Merge branch 'main' into dev
* main: (22 commits) blueprints: fix default username field in user-settings flow (#9136) website/docs: add procedural docs for RAC (#9006) web: bump API Client version (#9133) ci: fix python client generator (#9134) root: generate python client (#9107) web: Bump vite from 5.1.4 to 5.2.8 in /web (#9120) core, web: update translations (#9124) core: Bump golang from 1.22.1-bookworm to 1.22.2-bookworm (#9125) web: Bump the babel group in /web with 2 updates (#9126) web: Bump the eslint group in /web with 1 update (#9127) web: Bump the eslint group in /tests/wdio with 1 update (#9129) core: Bump sentry-sdk from 1.44.0 to 1.44.1 (#9130) core: Bump channels from 4.0.0 to 4.1.0 (#9131) core: Bump django from 5.0.3 to 5.0.4 (#9132) web: Bump the rollup group in /web with 3 updates (#9128) translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#9110) translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#9109) translate: Updates for file web/xliff/en.xlf in zh_CN (#9111) translate: Updates for file web/xliff/en.xlf in zh-Hans (#9112) web: Bump @fortawesome/fontawesome-free from 6.5.1 to 6.5.2 in /web (#9116) ...
This commit is contained in:
Ken Sternberg
65
.github/workflows/api-py-publish.yml
vendored
Normal file
65
.github/workflows/api-py-publish.yml
vendored
Normal file
@ -0,0 +1,65 @@
|
||||
name: authentik-api-py-publish
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
paths:
|
||||
- "schema.yml"
|
||||
workflow_dispatch:
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
id-token: write
|
||||
steps:
|
||||
- id: generate_token
|
||||
uses: tibdex/github-app-token@v2
|
||||
with:
|
||||
app_id: ${{ secrets.GH_APP_ID }}
|
||||
private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
token: ${{ steps.generate_token.outputs.token }}
|
||||
- name: Install poetry & deps
|
||||
shell: bash
|
||||
run: |
|
||||
pipx install poetry || true
|
||||
sudo apt-get update
|
||||
sudo apt-get install --no-install-recommends -y libpq-dev openssl libxmlsec1-dev pkg-config gettext
|
||||
- name: Setup python and restore poetry
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version-file: "pyproject.toml"
|
||||
cache: "poetry"
|
||||
- name: Generate API Client
|
||||
run: make gen-client-py
|
||||
- name: Publish package
|
||||
working-directory: gen-py-api/
|
||||
run: |
|
||||
poetry build
|
||||
- name: Publish package to PyPI
|
||||
uses: pypa/gh-action-pypi-publish@release/v1
|
||||
with:
|
||||
packages-dir: gen-py-api/dist/
|
||||
# We can't easily upgrade the API client being used due to poetry being poetry
|
||||
# so we'll have to rely on dependabot
|
||||
# - name: Upgrade /
|
||||
# run: |
|
||||
# export VERSION=$(cd gen-py-api && poetry version -s)
|
||||
# poetry add "authentik_client=$VERSION" --allow-prereleases --lock
|
||||
# - uses: peter-evans/create-pull-request@v6
|
||||
# id: cpr
|
||||
# with:
|
||||
# token: ${{ steps.generate_token.outputs.token }}
|
||||
# branch: update-root-api-client
|
||||
# commit-message: "root: bump API Client version"
|
||||
# title: "root: bump API Client version"
|
||||
# body: "root: bump API Client version"
|
||||
# delete-branch: true
|
||||
# signoff: true
|
||||
# # ID from https://api.github.com/users/authentik-automation[bot]
|
||||
# author: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
|
||||
# - uses: peter-evans/enable-pull-request-automerge@v3
|
||||
# with:
|
||||
# token: ${{ steps.generate_token.outputs.token }}
|
||||
# pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
|
||||
# merge-method: squash
|
||||
@ -1,4 +1,4 @@
|
||||
name: authentik-web-api-publish
|
||||
name: authentik-api-ts-publish
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
@ -38,7 +38,7 @@ COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
|
||||
RUN npm run build
|
||||
|
||||
# Stage 3: Build go proxy
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS go-builder
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.2-bookworm AS go-builder
|
||||
|
||||
ARG TARGETOS
|
||||
ARG TARGETARCH
|
||||
|
||||
20
Makefile
20
Makefile
@ -9,6 +9,7 @@ PY_SOURCES = authentik tests scripts lifecycle .github
|
||||
DOCKER_IMAGE ?= "authentik:test"
|
||||
|
||||
GEN_API_TS = "gen-ts-api"
|
||||
GEN_API_PY = "gen-py-api"
|
||||
GEN_API_GO = "gen-go-api"
|
||||
|
||||
pg_user := $(shell python -m authentik.lib.config postgresql.user 2>/dev/null)
|
||||
@ -137,7 +138,10 @@ gen-clean-ts: ## Remove generated API client for Typescript
|
||||
gen-clean-go: ## Remove generated API client for Go
|
||||
rm -rf ./${GEN_API_GO}/
|
||||
|
||||
gen-clean: gen-clean-ts gen-clean-go ## Remove generated API clients
|
||||
gen-clean-py: ## Remove generated API client for Python
|
||||
rm -rf ./${GEN_API_PY}/
|
||||
|
||||
gen-clean: gen-clean-ts gen-clean-go gen-clean-py ## Remove generated API clients
|
||||
|
||||
gen-client-ts: gen-clean-ts ## Build and install the authentik API for Typescript into the authentik UI Application
|
||||
docker run \
|
||||
@ -155,6 +159,20 @@ gen-client-ts: gen-clean-ts ## Build and install the authentik API for Typescri
|
||||
cd ./${GEN_API_TS} && npm i
|
||||
\cp -rf ./${GEN_API_TS}/* web/node_modules/@goauthentik/api
|
||||
|
||||
gen-client-py: gen-clean-py ## Build and install the authentik API for Python
|
||||
docker run \
|
||||
--rm -v ${PWD}:/local \
|
||||
--user ${UID}:${GID} \
|
||||
docker.io/openapitools/openapi-generator-cli:v7.4.0 generate \
|
||||
-i /local/schema.yml \
|
||||
-g python \
|
||||
-o /local/${GEN_API_PY} \
|
||||
-c /local/scripts/api-py-config.yaml \
|
||||
--additional-properties=packageVersion=${NPM_VERSION} \
|
||||
--git-repo-id authentik \
|
||||
--git-user-id goauthentik
|
||||
pip install ./${GEN_API_PY}
|
||||
|
||||
gen-client-go: gen-clean-go ## Build and install the authentik API for Golang
|
||||
mkdir -p ./${GEN_API_GO} ./${GEN_API_GO}/templates
|
||||
wget https://raw.githubusercontent.com/goauthentik/client-go/main/config.yaml -O ./${GEN_API_GO}/config.yaml
|
||||
|
||||
@ -85,7 +85,7 @@ class UserGroupSerializer(ModelSerializer):
|
||||
"""Simplified Group Serializer for user's groups"""
|
||||
|
||||
attributes = JSONDictField(required=False)
|
||||
parent_name = CharField(source="parent.name", read_only=True)
|
||||
parent_name = CharField(source="parent.name", read_only=True, allow_null=True)
|
||||
|
||||
class Meta:
|
||||
model = Group
|
||||
|
||||
@ -156,6 +156,7 @@ SPECTACULAR_SETTINGS = {
|
||||
"UserTypeEnum": "authentik.core.models.UserTypes",
|
||||
},
|
||||
"ENUM_ADD_EXPLICIT_BLANK_NULL_CHOICE": False,
|
||||
"ENUM_GENERATE_CHOICE_DESCRIPTION": False,
|
||||
"POSTPROCESSING_HOOKS": [
|
||||
"authentik.api.schema.postprocess_schema_responses",
|
||||
"drf_spectacular.hooks.postprocess_schema_enums",
|
||||
|
||||
@ -22,7 +22,7 @@ entries:
|
||||
return ''
|
||||
initial_value_expression: true
|
||||
required: true
|
||||
type: text
|
||||
type: username
|
||||
field_key: username
|
||||
label: Username
|
||||
identifiers:
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
# syntax=docker/dockerfile:1
|
||||
|
||||
# Stage 1: Build
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS builder
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.2-bookworm AS builder
|
||||
|
||||
ARG TARGETOS
|
||||
ARG TARGETARCH
|
||||
|
||||
@ -14,7 +14,7 @@ msgid ""
|
||||
msgstr ""
|
||||
"Project-Id-Version: PACKAGE VERSION\n"
|
||||
"Report-Msgid-Bugs-To: \n"
|
||||
"POT-Creation-Date: 2024-03-05 00:07+0000\n"
|
||||
"POT-Creation-Date: 2024-04-01 23:02+0000\n"
|
||||
"PO-Revision-Date: 2022-09-26 16:47+0000\n"
|
||||
"Last-Translator: deluxghost, 2024\n"
|
||||
"Language-Team: Chinese Simplified (https://app.transifex.com/authentik/teams/119923/zh-Hans/)\n"
|
||||
@ -468,6 +468,20 @@ msgstr "已达到最大连接数。"
|
||||
msgid "(You are already connected in another tab/window)"
|
||||
msgstr "（您已经在另一个标签页/窗口连接了）"
|
||||
|
||||
#: authentik/enterprise/stages/source/models.py
|
||||
msgid ""
|
||||
"Amount of time a user can take to return from the source to continue the "
|
||||
"flow (Format: hours=-1;minutes=-2;seconds=-3)"
|
||||
msgstr "用户从源返回并继续流程可以消耗的时间（格式：hours=-1;minutes=-2;seconds=-3）"
|
||||
|
||||
#: authentik/enterprise/stages/source/models.py
|
||||
msgid "Source Stage"
|
||||
msgstr "源阶段"
|
||||
|
||||
#: authentik/enterprise/stages/source/models.py
|
||||
msgid "Source Stages"
|
||||
msgstr "源阶段"
|
||||
|
||||
#: authentik/events/api/tasks.py
|
||||
#, python-brace-format
|
||||
msgid "Successfully started task {name}."
|
||||
@ -1772,6 +1786,10 @@ msgstr "将与此过滤器匹配的对象视为组。"
|
||||
msgid "Field which contains a unique Identifier."
|
||||
msgstr "包含唯一标识符的字段。"
|
||||
|
||||
#: authentik/sources/ldap/models.py
|
||||
msgid "Update internal authentik password when login succeeds with LDAP"
|
||||
msgstr "使用 LDAP 登录成功时更新内部 authentik 密码"
|
||||
|
||||
#: authentik/sources/ldap/models.py
|
||||
msgid ""
|
||||
"When a user changes their password, sync it back to LDAP. This can only be "
|
||||
@ -2199,8 +2217,10 @@ msgid "TOTP Devices"
|
||||
msgstr "TOTP 设备"
|
||||
|
||||
#: authentik/stages/authenticator_validate/challenge.py
|
||||
msgid "Invalid Token"
|
||||
msgstr "无效令牌"
|
||||
msgid ""
|
||||
"Invalid Token. Please ensure the time on your device is accurate and try "
|
||||
"again."
|
||||
msgstr "无效的令牌。请确保设备上的时间准确并重试。"
|
||||
|
||||
#: authentik/stages/authenticator_validate/models.py
|
||||
msgid "Static"
|
||||
|
||||
@ -14,7 +14,7 @@ msgid ""
|
||||
msgstr ""
|
||||
"Project-Id-Version: PACKAGE VERSION\n"
|
||||
"Report-Msgid-Bugs-To: \n"
|
||||
"POT-Creation-Date: 2024-03-05 00:07+0000\n"
|
||||
"POT-Creation-Date: 2024-04-01 23:02+0000\n"
|
||||
"PO-Revision-Date: 2022-09-26 16:47+0000\n"
|
||||
"Last-Translator: deluxghost, 2024\n"
|
||||
"Language-Team: Chinese (China) (https://app.transifex.com/authentik/teams/119923/zh_CN/)\n"
|
||||
@ -468,6 +468,20 @@ msgstr "已达到最大连接数。"
|
||||
msgid "(You are already connected in another tab/window)"
|
||||
msgstr "（您已经在另一个标签页/窗口连接了）"
|
||||
|
||||
#: authentik/enterprise/stages/source/models.py
|
||||
msgid ""
|
||||
"Amount of time a user can take to return from the source to continue the "
|
||||
"flow (Format: hours=-1;minutes=-2;seconds=-3)"
|
||||
msgstr "用户从源返回并继续流程可以消耗的时间（格式：hours=-1;minutes=-2;seconds=-3）"
|
||||
|
||||
#: authentik/enterprise/stages/source/models.py
|
||||
msgid "Source Stage"
|
||||
msgstr "源阶段"
|
||||
|
||||
#: authentik/enterprise/stages/source/models.py
|
||||
msgid "Source Stages"
|
||||
msgstr "源阶段"
|
||||
|
||||
#: authentik/events/api/tasks.py
|
||||
#, python-brace-format
|
||||
msgid "Successfully started task {name}."
|
||||
@ -1772,6 +1786,10 @@ msgstr "将与此过滤器匹配的对象视为组。"
|
||||
msgid "Field which contains a unique Identifier."
|
||||
msgstr "包含唯一标识符的字段。"
|
||||
|
||||
#: authentik/sources/ldap/models.py
|
||||
msgid "Update internal authentik password when login succeeds with LDAP"
|
||||
msgstr "使用 LDAP 登录成功时更新内部 authentik 密码"
|
||||
|
||||
#: authentik/sources/ldap/models.py
|
||||
msgid ""
|
||||
"When a user changes their password, sync it back to LDAP. This can only be "
|
||||
@ -2199,8 +2217,10 @@ msgid "TOTP Devices"
|
||||
msgstr "TOTP 设备"
|
||||
|
||||
#: authentik/stages/authenticator_validate/challenge.py
|
||||
msgid "Invalid Token"
|
||||
msgstr "无效令牌"
|
||||
msgid ""
|
||||
"Invalid Token. Please ensure the time on your device is accurate and try "
|
||||
"again."
|
||||
msgstr "无效的令牌。请确保设备上的时间准确并重试。"
|
||||
|
||||
#: authentik/stages/authenticator_validate/models.py
|
||||
msgid "Static"
|
||||
|
||||
24
poetry.lock
generated
24
poetry.lock
generated
@ -677,19 +677,19 @@ pycparser = "*"
|
||||
|
||||
[[package]]
|
||||
name = "channels"
|
||||
version = "4.0.0"
|
||||
version = "4.1.0"
|
||||
description = "Brings async, event-driven capabilities to Django 3.2 and up."
|
||||
optional = false
|
||||
python-versions = ">=3.7"
|
||||
python-versions = ">=3.8"
|
||||
files = [
|
||||
{file = "channels-4.0.0-py3-none-any.whl", hash = "sha256:2253334ac76f67cba68c2072273f7e0e67dbdac77eeb7e318f511d2f9a53c5e4"},
|
||||
{file = "channels-4.0.0.tar.gz", hash = "sha256:0ce53507a7da7b148eaa454526e0e05f7da5e5d1c23440e4886cf146981d8420"},
|
||||
{file = "channels-4.1.0-py3-none-any.whl", hash = "sha256:a3c4419307f582c3f71d67bfb6eff748ae819c2f360b9b141694d84f242baa48"},
|
||||
{file = "channels-4.1.0.tar.gz", hash = "sha256:e0ed375719f5c1851861f05ed4ce78b0166f9245ca0ecd836cb77d4bb531489d"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
asgiref = ">=3.5.0,<4"
|
||||
asgiref = ">=3.6.0,<4"
|
||||
daphne = {version = ">=4.0.0", optional = true, markers = "extra == \"daphne\""}
|
||||
Django = ">=3.2"
|
||||
Django = ">=4.2"
|
||||
|
||||
[package.extras]
|
||||
daphne = ["daphne (>=4.0.0)"]
|
||||
@ -1122,13 +1122,13 @@ files = [
|
||||
|
||||
[[package]]
|
||||
name = "django"
|
||||
version = "5.0.3"
|
||||
version = "5.0.4"
|
||||
description = "A high-level Python web framework that encourages rapid development and clean, pragmatic design."
|
||||
optional = false
|
||||
python-versions = ">=3.10"
|
||||
files = [
|
||||
{file = "Django-5.0.3-py3-none-any.whl", hash = "sha256:5c7d748ad113a81b2d44750ccc41edc14e933f56581683db548c9257e078cc83"},
|
||||
{file = "Django-5.0.3.tar.gz", hash = "sha256:5fb37580dcf4a262f9258c1f4373819aacca906431f505e4688e37f3a99195df"},
|
||||
{file = "Django-5.0.4-py3-none-any.whl", hash = "sha256:916423499d75d62da7aa038d19aef23d23498d8df229775eb0a6309ee1013775"},
|
||||
{file = "Django-5.0.4.tar.gz", hash = "sha256:4bd01a8c830bb77a8a3b0e7d8b25b887e536ad17a81ba2dce5476135c73312bd"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
@ -3568,13 +3568,13 @@ urllib3 = {version = ">=1.26,<3", extras = ["socks"]}
|
||||
|
||||
[[package]]
|
||||
name = "sentry-sdk"
|
||||
version = "1.44.0"
|
||||
version = "1.44.1"
|
||||
description = "Python client for Sentry (https://sentry.io)"
|
||||
optional = false
|
||||
python-versions = "*"
|
||||
files = [
|
||||
{file = "sentry-sdk-1.44.0.tar.gz", hash = "sha256:f7125a9235795811962d52ff796dc032cd1d0dd98b59beaced8380371cd9c13c"},
|
||||
{file = "sentry_sdk-1.44.0-py2.py3-none-any.whl", hash = "sha256:eb65289da013ca92fad2694851ad2f086aa3825e808dc285bd7dcaf63602bb18"},
|
||||
{file = "sentry-sdk-1.44.1.tar.gz", hash = "sha256:24e6a53eeabffd2f95d952aa35ca52f0f4201d17f820ac9d3ff7244c665aaf68"},
|
||||
{file = "sentry_sdk-1.44.1-py2.py3-none-any.whl", hash = "sha256:5f75eb91d8ab6037c754a87b8501cc581b2827e923682f593bed3539ce5b3999"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
|
||||
@ -17,7 +17,7 @@ COPY web .
|
||||
RUN npm run build-proxy
|
||||
|
||||
# Stage 2: Build
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS builder
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.2-bookworm AS builder
|
||||
|
||||
ARG TARGETOS
|
||||
ARG TARGETARCH
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
# syntax=docker/dockerfile:1
|
||||
|
||||
# Stage 1: Build
|
||||
FROM docker.io/golang:1.22.1-bookworm AS builder
|
||||
FROM docker.io/golang:1.22.2-bookworm AS builder
|
||||
|
||||
WORKDIR /go/src/goauthentik.io
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
# syntax=docker/dockerfile:1
|
||||
|
||||
# Stage 1: Build
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS builder
|
||||
FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.2-bookworm AS builder
|
||||
|
||||
ARG TARGETOS
|
||||
ARG TARGETARCH
|
||||
|
||||
1866
schema.yml
1866
schema.yml
File diff suppressed because it is too large
Load Diff
4
scripts/api-py-config.yaml
Normal file
4
scripts/api-py-config.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
additionalProperties:
|
||||
packageName: authentik_client
|
||||
projectName: authentik-client
|
||||
infoName: authentik Team
|
||||
8
tests/wdio/package-lock.json
generated
8
tests/wdio/package-lock.json
generated
@ -18,7 +18,7 @@
|
||||
"@wdio/spec-reporter": "^8.32.4",
|
||||
"eslint": "^8.57.0",
|
||||
"eslint-config-google": "^0.14.0",
|
||||
"eslint-plugin-sonarjs": "^0.25.0",
|
||||
"eslint-plugin-sonarjs": "^0.25.1",
|
||||
"npm-run-all": "^4.1.5",
|
||||
"prettier": "^3.2.5",
|
||||
"ts-node": "^10.9.2",
|
||||
@ -3114,9 +3114,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/eslint-plugin-sonarjs": {
|
||||
"version": "0.25.0",
|
||||
"resolved": "https://registry.npmjs.org/eslint-plugin-sonarjs/-/eslint-plugin-sonarjs-0.25.0.tgz",
|
||||
"integrity": "sha512-DaZOtpUucEZbvowgKxVFwICV6r0h7jSCAx0IHICvCowP+etFussnhtaiCPSnYAuwVJ+P/6UFUhkv7QJklpXFyA==",
|
||||
"version": "0.25.1",
|
||||
"resolved": "https://registry.npmjs.org/eslint-plugin-sonarjs/-/eslint-plugin-sonarjs-0.25.1.tgz",
|
||||
"integrity": "sha512-5IOKvj/GMBNqjxBdItfotfRHo7w48496GOu1hxdeXuD0mB1JBlDCViiLHETDTfA8pDAVSBimBEQoetRXYceQEw==",
|
||||
"dev": true,
|
||||
"engines": {
|
||||
"node": ">=16"
|
||||
|
||||
@ -12,7 +12,7 @@
|
||||
"@wdio/spec-reporter": "^8.32.4",
|
||||
"eslint": "^8.57.0",
|
||||
"eslint-config-google": "^0.14.0",
|
||||
"eslint-plugin-sonarjs": "^0.25.0",
|
||||
"eslint-plugin-sonarjs": "^0.25.1",
|
||||
"npm-run-all": "^4.1.5",
|
||||
"prettier": "^3.2.5",
|
||||
"ts-node": "^10.9.2",
|
||||
|
||||
729
web/package-lock.json
generated
729
web/package-lock.json
generated
File diff suppressed because it is too large
Load Diff
@ -37,8 +37,8 @@
|
||||
"@codemirror/legacy-modes": "^6.3.3",
|
||||
"@codemirror/theme-one-dark": "^6.1.2",
|
||||
"@formatjs/intl-listformat": "^7.5.5",
|
||||
"@fortawesome/fontawesome-free": "^6.5.1",
|
||||
"@goauthentik/api": "^2024.2.2-1711643691",
|
||||
"@fortawesome/fontawesome-free": "^6.5.2",
|
||||
"@goauthentik/api": "^2024.2.2-1712238004",
|
||||
"@lit-labs/task": "^3.1.0",
|
||||
"@lit/context": "^1.1.0",
|
||||
"@lit/localize": "^0.12.1",
|
||||
@ -68,13 +68,13 @@
|
||||
"yaml": "^2.4.1"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@babel/core": "^7.24.3",
|
||||
"@babel/core": "^7.24.4",
|
||||
"@babel/plugin-proposal-class-properties": "^7.18.6",
|
||||
"@babel/plugin-proposal-decorators": "^7.24.1",
|
||||
"@babel/plugin-transform-private-methods": "^7.24.1",
|
||||
"@babel/plugin-transform-private-property-in-object": "^7.24.1",
|
||||
"@babel/plugin-transform-runtime": "^7.24.3",
|
||||
"@babel/preset-env": "^7.24.3",
|
||||
"@babel/preset-env": "^7.24.4",
|
||||
"@babel/preset-typescript": "^7.24.1",
|
||||
"@hcaptcha/types": "^1.0.3",
|
||||
"@jeysal/storybook-addon-css-user-preferences": "^0.2.0",
|
||||
@ -105,7 +105,7 @@
|
||||
"eslint-config-google": "^0.14.0",
|
||||
"eslint-plugin-custom-elements": "0.0.8",
|
||||
"eslint-plugin-lit": "^1.11.0",
|
||||
"eslint-plugin-sonarjs": "^0.25.0",
|
||||
"eslint-plugin-sonarjs": "^0.25.1",
|
||||
"eslint-plugin-storybook": "^0.8.0",
|
||||
"github-slugger": "^2.0.0",
|
||||
"glob": "^10.3.12",
|
||||
@ -129,9 +129,9 @@
|
||||
"@esbuild/darwin-arm64": "^0.20.1",
|
||||
"@esbuild/linux-amd64": "^0.18.11",
|
||||
"@esbuild/linux-arm64": "^0.20.1",
|
||||
"@rollup/rollup-darwin-arm64": "4.13.2",
|
||||
"@rollup/rollup-linux-arm64-gnu": "4.13.2",
|
||||
"@rollup/rollup-linux-x64-gnu": "4.13.2"
|
||||
"@rollup/rollup-darwin-arm64": "4.14.0",
|
||||
"@rollup/rollup-linux-arm64-gnu": "4.14.0",
|
||||
"@rollup/rollup-linux-x64-gnu": "4.14.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=20"
|
||||
|
||||
@ -8458,51 +8458,67 @@ Bindings to groups/users are checked against the user of the event.</source>
|
||||
</trans-unit>
|
||||
<trans-unit id="s00bcaadd620a11f8">
|
||||
<source>Latest version unknown</source>
|
||||
<target>最新版本未知</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s10fedec3a779ea63">
|
||||
<source>Timestamp</source>
|
||||
<target>时间戳</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s48e186fb300e5464">
|
||||
<source>Time</source>
|
||||
<target>时间</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="saa8aa81ad6f055fd">
|
||||
<source>Level</source>
|
||||
<target>等级</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="sd0ea7366ebc403ff">
|
||||
<source>Event</source>
|
||||
<target>事件</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s225f3e57c6a0d635">
|
||||
<source>Logger</source>
|
||||
<target>日志记录器</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s39d6971531a270b6">
|
||||
<source>Update internal password on login</source>
|
||||
<target>登录时更新内部密码</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="sefe04e319223a3d6">
|
||||
<source>When the user logs in to authentik using this source password backend, update their credentials in authentik.</source>
|
||||
<target>当用户使用此源密码后端登录 authentik 时，在 authentik 内更新他们的凭据。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s5f43af3669b1e098">
|
||||
<source>Source</source>
|
||||
<target>源</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="sd9f752de8448bcc9">
|
||||
<source>Resume timeout</source>
|
||||
<target>恢复超时</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s517954806d7610f2">
|
||||
<source>Amount of time a user can take to return from the source to continue the flow.</source>
|
||||
<target>用户从源返回并继续流程可以消耗的时间。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s8c4bc6e515949112">
|
||||
<source>Your Install ID</source>
|
||||
<target>您的安装 ID</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s8cc0075913c67566">
|
||||
<source>Enter the email associated with your account, and we'll send you a link to reset your password.</source>
|
||||
<target>输入与您的账户关联的电子邮件地址，我们将会向您发送重置密码链接。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s06bfe45ffef2cf60">
|
||||
<source>Stage name: <x id="0" equiv-text="${this.challenge.name}"/></source>
|
||||
<target>阶段名称：<x id="0" equiv-text="${this.challenge.name}"/></target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s90064dd5c4dde2c6">
|
||||
<source>Please scan the QR code above using the Microsoft Authenticator, Google Authenticator, or other authenticator apps on your device, and enter the code the device displays below to finish setting up the MFA device.</source>
|
||||
<target>请用 Microsoft 身份验证器、Google 身份验证器或您设备上的其他身份验证器应用扫描上面的二维码，然后在下方输入设备上显示的代码，以完成 MFA 设备设置。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s02160dc6adba3456">
|
||||
<source>Inject an OAuth or SAML Source into the flow execution. This allows for additional user verification, or to dynamically access different sources for different user identifiers (username, email address, etc).</source>
|
||||
<target>将 OAuth 或 SAML 源注入到流程执行过程中。这允许额外的用户验证，或者基于不同的用户标识符（用户名、电子邮件地址等）动态访问不同的源。</target>
|
||||
</trans-unit>
|
||||
</body>
|
||||
</file>
|
||||
|
||||
@ -7175,10 +7175,6 @@ Bindings to groups/users are checked against the user of the event.</source>
|
||||
<source>License(s)</source>
|
||||
<target>许可证</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s3be1d90ffa46b7f1">
|
||||
<source>Enterprise is in preview.</source>
|
||||
<target>企业版目前处于预览状态。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="sd22bd01bdf28c548">
|
||||
<source>Cumulative license expiry</source>
|
||||
<target>累计许可证过期时间</target>
|
||||
@ -8459,6 +8455,70 @@ Bindings to groups/users are checked against the user of the event.</source>
|
||||
<trans-unit id="s6ecfc18dbfeedd76">
|
||||
<source>Select one of the options below to continue.</source>
|
||||
<target>选择以下选项之一以继续。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s00bcaadd620a11f8">
|
||||
<source>Latest version unknown</source>
|
||||
<target>最新版本未知</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s10fedec3a779ea63">
|
||||
<source>Timestamp</source>
|
||||
<target>时间戳</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s48e186fb300e5464">
|
||||
<source>Time</source>
|
||||
<target>时间</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="saa8aa81ad6f055fd">
|
||||
<source>Level</source>
|
||||
<target>等级</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="sd0ea7366ebc403ff">
|
||||
<source>Event</source>
|
||||
<target>事件</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s225f3e57c6a0d635">
|
||||
<source>Logger</source>
|
||||
<target>日志记录器</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s39d6971531a270b6">
|
||||
<source>Update internal password on login</source>
|
||||
<target>登录时更新内部密码</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="sefe04e319223a3d6">
|
||||
<source>When the user logs in to authentik using this source password backend, update their credentials in authentik.</source>
|
||||
<target>当用户使用此源密码后端登录 authentik 时，在 authentik 内更新他们的凭据。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s5f43af3669b1e098">
|
||||
<source>Source</source>
|
||||
<target>源</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="sd9f752de8448bcc9">
|
||||
<source>Resume timeout</source>
|
||||
<target>恢复超时</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s517954806d7610f2">
|
||||
<source>Amount of time a user can take to return from the source to continue the flow.</source>
|
||||
<target>用户从源返回并继续流程可以消耗的时间。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s8c4bc6e515949112">
|
||||
<source>Your Install ID</source>
|
||||
<target>您的安装 ID</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s8cc0075913c67566">
|
||||
<source>Enter the email associated with your account, and we'll send you a link to reset your password.</source>
|
||||
<target>输入与您的账户关联的电子邮件地址，我们将会向您发送重置密码链接。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s06bfe45ffef2cf60">
|
||||
<source>Stage name: <x id="0" equiv-text="${this.challenge.name}"/></source>
|
||||
<target>阶段名称：<x id="0" equiv-text="${this.challenge.name}"/></target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s90064dd5c4dde2c6">
|
||||
<source>Please scan the QR code above using the Microsoft Authenticator, Google Authenticator, or other authenticator apps on your device, and enter the code the device displays below to finish setting up the MFA device.</source>
|
||||
<target>请用 Microsoft 身份验证器、Google 身份验证器或您设备上的其他身份验证器应用扫描上面的二维码，然后在下方输入设备上显示的代码，以完成 MFA 设备设置。</target>
|
||||
</trans-unit>
|
||||
<trans-unit id="s02160dc6adba3456">
|
||||
<source>Inject an OAuth or SAML Source into the flow execution. This allows for additional user verification, or to dynamically access different sources for different user identifiers (username, email address, etc).</source>
|
||||
<target>将 OAuth 或 SAML 源注入到流程执行过程中。这允许额外的用户验证，或者基于不同的用户标识符（用户名、电子邮件地址等）动态访问不同的源。</target>
|
||||
</trans-unit>
|
||||
</body>
|
||||
</file>
|
||||
|
||||
@ -2,30 +2,58 @@
|
||||
title: Outposts
|
||||
---
|
||||
|
||||
An outpost is a single deployment of an authentik component, which can be deployed in a completely separate environment:
|
||||
An outpost is a single deployment of an authentik component, essentially a service, that can be deployed anywhere that allows for a connection to the authentik API.
|
||||
|
||||
An outpost is required if you use any of the following types of providers with your application:
|
||||
|
||||
- [LDAP Provider](../providers/ldap/index.md)
|
||||
- [Proxy Provider](../providers/proxy/index.md)
|
||||
- [RADIUS Provider](../providers/radius/index.md)
|
||||
- [RAC Provider](../providers/rac/index.md)
|
||||
|
||||
|
||||
These types of providers use an outpost for increased flexibility and speed. Instead of the provider logic being implemented in authentik Core, these providers use an outpost to handle the logic, which provides improved performance.
|
||||
|
||||
Upon creation, a service account and a token is generated. The service account only has permissions to read the outpost and provider configuration. This token is used by the Outpost to connect to authentik.
|
||||
An additional advantage of using an outpost is that outposts, like authentik itself, do not require access to the wider internet. Transactions between the application, the provider, and the outpost occur via the authentik API, and support single sign-on operations in firewalled or airgapped deployments and offline connections to remote machines that are not on the internet.
|
||||
|
||||
authentik can manage the deployment, updating and general lifecycle of an Outpost. To communicate with the underlying platforms on which the outpost is deployed, authentik has several built-in integrations.
|
||||
An outpost is given permissions to access the authentik API using a service account and token, both of which are auto-generated when you create a new outpost. The outpost is granted rights to only the application/provider pairs configured (and other necessary related objects such as certificates).
|
||||
|
||||
Any change made to the outpost's associated app or provider immediately triggers an event to update the configuration data stored on the outpost, via websockets. Websockets are used also by the outpost to send healthchecks to the authentik Core.
|
||||
|
||||
## Create and configure an outpost
|
||||
|
||||
1. To create a new outpost, log in to authentik as an administrator, and open to the Admin interface.
|
||||
|
||||
2. Navigate to **Applications --> Outposts** and then click **Create**.
|
||||
|
||||
|
||||
|
||||
3. Define the following values:
|
||||
|
||||
- **Name**: a name for the new outpost
|
||||
- **Type**: select the provider type (Proxy, LDAP, Radius, RAC)
|
||||
- **Integration** (_optional_): select either your [Docker or Kubernetes connection](#more-about-outpost-integrations)
|
||||
- **Applications**: select the applications that you want the outpost to serve
|
||||
- **Advanced settings** (*optional*): For further optional configuration settings, refer to [Configuration](#configuration) below.
|
||||
|
||||
4. Click **Create** to save your new outpost settings and close the modal.
|
||||
|
||||
Upon creation, a service account and a token is generated. The service account only has permissions to read the outpost and provider configuration. This token is used by the outpost to connect to authentik.
|
||||
|
||||
### More about outpost integrations
|
||||
|
||||
authentik can manage the deployment, updating, and general lifecycle of an outpost. To communicate with the underlying platforms on which the outpost is deployed, authentik has several built-in integrations.
|
||||
|
||||
- If you've deployed authentik on Docker Compose, authentik automatically creates an integration for the local docker socket (See [Docker](./integrations/docker.md)).
|
||||
- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates an integrations for the local Kubernetes Cluster (See [Kubernetes](./integrations/kubernetes.md)).
|
||||
- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates an integrations for the local Kubernetes Cluster (see [Kubernetes](./integrations/kubernetes.md)).
|
||||
|
||||
To deploy an outpost with these integrations, simply select them during the creation of an Outpost. A background task is started, which creates the container/deployment. You can see that Status on the System Tasks page.
|
||||
To deploy an outpost with these integrations, select them during the creation of an outpost. A background task is started, which creates the container/deployment. The outpost deployment can be monitored from the **Dashboards -> System Tasks** page in the Admin interface.
|
||||
|
||||
To deploy an outpost manually, see:
|
||||
|
||||
- [Kubernetes](./manual-deploy-kubernetes.md)
|
||||
- [docker-compose](./manual-deploy-docker-compose.md)
|
||||
- [Docker Compose](./manual-deploy-docker-compose.md)
|
||||
|
||||
## Configuration
|
||||
### Configuration
|
||||
|
||||
Outposts fetch their configuration from authentik. Below are all the options you can set, and how they influence the outpost.
|
||||
|
||||
@ -33,8 +61,8 @@ import Configuration from "./_config.md";
|
||||
|
||||
<Configuration />
|
||||
|
||||
## Metrics
|
||||
## Prometheus Metrics
|
||||
|
||||
Each authentik outpost has a Prometheus metrics endpoint accessible under port `:9300/metrics`. This endpoint is not mapped via docker, as the endpoint doesn't have any authentication.
|
||||
Each authentik outpost has a Prometheus metrics endpoint accessible under port `:9300/metrics`. This endpoint is not mapped via Docker, as the endpoint doesn't have any authentication.
|
||||
|
||||
For the embedded outpost, the metrics of the outpost and the metrics of the core authentik server are both returned under the same endpoint.
|
||||
|
||||
BIN
website/docs/outposts/outpost-create.png
Normal file
BIN
website/docs/outposts/outpost-create.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 131 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 171 KiB |
86
website/docs/providers/rac/how-to-rac.md
Normal file
86
website/docs/providers/rac/how-to-rac.md
Normal file
@ -0,0 +1,86 @@
|
||||
---
|
||||
title: Create a Remote Access Control (RAC) provider
|
||||
---
|
||||
|
||||
:::info
|
||||
This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
|
||||
:::
|
||||
|
||||
The RAC provider is a highly flexible feature for accessing remote machines. This document provides instructions for the basic creation and configuration of a RAC provider within a defined scenario.
|
||||
|
||||
Fow more information about using a RAC provider, see the [Overview](./index.md) documentation. You can also view our video on YouTube for setting up RAC.
|
||||
|
||||
<iframe width="560" height="315" src="https://www.youtube.com/embed/9wahIBRV6Ts;start=22" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
|
||||
|
||||
## Prereqisites
|
||||
|
||||
The RAC provider requires the deployment of the [RAC Outpost](../../outposts/).
|
||||
|
||||
## Overview workflow to create a RAC provider
|
||||
|
||||
The typical workflow to create and configure a RAC provider is to 1. create app/provider, 2. create property mappings (that define the access credentials to each remote machine), 3. create an endpoint for each remote machine you want to connect to.
|
||||
|
||||
Depending on whether you are connecting using RDP, SSH, or VNC, the exact configuration choices might differ, but the overall workflow applies to all RAC connections.
|
||||
|
||||
### Step 1. Create an application and RAC provider
|
||||
|
||||
The first step is to create the RAC app and provider.
|
||||
|
||||
1. Log in as an admin to authentik, and go to the Admin interface.
|
||||
|
||||
2. In the Admin interface, navigate to **Applications -> Applications**.
|
||||
|
||||
3. Click **Create with Wizard**. Follow the [instructions](../../applications/manage_apps.md#instructions) to create your RAC application and provider.
|
||||
|
||||
### Step 2. Create RAC property mapping
|
||||
|
||||
Next, you need to add a property mapping for each of the remote machines you want to access. Property mappings allow you to pass information to external applications, and with RAC they are used to pass the host name, IP address, and access credentials for the remote machines.
|
||||
|
||||
1. In the Admin interface, navigate to **Customization -> Property Mappings**.
|
||||
|
||||
2. On the **Property Mappings** page, click **Create**.
|
||||
|
||||
3. On the **New property mapping** modal, set the following:
|
||||
|
||||
- **Select Type**: RAC Property Mappings
|
||||
- **Create RAC Property Mapping**:
|
||||
- **Name**s: define a name for the property mapping, perhaps include the type of connection (RDP, SSH, VNC)
|
||||
- **General settings**:
|
||||
- **Username**: the username for the remote machine
|
||||
- **Password**: the password for the remote machine
|
||||
- **RDP settings**:
|
||||
- **Ignore server certificate: select **Enabled\*\* (Depending on the setup of your RDP Server, it might be required to enable this setting.)
|
||||
- **Enable wallpaper**: optional
|
||||
- **Enable font smoothing**: optional
|
||||
- **Enable full window dragging**: optional
|
||||
- Advanced settings:
|
||||
- **Expressions**: optional, using Python you can define custom [expressions](../../property-mappings/expression.mdx).
|
||||
|
||||
4. Click **Finish** to save your settings and close the modal.
|
||||
|
||||
### Step 3. Create Endpoints for the Provider
|
||||
|
||||
Finally, you need to create an endpoint for each remote machine. Endpoints are defined within providers; connections between the remote machine and authentik are enabled through communication between the provider's endpoint and the remote machine.
|
||||
|
||||
1. In the Admin interface navigate to **Applications -> Providers**.
|
||||
|
||||
2. Select the RAC provider you created in Step 1 above.
|
||||
|
||||
3. On the Provider page, under **Endpoints**, click **Create**.
|
||||
|
||||
4. On the **Create Endpoint** modal, provide the following settings:
|
||||
|
||||
- **Name**: define a name for the endpoint, perhaps include the type of connection (RDP, SSH, VNC)
|
||||
- **Protocol**: select the appropriate protocol
|
||||
- **Host**: the host name or IP address of the system you are connecting to.
|
||||
- **Maximum concurrent connections**: select a value or use `-1` to disable the limitation.
|
||||
- **Property mapping**: select either the property mapping that you created in Step 2, or use one of the default settings.
|
||||
- **Advance settings**: optional
|
||||
|
||||
5. Click **Create** to save your settings and close the modal.
|
||||
|
||||
### Access the remote machine
|
||||
|
||||
To verify your configuration and access the remote machine, go to the **User interface** of your authentik instance. On the **My applications** page click the **Remote Access** application. authentik connects you to a secure shell on the remote machine, in your web browser.
|
||||
|
||||
If you defined multiple endpoints, they are each displayed; click the endpoint for the remote machine that you want to access.
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Remote Access (RAC) Provider
|
||||
title: Remote Access Control (RAC) Provider
|
||||
---
|
||||
|
||||
<span class="badge badge--primary">Enterprise</span>
|
||||
@ -7,22 +7,40 @@ title: Remote Access (RAC) Provider
|
||||
---
|
||||
|
||||
:::info
|
||||
This feature is in technical preview, so please report any Bugs you run into on [GitHub](https://github.com/goauthentik/authentik/issues)
|
||||
This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
|
||||
:::
|
||||
|
||||
The Remote access provider allows users to access Windows/macOS/Linux machines via [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol)/[SSH](https://en.wikipedia.org/wiki/Secure_Shell)/[VNC](https://en.wikipedia.org/wiki/Virtual_Network_Computing).
|
||||
|
||||
:::info
|
||||
This provider requires the deployment of the [RAC Outpost](../../outposts/)
|
||||
This provider requires the deployment of the [RAC Outpost](../../outposts/).
|
||||
:::
|
||||
|
||||
## Endpoints
|
||||
## About the Remote Access Control (RAC) Provider
|
||||
|
||||
Unlike other providers, where one provider-application pair must be created for each resource you wish to access, the RAC provider handles this slightly differently. For each machine (computer/server) that should be accessible, an _Endpoint_ object must be created within an RAC provider.
|
||||
The RAC provider allows users to access remote Windows, macOS, and Linux machines via [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol)/[SSH](https://en.wikipedia.org/wiki/Secure_Shell)/[VNC](https://en.wikipedia.org/wiki/Virtual_Network_Computing). Just like other providers in authentik, the RAC provider is associated with an application that appears on a user's **My applications** page.
|
||||
|
||||
The _Endpoint_ object specifies the hostname/IP of the machine to connect to, as well as the protocol to use. Additionally it is possible to bind policies to _endpoint_ objects to restrict access. Users must have access to both the application the RAC Provider is using as well as the individual endpoint.
|
||||
:::info
|
||||
Note that with RAC, you create a single application and associated provider that serves to connect with _all remote machines_ that you want to configure for access via RAC.
|
||||
:::
|
||||
|
||||
Configuration like credentials can be specified through _settings_, which can be specified on different levels and are all merged together when connecting:
|
||||
For instructions on creating a RAC provider, refer to the [Managing RAC providers](./how-to-rac.md) documentation. You can also view our [video on YouTube](https://www.youtube.com/watch?v=9wahIBRV6Ts) for setting up a RAC.
|
||||
|
||||
There are several components used with a RAC provider; let's take a closer look at the high-level configuration layout of these components and how they are managed using endpoints and connections.
|
||||
|
||||
|
||||
|
||||
The provider-application pair, the authentik server, and the authentik API are typical to all configurations. With RAC, there are some new components, namely the endpoints, the outpost, and of course the target remote machines.
|
||||
|
||||
When a user starts the RAC application, the app communicates with the authentik server, which then connects to an instance of the outpost (the exact instance is selected dynamically based on connection load). After the outpost is selected, then the authentik server sends the outpost the instructions (based on the data you defined in the endpoint) required to connect to the remote machine.
|
||||
|
||||
After the connection to the remote machine is made, the outpost sends a message back to the authentik server (via websockets), and the web browser opens the websocket connection to the remote machine.
|
||||
|
||||
### Endpoints
|
||||
|
||||
Unlike other providers, where one provider-application pair must be created for each resource you wish to access, the RAC provider handles this slightly differently. For each remote machine (computer/server) that should be accessible, you create an _Endpoint_ object within a single RAC provider. (And as mentioned above, a single provider-application pair is used for all remote connections.)
|
||||
|
||||
The _Endpoint_ object specifies the hostname/IP of the machine to connect to, as well as the protocol to use. Additionally it is possible to bind policies to _endpoint_ objects to restrict access. Users must have access to both the application that the RAC Provider is using as well as the individual endpoint.
|
||||
|
||||
Configuration details such as credentials can be specified through _settings_, which can be specified on different levels and are all merged together when connecting:
|
||||
|
||||
1. Provider settings
|
||||
2. Endpoint settings
|
||||
@ -30,9 +48,9 @@ Configuration like credentials can be specified through _settings_, which can be
|
||||
4. Provider property mapping settings
|
||||
5. Endpoint property mapping settings
|
||||
|
||||
## Connections
|
||||
### Connections
|
||||
|
||||
Each connection is authorized through the policies bound to the application and the endpoint, and additional verification can be done with the authorization flow.
|
||||
Each connection is authorized through authentik Policy objects that are bound to the application and the endpoint. Additional verification can be done with the authorization flow.
|
||||
|
||||
Additionally it is possible to modify the connection settings through the authorization flow. Configuration set in `connection_settings` in the flow plan context will be merged with other settings as shown above.
|
||||
|
||||
|
||||
BIN
website/docs/providers/rac/rac-v3.png
Normal file
BIN
website/docs/providers/rac/rac-v3.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
@ -11,7 +11,7 @@ title: OPNsense
|
||||
> -- https://opnsense.org/
|
||||
|
||||
:::note
|
||||
This is based on authentik 2022.4.1 and OPNsense 22.1.6-amd64 installed using https://docs.opnsense.org/manual/install.html. Instructions may differ between versions.
|
||||
This is based on authentik 2024.2.2 and OPNsense 24.1.3_1-amd64 installed using https://docs.opnsense.org/manual/install.html. Instructions may differ between versions.
|
||||
:::
|
||||
|
||||
## Preparation
|
||||
@ -25,7 +25,7 @@ The following placeholders will be used:
|
||||
### Step 1
|
||||
|
||||
In authentik, go and 'Create Service account' (under _Directory/Users_) for OPNsense to use as the LDAP Binder, leaving 'Create group' ticked as we'll need that group for the provider.
|
||||
In this example, we'll use `opnsense` as the Service account's username
|
||||
In this example, we'll use `opnsense-user` as the Service account's username
|
||||
|
||||
:::note
|
||||
Take note of the password for this user as you'll need to give it to OPNsense in _Step 4_.
|
||||
@ -92,6 +92,10 @@ In OPNsense, go to _System/Settings/Administration_ and under _Authentication_ a
|
||||
|
||||
|
||||
|
||||
### Step 7
|
||||
|
||||
You can now either import users, or synchronize from Authentik LDAP. See https://docs.opnsense.org/manual/how-tos/user-ldap.html for more.
|
||||
|
||||
## Notes
|
||||
|
||||
:::note
|
||||
|
||||
8
website/package-lock.json
generated
8
website/package-lock.json
generated
@ -33,7 +33,7 @@
|
||||
"@docusaurus/module-type-aliases": "3.2.0",
|
||||
"@docusaurus/tsconfig": "3.2.0",
|
||||
"@docusaurus/types": "3.2.0",
|
||||
"@types/react": "^18.2.73",
|
||||
"@types/react": "^18.2.74",
|
||||
"prettier": "3.2.5",
|
||||
"typescript": "~5.4.3"
|
||||
},
|
||||
@ -3712,9 +3712,9 @@
|
||||
"integrity": "sha512-+0autS93xyXizIYiyL02FCY8N+KkKPhILhcUSA276HxzreZ16kl+cmwvV2qAM/PuCCwPXzOXOWhiPcw20uSFcA=="
|
||||
},
|
||||
"node_modules/@types/react": {
|
||||
"version": "18.2.73",
|
||||
"resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.73.tgz",
|
||||
"integrity": "sha512-XcGdod0Jjv84HOC7N5ziY3x+qL0AfmubvKOZ9hJjJ2yd5EE+KYjWhdOjt387e9HPheHkdggF9atTifMRtyAaRA==",
|
||||
"version": "18.2.74",
|
||||
"resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.74.tgz",
|
||||
"integrity": "sha512-9AEqNZZyBx8OdZpxzQlaFEVCSFUM2YXJH46yPOiOpm078k6ZLOCcuAzGum/zK8YBwY+dbahVNbHrbgrAwIRlqw==",
|
||||
"dependencies": {
|
||||
"@types/prop-types": "*",
|
||||
"csstype": "^3.0.2"
|
||||
|
||||
@ -52,7 +52,7 @@
|
||||
"@docusaurus/module-type-aliases": "3.2.0",
|
||||
"@docusaurus/tsconfig": "3.2.0",
|
||||
"@docusaurus/types": "3.2.0",
|
||||
"@types/react": "^18.2.73",
|
||||
"@types/react": "^18.2.74",
|
||||
"prettier": "3.2.5",
|
||||
"typescript": "~5.4.3"
|
||||
},
|
||||
|
||||
@ -124,7 +124,15 @@ const docsSidebar = {
|
||||
items: ["providers/ldap/generic_setup"],
|
||||
},
|
||||
"providers/scim/index",
|
||||
"providers/rac/index",
|
||||
{
|
||||
type: "category",
|
||||
label: "RAC (Remote Access Control) Provider",
|
||||
link: {
|
||||
type: "doc",
|
||||
id: "providers/rac/index",
|
||||
},
|
||||
items: ["providers/rac/how-to-rac"],
|
||||
},
|
||||
],
|
||||
},
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user