From 7b94d671e40d24b71e34aeb8e0e8d6aa4af27aaf Mon Sep 17 00:00:00 2001
From: Karan Parashar <whyredfire@gmail.com>
Date: Fri, 25 Sep 2026 03:20:54 +0530
Subject: [PATCH] feat(authentik): Log in with Google only

---
 infra/authentik/blueprints.yaml | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/infra/authentik/blueprints.yaml b/infra/authentik/blueprints.yaml
index 6922b48..356b24f 100644
--- a/infra/authentik/blueprints.yaml
+++ b/infra/authentik/blueprints.yaml
@@ -4,18 +4,11 @@ metadata:
   name: authentik-blueprints
   namespace: authentik
 data:
-  # Google is the only way in: its source has no enrollment flow, so a Google
-  # account can only log in when a user with the same email already exists.
   google-login.yaml: |
     version: 1
     metadata:
       name: Google login
     entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: default/flow-default-authentication-flow.yaml
-          required: true
       - model: authentik_blueprints.metaapplyblueprint
         attrs:
           identifiers:
@@ -48,8 +41,29 @@ data:
           provider_type: google
           user_matching_mode: email_link
       - model: authentik_stages_identification.identificationstage
+        id: google-identification
         identifiers:
-          name: default-authentication-identification
+          name: google-identification
         attrs:
           sources:
             - !KeyOf google
+          user_fields: []
+      - model: authentik_flows.flow
+        id: google-flow
+        identifiers:
+          slug: google-login
+        attrs:
+          authentication: require_unauthenticated
+          designation: authentication
+          name: Google login
+          title: Welcome!
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf google-identification
+          target: !KeyOf google-flow
+      - model: authentik_brands.brand
+        identifiers:
+          domain: authentik-default
+        attrs:
+          flow_authentication: !KeyOf google-flow