many things

authentik/grafana.tf

@@ -1,29 +1,22 @@
-
-resource "random_id" "client_id" {
+resource "random_id" "grafana_client_id" {
   byte_length = 16
 }
-
 resource "authentik_provider_oauth2" "grafana" {
-  name = "Grafana"
-  #  Required. You can use the output of:
-  #     $ openssl rand -hex 16
-  client_id = random_id.client_id.id
-
-  # Optional: will be generated if not provided
-  # client_secret = "my_client_secret"
-
-  authorization_flow = data.authentik_flow.default-provider-authorization-implicit-consent.id
-
-  redirect_uris = [
-    "https://grafana.lab.cowley.tech/login/generic_oauth"
+  name      = "Grafana"
+  client_id = random_id.grafana_client_id.id
+  allowed_redirect_uris = [
+    {
+      matching_mode = "strict",
+      url           = "https://grafana.lab.cowley.tech/login/generic_oauth"
+    }
   ]
-
+  authorization_flow = data.authentik_flow.default-provider-authorization-implicit-consent.id
+  invalidation_flow  = data.authentik_flow.default-invalidation-flow.id
   property_mappings = [
     data.authentik_property_mapping_provider_scope.scope-email.id,
     data.authentik_property_mapping_provider_scope.scope-profile.id,
     data.authentik_property_mapping_provider_scope.scope-openid.id,
   ]
-
   lifecycle {
     ignore_changes = [
       signing_key,
@@ -31,13 +24,11 @@ resource "authentik_provider_oauth2" "grafana" {
     ]
   }
 }
-
 resource "authentik_application" "grafana" {
   name              = "Grafana"
   slug              = "grafana"
   protocol_provider = authentik_provider_oauth2.grafana.id
 }
-
 resource "authentik_group" "grafana_admins" {
   name = "Grafana Admins"
 }