feat(security): deploy OpenCanary honeypot on VLAN 50 with Gotify and Discord alerting

scripts/test_ak_ha_authorize.py

@@ -0,0 +1,39 @@
+import urllib.request
+import urllib.parse
+import ssl
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
+
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
+
+params = {
+    "client_id": "homeassistant-7de44ad1",
+    "redirect_uri": "https://4qwu1vav8er84pjh1r9x7qt1ajwq9siw.ui.nabu.casa/auth/oidc/callback",
+    "response_type": "code",
+    "scope": "openid profile groups",
+    "state": "test_state_123"
+}
+
+url = f"https://authentik.snarfnet.net/application/o/authorize/?{urllib.parse.urlencode(params)}"
+print("Testing Authorize URL:", url)
+
+req = urllib.request.Request(url)
+try:
+    with urllib.request.urlopen(req, timeout=8, context=ctx) as r:
+        print("Status code:", r.getcode())
+        body = r.read().decode('utf-8', errors='ignore')
+        if "Redirect URI Error" in body:
+            print("ERROR: Redirect URI Error still present!")
+        else:
+            print("SUCCESS: Authorize endpoint accepted the redirect_uri!")
+except urllib.error.HTTPError as e:
+    print("HTTP error:", e.code)
+    body = e.read().decode('utf-8', errors='ignore')
+    if "Redirect URI Error" in body:
+        print("ERROR: Redirect URI Error still present!")
+    else:
+        print("Body preview:", body[:300])
+