habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

website: Bump prettier from 3.3.3 to 3.4.1 in /website (#12205)

Browse Source 
* website: Bump prettier from 3.3.3 to 3.4.1 in /website

Bumps [prettier](https://github.com/prettier/prettier) from 3.3.3 to 3.4.1.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.3.3...3.4.1)

---
updated-dependencies:
- dependency-name: prettier
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* update formatting

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* sigh

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* disable flaky test

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
This commit is contained in:
dependabot[bot]
2024-11-27 15:14:19 +01:00
committed by GitHub
parent 6d2072a730
commit 3996bdac33
252 changed files with 22143 additions and 22140 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
website/docs/add-secure-apps/applications/index.md
View File

@ -18,23 +18,23 @@ For information about creating and managing applications, refer to [Manage appli
Applications are displayed to users when:
- The user has access defined via policies (or the application has no policies bound)
- A valid Launch URL is configured/could be guessed, this consists of URLs starting with http:// and https://
- The user has access defined via policies (or the application has no policies bound)
- A valid Launch URL is configured/could be guessed, this consists of URLs starting with http:// and https://
The following options can be configured:
- _Name_: This is the name shown for the application card
- _Launch URL_: The URL that is opened when a user clicks on the application. When left empty, authentik tries to guess it based on the provider
- _Name_: This is the name shown for the application card
- _Launch URL_: The URL that is opened when a user clicks on the application. When left empty, authentik tries to guess it based on the provider
You can use placeholders in the launch url to build them dynamically based on the logged in user. For example, you can set the Launch URL to `https://goauthentik.io/%(username)s`, which will be replaced with the currently logged in user's username.
Only applications whose launch URL starts with `http://` or `https://` or are relative URLs are shown on the users' **My applications** page. This can also be used to hide applications that shouldn't be visible on the **My applications** page but are still accessible by users, by setting the _Launch URL_ to `blank://blank`.
- _Icon (URL)_: Optionally configure an Icon for the application
- _Icon (URL)_: Optionally configure an Icon for the application
If the authentik server does not have a volume mounted under `/media`, you'll get a text input. This accepts absolute URLs. If you've mounted single files into the container, you can reference them using `https://authentik.company/media/my-file.png`.
If there is a mount under `/media` or if [S3 storage](../../sys-mgmt/ops/storage-s3.md) is configured, you'll instead see a field to upload a file.
- _Publisher_: Text shown below the application
- _Description_: Subtext shown on the application card below the publisher
- _Publisher_: Text shown below the application
- _Description_: Subtext shown on the application card below the publisher

4
website/docs/add-secure-apps/applications/manage_apps.md
View File

@ -32,8 +32,8 @@ By default, all users can access applications when no policies are bound.
When multiple policies/groups/users are attached, you can configure the _Policy engine mode_ to either:
- Require users to pass all bindings/be member of all groups (ALL), or
- Require users to pass either binding/be member of either group (ANY)
- Require users to pass all bindings/be member of all groups (ALL), or
- Require users to pass either binding/be member of either group (ANY)
## Hide applications

12
website/docs/add-secure-apps/flows-stages/flow/context/index.md
View File

@ -144,12 +144,12 @@ Set by the [Password stage](../../stages/password/index.md), the [Authenticator
Possible options:
- `password` (Authenticated via the password in authentik's database)
- `token` (Authenticated via API token)
- `ldap` (Authenticated via LDAP bind from an LDAP source)
- `auth_mfa` (Authentication via MFA device without password)
- `auth_webauthn_pwl` (Passwordless authentication via WebAuthn)
- `jwt` ([M2M](../../../providers/oauth2/client_credentials.md) authentication via an existing JWT)
- `password` (Authenticated via the password in authentik's database)
- `token` (Authenticated via API token)
- `ldap` (Authenticated via LDAP bind from an LDAP source)
- `auth_mfa` (Authentication via MFA device without password)
- `auth_webauthn_pwl` (Passwordless authentication via WebAuthn)
- `jwt` ([M2M](../../../providers/oauth2/client_credentials.md) authentication via an existing JWT)
##### `auth_method_args` (dictionary)

6
website/docs/add-secure-apps/flows-stages/flow/executors/headless.md
View File

@ -6,6 +6,6 @@ The headless flow executor is used by clients that don't have access to the web
The following stages are supported:
- [**Identification stage**](../../stages/identification/index.md)
- [**Password stage**](../../stages/password/index.md)
- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.md)
- [**Identification stage**](../../stages/identification/index.md)
- [**Password stage**](../../stages/password/index.md)
- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.md)

20
website/docs/add-secure-apps/flows-stages/flow/executors/sfe.md
View File

@ -8,24 +8,24 @@ A simplified web-based flow executor that authentik automatically uses for older
Currently this flow executor is automatically used for the following browsers:
- Internet Explorer
- Microsoft Edge (up to and including version 18)
- Internet Explorer
- Microsoft Edge (up to and including version 18)
The following stages are supported:
- [**Identification stage**](../../stages/identification/index.md)
- [**Identification stage**](../../stages/identification/index.md)
:::info
Only user identifier and user identifier + password stage configurations are supported; sources and passwordless configurations are not supported.
:::
- [**Password stage**](../../stages/password/index.md)
- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.md)
- [**Password stage**](../../stages/password/index.md)
- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.md)
Compared to the [default flow executor](./if-flow.md), this flow executor does _not_ support the following features:
- Localization
- Theming (Dark / light themes)
- Theming (Custom CSS)
- Stages not listed above
- Flow inspector
- Localization
- Theming (Dark / light themes)
- Theming (Custom CSS)
- Stages not listed above
- Flow inspector

14
website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx
View File

@ -1,13 +1,13 @@
- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.md) stage, which attaches the staged user to the current session.
- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.md) stage, which attaches the staged user to the current session.
- **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required.
- **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required.
- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one.
- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one.
- **Invalidation**: designates a default flow to be used to invalidate a session. Use `default-invalidation-flow` for invalidation from authentik itself, or use `default-provider-invalidation-flow` to invalidate when the session of an application ends. When you use the `default-invalidation-flow` as a global invalidation flow, it should contain a [**User Logout**](../../stages/user_logout.md) stage. When you use the `default-provider-invalidation-flow` (supported with OIDC, SAML, Proxy, and RAC providers), you can configure this default flow to present users log-off options such as "log out of the app but remain logged in to authentik" or "return to the **My Applications** page", or "log out completely". (Alternatively, you can create a custom invalidation flow, with a branded background image.)
- **Invalidation**: designates a default flow to be used to invalidate a session. Use `default-invalidation-flow` for invalidation from authentik itself, or use `default-provider-invalidation-flow` to invalidate when the session of an application ends. When you use the `default-invalidation-flow` as a global invalidation flow, it should contain a [**User Logout**](../../stages/user_logout.md) stage. When you use the `default-provider-invalidation-flow` (supported with OIDC, SAML, Proxy, and RAC providers), you can configure this default flow to present users log-off options such as "log out of the app but remain logged in to authentik" or "return to the **My Applications** page", or "log out completely". (Alternatively, you can create a custom invalidation flow, with a branded background image.)
- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.md). Afterwards, use the [**Prompt**](../../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../../stages/user_write.md) stage to update the password.
- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.md). Afterwards, use the [**Prompt**](../../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../../stages/user_write.md) stage to update the password.
- **Stage configuration**: designates a flow for general setup. This designation doesn't have any constraints in what you can do. For example, by default this designation is used to configure authenticators, like change a password and set up TOTP.
- **Stage configuration**: designates a flow for general setup. This designation doesn't have any constraints in what you can do. For example, by default this designation is used to configure authenticators, like change a password and set up TOTP.
- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../../stages/user_delete.md) stage.
- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../../stages/user_delete.md) stage.

22
website/docs/add-secure-apps/flows-stages/flow/index.md
View File

@ -10,9 +10,9 @@ A flow is a method of describing a sequence of stages. A stage represents a sing
For example a standard login flow would consist of the following stages:
- **Identification stage**: user identifies themselves via a username or email address
- **Password stage**: the user's password is checked against the hash in the database
- **Login stage**: this stage attaches a currently pending user to the current session
- **Identification stage**: user identifies themselves via a username or email address
- **Password stage**: the user's password is checked against the hash in the database
- **Login stage**: this stage attaches a currently pending user to the current session
When these stages are successfully completed, authentik logs in the user.
@ -70,22 +70,22 @@ import Defaultflowlist from "../flow/flow_list/\_defaultflowlist.mdx";
**Behavior settings**:
- **Compatibility mode**: Toggle this option on to increase compatibility with password managers and mobile devices. Password managers like [1Password](https://1password.com/), for example, don't need this setting to be enabled, when accessing the flow from a desktop browser. However accessing the flow from a mobile device might necessitate this setting to be enabled.
- **Compatibility mode**: Toggle this option on to increase compatibility with password managers and mobile devices. Password managers like [1Password](https://1password.com/), for example, don't need this setting to be enabled, when accessing the flow from a desktop browser. However accessing the flow from a mobile device might necessitate this setting to be enabled.
The technical reasons for this settings' existence is due to the JavaScript libraries we're using for the default flow interface. These interfaces are implemented using [Lit](https://lit.dev/), which is a modern web development library. It uses a web standard called ["Shadow DOMs"](https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM), which makes encapsulating styles simpler. Due to differences in Browser APIs, many password managers are not compatible with this technology.
When the compatibility mode is enabled, authentik uses a polyfill which emulates the Shadow DOM APIs without actually using the feature, and instead a traditional DOM is rendered. This increases support for password managers, especially on mobile devices.
- **Denied action**: Configure what happens when access to a flow is denied by a policy. By default, authentik will redirect to a `?next` parameter if set, and otherwise show an error message.
- **Denied action**: Configure what happens when access to a flow is denied by a policy. By default, authentik will redirect to a `?next` parameter if set, and otherwise show an error message.
- `MESSAGE_CONTINUE`: Show a message if no `?next` parameter is set, otherwise redirect.
- `MESSAGE`: Always show error message.
- `CONTINUE`: Always redirect, either to `?next` if set, otherwise to the default interface.
- `MESSAGE_CONTINUE`: Show a message if no `?next` parameter is set, otherwise redirect.
- `MESSAGE`: Always show error message.
- `CONTINUE`: Always redirect, either to `?next` if set, otherwise to the default interface.
- **Policy engine mode**: Configure the flow to succeed in _any_ policy passes, or only if _all_ policies pass.
- **Policy engine mode**: Configure the flow to succeed in _any_ policy passes, or only if _all_ policies pass.
**Appearance Settings**:
- **Layout**: select how the UI displays the flow when it is executed; with stacked elements, content left or right, and sidebar left or right.
- **Layout**: select how the UI displays the flow when it is executed; with stacked elements, content left or right, and sidebar left or right.
- **Background**: optionally, select a background image for the UI presentation of the flow.
- **Background**: optionally, select a background image for the UI presentation of the flow.

4
website/docs/add-secure-apps/flows-stages/flow/inspector.md
View File

@ -35,8 +35,8 @@ Alternatively, a user with the correct permission can launch the inspector by ad
:::info
Troubleshooting:
- If the flow inspector does not launch and a "Bad request" error displays, this is likely either because you selected a flow that is not defined in your instance or the flow has a policy bound directly to it that prevents access, so the inspector won't open because the flow can't run results.
- If the flow inspector launches but is empty, you can refresh the browser or advance the flow to load the inspector. This can occur when a race condition happens (the inspector tries to fetch the data before the flow plan is fully planned and as such the panel just shows blank).
- If the flow inspector does not launch and a "Bad request" error displays, this is likely either because you selected a flow that is not defined in your instance or the flow has a policy bound directly to it that prevents access, so the inspector won't open because the flow can't run results.
- If the flow inspector launches but is empty, you can refresh the browser or advance the flow to load the inspector. This can occur when a race condition happens (the inspector tries to fetch the data before the flow plan is fully planned and as such the panel just shows blank).
:::

4
website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md
View File

@ -24,7 +24,7 @@ The Duo username can be found by navigating to your Duo Admin dashboard and sele
You can call the `/api/v3/stages/authenticator/duo/{stage_uuid}/import_devices/` endpoint ([see here](https://goauthentik.io/api/#post-/stages/authenticator/duo/-stage_uuid-/import_devices/)) using the following parameters:
- `duo_user_id`: The Duo User's ID. This can be found in the Duo Admin Portal, navigating to the user list and clicking on a single user. Their ID is shown in th URL.
- `username`: The authentik user's username to assign the device to.
- `duo_user_id`: The Duo User's ID. This can be found in the Duo Admin Portal, navigating to the user list and clicking on a single user. Their ID is shown in th URL.
- `username`: The authentik user's username to assign the device to.
Additionally, you need to pass `stage_uuid` which is the `authenticator_duo` stage, in which you entered your API credentials.

6
website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.md
View File

@ -41,9 +41,9 @@ For detailed instructions, refer to Google documentation.
3. On the **IAM** page, click **Service Accounts** in the left navigation pane.
4. At the top of the **Service Accounts** page, click **Create Service Account**.
- Under **Service account details** page, define the **Name** and **Description** for the new service account, and then click **Create and Continue**.
- Under **Grant this service account access to project** you do not need to define a role, so click **Continue**.
- Under **Grant users access to project** you do not need to define a role, so click **Done** to complete the creation of the service account.
- Under **Service account details** page, define the **Name** and **Description** for the new service account, and then click **Create and Continue**.
- Under **Grant this service account access to project** you do not need to define a role, so click **Continue**.
- Under **Grant users access to project** you do not need to define a role, so click **Done** to complete the creation of the service account.
### Set credentials for the service account

16
website/docs/add-secure-apps/flows-stages/stages/authenticator_validate/index.md
View File

@ -4,19 +4,19 @@ title: Authenticator validation stage
This stage validates an already configured Authenticator Device. This device has to be configured using any of the other authenticator stages:
- [Duo authenticator stage](../authenticator_duo/index.md)
- [SMS authenticator stage](../authenticator_sms/index.md)
- [Static authenticator stage](../authenticator_static/index.md)
- [TOTP authenticator stage](../authenticator_totp/index.md)
- [WebAuthn authenticator stage](../authenticator_webauthn/index.md)
- [Duo authenticator stage](../authenticator_duo/index.md)
- [SMS authenticator stage](../authenticator_sms/index.md)
- [Static authenticator stage](../authenticator_static/index.md)
- [TOTP authenticator stage](../authenticator_totp/index.md)
- [WebAuthn authenticator stage](../authenticator_webauthn/index.md)
You can select which type of device classes are allowed.
Using the `Not configured action`, you can choose what happens when a user does not have any matching devices.
- Skip: Validation is skipped and the flow continues
- Deny: Access is denied, the flow execution ends
- Configure: This option requires a _Configuration stage_ to be set. The validation stage will be marked as successful, and the configuration stage will be injected into the flow.
- Skip: Validation is skipped and the flow continues
- Deny: Access is denied, the flow execution ends
- Configure: This option requires a _Configuration stage_ to be set. The validation stage will be marked as successful, and the configuration stage will be injected into the flow.
By default, authenticator validation is required every time the flow containing this stage is executed. To only change this behavior, set _Last validation threshold_ to a non-zero value. (Requires authentik 2022.5)
Keep in mind that when using Code-based devices (TOTP, Static and SMS), values lower than `seconds=30` cannot be used, as with the way TOTP devices are saved, there is no exact timestamp.

32
website/docs/add-secure-apps/flows-stages/stages/captcha/index.md
View File

@ -6,9 +6,9 @@ This stage adds a form of verification using [Google's reCAPTCHA](https://www.go
Currently supported implementations:
- [Google reCAPTCHA](#google-recaptcha)
- [hCaptcha](#hcaptcha)
- [Cloudflare Turnstile](#cloudflare-turnstile)
- [Google reCAPTCHA](#google-recaptcha)
- [hCaptcha](#hcaptcha)
- [Cloudflare Turnstile](#cloudflare-turnstile)
## Captcha provider configuration
@ -20,11 +20,11 @@ This stage has two required fields: Public key and private key. These can both b
#### Configuration options
- Interactive: Enabled when using reCAPTCHA v3
- Score minimum threshold: `0.5`
- Score maximum threshold: `1`
- JS URL: `https://www.recaptcha.net/recaptcha/api.js`
- API URL: `https://www.recaptcha.net/recaptcha/api/siteverify`
- Interactive: Enabled when using reCAPTCHA v3
- Score minimum threshold: `0.5`
- Score maximum threshold: `1`
- JS URL: `https://www.recaptcha.net/recaptcha/api.js`
- API URL: `https://www.recaptcha.net/recaptcha/api/siteverify`
### hCaptcha
@ -32,14 +32,14 @@ See https://docs.hcaptcha.com/switch
#### Configuration options
- Interactive: Enabled
- JS URL: `https://js.hcaptcha.com/1/api.js`
- API URL: `https://api.hcaptcha.com/siteverify`
- Interactive: Enabled
- JS URL: `https://js.hcaptcha.com/1/api.js`
- API URL: `https://api.hcaptcha.com/siteverify`
**Score options only apply to hCaptcha Enterprise**
- Score minimum threshold: `0`
- Score maximum threshold: `0.5`
- Score minimum threshold: `0`
- Score maximum threshold: `0.5`
### Cloudflare Turnstile
@ -47,8 +47,8 @@ See https://developers.cloudflare.com/turnstile/get-started/migrating-from-recap
#### Configuration options
- Interactive: Enabled if the Turnstile instance is configured as visible or managed
- JS URL: `https://challenges.cloudflare.com/turnstile/v0/api.js`
- API URL: `https://challenges.cloudflare.com/turnstile/v0/siteverify`
- Interactive: Enabled if the Turnstile instance is configured as visible or managed
- JS URL: `https://challenges.cloudflare.com/turnstile/v0/api.js`
- API URL: `https://challenges.cloudflare.com/turnstile/v0/siteverify`
**Score options do not apply when using with turnstile**

6
website/docs/add-secure-apps/flows-stages/stages/email/index.mdx
View File

@ -81,9 +81,9 @@ If you've add the line and created a file, and can't see if, check the worker lo
Templates are rendered using Django's templating engine. The following variables can be used:
- `url`: The full URL for the user to click on
- `user`: The pending user object.
- `expires`: The timestamp when the token expires.
- `url`: The full URL for the user to click on
- `user`: The pending user object.
- `expires`: The timestamp when the token expires.
<!-- prettier-ignore-start -->

6
website/docs/add-secure-apps/flows-stages/stages/identification/index.md
View File

@ -8,9 +8,9 @@ This stage provides a ready-to-go form for users to identify themselves.
Select which fields the user can use to identify themselves. Multiple fields can be selected. If no fields are selected, only sources will be shown.
- Username
- Email
- UPN
- Username
- Email
- UPN
UPN will attempt to identify the user based on the `upn` attribute, which can be imported with an [LDAP Source](../../../../users-sources/sources/protocols/ldap)

8
website/docs/add-secure-apps/flows-stages/stages/prompt/index.md
View File

@ -35,10 +35,10 @@ The prompt can be any of the following types:
Some types have special behaviors:
- _Username_: Input is validated against other usernames to ensure a unique value is provided.
- _Password_: All prompts with the type password within the same stage are compared and must be equal. If they are not equal, an error is shown
- _Hidden_ and _Static_: Their initial values are defaults and are not user-changeable.
- _Radio Button Group_ and _Dropdown_: Only allow the user to select one of a set of predefined values.
- _Username_: Input is validated against other usernames to ensure a unique value is provided.
- _Password_: All prompts with the type password within the same stage are compared and must be equal. If they are not equal, an error is shown
- _Hidden_ and _Static_: Their initial values are defaults and are not user-changeable.
- _Radio Button Group_ and _Dropdown_: Only allow the user to select one of a set of predefined values.
A prompt has the following attributes:

22
website/docs/add-secure-apps/flows-stages/stages/user_login/index.md
View File

@ -14,7 +14,7 @@ When creating or editing this stage in the UI of the Admin interface, you can se
**Stage-specific settings**
- **Session duration**: By default, the authentik session expires when you close your browser (_seconds=0_).
- **Session duration**: By default, the authentik session expires when you close your browser (_seconds=0_).
:::warning
Different browsers handle session cookies differently, and might not remove them even when the browser is closed. See [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#expiresdate) for more info.
@ -22,21 +22,21 @@ When creating or editing this stage in the UI of the Admin interface, you can se
You can set the session to expire after any duration using the syntax of `hours=1,minutes=2,seconds=3`. The following keys are allowed:
- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks
- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks
All values accept floating-point values.
- **Stay signed in offset**: When this is set to a higher value than the default _seconds=0_, the user logging in is shown a prompt, allowing the user to choose if their session should be extended or not. The same syntax as for _Session duration_ applies.
- **Stay signed in offset**: When this is set to a higher value than the default _seconds=0_, the user logging in is shown a prompt, allowing the user to choose if their session should be extended or not. The same syntax as for _Session duration_ applies.
![](./stay_signed_in.png)
- **Network binding and GeoIP binding**
- **Network binding and GeoIP binding**
When configured, all sessions authenticated by this stage will be bound to the selected network and/or GeoIP criteria.
@ -79,6 +79,6 @@ When creating or editing this stage in the UI of the Admin interface, you can se
}
```
- **Terminate other sessions**
- **Terminate other sessions**
When enabled, previous sessions of the user logging in will be revoked. This has no affect on OAuth refresh tokens.

16
website/docs/add-secure-apps/outposts/index.mdx
View File

@ -6,10 +6,10 @@ An outpost is a single deployment of an authentik component, essentially a servi
An outpost is required if you use any of the following types of providers with your application:
- [LDAP Provider](../providers/ldap/index.md)
- [Proxy Provider](../providers/proxy/index.md)
- [RADIUS Provider](../providers/radius/index.mdx)
- [RAC Provider](../providers/rac/index.md)
- [LDAP Provider](../providers/ldap/index.md)
- [Proxy Provider](../providers/proxy/index.md)
- [RADIUS Provider](../providers/radius/index.mdx)
- [RAC Provider](../providers/rac/index.md)
These types of providers use an outpost for increased flexibility and speed. Instead of the provider logic being implemented in authentik Core, these providers use an outpost to handle the logic, which provides improved performance.
@ -43,15 +43,15 @@ Upon creation, a service account and a token is generated. The service account o
authentik can manage the deployment, updating, and general lifecycle of an outpost. To communicate with the underlying platforms on which the outpost is deployed, authentik has several built-in integrations.
- If you've deployed authentik on Docker Compose, authentik automatically creates an integration for the local docker socket (See [Docker](./integrations/docker.md)).
- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates an integrations for the local Kubernetes Cluster (see [Kubernetes](./integrations/kubernetes.md)).
- If you've deployed authentik on Docker Compose, authentik automatically creates an integration for the local docker socket (See [Docker](./integrations/docker.md)).
- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates an integrations for the local Kubernetes Cluster (see [Kubernetes](./integrations/kubernetes.md)).
To deploy an outpost with these integrations, select them during the creation of an outpost. A background task is started, which creates the container/deployment. The outpost deployment can be monitored from the **Dashboards -> System Tasks** page in the Admin interface.
To deploy an outpost manually, see:
- [Kubernetes](./manual-deploy-kubernetes.md)
- [Docker Compose](./manual-deploy-docker-compose.md)
- [Kubernetes](./manual-deploy-kubernetes.md)
- [Docker Compose](./manual-deploy-docker-compose.md)
### Configuration

48
website/docs/add-secure-apps/outposts/integrations/docker.md
View File

@ -8,37 +8,37 @@ This integration has the advantage over manual deployments of automatic updates
The following outpost settings are used:
- `object_naming_template`: Configures how the container is called
- `container_image`: Optionally overwrites the standard container image (see [Configuration](../../../install-config/configuration/configuration.mdx#authentik_outposts) to configure the global default)
- `docker_network`: The Docker network the container should be added to. This needs to be modified if you plan to connect to authentik using the internal hostname.
- `docker_map_ports`: Enable/disable the mapping of ports. When using a proxy outpost with Traefik for example, you might not want to bind ports as they are routed through Traefik.
- `docker_labels`: Optional additional labels that can be applied to the container.
- `object_naming_template`: Configures how the container is called
- `container_image`: Optionally overwrites the standard container image (see [Configuration](../../../install-config/configuration/configuration.mdx#authentik_outposts) to configure the global default)
- `docker_network`: The Docker network the container should be added to. This needs to be modified if you plan to connect to authentik using the internal hostname.
- `docker_map_ports`: Enable/disable the mapping of ports. When using a proxy outpost with Traefik for example, you might not want to bind ports as they are routed through Traefik.
- `docker_labels`: Optional additional labels that can be applied to the container.
The container is created with the following hardcoded properties:
- Labels
- Labels
- `io.goauthentik.outpost-uuid`: Used by authentik to identify the container, and to allow for name changes.
- `io.goauthentik.outpost-uuid`: Used by authentik to identify the container, and to allow for name changes.
Additionally, the proxy outposts have the following extra labels to add themselves into Traefik automatically.
- `traefik.enable`: "true"
- `traefik.http.routers.ak-outpost-<outpost-name>-router.rule`: `Host(...)`
- `traefik.http.routers.ak-outpost-<outpost-name>-router.service`: `ak-outpost-<outpost-name>-service`
- `traefik.http.routers.ak-outpost-<outpost-name>-router.tls`: "true"
- `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.healthcheck.path`: "/outpost.goauthentik.io/ping"
- `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.healthcheck.port`: "9300"
- `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.server.port`: "9000"
- `traefik.enable`: "true"
- `traefik.http.routers.ak-outpost-<outpost-name>-router.rule`: `Host(...)`
- `traefik.http.routers.ak-outpost-<outpost-name>-router.service`: `ak-outpost-<outpost-name>-service`
- `traefik.http.routers.ak-outpost-<outpost-name>-router.tls`: "true"
- `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.healthcheck.path`: "/outpost.goauthentik.io/ping"
- `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.healthcheck.port`: "9300"
- `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.server.port`: "9000"
## Permissions
To minimise the potential risks of mapping the Docker socket into a container/giving an application access to the Docker API, many people use Projects like [docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy). authentik requires these permissions from the Docker API:
- Images/Pull: authentik tries to pre-pull the custom image if one is configured, otherwise falling back to the default image.
- Containers/Read: Gather infos about currently running container
- Containers/Create: Create new containers
- Containers/Kill: Cleanup during upgrades
- Containers/Remove: Removal of outposts
- Images/Pull: authentik tries to pre-pull the custom image if one is configured, otherwise falling back to the default image.
- Containers/Read: Gather infos about currently running container
- Containers/Create: Create new containers
- Containers/Kill: Cleanup during upgrades
- Containers/Remove: Removal of outposts
## Remote hosts (TLS)
@ -46,8 +46,8 @@ To connect remote hosts, follow this guide from Docker [Use TLS (HTTPS) to prote
Afterwards, create two certificate-keypairs in authentik:
- `Docker CA`, with the contents of `~/.docker/ca.pem` as Certificate
- `Docker Cert`, with the contents of `~/.docker/cert.pem` as the certificate and `~/.docker/key.pem` as the private key.
- `Docker CA`, with the contents of `~/.docker/ca.pem` as Certificate
- `Docker Cert`, with the contents of `~/.docker/cert.pem` as the certificate and `~/.docker/key.pem` as the private key.
Create an integration with `Docker CA` as _TLS Verification Certificate_ and `Docker Cert` as _TLS Authentication Certificate_.
@ -65,9 +65,9 @@ openssl req -x509 -sha256 -nodes -days 365 -out certificate.pem -key authentik
You'll end up with three files:
- `authentik.pub` is the public key, this should be added to the `~/.ssh/authorized_keys` file on the target host and user.
- `authentik` is the private key, which should be imported into a Keypair in authentik.
- `certificate.pem` is the matching certificate for the keypair above.
- `authentik.pub` is the public key, this should be added to the `~/.ssh/authorized_keys` file on the target host and user.
- `authentik` is the private key, which should be imported into a Keypair in authentik.
- `certificate.pem` is the matching certificate for the keypair above.
Modify/create a new Docker integration, and set your _Docker URL_ to `ssh://hostname`, and select the keypair you created above as _TLS Authentication Certificate/SSH Keypair_.

46
website/docs/add-secure-apps/outposts/integrations/kubernetes.md
View File

@ -8,32 +8,32 @@ This integration has the advantage over manual deployments of automatic updates
This integration creates the following objects:
- Deployment for the outpost container
- Service
- Secret to store the token
- Prometheus ServiceMonitor (if the Prometheus Operator is installed in the target cluster)
- Ingress (only Proxy outposts)
- Traefik Middleware (only Proxy outposts with forward auth enabled)
- Deployment for the outpost container
- Service
- Secret to store the token
- Prometheus ServiceMonitor (if the Prometheus Operator is installed in the target cluster)
- Ingress (only Proxy outposts)
- Traefik Middleware (only Proxy outposts with forward auth enabled)
The following outpost settings are used:
- `object_naming_template`: Configures how the container is called
- `container_image`: Optionally overwrites the standard container image (see [Configuration](../../../install-config/configuration/configuration.mdx) to configure the global default)
- `kubernetes_replicas`: Replica count for the deployment of the outpost
- `kubernetes_namespace`: Namespace to deploy in, defaults to the same namespace authentik is deployed in (if available)
- `kubernetes_ingress_annotations`: Any additional annotations to add to the ingress object, for example cert-manager
- `kubernetes_ingress_secret_name`: Name of the secret that is used for TLS connections, can be empty to disable TLS config
- `kubernetes_ingress_class_name`: Optionally set the ingress class used for the generated ingress, requires authentik 2022.11.0
- `kubernetes_service_type`: Service kind created, can be set to LoadBalancer for LDAP outposts for example
- `kubernetes_disabled_components`: Disable any components of the kubernetes integration, can be any of
- 'secret'
- 'deployment'
- 'service'
- 'prometheus servicemonitor'
- 'ingress'
- 'traefik middleware'
- `kubernetes_image_pull_secrets`: If the above docker image is in a private repository, use these secrets to pull. (NOTE: The secret must be created manually in the namespace first.)
- `kubernetes_json_patches`: Applies an RFC 6902 compliant JSON patch to the Kubernetes objects.
- `object_naming_template`: Configures how the container is called
- `container_image`: Optionally overwrites the standard container image (see [Configuration](../../../install-config/configuration/configuration.mdx) to configure the global default)
- `kubernetes_replicas`: Replica count for the deployment of the outpost
- `kubernetes_namespace`: Namespace to deploy in, defaults to the same namespace authentik is deployed in (if available)
- `kubernetes_ingress_annotations`: Any additional annotations to add to the ingress object, for example cert-manager
- `kubernetes_ingress_secret_name`: Name of the secret that is used for TLS connections, can be empty to disable TLS config
- `kubernetes_ingress_class_name`: Optionally set the ingress class used for the generated ingress, requires authentik 2022.11.0
- `kubernetes_service_type`: Service kind created, can be set to LoadBalancer for LDAP outposts for example
- `kubernetes_disabled_components`: Disable any components of the kubernetes integration, can be any of
- 'secret'
- 'deployment'
- 'service'
- 'prometheus servicemonitor'
- 'ingress'
- 'traefik middleware'
- `kubernetes_image_pull_secrets`: If the above docker image is in a private repository, use these secrets to pull. (NOTE: The secret must be created manually in the namespace first.)
- `kubernetes_json_patches`: Applies an RFC 6902 compliant JSON patch to the Kubernetes objects.
## Permissions

14
website/docs/add-secure-apps/providers/entra/add-entra-provider.md
View File

@ -24,15 +24,15 @@ As detailed in the steps below, when you add an Entra ID provider in authentik y
3. Click **Create**, and in the **New provider** modal box select **Microsoft Entra Provider** as the type and click **Next**.
4. Define the following fields:
- **Name**: define a descriptive name, such as "Entra provider".
- **Name**: define a descriptive name, such as "Entra provider".
- **Protocol settings**
- **Protocol settings**
- **Client ID**: enter the Client ID that you [copied from your Entra app](./setup-entra.md).
- **Client Secret**: enter the secret from Entra.
- **Tenant ID**: enter the Tenant ID from Entra.
- **User deletion action**: determines what authentik will do when a user is deleted from the Entra ID system.
- **Group deletion action**: determines what authentik will do when a group is deleted from the Entra ID system.
- **Client ID**: enter the Client ID that you [copied from your Entra app](./setup-entra.md).
- **Client Secret**: enter the secret from Entra.
- **Tenant ID**: enter the Tenant ID from Entra.
- **User deletion action**: determines what authentik will do when a user is deleted from the Entra ID system.
- **Group deletion action**: determines what authentik will do when a group is deleted from the Entra ID system.
**User filtering**

12
website/docs/add-secure-apps/providers/entra/index.md
View File

@ -9,8 +9,8 @@ title: Microsoft Entra ID provider
With the Microsoft Entra ID provider, authentik serves as the single source of truth for all users and groups. Configuring Entra ID as a provider allows for auto-discovery of user and group accounts, on-going synchronization of user data such as email address, name, and status, and integrated data mapping of field names and values.
- For instructions to configure your Entra ID tenant to integrate with authentik, refer to [Configure Entra ID](./setup-entra.md).
- For instructions to add Entra ID as a provider in authentik, refer to [Create a Entra ID provider](./add-entra-provider.md).
- For instructions to configure your Entra ID tenant to integrate with authentik, refer to [Configure Entra ID](./setup-entra.md).
- For instructions to add Entra ID as a provider in authentik, refer to [Create a Entra ID provider](./add-entra-provider.md).
## About using Entra ID with authentik
@ -38,10 +38,10 @@ When a property mapping has an invalid expression, it will cause the sync to sto
There are a couple of considerations in regard to how authentik data is mapped to Entra ID user/group data by default.
- For users, authentik only saves the full display name, not separate first and family names.
- By default, authentik synchs a user’s email, a user’s name, and their active status between Entra ID and authentik. For groups, the name is synced.
- For users, authentik only saves the full display name, not separate first and family names.
- By default, authentik synchs a user’s email, a user’s name, and their active status between Entra ID and authentik. For groups, the name is synced.
Refer to Microsoft documentation for further details.
- https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0&tabs=http#request-body
- https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0&tabs=http#request-body
- https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0&tabs=http#request-body
- https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0&tabs=http#request-body

14
website/docs/add-secure-apps/providers/gws/index.md
View File

@ -9,8 +9,8 @@ title: Google Workspace provider
With the Google Workspace provider, authentik serves as the single source of truth for all users and groups, when using Google products like Gmail.
- For instructions to configure your Google Workspace to integrate with authentik, refer to [Configure Google Workspace](./setup-gws.md).
- For instructions to add Google Workspace as a provider, refer to [Create a Google Workspace provider](./add-gws-provider.md).
- For instructions to configure your Google Workspace to integrate with authentik, refer to [Configure Google Workspace](./setup-gws.md).
- For instructions to add Google Workspace as a provider, refer to [Create a Google Workspace provider](./add-gws-provider.md).
## About using Google Workspace with authentik
@ -38,13 +38,13 @@ When a property mapping has an invalid expression, it will cause the sync to sto
There are a couple of considerations in regard to how authentik data is mapped to google workspace user/group data by default.
- For users, authentik only saves the full display name, while Google requires given/family name separately, and as such authentik attempts to separate the full name automatically with the default User property mapping.
- For users, authentik only saves the full display name, while Google requires given/family name separately, and as such authentik attempts to separate the full name automatically with the default User property mapping.
- For groups, Google groups require an email address. Thus in authentik the provider configuration has an option **Default group email domain**, which will be used in conjunction with the group’s name to generate an email address. This can be customized with a property mapping.
- For groups, Google groups require an email address. Thus in authentik the provider configuration has an option **Default group email domain**, which will be used in conjunction with the group’s name to generate an email address. This can be customized with a property mapping.
- By default, authentik maps a user’s email, a user’s name, and their active status. For groups, the name is synced.
- By default, authentik maps a user’s email, a user’s name, and their active status. For groups, the name is synced.
Refer to Google documentation for further details on which fields data can be mapped to:
- https://developers.google.com/admin-sdk/directory/reference/rest/v1/users#User
- https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups#Group
- https://developers.google.com/admin-sdk/directory/reference/rest/v1/users#User
- https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups#Group

6
website/docs/add-secure-apps/providers/gws/setup-gws.md
View File

@ -36,9 +36,9 @@ For detailed instructions, refer to Google documentation.
3. On the **IAM** page, click **Service Accounts** in the left navigation pane.
4. At the top of the **Service Accounts** page, click **Create Service Account**.
- Under **Service account details** page, define the **Name** and **Description** for the new service account, and then click **Create and Continue**.
- Under **Grant this service account access to project** you do not need to define a role, so click **Continue**.
- Under **Grant users access to project** you do not need to define a role, so click **Done** to complete the creation of the service account.
- Under **Service account details** page, define the **Name** and **Description** for the new service account, and then click **Create and Continue**.
- Under **Grant this service account access to project** you do not need to define a role, so click **Continue**.
- Under **Grant users access to project** you do not need to define a role, so click **Done** to complete the creation of the service account.
### Set credentials for the service account

54
website/docs/add-secure-apps/providers/ldap/index.md
View File

@ -22,30 +22,30 @@ Note: Every LDAP provider needs to have a unique base DN. You can achieve this b
The following fields are currently sent for users:
- `cn`: User's username
- `uid`: Unique user identifier
- `uidNumber`: A unique numeric identifier for the user
- `name`: User's name
- `displayName`: User's name
- `mail`: User's email address
- `objectClass`: A list of these strings:
- "user"
- "organizationalPerson"
- "goauthentik.io/ldap/user"
- `memberOf`: A list of all DNs that the user is a member of
- `homeDirectory`: A default home directory path for the user, by default `/home/$username`. Can be overwritten by setting `homeDirectory` as an attribute on users or groups.
- `ak-active`: "true" if the account is active, otherwise "false"
- `ak-superuser`: "true" if the account is part of a group with superuser permissions, otherwise "false"
- `cn`: User's username
- `uid`: Unique user identifier
- `uidNumber`: A unique numeric identifier for the user
- `name`: User's name
- `displayName`: User's name
- `mail`: User's email address
- `objectClass`: A list of these strings:
- "user"
- "organizationalPerson"
- "goauthentik.io/ldap/user"
- `memberOf`: A list of all DNs that the user is a member of
- `homeDirectory`: A default home directory path for the user, by default `/home/$username`. Can be overwritten by setting `homeDirectory` as an attribute on users or groups.
- `ak-active`: "true" if the account is active, otherwise "false"
- `ak-superuser`: "true" if the account is part of a group with superuser permissions, otherwise "false"
The following fields are current set for groups:
- `cn`: The group's name
- `uid`: Unique group identifier
- `gidNumber`: A unique numeric identifier for the group
- `member`: A list of all DNs of the groups members
- `objectClass`: A list of these strings:
- "group"
- "goauthentik.io/ldap/group"
- `cn`: The group's name
- `uid`: Unique group identifier
- `gidNumber`: A unique numeric identifier for the group
- `member`: A list of all DNs of the groups members
- `objectClass`: A list of these strings:
- "group"
- "goauthentik.io/ldap/group"
A virtual group is also created for each user, they have the same fields as groups but have an additional objectClass: `goauthentik.io/ldap/virtual-group`.
The virtual groups gidNumber is equal to the uidNumber of the user.
@ -78,9 +78,9 @@ All bind modes rely on flows.
The following stages are supported:
- [Identification](../../flows-stages/stages/identification/index.md)
- [Password](../../flows-stages/stages/password/index.md)
- [Authenticator validation](../../flows-stages/stages/authenticator_validate/index.md)
- [Identification](../../flows-stages/stages/identification/index.md)
- [Password](../../flows-stages/stages/password/index.md)
- [Authenticator validation](../../flows-stages/stages/authenticator_validate/index.md)
Note: Authenticator validation currently only supports DUO, TOTP and static authenticators.
@ -90,9 +90,9 @@ The following stages are supported:
SMS-based authenticators are not supported as they require a code to be sent from authentik, which is not possible during the bind.
- [User Logout](../../flows-stages/stages/user_logout.md)
- [User Login](../../flows-stages/stages/user_login/index.md)
- [Deny](../../flows-stages/stages/deny.md)
- [User Logout](../../flows-stages/stages/user_logout.md)
- [User Login](../../flows-stages/stages/user_login/index.md)
- [Deny](../../flows-stages/stages/deny.md)
#### Direct bind

12
website/docs/add-secure-apps/providers/oauth2/device_code.md
View File

@ -25,12 +25,12 @@ scopes=openid email my-other-scope
The response contains the following fields:
- `device_code`: Device code, which is the code kept on the device
- `verification_uri`: The URL to be shown to the enduser to input the code
- `verification_uri_complete`: The same URL as above except the code will be prefilled
- `user_code`: The raw code for the enduser to input
- `expires_in`: The total seconds after which this token will expire
- `interval`: The interval in seconds for how often the device should check the token status
- `device_code`: Device code, which is the code kept on the device
- `verification_uri`: The URL to be shown to the enduser to input the code
- `verification_uri_complete`: The same URL as above except the code will be prefilled
- `user_code`: The raw code for the enduser to input
- `expires_in`: The total seconds after which this token will expire
- `interval`: The interval in seconds for how often the device should check the token status
---

10
website/docs/add-secure-apps/providers/oauth2/index.md
View File

@ -68,14 +68,14 @@ return True
#### GitHub compatibility
- `user`: No-op, is accepted for compatibility but does not give access to any resources
- `read:user`: Same as above
- `user:email`: Allows read-only access to `/user`, including email address
- `read:org`: Allows read-only access to `/user/teams`, listing all the user's groups as teams.
- `user`: No-op, is accepted for compatibility but does not give access to any resources
- `read:user`: Same as above
- `user:email`: Allows read-only access to `/user`, including email address
- `read:org`: Allows read-only access to `/user/teams`, listing all the user's groups as teams.
#### authentik
- `goauthentik.io/api`: This scope grants the refresh token access to the authentik API on behalf of the user
- `goauthentik.io/api`: This scope grants the refresh token access to the authentik API on behalf of the user
## Default scopes <span class="badge badge--version">authentik 2022.7+</span>

4
website/docs/add-secure-apps/providers/property-mappings/expression.mdx
View File

@ -20,5 +20,5 @@ import User from "../../../expressions/_user.md";
<User />
- `request`: The current request. This may be `None` if there is no contextual request. See ([Django documentation](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
- Other arbitrary arguments given by the provider, this is documented on the provider.
- `request`: The current request. This may be `None` if there is no contextual request. See ([Django documentation](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
- Other arbitrary arguments given by the provider, this is documented on the provider.

4
website/docs/add-secure-apps/providers/proxy/custom_headers.md
View File

@ -4,8 +4,8 @@ title: Custom headers
The proxy can send custom headers to your upstream application. These can be configured in one of two ways:
- Group attributes; this allows for inheritance, but only allows static values
- Property mappings; this allows for dynamic values
- Group attributes; this allows for inheritance, but only allows static values
- Property mappings; this allows for dynamic values
## Group attributes

4
website/docs/add-secure-apps/providers/proxy/forward_auth.mdx
View File

@ -26,8 +26,8 @@ In the Proxy Provider, make sure to use the _Forward auth (domain level)_ mode.
This mode differs from the _Forward auth (single application)_ mode in the following points:
- You don't have to configure an application in authentik for each domain
- Users don't have to authorize multiple times
- You don't have to configure an application in authentik for each domain
- Users don't have to authorize multiple times
There are, however, also some downsides, mainly the fact that you **can't** restrict individual applications to different users.

6
website/docs/add-secure-apps/providers/rac/index.md
View File

@ -56,6 +56,6 @@ A new connection is created every time an endpoint is selected in the [User Inte
The following features are currently supported:
- Bi-directional clipboard
- Audio redirection (from remote machine to browser)
- Resizing
- Bi-directional clipboard
- Audio redirection (from remote machine to browser)
- Resizing

12
website/docs/add-secure-apps/providers/radius/index.mdx
View File

@ -18,9 +18,9 @@ Authentication requests against the Radius Server use a flow in the background.
The following stages are supported:
- [Identification](../../flows-stages/stages/identification/index.md)
- [Password](../../flows-stages/stages/password/index.md)
- [Authenticator validation](../../flows-stages/stages/authenticator_validate/index.md)
- [Identification](../../flows-stages/stages/identification/index.md)
- [Password](../../flows-stages/stages/password/index.md)
- [Authenticator validation](../../flows-stages/stages/authenticator_validate/index.md)
Note: Authenticator validation currently only supports DUO, TOTP, and static authenticators.
@ -28,9 +28,9 @@ The following stages are supported:
SMS-based authenticators are not supported because they require a code to be sent from authentik, which is not possible during the bind.
- [User Logout](../../flows-stages/stages/user_logout.md)
- [User Login](../../flows-stages/stages/user_login/index.md)
- [Deny](../../flows-stages/stages/deny.md)
- [User Logout](../../flows-stages/stages/user_logout.md)
- [User Login](../../flows-stages/stages/user_login/index.md)
- [Deny](../../flows-stages/stages/deny.md)
### RADIUS attributes

10
website/docs/add-secure-apps/providers/saml/index.md
View File

@ -22,11 +22,11 @@ The metadata download link can also be copied with a button on the provider over
You can select a custom SAML Property Mapping after which the NameID field will be generated. If left default, the following checks are done:
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`, the NameID will be set to the hashed user ID.
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`, the NameID will be set to the user's `distinguishedName` attribute. This attribute is set by the LDAP source by default. If the attribute does not exist, it will fall back the persistent identifier.
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName`, the NameID will be set to the user's UPN. This is also set by the LDAP source, and also falls back to the persistent identifier.
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`, the NameID will be set based on the user's session ID.
- When the request asks for `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`, the NameID will be set to the user's email address.
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`, the NameID will be set to the hashed user ID.
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`, the NameID will be set to the user's `distinguishedName` attribute. This attribute is set by the LDAP source by default. If the attribute does not exist, it will fall back the persistent identifier.
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName`, the NameID will be set to the user's UPN. This is also set by the LDAP source, and also falls back to the persistent identifier.
- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`, the NameID will be set based on the user's session ID.
- When the request asks for `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`, the NameID will be set to the user's email address.
:::warning
Keep in mind that with the default settings, users are free to change their email addresses. As such it is recommended to use `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`, as this cannot be changed.

6
website/docs/add-secure-apps/providers/scim/index.md
View File

@ -20,8 +20,8 @@ When adding the SCIM provider, you must define the **Backchannel provider using
Data is synchronized in multiple ways:
- When a user/group is created/modified/deleted, that action is sent to all SCIM providers
- Periodically (once an hour), all SCIM providers are fully synchronized
- When a user/group is created/modified/deleted, that action is sent to all SCIM providers
- Periodically (once an hour), all SCIM providers are fully synchronized
The actual synchronization process is run in the authentik worker. To allow this process to better to scale, a task is started for each 100 users and groups, so when multiple workers are available the workload will be distributed.
@ -39,7 +39,7 @@ By default, service accounts are excluded from being synchronized. This can be c
SCIM defines multiple optional features, some of which are supported by the SCIM provider.
- Patch updates
- Patch updates
If the service provider supports patch updates, authentik will use patch requests to add/remove members of groups. For all other updates, such as user updates and other group updates, PUT requests are used.

10
website/docs/core/architecture.md
View File

@ -29,7 +29,7 @@ Similar to [other outposts](../add-secure-apps/outposts/index.mdx), this outpost
#### Persistence
- `/media` is used to store icons and such, but not required, and if not mounted, authentik will allow you to set a URL to icons in place of a file upload
- `/media` is used to store icons and such, but not required, and if not mounted, authentik will allow you to set a URL to icons in place of a file upload
### Background Worker
@ -37,8 +37,8 @@ This container executes background tasks, such as sending emails, the event noti
#### Persistence
- `/certs` is used for authentik to import external certs, which in most cases shouldn't be used for SAML, but rather if you use authentik without a reverse proxy, this can be used for example for the [Let's Encrypt integration](../sys-mgmt/certificates.md#lets-encrypt)
- `/templates` is used for [custom email templates](../add-secure-apps/flows-stages/stages/email/index.mdx#custom-templates), and as with the other ones fully optional
- `/certs` is used for authentik to import external certs, which in most cases shouldn't be used for SAML, but rather if you use authentik without a reverse proxy, this can be used for example for the [Let's Encrypt integration](../sys-mgmt/certificates.md#lets-encrypt)
- `/templates` is used for [custom email templates](../add-secure-apps/flows-stages/stages/email/index.mdx#custom-templates), and as with the other ones fully optional
### PostgreSQL
@ -46,7 +46,7 @@ authentik uses PostgreSQL to store all of its configuration and other data (excl
#### Persistence
- `/var/lib/postgresql/data` is used to store the PostgreSQL database
- `/var/lib/postgresql/data` is used to store the PostgreSQL database
On Kubernetes, with the default Helm chart and using the packaged PostgreSQL sub-chart, persistent data is stored in a PVC.
@ -56,6 +56,6 @@ authentik uses Redis as a message-queue and a cache. Data in Redis is not requir
#### Persistence
- `/data` is used to store the Redis data
- `/data` is used to store the Redis data
On Kubernetes, with the default Helm chart and using the packaged Redis sub-chart, persistent data is stored in a PVC.

10
website/docs/customize/blueprints/index.md
View File

@ -12,13 +12,13 @@ Blueprints offer a new way to template, automate and distribute authentik config
Blueprints are yaml files, whose format is described further in [File structure](./v1/structure). Blueprints can be applied in one of two ways:
- As a Blueprint instance, which is a YAML file mounted into the authentik (worker) container. This file is read and applied regularly (every 60 minutes). Multiple instances can be created for a single blueprint file, and instances can be given context key:value attributes to configure the blueprint.
- As a Blueprint instance, which is a YAML file mounted into the authentik (worker) container. This file is read and applied regularly (every 60 minutes). Multiple instances can be created for a single blueprint file, and instances can be given context key:value attributes to configure the blueprint.
:::info
Starting with authentik 2022.12.1, authentik watches for file modification/creation events in the blueprint directory and will automatically trigger a discovery when a new blueprint file is created, and trigger a blueprint apply when a file is modified.
:::
- As a Flow import, which is a YAML file uploaded via the Browser/API. This file is validated and applied directly after being uploaded, but is not further monitored/applied.
- As a Flow import, which is a YAML file uploaded via the Browser/API. This file is validated and applied directly after being uploaded, but is not further monitored/applied.
Starting with authentik 2022.8, blueprints are used to manage authentik default flows and other system objects. These blueprints can be disabled/replaced with custom blueprints in certain circumstances.
@ -26,9 +26,9 @@ Starting with authentik 2022.8, blueprints are used to manage authentik default
The authentik container by default looks for blueprints in `/blueprints`. Underneath this directory, there are a couple default subdirectories:
- `/blueprints/default`: Default blueprints for default flows, tenants, etc
- `/blueprints/example`: Example blueprints for common configurations and flows
- `/blueprints/system`: System blueprints for authentik managed Property mappings, etc
- `/blueprints/default`: Default blueprints for default flows, tenants, etc
- `/blueprints/example`: Example blueprints for common configurations and flows
- `/blueprints/system`: System blueprints for authentik managed Property mappings, etc
Any additional `.yaml` file in `/blueprints` will be discovered and automatically instantiated, depending on their labels.

4
website/docs/customize/blueprints/v1/meta.md
View File

@ -10,7 +10,7 @@ See [examples](https://github.com/search?q=repo%3Agoauthentik%2Fauthentik+path%3
#### Attributes
- `identifiers`: Key-value attributes used to match the blueprint instance
- `identifiers`: Key-value attributes used to match the blueprint instance
Example:
@ -20,6 +20,6 @@ See [examples](https://github.com/search?q=repo%3Agoauthentik%2Fauthentik+path%3
name: Default - Password change flow
```
- `required`: (Default: `true`) Configure if the blueprint instance must exist
- `required`: (Default: `true`) Configure if the blueprint instance must exist
If this is set to `true` and no blueprint instance matches the query above, an error will be thrown. Otherwise, execution will continue without applying anything extra.

10
website/docs/customize/blueprints/v1/tags.md
View File

@ -166,9 +166,9 @@ This tag takes 3 arguments:
!Enumerate [<iterable>, <output_object_type>, <single_item_yaml>]
```
- **iterable**: Any Python iterable or custom tag that resolves to such iterable
- **output_object_type**: `SEQ` or `MAP`. Controls whether the returned YAML will be a mapping or a sequence.
- **single_item_yaml**: The YAML to use to create a single entry in the output object
- **iterable**: Any Python iterable or custom tag that resolves to such iterable
- **output_object_type**: `SEQ` or `MAP`. Controls whether the returned YAML will be a mapping or a sequence.
- **single_item_yaml**: The YAML to use to create a single entry in the output object
2. `!Index` tag:
@ -182,7 +182,7 @@ This tag takes 1 argument:
!Index <depth>
```
- **depth**: Must be >= 0. A depth of 0 refers to the `!Enumerate` tag this tag is located in. A depth of 1 refers to one `!Enumerate` tag above that (to be used when multiple `!Enumerate` tags are nested inside each other).
- **depth**: Must be >= 0. A depth of 0 refers to the `!Enumerate` tag this tag is located in. A depth of 1 refers to one `!Enumerate` tag above that (to be used when multiple `!Enumerate` tags are nested inside each other).
Accesses the `!Enumerate` tag's iterable and resolves to the index of the item currently being iterated (in case `!Enumerate` is iterating over a sequence), or the mapping key (in case `!Enumerate` is iterating over a mapping).
@ -200,7 +200,7 @@ This tag takes 1 argument:
!Value <depth>
```
- **depth**: Must be >= 0. A depth of 0 refers to the `!Enumerate` tag this tag is located in. A depth of 1 refers to one `!Enumerate` tag above that (to be used when multiple `!Enumerate` tags are nested inside each other).
- **depth**: Must be >= 0. A depth of 0 refers to the `!Enumerate` tag this tag is located in. A depth of 1 refers to one `!Enumerate` tag above that (to be used when multiple `!Enumerate` tags are nested inside each other).
Accesses the `!Enumerate` tag's iterable and resolves to the value of the item currently being iterated.

12
website/docs/customize/brands.md
View File

@ -11,12 +11,12 @@ The main settings that brands influence are flows and branding.
You can explicitly select, in your instance's Brand settings, the default flow to use for the following configurations:
- Authentication flow: the flow used to authenticate users. If left empty, the first applicable flow sorted by the slug is used.
- Invalidation flow: for typical use cases, select the `default-invalidation-flow` (Logout) flow. This flow logs the user out of authentik when the application session ends (user logs out of the app).
- Recovery flow: if set, the user can access an option to recover their login credentials.
- Unenrollment flow: if set, users are able to unenroll themselves using this flow. If no flow is set, option is not shown.
- User settings flow: if set, users are able to configure details of their profile.
- Device code flow: if set, the OAuth Device Code profile can be used, and the selected flow will be used to enter the code.
- Authentication flow: the flow used to authenticate users. If left empty, the first applicable flow sorted by the slug is used.
- Invalidation flow: for typical use cases, select the `default-invalidation-flow` (Logout) flow. This flow logs the user out of authentik when the application session ends (user logs out of the app).
- Recovery flow: if set, the user can access an option to recover their login credentials.
- Unenrollment flow: if set, users are able to unenroll themselves using this flow. If no flow is set, option is not shown.
- User settings flow: if set, users are able to configure details of their profile.
- Device code flow: if set, the OAuth Device Code profile can be used, and the selected flow will be used to enter the code.
If a default flow is _not_ set in the brand, then authentik selects any flow that:

10
website/docs/customize/interfaces/user/customization.mdx
View File

@ -6,23 +6,23 @@ The user interface can be customized through attributes, and will be inherited f
The following features can be enabled/disabled. By default, all of them are enabled:
- `settings.enabledFeatures.apiDrawer`
- `settings.enabledFeatures.apiDrawer`
API Request drawer in navbar
- `settings.enabledFeatures.notificationDrawer`
- `settings.enabledFeatures.notificationDrawer`
Notification drawer in navbar
- `settings.enabledFeatures.settings`
- `settings.enabledFeatures.settings`
Settings link in navbar
- `settings.enabledFeatures.applicationEdit`
- `settings.enabledFeatures.applicationEdit`
Application edit in library (only shown when user is superuser)
- `settings.enabledFeatures.search`
- `settings.enabledFeatures.search`
Search bar

64
website/docs/customize/policies/expression.mdx
View File

@ -52,9 +52,9 @@ import Objects from "../../expressions/_objects.md";
<Objects />
- `request`: A PolicyRequest object, which has the following properties:
- `request`: A PolicyRequest object, which has the following properties:
- `request.user`: The current user, against which the policy is applied. See [User](../../users-sources/user/index.mdx)
- `request.user`: The current user, against which the policy is applied. See [User](../../users-sources/user/index.mdx)
:::caution
When a policy is executed in the context of a flow, this will be set to the user initiaing request, and will only be changed by a `user_login` stage. For that reason, using this value in authentication flow policies may not return the expected user. Use `context['pending_user']` instead; User Identification and other stages update this value during flow execution.
@ -62,42 +62,42 @@ import Objects from "../../expressions/_objects.md";
If the user is not authenticated, this will be set to a user called _AnonymousUser_, which is an instance of [authentik.core.models.User](https://docs.djangoproject.com/en/4.1/ref/contrib/auth/#django.contrib.auth.models.User) (authentik uses django-guardian for per-object permissions, [see](https://django-guardian.readthedocs.io/en/stable/)).
:::
- `request.http_request`: The Django HTTP Request. See [Django documentation](https://docs.djangoproject.com/en/4.1/ref/request-response/#httprequest-objects).
- `request.obj`: A Django Model instance. This is only set if the policy is ran against an object.
- `request.context`: A dictionary with dynamic data. This depends on the origin of the execution.
- `request.http_request`: The Django HTTP Request. See [Django documentation](https://docs.djangoproject.com/en/4.1/ref/request-response/#httprequest-objects).
- `request.obj`: A Django Model instance. This is only set if the policy is ran against an object.
- `request.context`: A dictionary with dynamic data. This depends on the origin of the execution.
- `geoip`: GeoIP dictionary. The following fields are available:
- `geoip`: GeoIP dictionary. The following fields are available:
:::info
For basic country matching, consider using a [GeoIP policy](./index.md#geoip-policy).
:::
- `continent`: a two character continent code like `NA` (North America) or `OC` (Oceania).
- `country`: the two character [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1) alpha code for the country.
- `lat`: the approximate latitude of the location associated with the IP address.
- `long`: the approximate longitude of the location associated with the IP address.
- `city`: the name of the city. May be empty.
- `continent`: a two character continent code like `NA` (North America) or `OC` (Oceania).
- `country`: the two character [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1) alpha code for the country.
- `lat`: the approximate latitude of the location associated with the IP address.
- `long`: the approximate longitude of the location associated with the IP address.
- `city`: the name of the city. May be empty.
```python
return context["geoip"]["continent"] == "EU"
```
- `asn`: ASN dictionary. The following fields are available:
- `asn`: ASN dictionary. The following fields are available:
:::info
For basic ASN matching, consider using a [GeoIP policy](./index.md#geoip-policy).
:::
- `asn`: the autonomous system number associated with the IP address.
- `as_org`: the organization associated with the registered autonomous system number for the IP address.
- `network`: the network associated with the record. In particular, this is the largest network where all of the fields except `ip_address` have the same value.
- `asn`: the autonomous system number associated with the IP address.
- `as_org`: the organization associated with the registered autonomous system number for the IP address.
- `network`: the network associated with the record. In particular, this is the largest network where all of the fields except `ip_address` have the same value.
```python
return context["asn"]["asn"] == 64496
```
- `ak_is_sso_flow`: Boolean which is true if request was initiated by authenticating through an external provider.
- `ak_client_ip`: Client's IP Address or 255.255.255.255 if no IP Address could be extracted. Can be [compared](#comparing-ip-addresses), for example
- `ak_is_sso_flow`: Boolean which is true if request was initiated by authenticating through an external provider.
- `ak_client_ip`: Client's IP Address or 255.255.255.255 if no IP Address could be extracted. Can be [compared](#comparing-ip-addresses), for example
```python
return ak_client_ip in ip_network('10.0.0.0/24')
@ -111,24 +111,24 @@ Additionally, when the policy is executed from a flow, every variable from the f
This includes the following:
- `context['flow_plan']`: The actual flow plan itself, can be used to inject stages.
- `context['flow_plan']`: The actual flow plan itself, can be used to inject stages.
- `context['flow_plan'].context`: The context of the currently active flow, which differs from the policy context. Some fields of flow plan context are passed to the root context, and updated from it, like 'prompt_data', but not every variable
- `context['flow_plan'].context['redirect']`: The URL the user should be redirected to after the flow execution succeeds. (Optional)
- `context['flow_plan'].context`: The context of the currently active flow, which differs from the policy context. Some fields of flow plan context are passed to the root context, and updated from it, like 'prompt_data', but not every variable
- `context['flow_plan'].context['redirect']`: The URL the user should be redirected to after the flow execution succeeds. (Optional)
- `context['prompt_data']`: Data which has been saved from a prompt stage or an external source. (Optional)
- `context['application']`: The application the user is in the process of authorizing. (Optional)
- `context['source']`: The source the user is authenticating/enrolling with. (Optional)
- `context['pending_user']`: The currently pending user, see [User](../../users-sources/user/user_ref.md)
- `context['is_restored']`: Contains the flow token when the flow plan was restored from a link, for example the user clicked a link to a flow which was sent by an email stage. (Optional)
- `context['auth_method']`: Authentication method (this value is set by password stages) (Optional)
- `context['prompt_data']`: Data which has been saved from a prompt stage or an external source. (Optional)
- `context['application']`: The application the user is in the process of authorizing. (Optional)
- `context['source']`: The source the user is authenticating/enrolling with. (Optional)
- `context['pending_user']`: The currently pending user, see [User](../../users-sources/user/user_ref.md)
- `context['is_restored']`: Contains the flow token when the flow plan was restored from a link, for example the user clicked a link to a flow which was sent by an email stage. (Optional)
- `context['auth_method']`: Authentication method (this value is set by password stages) (Optional)
Depending on method, `context['auth_method_args']` is also set.
Can be any of:
- `password`: Standard password login
- `auth_mfa`: MFA login (this method is only set if no password was used)
- `password`: Standard password login
- `auth_mfa`: MFA login (this method is only set if no password was used)
Sets `context['auth_method_args']` to
@ -145,9 +145,9 @@ This includes the following:
}
```
- `auth_webauthn_pwl`: Password-less WebAuthn login
- `jwt`: OAuth Machine-to-machine login via external JWT
- `app_password`: App password (token)
- `auth_webauthn_pwl`: Password-less WebAuthn login
- `jwt`: OAuth Machine-to-machine login via external JWT
- `app_password`: App password (token)
Sets `context['auth_method_args']` to
@ -162,7 +162,7 @@ This includes the following:
}
```
- `ldap`: LDAP bind authentication
- `ldap`: LDAP bind authentication
Sets `context['auth_method_args']` to

14
website/docs/customize/policies/index.md
View File

@ -39,16 +39,16 @@ By default, authentik's Password policy is compliant with [NIST's recommendation
This policy allows you to specify password rules, such as length and required characters.
The following rules can be set:
- Minimum amount of uppercase characters.
- Minimum amount of lowercase characters.
- Minimum amount of symbols characters.
- Minimum length.
- Symbol charset (define which characters are counted as symbols).
- Minimum amount of uppercase characters.
- Minimum amount of lowercase characters.
- Minimum amount of symbols characters.
- Minimum length.
- Symbol charset (define which characters are counted as symbols).
Starting with authentik 2022.11.0, the following checks can also be done with this policy:
- Check the password hash against the database of [Have I Been Pwned](https://haveibeenpwned.com/). Only the first 5 characters of the hashed password are transmitted, the rest is compared in authentik
- Check the password against the password complexity checker [zxcvbn](https://github.com/dropbox/zxcvbn), which detects weak password on various metrics.
- Check the password hash against the database of [Have I Been Pwned](https://haveibeenpwned.com/). Only the first 5 characters of the hashed password are transmitted, the rest is compared in authentik
- Check the password against the password complexity checker [zxcvbn](https://github.com/dropbox/zxcvbn), which detects weak password on various metrics.
### Reputation Policy

12
website/docs/developer-docs/api/websocket.md
View File

@ -33,15 +33,15 @@ Authentication is done via the `Authorization` header, same as the regular API.
All messages have two fields, `instruction` and `args`. Instruction is any number from this list:
- `0`: ACK, simply acknowledges the previous message
- `1`: HELLO, used for monitoring and regularly sent by outposts
- `2`: TRIGGER_UPDATE, sent by authentik to trigger a reload of the configuration
- `0`: ACK, simply acknowledges the previous message
- `1`: HELLO, used for monitoring and regularly sent by outposts
- `2`: TRIGGER_UPDATE, sent by authentik to trigger a reload of the configuration
Arguments for these messages vary, all though these common args are always sent:
- `args['uuid']`: A unique UUID generated on startup of an outpost, used to uniquely identify it.
- `args['uuid']`: A unique UUID generated on startup of an outpost, used to uniquely identify it.
These fields are only sent for HELLO instructions:
- `args['version']`: Version of the outpost
- `args['buildHash']`: Build hash of the outpost, when available
- `args['version']`: Version of the outpost
- `args['buildHash']`: Build hash of the outpost, when available

84
website/docs/developer-docs/docs/style-guide.mdx
View File

@ -10,47 +10,47 @@ If you find any documentation that doesn't match these guidelines, feel free to
## General style guidelines
- Try to order the documentation sections in the order that makes it easiest for the user to follow. That is, order the sections in the same order as the actual workflow used to accomplish the task.
- Try to order the documentation sections in the order that makes it easiest for the user to follow. That is, order the sections in the same order as the actual workflow used to accomplish the task.
- Use headings (sub-titles) to break up long documents, and make it easier to find a specific section.
- Use headings (sub-titles) to break up long documents, and make it easier to find a specific section.
- Add cross-reference links to related content whenever possible.
- Add cross-reference links to related content whenever possible.
- You can use standard [Docusaurus-specific features](https://docusaurus.io/docs/next/markdown-features), which include MDX elements such as tabs and admonitions.
- You can use standard [Docusaurus-specific features](https://docusaurus.io/docs/next/markdown-features), which include MDX elements such as tabs and admonitions.
## Terminology
### authentik names
- The product name authentik should always start with a lower-case "a" and end with a "k". Even if it is the first word in a sentence. :-)
- The product name authentik should always start with a lower-case "a" and end with a "k". Even if it is the first word in a sentence. :-)
- Our company name is Authentik Security, Inc. but in non-legal documentation you can shorten it to Authentik Security.
- Our company name is Authentik Security, Inc. but in non-legal documentation you can shorten it to Authentik Security.
### Industry terms, technology, and other tools
- When referring to external tools, or an industry term or technology, always follow the exact capitalization that the product or company itself uses on their website, in their official documentation, or what the industry uses in consensus.
- When referring to external tools, or an industry term or technology, always follow the exact capitalization that the product or company itself uses on their website, in their official documentation, or what the industry uses in consensus.
- Try to avoid using abbreviations if possible.
- Try to avoid using abbreviations if possible.
- Use acronyms where it makes sense (for commonly used terms like SAML or RBAC). If an acronym is less-known, spell it out in parentheses after the first use.
- Use acronyms where it makes sense (for commonly used terms like SAML or RBAC). If an acronym is less-known, spell it out in parentheses after the first use.
## Writing style
- authentik documentation strives for a friendly, but not overly so, tone. It's ok to be a little bit conversational, and to address the reader in second person: "Next, you need to configure the log in settings."
- authentik documentation strives for a friendly, but not overly so, tone. It's ok to be a little bit conversational, and to address the reader in second person: "Next, you need to configure the log in settings."
- Our documentation uses American English ("z" not "s").
- Our documentation uses American English ("z" not "s").
- Use the present tense and active voice in almost all cases:
- Use the present tense and active voice in almost all cases:
- DON'T: "The Applications page will be loaded."
- DON'T: "The Applications page will be loaded."
- DO: "The Applications page displays."
- DO: "The Applications page displays."
- Phrasing should never blame the user, and should be subjective:
- Phrasing should never blame the user, and should be subjective:
- DON'T: "Never modify the default file."
- DON'T: "Never modify the default file."
- DO: "We recommend that you do not modify the default file, because this can result in unexpected issues."
- DO: "We recommend that you do not modify the default file, because this can result in unexpected issues."
## Formatting
@ -58,37 +58,37 @@ Formatting in documentation is important; it improves comprehension and readabil
### Fonts and font styling
- When referring to UI elements or components in the authentik UI, such as field names, labels, etc., use **bold** text.
- When referring to UI elements or components in the authentik UI, such as field names, labels, etc., use **bold** text.
- When referring to internal components in authentik, like the policy engine, or blueprints, do not use any special formatting. Link to the relevant documentation when possible.
- When referring to internal components in authentik, like the policy engine, or blueprints, do not use any special formatting. Link to the relevant documentation when possible.
- Use `code` format when referring to:
- Use `code` format when referring to:
- commands
- file paths
- file names
- directory names
- code snippets (single line or a block of code)
- commands
- file paths
- file names
- directory names
- code snippets (single line or a block of code)
- For variables or placeholders use _italic_ font for the variable, and use place-holder names that makes it obvious that the user needs to replace it.
- For variables or placeholders use _italic_ font for the variable, and use place-holder names that makes it obvious that the user needs to replace it.
Example: <kbd>https://<em>company-domain</em>/source/oauth/callback/<em>source-slug</em></kbd>
When using variables in code snippets, make sure to specify if the value is something the user needs to define, is system-defined or generated.
- When referring to authentik functionality and features, such as flows, stages, sources, or policies, do not capitalize and do not use bold or italic text. When possible link to the corresponding documentation.
- When referring to authentik functionality and features, such as flows, stages, sources, or policies, do not capitalize and do not use bold or italic text. When possible link to the corresponding documentation.
### Titles and headers
- Both titles and headers (H1, H2, H3) use sentence style capitalization, meaning that only the first word is capitalized. However, if the title or header includes a proper noun (name of a product, etc) then capitalize those words.
Examples:
- Both titles and headers (H1, H2, H3) use sentence style capitalization, meaning that only the first word is capitalized. However, if the title or header includes a proper noun (name of a product, etc) then capitalize those words.
Examples:
- Configure your provider
- Configure the Google Workspace provider
- Configure your provider
- Configure the Google Workspace provider
- Make sure the title/header is descriptive, and tells the reader what that section is about. Try to avoid titles or headers like "Overview". Instead say "About authentik policies".
- Make sure the title/header is descriptive, and tells the reader what that section is about. Try to avoid titles or headers like "Overview". Instead say "About authentik policies".
- Use the imperative verb form (not the gerund form) for procedural topics. For example, use "Configure your instance" instead of "Configuring your instance".
- Use the imperative verb form (not the gerund form) for procedural topics. For example, use "Configure your instance" instead of "Configuring your instance".
### Examples
@ -134,16 +134,16 @@ Write your warning here.
## Word choices
- **May** versus **might** versus **can**
Typically, the word "may" is not used in technical writing, because it implies permission (rather than ability) to do something. Instead use the word "can". Use "might" when the scenario could be different in certain environments. Be sparing with your use of "might"; this word implies unpredictability, not our favorite thing with software.
- **May** versus **might** versus **can**
Typically, the word "may" is not used in technical writing, because it implies permission (rather than ability) to do something. Instead use the word "can". Use "might" when the scenario could be different in certain environments. Be sparing with your use of "might"; this word implies unpredictability, not our favorite thing with software.
- DON'T: "You may use an Expression policy to enforce MFA adherence."
- DON'T: "You may use an Expression policy to enforce MFA adherence."
- DO: "You can use an Expression policy to enforce MFA adherence."
- DO: "You can use an Expression policy to enforce MFA adherence."
- Do: "Values might differ depending on the source of the property mappings.""
- Do: "Values might differ depending on the source of the property mappings.""
- **Login**, **log in**, and **log in to**
As a descriptive term, use one word: "login". (The login panel.)
As a verb, use "log in", with two words. (This stage prompts the user to log in.)
As a verb with the proposition "to", use "log in to". (Log in to the application.)
- **Login**, **log in**, and **log in to**
As a descriptive term, use one word: "login". (The login panel.)
As a verb, use "log in", with two words. (This stage prompts the user to log in.)
As a verb with the proposition "to", use "log in to". (Log in to the application.)

8
website/docs/developer-docs/docs/templates/index.md vendored
View File

@ -6,13 +6,13 @@ In technical documentation, there are document "types" (similar to how there are
The most common types are:
- [**Combo**](./combo.md): For most topics (unless they are very large and complex), we can combine the procedural and conceptual information into a single document. A handy guideline to follow is: "If the actual 1., 2., 3. steps are buried at the bottom, and a reader has to scroll multiple times to find them, then the combo approach is _not_ the right one".
- [**Combo**](./combo.md): For most topics (unless they are very large and complex), we can combine the procedural and conceptual information into a single document. A handy guideline to follow is: "If the actual 1., 2., 3. steps are buried at the bottom, and a reader has to scroll multiple times to find them, then the combo approach is _not_ the right one".
- [**Procedural**](./procedural.md): these are How To docs, the HOW information, with step-by-step instructions for accomplishing a task. This is what most people are looking for when they open the docs... and best practice is to separate the procedural docs from long, lengthy conceptual or reference docs.
- [**Procedural**](./procedural.md): these are How To docs, the HOW information, with step-by-step instructions for accomplishing a task. This is what most people are looking for when they open the docs... and best practice is to separate the procedural docs from long, lengthy conceptual or reference docs.
- [**Conceptual**](./conceptual.md): these docs provide the WHY information, and explain when to use a feature (or when not to!), and general concepts behind the feature or functionality.
- [**Conceptual**](./conceptual.md): these docs provide the WHY information, and explain when to use a feature (or when not to!), and general concepts behind the feature or functionality.
- [**Reference**](./reference.md): this is typically tables or lists of reference information, such as configuration values, or functions, or most commmonly APIs.
- [**Reference**](./reference.md): this is typically tables or lists of reference information, such as configuration values, or functions, or most commmonly APIs.
### Add a new integration

26
website/docs/developer-docs/docs/writing-documentation.md
View File

@ -6,23 +6,23 @@ Writing documentation for authentik is a great way for both new and experienced
Adhering to the following guidelines will help us get your PRs merged much easier and faster, with fewer edits needed.
- Ideally, when you are making contributions to the documentation, you should fork and clone our repo, then [build it locally](#set-up-your-local-build), so that you can test the docs and run the required linting and spell checkers before pushing your PR. While you can do much of the writing and editing within the GitHub UI, you cannot run the required linters from the GitHub UI.
- Ideally, when you are making contributions to the documentation, you should fork and clone our repo, then [build it locally](#set-up-your-local-build), so that you can test the docs and run the required linting and spell checkers before pushing your PR. While you can do much of the writing and editing within the GitHub UI, you cannot run the required linters from the GitHub UI.
- Please refer to our [Style Guide](./style-guide.mdx) for authentik documentation. Here you will learn important guidelines about not capitalizing authentik, how we format our titles and headers, and much more.
- Please refer to our [Style Guide](./style-guide.mdx) for authentik documentation. Here you will learn important guidelines about not capitalizing authentik, how we format our titles and headers, and much more.
- Remember to use our [docs templates](./templates/index.md) when possible; they are already set up to follow our style guidelines, they make it a lot easier for you (no blank page frights!), and keeps the documentation structure and headings consistent.
- Remember to use our [docs templates](./templates/index.md) when possible; they are already set up to follow our style guidelines, they make it a lot easier for you (no blank page frights!), and keeps the documentation structure and headings consistent.
- To test how the documentation renders you can build locally and then use the Netlify Deploy Preview, especially when using Docusaurus-specific features. You can also run the `make website-watch` command on your local build, to see the rendered pages as you make changes.
- To test how the documentation renders you can build locally and then use the Netlify Deploy Preview, especially when using Docusaurus-specific features. You can also run the `make website-watch` command on your local build, to see the rendered pages as you make changes.
- Be sure to run the `make website` command on your local branch, before pushing the PR to the authentik repo. This command does important linting, and the build check in our repo will fail if the linting has not been done.
- Be sure to run the `make website` command on your local branch, before pushing the PR to the authentik repo. This command does important linting, and the build check in our repo will fail if the linting has not been done.
- For new entries, make sure to add any new pages to the appropriate `sidebar.js` file. Otherwise, the new page will not appear in the table of contents to the left.
- For new entries, make sure to add any new pages to the appropriate `sidebar.js` file. Otherwise, the new page will not appear in the table of contents to the left.
## Set up your local build
Requirements:
- Node.js 20 (or greater, we use Node.js 22)
- Node.js 20 (or greater, we use Node.js 22)
The docs and the code are in the same Github repo, at https://github.com/goauthentik/authentik, so if you have cloned the repo, you already have the docs.
@ -32,15 +32,15 @@ The documentation site is situated in the `/website` folder of the repo.
The site is built using npm, below are some useful make commands:
- **Installation**: `make website-install`
- **Installation**: `make website-install`
This command is required before running any of the following commands, and after upgrading any dependencies.
- **Formatting**: `make website`, `make website-lint-fix`, or `npm run prettier`
- **Formatting**: `make website`, `make website-lint-fix`, or `npm run prettier`
Run the appropriate formatting command for your set up before committing, to ensure consistent syntax, clean formatting, and verify links. Note that if the formatting command is not run, the build will fail with an error about linting.
- **Live editing**: `make website-watch`
- **Live editing**: `make website-watch`
For real-time viewing of changes, as you make them.
@ -54,8 +54,8 @@ In addition to following the [Style Guide](./style-guide.mdx) please review the
For new integration documentation, please use the Integrations template in our [Github repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.md`.
- Make sure to add the service to a fitting category in `/website/sidebarsIntegrations.js`. If this is not done the service will not appear in the table of contents to the left.
- Make sure to add the service to a fitting category in `/website/sidebarsIntegrations.js`. If this is not done the service will not appear in the table of contents to the left.
- For placeholder domains, use `authentik.company` and `app-name.company`, where `app-name` is the name of the application that you are writing documentation for.
- For placeholder domains, use `authentik.company` and `app-name.company`, where `app-name` is the name of the application that you are writing documentation for.
- Try to order the documentation sections in an order that makes it easiest for the user to configure.
- Try to order the documentation sections in an order that makes it easiest for the user to configure.

22
website/docs/developer-docs/hackathon/index.md
View File

@ -20,10 +20,10 @@ Prizes? Why, Yes! We've got a total prize pool of $5000 and a bunch of cool auth
July 26-30, 2023
- Kickoff meeting is on Wednesday, July 26th, at 8:00am Pacific USA (UTC -7), 5:00pm in Central Europe (UTC +2), and 8:30pm in Mumbai (UTC +5.30)
- Check-in calls on Thursday and Friday, for one hour, at the same times as above.
- Wrap-up and first demos on Saturday, starting at same times as above.
- Final demos, voting, and awards on Sunday! Yep, same times as above.
- Kickoff meeting is on Wednesday, July 26th, at 8:00am Pacific USA (UTC -7), 5:00pm in Central Europe (UTC +2), and 8:30pm in Mumbai (UTC +5.30)
- Check-in calls on Thursday and Friday, for one hour, at the same times as above.
- Wrap-up and first demos on Saturday, starting at same times as above.
- Final demos, voting, and awards on Sunday! Yep, same times as above.
## Where
@ -35,20 +35,20 @@ If you already know what you and/or your team want to work on, you can open an [
During the Kickoff call, there will be time to peruse existing Issues and add emotes to indicate your interest in working on it (or having it worked on!)
- 🚀 I want to work on this
- ❤️ I want to see this worked on
- 🚀 I want to work on this
- ❤️ I want to see this worked on
## Agenda
- **Wednesday, July 26th**: Kickoff, voting for topics to work on, teams formed, participants select the Issue/team they are going to work on, and get their environment set up. After the online kickoff, you can start your work at any time.
- **Wednesday, July 26th**: Kickoff, voting for topics to work on, teams formed, participants select the Issue/team they are going to work on, and get their environment set up. After the online kickoff, you can start your work at any time.
- **Thursday July 27th**: HackDay #1: participants working on their PRs, a one-hour Check-in call
- **Thursday July 27th**: HackDay #1: participants working on their PRs, a one-hour Check-in call
- **Friday, July 28th**: HackDay #2: participants working on their PRs, a one-hour Check-in call
- **Friday, July 28th**: HackDay #2: participants working on their PRs, a one-hour Check-in call
- **Saturday, July 29th**: an online “meeting” to do wrap-up, participants sign-up for demo slots (Saturday and Sunday slots available), then some demos
- **Saturday, July 29th**: an online “meeting” to do wrap-up, participants sign-up for demo slots (Saturday and Sunday slots available), then some demos
- **Sunday, July 30th**: rest of the demos, votes, and awards
- **Sunday, July 30th**: rest of the demos, votes, and awards
## About that money...

56
website/docs/developer-docs/index.md
View File

@ -22,12 +22,12 @@ Either [create a question on GitHub](https://github.com/goauthentik/authentik/is
authentik consists of a few larger components:
- _authentik_ the actual application server, is described below.
- _outpost-proxy_ is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
- _outpost-ldap_ is a Go LDAP server that uses the _authentik_ application server as its backend
- _outpost-radius_ is a Go RADIUS server that uses the _authentik_ application server as its backend
- _web_ is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
- _website_ is the Website/documentation, which uses docusaurus.
- _authentik_ the actual application server, is described below.
- _outpost-proxy_ is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
- _outpost-ldap_ is a Go LDAP server that uses the _authentik_ application server as its backend
- _outpost-radius_ is a Go RADIUS server that uses the _authentik_ application server as its backend
- _web_ is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
- _website_ is the Website/documentation, which uses docusaurus.
### authentik's structure
@ -128,10 +128,10 @@ Please be sure to refer to our [Style Guide](../developer-docs/docs/style-guide.
The process described here has several goals:
- Maintain authentik's quality
- Fix problems that are important to users
- Engage the community in working toward the best possible authentik
- Enable a sustainable system for authentik's maintainers to review contributions
- Maintain authentik's quality
- Fix problems that are important to users
- Engage the community in working toward the best possible authentik
- Enable a sustainable system for authentik's maintainers to review contributions
Please follow these steps to have your contribution considered by the maintainers:
@ -145,19 +145,19 @@ While the prerequisites above must be satisfied prior to having your pull reques
### PR naming
- Use the format of `<package>: <verb> <description>`
- See [here](#authentiks-structure) for `package`
- Examples:
`providers/saml2: fix parsing of requests`
`website/docs: add config info for GWS`
- Use the format of `<package>: <verb> <description>`
- See [here](#authentiks-structure) for `package`
- Examples:
`providers/saml2: fix parsing of requests`
`website/docs: add config info for GWS`
### Git Commit Messages
- Use the format of `<package>: <verb> <description>`
- See [here](#authentiks-structure) for `package`
- Example: `providers/saml2: fix parsing of requests`
- Reference issues and pull requests liberally after the first line
- Naming of commits within a PR does not need to adhere to the guidelines as we squash merge PRs
- Use the format of `<package>: <verb> <description>`
- See [here](#authentiks-structure) for `package`
- Example: `providers/saml2: fix parsing of requests`
- Reference issues and pull requests liberally after the first line
- Naming of commits within a PR does not need to adhere to the guidelines as we squash merge PRs
### Python Style Guide
@ -165,19 +165,19 @@ All Python code is linted with [black](https://black.readthedocs.io/en/stable/)
authentik runs on Python 3.12 at the time of writing this.
- Use native type-annotations wherever possible.
- Add meaningful docstrings when possible.
- Ensure any database migrations work properly from the last stable version (this is checked via CI)
- If your code changes central functions, make sure nothing else is broken.
- Use native type-annotations wherever possible.
- Add meaningful docstrings when possible.
- Ensure any database migrations work properly from the last stable version (this is checked via CI)
- If your code changes central functions, make sure nothing else is broken.
### Documentation Style Guide
Refer to the full [Style Guide](../developer-docs/docs/style-guide.mdx) for details, but here are some important highlights:
- Our product name is authentik, with a lower-case "a" and a "k" on the end. Our company name is Authentik Security.
- Our product name is authentik, with a lower-case "a" and a "k" on the end. Our company name is Authentik Security.
- We use sentence style case in our titles and headings.
- We use sentence style case in our titles and headings.
- We use **bold** text to name UI components, and _italic_ text for variables.
- We use **bold** text to name UI components, and _italic_ text for variables.
- Use [MDX](https://mdxjs.com/) whenever appropriate. MDX, which uses React components, is useful for creating tabs, action buttons, and advanced content formatting.
- Use [MDX](https://mdxjs.com/) whenever appropriate. MDX, which uses React components, is useful for creating tabs, action buttons, and advanced content formatting.

78
website/docs/developer-docs/releases/index.md
View File

@ -2,55 +2,55 @@
### Creating a standard release
- Ensure a branch exists for the version family (for 2022.12.2 the branch would be `version-2022.12`)
- Merge all the commits that should be released on the version branch
- Ensure a branch exists for the version family (for 2022.12.2 the branch would be `version-2022.12`)
- Merge all the commits that should be released on the version branch
If backporting commits to a non-current version branch, cherry-pick the commits.
- Check if any of the changes merged to the branch make changes to the API schema, and if so update the package `@goauthentik/api` in `/web`
- Push the branch, which will run the CI pipeline to make sure all tests pass
- Create the version subdomain for the version branch ([see](https://github.com/goauthentik/terraform/commit/87792678ed525711be9c8c15dd4b931077dbaac2)) and add the subdomain in Netlify ([here](https://app.netlify.com/sites/authentik/settings/domain))
- Create/update the release notes
- Check if any of the changes merged to the branch make changes to the API schema, and if so update the package `@goauthentik/api` in `/web`
- Push the branch, which will run the CI pipeline to make sure all tests pass
- Create the version subdomain for the version branch ([see](https://github.com/goauthentik/terraform/commit/87792678ed525711be9c8c15dd4b931077dbaac2)) and add the subdomain in Netlify ([here](https://app.netlify.com/sites/authentik/settings/domain))
- Create/update the release notes
#### For initial releases:
- Copy `website/docs/releases/_template.md` to `website/docs/releases/v2022.12.md` and replace `xxxx.x` with the version that is being released
- Copy `website/docs/releases/_template.md` to `website/docs/releases/v2022.12.md` and replace `xxxx.x` with the version that is being released
- Fill in the section of `Breaking changes` and `New features`, or remove the headers if there's nothing applicable
- Fill in the section of `Breaking changes` and `New features`, or remove the headers if there's nothing applicable
- Run `git log --pretty=format:'- %s' version/2022.11.3...version-2022.12`, where `version/2022.11.3` is the tag of the previous stable release. This will output a list of all commits since the previous release.
- Run `git log --pretty=format:'- %s' version/2022.11.3...version-2022.12`, where `version/2022.11.3` is the tag of the previous stable release. This will output a list of all commits since the previous release.
- Paste the list of commits since the previous release under the `Minor changes/fixes` section.
- Paste the list of commits since the previous release under the `Minor changes/fixes` section.
Run `make gen-changelog` and use the contents of `changelog.md`. Remove merged PRs from bumped dependencies unless they fix security issues or are otherwise notable. Remove merged PRs with the `website/` prefix.
- Sort the list of commits alphabetically and remove all commits that have little importance, like dependency updates and linting fixes
- Sort the list of commits alphabetically and remove all commits that have little importance, like dependency updates and linting fixes
- Run `make gen-diff` and copy the contents of `diff.md` under `API Changes`
- Run `make gen-diff` and copy the contents of `diff.md` under `API Changes`
- Update `website/sidebars.js` to include the new release notes, and move the oldest release into the `Previous versions` category.
- Update `website/sidebars.js` to include the new release notes, and move the oldest release into the `Previous versions` category.
If the release notes are created in advance without a fixed date for the release, only add them to the sidebar once the release is published.
- Run `make website`
- Run `make website`
#### For subsequent releases:
- Paste the list of commits since the previous release into `website/docs/releases/v2022.12.md`, creating a new section called `## Fixed in 2022.12.2` underneath the `Minor changes/fixes` section
- Paste the list of commits since the previous release into `website/docs/releases/v2022.12.md`, creating a new section called `## Fixed in 2022.12.2` underneath the `Minor changes/fixes` section
- Run `make gen-changelog` and use the contents of `changelog.md`. Remove merged PRs from bumped dependencies unless they fix security issues or are otherwise notable. Remove merged PRs with the `website/` prefix.
- Run `make gen-changelog` and use the contents of `changelog.md`. Remove merged PRs from bumped dependencies unless they fix security issues or are otherwise notable. Remove merged PRs with the `website/` prefix.
- Run `make gen-diff` and copy the contents of `diff.md` under `API Changes`, replacing the previous changes
- Run `make gen-diff` and copy the contents of `diff.md` under `API Changes`, replacing the previous changes
- Run `make website`
- Run `make website`
- Run `bumpversion` on the version branch with the new version (i.e. `bumpversion --new-version 2022.12.2 minor --verbose`)
- Push the tag and commit
- A GitHub actions workflow will start to run a last test in container images and create a draft release on GitHub
- Edit the draft GitHub release
- Run `bumpversion` on the version branch with the new version (i.e. `bumpversion --new-version 2022.12.2 minor --verbose`)
- Push the tag and commit
- A GitHub actions workflow will start to run a last test in container images and create a draft release on GitHub
- Edit the draft GitHub release
- Make sure the title is formatted `Release 2022.12.0`
- Add the following to the release notes
- Make sure the title is formatted `Release 2022.12.0`
- Add the following to the release notes
```
See https://goauthentik.io/docs/releases/2022.12
@ -62,11 +62,11 @@
See https://goauthentik.io/docs/releases/2022.12#fixed-in-2022121
```
- Auto-generate the full release notes using the GitHub _Generate Release Notes_ feature
- Auto-generate the full release notes using the GitHub _Generate Release Notes_ feature
### Preparing a security release
- Create a draft GitHub Security advisory
- Create a draft GitHub Security advisory
<details>
<summary>Template</summary>
@ -96,14 +96,14 @@ Describe a workaround if possible
If you have any questions or comments about this advisory:
- Email us at [security@goauthentik.io](mailto:security@goauthentik.io).
- Email us at [security@goauthentik.io](mailto:security@goauthentik.io).
```
</details>
- Request a CVE via the draft advisory
- If possible, add the original reporter in the advisory
- Implement a fix on a local branch `security/CVE-...`
- Request a CVE via the draft advisory
- If possible, add the original reporter in the advisory
- Implement a fix on a local branch `security/CVE-...`
The fix must include unit tests to ensure the issue can't happen again in the future
@ -113,9 +113,9 @@ If you have any questions or comments about this advisory:
Include the new file in the `/website/sidebars.js`
- Check with the original reporter that the fix works as intended
- Wait for GitHub to assign a CVE
- Announce the release of the vulnerability via Mailing list and discord
- Check with the original reporter that the fix works as intended
- Wait for GitHub to assign a CVE
- Announce the release of the vulnerability via Mailing list and discord
<details>
<summary>Mailing list template</summary>
@ -139,12 +139,12 @@ We'll be publishing a security Issue (CVE-2022-xxxxx) and accompanying fix on _d
### Creating a security release
- On the date specified in the announcement, push the local `security/CVE-2022-xxxxx` branch into a PR, and squash merge it if the pipeline passes
- If the fix made any changes to the API schema, merge the PR to update the web API client
- Cherry-pick the merge commit onto the version branch
- If the fix made any changes to the API schema, manually install the latest version of the API client in `/web`
- Resume the instructions above, starting with the `bumpversion` step
- After the release has been published, update the Discord announcement and send another mail to the mailing list to point to the new releases
- On the date specified in the announcement, push the local `security/CVE-2022-xxxxx` branch into a PR, and squash merge it if the pipeline passes
- If the fix made any changes to the API schema, merge the PR to update the web API client
- Cherry-pick the merge commit onto the version branch
- If the fix made any changes to the API schema, manually install the latest version of the API client in `/web`
- Resume the instructions above, starting with the `bumpversion` step
- After the release has been published, update the Discord announcement and send another mail to the mailing list to point to the new releases
<details>
<summary>Mailing list template</summary>

6
website/docs/developer-docs/setup/frontend-dev-environment.md
View File

@ -6,9 +6,9 @@ If you want to only make changes on the UI, you don't need a backend running fro
### Prerequisites
- Node.js (any recent version should work; we use 20.x to build)
- Make (again, any recent version should work)
- Docker and Docker Compose
- Node.js (any recent version should work; we use 20.x to build)
- Make (again, any recent version should work)
- Docker and Docker Compose
:::info
Depending on platform, some native dependencies might be required. On macOS, run `brew install node@20`, and for Docker `brew install --cask docker`

12
website/docs/developer-docs/setup/full-dev-environment.md
View File

@ -4,12 +4,12 @@ title: Full development environment
## Requirements
- Python 3.12
- Poetry, which is used to manage dependencies
- Go 1.23 or newer
- Node.js 21 or newer
- PostgreSQL 14 or newer
- Redis (any recent version will do)
- Python 3.12
- Poetry, which is used to manage dependencies
- Go 1.23 or newer
- Node.js 21 or newer
- PostgreSQL 14 or newer
- Redis (any recent version will do)
## Services Setup

4
website/docs/developer-docs/setup/website-dev-environment.md
View File

@ -6,8 +6,8 @@ If you want to only make changes to the website, you only need node.
### Prerequisites
- Node.js (any recent version should work; we use 20.x to build)
- Make (again, any recent version should work)
- Node.js (any recent version should work; we use 20.x to build)
- Make (again, any recent version should work)
:::info
Depending on platform, some native dependencies might be required. On macOS, run `brew install node@20`

6
website/docs/developer-docs/translation.md
View File

@ -18,9 +18,9 @@ To simplify translation you can use https://www.transifex.com/authentik/authenti
### Prerequisites
- Node (any recent version should work, we use 16.x to build)
- Make (again, any recent version should work)
- Docker
- Node (any recent version should work, we use 16.x to build)
- Make (again, any recent version should work)
- Docker
Run `npm i` in the `/web` folder to install all dependencies.

4
website/docs/enterprise/get-started.md
View File

@ -10,8 +10,8 @@ To get started working with Enterprise authentik, [upgrade](../install-config/up
If this is a fresh install, refer to our [technical documentation](../install-config/index.mdx) for instructions to install and configure authentik.
- [Docker Compose installation](../install-config/install/docker-compose.mdx)
- [Kubernetes installation](../install-config/install/kubernetes.md)
- [Docker Compose installation](../install-config/install/docker-compose.mdx)
- [Kubernetes installation](../install-config/install/kubernetes.md)
## Access Enterprise

6
website/docs/enterprise/index.md
View File

@ -6,8 +6,8 @@ The Enterprise release of authentik provides all of the functionality that we ha
Refer to our Enterprise documentation for information about creating and managing your organization, purchasing and activating a license, support, and managing billing and organization members.
- [Get started with Enterprise](./get-started.md)
- [Manage your Enterprise account](./manage-enterprise.md)
- [Support for Enterprise accounts](./entsupport.md)
- [Get started with Enterprise](./get-started.md)
- [Manage your Enterprise account](./manage-enterprise.md)
- [Support for Enterprise accounts](./entsupport.md)
Our standard technical documentation covers how to configure, customize, and use authentik, whether the open source version that we have built our reputation on, or our Enterprise version with dedicated support.

10
website/docs/enterprise/manage-enterprise.md
View File

@ -24,8 +24,8 @@ If you need to delete an organization open a ticket in the Support center.
In the Customer portal you can remove members and invite new members to the organization. When you invite new members, you can specify the role for the new member.
- **Member**: can view licenses, including the license key.
- **Owner**: can do everything the Member role can do, plus: add and remove members, order and renew licenses, and edit the organization.
- **Member**: can view licenses, including the license key.
- **Owner**: can do everything the Member role can do, plus: add and remove members, order and renew licenses, and edit the organization.
1. To manage membership in an organization, log in to the [Customer portal](./get-started.md#access-enterprise).
@ -97,11 +97,11 @@ The **Enterprise -> Licenses** page shows your current licenses' **Cumulative li
The following events occur when a license expires or the internal/external user count is over the licensed user count for the time period below.
- After 2 weeks of the expiry date administrators see a warning banner on the Admin interface
- After 2 weeks of the expiry date administrators see a warning banner on the Admin interface
- After another 2 weeks, users get a warning banner
- After another 2 weeks, users get a warning banner
- After another 2 weeks, the authentik Enterprise instance becomes “read-only”
- After another 2 weeks, the authentik Enterprise instance becomes “read-only”
### About users and licenses

8
website/docs/expressions/_functions.md
View File

@ -76,10 +76,10 @@ Check if a user has any authenticator devices. Only fully validated devices are
Optionally, you can filter a specific device type. The following options are valid:
- `totp`
- `duo`
- `static`
- `webauthn`
- `totp`
- `duo`
- `static`
- `webauthn`
Example:

4
website/docs/expressions/_objects.md
View File

@ -1,4 +1,4 @@
- `ak_logger`: structlog BoundLogger. See ([structlog documentation](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger))
- `ak_logger`: structlog BoundLogger. See ([structlog documentation](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger))
Example:
@ -8,4 +8,4 @@
ak_logger.info("Passing structured data", request=request)
```
- `requests`: requests Session object. See ([request documentation](https://requests.readthedocs.io/en/master/user/advanced/))
- `requests`: requests Session object. See ([request documentation](https://requests.readthedocs.io/en/master/user/advanced/))

2
website/docs/expressions/_user.md
View File

@ -1,4 +1,4 @@
- `user`: The current user. This may be `None` if there is no contextual user. See [User](../users-sources/user/user_ref.md#object-properties).
- `user`: The current user. This may be `None` if there is no contextual user. See [User](../users-sources/user/user_ref.md#object-properties).
Example:

10
website/docs/index.mdx
View File

@ -16,11 +16,11 @@ We offer two versions of authentik: the forever-free open source project upon wh
The authentik product provides the following consoles:
- **Admin interface**: a visual tool for the creation and management of users and groups, tokens and credentials, application integrations, events, and the Flows that define standard and customizable login and authentication processes. Easy-to-read visual dashboards display system status, recent logins and authentication events, and application usage.
- **Admin interface**: a visual tool for the creation and management of users and groups, tokens and credentials, application integrations, events, and the Flows that define standard and customizable login and authentication processes. Easy-to-read visual dashboards display system status, recent logins and authentication events, and application usage.
- **User interface**: this console view in authentik displays all of the applications and integrations in which you have implemented authentik. Click on the app that you want to access to open it, or drill down to edit its configuration in the admin interface.
- **User interface**: this console view in authentik displays all of the applications and integrations in which you have implemented authentik. Click on the app that you want to access to open it, or drill down to edit its configuration in the admin interface.
- **Flows**: [_Flows_](./add-secure-apps/flows-stages/flow/index.md) are the steps by which the various _Stages_ of a login and authentication process occurs. A stage represents a single verification or logic step in the sign-on process. authentik allows for the customization and exact definition of these flows.
- **Flows**: [_Flows_](./add-secure-apps/flows-stages/flow/index.md) are the steps by which the various _Stages_ of a login and authentication process occurs. A stage represents a single verification or logic step in the sign-on process. authentik allows for the customization and exact definition of these flows.
In authentik, you can use Light or Dark mode for the Admin interface, User interface, and the Flow interface.
@ -65,9 +65,9 @@ import useBaseUrl from "@docusaurus/useBaseUrl";
Our tech docs cover the typical topics, from installation to configuration, adding providers, defining policies and creating login flows, event monitoring, security, and attributes. [Enterprise](./enterprise/index.md) version documentation is included here, within our standard tech docs.
- For information about integrating a specific application or software into authentik, refer to our **Integrations** section, accessible from the top menu bar.
- For information about integrating a specific application or software into authentik, refer to our **Integrations** section, accessible from the top menu bar.
- For developer-focused documentation, such as using our APIs and blueprints, setting up your development environment, translations, or how to contribute, refer to the [**Developer**](./developer-docs/index.md) area, accessible from the top menu bar.
- For developer-focused documentation, such as using our APIs and blueprints, setting up your development environment, translations, or how to contribute, refer to the [**Developer**](./developer-docs/index.md) area, accessible from the top menu bar.
## Installation

14
website/docs/install-config/air-gapped.mdx
View File

@ -6,10 +6,10 @@ title: Air-gapped environments
By default, authentik creates outbound connections to the following URLs:
- https://version.goauthentik.io: Periodic update check
- https://goauthentik.io: Anonymous analytics on startup
- https://secure.gravatar.com: Avatars for users
- https://authentik.error-reporting.a7k.io: Error reporting
- https://version.goauthentik.io: Periodic update check
- https://goauthentik.io: Anonymous analytics on startup
- https://secure.gravatar.com: Avatars for users
- https://authentik.error-reporting.a7k.io: Error reporting
To disable these outbound connections, adjust the settings as follows:
@ -58,11 +58,11 @@ Afterwards, run the upgrade commands from the latest release notes.
In addition to the configuration options above, the following [System settings](../sys-mgmt/settings.md) need to also be adjusted:
- **Avatars**: By default this setting uses [Gravatar](https://secure.gravatar.com/). The option can be set to a combination of any of the other options, for example `initials`
- **Avatars**: By default this setting uses [Gravatar](https://secure.gravatar.com/). The option can be set to a combination of any of the other options, for example `initials`
## Container images
Container images can be pulled from the following URLs:
- ghcr.io/goauthentik/server (https://ghcr.io)
- beryju/authentik (https://index.docker.io)
- ghcr.io/goauthentik/server (https://ghcr.io)
- beryju/authentik (https://index.docker.io)

156
website/docs/install-config/configuration/configuration.mdx
View File

@ -12,8 +12,8 @@ The double-underscores are intentional, as all these settings are translated to
All of these variables can be set to values, but you can also use a URI-like format to load values from other places:
- `env://<name>` Loads the value from the environment variable `<name>`. Fallback can be optionally set like `env://<name>?<default>`
- `file://<name>` Loads the value from the file `<name>`. Fallback can be optionally set like `file://<name>?<default>`
- `env://<name>` Loads the value from the environment variable `<name>`. Fallback can be optionally set like `env://<name>?<default>`
- `file://<name>` Loads the value from the file `<name>`. Fallback can be optionally set like `file://<name>?<default>`
## Set your environment variables
@ -65,17 +65,17 @@ To check if your config has been applied correctly, you can run the following co
## PostgreSQL Settings
- `AUTHENTIK_POSTGRESQL__HOST`: Hostname of your PostgreSQL Server
- `AUTHENTIK_POSTGRESQL__NAME`: Database name
- `AUTHENTIK_POSTGRESQL__USER`: Database user
- `AUTHENTIK_POSTGRESQL__PORT`: Database port, defaults to 5432
- `AUTHENTIK_POSTGRESQL__PASSWORD`: Database password, defaults to the environment variable `POSTGRES_PASSWORD`
- `AUTHENTIK_POSTGRESQL__USE_PGBOUNCER`: Adjust configuration to support connection to PgBouncer
- `AUTHENTIK_POSTGRESQL__USE_PGPOOL`: Adjust configuration to support connection to Pgpool
- `AUTHENTIK_POSTGRESQL__SSLMODE`: Strictness of ssl verification. Defaults to `"verify-ca"`
- `AUTHENTIK_POSTGRESQL__SSLROOTCERT`: CA root for server ssl verification
- `AUTHENTIK_POSTGRESQL__SSLCERT`: Path to x509 client certificate to authenticate to server
- `AUTHENTIK_POSTGRESQL__SSLKEY`: Path to private key of `SSLCERT` certificate
- `AUTHENTIK_POSTGRESQL__HOST`: Hostname of your PostgreSQL Server
- `AUTHENTIK_POSTGRESQL__NAME`: Database name
- `AUTHENTIK_POSTGRESQL__USER`: Database user
- `AUTHENTIK_POSTGRESQL__PORT`: Database port, defaults to 5432
- `AUTHENTIK_POSTGRESQL__PASSWORD`: Database password, defaults to the environment variable `POSTGRES_PASSWORD`
- `AUTHENTIK_POSTGRESQL__USE_PGBOUNCER`: Adjust configuration to support connection to PgBouncer
- `AUTHENTIK_POSTGRESQL__USE_PGPOOL`: Adjust configuration to support connection to Pgpool
- `AUTHENTIK_POSTGRESQL__SSLMODE`: Strictness of ssl verification. Defaults to `"verify-ca"`
- `AUTHENTIK_POSTGRESQL__SSLROOTCERT`: CA root for server ssl verification
- `AUTHENTIK_POSTGRESQL__SSLCERT`: Path to x509 client certificate to authenticate to server
- `AUTHENTIK_POSTGRESQL__SSLKEY`: Path to private key of `SSLCERT` certificate
All PostgreSQL settings, apart from `USE_PGBOUNCER` and `USE_PGPOOL`, support hot-reloading. Adding and removing read replicas doesn't support hot-reloading.
@ -87,40 +87,40 @@ If read replicas are configured, the main database is not used for reads. If you
The same PostgreSQL settings as described above are used for each read replica.
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__HOST`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__NAME`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__USER`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PORT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PASSWORD`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLMODE`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLROOTCERT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLCERT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLKEY`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__HOST`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__NAME`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__USER`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PORT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PASSWORD`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLMODE`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLROOTCERT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLCERT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLKEY`
Note that `USE_PGBOUNCER` and `USE_PGPOOL` are inherited from the main database configuration and are _not_ overridable on read replicas.
## Redis Settings
- `AUTHENTIK_REDIS__HOST`: Redis server host when not using configuration URL
- `AUTHENTIK_REDIS__PORT`: Redis server port when not using configuration URL
- `AUTHENTIK_REDIS__DB`: Redis server database when not using configuration URL
- `AUTHENTIK_REDIS__USERNAME`: Redis server username when not using configuration URL
- `AUTHENTIK_REDIS__PASSWORD`: Redis server password when not using configuration URL
- `AUTHENTIK_REDIS__TLS`: Redis server connection using TLS when not using configuration URL
- `AUTHENTIK_REDIS__TLS_REQS`: Redis server TLS connection requirements when not using configuration URL. Defaults to `"none"`. Allowed values are `"none"` and `"required"`.
- `AUTHENTIK_REDIS__TLS_CA_CERT`: Path to the Redis server TLS CA root when not using configuration URL. Defaults to `null`.
- `AUTHENTIK_REDIS__HOST`: Redis server host when not using configuration URL
- `AUTHENTIK_REDIS__PORT`: Redis server port when not using configuration URL
- `AUTHENTIK_REDIS__DB`: Redis server database when not using configuration URL
- `AUTHENTIK_REDIS__USERNAME`: Redis server username when not using configuration URL
- `AUTHENTIK_REDIS__PASSWORD`: Redis server password when not using configuration URL
- `AUTHENTIK_REDIS__TLS`: Redis server connection using TLS when not using configuration URL
- `AUTHENTIK_REDIS__TLS_REQS`: Redis server TLS connection requirements when not using configuration URL. Defaults to `"none"`. Allowed values are `"none"` and `"required"`.
- `AUTHENTIK_REDIS__TLS_CA_CERT`: Path to the Redis server TLS CA root when not using configuration URL. Defaults to `null`.
## Result Backend Settings
- `AUTHENTIK_RESULT_BACKEND__URL`: Result backend configuration URL, uses [the Redis Settings](#redis-settings) by default
- `AUTHENTIK_RESULT_BACKEND__URL`: Result backend configuration URL, uses [the Redis Settings](#redis-settings) by default
## Cache Settings
- `AUTHENTIK_CACHE__URL`: Cache configuration URL, uses [the Redis Settings](#redis-settings) by default
- `AUTHENTIK_CACHE__TIMEOUT`: Timeout for cached data until it expires in seconds, defaults to 300
- `AUTHENTIK_CACHE__TIMEOUT_FLOWS`: Timeout for cached flow plans until they expire in seconds, defaults to 300
- `AUTHENTIK_CACHE__TIMEOUT_POLICIES`: Timeout for cached policies until they expire in seconds, defaults to 300
- `AUTHENTIK_CACHE__TIMEOUT_REPUTATION`: Timeout for cached reputation until they expire in seconds, defaults to 300
- `AUTHENTIK_CACHE__URL`: Cache configuration URL, uses [the Redis Settings](#redis-settings) by default
- `AUTHENTIK_CACHE__TIMEOUT`: Timeout for cached data until it expires in seconds, defaults to 300
- `AUTHENTIK_CACHE__TIMEOUT_FLOWS`: Timeout for cached flow plans until they expire in seconds, defaults to 300
- `AUTHENTIK_CACHE__TIMEOUT_POLICIES`: Timeout for cached policies until they expire in seconds, defaults to 300
- `AUTHENTIK_CACHE__TIMEOUT_REPUTATION`: Timeout for cached reputation until they expire in seconds, defaults to 300
:::info
`AUTHENTIK_CACHE__TIMEOUT_REPUTATION` only applies to the cache expiry, see [`AUTHENTIK_REPUTATION__EXPIRY`](#authentik_reputation__expiry-authentik-202382) to control how long reputation is persisted for.
@ -128,12 +128,12 @@ Note that `USE_PGBOUNCER` and `USE_PGPOOL` are inherited from the main database
## Channel Layer Settings (inter-instance communication)
- `AUTHENTIK_CHANNEL__URL`: Channel layers configuration URL, uses [the Redis Settings](#redis-settings) by default
- `AUTHENTIK_CHANNEL__URL`: Channel layers configuration URL, uses [the Redis Settings](#redis-settings) by default
## Broker Settings
- `AUTHENTIK_BROKER__URL`: Broker configuration URL, defaults to Redis using [the respective settings](#redis-settings)
- `AUTHENTIK_BROKER__TRANSPORT_OPTIONS`: Base64-encoded broker transport options
- `AUTHENTIK_BROKER__URL`: Broker configuration URL, defaults to Redis using [the respective settings](#redis-settings)
- `AUTHENTIK_BROKER__TRANSPORT_OPTIONS`: Base64-encoded broker transport options
:::info
`AUTHENTIK_REDIS__CACHE_TIMEOUT_REPUTATION` only applies to the cache expiry, see [`AUTHENTIK_REPUTATION__EXPIRY`](#authentik_reputation__expiry-authentik-202382) to control how long reputation is persisted for.
@ -141,13 +141,13 @@ Note that `USE_PGBOUNCER` and `USE_PGPOOL` are inherited from the main database
## Listen Settings
- `AUTHENTIK_LISTEN__HTTP`: Listening address:port (e.g. `0.0.0.0:9000`) for HTTP (Applies to Server and Proxy outpost)
- `AUTHENTIK_LISTEN__HTTPS`: Listening address:port (e.g. `0.0.0.0:9443`) for HTTPS (Applies to Server and Proxy outpost)
- `AUTHENTIK_LISTEN__LDAP`: Listening address:port (e.g. `0.0.0.0:3389`) for LDAP (Applies to LDAP outpost)
- `AUTHENTIK_LISTEN__LDAPS`: Listening address:port (e.g. `0.0.0.0:6636`) for LDAPS (Applies to LDAP outpost)
- `AUTHENTIK_LISTEN__METRICS`: Listening address:port (e.g. `0.0.0.0:9300`) for Prometheus metrics (Applies to All)
- `AUTHENTIK_LISTEN__DEBUG`: Listening address:port (e.g. `0.0.0.0:9900`) for Go Debugging metrics (Applies to All)
- `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`: List of comma-separated CIDRs that proxy headers should be accepted from (Applies to Server)
- `AUTHENTIK_LISTEN__HTTP`: Listening address:port (e.g. `0.0.0.0:9000`) for HTTP (Applies to Server and Proxy outpost)
- `AUTHENTIK_LISTEN__HTTPS`: Listening address:port (e.g. `0.0.0.0:9443`) for HTTPS (Applies to Server and Proxy outpost)
- `AUTHENTIK_LISTEN__LDAP`: Listening address:port (e.g. `0.0.0.0:3389`) for LDAP (Applies to LDAP outpost)
- `AUTHENTIK_LISTEN__LDAPS`: Listening address:port (e.g. `0.0.0.0:6636`) for LDAPS (Applies to LDAP outpost)
- `AUTHENTIK_LISTEN__METRICS`: Listening address:port (e.g. `0.0.0.0:9300`) for Prometheus metrics (Applies to All)
- `AUTHENTIK_LISTEN__DEBUG`: Listening address:port (e.g. `0.0.0.0:9900`) for Go Debugging metrics (Applies to All)
- `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`: List of comma-separated CIDRs that proxy headers should be accepted from (Applies to Server)
Defaults to `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `fe80::/10`, `::1/128`.
@ -157,17 +157,17 @@ Note that `USE_PGBOUNCER` and `USE_PGPOOL` are inherited from the main database
These settings affect where media files are stored. Those files include applications and sources icons. By default, they are stored on disk in the `/media` directory of the authentik container. S3 storage is also supported.
- `AUTHENTIK_STORAGE__MEDIA__BACKEND`: Where to store files. Valid values are `file` and `s3`. For `file` storage, files are stored in a `/media` directory in the container. For `s3`, see below.
- `AUTHENTIK_STORAGE__MEDIA__S3__REGION`: S3 region where the bucket has been created. May be omitted depending on which S3 provider you use. No default.
- `AUTHENTIK_STORAGE__MEDIA__S3__USE_SSL`: Whether to use HTTPS when talking to the S3 storage providers. Defaults to `true`.
- `AUTHENTIK_STORAGE__MEDIA__S3__ENDPOINT`: Endpoint to use to talk to the S3 storage provider. Override the previous region and use_ssl settings. Must be a valid URL in the form of `https://s3.provider`. No default.
- `AUTHENTIK_STORAGE__MEDIA__S3__SESSION_PROFILE`: Profile to use when using AWS SDK authentication. No default. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__ACCESS_KEY`: Access key to authenticate to S3. May be omitted if using AWS SDK authentication. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__SECRET_KEY`: Secret key to authenticate to S3. May be omitted if using AWS SDK authentication. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__SECURITY_TOKEN`: Security token to authenticate to S3. May be omitted. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__BUCKET_NAME`: Name of the bucket to use to store files.
- `AUTHENTIK_STORAGE__MEDIA__S3__CUSTOM_DOMAIN`: Domain to use to create URLs for users. Mainly useful for non-AWS providers. May include a port. Must include the bucket. Example: `s3.company:8080/authentik-media`.
- `AUTHENTIK_STORAGE__MEDIA__S3__SECURE_URLS`: Whether URLs created use HTTPS (set to `true` by default) or HTTP.
- `AUTHENTIK_STORAGE__MEDIA__BACKEND`: Where to store files. Valid values are `file` and `s3`. For `file` storage, files are stored in a `/media` directory in the container. For `s3`, see below.
- `AUTHENTIK_STORAGE__MEDIA__S3__REGION`: S3 region where the bucket has been created. May be omitted depending on which S3 provider you use. No default.
- `AUTHENTIK_STORAGE__MEDIA__S3__USE_SSL`: Whether to use HTTPS when talking to the S3 storage providers. Defaults to `true`.
- `AUTHENTIK_STORAGE__MEDIA__S3__ENDPOINT`: Endpoint to use to talk to the S3 storage provider. Override the previous region and use_ssl settings. Must be a valid URL in the form of `https://s3.provider`. No default.
- `AUTHENTIK_STORAGE__MEDIA__S3__SESSION_PROFILE`: Profile to use when using AWS SDK authentication. No default. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__ACCESS_KEY`: Access key to authenticate to S3. May be omitted if using AWS SDK authentication. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__SECRET_KEY`: Secret key to authenticate to S3. May be omitted if using AWS SDK authentication. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__SECURITY_TOKEN`: Security token to authenticate to S3. May be omitted. Supports hot-reloading.
- `AUTHENTIK_STORAGE__MEDIA__S3__BUCKET_NAME`: Name of the bucket to use to store files.
- `AUTHENTIK_STORAGE__MEDIA__S3__CUSTOM_DOMAIN`: Domain to use to create URLs for users. Mainly useful for non-AWS providers. May include a port. Must include the bucket. Example: `s3.company:8080/authentik-media`.
- `AUTHENTIK_STORAGE__MEDIA__S3__SECURE_URLS`: Whether URLs created use HTTPS (set to `true` by default) or HTTP.
## authentik Settings
@ -211,13 +211,13 @@ Disable the inbuilt update-checker. Defaults to `false`.
### `AUTHENTIK_ERROR_REPORTING`
- `AUTHENTIK_ERROR_REPORTING__ENABLED`
- `AUTHENTIK_ERROR_REPORTING__ENABLED`
Enable error reporting. Defaults to `false`.
Error reports are sent to https://sentry.io and are used for debugging and general feedback. Anonymous performance data is also sent.
- `AUTHENTIK_ERROR_REPORTING__SENTRY_DSN`
- `AUTHENTIK_ERROR_REPORTING__SENTRY_DSN`
Sets the DSN for the Sentry API endpoint.
@ -225,51 +225,51 @@ Disable the inbuilt update-checker. Defaults to `false`.
Users can create their own hosted Sentry account (or self-host Sentry) and opt to collect this data themselves.
- `AUTHENTIK_ERROR_REPORTING__ENVIRONMENT`
- `AUTHENTIK_ERROR_REPORTING__ENVIRONMENT`
The environment tag associated with all data sent to Sentry. Defaults to `customer`.
When error reporting has been enabled to aid in debugging issues, this should be set to a unique value, such as an email address.
- `AUTHENTIK_ERROR_REPORTING__SEND_PII`
- `AUTHENTIK_ERROR_REPORTING__SEND_PII`
Whether or not to send personal data, like usernames. Defaults to `false`.
- `AUTHENTIK_ERROR_REPORTING__EXTRA_ARGS`
- `AUTHENTIK_ERROR_REPORTING__EXTRA_ARGS`
Base64-encoded sentry_init arguments. See [Sentry's documentation](https://docs.sentry.io/platforms/python/configuration/options/) for available options.
### `AUTHENTIK_EMAIL`
- `AUTHENTIK_EMAIL__HOST`
- `AUTHENTIK_EMAIL__HOST`
Default: `localhost`
- `AUTHENTIK_EMAIL__PORT`
- `AUTHENTIK_EMAIL__PORT`
Default: `25`
- `AUTHENTIK_EMAIL__USERNAME`
- `AUTHENTIK_EMAIL__USERNAME`
Default: `` (Don't add quotation marks)
- `AUTHENTIK_EMAIL__PASSWORD`
- `AUTHENTIK_EMAIL__PASSWORD`
Default: `` (Don't add quotation marks)
- `AUTHENTIK_EMAIL__USE_TLS`
- `AUTHENTIK_EMAIL__USE_TLS`
Default: `false`
- `AUTHENTIK_EMAIL__USE_SSL`
- `AUTHENTIK_EMAIL__USE_SSL`
Default: `false`
- `AUTHENTIK_EMAIL__TIMEOUT`
- `AUTHENTIK_EMAIL__TIMEOUT`
Default: `10`
- `AUTHENTIK_EMAIL__FROM`
- `AUTHENTIK_EMAIL__FROM`
Default: `authentik@localhost`
@ -279,25 +279,25 @@ Disable the inbuilt update-checker. Defaults to `false`.
### `AUTHENTIK_OUTPOSTS`
- `AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE`
- `AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE`
Placeholders:
- `%(type)s`: Outpost type; proxy, ldap, etc
- `%(version)s`: Current version; 2021.4.1
- `%(build_hash)s`: Build hash if you're running a beta version
- `%(type)s`: Outpost type; proxy, ldap, etc
- `%(version)s`: Current version; 2021.4.1
- `%(build_hash)s`: Build hash if you're running a beta version
Placeholder for outpost docker images. Default: `ghcr.io/goauthentik/%(type)s:%(version)s`.
- `AUTHENTIK_OUTPOSTS__DISCOVER`
- `AUTHENTIK_OUTPOSTS__DISCOVER`
Configure the automatic discovery of integrations. Defaults to `true`.
By default, the following is discovered:
- Kubernetes in-cluster config
- Kubeconfig
- Existence of a docker socket
- Kubernetes in-cluster config
- Kubeconfig
- Existence of a docker socket
### `AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS` <span class="badge badge--version">authentik 2023.1+</span>

6
website/docs/install-config/install/docker-compose.mdx
View File

@ -6,9 +6,9 @@ This installation method is for test setups and small-scale production setups.
## Requirements
- A host with at least 2 CPU cores and 2 GB of RAM
- Docker
- Docker Compose (Compose v2 is recommended, see [here](https://docs.docker.com/compose/migrate/) for instructions on how to upgrade)
- A host with at least 2 CPU cores and 2 GB of RAM
- Docker
- Docker Compose (Compose v2 is recommended, see [here](https://docs.docker.com/compose/migrate/) for instructions on how to upgrade)
## Video

4
website/docs/install-config/install/kubernetes.md
View File

@ -10,8 +10,8 @@ You can also [view a video walk-through](https://www.youtube.com/watch?v=O1qUbrk
### Requirements
- Kubernetes
- Helm
- Kubernetes
- Helm
## Video

8
website/docs/install-config/reverse-proxy.md
View File

@ -8,10 +8,10 @@ Since authentik uses WebSockets to communicate with Outposts, it does not suppor
If you want to access authentik behind a reverse proxy, there are a few headers that must be passed upstream:
- `X-Forwarded-Proto`: Tells authentik and Proxy Providers if they are being served over an HTTPS connection.
- `X-Forwarded-For`: Without this, authentik will not know the IP addresses of clients.
- `Host`: Required for various security checks, WebSocket handshake, and Outpost and Proxy Provider communication.
- `Connection: Upgrade` and `Upgrade: WebSocket`: Required to upgrade protocols for requests to the WebSocket endpoints under HTTP/1.1.
- `X-Forwarded-Proto`: Tells authentik and Proxy Providers if they are being served over an HTTPS connection.
- `X-Forwarded-For`: Without this, authentik will not know the IP addresses of clients.
- `Host`: Required for various security checks, WebSocket handshake, and Outpost and Proxy Provider communication.
- `Connection: Upgrade` and `Upgrade: WebSocket`: Required to upgrade protocols for requests to the WebSocket endpoints under HTTP/1.1.
It is also recommended to use a [modern TLS configuration](https://ssl-config.mozilla.org/) and disable SSL/TLS protocols older than TLS 1.3.

8
website/docs/install-config/upgrade.mdx
View File

@ -10,13 +10,13 @@ Upgrading to the latest version of authentik, whether a new major release or a p
authentik does not support downgrading. Make sure to back up your database in case you need to revert an upgrade.
:::
- Be sure to carefully read the [Release Notes](../releases/) for the specific version to which you plan to upgrade. The release might have special requirements or actions or contain breaking changes.
- Be sure to carefully read the [Release Notes](../releases/) for the specific version to which you plan to upgrade. The release might have special requirements or actions or contain breaking changes.
- Make a backup of your PostgreSQL database before upgrading. You can dump your existing database to get a backup file. For more information about dumping and backing up your database, refer to [Upgrade PostgreSQL on Docker Compose](../troubleshooting/postgres/upgrade_docker.md) or [Upgrade PostgreSQL on Kubernetes](../troubleshooting/postgres/upgrade_kubernetes.md).
- Make a backup of your PostgreSQL database before upgrading. You can dump your existing database to get a backup file. For more information about dumping and backing up your database, refer to [Upgrade PostgreSQL on Docker Compose](../troubleshooting/postgres/upgrade_docker.md) or [Upgrade PostgreSQL on Kubernetes](../troubleshooting/postgres/upgrade_kubernetes.md).
- You need to upgrade in sequence of the major releases; do not skip directly from an older major version to the most recent version. For example, if you are currently running 2023.10.3, you will need to first upgrade to 2024.2.x, then 2024.4.x, and then 2024.6.x, in sequence.
- You need to upgrade in sequence of the major releases; do not skip directly from an older major version to the most recent version. For example, if you are currently running 2023.10.3, you will need to first upgrade to 2024.2.x, then 2024.4.x, and then 2024.6.x, in sequence.
- The version of the authentik instance and any outposts must be the same. We recommended that you always upgrade any outposts at the same time you upgrade your authentik instance.
- The version of the authentik instance and any outposts must be the same. We recommended that you always upgrade any outposts at the same time you upgrade your authentik instance.
## Upgrade authentik

50
website/docs/releases/2021/v2021.1.md
View File

@ -5,14 +5,14 @@ slug: "/releases/2021.1"
## Headline Changes
- New versioning schema (year.month.release)
- Add global email settings
- New versioning schema (year.month.release)
- Add global email settings
In previous versions, you had to configure email connection details per [Email Stage](../../add-secure-apps/flows-stages/stages/email/index.mdx). Now, you can (and should) configure global settings.
This is documented under the [docker-compose](../../install-config/install/docker-compose.mdx) and [Kubernetes](../../install-config/install/kubernetes.md) sections.
- New notification system
- New notification system
More info can be found under [Notifications](../../sys-mgmt/events/notifications.md) and [Transports](../../sys-mgmt/events/transports.md).
@ -22,37 +22,37 @@ slug: "/releases/2021.1"
## Fixes
- events: create event when system task fails
- helm: fix old reference to static secret_key
- helm: fix s3 secret key and email password not being base64 encoded
- policies: fix logic error for sync mode
- stages/email: fix email task not falling back to use_global_settings
- events: create event when system task fails
- helm: fix old reference to static secret_key
- helm: fix s3 secret key and email password not being base64 encoded
- policies: fix logic error for sync mode
- stages/email: fix email task not falling back to use_global_settings
### Fixed in 2021.1.2
- sources/\*: Add source to flow context, so source is logged during login
- outposts: Fix outpost not correctly updating on outpost modification
- outposts: Improve drift detection on kubernetes
- providers/saml: Fix metadata not being signed when signature is enabled
- policies: Improve error handling, ensure original stacktrace is preserved
- sources/\*: Add source to flow context, so source is logged during login
- outposts: Fix outpost not correctly updating on outpost modification
- outposts: Improve drift detection on kubernetes
- providers/saml: Fix metadata not being signed when signature is enabled
- policies: Improve error handling, ensure original stacktrace is preserved
### Fixed in 2021.1.3
- admin: handle FlowNonApplicableException during flow plan
- flows: fix FlowNonApplicableException not being Sentry Ignored
- lifecycle: fix typo causing single process in docker-compose
- admin: handle FlowNonApplicableException during flow plan
- flows: fix FlowNonApplicableException not being Sentry Ignored
- lifecycle: fix typo causing single process in docker-compose
### Fixed in 2021.1.4
- admin: fix providers not showing SAML Import on empty state
- core: only cache Applications API when no filtering is done
- events: fix email template for notifications
- lib: fix ak_is_group_member checking wrong groups
- providers/saml: add support for WindowsDomainQualifiedName, add docs for NameID
- providers/saml: import SAML Provider with all autogenerated mappings
- providers/saml: make NameID configurable using a Property Mapping
- providers/saml: update default OIDs for default property mappings
- web: fix site-shell being cut off when not full height
- admin: fix providers not showing SAML Import on empty state
- core: only cache Applications API when no filtering is done
- events: fix email template for notifications
- lib: fix ak_is_group_member checking wrong groups
- providers/saml: add support for WindowsDomainQualifiedName, add docs for NameID
- providers/saml: import SAML Provider with all autogenerated mappings
- providers/saml: make NameID configurable using a Property Mapping
- providers/saml: update default OIDs for default property mappings
- web: fix site-shell being cut off when not full height
## Upgrading

360
website/docs/releases/2021/v2021.10.md
View File

@ -5,17 +5,17 @@ slug: "/releases/2021.10"
## Headline Changes
- Flow Inspector
- Flow Inspector
To better understand how a flow works, and why things might not be working as intended, you can now launch Flows with an inspector enabled. This is simply triggered by adding a `?inspector` to the URL. Currently, only superuser have the permission to access the Inspector.
The inspector shows the current stage, previous stages, next planned stages, and the current flow context.
- SMS Authenticator
- SMS Authenticator
You can now use SMS-based TOTP authenticators. This new Stage supports both Twilio, and a generic API endpoint, if using another provider. This stage does not have to be used for authentication, it can simply be used during enrollment to verify your users phone numbers.
- Sign in with Apple
- Sign in with Apple
It is now possible to add an Apple OAuth Source, to allow your users to authenticate with their Apple ID.
@ -23,201 +23,201 @@ A huge shoutout to all the people that contributed, helped test and also transla
## Minor changes
- \*: Squash Migrations (#1593)
- admin: clear update notification when notification's version matches current version
- cmd: prevent outposts from panicking when failing to get their config
- core: add default for user's settings attribute
- core: add settings serializer to user/me and update_self endpoints, saved in a key in attributes
- core: improve detection for s3 settings to trigger backup
- core: include group uuids in self serializer
- core: make user's name field fully optional
- flows: inspector (#1469)
- internal: add internal healthchecking to prevent websocket errors
- internal/proxyv2: improve error handling when configuring app
- lifecycle: bump celery healthcheck to 5s timeout
- lifecycle: only lock database when system migrations need to be applied, and during django migrations, and don't double unlock
- lifecycle: only set prometheus_multiproc_dir in ak wrapper to prevent full disk on worker
- managed: don't run managed reconciler in foreground on startup
- outpost/proxy: fix missing negation for internal host ssl verification
- outposts: add additional error checking for docker controller
- outposts: Adding more flexibility to outposts in Kubernetes. (#1617)
- outposts: allow disabling of docker controller port mapping
- outposts: check ports of deployment in kubernetes outpost controller
- outposts: don't always build permissions on outpost.user access, only in signals and tasks
- outposts: fallback to known-good outpost image if configured image cannot be pulled
- outposts: fix error when comparing ports in docker controller when port mapping is disabled
- outposts: handle k8s 422 response code by recreating objects
- outposts: rename docker_image_base to container_image_base, since its not docker specific
- outposts/ldap: Support hard coded `uidNumber` and `gidNumber`. (#1582)
- outposts/proxy: add new headers with unified naming
- outposts/proxy: fix duplicate protocol in domain auth mode
- outposts/proxy: show full error message when user is authenticated
- policies: add additional filters to create flow charts on frontend
- policies/password: add extra sub_text field in tests
- providers/ldap: use RDN when using posixGroup's memberUid attribute (#1514)
- providers/proxy: always check ingress secret in kubernetes controller
- providers/proxy: update ingress controller to work with k8s 1.22
- recovery: handle error when user doesn't exist
- root: add docker-native healthcheck for web and celery
- root: add translation for backend strings
- root: coverage with toml support
- root: fix error with sentry proxy
- root: migrate docker images to netlify proxy (#1603)
- root: remove redundant internal network from compose
- root: remove structlog.processors.format_exc_info for new structlog version
- root: Use fully qualified names for docker bases base images. (#1490)
- sources/ldap: add support for Active Directory `userAccountControl` attribute
- sources/ldap: don't sync ldap source when no property mappings are set
- sources/ldap: fix logic error in Active Directory account disabled status
- sources/oauth: add Sign in with Apple (#1635)
- stages/authenticator_sms: add generic provider (#1595)
- stages/authenticator_sms: Add SMS Authenticator Stage (#1577)
- stages/authenticator_validate: create a default authenticator validate stage with sensible defaults
- stages/email: add activate_user_on_success flag, add for all example flows
- stages/prompt: add sub_text field to add HTML below prompt fields
- stages/prompt: fix sub_text not allowing blank
- stages/prompt: fix wrong field type of field_key
- stages/user_login: add check for user.is_active and tests
- stages/user_write: allow recursive writing to user.attributes
- web: add locale detection
- web: ensure fallback locale is loaded
- web: fix rendering of token copy button in dark mode
- web: fix strings not being translated at all when matching browser locale not found
- web: make table pagination size user-configurable
- web: new default flow background
- web: Translate /web/src/locales/en.po in fr_FR (#1506)
- web/admin: add fallback font for doughnut charts
- web/admin: default to warning state for backup task
- web/admin: don't require username nor name for activate/deactivate toggles
- web/admin: fix description for flow import
- web/admin: fix LDAP Source form not exposing syncParentGroup
- web/admin: fix search group label
- web/admin: fix SMS Authenticator stage not loading state correctly
- web/admin: improve visibility of oauth rsa key
- web/admin: only show outpost deployment info when not embedded
- web/admin: truncate prompt label when too long
- web/elements: fix initialLoad not being done when viewportCheck was disabled
- web/elements: fix model form always loading when viewport check is disabled
- web/elements: use dedicated button for search clear instead of webkit exclusive one
- web/flows: adjust message for email stage
- web/user: don't show managed tokens in user interface
- web/user: initial optimisation for smaller screens
- web/user: load interface settings from user settings
- \*: Squash Migrations (#1593)
- admin: clear update notification when notification's version matches current version
- cmd: prevent outposts from panicking when failing to get their config
- core: add default for user's settings attribute
- core: add settings serializer to user/me and update_self endpoints, saved in a key in attributes
- core: improve detection for s3 settings to trigger backup
- core: include group uuids in self serializer
- core: make user's name field fully optional
- flows: inspector (#1469)
- internal: add internal healthchecking to prevent websocket errors
- internal/proxyv2: improve error handling when configuring app
- lifecycle: bump celery healthcheck to 5s timeout
- lifecycle: only lock database when system migrations need to be applied, and during django migrations, and don't double unlock
- lifecycle: only set prometheus_multiproc_dir in ak wrapper to prevent full disk on worker
- managed: don't run managed reconciler in foreground on startup
- outpost/proxy: fix missing negation for internal host ssl verification
- outposts: add additional error checking for docker controller
- outposts: Adding more flexibility to outposts in Kubernetes. (#1617)
- outposts: allow disabling of docker controller port mapping
- outposts: check ports of deployment in kubernetes outpost controller
- outposts: don't always build permissions on outpost.user access, only in signals and tasks
- outposts: fallback to known-good outpost image if configured image cannot be pulled
- outposts: fix error when comparing ports in docker controller when port mapping is disabled
- outposts: handle k8s 422 response code by recreating objects
- outposts: rename docker_image_base to container_image_base, since its not docker specific
- outposts/ldap: Support hard coded `uidNumber` and `gidNumber`. (#1582)
- outposts/proxy: add new headers with unified naming
- outposts/proxy: fix duplicate protocol in domain auth mode
- outposts/proxy: show full error message when user is authenticated
- policies: add additional filters to create flow charts on frontend
- policies/password: add extra sub_text field in tests
- providers/ldap: use RDN when using posixGroup's memberUid attribute (#1514)
- providers/proxy: always check ingress secret in kubernetes controller
- providers/proxy: update ingress controller to work with k8s 1.22
- recovery: handle error when user doesn't exist
- root: add docker-native healthcheck for web and celery
- root: add translation for backend strings
- root: coverage with toml support
- root: fix error with sentry proxy
- root: migrate docker images to netlify proxy (#1603)
- root: remove redundant internal network from compose
- root: remove structlog.processors.format_exc_info for new structlog version
- root: Use fully qualified names for docker bases base images. (#1490)
- sources/ldap: add support for Active Directory `userAccountControl` attribute
- sources/ldap: don't sync ldap source when no property mappings are set
- sources/ldap: fix logic error in Active Directory account disabled status
- sources/oauth: add Sign in with Apple (#1635)
- stages/authenticator_sms: add generic provider (#1595)
- stages/authenticator_sms: Add SMS Authenticator Stage (#1577)
- stages/authenticator_validate: create a default authenticator validate stage with sensible defaults
- stages/email: add activate_user_on_success flag, add for all example flows
- stages/prompt: add sub_text field to add HTML below prompt fields
- stages/prompt: fix sub_text not allowing blank
- stages/prompt: fix wrong field type of field_key
- stages/user_login: add check for user.is_active and tests
- stages/user_write: allow recursive writing to user.attributes
- web: add locale detection
- web: ensure fallback locale is loaded
- web: fix rendering of token copy button in dark mode
- web: fix strings not being translated at all when matching browser locale not found
- web: make table pagination size user-configurable
- web: new default flow background
- web: Translate /web/src/locales/en.po in fr_FR (#1506)
- web/admin: add fallback font for doughnut charts
- web/admin: default to warning state for backup task
- web/admin: don't require username nor name for activate/deactivate toggles
- web/admin: fix description for flow import
- web/admin: fix LDAP Source form not exposing syncParentGroup
- web/admin: fix search group label
- web/admin: fix SMS Authenticator stage not loading state correctly
- web/admin: improve visibility of oauth rsa key
- web/admin: only show outpost deployment info when not embedded
- web/admin: truncate prompt label when too long
- web/elements: fix initialLoad not being done when viewportCheck was disabled
- web/elements: fix model form always loading when viewport check is disabled
- web/elements: use dedicated button for search clear instead of webkit exclusive one
- web/flows: adjust message for email stage
- web/user: don't show managed tokens in user interface
- web/user: initial optimisation for smaller screens
- web/user: load interface settings from user settings
## Fixed in 2021.10.1-rc2
- core: add user flag to prevent users from changing their usernames
- core: log user for http requests
- flows: clear cache when deleting bindings
- outpost/ldap: fix logging for mismatched provider
- root: add cookie domain setting
- sources/oauth: add choices to oauth provider_type
- web: disable Sentry.showReportDialog
- web/flows: showing of authentik logo in flow executor
- web/flows: fix authenticator device selection not updating
- web/flows: show cancel link when choosing authenticator challenge
- core: add user flag to prevent users from changing their usernames
- core: log user for http requests
- flows: clear cache when deleting bindings
- outpost/ldap: fix logging for mismatched provider
- root: add cookie domain setting
- sources/oauth: add choices to oauth provider_type
- web: disable Sentry.showReportDialog
- web/flows: showing of authentik logo in flow executor
- web/flows: fix authenticator device selection not updating
- web/flows: show cancel link when choosing authenticator challenge
## Fixed in 2021.10.1-rc3
- api: fix error when connection to websocket via secret_key
- core: add toggle to completely disable backup mechanism
- core: add USER_ATTRIBUTE_CHANGE_EMAIL
- events: fix error when notification transport doesn't exist anymore
- outposts: fix docker controller not using object_naming_template
- providers/oauth2: fallback to uid if UPN was selected but isn't available
- providers/oauth2: fix events being created from /application/o/authorize/
- sources/ldap: prevent key `users` from being set as this is an M2M relation
- sources/ldap: skip values which are of type bytes
- api: fix error when connection to websocket via secret_key
- core: add toggle to completely disable backup mechanism
- core: add USER_ATTRIBUTE_CHANGE_EMAIL
- events: fix error when notification transport doesn't exist anymore
- outposts: fix docker controller not using object_naming_template
- providers/oauth2: fallback to uid if UPN was selected but isn't available
- providers/oauth2: fix events being created from /application/o/authorize/
- sources/ldap: prevent key `users` from being set as this is an M2M relation
- sources/ldap: skip values which are of type bytes
## Fixed in 2021.10.1
- core: add API for all user-source connections
- core: add API to list all authenticator devices
- core: add created field to source connection
- flows: optimise stage user_settings API
- outposts: separate websocket re-connection logic to decrease requests on reconnect
- root: pin node images to v16
- root: update golang ldap server package
- web/user: fix wrong device being selected in user's mfa update form
- web/user: rework MFA Device UI to support multiple devices
- web/user: update form to update mfa devices
- core: add API for all user-source connections
- core: add API to list all authenticator devices
- core: add created field to source connection
- flows: optimise stage user_settings API
- outposts: separate websocket re-connection logic to decrease requests on reconnect
- root: pin node images to v16
- root: update golang ldap server package
- web/user: fix wrong device being selected in user's mfa update form
- web/user: rework MFA Device UI to support multiple devices
- web/user: update form to update mfa devices
## Fixed in 2021.10.2
- api: replace django sentry proxy with go proxy to prevent login issues
- providers/proxy: allow configuring of additional scope mappings for proxy
- providers/saml: fix error on missing AssertionConsumerServiceURL, fall back to default ACS
- root: fix Detection of S3 settings for backups
- root: fix postgres install on bullseye
- root: update base images for outposts
- root: update to buster
- stages/identification: add show_source_labels option, to show labels for sources
- stages/invitation: don't throw 404 error in stage
- stages/invitation: remove invitation from plan context after deletion
- stages/prompt: fix type in Prompt not having enum set
- web/flows: fix invalid validation for static tokens
- web/flows: fix sub_text not rendering for static fields
- web/user: fix configureUrl not being passed to `<ak-user-settings-password>`
- api: replace django sentry proxy with go proxy to prevent login issues
- providers/proxy: allow configuring of additional scope mappings for proxy
- providers/saml: fix error on missing AssertionConsumerServiceURL, fall back to default ACS
- root: fix Detection of S3 settings for backups
- root: fix postgres install on bullseye
- root: update base images for outposts
- root: update to buster
- stages/identification: add show_source_labels option, to show labels for sources
- stages/invitation: don't throw 404 error in stage
- stages/invitation: remove invitation from plan context after deletion
- stages/prompt: fix type in Prompt not having enum set
- web/flows: fix invalid validation for static tokens
- web/flows: fix sub_text not rendering for static fields
- web/user: fix configureUrl not being passed to `<ak-user-settings-password>`
## Fixed in 2021.10.3
- admin: improve check to remove version notifications
- cmd/server: improve cleanup on shutdown
- core: add command to output full config
- core: fix auth_method for tokens
- core: include parent group name
- core: make group membership lookup respect parent groups (upwards)
- events: ignore creation/deletion of AuthenticatedSession objects
- internal: start embedded outpost directly after backend is healthy instead of waiting
- lifecycle: revert to non-h11 worker
- outpost/ldap: don't cleanup user info as it is overwritten on bind
- providers/\*: include list of outposts
- providers/ldap: add/squash migrations
- providers/ldap: memory Query (#1681)
- recovery: add create_admin_group management command
- root: fix defaults for EMAIL_USE_TLS
- root: improve compose detection, add anonymous stats
- root: keep last 30 backups
- sources/ldap: remove deprecated default
- sources/oauth: set prompt=none for Discord provider
- sources/plex: allow users to connect their plex account without login flow
- sources/plex: use exception_to_string in tasks
- stages/authenticator\_\*: add default name for authenticators
- stages/identification: only allow limited challenges for login sources
- stages/identification: use random sleep
- stages/prompt: add text_read_only field
- stages/prompt: default prompts to the current value of the context
- stages/prompt: only set placeholder when in context
- stages/prompt: set field placeholder based on plan context
- stages/prompt: use initial instead of default
- web: fix linting errors by adding a wrapper for next param
- web/admin: only show flows with an invitation stage configured instead of all enrollment flows
- web/admin: show warning on invitation list when no stage exists or is bound
- web/admin: show warning on provider when not used with outpost
- web/flows: fix authenticator_validate not allowing alphanumeric codes due to empty pattern
- web/flows: improve display of static tokens
- web/user: fix ak-user-settings-password getting wrong configureUrl
- web/user: fix device type for static tokens
- web/user: fix empty page when no sources to connect exist
- web/user: fix redirect after starting configuration flow from user interface
- admin: improve check to remove version notifications
- cmd/server: improve cleanup on shutdown
- core: add command to output full config
- core: fix auth_method for tokens
- core: include parent group name
- core: make group membership lookup respect parent groups (upwards)
- events: ignore creation/deletion of AuthenticatedSession objects
- internal: start embedded outpost directly after backend is healthy instead of waiting
- lifecycle: revert to non-h11 worker
- outpost/ldap: don't cleanup user info as it is overwritten on bind
- providers/\*: include list of outposts
- providers/ldap: add/squash migrations
- providers/ldap: memory Query (#1681)
- recovery: add create_admin_group management command
- root: fix defaults for EMAIL_USE_TLS
- root: improve compose detection, add anonymous stats
- root: keep last 30 backups
- sources/ldap: remove deprecated default
- sources/oauth: set prompt=none for Discord provider
- sources/plex: allow users to connect their plex account without login flow
- sources/plex: use exception_to_string in tasks
- stages/authenticator\_\*: add default name for authenticators
- stages/identification: only allow limited challenges for login sources
- stages/identification: use random sleep
- stages/prompt: add text_read_only field
- stages/prompt: default prompts to the current value of the context
- stages/prompt: only set placeholder when in context
- stages/prompt: set field placeholder based on plan context
- stages/prompt: use initial instead of default
- web: fix linting errors by adding a wrapper for next param
- web/admin: only show flows with an invitation stage configured instead of all enrollment flows
- web/admin: show warning on invitation list when no stage exists or is bound
- web/admin: show warning on provider when not used with outpost
- web/flows: fix authenticator_validate not allowing alphanumeric codes due to empty pattern
- web/flows: improve display of static tokens
- web/user: fix ak-user-settings-password getting wrong configureUrl
- web/user: fix device type for static tokens
- web/user: fix empty page when no sources to connect exist
- web/user: fix redirect after starting configuration flow from user interface
## Fixed in 2021.10.4
- core: force lowercase emails for gravatar usage
- outposts: fix MFA Challenges not working with outpost
- outposts/ldap: fix logic error in cached ldap searcher
- outposts/proxy: fix static files not being served in proxy mode
- providers/proxy: return list of configured scope names so outpost requests custom scopes
- root: use python slim-bullseye as base
- sources/ldap: fix user/group sync overwriting attributes instead of merging them
- sources/ldap: set connect/receive timeout (default to 15s)
- stages/\*: disable trim_whitespace on important fields
- stages/authenticator_duo: fix devices created with name
- stages/authenticator_validate: enable all device classes by default
- web: write interfaces to different folders and remove custom chunk names
- web/admin: fix display issues with flow execute buttons
- web/admin: show warnings above tab bar
- web/admin: use more natural default ordering for objects
- core: force lowercase emails for gravatar usage
- outposts: fix MFA Challenges not working with outpost
- outposts/ldap: fix logic error in cached ldap searcher
- outposts/proxy: fix static files not being served in proxy mode
- providers/proxy: return list of configured scope names so outpost requests custom scopes
- root: use python slim-bullseye as base
- sources/ldap: fix user/group sync overwriting attributes instead of merging them
- sources/ldap: set connect/receive timeout (default to 15s)
- stages/\*: disable trim_whitespace on important fields
- stages/authenticator_duo: fix devices created with name
- stages/authenticator_validate: enable all device classes by default
- web: write interfaces to different folders and remove custom chunk names
- web/admin: fix display issues with flow execute buttons
- web/admin: show warnings above tab bar
- web/admin: use more natural default ordering for objects
## Upgrading

432
website/docs/releases/2021/v2021.12.md
View File

@ -9,252 +9,252 @@ This release does not have any headline features, and mostly fixes bugs.
## Breaking changes
- stages/prompt: Before 2021.12, any policy was required to pass for the result to be considered valid. This has been changed, and now all policies are required to be valid.
- stages/prompt: Before 2021.12, any policy was required to pass for the result to be considered valid. This has been changed, and now all policies are required to be valid.
## Minor changes
- core: make defaults for \_change_email and \_change_username configurable
- core: remove dump_config, handle directly in config loader without booting django, don't check database
- events: add gdpr_compliance option
- internal: fix integrated docs not working
- internal: use runserver when debug for code reload
- lib: add cli option for lib.config
- lib: add improved log to sentry events being sent
- lib: fix custom URL schemes being overwritten
- lib: load json strings in config env variables
- lib: log error for file:// in config
- lifecycle: allow custom worker count in k8s
- lifecycle: improve backup restore by dropping database before
- lifecycle: improve redis connection debug py printing full URL
- outpost: configure error reporting based off of main instance config
- outposts: don't panic when listening for metrics fails
- outposts: reload on signal USR1, fix display of reload offset
- outposts/ldap: copy boundUsers map when running refresh instead of using blank map
- outposts/ldap: fix panic when attempting to update without locked users mutex
- outposts/proxy: continue compiling additional regexes even when one fails
- outposts/proxy: show better error when hostname isn't configured
- outposts/proxy: use disableIndex for static files
- policies/expression: fix ak_user_has_authenticator evaluation when not specifying optional device_type (#1849)
- providers/saml: fix SessionNotOnOrAfter not being included
- root: add lifespan shim to prevent errors
- root: fix settings for managed not loaded
- root: make sentry sample rate configurable
- stages/authenticator_validate: catch error when attempting to configure user without flow
- stages/email: fix missing component in response when retrying email send
- stages/email: minify email css template
- stages/email: prevent error with duplicate token
- web: improve dark theme for vertical tabs
- web: only show applications with http link
- web/admin: allow flow edit on flow view page
- web/admin: fix actions column on ip reputation page
- web/admin: fix Forms with file uploads not handling errors correctly
- web/admin: make object view pages more consistent
- web/admin: make user clickable for bound policies list
- web/admin: redesign provider pages to provide more info
- web/admin: show changelog on user info page
- web/admin: unify rendering and sorting of user lists
- web/elements: add new API to store attributes in URL, use for table and tabs
- web/elements: allow app.model names for ak-object-changelog
- web/elements: allow multiple tabs with different state
- web/flows: fix spinner during webauthn not centred
- web/flows: update default background
- web/user: fix filtering for applications based on launchURL
- web/user: fix height issues on user interface
- core: make defaults for \_change_email and \_change_username configurable
- core: remove dump_config, handle directly in config loader without booting django, don't check database
- events: add gdpr_compliance option
- internal: fix integrated docs not working
- internal: use runserver when debug for code reload
- lib: add cli option for lib.config
- lib: add improved log to sentry events being sent
- lib: fix custom URL schemes being overwritten
- lib: load json strings in config env variables
- lib: log error for file:// in config
- lifecycle: allow custom worker count in k8s
- lifecycle: improve backup restore by dropping database before
- lifecycle: improve redis connection debug py printing full URL
- outpost: configure error reporting based off of main instance config
- outposts: don't panic when listening for metrics fails
- outposts: reload on signal USR1, fix display of reload offset
- outposts/ldap: copy boundUsers map when running refresh instead of using blank map
- outposts/ldap: fix panic when attempting to update without locked users mutex
- outposts/proxy: continue compiling additional regexes even when one fails
- outposts/proxy: show better error when hostname isn't configured
- outposts/proxy: use disableIndex for static files
- policies/expression: fix ak_user_has_authenticator evaluation when not specifying optional device_type (#1849)
- providers/saml: fix SessionNotOnOrAfter not being included
- root: add lifespan shim to prevent errors
- root: fix settings for managed not loaded
- root: make sentry sample rate configurable
- stages/authenticator_validate: catch error when attempting to configure user without flow
- stages/email: fix missing component in response when retrying email send
- stages/email: minify email css template
- stages/email: prevent error with duplicate token
- web: improve dark theme for vertical tabs
- web: only show applications with http link
- web/admin: allow flow edit on flow view page
- web/admin: fix actions column on ip reputation page
- web/admin: fix Forms with file uploads not handling errors correctly
- web/admin: make object view pages more consistent
- web/admin: make user clickable for bound policies list
- web/admin: redesign provider pages to provide more info
- web/admin: show changelog on user info page
- web/admin: unify rendering and sorting of user lists
- web/elements: add new API to store attributes in URL, use for table and tabs
- web/elements: allow app.model names for ak-object-changelog
- web/elements: allow multiple tabs with different state
- web/flows: fix spinner during webauthn not centred
- web/flows: update default background
- web/user: fix filtering for applications based on launchURL
- web/user: fix height issues on user interface
## Fixed in 2021.12.1-rc2
- \*: don't use go embed to make using custom files easier
- crypto: add certificate discovery to automatically import certificates from lets encrypt
- crypto: fix default API not having an ordering
- outposts: always trigger outpost reconcile on startup
- outposts/ldap: Rework/improve LDAP search logic. (#1687)
- outposts/proxy: make logging fields more consistent
- outposts/proxy: re-add rs256 support
- providers/proxy: fix defaults for traefik integration
- providers/proxy: use wildcard for traefik headers copy
- providers/saml: fix error when using post bindings and user freshly logged in
- providers/saml: fix IndexError in signature check
- sources/ldap: add optional tls verification certificate
- sources/ldap: allow multiple server URIs for loadbalancing and failover
- sources/ldap: don't cache LDAP Connection, use random server
- sources/ldap: handle typeerror during creation of objects when using wrong keyword params
- sources/plex: fix plex token being included in event log
- stages/prompt: fix error when both default and required are set
- web/admin: add spinner to table refresh button to show progress
- web/admin: don't show disabled http basic as red
- web/admin: fix wrong description for reputation policy
- web/flows: fix linting errors
- web/flows: Revise duo authenticator login prompt text (#1872)
- \*: don't use go embed to make using custom files easier
- crypto: add certificate discovery to automatically import certificates from lets encrypt
- crypto: fix default API not having an ordering
- outposts: always trigger outpost reconcile on startup
- outposts/ldap: Rework/improve LDAP search logic. (#1687)
- outposts/proxy: make logging fields more consistent
- outposts/proxy: re-add rs256 support
- providers/proxy: fix defaults for traefik integration
- providers/proxy: use wildcard for traefik headers copy
- providers/saml: fix error when using post bindings and user freshly logged in
- providers/saml: fix IndexError in signature check
- sources/ldap: add optional tls verification certificate
- sources/ldap: allow multiple server URIs for loadbalancing and failover
- sources/ldap: don't cache LDAP Connection, use random server
- sources/ldap: handle typeerror during creation of objects when using wrong keyword params
- sources/plex: fix plex token being included in event log
- stages/prompt: fix error when both default and required are set
- web/admin: add spinner to table refresh button to show progress
- web/admin: don't show disabled http basic as red
- web/admin: fix wrong description for reputation policy
- web/flows: fix linting errors
- web/flows: Revise duo authenticator login prompt text (#1872)
## Fixed in 2021.12.1-rc3
- core: add FlowToken which saves the pickled flow plan, replace standard token in email stage to allow finishing flows in different sessions
- core: fix missing permission check for group creating when creating service account
- outposts/ldap: Fix search case sensitivity. (#1897)
- policies/expression: add ak_call_policy
- providers/saml: add ?force_binding to limit bindings for metadata endpoint
- root: add request_id to celery tasks, prefixed with "task-"
- sources/\*: Allow creation of source connections via API
- stages/prompt: use policyenginemode all
- tests/e2e: add post binding test
- web: fix duplicate classes, make generic icon clickable
- web: fix text colour for bad request on light mode
- web/admin: show outpost warning on application page too
- web/elements: close dropdown when refresh event is dispatched
- web/user: allow custom font-awesome icons for applications
- core: add FlowToken which saves the pickled flow plan, replace standard token in email stage to allow finishing flows in different sessions
- core: fix missing permission check for group creating when creating service account
- outposts/ldap: Fix search case sensitivity. (#1897)
- policies/expression: add ak_call_policy
- providers/saml: add ?force_binding to limit bindings for metadata endpoint
- root: add request_id to celery tasks, prefixed with "task-"
- sources/\*: Allow creation of source connections via API
- stages/prompt: use policyenginemode all
- tests/e2e: add post binding test
- web: fix duplicate classes, make generic icon clickable
- web: fix text colour for bad request on light mode
- web/admin: show outpost warning on application page too
- web/elements: close dropdown when refresh event is dispatched
- web/user: allow custom font-awesome icons for applications
## Fixed in 2021.12.1-rc4
- core: fix error when using invalid key-values in attributes query
- flows: fix error in inspector view
- flows: fix error when trying to print FlowToken objects
- lib: correctly report "faked" IPs to sentry
- outposts: add additional checks for websocket connection
- outposts: cleanup logs for failed binds
- outposts: don't try to create docker client for embedded outpost
- outposts: fix docker controller not stopping containers
- outposts: fix unlabeled transaction
- outposts: handle RuntimeError during websocket connect
- outposts: rewrite re-connect logic without recws
- outposts: set display name for outpost service account
- outposts/ldap: fix searches with mixed casing
- outposts/proxy: use filesystem storage for non-embedded outposts
- policies: don't always clear application cache on post_save
- stagse/authenticator_webauthn: remove pydantic import
- web: fix borders of sidebars in dark mode
- core: fix error when using invalid key-values in attributes query
- flows: fix error in inspector view
- flows: fix error when trying to print FlowToken objects
- lib: correctly report "faked" IPs to sentry
- outposts: add additional checks for websocket connection
- outposts: cleanup logs for failed binds
- outposts: don't try to create docker client for embedded outpost
- outposts: fix docker controller not stopping containers
- outposts: fix unlabeled transaction
- outposts: handle RuntimeError during websocket connect
- outposts: rewrite re-connect logic without recws
- outposts: set display name for outpost service account
- outposts/ldap: fix searches with mixed casing
- outposts/proxy: use filesystem storage for non-embedded outposts
- policies: don't always clear application cache on post_save
- stagse/authenticator_webauthn: remove pydantic import
- web: fix borders of sidebars in dark mode
## Fixed in 2021.12.1-rc5
- crypto: add additional validation before importing a certificate
- events: add flow_execution event type
- events: fix schema for top_per_user
- flows: fix wrong exception being caught in flow inspector
- outposts: reset backoff after successful connect
- outposts/proxy: fix securecookie: the value is too long again, since it can happen even with filesystem storage
- providers/oauth2: add additional logging to show with token path is taken
- providers/oauth2: use generate_key instead of uuid4
- sources/ldap: fix incorrect task names being referenced, use source native slug
- sources/oauth: add initial okta type
- sources/oauth: allow oauth types to override their login button challenge
- sources/oauth: implement apple native sign-in using the apple JS SDK
- sources/oauth: strip parts of custom apple client_id
- stages/authenticator_webauthn: make user_verification configurable
- stages/identification: fix miscalculated sleep
- stages/invitation: use GroupMemberSerializer serializer to prevent all of the user's groups and their users from being returned
- web: add link to open API Browser for API Drawer
- web/admin: add dashboard with user creation/login statistics
- web/admin: fix invalid display for LDAP Source sync status
- web/admin: fix rendering for applications on view page
- web/admin: fix rendering of applications with custom icon
- web/admin: improve wording for froward_auth, don't show setup when using proxy mode
- web/admin: show warning when deleting currently logged in user
- web/admin: update overview page
- web/flows: fix error when attempting to enroll new webauthn device
- crypto: add additional validation before importing a certificate
- events: add flow_execution event type
- events: fix schema for top_per_user
- flows: fix wrong exception being caught in flow inspector
- outposts: reset backoff after successful connect
- outposts/proxy: fix securecookie: the value is too long again, since it can happen even with filesystem storage
- providers/oauth2: add additional logging to show with token path is taken
- providers/oauth2: use generate_key instead of uuid4
- sources/ldap: fix incorrect task names being referenced, use source native slug
- sources/oauth: add initial okta type
- sources/oauth: allow oauth types to override their login button challenge
- sources/oauth: implement apple native sign-in using the apple JS SDK
- sources/oauth: strip parts of custom apple client_id
- stages/authenticator_webauthn: make user_verification configurable
- stages/identification: fix miscalculated sleep
- stages/invitation: use GroupMemberSerializer serializer to prevent all of the user's groups and their users from being returned
- web: add link to open API Browser for API Drawer
- web/admin: add dashboard with user creation/login statistics
- web/admin: fix invalid display for LDAP Source sync status
- web/admin: fix rendering for applications on view page
- web/admin: fix rendering of applications with custom icon
- web/admin: improve wording for froward_auth, don't show setup when using proxy mode
- web/admin: show warning when deleting currently logged in user
- web/admin: update overview page
- web/flows: fix error when attempting to enroll new webauthn device
## Fixed in 2021.12.1
- core: fix error when attempting to provider from cached application
- events: improve app lookup for event creation
- internal: cleanup duplicate and redundant code, properly set sentry SDK scope settings
- lifecycle: add -Ofair to celery
- web/admin: add sidebar to applications
- web/admin: fix notification unread colours not matching on user and admin interface
- web/admin: fix stage related flows not being shown in a list
- web/elements: add Markdown component to improve rendering
- web/elements: add support for sidebar on table page
- web/elements: close notification drawer when clearing all notifications
- core: fix error when attempting to provider from cached application
- events: improve app lookup for event creation
- internal: cleanup duplicate and redundant code, properly set sentry SDK scope settings
- lifecycle: add -Ofair to celery
- web/admin: add sidebar to applications
- web/admin: fix notification unread colours not matching on user and admin interface
- web/admin: fix stage related flows not being shown in a list
- web/elements: add Markdown component to improve rendering
- web/elements: add support for sidebar on table page
- web/elements: close notification drawer when clearing all notifications
## Fixed in 2021.12.2
- core: don't rotate non-api tokens
- crypto: fix private keys not being imported correctly
- outposts: release binary outposts (#1954)
- outposts/proxy: match skipPathRegex against full URL on domain auth
- policies/password: add minimum digits
- providers/oauth2: don't rely on expiry task for access codes and refresh tokens
- sources/oauth: allow writing to user in SourceConnection
- web: ignore instantSearchSDKJSBridgeClearHighlight error on edge on iOS
- web/admin: fix background colour for application sidebar
- web/elements: fix border between search buttons
- core: don't rotate non-api tokens
- crypto: fix private keys not being imported correctly
- outposts: release binary outposts (#1954)
- outposts/proxy: match skipPathRegex against full URL on domain auth
- policies/password: add minimum digits
- providers/oauth2: don't rely on expiry task for access codes and refresh tokens
- sources/oauth: allow writing to user in SourceConnection
- web: ignore instantSearchSDKJSBridgeClearHighlight error on edge on iOS
- web/admin: fix background colour for application sidebar
- web/elements: fix border between search buttons
## Fixed in 2021.12.3
- \*: revert to using GHCR directly
- core: fix error when getting launch URL for application with non-existent Provider
- internal: fix sentry sample rate not applying to proxy
- internal: rework global logging settings, embedded outpost no longer overwrites core
- outpost: re-run globalSetup when updating config, allowing for live log level changes
- outposts: handle/ignore http Abort handler
- outposts/ldap: fix log formatter and level not being set correctly
- outposts/proxy: add initial redirect-loop prevention
- outposts/proxy: fix allowlist for forward_auth and traefik
- outposts/proxy: fix ping URI not being routed
- outposts/proxy: fix session not expiring correctly due to miscalculation
- root: allow trace log level to work for core/embedded
- root: don't set secure cross opener policy
- root: drop redis cache sentry errors
- root: fix inconsistent URL quoting of redis URLs
- web/admin: add outpost type to list
- web/admin: auto set the embedded outpost's authentik_host on first view
- web/admin: don't auto-select certificate for LDAP source verification
- web/admin: fix border for outpost health status
- \*: revert to using GHCR directly
- core: fix error when getting launch URL for application with non-existent Provider
- internal: fix sentry sample rate not applying to proxy
- internal: rework global logging settings, embedded outpost no longer overwrites core
- outpost: re-run globalSetup when updating config, allowing for live log level changes
- outposts: handle/ignore http Abort handler
- outposts/ldap: fix log formatter and level not being set correctly
- outposts/proxy: add initial redirect-loop prevention
- outposts/proxy: fix allowlist for forward_auth and traefik
- outposts/proxy: fix ping URI not being routed
- outposts/proxy: fix session not expiring correctly due to miscalculation
- root: allow trace log level to work for core/embedded
- root: don't set secure cross opener policy
- root: drop redis cache sentry errors
- root: fix inconsistent URL quoting of redis URLs
- web/admin: add outpost type to list
- web/admin: auto set the embedded outpost's authentik_host on first view
- web/admin: don't auto-select certificate for LDAP source verification
- web/admin: fix border for outpost health status
## Fixed in 2021.12.4
- crypto: improve handling for non-rsa private keys
- events: create test notification with event with data
- internal: add custom proxy certificates support to embedded outpost
- policies: fix application cache not being cleared correctly
- providers/oauth2: remove jwt_alg field and set algorithm based on selected keypair, select HS256 when no keypair is selected
- stages/authenticator_validate: add passwordless login
- stages/authenticator_validate: fix prompt not triggering when using in non-authentication context
- stages/authenticator_validate: refuse passwordless flow if flow is not for authentication
- tenants: add web certificate field, make authentik's core certificate configurable based on keypair
- web/admin: fix explore integration not opening in new tab
- web/elements: fix link from notification drawer not working in user interface
- web/user: fix user details not rendering when loading to a different user settings tab and then switching
- crypto: improve handling for non-rsa private keys
- events: create test notification with event with data
- internal: add custom proxy certificates support to embedded outpost
- policies: fix application cache not being cleared correctly
- providers/oauth2: remove jwt_alg field and set algorithm based on selected keypair, select HS256 when no keypair is selected
- stages/authenticator_validate: add passwordless login
- stages/authenticator_validate: fix prompt not triggering when using in non-authentication context
- stages/authenticator_validate: refuse passwordless flow if flow is not for authentication
- tenants: add web certificate field, make authentik's core certificate configurable based on keypair
- web/admin: fix explore integration not opening in new tab
- web/elements: fix link from notification drawer not working in user interface
- web/user: fix user details not rendering when loading to a different user settings tab and then switching
## Fixed in 2021.12.5
- \*: use py3.10 syntax for unions, remove old Type[] import when possible
- core: add API endpoint to directly set user's password
- core: add error handling in source flow manager when flow isn't applicable
- core: fix UserSelfSerializer's save() overwriting other user attributes
- core: prevent LDAP password being set for internal hash upgrades
- crypto: return private key's type (required for some oauth2 providers)
- flows: add test helpers to simplify and improve checking of stages, remove force_str
- flows: don't create EventAction.FLOW_EXECUTION
- flows: update default flow titles
- flows: use WithUserInfoChallenge for AccessDeniedChallenge
- lib: strip values for timedelta from string
- outposts: add remote docker integration via SSH
- outposts: fix outpost's sentry not sending release
- outposts: include outposts build hash in state
- outposts/proxy: add support for multiple states, when multiple requests are redirect at once
- outposts/proxy: fix error checking for type assertion
- policies/reputation: rework reputation to use a single entry, include geo_ip data
- sources/oauth: add additional scopes field to get additional data from provider
- sources/oauth: fix github provider not including correct base scopes
- stages/identification: add field for passwordless flow
- tenants: forbid creation of multiple default tenants
- web: add tr to locale
- web: remove page header colour, match user navbar to admin sidebar
- web/admin: add Admin in titlebar for admin interface
- web/admin: fix alignment in outpost list when expanding rows
- web/admin: fix display when groups/users don't fit on a single row
- web/admin: include key type in list
- web/admin: mark additional scopes as non-required
- web/admin: show flow title in list
- web/elements: fix alignment of chipgroup on modal add
- web/elements: fix spacing between chips in chip-group
- web/elements: re-enable codemirror line numbers (fixed on firefox)
- web/flows: add workaround for autofocus not working in password stage
- web/flows: fix duplicate loading spinners when using webauthn
- web/flows: fix helper form not being removed from identification stage (improve password manager compatibility)
- web/flows: include user in access denied stage
- web/flows: only add helper username input if using native shadow dom to prevent browser confusion
- web/user: add language selection
- web/user: rework user source connection UI
- \*: use py3.10 syntax for unions, remove old Type[] import when possible
- core: add API endpoint to directly set user's password
- core: add error handling in source flow manager when flow isn't applicable
- core: fix UserSelfSerializer's save() overwriting other user attributes
- core: prevent LDAP password being set for internal hash upgrades
- crypto: return private key's type (required for some oauth2 providers)
- flows: add test helpers to simplify and improve checking of stages, remove force_str
- flows: don't create EventAction.FLOW_EXECUTION
- flows: update default flow titles
- flows: use WithUserInfoChallenge for AccessDeniedChallenge
- lib: strip values for timedelta from string
- outposts: add remote docker integration via SSH
- outposts: fix outpost's sentry not sending release
- outposts: include outposts build hash in state
- outposts/proxy: add support for multiple states, when multiple requests are redirect at once
- outposts/proxy: fix error checking for type assertion
- policies/reputation: rework reputation to use a single entry, include geo_ip data
- sources/oauth: add additional scopes field to get additional data from provider
- sources/oauth: fix github provider not including correct base scopes
- stages/identification: add field for passwordless flow
- tenants: forbid creation of multiple default tenants
- web: add tr to locale
- web: remove page header colour, match user navbar to admin sidebar
- web/admin: add Admin in titlebar for admin interface
- web/admin: fix alignment in outpost list when expanding rows
- web/admin: fix display when groups/users don't fit on a single row
- web/admin: include key type in list
- web/admin: mark additional scopes as non-required
- web/admin: show flow title in list
- web/elements: fix alignment of chipgroup on modal add
- web/elements: fix spacing between chips in chip-group
- web/elements: re-enable codemirror line numbers (fixed on firefox)
- web/flows: add workaround for autofocus not working in password stage
- web/flows: fix duplicate loading spinners when using webauthn
- web/flows: fix helper form not being removed from identification stage (improve password manager compatibility)
- web/flows: include user in access denied stage
- web/flows: only add helper username input if using native shadow dom to prevent browser confusion
- web/user: add language selection
- web/user: rework user source connection UI
## Upgrading

146
website/docs/releases/2021/v2021.2.md
View File

@ -5,107 +5,107 @@ slug: "/releases/2021.2"
## Headline Changes
- Managed objects
- Managed objects
Objects like property mappings can now be marked as managed, which means that they will be created, updated and deleted by authentik.
Currently, this is used to update default property mappings, and mark tokens and users generated by outposts.
- Improved support for different LDAP Servers
- Improved support for different LDAP Servers
The LDAP source has improved support for non-Active Directory LDAP setups. This includes the following changes:
- Switch to sync membership from groups to users rather than user to group
- Fix users, which were removed from a group in LDAP not being removed from said group
- Add support for LDAP servers which have core fields declared as lists
- Add property-mappings for groups, to map attributes like `name` or `is_superuser`
- Switch to sync membership from groups to users rather than user to group
- Fix users, which were removed from a group in LDAP not being removed from said group
- Add support for LDAP servers which have core fields declared as lists
- Add property-mappings for groups, to map attributes like `name` or `is_superuser`
- Add test view to debug property-mappings.
- Add test view to debug property-mappings.
## Fixes
- admin: add test view for property mappings
- core: Fix application cache not being cleared correctly (and not being ignored for searches)
- events: add send_once flag to send webhooks only once
- events: allow searching by event id
- events: don't log successful system tasks
- events: improve information sent in notification emails
- providers/oauth2: pass application to configuration error event
- providers/saml: fix imported provider not saving properties correctly
- root: use filtering_bound_logger for speed improvements
- stages/consent: fix wrong widget for expire
- web: migrate Provider List to SPA
- admin: add test view for property mappings
- core: Fix application cache not being cleared correctly (and not being ignored for searches)
- events: add send_once flag to send webhooks only once
- events: allow searching by event id
- events: don't log successful system tasks
- events: improve information sent in notification emails
- providers/oauth2: pass application to configuration error event
- providers/saml: fix imported provider not saving properties correctly
- root: use filtering_bound_logger for speed improvements
- stages/consent: fix wrong widget for expire
- web: migrate Provider List to SPA
## Fixed in 2021.2.1-rc2
- admin: add Certificate-Keypair generation
- admin: fix property-mapping views redirecting to invalid URL
- admin: improve layout for policy testing
- admin: remove old provider list view
- outpost: cap reconnect backoff at 60 seconds, reset backoff on successful connection
- policies: add debug flag to PolicyRequest to prevent alerts from testing policies
- providers/saml: force-set friendly_name to empty string for managed mappings
- root: add dedicated live and readiness healthcheck views
- web: fix link to provider list on overview page
- web: fix outpost item in sidebar being active on service connection views
- admin: add Certificate-Keypair generation
- admin: fix property-mapping views redirecting to invalid URL
- admin: improve layout for policy testing
- admin: remove old provider list view
- outpost: cap reconnect backoff at 60 seconds, reset backoff on successful connection
- policies: add debug flag to PolicyRequest to prevent alerts from testing policies
- providers/saml: force-set friendly_name to empty string for managed mappings
- root: add dedicated live and readiness healthcheck views
- web: fix link to provider list on overview page
- web: fix outpost item in sidebar being active on service connection views
## Fixed in 2021.2.1-stable
- admin: fix link in source list
- web: rebuild Outposts list in SPA
- outposts: Fix reconnect not working reliably
- providers/oauth2: add authorized scopes to AUTHORIZE_APPLICATION event
- providers/oauth2: add unofficial groups attribute to default profile claim
- web: fix sidebar being active when stage prompts is selected
- admin: fix link in source list
- web: rebuild Outposts list in SPA
- outposts: Fix reconnect not working reliably
- providers/oauth2: add authorized scopes to AUTHORIZE_APPLICATION event
- providers/oauth2: add unofficial groups attribute to default profile claim
- web: fix sidebar being active when stage prompts is selected
## Fixed in 2021.2.2-stable
- crypto: move certificate and key data to separate api calls to create events
- events: rename context.token to context.secret
- events: rename token_view to secret_view
- lib: fix stacktrace for general expressions
- outposts: fix ProxyProvider update not triggering outpost update
- policies: skip cache on debug request
- providers/proxy: fix certificates without key being selectable
- root: log runtime in milliseconds
- sources/\*: switch API to use slug in URL
- sources/ldap: add API for sync status
- sources/oauth: add callback URL to api
- web: fix ModalButton working in global scope, causing issues on 2nd use
- crypto: move certificate and key data to separate api calls to create events
- events: rename context.token to context.secret
- events: rename token_view to secret_view
- lib: fix stacktrace for general expressions
- outposts: fix ProxyProvider update not triggering outpost update
- policies: skip cache on debug request
- providers/proxy: fix certificates without key being selectable
- root: log runtime in milliseconds
- sources/\*: switch API to use slug in URL
- sources/ldap: add API for sync status
- sources/oauth: add callback URL to api
- web: fix ModalButton working in global scope, causing issues on 2nd use
## Fixed in 2021.2.3-stable
- core: fix tokens using wrong lookup
- web: fix missing source create button
- core: fix tokens using wrong lookup
- web: fix missing source create button
## Fixed in 2021.2.4-stable
- admin: fix missing success_urls causing errors on create/update forms
- core: fix typo in user settings causing sources to not show
- admin: fix missing success_urls causing errors on create/update forms
- core: fix typo in user settings causing sources to not show
## Fixed in 2021.2.5-stable
- admin: fix policy list not having a refresh button
- events: pass Event's user to Notification policy engine when present
- helm: add initial wait for healthcheck
- outpost: improve logging output, ensure fields match api server
- root: fix request_id not being logged for actual asgi requests
- sources/oauth: fix buttons not being ak-root-link
- web: fix library not being full height, again
- web: fix outpost edit/delete buttons
- web: fix SiteShell breaking links when handlers are updated twice
- admin: fix policy list not having a refresh button
- events: pass Event's user to Notification policy engine when present
- helm: add initial wait for healthcheck
- outpost: improve logging output, ensure fields match api server
- root: fix request_id not being logged for actual asgi requests
- sources/oauth: fix buttons not being ak-root-link
- web: fix library not being full height, again
- web: fix outpost edit/delete buttons
- web: fix SiteShell breaking links when handlers are updated twice
## Fixed in 2021.2.6-stable
- admin: fix missing success_url for Cache clean views
- events: fix error when event can't be loaded in rule task
- flows: handle error when app cannot be found during flow import
- policies: sort groups in GroupMembershipPolicy policy and binding
- providers/oauth2: fix error when no login event could be found
- sources/ldap: fix API error when source has not synced yet
- sources/ldap: fix password setter on users which are not LDAP
- web: add sentry CaptureConsole
- web: fix colourstyles not being included in common_styles
- admin: fix missing success_url for Cache clean views
- events: fix error when event can't be loaded in rule task
- flows: handle error when app cannot be found during flow import
- policies: sort groups in GroupMembershipPolicy policy and binding
- providers/oauth2: fix error when no login event could be found
- sources/ldap: fix API error when source has not synced yet
- sources/ldap: fix password setter on users which are not LDAP
- web: add sentry CaptureConsole
- web: fix colourstyles not being included in common_styles
## Upgrading
@ -117,11 +117,11 @@ The change affects the "SAML Name" property, which has been changed from an oid
The integrations affected are:
- [Ansible Tower/AWX](/integrations/services/awx-tower/)
- [GitLab](/integrations/services/gitlab/)
- [NextCloud](/integrations/services/nextcloud/)
- [Rancher](/integrations/services/rancher/)
- [Sentry](/integrations/services/sentry/)
- [Ansible Tower/AWX](/integrations/services/awx-tower/)
- [GitLab](/integrations/services/gitlab/)
- [NextCloud](/integrations/services/nextcloud/)
- [Rancher](/integrations/services/rancher/)
- [Sentry](/integrations/services/sentry/)
### docker-compose

72
website/docs/releases/2021/v2021.3.md
View File

@ -5,13 +5,13 @@ slug: "/releases/2021.3"
## Headline Changes
- WebAuthn support
- WebAuthn support
This release introduces support for [WebAuthn](https://webauthn.io/), an open standard for the use of hardware authentication keys like YubiKeys on the web.
You can configure a WebAuthn device using the "WebAuthn Authenticator Setup Stage" stage. Afterwards, it can be used as an n-th factor, just like TOTP authenticators.
- Simplify role-based access
- Simplify role-based access
Instead of having to create a Group Membership policy for every group you want to use, you can now select a Group and even a User directly in a binding.
@ -21,19 +21,19 @@ slug: "/releases/2021.3"
Group Membership policies are automatically migrated to use this simplified access.
- Invisible reCAPTCHA
- Invisible reCAPTCHA
The checkbox-based reCAPTCHA has been replaced with [reCAPTCHA v2 Invisible](https://developers.google.com/recaptcha/docs/invisible).
This is a breaking change, as a set of reCAPTCHA keys are only valid for a single type. For this, go to https://www.google.com/recaptcha/admin and create a new set of keys with the "reCAPTCHA v2" type and "Invisible reCAPTCHA badge" mode.
- Migration of Flow Executor to SPA/API
- Migration of Flow Executor to SPA/API
The flow executor has been migrated to a full SPA/API architecture. This was required for WebAuthn, but also allows for greater customizability.
It also allows other services to use the flow executor via an API, which will be used by the outpost further down the road.
- Deny stage
- Deny stage
A new stage which simply denies access. This can be used to conditionally deny access to users during a flow. Authorization flows for example required an authenticated user, but there was no previous way to block access for un-authenticated users.
@ -41,43 +41,43 @@ slug: "/releases/2021.3"
## Fixed in 2021.3.2
- sources/ldap: fix sync for Users without pwdLastSet
- web: fix date display issue
- web: fix submit in Modal reloading page in firefox
- sources/ldap: fix sync for Users without pwdLastSet
- web: fix date display issue
- web: fix submit in Modal reloading page in firefox
## Fixed in 2021.3.3
- providers/oauth2: allow protected_resource_view when method is OPTIONS
- stages/authenticator_static: fix error when disable static tokens
- stages/authenticator_webauthn: add missing migration
- web: fix Colours for user settings in dark mode
- web: fix Flow executor not showing spinner when redirecting
- web: fix Source icons not being displayed on firefox
- web: fix styling for static token list
- providers/oauth2: allow protected_resource_view when method is OPTIONS
- stages/authenticator_static: fix error when disable static tokens
- stages/authenticator_webauthn: add missing migration
- web: fix Colours for user settings in dark mode
- web: fix Flow executor not showing spinner when redirecting
- web: fix Source icons not being displayed on firefox
- web: fix styling for static token list
## Fixed in 2021.3.4
- admin: include git build hash in gh-\* tags and show build hash in admin overview
- events: don't fail on boot when geoip can't be opened
- helm: add initial geoip
- outposts: improve logs for outpost connection
- policies: fix error when clearing policy cache when no policies are cached
- root: add comment for error reporting to compose
- root: add geoip config to docker-compose
- sources/oauth: fix error on user enrollment when no enrollment flow is defined
- web: add close button to messages
- web: backport fix: add missing background filter
- web: fix outpost health display
- web: fix path for fallback flow view
- web: fix system task index
- web: improve compatibility with password managers
- web: improve layout of expanded event info
- web: improve styling for application list
- web: prevent duplicate messages
- web: show related edit button for bound stages and policies
- web: use chunking for vendor and api
- web: use loadingState for autosubmitStage
- web: use sections in sidebar, adjust colouring
- admin: include git build hash in gh-\* tags and show build hash in admin overview
- events: don't fail on boot when geoip can't be opened
- helm: add initial geoip
- outposts: improve logs for outpost connection
- policies: fix error when clearing policy cache when no policies are cached
- root: add comment for error reporting to compose
- root: add geoip config to docker-compose
- sources/oauth: fix error on user enrollment when no enrollment flow is defined
- web: add close button to messages
- web: backport fix: add missing background filter
- web: fix outpost health display
- web: fix path for fallback flow view
- web: fix system task index
- web: improve compatibility with password managers
- web: improve layout of expanded event info
- web: improve styling for application list
- web: prevent duplicate messages
- web: show related edit button for bound stages and policies
- web: use chunking for vendor and api
- web: use loadingState for autosubmitStage
- web: use sections in sidebar, adjust colouring
## Upgrading

176
website/docs/releases/2021/v2021.4.md
View File

@ -5,126 +5,126 @@ slug: "/releases/2021.4"
## Headline Changes
- Configurable Policy engine mode
- Configurable Policy engine mode
In the past, all objects, which could have policies attached to them, required _all_ policies to pass to consider an action successful.
You can now configure if _all_ policies need to pass, or if _any_ policy needs to pass.
This can now be configured for the following objects:
- Applications (access restrictions)
- Sources
- Flows
- Flow-stage bindings
- Applications (access restrictions)
- Sources
- Flows
- Flow-stage bindings
For backwards compatibility, this is set to _all_, but new objects will default to _any_.
- Expiring Events
- Expiring Events
Previously, events would stay in the database forever, and had to eventually be cleaned up manually. This version add expiry to events with a default
timeout of 1 Year. This also applies to existing events, and their expiry will be set during the migration.
- New UI
- New UI
While the UI mostly looks the same, under the hood a lot has changed. The Web UI is now a Single-page application based on rollup and lit-html. This has several consequences and new features, for example:
- You can now see a user's OAuth Access/Refresh tokens and the consents they've given
- You can now see a per-object changelog based on the model_create/update/delete events being created.
- A new API Browser is available under `https://authentink.company/api/v2beta/`
- Several new charts, new pages and quality-of-life improvements
- Credentials of objects are no longer shown while editing them
- You can now see a user's OAuth Access/Refresh tokens and the consents they've given
- You can now see a per-object changelog based on the model_create/update/delete events being created.
- A new API Browser is available under `https://authentink.company/api/v2beta/`
- Several new charts, new pages and quality-of-life improvements
- Credentials of objects are no longer shown while editing them
- Deprecated Group membership has been removed.
- Deprecated Group membership has been removed.
## Minor changes
- You can now specify the amount of processes started in docker-compose using the `WORKERS` environment variable.
- You can now specify the amount of processes started in docker-compose using the `WORKERS` environment variable.
## Fixed in 2021.4.2
- core: fix propertymapping API returning invalid value for components (https://github.com/goauthentik/authentik/issues/746)
- core: improve messaging when creating a recovery link for a user when no recovery flow exists
- flows: annotate flows executor 404 error
- flows: include configure_flow in stages API
- helm: make storage class, size and mode configurable
- helm: turn off monitoring by default (https://github.com/goauthentik/authentik/issues/741)
- outposts: fix errors when creating multiple outposts
- root: add restart: unless-stopped to compose
- root: base Websocket message storage on Base not fallback
- root: fix healthcheck part in docker-compose
- root: fix setting of EMAIL_USE_TLS and EMAIL_USE_SSL
- sources/ldap: improve error handling during sync
- sources/oauth: fix error when creating an oauth source which has fixed URLs
- sources/oauth: fix resolution of sources' provider type
- web: fix background-color on router outlet on light mode
- web/admin: fix error when user doesn't have permissions to read source
- web/admin: fix errors in user profile when non-superuser
- core: fix propertymapping API returning invalid value for components (https://github.com/goauthentik/authentik/issues/746)
- core: improve messaging when creating a recovery link for a user when no recovery flow exists
- flows: annotate flows executor 404 error
- flows: include configure_flow in stages API
- helm: make storage class, size and mode configurable
- helm: turn off monitoring by default (https://github.com/goauthentik/authentik/issues/741)
- outposts: fix errors when creating multiple outposts
- root: add restart: unless-stopped to compose
- root: base Websocket message storage on Base not fallback
- root: fix healthcheck part in docker-compose
- root: fix setting of EMAIL_USE_TLS and EMAIL_USE_SSL
- sources/ldap: improve error handling during sync
- sources/oauth: fix error when creating an oauth source which has fixed URLs
- sources/oauth: fix resolution of sources' provider type
- web: fix background-color on router outlet on light mode
- web/admin: fix error when user doesn't have permissions to read source
- web/admin: fix errors in user profile when non-superuser
## Fixed in 2021.4.3
- \*: add model_name to TypeCreate API to distinguish between models sharing a component
- api: fix CSRF error when using POST/PATCH/PUT in API Browser
- api: make 401 messages clearer
- api: mount outposts under outposts/instances to match flows
- core: add parameter to output property mapping test result formatted
- core: add superuser_full_list to applications list, shows all applications when superuser
- core: fix Tokens being created with incorrect intent by default
- outposts: don't run outpost_controller when no service connection is set
- providers/oauth2: Set CORS Headers for token endpoint, check Origin header against redirect URLs
- root: auto-migrate on startup, lock database using pg_advisory_lock
- sources/oauth: add login with plex support
- sources/oauth: fix redirect loop for source with non-configurable URLs
- sources/oauth: save null instead of empty string for sources without configurable URLs
- web/admin: add ability to add users to a group whilst creating a group
- web/admin: fix default for codemirror
- web/admin: fix group member table order
- web/admin: fix non-matching provider type being selected when creating an OAuth Source
- web/admin: fix provider type resetting when changing provider type
- web/admin: fix undefined being shown when viewing application
- web/admin: improve default selection for property-mappings
- \*: add model_name to TypeCreate API to distinguish between models sharing a component
- api: fix CSRF error when using POST/PATCH/PUT in API Browser
- api: make 401 messages clearer
- api: mount outposts under outposts/instances to match flows
- core: add parameter to output property mapping test result formatted
- core: add superuser_full_list to applications list, shows all applications when superuser
- core: fix Tokens being created with incorrect intent by default
- outposts: don't run outpost_controller when no service connection is set
- providers/oauth2: Set CORS Headers for token endpoint, check Origin header against redirect URLs
- root: auto-migrate on startup, lock database using pg_advisory_lock
- sources/oauth: add login with plex support
- sources/oauth: fix redirect loop for source with non-configurable URLs
- sources/oauth: save null instead of empty string for sources without configurable URLs
- web/admin: add ability to add users to a group whilst creating a group
- web/admin: fix default for codemirror
- web/admin: fix group member table order
- web/admin: fix non-matching provider type being selected when creating an OAuth Source
- web/admin: fix provider type resetting when changing provider type
- web/admin: fix undefined being shown when viewing application
- web/admin: improve default selection for property-mappings
## Fixed in 2021.4.4
- \*: make tasks run every 60 minutes not :00 every hour
- outposts: check for X-Forwarded-Host to switch context
- outposts: improve update performance
- outposts: move local connection check to task, run every 60 minutes
- providers/oauth2: add proper support for non-http schemes as redirect URIs
- providers/oauth2: fix TokenView not having CORS headers set even with proper Origin
- sources/oauth: fix error whilst fetching user profile when source uses fixed URLs
- sources/oauth: handle error in AzureAD when ID Can't be extracted
- stages/user_login: add default backend
- web: fix title not being loaded from config
- web: only report http errors for 500 and above
- web: send response info when response is thrown
- web/admin: add description for fields in proxy provider form
- web/admin: adjust phrasing of cards on overview page
- web/admin: fix display for user supseruser status
- web/admin: fix error when me() returns 403
- web/admin: fix error when updating identification stage
- web/admin: fix invalid group member count
- web/admin: fix link to providers on overview page
- web/admin: fix mismatched required tags
- web/admin: improve phrasing for Policy bindings
- web/admin: only allow policies to be bound to sources as users/groups cannot be checked
- web/admin: only pre-select items when creating a new object
- web/flows: fix Sentry not being loaded correctly
- \*: make tasks run every 60 minutes not :00 every hour
- outposts: check for X-Forwarded-Host to switch context
- outposts: improve update performance
- outposts: move local connection check to task, run every 60 minutes
- providers/oauth2: add proper support for non-http schemes as redirect URIs
- providers/oauth2: fix TokenView not having CORS headers set even with proper Origin
- sources/oauth: fix error whilst fetching user profile when source uses fixed URLs
- sources/oauth: handle error in AzureAD when ID Can't be extracted
- stages/user_login: add default backend
- web: fix title not being loaded from config
- web: only report http errors for 500 and above
- web: send response info when response is thrown
- web/admin: add description for fields in proxy provider form
- web/admin: adjust phrasing of cards on overview page
- web/admin: fix display for user supseruser status
- web/admin: fix error when me() returns 403
- web/admin: fix error when updating identification stage
- web/admin: fix invalid group member count
- web/admin: fix link to providers on overview page
- web/admin: fix mismatched required tags
- web/admin: improve phrasing for Policy bindings
- web/admin: only allow policies to be bound to sources as users/groups cannot be checked
- web/admin: only pre-select items when creating a new object
- web/flows: fix Sentry not being loaded correctly
## Fixed in 2021.4.5
- core: fix text on error pages being hard to read
- outposts: only kill docker container if its running
- root: add middleware to properly report websocket connection to sentry
- root: don't use .error of structlog to not send to sentry
- stages/email: catch ValueError when global email settings are invalid
- stages/invitation: accept token from prompt_data
- stages/invitation: fix token not being loaded correctly from query string
- web: fix text-colour for form help text
- web: ignore network errors for sentry
- web/admin: don't show docker certs as required
- web/flows: fix redirect loop when sentry is enabled on flow views
- web/flows: include ShadyDOM, always enable ShadyDOM for flow interface, improve compatibility with password
- web/flows/identification: fix phrasing account recovery
- core: fix text on error pages being hard to read
- outposts: only kill docker container if its running
- root: add middleware to properly report websocket connection to sentry
- root: don't use .error of structlog to not send to sentry
- stages/email: catch ValueError when global email settings are invalid
- stages/invitation: accept token from prompt_data
- stages/invitation: fix token not being loaded correctly from query string
- web: fix text-colour for form help text
- web: ignore network errors for sentry
- web/admin: don't show docker certs as required
- web/flows: fix redirect loop when sentry is enabled on flow views
- web/flows: include ShadyDOM, always enable ShadyDOM for flow interface, improve compatibility with password
- web/flows/identification: fix phrasing account recovery
## Upgrading

96
website/docs/releases/2021/v2021.5.md
View File

@ -5,7 +5,7 @@ slug: "/releases/2021.5"
## Headline Changes
- LDAP Provider
- LDAP Provider
:::info
This feature is still in technical preview, so please report any Bugs you run into on [GitHub](https://github.com/goauthentik/authentik/issues)
@ -17,85 +17,85 @@ This feature is still in technical preview, so please report any Bugs you run in
Binding against the LDAP Server uses a flow in the background. This allows you to use the same policies and flows as you do for web-based logins. The only limitation is that currently only identification and password stages are supported, due to how LDAP works.
- Compatibility with forwardAuth/auth_request
- Compatibility with forwardAuth/auth_request
The authentik proxy is now compatible with forwardAuth (traefik) / auth_request (nginx). All that is required is the latest version of the outpost,
and the correct config from [here](../../add-secure-apps/providers/proxy/forward_auth.mdx).
- Docker images for ARM
- Docker images for ARM
Docker images are now built for amd64 and arm64.
- Reduced setup complexity
- Reduced setup complexity
The authentik server now requires less containers. The static container (as well as the traefik when using docker-compose) are no longer required. As the first stage of a migration to Golang instead of Python, authentik now runs behind an in-container reverse proxy, which hosts the static files.
- New Plex authentication source
- New Plex authentication source
The plex source (previously a provider for the OAuth Source) has been rewritten to a dedicated Source.
You can now limit access to authentik based on which servers a Plex user is member of.
- Configurable source behaviour
- Configurable source behaviour
You can now configure how a source behaves after the user has authenticated themselves to the source. Previously, authentik always checked the unique identifier from the source, enrolled the user when the identifier didn't exist and authenticated the user otherwise.
Now you can configure how the matching should be done:
- Identifier: Keeps the old behaviour, can lead to duplicate user accounts
- Email (link): If a user with the same Email address exists, they are linked. Can have security implications when a source doesn't validate email addresses.
- Email (deny): Deny the flow if the Email address is already used.
- Username (link): If a user with the same username address exists, they are linked. Can have security implications when a username is used with another source.
- Username (deny): Deny the flow if the username address is already used.
- Identifier: Keeps the old behaviour, can lead to duplicate user accounts
- Email (link): If a user with the same Email address exists, they are linked. Can have security implications when a source doesn't validate email addresses.
- Email (deny): Deny the flow if the Email address is already used.
- Username (link): If a user with the same username address exists, they are linked. Can have security implications when a username is used with another source.
- Username (deny): Deny the flow if the username address is already used.
## Minor changes
- Improved compatibility of the flow interface with password managers.
- Improved compatibility when using SAML Sources with a redirect binding.
- Improved configurability of outpost docker image name for managed Outposts.
- Add customization of access code validity for OAuth2 Providers.
- Add ability to configure no login fields on identification stage to only allow logins with Sources.
- Add single-use flag for invitations to delete token after use.
- Fix sidebar not collapsible on mobile.
- Improved compatibility of the flow interface with password managers.
- Improved compatibility when using SAML Sources with a redirect binding.
- Improved configurability of outpost docker image name for managed Outposts.
- Add customization of access code validity for OAuth2 Providers.
- Add ability to configure no login fields on identification stage to only allow logins with Sources.
- Add single-use flag for invitations to delete token after use.
- Fix sidebar not collapsible on mobile.
## Fixed in 2021.5.2
- core: fix application's slug field not being set to unique
- flows: fix error when using cancel flow
- lib: Fix config loading of secrets from files (#887)
- lib: fix parsing of remote IP header when behind multiple reverse proxies
- lifecycle: check if group of docker socket exists
- lifecycle: fix error when worker is not running as root
- outposts: fix error when controller loads from cache but cache has expired
- outposts: fix missing default for OutpostState.for_channel
- outposts: fix reload notification not working due to wrong ID being cached
- outposts/ldap: fix AUTHENTIK_INSECURE not being respected for API client during bind
- outposts/proxy: fix error redeeming code when using non-standard ports
- outposts/proxy: fix insecure TLS Skip
- providers/ldap: use username instead of name for user dn (#883)
- providers/proxy: connect ingress to https instead of http
- root: only load debug secret key when debug is enabled
- web: fix chunks overwriting each other
- web/admin: add notice for LDAP Provider's group selection
- web/admin: fix PropertyMappings not loading correctly
- website/docs: add example ldapsearch command
- core: fix application's slug field not being set to unique
- flows: fix error when using cancel flow
- lib: Fix config loading of secrets from files (#887)
- lib: fix parsing of remote IP header when behind multiple reverse proxies
- lifecycle: check if group of docker socket exists
- lifecycle: fix error when worker is not running as root
- outposts: fix error when controller loads from cache but cache has expired
- outposts: fix missing default for OutpostState.for_channel
- outposts: fix reload notification not working due to wrong ID being cached
- outposts/ldap: fix AUTHENTIK_INSECURE not being respected for API client during bind
- outposts/proxy: fix error redeeming code when using non-standard ports
- outposts/proxy: fix insecure TLS Skip
- providers/ldap: use username instead of name for user dn (#883)
- providers/proxy: connect ingress to https instead of http
- root: only load debug secret key when debug is enabled
- web: fix chunks overwriting each other
- web/admin: add notice for LDAP Provider's group selection
- web/admin: fix PropertyMappings not loading correctly
- website/docs: add example ldapsearch command
## Fixed in 2021.5.3
- outposts: fix update signal not being sent to correct instances
- providers/oauth2: fix double login required when prompt=login
- providers/proxy: fix redirect_uris not always being set on save
- sources/plex: force setting of plex token
- web: fix t.reset is not a function
- web: remove nginx config, add caching headers to static files
- web/admin: fix flow form not loading data
- outposts: fix update signal not being sent to correct instances
- providers/oauth2: fix double login required when prompt=login
- providers/proxy: fix redirect_uris not always being set on save
- sources/plex: force setting of plex token
- web: fix t.reset is not a function
- web: remove nginx config, add caching headers to static files
- web/admin: fix flow form not loading data
## Fixed in 2021.5.4
- providers/oauth2: add missing kid header to JWT Tokens
- stages/authenticator\_\*: fix Permission Error when disabling Authenticator as non-superuser
- web: fix missing flow and policy cache clearing UI
- web: set x-forwarded-proto based on upstream TLS Status
- providers/oauth2: add missing kid header to JWT Tokens
- stages/authenticator\_\*: fix Permission Error when disabling Authenticator as non-superuser
- web: fix missing flow and policy cache clearing UI
- web: set x-forwarded-proto based on upstream TLS Status
## Upgrading

230
website/docs/releases/2021/v2021.6.md
View File

@ -5,161 +5,161 @@ slug: "/releases/2021.6"
## Headline Changes
- Duo two-factor support
- Duo two-factor support
You can now add the new `authenticator_duo` stage to configure Duo authenticators. Duo has also been added as device class to the `authenticator_validation` stage.
Currently, only Duo push notifications are supported. Because no additional input is required, Duo also works with the LDAP Outpost.
- Multi-tenancy
- Multi-tenancy
This version adds soft multi-tenancy. This means you can configure different branding settings and different default flows per domain.
This also changes how a default flow is determined. Previously, for defaults flow, authentik would pick the first flow that
- matches the required designation
- comes first sorted by slug
- is allowed by policies
- matches the required designation
- comes first sorted by slug
- is allowed by policies
Now, authentik first checks if the current tenant has a default flow configured for the selected designation. If not, it behaves the same as before, meaning that if you want to select a default flow based on policy, you can just leave the tenant default empty.
- Domain-level authorization with proxy providers
- Domain-level authorization with proxy providers
Instead of simply being able to toggle between forward auth and proxy mode, you can now enable forward auth for an entire domain. This has the downside that you can't do per-application authorization, but also simplifies configuration as you don't have to create each application in authentik.
- API Schema now uses OpenAPI v3
- API Schema now uses OpenAPI v3
The API endpoints are mostly the same, however all the clients are now built from an OpenAPI v3 schema. You can retrieve the schema from `authentik.company.tld/api/v2beta/schema/`
- On Kubernetes installs without a /media PVC, you can now set URLs instead of uploading files.
- Expanded prometheus metrics for PolicyEngine and FlowPlanner
- On Kubernetes installs without a /media PVC, you can now set URLs instead of uploading files.
- Expanded prometheus metrics for PolicyEngine and FlowPlanner
## Minor changes
- You can now specify which sources should be shown on an Identification stage.
- Add UI for the reputation of IPs and usernames for reputation policies.
- Fix proxy outpost not being able to redeem tokens when using with an un-trusted SSL Certificate
- Add UI to check access of any application for any user
- You can now specify which sources should be shown on an Identification stage.
- Add UI for the reputation of IPs and usernames for reputation policies.
- Fix proxy outpost not being able to redeem tokens when using with an un-trusted SSL Certificate
- Add UI to check access of any application for any user
## Fixed in 2021.6.1-rc5
- flows: fix configuration URL being set when no flow is configure
- stages/authenticator_totp: set TOTP issuer based on slug'd tenant title
- stages/authenticator_webauthn: use tenant title as RP_NAME
- stages/identification: add UPN
- stages/password: add constants for password backends
- web: fix flow download link
- flows: fix configuration URL being set when no flow is configure
- stages/authenticator_totp: set TOTP issuer based on slug'd tenant title
- stages/authenticator_webauthn: use tenant title as RP_NAME
- stages/identification: add UPN
- stages/password: add constants for password backends
- web: fix flow download link
## Fixed in 2021.6.1-rc6
- ci: build and push stable tag when rc not in release name
- core: delete real session when AuthenticatedSession is deleted
- core: fix impersonation not working with inactive users
- core: fix upload api not checking clear properly
- core: revert check_access API to get to prevent CSRF errors
- events: add tenant to event
- events: catch unhandled exceptions from request as event, add button to open github issue
- flows: fix error clearing flow background when no files have been uploaded
- outpost: fix syntax error when creating an outpost with connection
- outposts: fix integrity error with tokens
- outposts/ldap: improve responses for unsuccessful binds
- policies/reputation: fix race condition in tests
- provider/proxy: mark forward_auth flag as deprecated
- providers/saml: improve error handling for signature errors
- root: fix build_hash being set incorrectly for tagged versions
- sources/saml: check sessions before deleting user
- stages/authenticator_duo: don't create default duo stage
- stages/authenticator_validate: add tests for authenticator validation
- stages/identification: fix challenges not being annotated correctly and API client not loading data correctly
- web: add capabilities to sentry event
- web: migrate banner to sidebar
- web/admin: fix user enable/disable modal not matching other modals
- web/admin: select service connection by default when only one exists
- web/flows: fix expiry not shown on consent stage when loading
- web/flows: fix IdentificationStage's label not matching fields
- web/flows: improve display of allowed fields for identification stage
- website/docs: add docs for outpost configuration
- ci: build and push stable tag when rc not in release name
- core: delete real session when AuthenticatedSession is deleted
- core: fix impersonation not working with inactive users
- core: fix upload api not checking clear properly
- core: revert check_access API to get to prevent CSRF errors
- events: add tenant to event
- events: catch unhandled exceptions from request as event, add button to open github issue
- flows: fix error clearing flow background when no files have been uploaded
- outpost: fix syntax error when creating an outpost with connection
- outposts: fix integrity error with tokens
- outposts/ldap: improve responses for unsuccessful binds
- policies/reputation: fix race condition in tests
- provider/proxy: mark forward_auth flag as deprecated
- providers/saml: improve error handling for signature errors
- root: fix build_hash being set incorrectly for tagged versions
- sources/saml: check sessions before deleting user
- stages/authenticator_duo: don't create default duo stage
- stages/authenticator_validate: add tests for authenticator validation
- stages/identification: fix challenges not being annotated correctly and API client not loading data correctly
- web: add capabilities to sentry event
- web: migrate banner to sidebar
- web/admin: fix user enable/disable modal not matching other modals
- web/admin: select service connection by default when only one exists
- web/flows: fix expiry not shown on consent stage when loading
- web/flows: fix IdentificationStage's label not matching fields
- web/flows: improve display of allowed fields for identification stage
- website/docs: add docs for outpost configuration
## Fixed in 2021.6.1
- core: fix error getting stages when enrollment flow isn't set
- core: fix error when creating AuthenticatedSession without key
- flows: fix error when stage has incorrect type
- providers/saml: add support for NameID type unspecified
- providers/saml: fix error when getting transient user identifier
- providers/saml: fix NameIDPolicy not being parsed correctly
- recovery: fix error when creating multiple keys for the same user
- stages/authenticator_duo: fix error when enrolling an existing user
- stages/authenticator_duo: make Duo-admin viewset writeable
- website/docs: remove migrate command
- core: fix error getting stages when enrollment flow isn't set
- core: fix error when creating AuthenticatedSession without key
- flows: fix error when stage has incorrect type
- providers/saml: add support for NameID type unspecified
- providers/saml: fix error when getting transient user identifier
- providers/saml: fix NameIDPolicy not being parsed correctly
- recovery: fix error when creating multiple keys for the same user
- stages/authenticator_duo: fix error when enrolling an existing user
- stages/authenticator_duo: make Duo-admin viewset writeable
- website/docs: remove migrate command
## Fixed in 2021.6.2
- core: add support for custom urls for avatars
- core: deepmerge user.group_attributes, use group_attributes for user settings
- core: fix PropertyMapping's globals not matching Expression policy
- core: remove default flow background from default css, set static in base_full and dynamically in if/flow
- crypto: catch error when loading private key
- flows: make flow plan cache timeout configurable
- outposts: fix port and inner_port being mixed on docker controller
- outposts/proxy: fix additionalHeaders not being set properly
- policies: don't use policy cache when checking application access
- policies: make policy result cache timeout configurable
- root: allow loading local /static files without debug flag
- root: make general cache timeouts configurable
- root: remove old traefik labels
- root: save temporary database dump in /tmp
- root: set outposts.docker_image_base to gh-master for tests
- stages/authenticator_validate: fix error when using not_configured_action=configure
- tenants: fix tenant not being queried correctly when using accessing over a child domain
- web/admin: fix tenant's default flag not being saved
- web/admin: handle elements in slot=form not being forms
- web/admin: sort inputs on authenticator validation stage form
- core: add support for custom urls for avatars
- core: deepmerge user.group_attributes, use group_attributes for user settings
- core: fix PropertyMapping's globals not matching Expression policy
- core: remove default flow background from default css, set static in base_full and dynamically in if/flow
- crypto: catch error when loading private key
- flows: make flow plan cache timeout configurable
- outposts: fix port and inner_port being mixed on docker controller
- outposts/proxy: fix additionalHeaders not being set properly
- policies: don't use policy cache when checking application access
- policies: make policy result cache timeout configurable
- root: allow loading local /static files without debug flag
- root: make general cache timeouts configurable
- root: remove old traefik labels
- root: save temporary database dump in /tmp
- root: set outposts.docker_image_base to gh-master for tests
- stages/authenticator_validate: fix error when using not_configured_action=configure
- tenants: fix tenant not being queried correctly when using accessing over a child domain
- web/admin: fix tenant's default flag not being saved
- web/admin: handle elements in slot=form not being forms
- web/admin: sort inputs on authenticator validation stage form
## Fixed in 2021.6.3
- api: use partition instead of split for token
- core: fix flow background not correctly loading on initial draw
- events: add ability to create events via API
- events: ignore notification non-existent in transport
- events: only create SYSTEM_EXCEPTION event when error would've been sent to sentry
- expressions: fix regex_match result being inverted
- flows: add FlowStageBinding to flow plan instead of just stage
- flows: add invalid_response_action to configure how the FlowExecutor should handle invalid responses
- flows: handle possible errors with FlowPlans received from cache
- outposts: check docker container ports match
- outposts/ldap: fixed IsActive and IsSuperuser returning swapped incorrect values (#1078)
- providers/oauth2: fix exp of JWT when not using seconds
- sources/ldap: improve error handling when checking for password complexity on non-ad setups
- stages/authenticator_duo: fix component not being set in API
- stages/prompt: ensure hidden and static fields keep the value they had set
- stages/user_write: add flag to create new users as inactive
- tenants: include all default flows in current_tenant
- web/admin: fix deletion of authenticator not reloading the state correctly
- web/admin: fix only recovery flows being selectable for unenrollment flow in tenant form
- web/admin: fix text color on pf-c-card
- api: use partition instead of split for token
- core: fix flow background not correctly loading on initial draw
- events: add ability to create events via API
- events: ignore notification non-existent in transport
- events: only create SYSTEM_EXCEPTION event when error would've been sent to sentry
- expressions: fix regex_match result being inverted
- flows: add FlowStageBinding to flow plan instead of just stage
- flows: add invalid_response_action to configure how the FlowExecutor should handle invalid responses
- flows: handle possible errors with FlowPlans received from cache
- outposts: check docker container ports match
- outposts/ldap: fixed IsActive and IsSuperuser returning swapped incorrect values (#1078)
- providers/oauth2: fix exp of JWT when not using seconds
- sources/ldap: improve error handling when checking for password complexity on non-ad setups
- stages/authenticator_duo: fix component not being set in API
- stages/prompt: ensure hidden and static fields keep the value they had set
- stages/user_write: add flag to create new users as inactive
- tenants: include all default flows in current_tenant
- web/admin: fix deletion of authenticator not reloading the state correctly
- web/admin: fix only recovery flows being selectable for unenrollment flow in tenant form
- web/admin: fix text color on pf-c-card
## Fixed in 2021.6.4
- core: only show `Reset password` link when recovery flow is configured
- crypto: show both sha1 and sha256 fingerprints
- flows: handle old cached flow plans better
- g: fix static and media caching not working properly
- outposts: fix container not being started after creation
- outposts: fix docker controller not checking env correctly
- outposts: fix docker controller not checking ports correctly
- outposts: fix empty message when docker outpost controller has changed nothing
- outposts: fix permissions not being set correctly upon outpost creation
- outposts/ldap: add support for boolean fields in ldap
- outposts/proxy: always redirect to session-end interface on sign_out
- providers/oauth2: add revoked field, create suspicious event when previous token is used
- providers/oauth2: deepmerge claims
- providers/oauth2: fix CORS headers not being set for unsuccessful requests
- providers/oauth2: use self.expires for exp field instead of calculating it again
- sources/oauth: create configuration error event when profile can't be parsed as json
- stages/user_write: add wrapper for post to user_write
- web/admin: fix ModelForm not re-loading after being reset
- web/admin: show oauth2 token revoked status
- core: only show `Reset password` link when recovery flow is configured
- crypto: show both sha1 and sha256 fingerprints
- flows: handle old cached flow plans better
- g: fix static and media caching not working properly
- outposts: fix container not being started after creation
- outposts: fix docker controller not checking env correctly
- outposts: fix docker controller not checking ports correctly
- outposts: fix empty message when docker outpost controller has changed nothing
- outposts: fix permissions not being set correctly upon outpost creation
- outposts/ldap: add support for boolean fields in ldap
- outposts/proxy: always redirect to session-end interface on sign_out
- providers/oauth2: add revoked field, create suspicious event when previous token is used
- providers/oauth2: deepmerge claims
- providers/oauth2: fix CORS headers not being set for unsuccessful requests
- providers/oauth2: use self.expires for exp field instead of calculating it again
- sources/oauth: create configuration error event when profile can't be parsed as json
- stages/user_write: add wrapper for post to user_write
- web/admin: fix ModelForm not re-loading after being reset
- web/admin: show oauth2 token revoked status
## Upgrading

156
website/docs/releases/2021/v2021.7.md
View File

@ -5,107 +5,107 @@ slug: "/releases/2021.7"
## Headline Changes
- SSL Support for LDAP Providers
- SSL Support for LDAP Providers
You can now configure certificates for your LDAP Providers, meaning that all communication will be done encrypted.
Currently, only SSL on port 636 is supported, not StartTLS.
- Add bundled docs
- Add bundled docs
You can now browse the authentik docs for your version by browsing to `/help`. This means you don't have to rely on an
internet connection to check the docs, and you also have the correct docs for your currently running version.
## Minor changes
- api: Tunnel Sentry requests through authentik to prevent them being blocked by ad-blockers
- core: fix error when setting icon/background to url longer than 100 chars
- events: fix error when slack notification request failed without a response
- flows: allow variable substitution in flow titles
- outposts/ldap: Fix LDAP outpost missing a `member` field on groups with all member DNs
- outposts/ldap: Fix LDAP outpost not parsing arrays from user and group attributes correctly
- providers/oauth2: allow blank redirect_uris to allow any redirect_uri
- providers/saml: fix parsing of POST bindings
- root: add PROXY protocol support for http, https, ldap and ldaps servers
- root: Allow configuration of Redis port
- root: set samesite to None for SAML POST flows
- root: subclass SessionMiddleware to set Secure and SameSite flag depending on context
- web: fix error when showing error message of request
- api: Tunnel Sentry requests through authentik to prevent them being blocked by ad-blockers
- core: fix error when setting icon/background to url longer than 100 chars
- events: fix error when slack notification request failed without a response
- flows: allow variable substitution in flow titles
- outposts/ldap: Fix LDAP outpost missing a `member` field on groups with all member DNs
- outposts/ldap: Fix LDAP outpost not parsing arrays from user and group attributes correctly
- providers/oauth2: allow blank redirect_uris to allow any redirect_uri
- providers/saml: fix parsing of POST bindings
- root: add PROXY protocol support for http, https, ldap and ldaps servers
- root: Allow configuration of Redis port
- root: set samesite to None for SAML POST flows
- root: subclass SessionMiddleware to set Secure and SameSite flag depending on context
- web: fix error when showing error message of request
## Fixed in 2021.7.1-rc2
- core: add email filter for user
- core: add group filter by member username and pk
- core: broaden error catching for propertymappings
- lib: fix outpost fake-ip not working, add tests
- outpost: fix 100% CPU Usage when not connected to websocket
- outposts: ensure outpost SAs always have permissions to fake IP
- outposts: fix git hash not being set in outposts
- outposts: save certificate fingerprint and check before re-fetching to cleanup logs
- outposts/ldap: add tracing for LDAP bind and search
- outposts/ldap: improve parsing of LDAP filters
- outposts/ldap: optimise backend Search API requests
- outposts/proxy: add X-Auth-Groups header to pass groups
- providers/oauth2: handler PropertyMapping exceptions and create event
- providers/saml: improve error handling for property mappings
- sources/ldap: improve error handling for property mappings
- web: fix icon flashing in header, fix notification header icon in dark mode
- web: separate websocket connection from messages
- web/admin: fix missing dark theme for notifications
- web/admin: fix negative count for policies when more cached than total policies
- web/admin: improve UI for notification toggle
- website/docs: clear up outpost uuids
- website/docs: remove duplicate proxy docs
- core: add email filter for user
- core: add group filter by member username and pk
- core: broaden error catching for propertymappings
- lib: fix outpost fake-ip not working, add tests
- outpost: fix 100% CPU Usage when not connected to websocket
- outposts: ensure outpost SAs always have permissions to fake IP
- outposts: fix git hash not being set in outposts
- outposts: save certificate fingerprint and check before re-fetching to cleanup logs
- outposts/ldap: add tracing for LDAP bind and search
- outposts/ldap: improve parsing of LDAP filters
- outposts/ldap: optimise backend Search API requests
- outposts/proxy: add X-Auth-Groups header to pass groups
- providers/oauth2: handler PropertyMapping exceptions and create event
- providers/saml: improve error handling for property mappings
- sources/ldap: improve error handling for property mappings
- web: fix icon flashing in header, fix notification header icon in dark mode
- web: separate websocket connection from messages
- web/admin: fix missing dark theme for notifications
- web/admin: fix negative count for policies when more cached than total policies
- web/admin: improve UI for notification toggle
- website/docs: clear up outpost uuids
- website/docs: remove duplicate proxy docs
## Fixed in 2021.7.1
- core: add tests for flow_manager
- core: fix CheckApplication's for_user flag not being checked correctly
- core: fix pagination not working correctly with applications API
- providers/oauth2: fix blank redirect_uri not working with TokenView
- root: add code of conduct and PR template
- root: add contributing file
- tenants: make event retention configurable on tenant level
- tenants: set tenant uuid in sentry
- web/admin: add notice for event_retention
- web/admin: add status card for https and timedrift
- web/admin: default to authentication flow for LDAP provider
- web/admin: fix ApplicationView's CheckAccess not sending UserID correctly
- website/docs: add go requirement
- website/docs: update terminology for dark mode
- core: add tests for flow_manager
- core: fix CheckApplication's for_user flag not being checked correctly
- core: fix pagination not working correctly with applications API
- providers/oauth2: fix blank redirect_uri not working with TokenView
- root: add code of conduct and PR template
- root: add contributing file
- tenants: make event retention configurable on tenant level
- tenants: set tenant uuid in sentry
- web/admin: add notice for event_retention
- web/admin: add status card for https and timedrift
- web/admin: default to authentication flow for LDAP provider
- web/admin: fix ApplicationView's CheckAccess not sending UserID correctly
- website/docs: add go requirement
- website/docs: update terminology for dark mode
## Fixed in 2021.7.2
- ci: fix sentry sourcemap path
- e2e: fix broken selenium by locking images
- events: ensure fallback result is set for on_failure
- events: remove default result for MonitoredTasks, only save when result was set
- flows: don't check redirect URL when set from flow plan (set from authentik or policy)
- flows: fix unhandled error in stage execution not being logged as SYSTEM_EXCEPTION event
- outpost: bump timer for periodic config reloads
- outposts: catch invalid ServiceConnection error in outpost controller
- providers/oauth2: fix error when requesting jwks keys with no rs256 aet
- providers/proxy: fix hosts for ingress not being compared correctly
- providers/saml: fix Error when getting metadata for invalid ID
- providers/saml: fix metadata being inaccessible without authentication
- sources/ldap: improve ms-ad password complexity checking
- sources/plex: add background task to monitor validity of plex token
- stages/email: fix error when re-requesting email after token has expired
- stages/invitation: delete invite only after full enrollment flow is completed
- web/admin: add re-authenticate button for plex
- web/admin: add UI to copy invitation link
- web/admin: fix empty column when no invitation expiry was set
- web/admin: fix LDAP Provider bind flow list being empty
- web/admin: fully remove response cloning due to errors
- ci: fix sentry sourcemap path
- e2e: fix broken selenium by locking images
- events: ensure fallback result is set for on_failure
- events: remove default result for MonitoredTasks, only save when result was set
- flows: don't check redirect URL when set from flow plan (set from authentik or policy)
- flows: fix unhandled error in stage execution not being logged as SYSTEM_EXCEPTION event
- outpost: bump timer for periodic config reloads
- outposts: catch invalid ServiceConnection error in outpost controller
- providers/oauth2: fix error when requesting jwks keys with no rs256 aet
- providers/proxy: fix hosts for ingress not being compared correctly
- providers/saml: fix Error when getting metadata for invalid ID
- providers/saml: fix metadata being inaccessible without authentication
- sources/ldap: improve ms-ad password complexity checking
- sources/plex: add background task to monitor validity of plex token
- stages/email: fix error when re-requesting email after token has expired
- stages/invitation: delete invite only after full enrollment flow is completed
- web/admin: add re-authenticate button for plex
- web/admin: add UI to copy invitation link
- web/admin: fix empty column when no invitation expiry was set
- web/admin: fix LDAP Provider bind flow list being empty
- web/admin: fully remove response cloning due to errors
## Fixed in 2021.7.3
- core: fix users not being able to update their profile
- lifecycle: decrease default worker count on compose
- providers/saml: fix error when WantAssertionsSigned is missing
- providers/saml: fix error when PropertyMapping return value isn't string
- web/admin: fix user's email field being required
- web/admin: fix source form's userMatchingMode being swapped
- core: fix users not being able to update their profile
- lifecycle: decrease default worker count on compose
- providers/saml: fix error when WantAssertionsSigned is missing
- providers/saml: fix error when PropertyMapping return value isn't string
- web/admin: fix user's email field being required
- web/admin: fix source form's userMatchingMode being swapped
## Upgrading

200
website/docs/releases/2021/v2021.8.md
View File

@ -5,14 +5,14 @@ slug: "/releases/2021.8"
## Headline Changes
- Embedded Outpost
- Embedded Outpost
To simplify the setup, an embedded outpost has been added. This outpost runs as part of the main authentik server, and requires no additional setup.
You can simply assign providers to the embedded outpost, and either use the integrations to configure reverse proxies, or point your traffic to the main authentik server.
Traffic is routed based on host-header, meaning every host that has been configured as a provider and is assigned to the embedded proxy will be sent to the outpost, and every sub-path under `/outpost.goauthentik.io` is sent to the outpost too. The rest is sent to authentik itself.
- App passwords
- App passwords
You can now create Tokens with the intent `app_password`, and use them when authenticating with a flow. This requires the `User database + app passwords` backend in your password stage (this is done automatically on upgrade).
@ -20,122 +20,122 @@ slug: "/releases/2021.8"
## Minor changes
- admin: add API to show embedded outpost status, add notice when its not configured properly
- api: ensure all resources can be filtered
- api: make all PropertyMappings filterable by multiple managed attributes
- core: add API to directly send recovery link to user
- core: add UserSelfSerializer and separate method for users to update themselves with limited fields
- core: allow changing of groups a user is in from user api
- flows: fix unhandled error in stage execution not being logged as SYSTEM_EXCEPTION event
- lifecycle: decrease default worker count on compose
- outpost/ldap: Performance improvements, support for (member=) lookup
- providers/proxy: don't create ingress when no hosts are defined
- sources/plex: add API to get user connections
- web: add API Drawer
- web/admin: add UI to copy invitation link
- web/admin: allow modification of users groups from user view
- web/admin: re-name service connection to integration
- admin: add API to show embedded outpost status, add notice when its not configured properly
- api: ensure all resources can be filtered
- api: make all PropertyMappings filterable by multiple managed attributes
- core: add API to directly send recovery link to user
- core: add UserSelfSerializer and separate method for users to update themselves with limited fields
- core: allow changing of groups a user is in from user api
- flows: fix unhandled error in stage execution not being logged as SYSTEM_EXCEPTION event
- lifecycle: decrease default worker count on compose
- outpost/ldap: Performance improvements, support for (member=) lookup
- providers/proxy: don't create ingress when no hosts are defined
- sources/plex: add API to get user connections
- web: add API Drawer
- web/admin: add UI to copy invitation link
- web/admin: allow modification of users groups from user view
- web/admin: re-name service connection to integration
## Fixed in 2021.8.1-rc2
- ci: add pipeline to build and push js api package
- ci: upgrade web api client when schema changes
- core: add new token intent and auth backend (#1284)
- core: add token tests for invalid intent and token auth
- core: fix token intent not defaulting correctly
- core: handle error when ?for_user is not numerical
- lib: move id and key generators to lib (#1286)
- lifecycle: rename to ak
- outpost: handle non-existent permission
- outpost: add recursion limit for docker controller
- outpost: add repair_permissions command
- root: add alias for akflow files
- root: add ASGI Error handler
- root: add License to NPM package
- root: fix error_handler for websocket
- root: fix mis-matched postgres version for CI
- root: remove remainders from gen
- root: remove usage of make-gen
- root: test schema auto-update
- root: update schema
- stages/password: auto-enable app password backend
- stages/user_write: fix wrong fallback authentication backend
- web: add custom readme to api client
- web: add ESM to generated Client
- web: build. api in different folder
- web: improve api client versioning
- web: Merge pull request #1258 from goauthentik/publish-api-to-npm
- web: migrate to @goauthentik/api
- web: Update Web API Client version (#1283)
- web/admin: allow users to create app password tokens
- web/admin: display token's intents
- web/admin: fix missing app passwords backend
- web/admin: improve delete modal for stage bindings and policy bindings
- web/admin: select all password stage backends by default
- website: add docs for making schema changes
- website: make default login-2fa flow ignore 2fa with app passwords
- website/docs: add docs for `auth_method` and `auth_method_args` fields
- ci: add pipeline to build and push js api package
- ci: upgrade web api client when schema changes
- core: add new token intent and auth backend (#1284)
- core: add token tests for invalid intent and token auth
- core: fix token intent not defaulting correctly
- core: handle error when ?for_user is not numerical
- lib: move id and key generators to lib (#1286)
- lifecycle: rename to ak
- outpost: handle non-existent permission
- outpost: add recursion limit for docker controller
- outpost: add repair_permissions command
- root: add alias for akflow files
- root: add ASGI Error handler
- root: add License to NPM package
- root: fix error_handler for websocket
- root: fix mis-matched postgres version for CI
- root: remove remainders from gen
- root: remove usage of make-gen
- root: test schema auto-update
- root: update schema
- stages/password: auto-enable app password backend
- stages/user_write: fix wrong fallback authentication backend
- web: add custom readme to api client
- web: add ESM to generated Client
- web: build. api in different folder
- web: improve api client versioning
- web: Merge pull request #1258 from goauthentik/publish-api-to-npm
- web: migrate to @goauthentik/api
- web: Update Web API Client version (#1283)
- web/admin: allow users to create app password tokens
- web/admin: display token's intents
- web/admin: fix missing app passwords backend
- web/admin: improve delete modal for stage bindings and policy bindings
- web/admin: select all password stage backends by default
- website: add docs for making schema changes
- website: make default login-2fa flow ignore 2fa with app passwords
- website/docs: add docs for `auth_method` and `auth_method_args` fields
## Fixed in 2021.8.1
- \*: cleanup api schema warnings
- core: fix error for asgi error handler with websockets
- core: fix error when user updates themselves
- core: fix user object for token not be set-able
- root: Fix table of contents for CONTRIBUTING.md (#1302)
- root: Require PG_PASS to be set (#1303)
- web/admin: allow admins to create tokens
- \*: cleanup api schema warnings
- core: fix error for asgi error handler with websockets
- core: fix error when user updates themselves
- core: fix user object for token not be set-able
- root: Fix table of contents for CONTRIBUTING.md (#1302)
- root: Require PG_PASS to be set (#1303)
- web/admin: allow admins to create tokens
## Fixed in 2021.8.2
- root: fix login loop created by old settings stored in cache
- root: fix login loop created by old settings stored in cache
## Fixed in 2021.8.3
- outpost: fix FlowExecutor not sending password for identification stage
- outpost: fix generated traefik labels containing invalid hosts
- outpost: make docker network configurable when using docker integration
- web/flow: fix redirects to application being sent multiple times, causing issues with OAuth providers
- web/flow: fix rendering of checkboxes in prompt stages
- outpost: fix FlowExecutor not sending password for identification stage
- outpost: fix generated traefik labels containing invalid hosts
- outpost: make docker network configurable when using docker integration
- web/flow: fix redirects to application being sent multiple times, causing issues with OAuth providers
- web/flow: fix rendering of checkboxes in prompt stages
## Fixed in 2021.8.4
- api: add /api/v3 path
- api: add basic rate limiting for sentry proxy endpoint
- core: fix user_obj being empty on token API
- events: improve logging for task exceptions
- outpost/embedded: only send requests for non-akprox paths when we're doing proxy mode
- outpost/ldap: delay user information removal upon closing of connection
- policies/password: fix PasswordStage not being usable with prompt stages
- providers/proxy: fix traefik middleware being generated with wrong ports for embedded outposts
- providers/proxy: improve error handling for non-tls ingresses
- stages/authenticator_validate: show single button for multiple webauthn authenticators
- stages/invitation: fix invitation not inheriting ExpiringModel
- web/admin: fallback for invitation list on first load
- web/admin: fix flow executor not opening in new tab
- web/admin: fix list of webauthn devices not updating after rename
- web/flows: fix FlowExecutor not updating when challenge changes from outside
- api: add /api/v3 path
- api: add basic rate limiting for sentry proxy endpoint
- core: fix user_obj being empty on token API
- events: improve logging for task exceptions
- outpost/embedded: only send requests for non-akprox paths when we're doing proxy mode
- outpost/ldap: delay user information removal upon closing of connection
- policies/password: fix PasswordStage not being usable with prompt stages
- providers/proxy: fix traefik middleware being generated with wrong ports for embedded outposts
- providers/proxy: improve error handling for non-tls ingresses
- stages/authenticator_validate: show single button for multiple webauthn authenticators
- stages/invitation: fix invitation not inheriting ExpiringModel
- web/admin: fallback for invitation list on first load
- web/admin: fix flow executor not opening in new tab
- web/admin: fix list of webauthn devices not updating after rename
- web/flows: fix FlowExecutor not updating when challenge changes from outside
## Fixed in 2021.8.5
- api: add additional filters for ldap and proxy providers
- api: cache schema, fix server urls
- core: minor query optimization
- events: add mark_all_seen
- events: remove authentik_events gauge
- internal: disable directory listing on static files
- internal: fix font loading errors on safari
- internal: fix web requests not having a logger set
- outpost: fix spans being sent without parent context
- outposts: add expected outpost replica count to metrics
- outposts/ldap: improve logging of client IPs
- policies/password: fix symbols not being checked correctly
- root: fix is_secure with safari on debug environments
- root: include authentik version in backup naming
- stages/identification: fix empty user_fields query returning first user
- web/admin: fix user selection in token form
- web/admin: show applications instead of providers in outpost form
- web/flows: fix display error when using IdentificationStage without input fields
- api: add additional filters for ldap and proxy providers
- api: cache schema, fix server urls
- core: minor query optimization
- events: add mark_all_seen
- events: remove authentik_events gauge
- internal: disable directory listing on static files
- internal: fix font loading errors on safari
- internal: fix web requests not having a logger set
- outpost: fix spans being sent without parent context
- outposts: add expected outpost replica count to metrics
- outposts/ldap: improve logging of client IPs
- policies/password: fix symbols not being checked correctly
- root: fix is_secure with safari on debug environments
- root: include authentik version in backup naming
- stages/identification: fix empty user_fields query returning first user
- web/admin: fix user selection in token form
- web/admin: show applications instead of providers in outpost form
- web/flows: fix display error when using IdentificationStage without input fields
## Upgrading

266
website/docs/releases/2021/v2021.9.md
View File

@ -5,7 +5,7 @@ slug: "/releases/2021.9"
## Headline Changes
- Split user interface
- Split user interface
This release splits the administration interface from the end-user interface. This makes things clearer for end-users, as all their options are laid out more clearly.
@ -13,7 +13,7 @@ slug: "/releases/2021.9"
The admin interface remains the same, and familiar buttons will redirect you between interfaces.
- New proxy
- New proxy
The proxy outpost has been rewritten from scratch. This replaces the old proxy, which was based on oauth2_proxy. The new proxy allows us a much greater degree of flexibility, is much lighter and reports errors better.
@ -23,7 +23,7 @@ slug: "/releases/2021.9"
If you're using a manually deployed outpost, keep in mind that the ports change to 9000 and 9443 instead of 4180 and 4443
- New metrics
- New metrics
This version introduces new and simplified Prometheus metrics. There is a new common monitoring port across the server and all outposts, 9300. This port requires no authentication, making it easier to configure.
@ -31,166 +31,166 @@ slug: "/releases/2021.9"
## Minor changes
- \*: use common user agent for all outgoing requests
- admin: migrate to new update check, add option to disable update check
- api: add additional filters for ldap and proxy providers
- core: optimise groups api by removing member superuser status
- core: remove ?v from static files
- events: add mark_all_seen
- events: allow setting a mapping for webhook transport to customise request payloads
- internal: fix font loading errors on safari
- lifecycle: fix worker startup error when docker socket's group is not called docker
- outpost: fix spans being sent without parent context
- outpost: update global outpost config on refresh
- outposts: add expected outpost replica count to metrics
- outposts/controllers: re-create service when mismatched ports to prevent errors
- outposts/controllers/kubernetes: don't create service monitor for embedded outpost
- outposts/ldap: improve logging of client IPs
- policies/password: fix symbols not being checked correctly
- root: include authentik version in backup naming
- root: show location header in logs when redirecting
- sources/oauth: prevent potentially confidential data from being logged
- stages/authenticator_duo: add API to "import" devices from duo
- stages/identification: fix empty user_fields query returning first user
- tenants: optimise db queries in middleware
- web: allow duplicate messages
- web: ignore network error
- web/admin: fix notification clear all not triggering render
- web/admin: fix user selection in token form
- web/admin: increase default expiry for refresh tokens
- web/admin: show applications instead of providers in outpost form
- web/flows: fix display error when using IdentificationStage without input fields
- \*: use common user agent for all outgoing requests
- admin: migrate to new update check, add option to disable update check
- api: add additional filters for ldap and proxy providers
- core: optimise groups api by removing member superuser status
- core: remove ?v from static files
- events: add mark_all_seen
- events: allow setting a mapping for webhook transport to customise request payloads
- internal: fix font loading errors on safari
- lifecycle: fix worker startup error when docker socket's group is not called docker
- outpost: fix spans being sent without parent context
- outpost: update global outpost config on refresh
- outposts: add expected outpost replica count to metrics
- outposts/controllers: re-create service when mismatched ports to prevent errors
- outposts/controllers/kubernetes: don't create service monitor for embedded outpost
- outposts/ldap: improve logging of client IPs
- policies/password: fix symbols not being checked correctly
- root: include authentik version in backup naming
- root: show location header in logs when redirecting
- sources/oauth: prevent potentially confidential data from being logged
- stages/authenticator_duo: add API to "import" devices from duo
- stages/identification: fix empty user_fields query returning first user
- tenants: optimise db queries in middleware
- web: allow duplicate messages
- web: ignore network error
- web/admin: fix notification clear all not triggering render
- web/admin: fix user selection in token form
- web/admin: increase default expiry for refresh tokens
- web/admin: show applications instead of providers in outpost form
- web/flows: fix display error when using IdentificationStage without input fields
## Fixed in 2021.9.1-rc2
- core: fix token expiry for service accounts being only 30 minutes
- outposts: add consistent name and type to metrics
- outposts/proxy: remove deprecated rs256
- policies: improve error handling when using bindings without policy
- providers/saml: improved error handling
- stages/email: don't crash when testing stage does not exist
- web: update background image
- core: fix token expiry for service accounts being only 30 minutes
- outposts: add consistent name and type to metrics
- outposts/proxy: remove deprecated rs256
- policies: improve error handling when using bindings without policy
- providers/saml: improved error handling
- stages/email: don't crash when testing stage does not exist
- web: update background image
## Fixed in 2021.9.1-rc3
- core: allow admins to create tokens with all parameters, re-add user to token form
- core: fix tokens not being viewable but superusers
- root: log failed celery tasks to event log
- sources/ldap: bump timeout, run each sync component in its own task
- sources/ldap: improve messages of sync tasks in UI
- sources/ldap: prevent error when retrying old system task with no arguments
- web: fix datetime-local fields throwing errors on firefox
- web: fix text colour in delete form in dark mode
- web: improve display of action buttons with non-primary classes
- web/admin: fix error in firefox when creating token
- web/admin: fix ldap sync status for new API
- web/admin: fix settings link on user avatar
- web/admin: trigger refresh after syncing ldap
- web/user: add auto-focus search for applications
- web/user: add missing stop impersonation button
- web/user: fix edit button for applications
- web/user: fix final redirect after stage setup
- web/user: optimise load, fix unread status for notifications
- core: allow admins to create tokens with all parameters, re-add user to token form
- core: fix tokens not being viewable but superusers
- root: log failed celery tasks to event log
- sources/ldap: bump timeout, run each sync component in its own task
- sources/ldap: improve messages of sync tasks in UI
- sources/ldap: prevent error when retrying old system task with no arguments
- web: fix datetime-local fields throwing errors on firefox
- web: fix text colour in delete form in dark mode
- web: improve display of action buttons with non-primary classes
- web/admin: fix error in firefox when creating token
- web/admin: fix ldap sync status for new API
- web/admin: fix settings link on user avatar
- web/admin: trigger refresh after syncing ldap
- web/user: add auto-focus search for applications
- web/user: add missing stop impersonation button
- web/user: fix edit button for applications
- web/user: fix final redirect after stage setup
- web/user: optimise load, fix unread status for notifications
## Fixed in 2021.9.1
- api: disable include_format_suffixes
- core: fix token identifier not being slugified when created with user-controller input
- outposts: don't map port 9300 on docker, only expose port
- outposts: don't restart container when health checks are starting
- outposts/ldap: allow custom attributes to shadow built-in attributes
- policies/expression: add ak_user_has_authenticator
- root: use tagged go client version
- stages/email: don't throw 404 when token can't be found
- stages/email: slugify token identifier
- stages/email: use different query arguments for email and invitation tokens
- web: fix notification badge not refreshing after clearing notifications
- api: disable include_format_suffixes
- core: fix token identifier not being slugified when created with user-controller input
- outposts: don't map port 9300 on docker, only expose port
- outposts: don't restart container when health checks are starting
- outposts/ldap: allow custom attributes to shadow built-in attributes
- policies/expression: add ak_user_has_authenticator
- root: use tagged go client version
- stages/email: don't throw 404 when token can't be found
- stages/email: slugify token identifier
- stages/email: use different query arguments for email and invitation tokens
- web: fix notification badge not refreshing after clearing notifications
## Fixed in 2021.9.2
- api: add logging to sentry proxy
- internal: add asset paths for user interface
- web: fix import order of polyfills causing shadydom to not work on firefox and safari
- web/user: enable sentry
- api: add logging to sentry proxy
- internal: add asset paths for user interface
- web: fix import order of polyfills causing shadydom to not work on firefox and safari
- web/user: enable sentry
## Fixed in 2021.9.3
- core: fix api return code for user self-update
- events: add additional validation for event transport
- outposts: ensure service is always re-created with mismatching ports
- outposts: fix outposts not correctly updating central state
- outposts: make AUTHENTIK_HOST_BROWSER configurable from central config
- outposts/proxy: ensure cookies only last as long as tokens
- outposts/proxy: Fix failing traefik healthcheck (#1470)
- outposts/proxyv2: fix routing not working correctly for domain auth
- providers/proxy: add token_validity field for outpost configuration
- web/admin: add notice for recovery
- web/admin: fix NotificationWebhookMapping not loading correctly
- web/admin: fix Transport Form not loading mode correctly on edit
- web/admin: handle error correctly when creating user recovery link
- web/elements: fix token copy error in safari
- web/elements: improve error handling on forms
- web/user: fix brand not being shown in safari
- web/user: search apps when user typed before apps have loaded
- website/docs: fix typos and grammar (#1459)
- core: fix api return code for user self-update
- events: add additional validation for event transport
- outposts: ensure service is always re-created with mismatching ports
- outposts: fix outposts not correctly updating central state
- outposts: make AUTHENTIK_HOST_BROWSER configurable from central config
- outposts/proxy: ensure cookies only last as long as tokens
- outposts/proxy: Fix failing traefik healthcheck (#1470)
- outposts/proxyv2: fix routing not working correctly for domain auth
- providers/proxy: add token_validity field for outpost configuration
- web/admin: add notice for recovery
- web/admin: fix NotificationWebhookMapping not loading correctly
- web/admin: fix Transport Form not loading mode correctly on edit
- web/admin: handle error correctly when creating user recovery link
- web/elements: fix token copy error in safari
- web/elements: improve error handling on forms
- web/user: fix brand not being shown in safari
- web/user: search apps when user typed before apps have loaded
- website/docs: fix typos and grammar (#1459)
## Fixed in 2021.9.4
- outposts: allow disabling of docker controller port mapping
- outposts/proxy: fix duplicate protocol in domain auth mode
- root: Use fully qualified names for docker bases base images. (#1490)
- sources/ldap: add support for Active Directory `userAccountControl` attribute
- sources/ldap: don't sync ldap source when no property mappings are set
- web/admin: don't require username nor name for activate/deactivate toggles
- web/admin: fix LDAP Source form not exposing syncParentGroup
- web/elements: fix initialLoad not being done when viewportCheck was disabled
- web/elements: use dedicated button for search clear instead of webkit exclusive one
- outposts: allow disabling of docker controller port mapping
- outposts/proxy: fix duplicate protocol in domain auth mode
- root: Use fully qualified names for docker bases base images. (#1490)
- sources/ldap: add support for Active Directory `userAccountControl` attribute
- sources/ldap: don't sync ldap source when no property mappings are set
- web/admin: don't require username nor name for activate/deactivate toggles
- web/admin: fix LDAP Source form not exposing syncParentGroup
- web/elements: fix initialLoad not being done when viewportCheck was disabled
- web/elements: use dedicated button for search clear instead of webkit exclusive one
## Fixed in 2021.9.5
- events: add missing migration
- lifecycle: switch to h11 uvicorn worker for now
- outpost/proxy: fix missing negation for internal host ssl verification
- outposts: check ports of deployment in kubernetes outpost controller
- outposts: don't always build permissions on outpost.user access, only in signals and tasks
- outposts: fix circular import in kubernetes controller
- outposts/proxy: add new headers with unified naming
- outposts/proxy: show full error message when user is authenticated
- providers/ldap: use RDN when using posixGroup's memberUid attribute (#1514)
- providers/proxy: always check ingress secret in kubernetes controller
- sources/ldap: fix logic error in Active Directory account disabled status
- stages/email: add activate_user_on_success flag, add for all example flows
- stages/user_login: add check for user.is_active and tests
- tests/integration: fix tests failing due to incorrect comparison
- web/admin: fix search group label
- events: add missing migration
- lifecycle: switch to h11 uvicorn worker for now
- outpost/proxy: fix missing negation for internal host ssl verification
- outposts: check ports of deployment in kubernetes outpost controller
- outposts: don't always build permissions on outpost.user access, only in signals and tasks
- outposts: fix circular import in kubernetes controller
- outposts/proxy: add new headers with unified naming
- outposts/proxy: show full error message when user is authenticated
- providers/ldap: use RDN when using posixGroup's memberUid attribute (#1514)
- providers/proxy: always check ingress secret in kubernetes controller
- sources/ldap: fix logic error in Active Directory account disabled status
- stages/email: add activate_user_on_success flag, add for all example flows
- stages/user_login: add check for user.is_active and tests
- tests/integration: fix tests failing due to incorrect comparison
- web/admin: fix search group label
## Fixed in 2021.9.6
- admin: clear update notification when notification's version matches current version
- api: ensure viewsets have default ordering
- core: include group uuids in self serializer
- core: make user's name field fully options
- core: only return group names for user_self
- internal: add internal healthchecking to prevent websocket errors
- outposts: fix error when comparing ports in docker controller when port mapping is disabled
- root: add docker-native healthcheck for web and celery
- root: remove redundant internal network from compose
- web: add locale detection
- web: fix rendering of token copy button in dark mode
- web: fix strings not being translated at all when matching browser locale not found
- web/admin: only show outpost deployment info when not embedded
- web/elements: fix model form always loading when viewport check is disabled
- web/flows: adjust message for email stage
- web/user: don't show managed tokens in user interface
- admin: clear update notification when notification's version matches current version
- api: ensure viewsets have default ordering
- core: include group uuids in self serializer
- core: make user's name field fully options
- core: only return group names for user_self
- internal: add internal healthchecking to prevent websocket errors
- outposts: fix error when comparing ports in docker controller when port mapping is disabled
- root: add docker-native healthcheck for web and celery
- root: remove redundant internal network from compose
- web: add locale detection
- web: fix rendering of token copy button in dark mode
- web: fix strings not being translated at all when matching browser locale not found
- web/admin: only show outpost deployment info when not embedded
- web/elements: fix model form always loading when viewport check is disabled
- web/flows: adjust message for email stage
- web/user: don't show managed tokens in user interface
## Fixed in 2021.9.7
- root: fix syntax error in dockerfile healthcheck
- web/admin: fix description for flow import
- root: fix syntax error in dockerfile healthcheck
- web/admin: fix description for flow import
## Fixed in 2021.9.8
- web: fix interface crashing in non-blink browsers
- web: fix interface crashing in non-blink browsers
## Upgrading

172
website/docs/releases/2022/v2022.1.md
View File

@ -7,126 +7,126 @@ slug: "/releases/2022.1"
This release mostly removes legacy fields and features that have been deprecated for several releases.
- LDAP Outposts:
- LDAP Outposts:
This release removes the `accountStatus` and `superuser` fields. Use the direct replacements `goauthentik.io/ldap/active` and `goauthentik.io/ldap/superuser`.
- Proxy Outposts:
- Proxy Outposts:
This release consolidates headers sent by authentik to have a common prefix.
The following headers have been removed:
- X-Auth-Username, use `X-authentik-username`
- X-Auth-Groups, use `X-authentik-groups`
- X-Forwarded-Email, use `X-authentik-email`
- X-Forwarded-Preferred-Username, use `X-authentik-username`
- X-Forwarded-User, use `X-authentik-uid`
- X-Auth-Username, use `X-authentik-username`
- X-Auth-Groups, use `X-authentik-groups`
- X-Forwarded-Email, use `X-authentik-email`
- X-Forwarded-Preferred-Username, use `X-authentik-username`
- X-Forwarded-User, use `X-authentik-uid`
The proxy now also sets the host header based on what is configured as upstream in the proxy provider. The original Host is forwarded as `X-Forwarded-Host`.
Additionally, the header requirements for nginx have changed. Either a `X-Original-URL` or `X-Original-URI` header are now required. See the [_Proxy provider_](../../add-secure-apps/providers/proxy/forward_auth.mdx) documentation for updated snippets.
- API:
- API:
The deprecated /api/v2beta/ Endpoint is removed. Use `/api/v3/`.
- Backup:
- Backup:
The integrated backup has been deprecated for the following reasons:
- Difficulty with restores not working properly
- Inflexible configuration (fixed retention, limited to once a day, only S3 supported)
- Most users will already have an existing backup infrastructure
- Difficulty with restores not working properly
- Inflexible configuration (fixed retention, limited to once a day, only S3 supported)
- Most users will already have an existing backup infrastructure
## Minor changes/fixes
- core: dont return 404 when trying to view key of expired token
- crypto: fully parse certificate on validation in serializer to prevent invalid certificates from being saved
- flows: handle error if flow title contains invalid format string
- internal: route traffic to proxy providers based on cookie domain when multiple domain-level providers exist
- internal: use math.MaxInt for compatibility
- lifecycle: add early check for missing/invalid secret key
- outposts/proxyv2: allow access to /outpost.goauthentik.io urls in forward auth mode to make routing in nginx/traefik easier
- outposts/proxyv2: fix before-redirect url not being saved in proxy mode
- outposts/proxyv2: fix JWKS url pointing to localhost on embedded outpost
- providers/oauth2: change default redirect uri behaviour; set first used url when blank and use star for wildcard
- root: allow customisation of ports in compose without override
- root: decrease to 10 backup history
- root: fix backups running every minute instead of once
- stages/authenticator_webauthn: make more WebAuthn options configurable
- web: add polyfill for Intl.ListFormat
- web: directly read csrf token before injecting into request
- web: fix double plural in label
- web/admin: also set embedded outpost host when it doesn't include scheme
- web/admin: fix missing configure flow setting on webuahtn setup stage form
- web/flows: remove node directly instead of using removeChild()
- core: dont return 404 when trying to view key of expired token
- crypto: fully parse certificate on validation in serializer to prevent invalid certificates from being saved
- flows: handle error if flow title contains invalid format string
- internal: route traffic to proxy providers based on cookie domain when multiple domain-level providers exist
- internal: use math.MaxInt for compatibility
- lifecycle: add early check for missing/invalid secret key
- outposts/proxyv2: allow access to /outpost.goauthentik.io urls in forward auth mode to make routing in nginx/traefik easier
- outposts/proxyv2: fix before-redirect url not being saved in proxy mode
- outposts/proxyv2: fix JWKS url pointing to localhost on embedded outpost
- providers/oauth2: change default redirect uri behaviour; set first used url when blank and use star for wildcard
- root: allow customisation of ports in compose without override
- root: decrease to 10 backup history
- root: fix backups running every minute instead of once
- stages/authenticator_webauthn: make more WebAuthn options configurable
- web: add polyfill for Intl.ListFormat
- web: directly read csrf token before injecting into request
- web: fix double plural in label
- web/admin: also set embedded outpost host when it doesn't include scheme
- web/admin: fix missing configure flow setting on webuahtn setup stage form
- web/flows: remove node directly instead of using removeChild()
## Fixed in 2022.1.2
- internal/proxyv2: only allow access to /outpost.goauthentik.io in nginx mode when forward url could be extracted
- lib: disable backup by default, add note to configuration
- lifecycle: replace lowercase, deprecated prometheus_multiproc_dir
- outposts: allow custom label for docker containers
- policies/hibp: ensure password is encodable
- providers/proxy: add PathPrefix to auto-traefik labels
- root: upgrade python dependencies
- internal/proxyv2: only allow access to /outpost.goauthentik.io in nginx mode when forward url could be extracted
- lib: disable backup by default, add note to configuration
- lifecycle: replace lowercase, deprecated prometheus_multiproc_dir
- outposts: allow custom label for docker containers
- policies/hibp: ensure password is encodable
- providers/proxy: add PathPrefix to auto-traefik labels
- root: upgrade python dependencies
## Fixed in 2022.1.3
- internal: add support for X-Original-URL
- internal: add optional debug server listening on 9900
- internal: don't override server header
- internal: start adding tests to outpost
- lifecycle: make secret_key warning more prominent
- lifecycle: wait for db in worker
- outposts/ldap: Fix more case sensitivity issues. (#2144)
- outposts/proxy: add more test cases for domain-level auth
- outposts/proxy: fix potential empty redirect, add tests
- outposts/proxy: trace full headers to debug
- providers/proxy: fix traefik label
- root: add max-requests for gunicorn and max tasks for celery
- root: fix redis passwords not being encoded correctly
- web/admin: fix links which look like labels
- web/admin: fix SMS Stage form not working
- internal: add support for X-Original-URL
- internal: add optional debug server listening on 9900
- internal: don't override server header
- internal: start adding tests to outpost
- lifecycle: make secret_key warning more prominent
- lifecycle: wait for db in worker
- outposts/ldap: Fix more case sensitivity issues. (#2144)
- outposts/proxy: add more test cases for domain-level auth
- outposts/proxy: fix potential empty redirect, add tests
- outposts/proxy: trace full headers to debug
- providers/proxy: fix traefik label
- root: add max-requests for gunicorn and max tasks for celery
- root: fix redis passwords not being encoded correctly
- web/admin: fix links which look like labels
- web/admin: fix SMS Stage form not working
## Fixed in 2022.1.4
- core: fix view_token permission not being assigned on token creation for non-admin user
- lifecycle: remove gunicorn reload option
- lifecycle: send analytics in gunicorn config to decrease outgoing requests when workers get restarted
- providers/proxy: add support for X-Original-URI in nginx, better handle missing headers and report errors to authentik
- providers/proxy: don't include hostname and scheme in redirect when we only got a path and not a full URL
- providers/proxy: fix routing for external_host when using forward_auth_domain
- providers/proxy: set traefik labels using object_naming_template instead of UUID
- sources/ldap: add list_flatten function to property mappings, enable on managed LDAP mappings
- web: add es locale
- web: add pl locale
- web/admin: only check first half of locale when detecting
- web/flows: fix width on flow container
- web/user: include locale code in locale selection
- core: fix view_token permission not being assigned on token creation for non-admin user
- lifecycle: remove gunicorn reload option
- lifecycle: send analytics in gunicorn config to decrease outgoing requests when workers get restarted
- providers/proxy: add support for X-Original-URI in nginx, better handle missing headers and report errors to authentik
- providers/proxy: don't include hostname and scheme in redirect when we only got a path and not a full URL
- providers/proxy: fix routing for external_host when using forward_auth_domain
- providers/proxy: set traefik labels using object_naming_template instead of UUID
- sources/ldap: add list_flatten function to property mappings, enable on managed LDAP mappings
- web: add es locale
- web: add pl locale
- web/admin: only check first half of locale when detecting
- web/flows: fix width on flow container
- web/user: include locale code in locale selection
## Fixed in 2022.1.5
- build(deps): bump uvicorn from 0.17.1 to 0.17.3 (#2229)
- core: allow formatting strings to be used for applications' launch URLs
- internal: don't attempt to lookup SNI Certificate if no SNI is sent
- internal: fix CSRF error caused by Host header
- internal: improve error handling for internal reverse proxy
- internal: remove uvicorn server header
- internal: trace headers and url for backend requests
- outposts: fix channel not always having a logger attribute
- outposts: fix compare_ports to support both service and container ports
- outposts: fix service reconciler re-creating services
- outposts: remove node_port on V1ServicePort checks to prevent service creation loops
- providers/proxy: fix Host/:Authority not being modified
- providers/proxy: fix nil error in claims
- providers/proxy: improve error handling for invalid backend_override
- sources/ldap: log entire exception
- sources/saml: fix incorrect ProtocolBinding being sent
- sources/saml: fix server error
- stages/authenticator_validate: handle non-existent device_challenges
- web/admin: fix mismatched icons in overview and lists
- build(deps): bump uvicorn from 0.17.1 to 0.17.3 (#2229)
- core: allow formatting strings to be used for applications' launch URLs
- internal: don't attempt to lookup SNI Certificate if no SNI is sent
- internal: fix CSRF error caused by Host header
- internal: improve error handling for internal reverse proxy
- internal: remove uvicorn server header
- internal: trace headers and url for backend requests
- outposts: fix channel not always having a logger attribute
- outposts: fix compare_ports to support both service and container ports
- outposts: fix service reconciler re-creating services
- outposts: remove node_port on V1ServicePort checks to prevent service creation loops
- providers/proxy: fix Host/:Authority not being modified
- providers/proxy: fix nil error in claims
- providers/proxy: improve error handling for invalid backend_override
- sources/ldap: log entire exception
- sources/saml: fix incorrect ProtocolBinding being sent
- sources/saml: fix server error
- stages/authenticator_validate: handle non-existent device_challenges
- web/admin: fix mismatched icons in overview and lists
## Upgrading

2242
website/docs/releases/2022/v2022.10.md
View File

File diff suppressed because it is too large Load Diff

416
website/docs/releases/2022/v2022.11.md
View File

@ -5,18 +5,18 @@ slug: "/releases/2022.11"
## Breaking changes
- Have I Been Pwned policy is deprecated
- Have I Been Pwned policy is deprecated
The policy has been merged with the password policy which provides the same functionality. Existing Have I Been Pwned policies will automatically be migrated.
- Instead of using multiple redis databases, authentik now uses a single redis database
- Instead of using multiple redis databases, authentik now uses a single redis database
This will temporarily loose some cached information after the upgrade, like cached system tasks and policy results. This data will be re-cached in the background.
## New features
- authentik now runs on Python 3.11
- Expanded password policy
- authentik now runs on Python 3.11
- Expanded password policy
The "Have I been Pwned" policy has been merged into the password policy, and additionally passwords can be checked using [zxcvbn](https://github.com/dropbox/zxcvbn) to provider concise feedback.
@ -40,49 +40,49 @@ image:
## Minor changes/fixes
- api: fix missing scheme in securitySchemes
- blueprints: Fixed bug causing blueprint instance context be discarded (#3990)
- core: fix error when propertymappings return complex value
- core: simplify group serializer for user API endpoint (#3899)
- events: deepcopy event kwargs to prevent objects being removed, remove workaround
- events: sanitize generator for json safety
- lib: fix complex objects being included in event context for ak_create_event
- lifecycle: fix incorrect messages looped
- outposts/kubernetes: ingress class (#4002)
- policies: only cache policies for authenticated users
- policies/password: merge hibp add zxcvbn (#4001)
- providers/oauth2: fix inconsistent expiry encoded in JWT
- root: make sentry DSN configurable (#4016)
- root: relicense and launch blog post
- root: use single redis db (#4009)
- sources: add custom icon support (#4022)
- stages/authenticator\_\*: cleanup
- stages/authenticator_validate: add flag to configure user_verification for webauthn devices
- stages/invitation: directly delete invitation now that flow plan is saved in email token
- web: fix twitter icon
- web/flows: always hide static user info when its not set in the flow
- api: fix missing scheme in securitySchemes
- blueprints: Fixed bug causing blueprint instance context be discarded (#3990)
- core: fix error when propertymappings return complex value
- core: simplify group serializer for user API endpoint (#3899)
- events: deepcopy event kwargs to prevent objects being removed, remove workaround
- events: sanitize generator for json safety
- lib: fix complex objects being included in event context for ak_create_event
- lifecycle: fix incorrect messages looped
- outposts/kubernetes: ingress class (#4002)
- policies: only cache policies for authenticated users
- policies/password: merge hibp add zxcvbn (#4001)
- providers/oauth2: fix inconsistent expiry encoded in JWT
- root: make sentry DSN configurable (#4016)
- root: relicense and launch blog post
- root: use single redis db (#4009)
- sources: add custom icon support (#4022)
- stages/authenticator\_\*: cleanup
- stages/authenticator_validate: add flag to configure user_verification for webauthn devices
- stages/invitation: directly delete invitation now that flow plan is saved in email token
- web: fix twitter icon
- web/flows: always hide static user info when its not set in the flow
## Fixed in 2022.11.1
- blueprints: add desired state attribute to objects (#4061)
- core: fix tab-complete in shell
- root: fix build on arm64
- stages/email: add test for email translation
- web/admin: fix error when importing duo devices
- web/admin: reset cookie_domain when setting non-domain forward auth
- blueprints: add desired state attribute to objects (#4061)
- core: fix tab-complete in shell
- root: fix build on arm64
- stages/email: add test for email translation
- web/admin: fix error when importing duo devices
- web/admin: reset cookie_domain when setting non-domain forward auth
## Fixed in 2022.11.2
- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.md), Reported by [@sdimovv](https://github.com/sdimovv)
- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.md), Reported by [@sdimovv](https://github.com/sdimovv)
## Fixed in 2022.11.3
- web: fix Flow Form failing to load due to outdated API client
- web: fix Flow Form failing to load due to outdated API client
## Fixed in 2022.11.4
- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.md), Reported by [@DreamingRaven](https://github.com/DreamingRaven)
- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.md), Reported by [@fuomag9](https://github.com/fuomag9)
- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.md), Reported by [@DreamingRaven](https://github.com/DreamingRaven)
- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.md), Reported by [@fuomag9](https://github.com/fuomag9)
## API Changes
@ -96,19 +96,19 @@ image:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
##### `PUT` /policies/password/&#123;policy_uuid&#125;/
@ -117,36 +117,36 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
##### `PATCH` /policies/password/&#123;policy_uuid&#125;/
@ -155,36 +155,36 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
##### `GET` /core/tokens/&#123;identifier&#125;/
@ -193,23 +193,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `PUT` /core/tokens/&#123;identifier&#125;/
@ -217,23 +217,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `PATCH` /core/tokens/&#123;identifier&#125;/
@ -241,23 +241,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /core/users/&#123;id&#125;/
@ -265,19 +265,19 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `PUT` /core/users/&#123;id&#125;/
@ -285,19 +285,19 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `PATCH` /core/users/&#123;id&#125;/
@ -305,19 +305,19 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /policies/bindings/&#123;policy_binding_uuid&#125;/
@ -325,23 +325,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `PUT` /policies/bindings/&#123;policy_binding_uuid&#125;/
@ -349,23 +349,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `PATCH` /policies/bindings/&#123;policy_binding_uuid&#125;/
@ -373,23 +373,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `POST` /policies/password/
@ -397,36 +397,36 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
##### `GET` /policies/password/
@ -447,23 +447,23 @@ Added: `zxcvbn_score_threshold` in `query`
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > Password Policy Serializer
- Added property `check_static_rules` (boolean)
- Added property `check_static_rules` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_have_i_been_pwned` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `check_zxcvbn` (boolean)
- Added property `hibp_allowed_count` (integer)
- Added property `hibp_allowed_count` (integer)
> How many times the password hash is allowed to be on haveibeenpwned
- Added property `zxcvbn_score_threshold` (integer)
- Added property `zxcvbn_score_threshold` (integer)
> If the zxcvbn score is equal or less than this value, the policy will fail.
##### `POST` /core/tokens/
@ -472,23 +472,23 @@ Changed response : **200 OK**
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /core/tokens/
@ -496,27 +496,27 @@ Changed response : **201 Created**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > Token Serializer
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /core/user_consent/&#123;id&#125;/
@ -524,23 +524,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user` (object)
- Changed property `user` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `POST` /core/users/
@ -548,19 +548,19 @@ Changed response : **200 OK**
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /core/users/
@ -568,23 +568,23 @@ Changed response : **201 Created**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /oauth2/authorization_codes/&#123;id&#125;/
@ -592,23 +592,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user` (object)
- Changed property `user` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /oauth2/refresh_tokens/&#123;id&#125;/
@ -616,23 +616,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user` (object)
- Changed property `user` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `POST` /policies/bindings/
@ -640,23 +640,23 @@ Changed response : **200 OK**
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /policies/bindings/
@ -664,27 +664,27 @@ Changed response : **201 Created**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > PolicyBinding Serializer
- Changed property `user_obj` (object)
- Changed property `user_obj` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /core/user_consent/
@ -692,27 +692,27 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > UserConsent Serializer
- Changed property `user` (object)
- Changed property `user` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /oauth2/authorization_codes/
@ -720,27 +720,27 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
- Changed property `user` (object)
- Changed property `user` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)
##### `GET` /oauth2/refresh_tokens/
@ -748,24 +748,24 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > Serializer for BaseGrantModel and RefreshToken
- Changed property `user` (object)
- Changed property `user` (object)
> User Serializer
- Changed property `groups_obj` (array)
- Changed property `groups_obj` (array)
Changed items (object): > Simplified Group Serializer for user's groups
New optional properties:
- `users_obj`
- `users_obj`
* Deleted property `users` (array)
* Deleted property `users` (array)
* Deleted property `users_obj` (array)
* Deleted property `users_obj` (array)

306
website/docs/releases/2022/v2022.12.md
View File

@ -5,17 +5,17 @@ slug: "/releases/2022.12"
## Breaking changes
- Blueprints fetched via OCI require oci:// schema
- Blueprints fetched via OCI require oci:// schema
To better detect if a blueprint should be fetched locally or via OCI, all OCI sourced blueprints require an `oci://` protocol.
## New features
- Bundled GeoIP City database
- Bundled GeoIP City database
authentik now comes with a bundled MaxMind GeoLite2 City database. This allows everyone to take advantage of the extra data provided by GeoIP. The default docker-compose file removes the GeoIP update container as it is no longer needed. See more [here](../../sys-mgmt/ops/geoip.mdx).
- Improved UX for user & group management and stage/policy binding
- Improved UX for user & group management and stage/policy binding
Users can now more easily be added to and removed from groups, both when viewing a single user and viewing a group.
@ -23,11 +23,11 @@ slug: "/releases/2022.12"
Select inputs were previously limited to showing a single page of items (default size of 100 items). These inputs have been replaced by dynamically loading inputs which support searching and better show the properties of the item.
- Preview for OAuth2 and SAML providers
- Preview for OAuth2 and SAML providers
OAuth2 and SAML providers can now preview what the currently selected property/scope mappings's outcome will look like. This helps with seeing what data is sent to the client and implementing and testing custom mappings.
- Customisable Captcha stage
- Customisable Captcha stage
The captcha stage now supports alternate compatible providers, like [hCaptcha](https://docs.hcaptcha.com/switch/) and [Turnstile](https://developers.cloudflare.com/turnstile/get-started/migrating-from-recaptcha/).
@ -51,124 +51,124 @@ image:
## Minor changes/fixes
- blueprints: add !Env tag
- blueprints: add `!If` tag (#4264)
- blueprints: add conditions to blueprint schema
- blueprints: Added conditional entry application (#4167)
- blueprints: better OCI support in UI (#4263)
- blueprints: fixed bug causing filtering with an empty query (#4106)
- blueprints: Support nested custom tags in `!Find` and `!Format` tags (#4127)
- core: add endpoints to add/remove users from group atomically
- core: bundle geoip (#4250)
- events: fix incorrect EventAction being used
- events: improve handling creation of events with non-pickleable objects
- events: remove legacy logger declaration
- events: save login event in session after login
- flows: fix redirect from plan context "redirect" not being wrapped in flow response
- flows: set stage name and verbose_name for in_memory stages
- internal: dont error if environment config isn't found
- internal: remove sentry proxy
- internal: reuse http transport to prevent leaking connections (#3996)
- lib: enable sentry profiles_sample_rate
- lib: fix uploaded files not being saved correctly, add tests
- lifecycle: don't set user/group in gunicorn
- lifecycle: improve explanation for user: root and docket socket mount
- policies: don't log context when policy returns None
- policies: log correct cache state
- policies: make name required
- policies/password: Always add generic message to failing zxcvbn check (#4100)
- providers: add preview for mappings (#4254)
- providers/ldap: improve mapping of LDAP filters to authentik queries
- providers/oauth2: optimise and cache signing key, prevent key being loaded multiple times
- providers/oauth2: set amr values based on login event
- providers/proxy: correctly set id_token_hint if possible
- providers/saml: set AuthnContextClassRef based on login event
- root: allow custom settings via python module
- root: migrate to hosted sentry with rate-limited DSN
- security: fix CVE 2022 23555 (#4274)
- security: fix CVE 2022 46145 (#4140)
- security: fix CVE 2022 46172 (#4275)
- stages/authenticator_duo: fix imported duo devices not being confirmed
- stages/authenticator_validate: fix validation to ensure configuration stage is set
- stages/authenticator_validate: improve validation for not_configured_action
- stages/authenticator_validate: log duo error
- stages/authenticator_validate: save used mfa devices in login event
- stages/captcha: customisable URLs (#3832)
- stages/invitation: fix incorrect pk check for invitation's flow
- stages/user_login: prevent double success message when logging in via source
- stages/user_write: always ignore `component` field and prevent warning
- web: fix authentication with Plex on iOS (#4095)
- web: ignore d3 circular deps warning, treat unresolved import as error
- web: use version family subdomain for in-app doc links
- web/admin: better show metadata download for saml provider
- web/admin: break all in code blocks in event info
- web/admin: clarify phrasing that user ID is required
- web/admin: fix action button order for blueprints
- web/admin: fix alignment in tables with multiple elements in cell
- web/admin: fix empty request being sent due to multiple forms in duo import modal
- web/admin: improve i18n for documentation link in outpost form
- web/admin: improve UI for removing users from groups and groups from users
- web/admin: improve user/group UX for adding/removing users to and from groups
- web/admin: more consistent label usage, use compact labels
- web/admin: rework markdown, correctly render Admonitions, fix links
- web/admin: show bound policies order first to match stages
- web/admin: show policy binding form when creating policy in bound list
- web/admin: show stage binding form when creating stage in bound list
- web/elements: fix alignment for checkboxes in table
- web/elements: fix alignment with checkbox in table
- web/elements: fix log level for diagram
- web/elements: fix table select-all checkbox being checked with no elements
- web/elements: fix wizard form page changing state before being active
- web/elements: unselect top checkbox in table when not all elements are selected
- web/flows: fix display for long redirect URLs
- web/flows: improve error messages for failed duo push
- web/flows: update flow background
- web/user: fix styling for clear all button in notification drawer
- blueprints: add !Env tag
- blueprints: add `!If` tag (#4264)
- blueprints: add conditions to blueprint schema
- blueprints: Added conditional entry application (#4167)
- blueprints: better OCI support in UI (#4263)
- blueprints: fixed bug causing filtering with an empty query (#4106)
- blueprints: Support nested custom tags in `!Find` and `!Format` tags (#4127)
- core: add endpoints to add/remove users from group atomically
- core: bundle geoip (#4250)
- events: fix incorrect EventAction being used
- events: improve handling creation of events with non-pickleable objects
- events: remove legacy logger declaration
- events: save login event in session after login
- flows: fix redirect from plan context "redirect" not being wrapped in flow response
- flows: set stage name and verbose_name for in_memory stages
- internal: dont error if environment config isn't found
- internal: remove sentry proxy
- internal: reuse http transport to prevent leaking connections (#3996)
- lib: enable sentry profiles_sample_rate
- lib: fix uploaded files not being saved correctly, add tests
- lifecycle: don't set user/group in gunicorn
- lifecycle: improve explanation for user: root and docket socket mount
- policies: don't log context when policy returns None
- policies: log correct cache state
- policies: make name required
- policies/password: Always add generic message to failing zxcvbn check (#4100)
- providers: add preview for mappings (#4254)
- providers/ldap: improve mapping of LDAP filters to authentik queries
- providers/oauth2: optimise and cache signing key, prevent key being loaded multiple times
- providers/oauth2: set amr values based on login event
- providers/proxy: correctly set id_token_hint if possible
- providers/saml: set AuthnContextClassRef based on login event
- root: allow custom settings via python module
- root: migrate to hosted sentry with rate-limited DSN
- security: fix CVE 2022 23555 (#4274)
- security: fix CVE 2022 46145 (#4140)
- security: fix CVE 2022 46172 (#4275)
- stages/authenticator_duo: fix imported duo devices not being confirmed
- stages/authenticator_validate: fix validation to ensure configuration stage is set
- stages/authenticator_validate: improve validation for not_configured_action
- stages/authenticator_validate: log duo error
- stages/authenticator_validate: save used mfa devices in login event
- stages/captcha: customisable URLs (#3832)
- stages/invitation: fix incorrect pk check for invitation's flow
- stages/user_login: prevent double success message when logging in via source
- stages/user_write: always ignore `component` field and prevent warning
- web: fix authentication with Plex on iOS (#4095)
- web: ignore d3 circular deps warning, treat unresolved import as error
- web: use version family subdomain for in-app doc links
- web/admin: better show metadata download for saml provider
- web/admin: break all in code blocks in event info
- web/admin: clarify phrasing that user ID is required
- web/admin: fix action button order for blueprints
- web/admin: fix alignment in tables with multiple elements in cell
- web/admin: fix empty request being sent due to multiple forms in duo import modal
- web/admin: improve i18n for documentation link in outpost form
- web/admin: improve UI for removing users from groups and groups from users
- web/admin: improve user/group UX for adding/removing users to and from groups
- web/admin: more consistent label usage, use compact labels
- web/admin: rework markdown, correctly render Admonitions, fix links
- web/admin: show bound policies order first to match stages
- web/admin: show policy binding form when creating policy in bound list
- web/admin: show stage binding form when creating stage in bound list
- web/elements: fix alignment for checkboxes in table
- web/elements: fix alignment with checkbox in table
- web/elements: fix log level for diagram
- web/elements: fix table select-all checkbox being checked with no elements
- web/elements: fix wizard form page changing state before being active
- web/elements: unselect top checkbox in table when not all elements are selected
- web/flows: fix display for long redirect URLs
- web/flows: improve error messages for failed duo push
- web/flows: update flow background
- web/user: fix styling for clear all button in notification drawer
## Fixed in 2022.12.1
- api: add filter backend for secret key to allow access to tenants and certificates
- blueprints: fix error when entry with state absent doesn't exist
- blueprints: Resolve yamltags in state and model attributes (#4299)
- outposts: include hostname in outpost heartbeat
- outposts/ldap: only use common cert if cert is configured
- outposts/ldap: use configured certificate for LDAPS when all providers' certificates are identical
- web/admin: migrate selection to ak-search-select
- web/admin: rework outpost health
- web/elements: add grouping and descriptions to search select
- web/elements: make ak-search-select limited in height and scroll
- web/elements: render ak-seach-select dropdown correctly in modals
- web/user: fix user settings stuck loading
- api: add filter backend for secret key to allow access to tenants and certificates
- blueprints: fix error when entry with state absent doesn't exist
- blueprints: Resolve yamltags in state and model attributes (#4299)
- outposts: include hostname in outpost heartbeat
- outposts/ldap: only use common cert if cert is configured
- outposts/ldap: use configured certificate for LDAPS when all providers' certificates are identical
- web/admin: migrate selection to ak-search-select
- web/admin: rework outpost health
- web/elements: add grouping and descriptions to search select
- web/elements: make ak-search-select limited in height and scroll
- web/elements: render ak-seach-select dropdown correctly in modals
- web/user: fix user settings stuck loading
## Fixed in 2022.12.2
- admin: use matching environment for system API
- crypto: fix type for has_key
- providers/oauth2: fix null amr value not being removed from id_token
- providers/saml: don't error if no request in API serializer context
- stages/captcha: fix captcha not loading correctly, add tests
- stages/dummy: add toggle to throw error for debugging
- stages/email: make template tests less flaky
- stages/email: use pending user correctly
- stages/prompt: use stage.get_pending_user() to fallback to the correct user
- web: add check compile test to prevent compile errors/warnings
- web: ensure locales are built for tsc check
- web: update tsconfig strictness
- web/admin: add Radio control, search-select fixes (#4333)
- web/admin: fix error in outpost form dropdown
- web/admin: fix error when creating SAML Provider from metadata
- web/elements: correctly display selected empty option when blankable is enabled
- web/elements: fix dropdown menu closing before selecting item sometimes
- web/elements: fix selection of blank elements in search-select, fix issue when re-opening dropdown
- web/elements: tabs: only find pages for directly related slots
- web/elements: trigger search select data update on connected callback
- web/flows: add close button to flow inspector
- web/flows: fix alternate captchas not loading
- web/flows: rework error display, always use ak-stage-flow-error instead of shell
- admin: use matching environment for system API
- crypto: fix type for has_key
- providers/oauth2: fix null amr value not being removed from id_token
- providers/saml: don't error if no request in API serializer context
- stages/captcha: fix captcha not loading correctly, add tests
- stages/dummy: add toggle to throw error for debugging
- stages/email: make template tests less flaky
- stages/email: use pending user correctly
- stages/prompt: use stage.get_pending_user() to fallback to the correct user
- web: add check compile test to prevent compile errors/warnings
- web: ensure locales are built for tsc check
- web: update tsconfig strictness
- web/admin: add Radio control, search-select fixes (#4333)
- web/admin: fix error in outpost form dropdown
- web/admin: fix error when creating SAML Provider from metadata
- web/elements: correctly display selected empty option when blankable is enabled
- web/elements: fix dropdown menu closing before selecting item sometimes
- web/elements: fix selection of blank elements in search-select, fix issue when re-opening dropdown
- web/elements: tabs: only find pages for directly related slots
- web/elements: trigger search select data update on connected callback
- web/flows: add close button to flow inspector
- web/flows: fix alternate captchas not loading
- web/flows: rework error display, always use ak-stage-flow-error instead of shell
## Fixed in 2022.12.3
- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9)
- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9)
## API Changes
@ -182,13 +182,13 @@ image:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.
##### `PUT` /stages/captcha/&#123;stage_uuid&#125;/
@ -197,28 +197,28 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.
- Changed property `private_key` (string)
- Changed property `private_key` (string)
> Private key, acquired your captcha Provider.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.
##### `PATCH` /stages/captcha/&#123;stage_uuid&#125;/
@ -227,28 +227,28 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.
- Changed property `private_key` (string)
- Changed property `private_key` (string)
> Private key, acquired your captcha Provider.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.
##### `GET` /flows/executor/&#123;flow_slug&#125;/
@ -257,14 +257,14 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
Updated `ak-stage-captcha` component:
New required properties:
- `js_url`
- `js_url`
* Added property `js_url` (string)
* Added property `js_url` (string)
##### `POST` /flows/executor/&#123;flow_slug&#125;/
@ -272,14 +272,14 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
Updated `ak-stage-captcha` component:
New required properties:
- `js_url`
- `js_url`
* Added property `js_url` (string)
* Added property `js_url` (string)
##### `POST` /stages/captcha/
@ -287,28 +287,28 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.
- Changed property `private_key` (string)
- Changed property `private_key` (string)
> Private key, acquired your captcha Provider.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.
##### `GET` /stages/captcha/
@ -317,15 +317,15 @@ Changed response : **201 Created**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > CaptchaStage Serializer
- Added property `js_url` (string)
- Added property `js_url` (string)
- Added property `api_url` (string)
- Added property `api_url` (string)
- Changed property `public_key` (string)
- Changed property `public_key` (string)
> Public key, acquired your captcha Provider.

74
website/docs/releases/2022/v2022.2.md
View File

@ -9,14 +9,14 @@ slug: "/releases/2022.2"
The integrated backup functionality has been removed due to the following reasons:
- It caused a lot of issues during restore, with things breaking and difficult to restore backups
- Limited compatibility (only supported local and S3 backups)
- Most environments already have a solution for backups, so we feel that investing more time into making this feature better should be spent on more important things.
- It caused a lot of issues during restore, with things breaking and difficult to restore backups
- Limited compatibility (only supported local and S3 backups)
- Most environments already have a solution for backups, so we feel that investing more time into making this feature better should be spent on more important things.
If you don't already have a standard backup solution for other applications, you can consider these replacements:
- https://github.com/kartoza/docker-pg-backup for docker-compose and
- https://devtron.ai/blog/creating-a-kubernetes-cron-job-to-backup-postgres-db/ or https://cwienczek.com/2020/06/simple-backup-of-postgres-database-in-kubernetes/ for Kubernetes
- https://github.com/kartoza/docker-pg-backup for docker-compose and
- https://devtron.ai/blog/creating-a-kubernetes-cron-job-to-backup-postgres-db/ or https://cwienczek.com/2020/06/simple-backup-of-postgres-database-in-kubernetes/ for Kubernetes
### Changed URLs for forward auth
@ -30,38 +30,38 @@ In an authenticator validation stage you can now configure multiple configuratio
## Minor changes/fixes
- \*: add placeholder custom.css to easily allow user customisation
- \*: rename akprox to outpost.goauthentik.io (#2266)
- internal: don't attempt to lookup SNI Certificate if no SNI is sent
- internal: improve error handling for internal reverse proxy
- internal: increase logging for no hostname found
- internal: remove uvicorn server header
- outposts: ensure keypair is set for SSH connections
- outposts: fix channel not always having a logger attribute
- outposts: fix compare_ports to support both service and container ports
- outposts: fix service reconciler re-creating services
- outposts: make local discovery configurable
- outposts: remove node_port on V1ServicePort checks to prevent service creation loops
- outposts/proxy: correctly check host in forward domain redirect
- outposts/proxy: correctly handle ?rd= param
- providers/oauth2: add support for explicit response_mode
- providers/oauth2: fix redirect_uri being lowercased on successful validation
- providers/proxy: enable TLS in ingress via traefik annotation
- providers/proxy: improve error handling for invalid backend_override
- providers/proxy: remove leading slash to allow subdirectories in proxy
- sources/ldap: log entire exception
- sources/ldap: use merger that only appends unique items to list
- sources/saml: fix incorrect ProtocolBinding being sent
- stages/authenticator_validate: add ability to select multiple configuration stages which the user can choose
- stages/authenticator_validate: fix handling when single configuration stage is selected
- stages/authenticator_validate: handle non-existent device_challenges
- Translate /web/src/locales/en.po in de (#2291)
- Translate /web/src/locales/en.po in pl (#2274)
- Translate /web/src/locales/en.po in zh_TW (#2263)
- Translate /web/src/locales/en.po in zh-Hans (#2262)
- Translate /web/src/locales/en.po in zh-Hant (#2261)
- web/admin: fix invalid URLs in example proxy config
- web/admin: fix mismatched icons in overview and lists
- \*: add placeholder custom.css to easily allow user customisation
- \*: rename akprox to outpost.goauthentik.io (#2266)
- internal: don't attempt to lookup SNI Certificate if no SNI is sent
- internal: improve error handling for internal reverse proxy
- internal: increase logging for no hostname found
- internal: remove uvicorn server header
- outposts: ensure keypair is set for SSH connections
- outposts: fix channel not always having a logger attribute
- outposts: fix compare_ports to support both service and container ports
- outposts: fix service reconciler re-creating services
- outposts: make local discovery configurable
- outposts: remove node_port on V1ServicePort checks to prevent service creation loops
- outposts/proxy: correctly check host in forward domain redirect
- outposts/proxy: correctly handle ?rd= param
- providers/oauth2: add support for explicit response_mode
- providers/oauth2: fix redirect_uri being lowercased on successful validation
- providers/proxy: enable TLS in ingress via traefik annotation
- providers/proxy: improve error handling for invalid backend_override
- providers/proxy: remove leading slash to allow subdirectories in proxy
- sources/ldap: log entire exception
- sources/ldap: use merger that only appends unique items to list
- sources/saml: fix incorrect ProtocolBinding being sent
- stages/authenticator_validate: add ability to select multiple configuration stages which the user can choose
- stages/authenticator_validate: fix handling when single configuration stage is selected
- stages/authenticator_validate: handle non-existent device_challenges
- Translate /web/src/locales/en.po in de (#2291)
- Translate /web/src/locales/en.po in pl (#2274)
- Translate /web/src/locales/en.po in zh_TW (#2263)
- Translate /web/src/locales/en.po in zh-Hans (#2262)
- Translate /web/src/locales/en.po in zh-Hant (#2261)
- web/admin: fix invalid URLs in example proxy config
- web/admin: fix mismatched icons in overview and lists
## Upgrading

62
website/docs/releases/2022/v2022.3.md
View File

@ -21,43 +21,43 @@ To simplify the release process we don't publish explicitly tagged release-candi
## Minor changes/fixes
- core: add initial app launch url (#2367)
- core: customisable user settings (#2397)
- core/api: allow filtering users by uid, add uid to search
- internal/ldap: fix panic when parsing lists with mixed types
- lib: fix default geoip path
- providers/oauth2: fix invalid launch URL being generated
- providers/oauth2: initial client_credentials grant support (#2437)
- providers/proxy: always set rd param in addition to session to prevent wrong url in session
- web: cleanup default footer links
- web: prioritise ?locale parameter over saved locale
- web/admin: improve user and group management by showing related objects
- web/admin: use searchable select field for users and groups in policy binding form
- web/flows: fix rendering of help text on prompt stages
- core: add initial app launch url (#2367)
- core: customisable user settings (#2397)
- core/api: allow filtering users by uid, add uid to search
- internal/ldap: fix panic when parsing lists with mixed types
- lib: fix default geoip path
- providers/oauth2: fix invalid launch URL being generated
- providers/oauth2: initial client_credentials grant support (#2437)
- providers/proxy: always set rd param in addition to session to prevent wrong url in session
- web: cleanup default footer links
- web: prioritise ?locale parameter over saved locale
- web/admin: improve user and group management by showing related objects
- web/admin: use searchable select field for users and groups in policy binding form
- web/flows: fix rendering of help text on prompt stages
## Fixed in 2022.3.2
- core: replace uid with uuid search
- flows: revert default flow user change
- lib: lower default sample rate
- sources/ldap: fix parent_group not being applied
- stages/authenticator_validate: fix passwordless flows not working
- web/elements: fix error with blank SearchSelect elements in forms
- web/elements: fix search select background in dark mode
- web/elements: fix search-select hover background
- web/user: filter applications by launch URL lto show empty state
- web/user: fix duplicate help text in prompts
- core: replace uid with uuid search
- flows: revert default flow user change
- lib: lower default sample rate
- sources/ldap: fix parent_group not being applied
- stages/authenticator_validate: fix passwordless flows not working
- web/elements: fix error with blank SearchSelect elements in forms
- web/elements: fix search select background in dark mode
- web/elements: fix search-select hover background
- web/user: filter applications by launch URL lto show empty state
- web/user: fix duplicate help text in prompts
## Fixed in 2022.3.3
- core: fix provider launch URL being prioritised over manually configured launch URL
- crypto: open files in read-only mode for importing (#2536)
- outposts/ldap: prevent operations error from nil dereference (#2447)
- outposts/proxy: use Prefix in ingress for k8s
- web: fix style for selected item in select in dark mode
- web/admin: default to not include current session in flow play, add option to start with current session
- web/admin: fix user defaulting to 0 when not set in PolicyBindingForm
- web/elements: make SearchSelect optionally blankable
- core: fix provider launch URL being prioritised over manually configured launch URL
- crypto: open files in read-only mode for importing (#2536)
- outposts/ldap: prevent operations error from nil dereference (#2447)
- outposts/proxy: use Prefix in ingress for k8s
- web: fix style for selected item in select in dark mode
- web/admin: default to not include current session in flow play, add option to start with current session
- web/admin: fix user defaulting to 0 when not set in PolicyBindingForm
- web/elements: make SearchSelect optionally blankable
## Upgrading

50
website/docs/releases/2022/v2022.4.md
View File

@ -5,50 +5,50 @@ slug: "/releases/2022.4"
## Breaking changes
- Removal of HTTP Basic authentication for API requests
- Removal of HTTP Basic authentication for API requests
For legacy reasons, authentik used to support HTTP-Basic authenticated requests, using the token as a password. This has been removed.
- Removal of deprecated context in Expression policies used in prompt stages
- Removal of deprecated context in Expression policies used in prompt stages
Before this version, you could use both `context['*field_name*']` and `context['prompt_data']['*field_name*']`. The former one has been removed as it could overwrite other data in the context if the field name is the same as another context value.
- Added name field for invitations
- Added name field for invitations
Invitations now require a name, used to better identify their purpose.
## New features
- Application Grouping
- Application Grouping
Applications can now be grouped together to better organise connected applications in the user dashboard.
- JWT authentication for `client_credentials` grants
- JWT authentication for `client_credentials` grants
Providers can now be configured to accept JWTs signed by configured certificates, which makes it a lot easier to services access to authentik, when an existing machine/service identity is provided (for example, this can be used to let Kubernetes Pods authenticate themselves to authentik via their service account)
## Minor changes/fixes
- core: add method to set key of token
- core: add num_pk to group for applications that need a numerical group id
- internal: disable HTML encoding in go-generated log messages
- lifecycle: fix password and hostname in redis URI not properly quoted
- outposts: check if docker ports should be mapped before comparing ports
- policies: add policy log messages to test endpoints
- providers/oauth2: map internal groups to GitHub teams in GHE OAuth emulation (#2497)
- providers/oauth2: pass scope and other parameters to access policy request context
- stages/email: allow overriding of destination email in plan context
- stages/invitation: add invitation name
- stages/prompt: filter rest_framework.fields.empty when field is not required
- stages/prompt: fix non-required fields not allowing blank values
- stages/prompt: set field default based on placeholder
- tenants: add tenant-level attributes, applied to users based on request
- web: live-convert to slug in fields where only slugs are allowed
- web: migrate dropdowns to wizards (#2633)
- web/admin: allow editing of invitations
- web/admin: fix missing protocols on generated nginx config
- web/admin: trigger update when provider wizard finishes
- web/user: add column layouts
- core: add method to set key of token
- core: add num_pk to group for applications that need a numerical group id
- internal: disable HTML encoding in go-generated log messages
- lifecycle: fix password and hostname in redis URI not properly quoted
- outposts: check if docker ports should be mapped before comparing ports
- policies: add policy log messages to test endpoints
- providers/oauth2: map internal groups to GitHub teams in GHE OAuth emulation (#2497)
- providers/oauth2: pass scope and other parameters to access policy request context
- stages/email: allow overriding of destination email in plan context
- stages/invitation: add invitation name
- stages/prompt: filter rest_framework.fields.empty when field is not required
- stages/prompt: fix non-required fields not allowing blank values
- stages/prompt: set field default based on placeholder
- tenants: add tenant-level attributes, applied to users based on request
- web: live-convert to slug in fields where only slugs are allowed
- web: migrate dropdowns to wizards (#2633)
- web/admin: allow editing of invitations
- web/admin: fix missing protocols on generated nginx config
- web/admin: trigger update when provider wizard finishes
- web/user: add column layouts
## Upgrading

126
website/docs/releases/2022/v2022.5.md
View File

@ -5,28 +5,28 @@ slug: "/releases/2022.5"
## Breaking changes
- Twitter Source has been migrated to OAuth2
- Twitter Source has been migrated to OAuth2
This requires some reconfiguration on both Twitter's and authentik's side. Check out the new Twitter integration docs [here](../../users-sources/sources/social-logins/twitter/index.md).
- OAuth Provider: Redirect URIs are now checked using regular expressions
- OAuth Provider: Redirect URIs are now checked using regular expressions
Allowed Redirect URIs now accepts regular expressions to check redirect URIs to support wildcards. In most cases this will not change anything, however casing is also important now. Meaning if your redirect URI is "https://Foo.bar" and allowed is "https://foo.bar", authorization will not be allowed. Additionally, the special handling when _Redirect URIs/Origins_ is set to `*` has been removed. To get the same behaviour, set _Redirect URIs/Origins_ to `.+`.
## New features
- LDAP Outpost cached binding
- LDAP Outpost cached binding
Instead of always executing the configured flow when a new Bind request is received, the provider can now be configured to cache the session from the initial flow execution, and directly validate credentials in the outpost. This drastically improves the bind performance.
See [LDAP provider](../../add-secure-apps/providers/ldap/index.md#cached-bind)
- OAuth2: Add support for `form_post` response mode
- Don't prompt users for MFA when they've authenticated themselves within a time period
- OAuth2: Add support for `form_post` response mode
- Don't prompt users for MFA when they've authenticated themselves within a time period
You can now configure any [Authenticator Validation Stage](../../add-secure-apps/flows-stages/stages/authenticator_validate/index.md) stage to not ask for MFA validation if the user has previously authenticated themselves with an MFA device (of any of the selected classes) in the `Last validation threshold`.
- Optimise bundling of web assets
- Optimise bundling of web assets
Previous versions had the entire frontend bundled in a single file (per interface). This has been revamped to produce smaller bundle sizes for each interface to improve the loading times.
@ -36,69 +36,69 @@ slug: "/releases/2022.5"
## Minor changes/fixes
- \*: decrease frequency of background tasks, smear tasks based on name and fqdn
- api: fix OwnerFilter filtering out objects for superusers
- core: add custom shell command which imports all models and creates events for model events
- core: add flag to globally disable impersonation
- events: fix created events only being logged as debug level
- flows: handle flow title formatting error better, add user to flow title context
- internal: add signal handler for SIGTERM
- outposts/ldap: cached bind (#2824)
- policies: fix current user not being set in server-side policy deny
- providers/oauth2: add support for form_post response mode (#2818)
- providers/oauth2: allow regex matches for allowed redirect_uri
- providers/oauth2: don't create events before client_id can be verified to prevent spam
- providers/saml: make SAML metadata generation consistent
- root: export poetry deps to requirements.txt so we don't need poetry … (#2823)
- root: handle JSON error in metrics
- root: set SESSION_SAVE_EVERY_REQUEST to enable sliding sessions
- sources/oauth: Fix wording for OAuth source names (#2732)
- stages/authenticator_validate: remember (#2828)
- stages/identification: redirect with QS to keep next parameters (#2909)
- stages/user_delete: fix delete stage failing when pending user is not explicitly set
- web: fix dateTimeLocal() dropping local timezone
- web: lazy load parts of interfaces (#2864)
- web/user: add missing checkbox element in user settings (#2762)
- \*: decrease frequency of background tasks, smear tasks based on name and fqdn
- api: fix OwnerFilter filtering out objects for superusers
- core: add custom shell command which imports all models and creates events for model events
- core: add flag to globally disable impersonation
- events: fix created events only being logged as debug level
- flows: handle flow title formatting error better, add user to flow title context
- internal: add signal handler for SIGTERM
- outposts/ldap: cached bind (#2824)
- policies: fix current user not being set in server-side policy deny
- providers/oauth2: add support for form_post response mode (#2818)
- providers/oauth2: allow regex matches for allowed redirect_uri
- providers/oauth2: don't create events before client_id can be verified to prevent spam
- providers/saml: make SAML metadata generation consistent
- root: export poetry deps to requirements.txt so we don't need poetry … (#2823)
- root: handle JSON error in metrics
- root: set SESSION_SAVE_EVERY_REQUEST to enable sliding sessions
- sources/oauth: Fix wording for OAuth source names (#2732)
- stages/authenticator_validate: remember (#2828)
- stages/identification: redirect with QS to keep next parameters (#2909)
- stages/user_delete: fix delete stage failing when pending user is not explicitly set
- web: fix dateTimeLocal() dropping local timezone
- web: lazy load parts of interfaces (#2864)
- web/user: add missing checkbox element in user settings (#2762)
## Fixed in 2022.5.2
- internal: fix nil pointer dereference in ldap outpost
- internal: revert cookie path on proxy causing redirect loops
- outposts: allow externally managed SSH Config for outposts (#2917)
- outposts: ensure the user and token are created on initial outpost save
- root: fix missing curl in dockerfile
- web/admin: improve error handling in TokenCopyButton
- web/admin: make external host clickable
- web/user: fix use sub-pages not redirecting back to the subpage
- internal: fix nil pointer dereference in ldap outpost
- internal: revert cookie path on proxy causing redirect loops
- outposts: allow externally managed SSH Config for outposts (#2917)
- outposts: ensure the user and token are created on initial outpost save
- root: fix missing curl in dockerfile
- web/admin: improve error handling in TokenCopyButton
- web/admin: make external host clickable
- web/user: fix use sub-pages not redirecting back to the subpage
## Fixed in 2022.5.3
- api: migrate to openapi generator v6 (#2968)
- api: update API browser to match admin UI and auto-switch theme
- core: fix username validator not allowing changes that can be done via flows
- crypto: set SAN in default generated Certificate to semi-random domain
- ensure all viewsets have filter and search and add tests (#2946)
- events: fix transport not allowing blank values
- flows: fix re-imports of entries with identical PK re-creating objects (#2941)
- providers/oauth2: handle attribute errors when validation JWK contains private key
- providers/oauth2: improve error handling for invalid regular expressions
- providers/oauth2: only set expiry on user when it was freshly created
- providers/oauth2: regex-escape URLs when set to blank
- providers/oauth2: set related_name for many-to-many connections so used by detects the connection
- providers/saml: handle parse error
- root: Add docker-compose postgresql and redis healthchecks (#2958)
- stages/user_write: fix typo in request context variable
- web: decrease elements that refresh on global refresh signal
- web/admin: add note that regex is used for redirect URIs
- web/admin: add set password button to user view page
- web/admin: fix broken flow execute link (#2940)
- web/admin: fix display of LDAP bind mode
- web/admin: fix flow diagram not updating on flow changes
- web/admin: fix phrasing on LDAP provider form for bind mode
- web/admin: refactor table refresh to preserve selected/expanded elements correctly
- web/elements: fix missing click handler on wizard close button
- web/elements: fix used_by refreshing for all elements when using DeleteBulkForm
- website/docs: Fix misconfiguration causing POST requests behind Nginx to timeout (#2967)
- api: migrate to openapi generator v6 (#2968)
- api: update API browser to match admin UI and auto-switch theme
- core: fix username validator not allowing changes that can be done via flows
- crypto: set SAN in default generated Certificate to semi-random domain
- ensure all viewsets have filter and search and add tests (#2946)
- events: fix transport not allowing blank values
- flows: fix re-imports of entries with identical PK re-creating objects (#2941)
- providers/oauth2: handle attribute errors when validation JWK contains private key
- providers/oauth2: improve error handling for invalid regular expressions
- providers/oauth2: only set expiry on user when it was freshly created
- providers/oauth2: regex-escape URLs when set to blank
- providers/oauth2: set related_name for many-to-many connections so used by detects the connection
- providers/saml: handle parse error
- root: Add docker-compose postgresql and redis healthchecks (#2958)
- stages/user_write: fix typo in request context variable
- web: decrease elements that refresh on global refresh signal
- web/admin: add note that regex is used for redirect URIs
- web/admin: add set password button to user view page
- web/admin: fix broken flow execute link (#2940)
- web/admin: fix display of LDAP bind mode
- web/admin: fix flow diagram not updating on flow changes
- web/admin: fix phrasing on LDAP provider form for bind mode
- web/admin: refactor table refresh to preserve selected/expanded elements correctly
- web/elements: fix missing click handler on wizard close button
- web/elements: fix used_by refreshing for all elements when using DeleteBulkForm
- website/docs: Fix misconfiguration causing POST requests behind Nginx to timeout (#2967)
## Upgrading

104
website/docs/releases/2022/v2022.6.md
View File

@ -5,80 +5,80 @@ slug: "/releases/2022.6"
## New features
- Added OIDC well-known and JWKS URL in OAuth Source
- Added OIDC well-known and JWKS URL in OAuth Source
These fields can be used to automatically configure OAuth Sources based on the [OpenID Connect Discovery Spec](https://openid.net/specs/openid-connect-discovery-1_0.html). Additionally, you can manually define a JWKS URL or raw JWKS data, and this can be used for Machine-to-machine authentication for OAuth2 Providers.
- Notifications are no longer created by default
- Notifications are no longer created by default
Instead of creating a Notification with each transport, there is now a new Transport mode called "Local", which locally creates the Notifications. This also adds the ability to customize the notification using a mapping.
- MFA Validation threshold has been migrated to signed cookies
- MFA Validation threshold has been migrated to signed cookies
Last MFA validation is now saved in a signed cookie, which changes the behavior so that only the current browser is affected by MFA validation, and an attacker cannot exploit the fact that a user has recently authenticated with MFA.
- Verification-only SMS Devices
- Verification-only SMS Devices
SMS authenticator stages can now be configured to hash the phone number. This is useful if you want to require your users to configure and confirm their phone numbers, without saving them in a readable-format.
- The LDAP outpost would incorrectly return `groupOfUniqueNames` as a group class when the members where returned in a manner like `groupOfNames` requires. `groupOfNames` has been added as an objectClass for LDAP Groups, and `groupOfUniqueNames` will be removed in the next version.
- The LDAP outpost would incorrectly return `groupOfUniqueNames` as a group class when the members where returned in a manner like `groupOfNames` requires. `groupOfNames` has been added as an objectClass for LDAP Groups, and `groupOfUniqueNames` will be removed in the next version.
- Preview support for forward auth when using Envoy
- Preview support for forward auth when using Envoy
## Minor changes/fixes
- api: migrate to openapi generator v6 (#2968)
- api: update API browser to match admin UI and auto-switch theme
- core: improve loading speed of flow background
- ensure all viewsets have filter and search and add tests (#2946)
- flows: fix re-imports of entries with identical PK re-creating objects
- lifecycle: cleanup prometheus metrics, remove PII (#2972)
- policies: fix incorrect bound_to count
- providers/oauth2: add configuration error event when wrong redirect uri is used in token request
- providers/oauth2: handle attribute errors when validation JWK contains private key
- providers/oauth2: only set expiry on user when it was freshly created
- providers/oauth2: regex-escape URLs when set to blank
- root: Add docker-compose postgresql and redis healthchecks (#2958)
- root: disable session_save_every_request as it causes race conditions
- web/elements: fix top-right dialog close button not resetting form
- web/elements: fix used_by refreshing for all elements when using DeleteBulkForm
- web/user: fix static prompt fields being rendered with label
- web/user: improve ux for restarting user settings flow
- api: migrate to openapi generator v6 (#2968)
- api: update API browser to match admin UI and auto-switch theme
- core: improve loading speed of flow background
- ensure all viewsets have filter and search and add tests (#2946)
- flows: fix re-imports of entries with identical PK re-creating objects
- lifecycle: cleanup prometheus metrics, remove PII (#2972)
- policies: fix incorrect bound_to count
- providers/oauth2: add configuration error event when wrong redirect uri is used in token request
- providers/oauth2: handle attribute errors when validation JWK contains private key
- providers/oauth2: only set expiry on user when it was freshly created
- providers/oauth2: regex-escape URLs when set to blank
- root: Add docker-compose postgresql and redis healthchecks (#2958)
- root: disable session_save_every_request as it causes race conditions
- web/elements: fix top-right dialog close button not resetting form
- web/elements: fix used_by refreshing for all elements when using DeleteBulkForm
- web/user: fix static prompt fields being rendered with label
- web/user: improve ux for restarting user settings flow
## Fixed in 2022.6.2
- \*: make user logging more consistent
- core: add additional filters to source viewset
- core: add setting to open application launch URL in a new browser tab (#3037)
- core: add slug to built-in source
- events: fix error when attempting to create event with GeoIP City in context
- providers/ldap: fix existing binder not being carried forward correctly
- providers/oauth2: add JWKS URL to OAuth2ProviderSetupURLs
- providers/proxy: use same redirect-save code for all modes
- sources/oauth: fix twitter client missing basic auth
- stages/authenticator_validate: fix error in passwordless webauthn
- web/elements: add error handler when table fails to fetch objects
- \*: make user logging more consistent
- core: add additional filters to source viewset
- core: add setting to open application launch URL in a new browser tab (#3037)
- core: add slug to built-in source
- events: fix error when attempting to create event with GeoIP City in context
- providers/ldap: fix existing binder not being carried forward correctly
- providers/oauth2: add JWKS URL to OAuth2ProviderSetupURLs
- providers/proxy: use same redirect-save code for all modes
- sources/oauth: fix twitter client missing basic auth
- stages/authenticator_validate: fix error in passwordless webauthn
- web/elements: add error handler when table fails to fetch objects
## Fixed in 2022.6.3
- core: fix migrations when creating bootstrap token
- internal: dont sample gunicorn proxied requests
- internal: fix routing to embedded outpost
- internal: skip tracing for go healthcheck and metrics endpoints
- lifecycle: run bootstrap tasks inline when using automated install
- policies: consolidate log user and application
- providers/oauth2: add test to ensure capitalised redirect_uri isn't changed
- providers/oauth2: dont lowercase URL for token requests (#3114)
- providers/oauth2: if a redirect_uri cannot be parsed as regex, compare strict (#3070)
- providers/proxy: only send misconfiguration event once
- root: ignore healthcheck routes in sentry tracing
- stages/authenticator_validate: add webauthn tests (#3069)
- web/admin: lint bound group under policies
- web/admin: remove invalid requirement for usernames
- web/elements: add spinner when loading dynamic routes
- web/flows: add divider to identification stage for security key
- web/flows: fix error when webauthn operations failed and user retries
- web/flows: remove autofocus from password field of identifications stage
- core: fix migrations when creating bootstrap token
- internal: dont sample gunicorn proxied requests
- internal: fix routing to embedded outpost
- internal: skip tracing for go healthcheck and metrics endpoints
- lifecycle: run bootstrap tasks inline when using automated install
- policies: consolidate log user and application
- providers/oauth2: add test to ensure capitalised redirect_uri isn't changed
- providers/oauth2: dont lowercase URL for token requests (#3114)
- providers/oauth2: if a redirect_uri cannot be parsed as regex, compare strict (#3070)
- providers/proxy: only send misconfiguration event once
- root: ignore healthcheck routes in sentry tracing
- stages/authenticator_validate: add webauthn tests (#3069)
- web/admin: lint bound group under policies
- web/admin: remove invalid requirement for usernames
- web/elements: add spinner when loading dynamic routes
- web/flows: add divider to identification stage for security key
- web/flows: fix error when webauthn operations failed and user retries
- web/flows: remove autofocus from password field of identifications stage
## Upgrading

114
website/docs/releases/2022/v2022.7.md
View File

@ -5,97 +5,97 @@ slug: "/releases/2022.7"
## Breaking changes
- Removal of verification certificates for Machine-to-Machine authentication in OAuth 2 Provider
- Removal of verification certificates for Machine-to-Machine authentication in OAuth 2 Provider
Instead, create an OAuth Source with the certificate configured as JWKS Data, and enable the source in the provider.
- Maximum Limit of group recursion
- Maximum Limit of group recursion
In earlier versions, cyclic group relations can lead to a deadlock when one of groups in the relationship are bound to an application/flow/etc.
This is now limited to 20 levels of recursion.
- Change in context behaviour for policies executed within flows
- Change in context behaviour for policies executed within flows
In previous versions, the policy context would be set to a reference to the currently active flow plan context. This makes it so any changes to `context` wre directly reflected in the flow context. The context has been changed to only include the values, and as such updates like this won't be reflected in the flow. Instead, `context['flow_plan']` is now set, which contains a full reference to the flow Plan, allowing for more customisability than previously. Context changes can be mad by modifying `context['flow_plan'].context`.
## New features
- User paths
- User paths
To better organize users, they can now be assigned a path. This allows for organization of users based on sources they enrolled with/got imported from, organizational structure or any other structure.
Sources now have a path template to specify which path users created by it should be assigned. Additionally, you can set the path in the user_write stage in any flow, and it can be dynamically overwritten within a flow's context.
- API Authentication using JWT
- API Authentication using JWT
OAuth Refresh tokens that have been issued with the scope `goauthentik.io/api` can now be used to authenticate to the API on behalf of the user the token belongs to.
- Version-family tagged Container images
- Version-family tagged Container images
Instead of having to choose between using the `:latest` tag and explicit versions like `:2022.7.1`, there are now also version-family tags (:2022.7). This allows for sticking with a single version but still getting bugfix updates.
- OAuth2 Provider default Scopes
- OAuth2 Provider default Scopes
Starting with authentik 2022.7, when an OAuth client doesn't specify any scopes, authentik will treat the request as if all the configured scopes of that provider had been requested. Normal consent is still required depending on the configured flow. No special scopes will be added, as those can't be selected in the configuration.
## Minor changes/fixes
- \*: define prometheus metrics in apps to prevent re-import
- api: add basic jwt auth support with required scope (#2624)
- ci: add version family (#3059)
- core: add limit of 20 to group recursion
- core: create FlowToken instead of regular token for generated recovery links (#3193)
- core: mark session as modified instead of saving it directly to bump expiry
- core: re-create anonymous user when repairing permissions
- core: user paths (#3085)
- flows: add shortcut to redirect current flow (#3192)
- flows: denied action (#3194)
- flows: show messages from ak_message when flow is denied
- internal: failback with self-signed cert if cert for tenant fails to load
- internal: fix nil pointer reference
- internal: skip tracing for go healthcheck and metrics endpoints
- lifecycle: fix confusing success messages in startup healthiness check
- lifecycle: run bootstrap tasks inline when using automated install
- lifecycle: Update postgres healthcheck for compose with user information (#3143)
- policies: consolidate log user and application
- providers/oauth2: dont lowercase URL for token requests (#3114)
- providers/oauth2: ensure refresh tokens are URL safe
- providers/oauth2: fix OAuth form_post response mode for code response_type
- providers/oauth2: if a redirect_uri cannot be parsed as regex, compare strict (#3070)
- providers/oauth2: if no scopes are sent in authorize request, select all configured scopes
- providers/oauth2: remove deprecated verification_keys (#3071)
- providers/oauth2: token revoke (#3077)
- providers/proxy: only send misconfiguration event once
- root: ignore healthcheck routes in sentry tracing
- sources/ldap: add configuration for LDAP Source ciphers
- web: fix redirect when accessing authentik URLs authenticated
- web: improve detection for locales
- web/admin: default to users path in sidebar link
- web/admin: link bound group under policies
- web/admin: only pre-select oauth2 provider key if creating a new instance
- web/admin: remove invalid requirement for usernames
- web/elements: add spinner when loading dynamic routes
- web/elements: auto-switch themes for codemirror
- web/flows: add divider to identification stage for security key
- web/flows: fix error when webauthn operations failed and user retries
- web/flows: remove autofocus from password field of identifications stage
- web/flows: statically import webauthn-related stages for safari issues
- \*: define prometheus metrics in apps to prevent re-import
- api: add basic jwt auth support with required scope (#2624)
- ci: add version family (#3059)
- core: add limit of 20 to group recursion
- core: create FlowToken instead of regular token for generated recovery links (#3193)
- core: mark session as modified instead of saving it directly to bump expiry
- core: re-create anonymous user when repairing permissions
- core: user paths (#3085)
- flows: add shortcut to redirect current flow (#3192)
- flows: denied action (#3194)
- flows: show messages from ak_message when flow is denied
- internal: failback with self-signed cert if cert for tenant fails to load
- internal: fix nil pointer reference
- internal: skip tracing for go healthcheck and metrics endpoints
- lifecycle: fix confusing success messages in startup healthiness check
- lifecycle: run bootstrap tasks inline when using automated install
- lifecycle: Update postgres healthcheck for compose with user information (#3143)
- policies: consolidate log user and application
- providers/oauth2: dont lowercase URL for token requests (#3114)
- providers/oauth2: ensure refresh tokens are URL safe
- providers/oauth2: fix OAuth form_post response mode for code response_type
- providers/oauth2: if a redirect_uri cannot be parsed as regex, compare strict (#3070)
- providers/oauth2: if no scopes are sent in authorize request, select all configured scopes
- providers/oauth2: remove deprecated verification_keys (#3071)
- providers/oauth2: token revoke (#3077)
- providers/proxy: only send misconfiguration event once
- root: ignore healthcheck routes in sentry tracing
- sources/ldap: add configuration for LDAP Source ciphers
- web: fix redirect when accessing authentik URLs authenticated
- web: improve detection for locales
- web/admin: default to users path in sidebar link
- web/admin: link bound group under policies
- web/admin: only pre-select oauth2 provider key if creating a new instance
- web/admin: remove invalid requirement for usernames
- web/elements: add spinner when loading dynamic routes
- web/elements: auto-switch themes for codemirror
- web/flows: add divider to identification stage for security key
- web/flows: fix error when webauthn operations failed and user retries
- web/flows: remove autofocus from password field of identifications stage
- web/flows: statically import webauthn-related stages for safari issues
## Fixed in 2022.7.2
- flows: fix OOB flow incorrectly setting pending user
- stages/prompt: add basic file field (#3156)
- tenants: add default_locale read only field, pre-hydrate in flows and read in autodetect as first choice
- flows: fix OOB flow incorrectly setting pending user
- stages/prompt: add basic file field (#3156)
- tenants: add default_locale read only field, pre-hydrate in flows and read in autodetect as first choice
## Fixed in 2022.7.3
- core: delete expired models when filtering instead of excluding them
- providers/oauth2: correctly log authenticated user for OAuth views using protected_resource_view
- sources/oauth: use oidc preferred_username if set, otherwise nickname
- stages/consent: fix permissions for consent API (allow owner to delete)
- stages/prompt: force required to false when using readonlyfield
- stages/prompt: try to base64 decode file, fallback to keeping value as-is
- web/elements: improve contrast for codemirror backgrounds
- core: delete expired models when filtering instead of excluding them
- providers/oauth2: correctly log authenticated user for OAuth views using protected_resource_view
- sources/oauth: use oidc preferred_username if set, otherwise nickname
- stages/consent: fix permissions for consent API (allow owner to delete)
- stages/prompt: force required to false when using readonlyfield
- stages/prompt: try to base64 decode file, fallback to keeping value as-is
- web/elements: improve contrast for codemirror backgrounds
## Upgrading

88
website/docs/releases/2022/v2022.8.md
View File

@ -5,71 +5,71 @@ slug: "/releases/2022.8"
## Breaking changes
- Prompt fields with file type are now a full Base64 Data-URI
- Prompt fields with file type are now a full Base64 Data-URI
Previously the data was parsed into a string when possible, and when decoding failed, the raw base64 would be saved. Now, the entire URI is parsed, validated and kept in one piece, to make it possible to validate/save the MIME type.
## New features
- Blueprints
- Blueprints
Blueprints allow for the configuration, automation and templating of authentik objects and configurations. They can be used to bootstrap new instances, configure them automatically without external tools, and to template configurations for sharing. See more [here](../../customize/blueprints/index.md).
For installations upgrading to 2022.8, if a single flow exists, then the default blueprints will not be activated, to not overwrite user modifications.
- Simplified forward auth
- Simplified forward auth
In previous releases, to use forward auth, the reverse proxy would have to be configured to both send auth requests to the outpost, but also allow access to URLs starting with `/outpost.goauthentik.io`. The second part is now no longer required, with the exception of nginx. Existing setups should continue to function as previously.
- Support for Caddy forward auth
- Support for Caddy forward auth
Based on the traefik support, there is now dedicated support for Caddy with configuration examples, see [here](../../add-secure-apps/providers/proxy/forward_auth.mdx).
## Minor changes/fixes
- \*: improve error handling for startup tasks
- core: add API Endpoint to get all MFA devices, add web ui to delete MFA devices of any user
- core: add attributes. avatar method to allow custom uploaded avatars
- core: pre-hydrate config into templates to directly load correct assets
- flows: migrate flows to be yaml (#3335)
- internal: centralise config for listeners to use same config system everywhere (#3367)
- internal: fix outposts not reacting to signals while starting
- internal: fix race conditions when accessing settings before bootstrap
- internal: walk config in go, check, parse and load from scheme like in python
- lifecycle: optimise container lifecycle and process signals (#3332)
- providers/oauth2: don't separate scopes by comma-space in created events
- providers/oauth2: fix scopes without descriptions not being saved in consent
- providers/proxy: add caddy endpoint (#3330)
- providers/proxy: add is_superuser to ak_proxy object, only show full error when superuser
- providers/proxy: no exposed urls (#3151)
- root: fix dockerfile for blueprints
- sources/oauth: correctly concatenate URLs to allow custom parameters to be passed to authorization server
- sources/oauth: only send header authentication for OIDC source
- sources/oauth: use mailcow full_name as username for mailcow source (#3299)
- stages/\*: use stage-bound logger when possible
- stages/authenticator_validate: improve error handling for duo
- stages/authenticator_duo: fix imported Duo Device not having a name
- stages/authenticator_sms: use twilio SDK, improve docs
- stages/authenticator_totp: remove single device per user limit
- stages/consent: fix error when requests with identical empty permissions
- stages/consent: fix for post requests (#3339)
- stages/prompt: fix tests for file field
- \*: improve error handling for startup tasks
- core: add API Endpoint to get all MFA devices, add web ui to delete MFA devices of any user
- core: add attributes. avatar method to allow custom uploaded avatars
- core: pre-hydrate config into templates to directly load correct assets
- flows: migrate flows to be yaml (#3335)
- internal: centralise config for listeners to use same config system everywhere (#3367)
- internal: fix outposts not reacting to signals while starting
- internal: fix race conditions when accessing settings before bootstrap
- internal: walk config in go, check, parse and load from scheme like in python
- lifecycle: optimise container lifecycle and process signals (#3332)
- providers/oauth2: don't separate scopes by comma-space in created events
- providers/oauth2: fix scopes without descriptions not being saved in consent
- providers/proxy: add caddy endpoint (#3330)
- providers/proxy: add is_superuser to ak_proxy object, only show full error when superuser
- providers/proxy: no exposed urls (#3151)
- root: fix dockerfile for blueprints
- sources/oauth: correctly concatenate URLs to allow custom parameters to be passed to authorization server
- sources/oauth: only send header authentication for OIDC source
- sources/oauth: use mailcow full_name as username for mailcow source (#3299)
- stages/\*: use stage-bound logger when possible
- stages/authenticator_validate: improve error handling for duo
- stages/authenticator_duo: fix imported Duo Device not having a name
- stages/authenticator_sms: use twilio SDK, improve docs
- stages/authenticator_totp: remove single device per user limit
- stages/consent: fix error when requests with identical empty permissions
- stages/consent: fix for post requests (#3339)
- stages/prompt: fix tests for file field
## Fixed in 2022.8.2
- blueprints: add generic export next to flow exporter (#3439)
- blueprints: allow for adding remote blueprints (#3435)
- blueprints: fix exporter not ignoring non-SerializerModel objects
- blueprints: fix issue in prod setups with encoding dataclasses via json
- blueprints: remove \_state from exporter blueprints
- core: fix pre-hydrated config not being escaped properly
- events: correctly handle lists for cleaning/sanitization
- internal: fix routing for requests with querystring signature to embedded outpost
- lifecycle: add worker-status command to debug worker cpu usage issues
- providers/oauth2: fix oauth2 requests being logged as unauthenticated
- sources/oauth: fix missing doseq param for updating URL query string
- web/elements: fix automatic slug not working on newly opened forms
- web/flows: simplify consent's permission handling
- blueprints: add generic export next to flow exporter (#3439)
- blueprints: allow for adding remote blueprints (#3435)
- blueprints: fix exporter not ignoring non-SerializerModel objects
- blueprints: fix issue in prod setups with encoding dataclasses via json
- blueprints: remove \_state from exporter blueprints
- core: fix pre-hydrated config not being escaped properly
- events: correctly handle lists for cleaning/sanitization
- internal: fix routing for requests with querystring signature to embedded outpost
- lifecycle: add worker-status command to debug worker cpu usage issues
- providers/oauth2: fix oauth2 requests being logged as unauthenticated
- sources/oauth: fix missing doseq param for updating URL query string
- web/elements: fix automatic slug not working on newly opened forms
- web/flows: simplify consent's permission handling
## Upgrading

206
website/docs/releases/2022/v2022.9.md
View File

@ -5,15 +5,15 @@ slug: "/releases/2022.9"
## Breaking changes
- `WORKERS` environment variable has been renamed to match other config options, see [Configuration](../../install-config/configuration/configuration.mdx#authentik_web__workers-authentik-20229)
- `WORKERS` environment variable has been renamed to match other config options, see [Configuration](../../install-config/configuration/configuration.mdx#authentik_web__workers-authentik-20229)
## New features
- UI for Duo device Import
- UI for Duo device Import
Instead of manually having to call an API endpoint, there's now a UI for importing Duo devices.
- Duo Admin API integration
- Duo Admin API integration
When using a Duo MFA, Duo Access or Duo Beyond plan, authentik can now automatically import devices from Duo into authentik. More info [here](../../add-secure-apps/flows-stages/stages/authenticator_duo/index.md).
@ -43,9 +43,9 @@ slug: "/releases/2022.9"
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
##### `PUT` /stages/authenticator/duo/&#123;stage_uuid&#125;/
@ -53,17 +53,17 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
- Added property `admin_secret_key` (string)
- Added property `admin_secret_key` (string)
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
##### `PATCH` /stages/authenticator/duo/&#123;stage_uuid&#125;/
@ -71,17 +71,17 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
- Added property `admin_secret_key` (string)
- Added property `admin_secret_key` (string)
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
##### `GET` /flows/executor/&#123;flow_slug&#125;/
@ -89,51 +89,51 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
Added 'xak-flow-error' component:
- Property `type` (string)
- Property `type` (string)
Enum values:
- `native`
- `shell`
- `redirect`
- `native`
- `shell`
- `redirect`
- Property `flow_info` (object)
- Property `flow_info` (object)
> Contextual flow information for a challenge
- Property `title` (string)
- Property `title` (string)
- Property `background` (string)
- Property `background` (string)
- Property `cancel_url` (string)
- Property `cancel_url` (string)
- Property `layout` (string)
- Property `layout` (string)
Enum values:
- `stacked`
- `content_left`
- `content_right`
- `sidebar_left`
- `sidebar_right`
- `stacked`
- `content_left`
- `content_right`
- `sidebar_left`
- `sidebar_right`
- Property `component` (string)
- Property `component` (string)
- Property `response_errors` (object)
- Property `response_errors` (object)
- Property `pending_user` (string)
- Property `pending_user` (string)
- Property `pending_user_avatar` (string)
- Property `pending_user_avatar` (string)
- Property `request_id` (string)
- Property `request_id` (string)
- Property `error` (string)
- Property `error` (string)
- Property `traceback` (string)
- Property `traceback` (string)
##### `POST` /flows/executor/&#123;flow_slug&#125;/
@ -141,51 +141,51 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
Added 'xak-flow-error' component:
- Property `type` (string)
- Property `type` (string)
Enum values:
- `native`
- `shell`
- `redirect`
- `native`
- `shell`
- `redirect`
- Property `flow_info` (object)
- Property `flow_info` (object)
> Contextual flow information for a challenge
- Property `title` (string)
- Property `title` (string)
- Property `background` (string)
- Property `background` (string)
- Property `cancel_url` (string)
- Property `cancel_url` (string)
- Property `layout` (string)
- Property `layout` (string)
Enum values:
- `stacked`
- `content_left`
- `content_right`
- `sidebar_left`
- `sidebar_right`
- `stacked`
- `content_left`
- `content_right`
- `sidebar_left`
- `sidebar_right`
- Property `component` (string)
- Property `component` (string)
- Property `response_errors` (object)
- Property `response_errors` (object)
- Property `pending_user` (string)
- Property `pending_user` (string)
- Property `pending_user_avatar` (string)
- Property `pending_user_avatar` (string)
- Property `request_id` (string)
- Property `request_id` (string)
- Property `error` (string)
- Property `error` (string)
- Property `traceback` (string)
- Property `traceback` (string)
##### `POST` /stages/authenticator/duo/
@ -193,17 +193,17 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
- Added property `admin_secret_key` (string)
- Added property `admin_secret_key` (string)
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
##### `GET` /stages/authenticator/duo/
@ -211,55 +211,55 @@ Changed response : **201 Created**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > AuthenticatorDuoStage Serializer
- Added property `admin_integration_key` (string)
- Added property `admin_integration_key` (string)
## Minor changes/fixes
- \*: cleanup stray print calls
- \*: remove remaining default creation code in squashed migrations
- blueprint: fix EntryInvalidError not being handled in tasks
- blueprints: add meta model to apply blueprint within blueprint for dependencies (#3486)
- blueprints: don't export events by default and exclude anonymous user
- blueprints: OCI registry support (#3500)
- blueprints: use correct log level when re-logging import validation logs
- core: fix custom favicon not being set correctly on load
- core: improve error template (#3521)
- crypto: add command to import certificates
- events: fix MonitoredTasks' save_on_success not behaving as expected
- events: reset task info when not saving on success
- events: save event to test notification transport
- flows: fix incorrect diagram for policies bound to flows
- flows: migrate FlowExecutor error handler to native challenge instead of shell
- internal: fix outposts not logging flow execution errors correctly
- internal: optimise outpost's flow executor to use less requests
- internal: use config system for workers/threads, document the settings (#3626)
- outposts: fix oauth state when using signature routing (#3616)
- outposts/proxy: fix redirect path when external host is a subdirectory (#3628)
- providers/oauth2: add x5c (#3556)
- providers/proxy: fix routing based on signature in traefik and caddy
- root: make redis persistent in docker-compose
- root: reuse custom log helper from config and cleanup duplicate functions
- root: shorten outpost docker healthcheck intervals
- sources/ldap: start_tls before binding but without reading server info
- sources/oauth: use GitHub's dedicated email API when no public email address is configured
- sources/oauth: use UPN for username with azure AD source
- stages/authenticator_duo: fix 404 when current user does not have permissions to view stage
- stages/authenticator_duo: improved import (#3601)
- stages/consent: default to expiring consent instead of always_require
- tenants: handle all errors in default_locale
- web: fix checkbox styling on applications form
- web: fix scrolling in modals in low-height views (#3596)
- web: use mermaidjs (#3623)
- web/admin: enable blueprint instances by default
- web/flows: fix ak-locale prompt being rendered without name attribute
- web/flows: update flow background
- web/user: justify content on user settings page on desktop
- \*: cleanup stray print calls
- \*: remove remaining default creation code in squashed migrations
- blueprint: fix EntryInvalidError not being handled in tasks
- blueprints: add meta model to apply blueprint within blueprint for dependencies (#3486)
- blueprints: don't export events by default and exclude anonymous user
- blueprints: OCI registry support (#3500)
- blueprints: use correct log level when re-logging import validation logs
- core: fix custom favicon not being set correctly on load
- core: improve error template (#3521)
- crypto: add command to import certificates
- events: fix MonitoredTasks' save_on_success not behaving as expected
- events: reset task info when not saving on success
- events: save event to test notification transport
- flows: fix incorrect diagram for policies bound to flows
- flows: migrate FlowExecutor error handler to native challenge instead of shell
- internal: fix outposts not logging flow execution errors correctly
- internal: optimise outpost's flow executor to use less requests
- internal: use config system for workers/threads, document the settings (#3626)
- outposts: fix oauth state when using signature routing (#3616)
- outposts/proxy: fix redirect path when external host is a subdirectory (#3628)
- providers/oauth2: add x5c (#3556)
- providers/proxy: fix routing based on signature in traefik and caddy
- root: make redis persistent in docker-compose
- root: reuse custom log helper from config and cleanup duplicate functions
- root: shorten outpost docker healthcheck intervals
- sources/ldap: start_tls before binding but without reading server info
- sources/oauth: use GitHub's dedicated email API when no public email address is configured
- sources/oauth: use UPN for username with azure AD source
- stages/authenticator_duo: fix 404 when current user does not have permissions to view stage
- stages/authenticator_duo: improved import (#3601)
- stages/consent: default to expiring consent instead of always_require
- tenants: handle all errors in default_locale
- web: fix checkbox styling on applications form
- web: fix scrolling in modals in low-height views (#3596)
- web: use mermaidjs (#3623)
- web/admin: enable blueprint instances by default
- web/flows: fix ak-locale prompt being rendered without name attribute
- web/flows: update flow background
- web/user: justify content on user settings page on desktop
## Upgrading

518
website/docs/releases/2023/v2023.1.md
View File

File diff suppressed because it is too large Load Diff

2934
website/docs/releases/2023/v2023.10.md
View File

File diff suppressed because it is too large Load Diff

246
website/docs/releases/2023/v2023.2.md
View File

@ -5,21 +5,21 @@ slug: "/releases/2023.2"
## New features
- Proxy provider logout improvements
- Proxy provider logout improvements
In previous versions, logging out of a single proxied application would only invalidate that application's session. Starting with this release, when logging out of a proxied application (via the _/outpost.goauthentik.io/sign_out_ URL), all the users session within the outpost are terminated. Sessions in other outposts and with other protocols are unaffected.
Additionally, different providers now have different cookies, instead of all using the same "authentik_proxy" token.
- UX Improvements
- UX Improvements
As with the previous improvements, we've made a lot of minor improvements to the general authentik UX to make your life easier.
- OAuth2 Provider improvements
- OAuth2 Provider improvements
The OAuth2 provider has been reworked to be closer to OAuth specifications and better support refresh tokens and offline access. Additionally the expiry for access tokens and refresh tokens can be adjusted separately now.
- Generated avatars, multiple avatar modes
- Generated avatars, multiple avatar modes
authentik now supports multiple avatar modes, and will use the next configured mode when a mode doesn't have an avatar. For example, the new default configuration attempts to use gravatar, but if the user's email does not have a gravatar setup, it will instead use the new generated avatars. See [Configuration](../../sys-mgmt/settings.md#avatars)
@ -43,73 +43,73 @@ image:
## Minor changes/fixes
- \*/saml: disable pretty_print, add signature tests
- blueprints: don't update default tenant
- blueprints: handle error when blueprint entry identifier field does not exist
- core: Add support for auto generating unique avatars based on the user's initials (#4663)
- core: delete session when user is set to inactive
- core: fix inconsistent branding in end_session view
- core: fix missing uniqueness validator on user api
- core: fix token's set_key accessing data incorrectly
- events: dont log oauth temporary model creation
- events: improve sanitising for tuples and sets
- events: prevent error when request fails without response
- internal: better error message when outpost API controller couldn't fetch outposts
- internal: fix cache-control header
- policies/event_matcher: fix empty app label not being allowed, require at least 1 criteria
- providers/ldap: add unbind flow execution (#4484)
- providers/ldap: fix error not being checked correctly when fetching users
- providers/oauth2: add user id as "sub" mode
- providers/oauth2: don't use policy cache for token requests
- providers/oauth2: only set auth_time in ID token when a login event is stored in the session
- providers/oauth2: optimise client credentials JWT database lookup (#4606)
- providers/oauth2: rework OAuth2 Provider (#4652)
- providers/proxy: add token support for basic auth
- providers/proxy: different cookie name based on hashed client id (#4666)
- providers/proxy: outpost wide logout implementation (#4605)
- providers/saml: fix invalid SAML provider metadata, add schema tests
- providers/saml: fix mismatched SAML SLO Urls (#4655)
- stages/authenticator_validate: fix error with passwordless webauthn login
- stages/prompt: field name (#4497)
- stages/user_write: fix migration setting wrong value, fix form
- web: fix token delete form not showing token identifiers
- web/admin: add notice for user_login stage session cookie behaviour
- web/admin: clarify access code expiration
- web/admin: default to disable policy execution logging
- web/admin: fix certificate filtering for SAML verification certificate
- web/admin: rework event info page to show all event infos
- web/elements: add dropdown css to DOM directly instead of including
- web/elements: fix ak-expand not using correct font
- web/elements: fix clashing page url param
- web/elements: improve codemirror contrast in dark theme
- web/elements: make table rows clickable to select items
- web/elements: persist table page in URL parameters
- web/flows: fix flow background overlay on firefox
- web/user: filter tokens by username
- web/user: refactor loading of data in userinterface
- \*/saml: disable pretty_print, add signature tests
- blueprints: don't update default tenant
- blueprints: handle error when blueprint entry identifier field does not exist
- core: Add support for auto generating unique avatars based on the user's initials (#4663)
- core: delete session when user is set to inactive
- core: fix inconsistent branding in end_session view
- core: fix missing uniqueness validator on user api
- core: fix token's set_key accessing data incorrectly
- events: dont log oauth temporary model creation
- events: improve sanitising for tuples and sets
- events: prevent error when request fails without response
- internal: better error message when outpost API controller couldn't fetch outposts
- internal: fix cache-control header
- policies/event_matcher: fix empty app label not being allowed, require at least 1 criteria
- providers/ldap: add unbind flow execution (#4484)
- providers/ldap: fix error not being checked correctly when fetching users
- providers/oauth2: add user id as "sub" mode
- providers/oauth2: don't use policy cache for token requests
- providers/oauth2: only set auth_time in ID token when a login event is stored in the session
- providers/oauth2: optimise client credentials JWT database lookup (#4606)
- providers/oauth2: rework OAuth2 Provider (#4652)
- providers/proxy: add token support for basic auth
- providers/proxy: different cookie name based on hashed client id (#4666)
- providers/proxy: outpost wide logout implementation (#4605)
- providers/saml: fix invalid SAML provider metadata, add schema tests
- providers/saml: fix mismatched SAML SLO Urls (#4655)
- stages/authenticator_validate: fix error with passwordless webauthn login
- stages/prompt: field name (#4497)
- stages/user_write: fix migration setting wrong value, fix form
- web: fix token delete form not showing token identifiers
- web/admin: add notice for user_login stage session cookie behaviour
- web/admin: clarify access code expiration
- web/admin: default to disable policy execution logging
- web/admin: fix certificate filtering for SAML verification certificate
- web/admin: rework event info page to show all event infos
- web/elements: add dropdown css to DOM directly instead of including
- web/elements: fix ak-expand not using correct font
- web/elements: fix clashing page url param
- web/elements: improve codemirror contrast in dark theme
- web/elements: make table rows clickable to select items
- web/elements: persist table page in URL parameters
- web/flows: fix flow background overlay on firefox
- web/user: filter tokens by username
- web/user: refactor loading of data in userinterface
## Fixed in 2023.2.1
- internal: fix scheme not being forwarded correctly for host intercepted requests
- sources/ldap: add LDAP Debug endpoint
- web/admin: improve action button spinner on ldap source page
- web/admin: remove groups and users from users and group form to prevent accidental removal when updating
- web/admin: use full page size for modals
- internal: fix scheme not being forwarded correctly for host intercepted requests
- sources/ldap: add LDAP Debug endpoint
- web/admin: improve action button spinner on ldap source page
- web/admin: remove groups and users from users and group form to prevent accidental removal when updating
- web/admin: use full page size for modals
## Fixed in 2023.2.2
- flows: include flow authentication requirement in diagram
- lib: don't try to cache generated avatar with full user, only cache with name
- providers/ldap: check MFA password on password stage
- providers/proxy: fix client credential flows not using http interceptor
- providers/proxy: fix value is too long with filesystem sessions
- root: use channel send workaround for sync sending of websocket messages
- web/admin: fix error when creating new users
- web/user: revert truncate behaviour for application description
- flows: include flow authentication requirement in diagram
- lib: don't try to cache generated avatar with full user, only cache with name
- providers/ldap: check MFA password on password stage
- providers/proxy: fix client credential flows not using http interceptor
- providers/proxy: fix value is too long with filesystem sessions
- root: use channel send workaround for sync sending of websocket messages
- web/admin: fix error when creating new users
- web/user: revert truncate behaviour for application description
## Fixed in 2023.2.3
- \*: fix [CVE-2023-26481.md](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9)
- \*: fix [CVE-2023-26481.md](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9)
## API Changes
@ -131,15 +131,15 @@ image:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `PUT` /providers/oauth2/&#123;id&#125;/
@ -147,27 +147,27 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `PATCH` /providers/oauth2/&#123;id&#125;/
@ -175,27 +175,27 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `POST` /providers/oauth2/
@ -203,27 +203,27 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `GET` /providers/oauth2/
@ -237,19 +237,19 @@ Changed: `sub_mode` in `query`
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > OAuth2Provider Serializer
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `GET` /oauth2/authorization_codes/&#123;id&#125;/
@ -257,19 +257,19 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `provider` (object)
- Changed property `provider` (object)
> OAuth2Provider Serializer
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `GET` /oauth2/refresh_tokens/&#123;id&#125;/
@ -277,19 +277,19 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `provider` (object)
- Changed property `provider` (object)
> OAuth2Provider Serializer
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `GET` /oauth2/authorization_codes/
@ -297,23 +297,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
- Changed property `provider` (object)
- Changed property `provider` (object)
> OAuth2Provider Serializer
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `GET` /oauth2/refresh_tokens/
@ -321,23 +321,23 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > Serializer for BaseGrantModel and RefreshToken
- Changed property `provider` (object)
- Changed property `provider` (object)
> OAuth2Provider Serializer
- Changed property `sub_mode` (string)
- Changed property `sub_mode` (string)
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Added enum value:
- `user_id`
- `user_id`
##### `GET` /stages/prompt/prompts/&#123;prompt_uuid&#125;/
@ -345,13 +345,13 @@ Changed response : **200 OK**
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
New required properties:
- `name`
- `name`
* Added property `name` (string)
* Added property `name` (string)
##### `PUT` /stages/prompt/prompts/&#123;prompt_uuid&#125;/
@ -361,21 +361,21 @@ Changed content type : `application/json`
New required properties:
- `name`
- `name`
* Added property `name` (string)
* Added property `name` (string)
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
New required properties:
- `name`
- `name`
* Added property `name` (string)
* Added property `name` (string)
##### `PATCH` /stages/prompt/prompts/&#123;prompt_uuid&#125;/
@ -383,19 +383,19 @@ Changed response : **200 OK**
Changed content type : `application/json`
- Added property `name` (string)
- Added property `name` (string)
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
New required properties:
- `name`
- `name`
* Added property `name` (string)
* Added property `name` (string)
##### `POST` /stages/prompt/prompts/
@ -405,21 +405,21 @@ Changed content type : `application/json`
New required properties:
- `name`
- `name`
* Added property `name` (string)
* Added property `name` (string)
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed content type : `application/json`
New required properties:
- `name`
- `name`
* Added property `name` (string)
* Added property `name` (string)
##### `GET` /stages/prompt/prompts/
@ -431,14 +431,14 @@ Added: `name` in `query`
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed content type : `application/json`
- Changed property `results` (array)
- Changed property `results` (array)
Changed items (object): > Prompt Serializer
New required properties:
- `name`
- `name`
* Added property `name` (string)
* Added property `name` (string)

578
website/docs/releases/2023/v2023.3.md
View File

File diff suppressed because it is too large Load Diff

1882
website/docs/releases/2023/v2023.4.md
View File

File diff suppressed because it is too large Load Diff

4490
website/docs/releases/2023/v2023.5.md
View File

File diff suppressed because it is too large Load Diff

1702
website/docs/releases/2023/v2023.6.md
View File

File diff suppressed because it is too large Load Diff

1416
website/docs/releases/2023/v2023.8.md
View File

File diff suppressed because it is too large Load Diff

1606
website/docs/releases/2024/v2024.10.md
View File

File diff suppressed because it is too large Load Diff

10370
website/docs/releases/2024/v2024.2.md
View File

File diff suppressed because it is too large Load Diff

4980
website/docs/releases/2024/v2024.4.md
View File

File diff suppressed because it is too large Load Diff

774
website/docs/releases/2024/v2024.6.md
View File

File diff suppressed because it is too large Load Diff

Some files were not shown because too many files have changed in this diff Show More