АРХ - NODEDC PLATFORM: fix Authentik JWKS signing

infra/authentik/bootstrap-dev.py

@@ -4,6 +4,7 @@ from django.db import transaction
 
 from authentik.common.oauth.constants import SubModes
 from authentik.core.models import Application, Group, User
+from authentik.crypto.models import CertificateKeyPair
 from authentik.flows.models import Flow
 from authentik.policies.models import PolicyBinding
 from authentik.providers.oauth2.models import (
@@ -127,6 +128,13 @@ def default_scope_mappings():
 def ensure_provider(spec, mappings):
     authorization_flow = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
     invalidation_flow = Flow.objects.get(slug="default-provider-invalidation-flow")
+    signing_key = (
+        CertificateKeyPair.objects.filter(name="authentik Self-signed Certificate").first()
+        or CertificateKeyPair.objects.first()
+    )
+
+    if signing_key is None:
+        raise RuntimeError("No Authentik CertificateKeyPair exists for OIDC signing")
 
     provider = OAuth2Provider.objects.filter(name=spec["provider_name"]).first()
     if provider is None:
@@ -146,6 +154,7 @@ def ensure_provider(spec, mappings):
     provider.issuer_mode = IssuerMode.PER_PROVIDER
     provider.authorization_flow = authorization_flow
     provider.invalidation_flow = invalidation_flow
+    provider.signing_key = signing_key
     provider.save()
     provider.property_mappings.set(mappings)
     return provider