diff --git a/.bumpversion.cfg b/.bumpversion.cfg index b31c7e03e1..8978eeee7a 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 2024.8.3 +current_version = 2024.10.0 tag = True commit = True parse = (?P\d+)\.(?P\d+)\.(?P\d+)(?:-(?P[a-zA-Z-]+)(?P[1-9]\\d*))? diff --git a/SECURITY.md b/SECURITY.md index 871f95a6fe..2e0beb7d72 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -18,10 +18,10 @@ Even if the issue is not a CVE, we still greatly appreciate your help in hardeni (.x being the latest patch release for each version) -| Version | Supported | -| -------- | --------- | -| 2024.6.x | ✅ | -| 2024.8.x | ✅ | +| Version | Supported | +| --------- | --------- | +| 2024.8.x | ✅ | +| 2024.10.x | ✅ | ## Reporting a Vulnerability diff --git a/authentik/__init__.py b/authentik/__init__.py index 548dde0b9c..259d0f83f6 100644 --- a/authentik/__init__.py +++ b/authentik/__init__.py @@ -2,7 +2,7 @@ from os import environ -__version__ = "2024.8.3" +__version__ = "2024.10.0" ENV_GIT_HASH_KEY = "GIT_BUILD_HASH" diff --git a/blueprints/schema.json b/blueprints/schema.json index b0e7d140f1..623243f271 100644 --- a/blueprints/schema.json +++ b/blueprints/schema.json @@ -2,7 +2,7 @@ "$schema": "http://json-schema.org/draft-07/schema", "$id": "https://goauthentik.io/blueprints/schema.json", "type": "object", - "title": "authentik 2024.8.3 Blueprint schema", + "title": "authentik 2024.10.0 Blueprint schema", "required": [ "version", "entries" diff --git a/docker-compose.yml b/docker-compose.yml index 3f58105b7d..ca99ad0ca0 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -31,7 +31,7 @@ services: volumes: - redis:/data server: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.8.3} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.10.0} restart: unless-stopped command: server environment: @@ -52,7 +52,7 @@ services: - postgresql - redis worker: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.8.3} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.10.0} restart: unless-stopped command: worker environment: diff --git a/go.mod b/go.mod index 3b36858dd0..74b8d14040 100644 --- a/go.mod +++ b/go.mod @@ -29,7 +29,7 @@ require ( github.com/spf13/cobra v1.8.1 github.com/stretchr/testify v1.9.0 github.com/wwt/guac v1.3.2 - goauthentik.io/api/v3 v3.2024083.14 + goauthentik.io/api/v3 v3.2024100.1 golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab golang.org/x/oauth2 v0.23.0 golang.org/x/sync v0.8.0 diff --git a/go.sum b/go.sum index fb4733c1dd..6ee92559be 100644 --- a/go.sum +++ b/go.sum @@ -299,8 +299,8 @@ go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= -goauthentik.io/api/v3 v3.2024083.14 h1:8iLXkNpVS275S4DLMBr6WIeaMkkaIJbzlNRLCFe+k3A= -goauthentik.io/api/v3 v3.2024083.14/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw= +goauthentik.io/api/v3 v3.2024100.1 h1:ve8xiaKOyUD5oCkNAsu1o3nc7aolt9bKTTR2qMI1iU4= +goauthentik.io/api/v3 v3.2024100.1/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= diff --git a/internal/constants/constants.go b/internal/constants/constants.go index 74324a2788..4aa19f377c 100644 --- a/internal/constants/constants.go +++ b/internal/constants/constants.go @@ -29,4 +29,4 @@ func UserAgent() string { return fmt.Sprintf("authentik@%s", FullVersion()) } -const VERSION = "2024.8.3" +const VERSION = "2024.10.0" diff --git a/locale/zh-Hans/LC_MESSAGES/django.mo b/locale/zh-Hans/LC_MESSAGES/django.mo index 3377f5d239..05a66744b3 100644 Binary files a/locale/zh-Hans/LC_MESSAGES/django.mo and b/locale/zh-Hans/LC_MESSAGES/django.mo differ diff --git a/package.json b/package.json index 1232164804..dae8194aad 100644 --- a/package.json +++ b/package.json @@ -1,5 +1,5 @@ { "name": "@goauthentik/authentik", - "version": "2024.8.3", + "version": "2024.10.0", "private": true } diff --git a/poetry.lock b/poetry.lock index 9fde46832f..1692261527 100644 --- a/poetry.lock +++ b/poetry.lock @@ -4354,13 +4354,13 @@ django-query = ["django (>=3.2)"] [[package]] name = "selenium" -version = "4.25.0" +version = "4.26.0" description = "Official Python bindings for Selenium WebDriver" optional = false python-versions = ">=3.8" files = [ - {file = "selenium-4.25.0-py3-none-any.whl", hash = "sha256:3798d2d12b4a570bc5790163ba57fef10b2afee958bf1d80f2a3cf07c4141f33"}, - {file = "selenium-4.25.0.tar.gz", hash = "sha256:95d08d3b82fb353f3c474895154516604c7f0e6a9a565ae6498ef36c9bac6921"}, + {file = "selenium-4.26.0-py3-none-any.whl", hash = "sha256:48013f36e812de5b3948ef53d04e73f77bc923ee3e1d7d99eaf0618179081b99"}, + {file = "selenium-4.26.0.tar.gz", hash = "sha256:f0780f85f10310aa5d085b81e79d73d3c93b83d8de121d0400d543a50ee963e8"}, ] [package.dependencies] diff --git a/pyproject.toml b/pyproject.toml index 47295a20f6..5c3f76c3ab 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [tool.poetry] name = "authentik" -version = "2024.8.3" +version = "2024.10.0" description = "" authors = ["authentik Team "] diff --git a/schema.yml b/schema.yml index 9028d7c5c9..dd6d03f5bd 100644 --- a/schema.yml +++ b/schema.yml @@ -1,7 +1,7 @@ openapi: 3.0.3 info: title: authentik - version: 2024.8.3 + version: 2024.10.0 description: Making authentication simple. contact: email: hello@goauthentik.io diff --git a/web/package-lock.json b/web/package-lock.json index 869227879e..81dcbe180b 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -23,7 +23,7 @@ "@floating-ui/dom": "^1.6.11", "@formatjs/intl-listformat": "^7.5.7", "@fortawesome/fontawesome-free": "^6.6.0", - "@goauthentik/api": "^2024.8.3-1729836831", + "@goauthentik/api": "^2024.10.0-1730331602", "@lit-labs/ssr": "^3.2.2", "@lit/context": "^1.1.2", "@lit/localize": "^0.12.2", @@ -1775,9 +1775,9 @@ } }, "node_modules/@goauthentik/api": { - "version": "2024.8.3-1729836831", - "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2024.8.3-1729836831.tgz", - "integrity": "sha512-nOgvjYQiK+HhWuiZ635h/aSsq7Mfj5cDrIyBJt+IJRQuJFtnnHx8nscRXKK/8sBl9obH2zMCoZgeqytK8145bg==" + "version": "2024.10.0-1730331602", + "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2024.10.0-1730331602.tgz", + "integrity": "sha512-VaXywdDCFkIs9RgmHVYt8jGf5xnc+czsu5ILEThNQOuXvBjkGa0J8aPWVSdfP++GiHnkjddWVFzJ6R6LOoHbWQ==" }, "node_modules/@goauthentik/web": { "resolved": "", diff --git a/web/package.json b/web/package.json index a51cd66952..38a02c055b 100644 --- a/web/package.json +++ b/web/package.json @@ -11,7 +11,7 @@ "@floating-ui/dom": "^1.6.11", "@formatjs/intl-listformat": "^7.5.7", "@fortawesome/fontawesome-free": "^6.6.0", - "@goauthentik/api": "^2024.8.3-1729836831", + "@goauthentik/api": "^2024.10.0-1730331602", "@lit-labs/ssr": "^3.2.2", "@lit/context": "^1.1.2", "@lit/localize": "^0.12.2", diff --git a/web/src/admin/providers/radius/RadiusProviderForm.ts b/web/src/admin/providers/radius/RadiusProviderForm.ts index e1832f7fc7..3fe543209f 100644 --- a/web/src/admin/providers/radius/RadiusProviderForm.ts +++ b/web/src/admin/providers/radius/RadiusProviderForm.ts @@ -29,8 +29,132 @@ export class RadiusProviderFormPage extends WithBrandConfig(BaseProviderForm + + + + +

${msg("Flow used for users to authenticate.")}

+ + + +

+ ${msg( + "When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.", + )} +

+ + + + ${msg("Protocol settings")} +
+ + + + + +

+ ${msg(`List of CIDRs (comma-seperated) that clients can connect from. A more specific + CIDR will match before a looser one. Clients connecting from a non-specified CIDR + will be dropped.`)} +

+ + + + +
+ + + ${msg("Advanced flow settings")} +
+ + +

+ ${msg("Flow used when logging out of this provider.")} +

+ +
+ `; +>>>>>>> main } } diff --git a/web/src/common/constants.ts b/web/src/common/constants.ts index 5c390663ed..8dd39b249d 100644 --- a/web/src/common/constants.ts +++ b/web/src/common/constants.ts @@ -3,7 +3,7 @@ export const SUCCESS_CLASS = "pf-m-success"; export const ERROR_CLASS = "pf-m-danger"; export const PROGRESS_CLASS = "pf-m-in-progress"; export const CURRENT_CLASS = "pf-m-current"; -export const VERSION = "2024.8.3"; +export const VERSION = "2024.10.0"; export const TITLE_DEFAULT = "authentik"; export const ROUTE_SEPARATOR = ";"; diff --git a/web/xliff/zh-Hans.xlf b/web/xliff/zh-Hans.xlf index b1b22fedce..de693043ab 100644 --- a/web/xliff/zh-Hans.xlf +++ b/web/xliff/zh-Hans.xlf @@ -1,4 +1,4 @@ - + @@ -596,9 +596,9 @@ - The URL "" was not found. - 未找到 URL " - "。 + The URL "" was not found. + 未找到 URL " + "。 @@ -1030,8 +1030,8 @@ - To allow any redirect URI, set this value to ".*". Be aware of the possible security implications this can have. - 要允许任何重定向 URI，请将此值设置为 ".*"。请注意这可能带来的安全影响。 + To allow any redirect URI, set this value to ".*". Be aware of the possible security implications this can have. + 要允许任何重定向 URI，请将此值设置为 ".*"。请注意这可能带来的安全影响。 @@ -1752,8 +1752,8 @@ - Either input a full URL, a relative path, or use 'fa://fa-test' to use the Font Awesome icon "fa-test". - 输入完整 URL、相对路径，或者使用 'fa://fa-test' 来使用 Font Awesome 图标 "fa-test"。 + Either input a full URL, a relative path, or use 'fa://fa-test' to use the Font Awesome icon "fa-test". + 输入完整 URL、相对路径，或者使用 'fa://fa-test' 来使用 Font Awesome 图标 "fa-test"。 @@ -2916,8 +2916,8 @@ doesn't pass when either or both of the selected options are equal or above the - Field which contains members of a group. Note that if using the "memberUid" field, the value is assumed to contain a relative distinguished name. e.g. 'memberUid=some-user' instead of 'memberUid=cn=some-user,ou=groups,...' - 包含组成员的字段。请注意，如果使用 "memberUid" 字段，则假定该值包含相对可分辨名称。例如，'memberUid=some-user' 而不是 'memberUid=cn=some-user,ou=groups,...' + Field which contains members of a group. Note that if using the "memberUid" field, the value is assumed to contain a relative distinguished name. e.g. 'memberUid=some-user' instead of 'memberUid=cn=some-user,ou=groups,...' + 包含组成员的字段。请注意，如果使用 "memberUid" 字段，则假定该值包含相对可分辨名称。例如，'memberUid=some-user' 而不是 'memberUid=cn=some-user,ou=groups,...' @@ -3663,8 +3663,8 @@ doesn't pass when either or both of the selected options are equal or above the - When using an external logging solution for archiving, this can be set to "minutes=5". - 使用外部日志记录解决方案进行存档时，可以将其设置为 "minutes=5"。 + When using an external logging solution for archiving, this can be set to "minutes=5". + 使用外部日志记录解决方案进行存档时，可以将其设置为 "minutes=5"。 @@ -3840,10 +3840,10 @@ doesn't pass when either or both of the selected options are equal or above the - Are you sure you want to update ""? + Are you sure you want to update ""? 您确定要更新 - " - " 吗？ + " + " 吗？ @@ -4919,7 +4919,7 @@ doesn't pass when either or both of the selected options are equal or above the - A "roaming" authenticator, like a YubiKey + A "roaming" authenticator, like a YubiKey 像 YubiKey 这样的“漫游”身份验证器 @@ -5298,7 +5298,7 @@ doesn't pass when either or both of the selected options are equal or above the - If set to a duration above 0, the user will have the option to choose to "stay signed in", which will extend their session by the time specified here. + If set to a duration above 0, the user will have the option to choose to "stay signed in", which will extend their session by the time specified here. 如果设置时长大于 0，用户可以选择“保持登录”选项，这将使用户的会话延长此处设置的时间。 @@ -7713,7 +7713,7 @@ Bindings to groups/users are checked against the user of the event. 成功创建用户并添加到组 - This user will be added to the group "". + This user will be added to the group "". 此用户将会被添加到组 ""。 @@ -9067,7 +9067,7 @@ Bindings to groups/users are checked against the user of the event. 同步组 - ("", of type ) + ("", of type ) （""，类型为 ） @@ -9264,4 +9264,4 @@ Bindings to groups/users are checked against the user of the event. - \ No newline at end of file + diff --git a/website/docs/add-secure-apps/applications/manage_apps.md b/website/docs/add-secure-apps/applications/manage_apps.md index db6ad6c8a8..72cc5c9fa9 100644 --- a/website/docs/add-secure-apps/applications/manage_apps.md +++ b/website/docs/add-secure-apps/applications/manage_apps.md @@ -26,7 +26,7 @@ To add an application to authentik and have it display on users' **My applicatio ## Authorization -Application access can be configured using (Policy) Bindings. Click on an application in the applications list, and select the _Policy / Group / User Bindings_ tab. There you can bind users/groups/policies to grant them access. When nothing is bound, everyone has access. You can use this to grant access to one or multiple users/groups, or dynamically give access using policies. +Application access can be configured using (Policy) bindings. Click on an application in the applications list, and select the _Policy / Group / User Bindings_ tab. There you can bind users/groups/policies to grant them access. When nothing is bound, everyone has access. You can use this to grant access to one or multiple users/groups, or dynamically give access using policies. By default, all users can access applications when no policies are bound. diff --git a/website/docs/add-secure-apps/flows-stages/flow/examples/default_flows.md b/website/docs/add-secure-apps/flows-stages/flow/examples/default_flows.md new file mode 100644 index 0000000000..e301339f2b --- /dev/null +++ b/website/docs/add-secure-apps/flows-stages/flow/examples/default_flows.md @@ -0,0 +1,11 @@ +--- +title: Default flows +--- + +When you create a new provider, you can select certain default flows that will be used with the provider and its associated application. For example, you can [create a custom flow](../index.md#create-a-custom-flow) that override the defaults configured on the brand. + +If no default flow is selected when the provider is created, to determine which flow should be used authentik will first check if there is a default flow configured in the active [**Brand**](../../../../customize/brands.md). If no default is configured there, authentik will go through all flows with the matching designation, sorted by `slug` and evaluate policies bound directly to the flows, and the first flow whose policies allow access will be picked. + +import DefaultFlowList from "../../flow/flow_list/\_defaultflowlist.mdx"; + + diff --git a/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md b/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md index 7143797e13..b81bcdd5eb 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md +++ b/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md @@ -1,5 +1,5 @@ --- -title: Example Flows +title: Example flows --- :::info diff --git a/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md b/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md index 20419a1a67..101f945a21 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md +++ b/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md @@ -7,3 +7,27 @@ This is the default, web-based environment that flows are executed in. All stage :::info All flow executors use the same [API](../../../../developer-docs/api/flow-executor.md), which allows for the implementation of custom flow executors. ::: + +## Layouts + +Starting with authentik 2022.5, the layout of the default flow executor can be changed. Below are examples for the available options: + +### Stacked (default) + +![](../layouts/stacked.png) + +### Content besides logo (left) + +![](../layouts/content_left.png) + +### Content besides logo (right) + +![](../layouts/content_right.png) + +### Sidebar (left) + +![](../layouts/sidebar_left.png) + +### Sidebar (right) + +![](../layouts/sidebar_right.png) diff --git a/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx b/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx new file mode 100644 index 0000000000..5a49106c8f --- /dev/null +++ b/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx @@ -0,0 +1,13 @@ +- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.md) stage, which attaches the staged user to the current session. + +- **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required. + +- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one. + +- **Invalidation**: designates a default flow to be used to invalidate a session. Use `default-invalidation-flow` for invalidation from authentik itself, or use `default-provider-invalidation-flow` to invalidate when the session of an application ends. When you use the `default-invalidation-flow` as a global invalidation flow, it should contain a [**User Logout**](../../stages/user_logout.md) stage. When you use the `default-provider-invalidation-flow` (supported with OIDC, SAML, Proxy, and RAC providers), you can configure this default flow to present users log-off options such as "log out of the app but remain logged in to authentik" or "return to the **My Applications** page", or "log out completely". (Alternatively, you can create a custom invalidation flow, with a branded background image.) + +- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.md). Afterwards, use the [**Prompt**](../../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../../stages/user_write.md) stage to update the password. + +- **Stage configuration**: designates a flow for general setup. This designation doesn't have any constraints in what you can do. For example, by default this designation is used to configure authenticators, like change a password and set up TOTP. + +- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../../stages/user_delete.md) stage. diff --git a/website/docs/add-secure-apps/flows-stages/flow/index.md b/website/docs/add-secure-apps/flows-stages/flow/index.md index 18707cd67a..53617a786e 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/index.md +++ b/website/docs/add-secure-apps/flows-stages/flow/index.md @@ -4,11 +4,11 @@ title: Flows Flows are a major component in authentik. In conjunction with stages and [policies](../../../customize/policies/index.md), flows are at the heart of our system of building blocks, used to define and execute the workflows of authentication, authorization, enrollment, and user settings. -There are over a dozen default, out-of-the box flows available in authentik. Users can decide if they already have everything they need with the default flows or if they want to [create](#create-a-custom-flow) their own custom flow, using the Admin interface. +There are over a dozen default, out-of-the box flows available in authentik. Users can decide if they already have everything they need with the [default flows](../flow/examples/default_flows.md) or if they want to [create](#create-a-custom-flow) their own custom flow, using the Admin interface, Terraform, or via the API. A flow is a method of describing a sequence of stages. A stage represents a single verification or logic step. By connecting a series of stages within a flow (and optionally attaching policies as needed) you can build a highly flexible process for authenticating users, enrolling them, and more. -For example, a standard login flow would consist of the following stages: +For example a standard login flow would consist of the following stages: - **Identification stage**: user identifies themselves via a username or email address - **Password stage**: the user's password is checked against the hash in the database @@ -22,8 +22,6 @@ By default, policies are evaluated dynamically, right before the stage (to which This default behaviour can be altered by enabling the **Evaluate when flow is planned** option on the stage binding. With this setting a _flow plan_ containing all stages is generated upon flow execution. This means that all attached policies are evaluated upon execution. For more information about flow plans, read our [flow context documentation](./context/index.md). -To determine which flow should be used, authentik will first check which default authentication flow is configured in the active [**Brand**](../../../customize/brands.md). If no default is configured there, the policies in all flows with the matching designation are checked, and the first flow with matching policies sorted by `slug` will be used. - ## Permissions Flows can have [policies](../stages/index.md) assigned to them. These policies determine if the current user is allowed to see and use this flow. @@ -64,19 +62,9 @@ When creating or editing a flow in the UI of the Admin interface, you can set th **Designation**: Flows are designated for a single purpose. This designation changes when a flow is used. The following designations are available: -- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../stages/user_login/index.md) stage, which attaches the staged user to the current session. +import Defaultflowlist from "../flow/flow_list/\_defaultflowlist.mdx"; -- **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. - -- **Invalidation**: designates a flow to be used to invalidate a session. Both used to invalidate a session from authentik and when the session of an application ends. When used as a global invalidation flow should contain a [**User Logout**](../stages/user_logout.md) stage. - -- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../stages/email/index.mdx) or [**Captcha**](../stages/captcha/index.md). At the end, to create the user, you can use the [**User Write**](../stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one. - -- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../stages/email/index.mdx) or [**Captcha**](../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../stages/user_delete.md) stage. - -- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../stages/email/index.mdx) or [**captcha**](../stages/captcha/index.md). Afterwards, use the [**Prompt**](../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../stages/user_write.md) stage to update the password. - -- **Stage configuration**: designates a flow for general setup. This designation doesn't have any constraints in what you can do. For example, by default this designation is used to configure authenticators, like change a password and setup TOTP. + **Authentication**: Using this option, you can configure whether the the flow requires initial authentication or not, whether the user must be a superuser, or if the flow requires an outpost. diff --git a/website/docs/add-secure-apps/flows-stages/flow/layouts.md b/website/docs/add-secure-apps/flows-stages/flow/layouts.md deleted file mode 100644 index 77b15a3b6c..0000000000 --- a/website/docs/add-secure-apps/flows-stages/flow/layouts.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Layouts ---- - -Starting with authentik 2022.5, the layout of the default flow executor can be changed. Below are examples for the available options: - -### Stacked (default) - -![](./layouts/stacked.png) - -### Content besides logo (left) - -![](./layouts/content_left.png) - -### Content besides logo (right) - -![](./layouts/content_right.png) - -### Sidebar (left) - -![](./layouts/sidebar_left.png) - -### Sidebar (right) - -![](./layouts/sidebar_right.png) diff --git a/website/docs/add-secure-apps/providers/index.mdx b/website/docs/add-secure-apps/providers/index.mdx index 99790ab300..b88c6aad57 100644 --- a/website/docs/add-secure-apps/providers/index.mdx +++ b/website/docs/add-secure-apps/providers/index.mdx @@ -13,7 +13,9 @@ Applications can use additional providers to augment the functionality of the ma You can create a new provider in the Admin interface, or you can use the [Application wizard](../applications/manage_apps.md#instructions) to create a new application and its provider at the same time. -Refer to the documentation for each provider: +When you create certain types of providers, you need to select specific [flows](../flows-stages/flow/index.md) to apply to users who access authentik via the provider. To learn more, refer to our [default flow documentation](../flows-stages/flow/examples/default_flows.md). + +To learn more about each provider type, refer to the documentation for each provider: diff --git a/website/docs/customize/brands.md b/website/docs/customize/brands.md index dc4931f05a..fbaa057517 100644 --- a/website/docs/customize/brands.md +++ b/website/docs/customize/brands.md @@ -9,13 +9,22 @@ The main settings that brands influence are flows and branding. ## Flows -authentik picks a default flow by selecting the flow that is configured in the current brand, otherwise any flow that: +You can explicitly select, in your instance's Brand settings, the default flow to use for the following configurations: + +- Authentication flow: the flow used to authenticate users. If left empty, the first applicable flow sorted by the slug is used. +- Invalidation flow: for typical use cases, select the `default-invalidation-flow` (Logout) flow. This flow logs the user out of authentik when the application session ends (user logs out of the app). +- Recovery flow: if set, the user can access an option to recover their login credentials. +- Unenrollment flow: if set, users are able to unenroll themselves using this flow. If no flow is set, option is not shown. +- User settings flow: if set, users are able to configure details of their profile. +- Device code flow: if set, the OAuth Device Code profile can be used, and the selected flow will be used to enter the code. + +If a default flow is _not_ set in the brand, then authentik selects any flow that: - matches the required designation - comes first sorted by slug - is allowed by policies -This means that if you want to select a default flow based on policy, you can leave the brand default empty. +This means that if you want to select a default flow based on policy, you can leave the brand default empty. To learn more about default flows, refer to our [documentation](../add-secure-apps/flows-stages/flow/examples/default_flows.md). ## Branding diff --git a/website/docs/releases/2024/v2024.10.md b/website/docs/releases/2024/v2024.10.md index 070f9ce376..d3aa0654e5 100644 --- a/website/docs/releases/2024/v2024.10.md +++ b/website/docs/releases/2024/v2024.10.md @@ -3,12 +3,6 @@ title: Release 2024.10 slug: "/releases/2024.10" --- -:::::note -2024.10 has not been released yet! We're publishing these release notes as a preview of what's to come, and for our awesome beta testers trying out release candidates. - -To try out the release candidate, replace your Docker image tag with the latest release candidate number, such as 2024.10.0-rc1. You can find the latest one in [the latest releases on GitHub](https://github.com/goauthentik/authentik/releases). If you don't find any, it means we haven't released one yet. -::::: - ## Highlights - **Chrome Device Trust** Enterprise Preview: Verify that your users are logging in from managed devices and validate the devices' compliance with company policies. diff --git a/website/docs/releases/2024/v2024.8.md b/website/docs/releases/2024/v2024.8.md index ab05a126a6..2544f8da07 100644 --- a/website/docs/releases/2024/v2024.8.md +++ b/website/docs/releases/2024/v2024.8.md @@ -286,6 +286,20 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.8 - web: Fix missing integrity fields in package-lock.json (#11509) - web/admin: fix Authentication flow being required (cherry-pick #11496) (#11497) +## Fixed in 2024.8.4 + +- blueprints: fix validation error when using internal storage (cherry-pick #11654) (#11656) +- core: fix permission check for scoped impersonation (cherry-pick #11603) (#11650) +- internal: restore /ping behaviour for embedded outpost (cherry-pick #11568) (#11570) +- policies/event_matcher: fix inconsistent behaviour (cherry-pick #11724) (#11726) +- providers/oauth2: don't overwrite attributes when updating service account (cherry-pick #11709) (#11723) +- providers/saml: fix incorrect ds:Reference URI (cherry-pick #11699) (#11701) +- providers/scim: add comparison with existing group on update and delta update users (cherry-pick #11414) (#11796) +- providers/scim: clamp batch size for patch requests (cherry-pick #11797) (#11802) +- providers/scim: handle no members in group in consistency check (cherry-pick #11801) (#11812) +- web/admin: fix invalid create date shown for MFA registered before date was saved (cherry-pick #11728) (#11729) +- web/admin: fix sync single button throwing error (cherry-pick #11727) (#11730) + ## API Changes #### What's New diff --git a/website/netlify.toml b/website/netlify.toml index 1aaf3f1b4a..de729ecb93 100644 --- a/website/netlify.toml +++ b/website/netlify.toml @@ -62,7 +62,10 @@ to = "/docs/providers/property-mappings/expression" status = 302 - +[[redirects]] + from = "/docs/add-secure-apps/flows-stages/flow/layouts.md" + to = "/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md" + status = 302 @@ -675,8 +678,8 @@ force = true [[redirects]] - from = "/docs/providers/radius/x" - to = "/docs/add-secure-apps/providers/radius/x" + from = "/docs/providers/radius/" + to = "/docs/add-secure-apps/providers/radius/" status = 302 force = true diff --git a/website/package-lock.json b/website/package-lock.json index 0c30dfa5b3..f5e293db97 100644 --- a/website/package-lock.json +++ b/website/package-lock.json @@ -8895,9 +8895,9 @@ "integrity": "sha512-f/ZeWvW/BCXbhGEf1Ujp29EASo/lk1FDnETgNKwJrsVvGZhUWCZyg3xLJjAsxfOmt8KjswHmI5EwCQcPMpOYhQ==" }, "node_modules/elliptic": { - "version": "6.5.7", - "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.5.7.tgz", - "integrity": "sha512-ESVCtTwiA+XhY3wyh24QqRGBoP3rEdDUl3EDUUo9tft074fi19IrdpH7hLCMMP3CIj7jb3W96rn8lt/BqIlt5Q==", + "version": "6.6.0", + "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.6.0.tgz", + "integrity": "sha512-dpwoQcLc/2WLQvJvLRHKZ+f9FgOdjnq11rurqwekGQygGPsYSK29OMMD2WalatiqQ+XGFDglTNixpPfI+lpaAA==", "dependencies": { "bn.js": "^4.11.9", "brorand": "^1.1.0", diff --git a/website/sidebars.js b/website/sidebars.js index 0fd73b6e29..d7ae2be133 100644 --- a/website/sidebars.js +++ b/website/sidebars.js @@ -251,14 +251,14 @@ export default { id: "add-secure-apps/flows-stages/flow/index", }, items: [ - "add-secure-apps/flows-stages/flow/layouts", "add-secure-apps/flows-stages/flow/inspector", "add-secure-apps/flows-stages/flow/context/index", { type: "category", - label: "Examples", + label: "Defaults and Examples", items: [ "add-secure-apps/flows-stages/flow/examples/flows", + "add-secure-apps/flows-stages/flow/examples/default_flows", "add-secure-apps/flows-stages/flow/examples/snippets", ], },