32 COO-org identities enrolled end-to-end (seed in vault +
real TOTP login as each identity). Full detail on the #942 comment.
https://projects.knownelement.com/issues/942
mrcharles