web: bump @babel/preset-env from 7.22.2 to 7.22.4 in /web (#5808)

Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.22.2 to 7.22.4.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.22.4/packages/babel-preset-env)

---
updated-dependencies:
- dependency-name: "@babel/preset-env"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.4.1
+current_version = 2023.5.2
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)

.devcontainer/Dockerfile

@@ -1,7 +0,0 @@
-FROM ghcr.io/goauthentik/server:latest
-
-USER root
-
-HEALTHCHECK --interval=10s CMD exit 0
-
-RUN pip install --no-cache-dir -r /app-root/requirements-dev.txt

.devcontainer/devcontainer.json

@@ -1,34 +0,0 @@
-{
-    "name": "authentik",
-    "dockerComposeFile": "docker-compose.yml",
-    "service": "app",
-    "workspaceFolder": "/app-root",
-    "features": {
-        "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {},
-        "ghcr.io/devcontainers/features/go:1": {},
-        "ghcr.io/devcontainers/features/node:1": {}
-    },
-    "forwardPorts": [9000],
-    "customizations": {
-        "vscode": {
-            "extensions": [
-                "EditorConfig.EditorConfig",
-                "bashmish.es6-string-css",
-                "bpruitt-goddard.mermaid-markdown-syntax-highlighting",
-                "dbaeumer.vscode-eslint",
-                "esbenp.prettier-vscode",
-                "golang.go",
-                "Gruntfuggly.todo-tree",
-                "mechatroner.rainbow-csv",
-                "ms-python.black-formatter",
-                "ms-python.isort",
-                "ms-python.pylint",
-                "ms-python.python",
-                "ms-python.vscode-pylance",
-                "redhat.vscode-yaml",
-                "Tobermory.es6-string-html",
-                "unifiedjs.vscode-mdx"
-            ]
-        }
-    }
-}

.devcontainer/docker-compose.yml

@@ -1,32 +0,0 @@
-version: '3.8'
-
-services:
-  app:
-    build:
-      context: ..
-      dockerfile: .devcontainer/Dockerfile
-    volumes:
-      - ../:/app-root:cached
-    command: debug
-    environment:
-      AUTHENTIK_POSTGRESQL__USER: postgres
-      AUTHENTIK_POSTGRESQL__PASSWORD: postgres
-      AUTHENTIK_BOOTSTRAP_PASSWORD: akadmin
-      AUTHENTIK_BOOTSTRAP_TOKEN: akadmin
-  db:
-    image: docker.io/library/postgres:15
-    restart: unless-stopped
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    network_mode: service:app
-    environment:
-      POSTGRES_USER: postgres
-      POSTGRES_DB: authentik
-      POSTGRES_PASSWORD: postgres
-  redis:
-    image: docker.io/redis/redis-stack-server
-    restart: unless-stopped
-    network_mode: service:app
-
-volumes:
-  postgres-data:

.github/dependabot.yml

@@ -6,8 +6,6 @@ updates:
       interval: daily
       time: "04:00"
     open-pull-requests-limit: 10
-    reviewers:
-      - "@goauthentik/core"
     commit-message:
       prefix: "ci:"
   - package-ecosystem: gomod
@@ -16,8 +14,6 @@ updates:
       interval: daily
       time: "04:00"
     open-pull-requests-limit: 10
-    reviewers:
-      - "@goauthentik/core"
     commit-message:
       prefix: "core:"
   - package-ecosystem: npm
@@ -26,8 +22,6 @@ updates:
       interval: daily
       time: "04:00"
     open-pull-requests-limit: 10
-    reviewers:
-      - "@goauthentik/core"
     commit-message:
       prefix: "web:"
   - package-ecosystem: npm
@@ -36,8 +30,6 @@ updates:
       interval: daily
       time: "04:00"
     open-pull-requests-limit: 10
-    reviewers:
-      - "@goauthentik/core"
     commit-message:
       prefix: "website:"
   - package-ecosystem: pip
@@ -46,8 +38,6 @@ updates:
       interval: daily
       time: "04:00"
     open-pull-requests-limit: 10
-    reviewers:
-      - "@goauthentik/core"
     commit-message:
       prefix: "core:"
   - package-ecosystem: docker
@@ -56,7 +46,5 @@ updates:
       interval: daily
       time: "04:00"
     open-pull-requests-limit: 10
-    reviewers:
-      - "@goauthentik/core"
     commit-message:
       prefix: "core:"

.github/pull_request_template.md

@@ -1,10 +1,10 @@
 <!--
 👋 Hello there! Welcome.
 
-Please check the [Contributing guidelines](https://github.com/goauthentik/authentik/blob/main/CONTRIBUTING.md#how-can-i-contribute).
+Please check the [Contributing guidelines](https://goauthentik.io/developer-docs/#how-can-i-contribute).
 -->
 
-# Details
+## Details
 
 -   **Does this resolve an issue?**
     Resolves #

.github/workflows/ci-main.yml

@@ -112,7 +112,7 @@ jobs:
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.5.0
+        uses: helm/kind-action@v1.7.0
       - name: run integration
         run: |
           poetry run coverage run manage.py test tests/integration

.github/workflows/translation-advice.yml

@@ -21,7 +21,7 @@ jobs:
           comment-author: "github-actions[bot]"
           body-includes: authentik translations instructions
       - name: Create or update comment
-        uses: peter-evans/create-or-update-comment@v2
+        uses: peter-evans/create-or-update-comment@v3
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}

.vscode/extensions.json

@@ -1,10 +1,11 @@
 {
     "recommendations": [
-        "EditorConfig.EditorConfig",
         "bashmish.es6-string-css",
         "bpruitt-goddard.mermaid-markdown-syntax-highlighting",
         "dbaeumer.vscode-eslint",
+        "EditorConfig.EditorConfig",
         "esbenp.prettier-vscode",
+        "github.vscode-github-actions",
         "golang.go",
         "Gruntfuggly.todo-tree",
         "mechatroner.rainbow-csv",
@@ -15,6 +16,6 @@
         "ms-python.vscode-pylance",
         "redhat.vscode-yaml",
         "Tobermory.es6-string-html",
-        "unifiedjs.vscode-mdx"
+        "unifiedjs.vscode-mdx",
     ]
 }

.vscode/settings.json

@@ -48,5 +48,10 @@
             "ignoreCase": false
         }
     ],
-    "go.testFlags": ["-count=1"]
+    "go.testFlags": [
+        "-count=1"
+    ],
+    "github-actions.workflows.pinned.workflows": [
+        ".github/workflows/ci-main.yml"
+    ]
 }

.vscode/tasks.json

@@ -3,23 +3,26 @@
     "tasks": [
         {
             "label": "authentik[core]: format & test",
-            "command": "make",
+            "command": "poetry",
+            "args": [
+                "run",
+                "make"
+            ],
             "group": "build",
         },
         {
             "label": "authentik[core]: run",
-            "command": "ak",
+            "command": "poetry",
             "args": [
-                "server",
+                "run",
+                "make",
+                "run",
             ],
             "group": "build",
             "presentation": {
                 "panel": "dedicated",
                 "group": "running"
             },
-            "runOptions": {
-                "runOn": "folderOpen"
-            }
         },
         {
             "label": "authentik[web]: format",
@@ -36,9 +39,6 @@
                 "panel": "dedicated",
                 "group": "running"
             },
-            "runOptions": {
-                "runOn": "folderOpen"
-            }
         },
         {
             "label": "authentik: install",

CODEOWNERS

@@ -0,0 +1,2 @@
+*   @goauthentik/core
+website/docs/security/**    @goauthentik/security

CONTRIBUTING.md

@@ -1,188 +0,0 @@
-# Contributing to authentik
-
-:+1::tada: Thanks for taking the time to contribute! :tada::+1:
-
-The following is a set of guidelines for contributing to authentik and its components, which are hosted in the [goauthentik Organization](https://github.com/goauthentik) on GitHub. These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
-
-#### Table Of Contents
-
-[Code of Conduct](#code-of-conduct)
-
-[I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)
-
-[What should I know before I get started?](#what-should-i-know-before-i-get-started)
-
--   [The components](#the-components)
--   [authentik's structure](#authentiks-structure)
-
-[How Can I Contribute?](#how-can-i-contribute)
-
--   [Reporting Bugs](#reporting-bugs)
--   [Suggesting Enhancements](#suggesting-enhancements)
--   [Your First Code Contribution](#your-first-code-contribution)
--   [Help with the Docs](#help-with-the-docs)
--   [Pull Requests](#pull-requests)
-
-[Styleguides](#styleguides)
-
--   [Git Commit Messages](#git-commit-messages)
--   [Python Styleguide](#python-styleguide)
--   [Documentation Styleguide](#documentation-styleguide)
-
-## Code of Conduct
-
-Basically, don't be a dickhead. This is an open-source non-profit project, that is made in the free time of Volunteers. If there's something you dislike or think can be done better, tell us! We'd love to hear any suggestions for improvement.
-
-## I don't want to read this whole thing I just have a question!!!
-
-Either [create a question on GitHub](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=question&template=question.md&title=) or join [the Discord server](https://goauthentik.io/discord)
-
-## What should I know before I get started?
-
-### The components
-
-authentik consists of a few larger components:
-
--   _authentik_ the actual application server, is described below.
--   _outpost-proxy_ is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
--   _outpost-ldap_ is a Go LDAP server that uses the _authentik_ application server as its backend
--   _web_ is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
--   _website_ is the Website/documentation, which uses docusaurus.
-
-### authentik's structure
-
-authentik is at it's very core a Django project. It consists of many individual django applications. These applications are intended to separate concerns, and they may share code between each other.
-
-These are the current packages:
-<a id="authentik-packages"/>
-
-```
-authentik
-├── admin - Administrative tasks and APIs, no models (Version updates, Metrics, system tasks)
-├── api - General API Configuration (Routes, Schema and general API utilities)
-├── blueprints - Handle managed models and their state.
-├── core - Core authentik functionality, central routes, core Models
-├── crypto - Cryptography, currently used to generate and hold Certificates and Private Keys
-├── events - Event Log, middleware and signals to generate signals
-├── flows - Flows, the FlowPlanner and the FlowExecutor, used for all flows for authentication, authorization, etc
-├── lib - Generic library of functions, few dependencies on other packages.
-├── outposts - Configure and deploy outposts on kubernetes and docker.
-├── policies - General PolicyEngine
-│   ├── dummy - A Dummy policy used for testing
-│   ├── event_matcher - Match events based on different criteria
-│   ├── expiry - Check when a user's password was last set
-│   ├── expression - Execute any arbitrary python code
-│   ├── password - Check a password against several rules
-│   └── reputation - Check the user's/client's reputation
-├── providers
-│   ├── ldap - Provide LDAP access to authentik users/groups using an outpost
-│   ├── oauth2 - OIDC-compliant OAuth2 provider
-│   ├── proxy - Provides an identity-aware proxy using an outpost
-│   └── saml - SAML2 Provider
-├── recovery - Generate keys to use in case you lock yourself out
-├── root - Root django application, contains global settings and routes
-├── sources
-│   ├── ldap - Sync LDAP users from OpenLDAP or Active Directory into authentik
-│   ├── oauth - OAuth1 and OAuth2 Source
-│   ├── plex - Plex source
-│   └── saml - SAML2 Source
-├── stages
-│   ├── authenticator_duo - Configure a DUO authenticator
-│   ├── authenticator_static - Configure TOTP backup keys
-│   ├── authenticator_totp - Configure a TOTP authenticator
-│   ├── authenticator_validate - Validate any authenticator
-│   ├── authenticator_webauthn - Configure a WebAuthn authenticator
-│   ├── captcha - Make the user pass a captcha
-│   ├── consent - Let the user decide if they want to consent to an action
-│   ├── deny - Static deny, can be used with policies
-│   ├── dummy - Dummy stage to test
-│   ├── email - Send the user an email and block execution until they click the link
-│   ├── identification - Identify a user with any combination of fields
-│   ├── invitation - Invitation system to limit flows to certain users
-│   ├── password - Password authentication
-│   ├── prompt - Arbitrary prompts
-│   ├── user_delete - Delete the currently pending user
-│   ├── user_login - Login the currently pending user
-│   ├── user_logout - Logout the currently pending user
-│   └── user_write - Write any currenetly pending data to the user.
-└── tenants - Soft tennancy, configure defaults and branding per domain
-```
-
-This django project is running in gunicorn, which spawns multiple workers and threads. Gunicorn is run from a lightweight Go application which reverse-proxies it, handles static files and will eventually gain more functionality as more code is migrated to go.
-
-There are also several background tasks which run in Celery, the root celery application is defined in `authentik.root.celery`.
-
-## How Can I Contribute?
-
-### Reporting Bugs
-
-This section guides you through submitting a bug report for authentik. Following these guidelines helps maintainers and the community understand your report, reproduce the behavior, and find related reports.
-
-Whenever authentik encounters an error, it will be logged as an Event with the type `system_exception`. This event type has a button to directly open a pre-filled GitHub issue form.
-
-This form will have the full stack trace of the error that occurred and shouldn't contain any sensitive data.
-
-### Suggesting Enhancements
-
-This section guides you through submitting an enhancement suggestion for authentik, including completely new features and minor improvements to existing functionality. Following these guidelines helps maintainers and the community understand your suggestion and find related suggestions.
-
-When you are creating an enhancement suggestion, please fill in [the template](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=), including the steps that you imagine you would take if the feature you're requesting existed.
-
-### Your First Code Contribution
-
-#### Local development
-
-authentik can be run locally, all though depending on which part you want to work on, different pre-requisites are required.
-
-This is documented in the [developer docs](https://goauthentik.io/developer-docs/?utm_source=github)
-
-### Help with the Docs
-Contributions to the technical documentation are greatly appreciated. Open a PR if you have improvements to make or new content to add. If you have questions or suggestions about the documentation, open an Issue. No contribution is too small.
-
-### Pull Requests
-
-The process described here has several goals:
-
--   Maintain authentik's quality
--   Fix problems that are important to users
--   Engage the community in working toward the best possible authentik
--   Enable a sustainable system for authentik's maintainers to review contributions
-
-Please follow these steps to have your contribution considered by the maintainers:
-
-1. Follow the [styleguides](#styleguides)
-2. After you submit your pull request, verify that all [status checks](https://help.github.com/articles/about-status-checks/) are passing <details><summary>What if the status checks are failing?</summary>If a status check is failing, and you believe that the failure is unrelated to your change, please leave a comment on the pull request explaining why you believe the failure is unrelated. A maintainer will re-run the status check for you. If we conclude that the failure was a false positive, then we will open an issue to track that problem with our status check suite.</details>
-3. Ensure your Code has tests. While it is not always possible to test every single case, the majority of the code should be tested.
-
-While the prerequisites above must be satisfied prior to having your pull request reviewed, the reviewer(s) may ask you to complete additional design work, tests, or other changes before your pull request can be ultimately accepted.
-
-## Styleguides
-
-### PR naming
-
--   Use the format of `<package>: <verb> <description>`
-    -   See [here](#authentik-packages) for `package`
-    -   Example: `providers/saml2: fix parsing of requests`
-
-### Git Commit Messages
-
--   Use the format of `<package>: <verb> <description>`
-    -   See [here](#authentik-packages) for `package`
-    -   Example: `providers/saml2: fix parsing of requests`
--   Reference issues and pull requests liberally after the first line
--   Naming of commits within a PR does not need to adhere to the guidelines as we squash merge PRs
-
-### Python Styleguide
-
-All Python code is linted with [black](https://black.readthedocs.io/en/stable/), [PyLint](https://www.pylint.org/) and [isort](https://pycqa.github.io/isort/).
-
-authentik runs on Python 3.9 at the time of writing this.
-
--   Use native type-annotations wherever possible.
--   Add meaningful docstrings when possible.
--   Ensure any database migrations work properly from the last stable version (this is checked via CI)
--   If your code changes central functions, make sure nothing else is broken.
-
-### Documentation Styleguide
-
--   Use [MDX](https://mdxjs.com/) whenever appropriate.

CONTRIBUTING.md

@@ -0,0 +1 @@
+website/developer-docs/index.md

Dockerfile

@@ -7,7 +7,7 @@ COPY ./SECURITY.md /work/
 
 ENV NODE_ENV=production
 WORKDIR /work/website
-RUN npm ci && npm run build-docs-only
+RUN npm ci --include=dev && npm run build-docs-only
 
 # Stage 2: Build webui
 FROM --platform=${BUILDPLATFORM} docker.io/node:20 as web-builder
@@ -17,7 +17,7 @@ COPY ./website /work/website/
 
 ENV NODE_ENV=production
 WORKDIR /work/web
-RUN npm ci && npm run build
+RUN npm ci --include=dev && npm run build
 
 # Stage 3: Poetry to requirements.txt export
 FROM docker.io/python:3.11.3-slim-bullseye AS poetry-locker
@@ -47,11 +47,12 @@ COPY ./go.sum /work/go.sum
 RUN go build -o /work/authentik ./cmd/server/
 
 # Stage 5: MaxMind GeoIP
-FROM docker.io/maxmindinc/geoipupdate:v5.0 as geoip
+FROM ghcr.io/maxmind/geoipupdate:v5.1 as geoip
 
 ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City"
 ENV GEOIPUPDATE_VERBOSE="true"
 
+USER root
 RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     --mount=type=secret,id=GEOIPUPDATE_LICENSE_KEY \
     mkdir -p /usr/share/GeoIP && \
@@ -68,14 +69,14 @@ LABEL org.opencontainers.image.url https://goauthentik.io
 LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.
 LABEL org.opencontainers.image.source https://github.com/goauthentik/authentik
 
-WORKDIR /app-root
+WORKDIR /
 
 ARG GIT_BUILD_HASH
 ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
 
-COPY --from=poetry-locker /work/requirements.txt /app-root
-COPY --from=poetry-locker /work/requirements-dev.txt /app-root
-COPY --from=geoip /usr/share/GeoIP /app-root/geoip
+COPY --from=poetry-locker /work/requirements.txt /
+COPY --from=poetry-locker /work/requirements-dev.txt /
+COPY --from=geoip /usr/share/GeoIP /geoip
 
 RUN apt-get update && \
     # Required for installing pip packages
@@ -84,35 +85,35 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends libxmlsec1-openssl libmaxminddb0 && \
     # Required for bootstrap & healtcheck
     apt-get install -y --no-install-recommends runit && \
-    pip install --no-cache-dir -r /app-root/requirements.txt && \
+    pip install --no-cache-dir -r /requirements.txt && \
     apt-get remove --purge -y build-essential pkg-config libxmlsec1-dev && \
     apt-get autoremove --purge -y && \
     apt-get clean && \
     rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
-    adduser --system --no-create-home --uid 1000 --group --home /app-root authentik && \
-    mkdir -p /app-root /app-root/.ssh && \
+    adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \
     mkdir -p /certs /media /blueprints && \
-    chown -R authentik:authentik /certs /media /app-root/
+    mkdir -p /authentik/.ssh && \
+    chown authentik:authentik /certs /media /authentik/.ssh
 
-COPY ./authentik/ /app-root/authentik
-COPY ./pyproject.toml /app-root/
-COPY ./schemas /app-root/schemas
-COPY ./locale /app-root/locale
-COPY ./tests /app-root/tests
-COPY ./manage.py /app-root/
+COPY ./authentik/ /authentik
+COPY ./pyproject.toml /
+COPY ./schemas /schemas
+COPY ./locale /locale
+COPY ./tests /tests
+COPY ./manage.py /
 COPY ./blueprints /blueprints
-COPY ./lifecycle/ /app-root/lifecycle
+COPY ./lifecycle/ /lifecycle
 COPY --from=go-builder /work/authentik /bin/authentik
-COPY --from=web-builder /work/web/dist/ /app-root/web/dist/
-COPY --from=web-builder /work/web/authentik/ /app-root/web/authentik/
-COPY --from=website-builder /work/website/help/ /app-root/website/help/
+COPY --from=web-builder /work/web/dist/ /web/dist/
+COPY --from=web-builder /work/web/authentik/ /web/authentik/
+COPY --from=website-builder /work/website/help/ /website/help/
 
 USER 1000
 
 ENV TMPDIR /dev/shm/
 ENV PYTHONUNBUFFERED 1
-ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/app-root/lifecycle"
+ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/lifecycle"
 
-HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "ak", "healthcheck" ]
+HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "/lifecycle/ak", "healthcheck" ]
 
-ENTRYPOINT [ "/usr/local/bin/dumb-init", "--", "ak" ]
+ENTRYPOINT [ "/usr/local/bin/dumb-init", "--", "/lifecycle/ak" ]

Makefile

@@ -206,6 +206,8 @@ install: web-install website-install
 
 dev-reset:
 	dropdb -U postgres -h localhost authentik
+	# Also remove the test-db if it exists
+	dropdb -U postgres -h localhost test_authentik || true
 	createdb -U postgres -h localhost authentik
 	redis-cli -n 0 flushall
 	make migrate

SECURITY.md

@@ -6,8 +6,8 @@ Authentik takes security very seriously. We follow the rules of [responsible dis
 
 | Version   | Supported          |
 | --------- | ------------------ |
-| 2023.2.x  | :white_check_mark: |
-| 2023.3.x  | :white_check_mark: |
+| 2023.4.x  | :white_check_mark: |
+| 2023.5.x  | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2023.4.1"
+__version__ = "2023.5.2"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/urls.py

@@ -0,0 +1,22 @@
+"""API URLs"""
+from django.urls import path
+
+from authentik.admin.api.meta import AppsViewSet
+from authentik.admin.api.metrics import AdministrationMetricsViewSet
+from authentik.admin.api.system import SystemView
+from authentik.admin.api.tasks import TaskViewSet
+from authentik.admin.api.version import VersionView
+from authentik.admin.api.workers import WorkerView
+
+api_urlpatterns = [
+    ("admin/system_tasks", TaskViewSet, "admin_system_tasks"),
+    ("admin/apps", AppsViewSet, "apps"),
+    path(
+        "admin/metrics/",
+        AdministrationMetricsViewSet.as_view(),
+        name="admin_metrics",
+    ),
+    path("admin/version/", VersionView.as_view(), name="admin_version"),
+    path("admin/workers/", WorkerView.as_view(), name="admin_workers"),
+    path("admin/system/", SystemView.as_view(), name="admin_system"),
+]

authentik/api/v3/config.py

@@ -1,5 +1,5 @@
 """core Configs API"""
-from os import path
+from pathlib import Path
 
 from django.conf import settings
 from django.db import models
@@ -63,7 +63,7 @@ class ConfigView(APIView):
         """Get all capabilities this server instance supports"""
         caps = []
         deb_test = settings.DEBUG or settings.TEST
-        if path.ismount(settings.MEDIA_ROOT) or deb_test:
+        if Path(settings.MEDIA_ROOT).is_mount() or deb_test:
             caps.append(Capabilities.CAN_SAVE_MEDIA)
         if GEOIP_READER.enabled:
             caps.append(Capabilities.CAN_GEO_IP)

authentik/api/v3/urls.py

@@ -1,269 +1,50 @@
 """api v3 urls"""
+from importlib import import_module
+
 from django.urls import path
+from django.urls.resolvers import URLPattern
 from django.views.decorators.cache import cache_page
 from drf_spectacular.views import SpectacularAPIView
 from rest_framework import routers
+from structlog.stdlib import get_logger
 
-from authentik.admin.api.meta import AppsViewSet
-from authentik.admin.api.metrics import AdministrationMetricsViewSet
-from authentik.admin.api.system import SystemView
-from authentik.admin.api.tasks import TaskViewSet
-from authentik.admin.api.version import VersionView
-from authentik.admin.api.workers import WorkerView
 from authentik.api.v3.config import ConfigView
 from authentik.api.views import APIBrowserView
-from authentik.blueprints.api import BlueprintInstanceViewSet
-from authentik.core.api.applications import ApplicationViewSet
-from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
-from authentik.core.api.devices import AdminDeviceViewSet, DeviceViewSet
-from authentik.core.api.groups import GroupViewSet
-from authentik.core.api.propertymappings import PropertyMappingViewSet
-from authentik.core.api.providers import ProviderViewSet
-from authentik.core.api.sources import SourceViewSet, UserSourceConnectionViewSet
-from authentik.core.api.tokens import TokenViewSet
-from authentik.core.api.users import UserViewSet
-from authentik.crypto.api import CertificateKeyPairViewSet
-from authentik.events.api.events import EventViewSet
-from authentik.events.api.notification_mappings import NotificationWebhookMappingViewSet
-from authentik.events.api.notification_rules import NotificationRuleViewSet
-from authentik.events.api.notification_transports import NotificationTransportViewSet
-from authentik.events.api.notifications import NotificationViewSet
-from authentik.flows.api.bindings import FlowStageBindingViewSet
-from authentik.flows.api.flows import FlowViewSet
-from authentik.flows.api.stages import StageViewSet
-from authentik.flows.views.executor import FlowExecutorView
-from authentik.flows.views.inspector import FlowInspectorView
-from authentik.outposts.api.outposts import OutpostViewSet
-from authentik.outposts.api.service_connections import (
-    DockerServiceConnectionViewSet,
-    KubernetesServiceConnectionViewSet,
-    ServiceConnectionViewSet,
-)
-from authentik.policies.api.bindings import PolicyBindingViewSet
-from authentik.policies.api.policies import PolicyViewSet
-from authentik.policies.dummy.api import DummyPolicyViewSet
-from authentik.policies.event_matcher.api import EventMatcherPolicyViewSet
-from authentik.policies.expiry.api import PasswordExpiryPolicyViewSet
-from authentik.policies.expression.api import ExpressionPolicyViewSet
-from authentik.policies.password.api import PasswordPolicyViewSet
-from authentik.policies.reputation.api import ReputationPolicyViewSet, ReputationViewSet
-from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
-from authentik.providers.oauth2.api.providers import OAuth2ProviderViewSet
-from authentik.providers.oauth2.api.scopes import ScopeMappingViewSet
-from authentik.providers.oauth2.api.tokens import (
-    AccessTokenViewSet,
-    AuthorizationCodeViewSet,
-    RefreshTokenViewSet,
-)
-from authentik.providers.proxy.api import ProxyOutpostConfigViewSet, ProxyProviderViewSet
-from authentik.providers.radius.api import RadiusOutpostConfigViewSet, RadiusProviderViewSet
-from authentik.providers.saml.api.property_mapping import SAMLPropertyMappingViewSet
-from authentik.providers.saml.api.providers import SAMLProviderViewSet
-from authentik.providers.scim.api.property_mapping import SCIMMappingViewSet
-from authentik.providers.scim.api.providers import SCIMProviderViewSet
-from authentik.sources.ldap.api import LDAPPropertyMappingViewSet, LDAPSourceViewSet
-from authentik.sources.oauth.api.source import OAuthSourceViewSet
-from authentik.sources.oauth.api.source_connection import UserOAuthSourceConnectionViewSet
-from authentik.sources.plex.api.source import PlexSourceViewSet
-from authentik.sources.plex.api.source_connection import PlexSourceConnectionViewSet
-from authentik.sources.saml.api.source import SAMLSourceViewSet
-from authentik.sources.saml.api.source_connection import UserSAMLSourceConnectionViewSet
-from authentik.stages.authenticator_duo.api import (
-    AuthenticatorDuoStageViewSet,
-    DuoAdminDeviceViewSet,
-    DuoDeviceViewSet,
-)
-from authentik.stages.authenticator_sms.api import (
-    AuthenticatorSMSStageViewSet,
-    SMSAdminDeviceViewSet,
-    SMSDeviceViewSet,
-)
-from authentik.stages.authenticator_static.api import (
-    AuthenticatorStaticStageViewSet,
-    StaticAdminDeviceViewSet,
-    StaticDeviceViewSet,
-)
-from authentik.stages.authenticator_totp.api import (
-    AuthenticatorTOTPStageViewSet,
-    TOTPAdminDeviceViewSet,
-    TOTPDeviceViewSet,
-)
-from authentik.stages.authenticator_validate.api import AuthenticatorValidateStageViewSet
-from authentik.stages.authenticator_webauthn.api import (
-    AuthenticateWebAuthnStageViewSet,
-    WebAuthnAdminDeviceViewSet,
-    WebAuthnDeviceViewSet,
-)
-from authentik.stages.captcha.api import CaptchaStageViewSet
-from authentik.stages.consent.api import ConsentStageViewSet, UserConsentViewSet
-from authentik.stages.deny.api import DenyStageViewSet
-from authentik.stages.dummy.api import DummyStageViewSet
-from authentik.stages.email.api import EmailStageViewSet
-from authentik.stages.identification.api import IdentificationStageViewSet
-from authentik.stages.invitation.api import InvitationStageViewSet, InvitationViewSet
-from authentik.stages.password.api import PasswordStageViewSet
-from authentik.stages.prompt.api import PromptStageViewSet, PromptViewSet
-from authentik.stages.user_delete.api import UserDeleteStageViewSet
-from authentik.stages.user_login.api import UserLoginStageViewSet
-from authentik.stages.user_logout.api import UserLogoutStageViewSet
-from authentik.stages.user_write.api import UserWriteStageViewSet
-from authentik.tenants.api import TenantViewSet
+from authentik.lib.utils.reflection import get_apps
+
+LOGGER = get_logger()
 
 router = routers.DefaultRouter()
 router.include_format_suffixes = False
 
-router.register("admin/system_tasks", TaskViewSet, basename="admin_system_tasks")
-router.register("admin/apps", AppsViewSet, basename="apps")
+_other_urls = []
+for _authentik_app in get_apps():
+    try:
+        api_urls = import_module(f"{_authentik_app.name}.urls")
+    except (ModuleNotFoundError, ImportError):
+        continue
+    if not hasattr(api_urls, "api_urlpatterns"):
+        continue
+    urls: list = getattr(api_urls, "api_urlpatterns")
+    for url in urls:
+        if isinstance(url, URLPattern):
+            _other_urls.append(url)
+        else:
+            router.register(*url)
+    LOGGER.debug(
+        "Mounted API URLs",
+        app_name=_authentik_app.name,
+    )
 
-router.register("core/authenticated_sessions", AuthenticatedSessionViewSet)
-router.register("core/applications", ApplicationViewSet)
-router.register("core/groups", GroupViewSet)
-router.register("core/users", UserViewSet)
-router.register("core/user_consent", UserConsentViewSet)
-router.register("core/tokens", TokenViewSet)
-router.register("core/tenants", TenantViewSet)
-
-router.register("outposts/instances", OutpostViewSet)
-router.register("outposts/service_connections/all", ServiceConnectionViewSet)
-router.register("outposts/service_connections/docker", DockerServiceConnectionViewSet)
-router.register("outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet)
-router.register("outposts/proxy", ProxyOutpostConfigViewSet)
-router.register("outposts/ldap", LDAPOutpostConfigViewSet)
-router.register("outposts/radius", RadiusOutpostConfigViewSet)
-
-router.register("flows/instances", FlowViewSet)
-router.register("flows/bindings", FlowStageBindingViewSet)
-
-router.register("crypto/certificatekeypairs", CertificateKeyPairViewSet)
-
-router.register("events/events", EventViewSet)
-router.register("events/notifications", NotificationViewSet)
-router.register("events/transports", NotificationTransportViewSet)
-router.register("events/rules", NotificationRuleViewSet)
-
-router.register("managed/blueprints", BlueprintInstanceViewSet)
-
-router.register("sources/all", SourceViewSet)
-router.register("sources/user_connections/all", UserSourceConnectionViewSet)
-router.register("sources/user_connections/oauth", UserOAuthSourceConnectionViewSet)
-router.register("sources/user_connections/plex", PlexSourceConnectionViewSet)
-router.register("sources/user_connections/saml", UserSAMLSourceConnectionViewSet)
-router.register("sources/ldap", LDAPSourceViewSet)
-router.register("sources/saml", SAMLSourceViewSet)
-router.register("sources/oauth", OAuthSourceViewSet)
-router.register("sources/plex", PlexSourceViewSet)
-
-router.register("policies/all", PolicyViewSet)
-router.register("policies/bindings", PolicyBindingViewSet)
-router.register("policies/expression", ExpressionPolicyViewSet)
-router.register("policies/event_matcher", EventMatcherPolicyViewSet)
-router.register("policies/password_expiry", PasswordExpiryPolicyViewSet)
-router.register("policies/password", PasswordPolicyViewSet)
-router.register("policies/reputation/scores", ReputationViewSet)
-router.register("policies/reputation", ReputationPolicyViewSet)
-
-router.register("providers/all", ProviderViewSet)
-router.register("providers/ldap", LDAPProviderViewSet)
-router.register("providers/proxy", ProxyProviderViewSet)
-router.register("providers/oauth2", OAuth2ProviderViewSet)
-router.register("providers/saml", SAMLProviderViewSet)
-router.register("providers/scim", SCIMProviderViewSet)
-router.register("providers/radius", RadiusProviderViewSet)
-
-router.register("oauth2/authorization_codes", AuthorizationCodeViewSet)
-router.register("oauth2/refresh_tokens", RefreshTokenViewSet)
-router.register("oauth2/access_tokens", AccessTokenViewSet)
-
-router.register("propertymappings/all", PropertyMappingViewSet)
-router.register("propertymappings/ldap", LDAPPropertyMappingViewSet)
-router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
-router.register("propertymappings/scope", ScopeMappingViewSet)
-router.register("propertymappings/notification", NotificationWebhookMappingViewSet)
-router.register("propertymappings/scim", SCIMMappingViewSet)
-
-router.register("authenticators/all", DeviceViewSet, basename="device")
-router.register("authenticators/duo", DuoDeviceViewSet)
-router.register("authenticators/sms", SMSDeviceViewSet)
-router.register("authenticators/static", StaticDeviceViewSet)
-router.register("authenticators/totp", TOTPDeviceViewSet)
-router.register("authenticators/webauthn", WebAuthnDeviceViewSet)
-router.register(
-    "authenticators/admin/all",
-    AdminDeviceViewSet,
-    basename="admin-device",
-)
-router.register(
-    "authenticators/admin/duo",
-    DuoAdminDeviceViewSet,
-    basename="admin-duodevice",
-)
-router.register(
-    "authenticators/admin/sms",
-    SMSAdminDeviceViewSet,
-    basename="admin-smsdevice",
-)
-router.register(
-    "authenticators/admin/static",
-    StaticAdminDeviceViewSet,
-    basename="admin-staticdevice",
-)
-router.register("authenticators/admin/totp", TOTPAdminDeviceViewSet, basename="admin-totpdevice")
-router.register(
-    "authenticators/admin/webauthn",
-    WebAuthnAdminDeviceViewSet,
-    basename="admin-webauthndevice",
-)
-
-router.register("stages/all", StageViewSet)
-router.register("stages/authenticator/duo", AuthenticatorDuoStageViewSet)
-router.register("stages/authenticator/sms", AuthenticatorSMSStageViewSet)
-router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet)
-router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet)
-router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet)
-router.register("stages/authenticator/webauthn", AuthenticateWebAuthnStageViewSet)
-router.register("stages/captcha", CaptchaStageViewSet)
-router.register("stages/consent", ConsentStageViewSet)
-router.register("stages/deny", DenyStageViewSet)
-router.register("stages/email", EmailStageViewSet)
-router.register("stages/identification", IdentificationStageViewSet)
-router.register("stages/invitation/invitations", InvitationViewSet)
-router.register("stages/invitation/stages", InvitationStageViewSet)
-router.register("stages/password", PasswordStageViewSet)
-router.register("stages/prompt/prompts", PromptViewSet)
-router.register("stages/prompt/stages", PromptStageViewSet)
-router.register("stages/user_delete", UserDeleteStageViewSet)
-router.register("stages/user_login", UserLoginStageViewSet)
-router.register("stages/user_logout", UserLogoutStageViewSet)
-router.register("stages/user_write", UserWriteStageViewSet)
-
-router.register("stages/dummy", DummyStageViewSet)
-router.register("policies/dummy", DummyPolicyViewSet)
 
 urlpatterns = (
     [
         path("", APIBrowserView.as_view(), name="schema-browser"),
     ]
     + router.urls
+    + _other_urls
     + [
-        path(
-            "admin/metrics/",
-            AdministrationMetricsViewSet.as_view(),
-            name="admin_metrics",
-        ),
-        path("admin/version/", VersionView.as_view(), name="admin_version"),
-        path("admin/workers/", WorkerView.as_view(), name="admin_workers"),
-        path("admin/system/", SystemView.as_view(), name="admin_system"),
         path("root/config/", ConfigView.as_view(), name="config"),
-        path(
-            "flows/executor/<slug:flow_slug>/",
-            FlowExecutorView.as_view(),
-            name="flow-executor",
-        ),
-        path(
-            "flows/inspector/<slug:flow_slug>/",
-            FlowInspectorView.as_view(),
-            name="flow-inspector",
-        ),
         path("schema/", cache_page(86400)(SpectacularAPIView.as_view()), name="schema"),
     ]
 )

authentik/blueprints/api.py

@@ -11,7 +11,7 @@ from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.decorators import permission_required
-from authentik.blueprints.models import BlueprintInstance, BlueprintRetrievalFailed
+from authentik.blueprints.models import BlueprintInstance
 from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.tasks import apply_blueprint, blueprints_find_dict
 from authentik.core.api.used_by import UsedByMixin
@@ -35,11 +35,12 @@ class BlueprintInstanceSerializer(ModelSerializer):
     """Info about a single blueprint instance file"""
 
     def validate_path(self, path: str) -> str:
-        """Ensure the path specified is retrievable"""
-        try:
-            BlueprintInstance(path=path).retrieve()
-        except BlueprintRetrievalFailed as exc:
-            raise ValidationError(exc) from exc
+        """Ensure the path (if set) specified is retrievable"""
+        if path == "":
+            return path
+        files: list[dict] = blueprints_find_dict.delay().get()
+        if path not in [file["path"] for file in files]:
+            raise ValidationError(_("Blueprint file does not exist"))
         return path
 
     def validate_content(self, content: str) -> str:

authentik/blueprints/management/commands/make_blueprint_schema.py

@@ -1,12 +1,17 @@
 """Generate JSON Schema for blueprints"""
-from json import dumps, loads
-from pathlib import Path
+from json import dumps
+from typing import Any
 
 from django.core.management.base import BaseCommand, no_translations
+from django.db.models import Model
+from drf_jsonschema_serializer.convert import field_to_converter
+from rest_framework.fields import Field, JSONField, UUIDField
+from rest_framework.serializers import Serializer
 from structlog.stdlib import get_logger
 
-from authentik.blueprints.v1.importer import is_model_allowed
-from authentik.blueprints.v1.meta.registry import registry
+from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT, is_model_allowed
+from authentik.blueprints.v1.meta.registry import BaseMetaModel, registry
+from authentik.lib.models import SerializerModel
 
 LOGGER = get_logger()
 
@@ -16,21 +21,146 @@ class Command(BaseCommand):
 
     schema: dict
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.schema = {
+            "$schema": "http://json-schema.org/draft-07/schema",
+            "$id": "https://goauthentik.io/blueprints/schema.json",
+            "type": "object",
+            "title": "authentik Blueprint schema",
+            "required": ["version", "entries"],
+            "properties": {
+                "version": {
+                    "$id": "#/properties/version",
+                    "type": "integer",
+                    "title": "Blueprint version",
+                    "default": 1,
+                },
+                "metadata": {
+                    "$id": "#/properties/metadata",
+                    "type": "object",
+                    "required": ["name"],
+                    "properties": {
+                        "name": {"type": "string"},
+                        "labels": {"type": "object", "additionalProperties": {"type": "string"}},
+                    },
+                },
+                "context": {
+                    "$id": "#/properties/context",
+                    "type": "object",
+                    "additionalProperties": True,
+                },
+                "entries": {
+                    "type": "array",
+                    "items": {
+                        "oneOf": [],
+                    },
+                },
+            },
+            "$defs": {},
+        }
+
     @no_translations
     def handle(self, *args, **options):
         """Generate JSON Schema for blueprints"""
-        path = Path(__file__).parent.joinpath("./schema_template.json")
-        with open(path, "r", encoding="utf-8") as _template_file:
-            self.schema = loads(_template_file.read())
-        self.set_model_allowed()
-        self.stdout.write(dumps(self.schema, indent=4))
+        self.build()
+        self.stdout.write(dumps(self.schema, indent=4, default=Command.json_default))
 
-    def set_model_allowed(self):
-        """Set model enum"""
-        model_names = []
+    @staticmethod
+    def json_default(value: Any) -> Any:
+        """Helper that handles gettext_lazy strings that JSON doesn't handle"""
+        return str(value)
+
+    def build(self):
+        """Build all models into the schema"""
         for model in registry.get_models():
-            if not is_model_allowed(model):
+            if issubclass(model, BaseMetaModel):
+                serializer_class = model.serializer()
+            else:
+                if model._meta.abstract:
+                    continue
+                if not is_model_allowed(model):
+                    continue
+                model_instance: Model = model()
+                if not isinstance(model_instance, SerializerModel):
+                    continue
+                serializer_class = model_instance.serializer
+            serializer = serializer_class(
+                context={
+                    SERIALIZER_CONTEXT_BLUEPRINT: False,
+                }
+            )
+            model_path = f"{model._meta.app_label}.{model._meta.model_name}"
+            self.schema["properties"]["entries"]["items"]["oneOf"].append(
+                self.template_entry(model_path, serializer)
+            )
+
+    def template_entry(self, model_path: str, serializer: Serializer) -> dict:
+        """Template entry for a single model"""
+        model_schema = self.to_jsonschema(serializer)
+        model_schema["required"] = []
+        def_name = f"model_{model_path}"
+        def_path = f"#/$defs/{def_name}"
+        self.schema["$defs"][def_name] = model_schema
+        return {
+            "type": "object",
+            "required": ["model", "identifiers"],
+            "properties": {
+                "model": {"const": model_path},
+                "id": {"type": "string"},
+                "state": {
+                    "type": "string",
+                    "enum": ["absent", "present", "created"],
+                    "default": "present",
+                },
+                "conditions": {"type": "array", "items": {"type": "boolean"}},
+                "attrs": {"$ref": def_path},
+                "identifiers": {"$ref": def_path},
+            },
+        }
+
+    def field_to_jsonschema(self, field: Field) -> dict:
+        """Convert a single field to json schema"""
+        if isinstance(field, Serializer):
+            result = self.to_jsonschema(field)
+        else:
+            try:
+                converter = field_to_converter[field]
+                result = converter.convert(field)
+            except KeyError:
+                if isinstance(field, JSONField):
+                    result = {"type": "object", "additionalProperties": True}
+                elif isinstance(field, UUIDField):
+                    result = {"type": "string", "format": "uuid"}
+                else:
+                    raise
+        if field.label:
+            result["title"] = field.label
+        if field.help_text:
+            result["description"] = field.help_text
+        return self.clean_result(result)
+
+    def clean_result(self, result: dict) -> dict:
+        """Remove enumNames from result, recursively"""
+        result.pop("enumNames", None)
+        for key, value in result.items():
+            if isinstance(value, dict):
+                result[key] = self.clean_result(value)
+        return result
+
+    def to_jsonschema(self, serializer: Serializer) -> dict:
+        """Convert serializer to json schema"""
+        properties = {}
+        required = []
+        for name, field in serializer.fields.items():
+            if field.read_only:
                 continue
-            model_names.append(f"{model._meta.app_label}.{model._meta.model_name}")
-        model_names.sort()
-        self.schema["properties"]["entries"]["items"]["properties"]["model"]["enum"] = model_names
+            sub_schema = self.field_to_jsonschema(field)
+            if field.required:
+                required.append(name)
+            properties[name] = sub_schema
+
+        result = {"type": "object", "properties": properties}
+        if required:
+            result["required"] = required
+        return result

authentik/blueprints/management/commands/schema_template.json

@@ -1,105 +0,0 @@
-{
-    "$schema": "http://json-schema.org/draft-07/schema",
-    "$id": "http://example.com/example.json",
-    "type": "object",
-    "title": "authentik Blueprint schema",
-    "default": {},
-    "required": [
-        "version",
-        "entries"
-    ],
-    "properties": {
-        "version": {
-            "$id": "#/properties/version",
-            "type": "integer",
-            "title": "Blueprint version",
-            "default": 1
-        },
-        "metadata": {
-            "$id": "#/properties/metadata",
-            "type": "object",
-            "required": [
-                "name"
-            ],
-            "properties": {
-                "name": {
-                    "type": "string"
-                },
-                "labels": {
-                    "type": "object"
-                }
-            }
-        },
-        "context": {
-            "$id": "#/properties/context",
-            "type": "object",
-            "additionalProperties": true
-        },
-        "entries": {
-            "type": "array",
-            "items": {
-                "$id": "#entry",
-                "type": "object",
-                "required": [
-                    "model"
-                ],
-                "properties": {
-                    "model": {
-                        "type": "string",
-                        "enum": [
-                            "placeholder"
-                        ]
-                    },
-                    "id": {
-                        "type": "string"
-                    },
-                    "state": {
-                        "type": "string",
-                        "enum": [
-                            "absent",
-                            "present",
-                            "created"
-                        ],
-                        "default": "present"
-                    },
-                    "conditions": {
-                        "type": "array",
-                        "items": {
-                            "type": "boolean"
-                        }
-                    },
-                    "attrs": {
-                        "type": "object",
-                        "properties": {
-                            "name": {
-                                "type": "string",
-                                "description": "Commonly available field, may not exist on all models"
-                            }
-                        },
-                        "default": {},
-                        "additionalProperties": true
-                    },
-                    "identifiers": {
-                        "type": "object",
-                        "default": {},
-                        "properties": {
-                            "pk": {
-                                "description": "Commonly available field, may not exist on all models",
-                                "anyOf": [
-                                    {
-                                        "type": "number"
-                                    },
-                                    {
-                                        "type": "string",
-                                        "format": "uuid"
-                                    }
-                                ]
-                            }
-                        },
-                        "additionalProperties": true
-                    }
-                }
-            }
-        }
-    }
-}

authentik/blueprints/migrations/0001_initial.py

@@ -45,7 +45,7 @@ def check_blueprint_v1_file(BlueprintInstance: type, path: Path):
             enabled=True,
             managed_models=[],
             last_applied_hash="",
-            metadata=metadata,
+            metadata=metadata or {},
         )
         instance.save()
 

authentik/blueprints/migrations/0003_alter_blueprintinstance_name.py

@@ -17,4 +17,15 @@ class Migration(migrations.Migration):
             name="name",
             field=models.TextField(unique=True),
         ),
+        migrations.AlterField(
+            model_name="blueprintinstance",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                unique=True,
+                verbose_name="Managed by authentik",
+            ),
+        ),
     ]

authentik/blueprints/models.py

@@ -17,20 +17,20 @@ LOGGER = get_logger()
 
 
 class BlueprintRetrievalFailed(SentryIgnoredException):
-    """Error raised when we're unable to fetch the blueprint contents, whether it be HTTP files
+    """Error raised when we are unable to fetch the blueprint contents, whether it be HTTP files
     not being accessible or local files not being readable"""
 
 
 class ManagedModel(models.Model):
-    """Model which can be managed by authentik exclusively"""
+    """Model that can be managed by authentik exclusively"""
 
     managed = models.TextField(
         default=None,
         null=True,
         verbose_name=_("Managed by authentik"),
         help_text=_(
-            "Objects which are managed by authentik. These objects are created and updated "
-            "automatically. This is flag only indicates that an object can be overwritten by "
+            "Objects that are managed by authentik. These objects are created and updated "
+            "automatically. This flag only indicates that an object can be overwritten by "
             "migrations. You can still modify the objects via the API, but expect changes "
             "to be overwritten in a later update."
         ),

authentik/blueprints/tests/fixtures/conditional_fields.yaml

@@ -0,0 +1,47 @@
+version: 1
+metadata:
+  name: test conditional fields
+  labels:
+    blueprints.goauthentik.io/description: |
+      Some models have conditional fields that are only allowed in blueprint contexts
+      - Token (key)
+      - Application (icon)
+      - Source (icon)
+      - Flow (background)
+entries:
+  - model: authentik_core.token
+    identifiers:
+      identifier: "%(uid)s-token"
+    attrs:
+      key: "%(uid)s"
+      user: "%(user)s"
+      intent: api
+  - model: authentik_core.application
+    identifiers:
+      slug: "%(uid)s-app"
+    attrs:
+      name: "%(uid)s-app"
+      icon: https://goauthentik.io/img/icon.png
+  - model: authentik_sources_oauth.oauthsource
+    identifiers:
+      slug: "%(uid)s-source"
+    attrs:
+      name: "%(uid)s-source"
+      provider_type: azuread
+      consumer_key: "%(uid)s"
+      consumer_secret: "%(uid)s"
+      icon: https://goauthentik.io/img/icon.png
+  - model: authentik_flows.flow
+    identifiers:
+      slug: "%(uid)s-flow"
+    attrs:
+      name: "%(uid)s-flow"
+      title: "%(uid)s-flow"
+      designation: authentication
+      background: https://goauthentik.io/img/icon.png
+  - model: authentik_core.user
+    identifiers:
+      username: "%(uid)s"
+    attrs:
+      name: "%(uid)s"
+      password: "%(uid)s"

authentik/blueprints/tests/test_oci.py

@@ -32,6 +32,29 @@ class TestBlueprintOCI(TransactionTestCase):
                 "foo",
             )
 
+    def test_successful_port(self):
+        """Successful retrieval with custom port"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io:1234/v2/goauthentik/blueprints/test/manifests/latest",
+                json={
+                    "layers": [
+                        {
+                            "mediaType": OCI_MEDIA_TYPE,
+                            "digest": "foo",
+                        }
+                    ]
+                },
+            )
+            mocker.get("https://ghcr.io:1234/v2/goauthentik/blueprints/test/blobs/foo", text="foo")
+
+            self.assertEqual(
+                BlueprintInstance(
+                    path="oci://ghcr.io:1234/goauthentik/blueprints/test:latest"
+                ).retrieve(),
+                "foo",
+            )
+
     def test_manifests_error(self):
         """Test manifests request erroring"""
         with Mocker() as mocker:

authentik/blueprints/tests/test_v1_conditional_fields.py

@@ -0,0 +1,53 @@
+"""Test blueprints v1"""
+from django.test import TransactionTestCase
+
+from authentik.blueprints.v1.importer import Importer
+from authentik.core.models import Application, Token, User
+from authentik.core.tests.utils import create_test_admin_user
+from authentik.flows.models import Flow
+from authentik.lib.generators import generate_id
+from authentik.lib.tests.utils import load_fixture
+from authentik.sources.oauth.models import OAuthSource
+
+
+class TestBlueprintsV1ConditionalFields(TransactionTestCase):
+    """Test Blueprints conditional fields"""
+
+    def setUp(self) -> None:
+        user = create_test_admin_user()
+        self.uid = generate_id()
+        import_yaml = load_fixture("fixtures/conditional_fields.yaml", uid=self.uid, user=user.pk)
+
+        importer = Importer(import_yaml)
+        self.assertTrue(importer.validate()[0])
+        self.assertTrue(importer.apply())
+
+    def test_token(self):
+        """Test token"""
+        token = Token.objects.filter(identifier=f"{self.uid}-token").first()
+        self.assertIsNotNone(token)
+        self.assertEqual(token.key, self.uid)
+
+    def test_application(self):
+        """Test application"""
+        app = Application.objects.filter(slug=f"{self.uid}-app").first()
+        self.assertIsNotNone(app)
+        self.assertEqual(app.meta_icon, "https://goauthentik.io/img/icon.png")
+
+    def test_source(self):
+        """Test source"""
+        source = OAuthSource.objects.filter(slug=f"{self.uid}-source").first()
+        self.assertIsNotNone(source)
+        self.assertEqual(source.icon, "https://goauthentik.io/img/icon.png")
+
+    def test_flow(self):
+        """Test flow"""
+        flow = Flow.objects.filter(slug=f"{self.uid}-flow").first()
+        self.assertIsNotNone(flow)
+        self.assertEqual(flow.background, "https://goauthentik.io/img/icon.png")
+
+    def test_user(self):
+        """Test user"""
+        user: User = User.objects.filter(username=self.uid).first()
+        self.assertIsNotNone(user)
+        self.assertTrue(user.check_password(self.uid))

authentik/blueprints/urls.py

@@ -0,0 +1,6 @@
+"""API URLs"""
+from authentik.blueprints.api import BlueprintInstanceViewSet
+
+api_urlpatterns = [
+    ("managed/blueprints", BlueprintInstanceViewSet),
+]

authentik/blueprints/v1/oci.py

@@ -39,11 +39,16 @@ class BlueprintOCIClient:
         self.logger = get_logger().bind(url=self.sanitized_url)
 
         self.ref = "latest"
+        # Remove the leading slash of the path to convert it to an image name
         path = self.url.path[1:]
-        if ":" in self.url.path:
+        if ":" in path:
+            # if there's a colon in the path, use everything after it as a ref
             path, _, self.ref = path.partition(":")
+        base_url = f"https://{self.url.hostname}"
+        if self.url.port:
+            base_url += f":{self.url.port}"
         self.client = NewClient(
-            f"https://{self.url.hostname}",
+            base_url,
             WithUserAgent(authentik_user_agent()),
             WithUsernamePassword(self.url.username, self.url.password),
             WithDefaultName(path),

authentik/blueprints/v1/tasks.py

@@ -184,9 +184,9 @@ def apply_blueprint(self: MonitoredTask, instance_pk: str):
     instance: Optional[BlueprintInstance] = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
-        self.set_uid(slugify(instance.name))
         if not instance or not instance.enabled:
             return
+        self.set_uid(slugify(instance.name))
         blueprint_content = instance.retrieve()
         file_hash = sha512(blueprint_content.encode()).hexdigest()
         importer = Importer(blueprint_content, instance.context)

authentik/core/api/applications.py

@@ -11,7 +11,7 @@ from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.fields import ReadOnlyField, SerializerMethodField
+from rest_framework.fields import CharField, ReadOnlyField, SerializerMethodField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -23,6 +23,7 @@ from structlog.testing import capture_logs
 
 from authentik.admin.api.metrics import CoordinateSerializer
 from authentik.api.decorators import permission_required
+from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.models import Application, User
@@ -51,6 +52,9 @@ class ApplicationSerializer(ModelSerializer):
 
     launch_url = SerializerMethodField()
     provider_obj = ProviderSerializer(source="get_provider", required=False, read_only=True)
+    backchannel_providers_obj = ProviderSerializer(
+        source="backchannel_providers", required=False, read_only=True, many=True
+    )
 
     meta_icon = ReadOnlyField(source="get_meta_icon")
 
@@ -61,6 +65,11 @@ class ApplicationSerializer(ModelSerializer):
             user = self.context["request"].user
         return app.get_launch_url(user)
 
+    def __init__(self, *args, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
+            self.fields["icon"] = CharField(source="meta_icon", required=False)
+
     class Meta:
         model = Application
         fields = [
@@ -69,6 +78,8 @@ class ApplicationSerializer(ModelSerializer):
             "slug",
             "provider",
             "provider_obj",
+            "backchannel_providers",
+            "backchannel_providers_obj",
             "launch_url",
             "open_in_new_tab",
             "meta_launch_url",
@@ -80,6 +91,7 @@ class ApplicationSerializer(ModelSerializer):
         ]
         extra_kwargs = {
             "meta_icon": {"read_only": True},
+            "backchannel_providers": {"required": False},
         }
 
 

authentik/core/api/providers.py

@@ -1,5 +1,7 @@
 """Provider API Views"""
 from django.utils.translation import gettext_lazy as _
+from django_filters.filters import BooleanFilter
+from django_filters.filterset import FilterSet
 from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
@@ -20,6 +22,8 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
 
     assigned_application_slug = ReadOnlyField(source="application.slug")
     assigned_application_name = ReadOnlyField(source="application.name")
+    assigned_backchannel_application_slug = ReadOnlyField(source="backchannel_application.slug")
+    assigned_backchannel_application_name = ReadOnlyField(source="backchannel_application.name")
 
     component = SerializerMethodField()
 
@@ -40,6 +44,8 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
             "component",
             "assigned_application_slug",
             "assigned_application_name",
+            "assigned_backchannel_application_slug",
+            "assigned_backchannel_application_name",
             "verbose_name",
             "verbose_name_plural",
             "meta_model_name",
@@ -49,6 +55,22 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
         }
 
 
+class ProviderFilter(FilterSet):
+    """Filter for groups"""
+
+    application__isnull = BooleanFilter(
+        field_name="application",
+        lookup_expr="isnull",
+    )
+    backchannel_only = BooleanFilter(
+        method="filter_backchannel_only",
+    )
+
+    def filter_backchannel_only(self, queryset, name, value):
+        """Only return backchannel providers"""
+        return queryset.filter(is_backchannel=value)
+
+
 class ProviderViewSet(
     mixins.RetrieveModelMixin,
     mixins.DestroyModelMixin,
@@ -60,9 +82,7 @@ class ProviderViewSet(
 
     queryset = Provider.objects.none()
     serializer_class = ProviderSerializer
-    filterset_fields = {
-        "application": ["isnull"],
-    }
+    filterset_class = ProviderFilter
     search_fields = [
         "name",
         "application__name",
@@ -78,6 +98,8 @@ class ProviderViewSet(
         data = []
         for subclass in all_subclasses(self.queryset.model):
             subclass: Provider
+            if subclass._meta.abstract:
+                continue
             data.append(
                 {
                     "name": subclass._meta.verbose_name,

authentik/core/api/sources.py

@@ -5,16 +5,18 @@ from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
+from rest_framework.fields import CharField, ReadOnlyField, SerializerMethodField
 from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer, ReadOnlyField, SerializerMethodField
+from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
 from authentik.api.authorization import OwnerFilter, OwnerSuperuserPermissions
 from authentik.api.decorators import permission_required
+from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Source, UserSourceConnection
@@ -44,6 +46,11 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
             return ""
         return obj.component
 
+    def __init__(self, *args, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
+            self.fields["icon"] = CharField(required=False)
+
     class Meta:
         model = Source
         fields = [

authentik/core/api/tokens.py

@@ -33,7 +33,7 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
-            self.fields["key"] = CharField()
+            self.fields["key"] = CharField(required=False)
 
     def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
         """Ensure only API or App password tokens are created."""

authentik/core/api/users.py

@@ -51,6 +51,7 @@ from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import CoordinateSerializer
 from authentik.api.decorators import permission_required
+from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
 from authentik.core.middleware import (
@@ -106,12 +107,36 @@ class UserSerializer(ModelSerializer):
     avatar = CharField(read_only=True)
     attributes = JSONField(validators=[is_dict], required=False)
     groups = PrimaryKeyRelatedField(
-        allow_empty=True, many=True, source="ak_groups", queryset=Group.objects.all()
+        allow_empty=True, many=True, source="ak_groups", queryset=Group.objects.all(), default=list
     )
     groups_obj = ListSerializer(child=UserGroupSerializer(), read_only=True, source="ak_groups")
     uid = CharField(read_only=True)
     username = CharField(max_length=150, validators=[UniqueValidator(queryset=User.objects.all())])
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
+            self.fields["password"] = CharField(required=False)
+
+    def create(self, validated_data: dict) -> User:
+        """If this serializer is used in the blueprint context, we allow for
+        directly setting a password. However should be done via the `set_password`
+        method instead of directly setting it like rest_framework."""
+        instance: User = super().create(validated_data)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
+            instance.set_password(validated_data["password"])
+            instance.save()
+        return instance
+
+    def update(self, instance: User, validated_data: dict) -> User:
+        """Same as `create` above, set the password directly if we're in a blueprint
+        context"""
+        instance = super().update(instance, validated_data)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
+            instance.set_password(validated_data["password"])
+            instance.save()
+        return instance
+
     def validate_path(self, path: str) -> str:
         """Validate path"""
         if path[:1] == "/" or path[-1] == "/":

authentik/core/apps.py

@@ -11,7 +11,6 @@ class AuthentikCoreConfig(ManagedAppConfig):
     label = "authentik_core"
     verbose_name = "authentik Core"
     mountpoint = ""
-    ws_mountpoint = "authentik.core.urls"
     default = True
 
     def reconcile_load_core_signals(self):

authentik/core/migrations/0029_provider_backchannel_applications_and_more.py

@@ -0,0 +1,82 @@
+# Generated by Django 4.1.7 on 2023-04-30 17:56
+
+import django.db.models.deletion
+from django.apps.registry import Apps
+from django.db import DatabaseError, InternalError, ProgrammingError, migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def backport_is_backchannel(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    from authentik.core.models import BackchannelProvider
+
+    for model in BackchannelProvider.__subclasses__():
+        try:
+            for obj in model.objects.all():
+                obj.is_backchannel = True
+                obj.save()
+        except (DatabaseError, InternalError, ProgrammingError):
+            # The model might not have been migrated yet/doesn't exist yet
+            # so we don't need to worry about backporting the data
+            pass
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_core", "0028_provider_authentication_flow"),
+        ("authentik_providers_ldap", "0002_ldapprovider_bind_mode"),
+        ("authentik_providers_scim", "0006_rename_parent_group_scimprovider_filter_group"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="provider",
+            name="backchannel_application",
+            field=models.ForeignKey(
+                default=None,
+                help_text="Accessed from applications; optional backchannel providers for protocols like LDAP and SCIM.",
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="backchannel_providers",
+                to="authentik_core.application",
+            ),
+        ),
+        migrations.AddField(
+            model_name="provider",
+            name="is_backchannel",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.RunPython(backport_is_backchannel),
+        migrations.AlterField(
+            model_name="propertymapping",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                unique=True,
+                verbose_name="Managed by authentik",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="source",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                unique=True,
+                verbose_name="Managed by authentik",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="token",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                unique=True,
+                verbose_name="Managed by authentik",
+            ),
+        ),
+    ]

authentik/core/models.py

@@ -5,7 +5,6 @@ from typing import Any, Optional
 from uuid import uuid4
 
 from deepmerge import always_merger
-from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.models import AbstractUser
 from django.contrib.auth.models import UserManager as DjangoUserManager
@@ -33,6 +32,7 @@ from authentik.lib.models import (
 )
 from authentik.lib.utils.http import get_client_ip
 from authentik.policies.models import PolicyBindingModel
+from authentik.root.install_id import get_install_id
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
@@ -217,7 +217,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def uid(self) -> str:
         """Generate a globally unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{settings.SECRET_KEY}".encode("ascii")).hexdigest()
+        return sha256(f"{self.id}-{get_install_id()}".encode("ascii")).hexdigest()
 
     def locale(self, request: Optional[HttpRequest] = None) -> str:
         """Get the locale the user has configured"""
@@ -270,6 +270,20 @@ class Provider(SerializerModel):
 
     property_mappings = models.ManyToManyField("PropertyMapping", default=None, blank=True)
 
+    backchannel_application = models.ForeignKey(
+        "Application",
+        default=None,
+        null=True,
+        on_delete=models.CASCADE,
+        help_text=_(
+            "Accessed from applications; optional backchannel providers for protocols "
+            "like LDAP and SCIM."
+        ),
+        related_name="backchannel_providers",
+    )
+
+    is_backchannel = models.BooleanField(default=False)
+
     objects = InheritanceManager()
 
     @property
@@ -292,6 +306,26 @@ class Provider(SerializerModel):
         return str(self.name)
 
 
+class BackchannelProvider(Provider):
+    """Base class for providers that augment other providers, for example LDAP and SCIM.
+    Multiple of these providers can be configured per application, they may not use the application
+    slug in URLs as an application may have multiple instances of the same
+    type of Backchannel provider
+
+    They can use the application's policies and metadata"""
+
+    @property
+    def component(self) -> str:
+        raise NotImplementedError
+
+    @property
+    def serializer(self) -> type[Serializer]:
+        raise NotImplementedError
+
+    class Meta:
+        abstract = True
+
+
 class Application(SerializerModel, PolicyBindingModel):
     """Every Application which uses authentik for authentication/identification/authorization
     needs an Application record. Other authentication types can subclass this Model to

authentik/core/signals.py

@@ -6,11 +6,11 @@ from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
 from django.core.signals import Signal
 from django.db.models import Model
-from django.db.models.signals import post_save, pre_delete
+from django.db.models.signals import post_save, pre_delete, pre_save
 from django.dispatch import receiver
 from django.http.request import HttpRequest
 
-from authentik.core.models import Application, AuthenticatedSession
+from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider
 
 # Arguments: user: User, password: str
 password_changed = Signal()
@@ -54,3 +54,11 @@ def authenticated_session_delete(sender: type[Model], instance: "AuthenticatedSe
     """Delete session when authenticated session is deleted"""
     cache_key = f"{KEY_PREFIX}{instance.session_key}"
     cache.delete(cache_key)
+
+
+@receiver(pre_save)
+def backchannel_provider_pre_save(sender: type[Model], instance: Model, **_):
+    """Ensure backchannel providers have is_backchannel set to true"""
+    if not isinstance(instance, BackchannelProvider):
+        return
+    instance.is_backchannel = True

authentik/core/sources/flow_manager.py

@@ -28,7 +28,7 @@ from authentik.flows.views.executor import NEXT_ARG_NAME, SESSION_KEY_GET, SESSI
 from authentik.lib.utils.urls import redirect_with_qs
 from authentik.lib.views import bad_request_message
 from authentik.policies.denied import AccessDeniedResponse
-from authentik.policies.utils import delete_none_keys
+from authentik.policies.utils import delete_none_values
 from authentik.stages.password import BACKEND_INBUILT
 from authentik.stages.password.stage import PLAN_CONTEXT_AUTHENTICATION_BACKEND
 from authentik.stages.prompt.stage import PLAN_CONTEXT_PROMPT
@@ -329,7 +329,7 @@ class SourceFlowManager:
                 )
             ],
             **{
-                PLAN_CONTEXT_PROMPT: delete_none_keys(self.enroll_info),
+                PLAN_CONTEXT_PROMPT: delete_none_values(self.enroll_info),
                 PLAN_CONTEXT_USER_PATH: self.source.get_user_path(),
             },
         )

authentik/core/templates/if/user.html

@@ -4,8 +4,8 @@
 
 {% block head %}
 <script src="{% static 'dist/user/UserInterface.js' %}?version={{ version }}" type="module"></script>
-<meta name="theme-color" content="#151515" media="(prefers-color-scheme: light)">
-<meta name="theme-color" content="#151515" media="(prefers-color-scheme: dark)">
+<meta name="theme-color" content="#1c1e21" media="(prefers-color-scheme: light)">
+<meta name="theme-color" content="#1c1e21" media="(prefers-color-scheme: dark)">
 <link rel="icon" href="{{ tenant.branding_favicon }}">
 <link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% include "base/header_js.html" %}

authentik/core/tests/test_applications_api.py

@@ -139,6 +139,8 @@ class TestApplicationsAPI(APITestCase):
                             "verbose_name": "OAuth2/OpenID Provider",
                             "verbose_name_plural": "OAuth2/OpenID Providers",
                         },
+                        "backchannel_providers": [],
+                        "backchannel_providers_obj": [],
                         "launch_url": f"https://goauthentik.io/{self.user.username}",
                         "meta_launch_url": "https://goauthentik.io/%(username)s",
                         "open_in_new_tab": True,
@@ -189,6 +191,8 @@ class TestApplicationsAPI(APITestCase):
                             "verbose_name": "OAuth2/OpenID Provider",
                             "verbose_name_plural": "OAuth2/OpenID Providers",
                         },
+                        "backchannel_providers": [],
+                        "backchannel_providers_obj": [],
                         "launch_url": f"https://goauthentik.io/{self.user.username}",
                         "meta_launch_url": "https://goauthentik.io/%(username)s",
                         "open_in_new_tab": True,
@@ -210,6 +214,8 @@ class TestApplicationsAPI(APITestCase):
                         "policy_engine_mode": "any",
                         "provider": None,
                         "provider_obj": None,
+                        "backchannel_providers": [],
+                        "backchannel_providers_obj": [],
                         "slug": "denied",
                     },
                 ],

authentik/core/tests/test_models.py

@@ -53,9 +53,8 @@ def provider_tester_factory(test_model: type[Stage]) -> Callable:
     def tester(self: TestModels):
         model_class = None
         if test_model._meta.abstract:  # pragma: no cover
-            model_class = test_model.__bases__[0]()
-        else:
-            model_class = test_model()
+            return
+        model_class = test_model()
         self.assertIsNotNone(model_class.component)
 
     return tester

authentik/core/tests/test_token_api.py

@@ -77,6 +77,7 @@ class TestTokenAPI(APITestCase):
 
     def test_list(self):
         """Test Token List (Test normal authentication)"""
+        Token.objects.all().delete()
         token_should: Token = Token.objects.create(
             identifier="test", expiring=False, user=self.user
         )
@@ -88,6 +89,7 @@ class TestTokenAPI(APITestCase):
 
     def test_list_admin(self):
         """Test Token List (Test with admin auth)"""
+        Token.objects.all().delete()
         self.client.force_login(self.admin)
         token_should: Token = Token.objects.create(
             identifier="test", expiring=False, user=self.user

authentik/core/urls.py

@@ -7,6 +7,15 @@ from django.urls import path
 from django.views.decorators.csrf import ensure_csrf_cookie
 from django.views.generic import RedirectView
 
+from authentik.core.api.applications import ApplicationViewSet
+from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
+from authentik.core.api.devices import AdminDeviceViewSet, DeviceViewSet
+from authentik.core.api.groups import GroupViewSet
+from authentik.core.api.propertymappings import PropertyMappingViewSet
+from authentik.core.api.providers import ProviderViewSet
+from authentik.core.api.sources import SourceViewSet, UserSourceConnectionViewSet
+from authentik.core.api.tokens import TokenViewSet
+from authentik.core.api.users import UserViewSet
 from authentik.core.views import apps, impersonate
 from authentik.core.views.debug import AccessDeniedView
 from authentik.core.views.interface import FlowInterfaceView, InterfaceView
@@ -69,6 +78,24 @@ urlpatterns = [
     ),
 ]
 
+api_urlpatterns = [
+    ("core/authenticated_sessions", AuthenticatedSessionViewSet),
+    ("core/applications", ApplicationViewSet),
+    ("core/groups", GroupViewSet),
+    ("core/users", UserViewSet),
+    ("core/tokens", TokenViewSet),
+    ("sources/all", SourceViewSet),
+    ("sources/user_connections/all", UserSourceConnectionViewSet),
+    ("providers/all", ProviderViewSet),
+    ("propertymappings/all", PropertyMappingViewSet),
+    ("authenticators/all", DeviceViewSet, "device"),
+    (
+        "authenticators/admin/all",
+        AdminDeviceViewSet,
+        "admin-device",
+    ),
+]
+
 websocket_urlpatterns = [
     path(
         "ws/client/",

authentik/crypto/api.py

@@ -160,6 +160,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
             "managed",
         ]
         extra_kwargs = {
+            "managed": {"read_only": True},
             "key_data": {"write_only": True},
             "certificate_data": {"write_only": True},
         }

authentik/crypto/migrations/0004_alter_certificatekeypair_name.py

@@ -17,4 +17,15 @@ class Migration(migrations.Migration):
             name="name",
             field=models.TextField(unique=True),
         ),
+        migrations.AlterField(
+            model_name="certificatekeypair",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                unique=True,
+                verbose_name="Managed by authentik",
+            ),
+        ),
     ]

authentik/crypto/urls.py

@@ -0,0 +1,6 @@
+"""API URLs"""
+from authentik.crypto.api import CertificateKeyPairViewSet
+
+api_urlpatterns = [
+    ("crypto/certificatekeypairs", CertificateKeyPairViewSet),
+]

authentik/events/models.py

@@ -7,7 +7,6 @@ from smtplib import SMTPException
 from typing import TYPE_CHECKING, Optional
 from uuid import uuid4
 
-from django.conf import settings
 from django.db import models
 from django.db.models import Count, ExpressionWrapper, F
 from django.db.models.fields import DurationField
@@ -207,9 +206,7 @@ class Event(SerializerModel, ExpiringModel):
         self.user = get_user(user)
         return self
 
-    def from_http(
-        self, request: HttpRequest, user: Optional[settings.AUTH_USER_MODEL] = None
-    ) -> "Event":
+    def from_http(self, request: HttpRequest, user: Optional[User] = None) -> "Event":
         """Add data from a Django-HttpRequest, allowing the creation of
         Events independently from requests.
         `user` arguments optionally overrides user from requests."""
@@ -219,13 +216,13 @@ class Event(SerializerModel, ExpiringModel):
             self.context["http_request"] = {
                 "path": request.path,
                 "method": request.method,
-                "args": QueryDict(request.META.get("QUERY_STRING", "")),
+                "args": cleanse_dict(QueryDict(request.META.get("QUERY_STRING", ""))),
             }
             # Special case for events created during flow execution
             # since they keep the http query within a wrapped query
             if QS_QUERY in self.context["http_request"]["args"]:
                 wrapped = self.context["http_request"]["args"][QS_QUERY]
-                self.context["http_request"]["args"] = QueryDict(wrapped)
+                self.context["http_request"]["args"] = cleanse_dict(QueryDict(wrapped))
         if hasattr(request, "tenant"):
             tenant: Tenant = request.tenant
             # Because self.created only gets set on save, we can't use it's value here
@@ -353,6 +350,9 @@ class NotificationTransport(SerializerModel):
             "user_email": notification.user.email,
             "user_username": notification.user.username,
         }
+        if notification.event and notification.event.user:
+            default_body["event_user_email"] = notification.event.user.get("email", None)
+            default_body["event_user_username"] = notification.event.user.get("username", None)
         if self.webhook_mapping:
             default_body = sanitize_item(
                 self.webhook_mapping.evaluate(
@@ -391,6 +391,14 @@ class NotificationTransport(SerializerModel):
             },
         ]
         if notification.event:
+            if notification.event.user:
+                fields.append(
+                    {
+                        "title": _("Event user"),
+                        "value": str(notification.event.user.get("username")),
+                        "short": True,
+                    },
+                )
             for key, value in notification.event.context.items():
                 if not isinstance(value, str):
                     continue
@@ -429,7 +437,13 @@ class NotificationTransport(SerializerModel):
     def send_email(self, notification: "Notification") -> list[str]:
         """Send notification via global email configuration"""
         subject = "authentik Notification: "
-        key_value = {}
+        key_value = {
+            "user_email": notification.user.email,
+            "user_username": notification.user.username,
+        }
+        if notification.event and notification.event.user:
+            key_value["event_user_email"] = notification.event.user.get("email", None)
+            key_value["event_user_username"] = notification.event.user.get("username", None)
         if notification.event:
             subject += notification.event.action
             for key, value in notification.event.context.items():

authentik/events/monitored_tasks.py

@@ -87,9 +87,9 @@ class TaskInfo:
         except TypeError:
             duration = 0
         GAUGE_TASKS.labels(
-            task_name=self.task_name,
+            task_name=self.task_name.split(":")[0],
             task_uid=self.result.uid or "",
-            status=self.result.status,
+            status=self.result.status.value,
         ).set(duration)
 
     def save(self, timeout_hours=6):

authentik/events/tests/test_event.py

@@ -1,17 +1,25 @@
 """event tests"""
+from urllib.parse import urlencode
 
 from django.contrib.contenttypes.models import ContentType
-from django.test import TestCase
+from django.test import RequestFactory, TestCase
+from django.views.debug import SafeExceptionReporterFilter
 from guardian.shortcuts import get_anonymous_user
 
 from authentik.core.models import Group
 from authentik.events.models import Event
+from authentik.flows.views.executor import QS_QUERY
+from authentik.lib.generators import generate_id
 from authentik.policies.dummy.models import DummyPolicy
+from authentik.tenants.models import Tenant
 
 
 class TestEvents(TestCase):
     """Test Event"""
 
+    def setUp(self) -> None:
+        self.factory = RequestFactory()
+
     def test_new_with_model(self):
         """Create a new Event passing a model as kwarg"""
         test_model = Group.objects.create(name="test")
@@ -40,3 +48,58 @@ class TestEvents(TestCase):
         model_content_type = ContentType.objects.get_for_model(temp_model)
         self.assertEqual(event.context.get("model").get("app"), model_content_type.app_label)
         self.assertEqual(event.context.get("model").get("pk"), temp_model.pk.hex)
+
+    def test_from_http_basic(self):
+        """Test plain from_http"""
+        event = Event.new("unittest").from_http(self.factory.get("/"))
+        self.assertEqual(
+            event.context, {"http_request": {"args": {}, "method": "GET", "path": "/"}}
+        )
+
+    def test_from_http_clean_querystring(self):
+        """Test cleansing query string"""
+        request = self.factory.get(f"/?token={generate_id()}")
+        event = Event.new("unittest").from_http(request)
+        self.assertEqual(
+            event.context,
+            {
+                "http_request": {
+                    "args": {"token": SafeExceptionReporterFilter.cleansed_substitute},
+                    "method": "GET",
+                    "path": "/",
+                }
+            },
+        )
+
+    def test_from_http_clean_querystring_flow(self):
+        """Test cleansing query string (nested query string like flow executor)"""
+        nested_qs = {"token": generate_id()}
+        request = self.factory.get(f"/?{QS_QUERY}={urlencode(nested_qs)}")
+        event = Event.new("unittest").from_http(request)
+        self.assertEqual(
+            event.context,
+            {
+                "http_request": {
+                    "args": {"token": SafeExceptionReporterFilter.cleansed_substitute},
+                    "method": "GET",
+                    "path": "/",
+                }
+            },
+        )
+
+    def test_from_http_tenant(self):
+        """Test from_http tenant"""
+        # Test tenant
+        request = self.factory.get("/")
+        tenant = Tenant(domain="test-tenant")
+        setattr(request, "tenant", tenant)
+        event = Event.new("unittest").from_http(request)
+        self.assertEqual(
+            event.tenant,
+            {
+                "app": "authentik_tenants",
+                "model_name": "tenant",
+                "name": "Tenant test-tenant",
+                "pk": tenant.pk.hex,
+            },
+        )

authentik/events/tests/test_transports.py

@@ -52,6 +52,8 @@ class TestEventTransports(TestCase):
                     "severity": "alert",
                     "user_email": self.user.email,
                     "user_username": self.user.username,
+                    "event_user_email": self.user.email,
+                    "event_user_username": self.user.username,
                 },
             )
 
@@ -107,6 +109,7 @@ class TestEventTransports(TestCase):
                                     "value": self.user.username,
                                     "short": True,
                                 },
+                                {"short": True, "title": "Event user", "value": self.user.username},
                                 {"title": "foo", "value": "bar,"},
                             ],
                             "footer": f"authentik {get_full_version()}",

authentik/events/urls.py

@@ -0,0 +1,14 @@
+"""API URLs"""
+from authentik.events.api.events import EventViewSet
+from authentik.events.api.notification_mappings import NotificationWebhookMappingViewSet
+from authentik.events.api.notification_rules import NotificationRuleViewSet
+from authentik.events.api.notification_transports import NotificationTransportViewSet
+from authentik.events.api.notifications import NotificationViewSet
+
+api_urlpatterns = [
+    ("events/events", EventViewSet),
+    ("events/notifications", NotificationViewSet),
+    ("events/transports", NotificationTransportViewSet),
+    ("events/rules", NotificationRuleViewSet),
+    ("propertymappings/notification", NotificationWebhookMappingViewSet),
+]

authentik/events/utils.py

@@ -2,6 +2,7 @@
 import re
 from copy import copy
 from dataclasses import asdict, is_dataclass
+from enum import Enum
 from pathlib import Path
 from types import GeneratorType
 from typing import Any, Optional
@@ -126,6 +127,8 @@ def sanitize_item(value: Any) -> Any:
         return str(value)
     if isinstance(value, YAMLTag):
         return str(value)
+    if isinstance(value, Enum):
+        return value.value
     if isinstance(value, type):
         return {
             "type": value.__name__,

authentik/flows/api/flows.py

@@ -6,7 +6,7 @@ from django.utils.translation import gettext as _
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
-from rest_framework.fields import BooleanField, DictField, ListField, ReadOnlyField
+from rest_framework.fields import BooleanField, CharField, DictField, ListField, ReadOnlyField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -16,7 +16,7 @@ from structlog.stdlib import get_logger
 
 from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.exporter import FlowExporter
-from authentik.blueprints.v1.importer import Importer
+from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT, Importer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import CacheSerializer, LinkSerializer, PassiveSerializer
 from authentik.events.utils import sanitize_dict
@@ -52,6 +52,11 @@ class FlowSerializer(ModelSerializer):
         """Get export URL for flow"""
         return reverse("authentik_api:flow-export", kwargs={"slug": flow.slug})
 
+    def __init__(self, *args, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
+            self.fields["background"] = CharField(required=False)
+
     class Meta:
         model = Flow
         fields = [

authentik/flows/urls.py

@@ -1,8 +1,17 @@
 """flow urls"""
 from django.urls import path
 
+from authentik.flows.api.bindings import FlowStageBindingViewSet
+from authentik.flows.api.flows import FlowViewSet
+from authentik.flows.api.stages import StageViewSet
 from authentik.flows.models import FlowDesignation
-from authentik.flows.views.executor import CancelView, ConfigureFlowInitView, ToDefaultFlow
+from authentik.flows.views.executor import (
+    CancelView,
+    ConfigureFlowInitView,
+    FlowExecutorView,
+    ToDefaultFlow,
+)
+from authentik.flows.views.inspector import FlowInspectorView
 
 urlpatterns = [
     path(
@@ -22,3 +31,19 @@ urlpatterns = [
         name="configure",
     ),
 ]
+
+api_urlpatterns = [
+    ("flows/instances", FlowViewSet),
+    ("flows/bindings", FlowStageBindingViewSet),
+    ("stages/all", StageViewSet),
+    path(
+        "flows/executor/<slug:flow_slug>/",
+        FlowExecutorView.as_view(),
+        name="flow-executor",
+    ),
+    path(
+        "flows/inspector/<slug:flow_slug>/",
+        FlowInspectorView.as_view(),
+        name="flow-inspector",
+    ),
+]

authentik/flows/views/inspector.py

@@ -23,6 +23,7 @@ from authentik.flows.api.bindings import FlowStageBindingSerializer
 from authentik.flows.models import Flow
 from authentik.flows.planner import FlowPlan
 from authentik.flows.views.executor import SESSION_KEY_HISTORY, SESSION_KEY_PLAN
+from authentik.root.install_id import get_install_id
 
 
 class FlowInspectorPlanSerializer(PassiveSerializer):
@@ -51,7 +52,7 @@ class FlowInspectorPlanSerializer(PassiveSerializer):
         """Get a unique session ID"""
         request: Request = self.context["request"]
         return sha256(
-            f"{request._request.session.session_key}-{settings.SECRET_KEY}".encode("ascii")
+            f"{request._request.session.session_key}-{get_install_id()}".encode("ascii")
         ).hexdigest()
 
 

authentik/lib/config.py

@@ -5,6 +5,7 @@ from contextlib import contextmanager
 from glob import glob
 from json import dumps, loads
 from json.decoder import JSONDecodeError
+from pathlib import Path
 from sys import argv, stderr
 from time import time
 from typing import Any
@@ -42,22 +43,25 @@ class ConfigLoader:
     def __init__(self):
         super().__init__()
         self.__config = {}
-        base_dir = os.path.realpath(os.path.join(os.path.dirname(__file__), "../.."))
-        for path in SEARCH_PATHS:
+        base_dir = Path(__file__).parent.joinpath(Path("../..")).resolve()
+        for _path in SEARCH_PATHS:
+            path = Path(_path)
             # Check if path is relative, and if so join with base_dir
-            if not os.path.isabs(path):
-                path = os.path.join(base_dir, path)
-            if os.path.isfile(path) and os.path.exists(path):
+            if not path.is_absolute():
+                path = base_dir / path
+            if path.is_file() and path.exists():
                 # Path is an existing file, so we just read it and update our config with it
                 self.update_from_file(path)
-            elif os.path.isdir(path) and os.path.exists(path):
+            elif path.is_dir() and path.exists():
                 # Path is an existing dir, so we try to read the env config from it
                 env_paths = [
-                    os.path.join(path, ENVIRONMENT + ".yml"),
-                    os.path.join(path, ENVIRONMENT + ".env.yml"),
+                    path / Path(ENVIRONMENT + ".yml"),
+                    path / Path(ENVIRONMENT + ".env.yml"),
+                    path / Path(ENVIRONMENT + ".yaml"),
+                    path / Path(ENVIRONMENT + ".env.yaml"),
                 ]
                 for env_file in env_paths:
-                    if os.path.isfile(env_file) and os.path.exists(env_file):
+                    if env_file.is_file() and env_file.exists():
                         # Update config with env file
                         self.update_from_file(env_file)
         self.update_from_env()
@@ -99,13 +103,13 @@ class ConfigLoader:
                 value = url.query
         return value
 
-    def update_from_file(self, path: str):
+    def update_from_file(self, path: Path):
         """Update config from file contents"""
         try:
             with open(path, encoding="utf8") as file:
                 try:
                     self.update(self.__config, yaml.safe_load(file))
-                    self.log("debug", "Loaded config", file=path)
+                    self.log("debug", "Loaded config", file=str(path))
                     self.loaded_file.append(path)
                 except yaml.YAMLError as exc:
                     raise ImproperlyConfigured from exc

authentik/lib/default.yml

@@ -31,7 +31,7 @@ log_level: info
 
 error_reporting:
   enabled: false
-  sentry_dsn: https://151ba72610234c4c97c5bcff4e1cffd8@o4504163616882688.ingest.sentry.io/4504163677503489
+  sentry_dsn: https://151ba72610234c4c97c5bcff4e1cffd8@authentik.error-reporting.a7k.io/4504163677503489
   environment: customer
   send_pii: false
   sample_rate: 0.1
@@ -72,13 +72,13 @@ cookie_domain: null
 disable_update_check: false
 disable_startup_analytics: false
 avatars: env://AUTHENTIK_AUTHENTIK__AVATARS?gravatar,initials
-geoip: "/app-root/geoip/GeoLite2-City.mmdb"
+geoip: "/geoip/GeoLite2-City.mmdb"
 
 footer_links: []
 
 default_user_change_name: true
-default_user_change_email: true
-default_user_change_username: true
+default_user_change_email: false
+default_user_change_username: false
 
 gdpr_compliance: true
 cert_discovery_dir: /certs

authentik/lib/expression/evaluator.py

@@ -140,19 +140,21 @@ class BaseEvaluator:
     def expr_event_create(self, action: str, **kwargs):
         """Create event with supplied data and try to extract as much relevant data
         from the context"""
+        context = self._context.copy()
         # If the result was a complex variable, we don't want to re-use it
-        self._context.pop("result", None)
-        self._context.pop("handler", None)
-        kwargs["context"] = self._context
+        context.pop("result", None)
+        context.pop("handler", None)
+        event_kwargs = context
+        event_kwargs.update(kwargs)
         event = Event.new(
             action,
             app=self._filename,
-            **kwargs,
+            **event_kwargs,
         )
-        if "request" in self._context and isinstance(self._context["request"], PolicyRequest):
-            policy_request: PolicyRequest = self._context["request"]
+        if "request" in context and isinstance(context["request"], PolicyRequest):
+            policy_request: PolicyRequest = context["request"]
             if policy_request.http_request:
-                event.from_http(policy_request)
+                event.from_http(policy_request.http_request)
                 return
         event.save()
 

authentik/lib/migrations.py

@@ -19,7 +19,15 @@ def fallback_names(app: str, model: str, field: str):
             if value not in seen_names:
                 seen_names.append(value)
                 continue
-            new_value = value + "_2"
+            separator = "_"
+            suffix_index = 2
+            while (
+                klass.objects.using(db_alias)
+                .filter(**{field: f"{value}{separator}{suffix_index}"})
+                .exists()
+            ):
+                suffix_index += 1
+            new_value = f"{value}{separator}{suffix_index}"
             setattr(obj, field, new_value)
             obj.save()
 

authentik/lib/tests/test_evaluator.py

@@ -2,28 +2,41 @@
 from django.test import TestCase
 
 from authentik.core.tests.utils import create_test_admin_user
+from authentik.events.models import Event
 from authentik.lib.expression.evaluator import BaseEvaluator
+from authentik.lib.generators import generate_id
 
 
 class TestEvaluator(TestCase):
     """Test Evaluator base functions"""
 
-    def test_regex_match(self):
+    def test_expr_regex_match(self):
         """Test expr_regex_match"""
         self.assertFalse(BaseEvaluator.expr_regex_match("foo", "bar"))
         self.assertTrue(BaseEvaluator.expr_regex_match("foo", "foo"))
 
-    def test_regex_replace(self):
+    def test_expr_regex_replace(self):
         """Test expr_regex_replace"""
         self.assertEqual(BaseEvaluator.expr_regex_replace("foo", "o", "a"), "faa")
 
-    def test_user_by(self):
+    def test_expr_user_by(self):
         """Test expr_user_by"""
         user = create_test_admin_user()
         self.assertIsNotNone(BaseEvaluator.expr_user_by(username=user.username))
         self.assertIsNone(BaseEvaluator.expr_user_by(username="bar"))
         self.assertIsNone(BaseEvaluator.expr_user_by(foo="bar"))
 
-    def test_is_group_member(self):
+    def test_expr_is_group_member(self):
         """Test expr_is_group_member"""
         self.assertFalse(BaseEvaluator.expr_is_group_member(create_test_admin_user(), name="test"))
+
+    def test_expr_event_create(self):
+        """Test expr_event_create"""
+        evaluator = BaseEvaluator(generate_id())
+        evaluator._context = {
+            "foo": "bar",
+        }
+        evaluator.evaluate("ak_create_event('foo', bar='baz')")
+        event = Event.objects.filter(action="custom_foo").first()
+        self.assertIsNotNone(event)
+        self.assertEqual(event.context, {"bar": "baz", "foo": "bar"})

authentik/outposts/apps.py

@@ -24,7 +24,6 @@ class AuthentikOutpostConfig(ManagedAppConfig):
     label = "authentik_outposts"
     verbose_name = "authentik Outpost"
     default = True
-    ws_mountpoint = "authentik.outposts.urls"
 
     def reconcile_load_outposts_signals(self):
         """Load outposts signals"""

authentik/outposts/migrations/0020_alter_outpost_type.py

@@ -17,4 +17,15 @@ class Migration(migrations.Migration):
                 default="proxy",
             ),
         ),
+        migrations.AlterField(
+            model_name="outpost",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                unique=True,
+                verbose_name="Managed by authentik",
+            ),
+        ),
     ]

authentik/outposts/tasks.py

@@ -42,12 +42,15 @@ from authentik.providers.ldap.controllers.docker import LDAPDockerController
 from authentik.providers.ldap.controllers.kubernetes import LDAPKubernetesController
 from authentik.providers.proxy.controllers.docker import ProxyDockerController
 from authentik.providers.proxy.controllers.kubernetes import ProxyKubernetesController
+from authentik.providers.radius.controllers.docker import RadiusDockerController
+from authentik.providers.radius.controllers.kubernetes import RadiusKubernetesController
 from authentik.root.celery import CELERY_APP
 
 LOGGER = get_logger()
 CACHE_KEY_OUTPOST_DOWN = "goauthentik.io/outposts/teardown/%s"
 
 
+# pylint: disable=too-many-return-statements
 def controller_for_outpost(outpost: Outpost) -> Optional[type[BaseController]]:
     """Get a controller for the outpost, when a service connection is defined"""
     if not outpost.service_connection:
@@ -63,6 +66,11 @@ def controller_for_outpost(outpost: Outpost) -> Optional[type[BaseController]]:
             return LDAPDockerController
         if isinstance(service_connection, KubernetesServiceConnection):
             return LDAPKubernetesController
+    if outpost.type == OutpostType.RADIUS:
+        if isinstance(service_connection, DockerServiceConnection):
+            return RadiusDockerController
+        if isinstance(service_connection, KubernetesServiceConnection):
+            return RadiusKubernetesController
     return None
 
 

authentik/outposts/urls.py

@@ -1,9 +1,22 @@
 """Outpost Websocket URLS"""
 from django.urls import path
 
+from authentik.outposts.api.outposts import OutpostViewSet
+from authentik.outposts.api.service_connections import (
+    DockerServiceConnectionViewSet,
+    KubernetesServiceConnectionViewSet,
+    ServiceConnectionViewSet,
+)
 from authentik.outposts.channels import OutpostConsumer
 from authentik.root.middleware import ChannelsLoggingMiddleware
 
 websocket_urlpatterns = [
     path("ws/outpost/<uuid:pk>/", ChannelsLoggingMiddleware(OutpostConsumer.as_asgi())),
 ]
+
+api_urlpatterns = [
+    ("outposts/instances", OutpostViewSet),
+    ("outposts/service_connections/all", ServiceConnectionViewSet),
+    ("outposts/service_connections/docker", DockerServiceConnectionViewSet),
+    ("outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet),
+]

authentik/policies/dummy/urls.py

@@ -0,0 +1,4 @@
+"""API URLs"""
+from authentik.policies.dummy.api import DummyPolicyViewSet
+
+api_urlpatterns = [("policies/dummy", DummyPolicyViewSet)]

authentik/policies/event_matcher/urls.py

@@ -0,0 +1,4 @@
+"""API URLs"""
+from authentik.policies.event_matcher.api import EventMatcherPolicyViewSet
+
+api_urlpatterns = [("policies/event_matcher", EventMatcherPolicyViewSet)]

authentik/policies/expiry/urls.py

@@ -0,0 +1,4 @@
+"""API URLs"""
+from authentik.policies.expiry.api import PasswordExpiryPolicyViewSet
+
+api_urlpatterns = [("policies/password_expiry", PasswordExpiryPolicyViewSet)]

authentik/policies/expression/urls.py

@@ -0,0 +1,4 @@
+"""API URLs"""
+from authentik.policies.expression.api import ExpressionPolicyViewSet
+
+api_urlpatterns = [("policies/expression", ExpressionPolicyViewSet)]

authentik/policies/password/urls.py

@@ -0,0 +1,4 @@
+"""API URLs"""
+from authentik.policies.password.api import PasswordPolicyViewSet
+
+api_urlpatterns = [("policies/password", PasswordPolicyViewSet)]

authentik/policies/reputation/urls.py

@@ -0,0 +1,7 @@
+"""API URLs"""
+from authentik.policies.reputation.api import ReputationPolicyViewSet, ReputationViewSet
+
+api_urlpatterns = [
+    ("policies/reputation/scores", ReputationViewSet),
+    ("policies/reputation", ReputationPolicyViewSet),
+]

authentik/policies/urls.py

@@ -0,0 +1,8 @@
+"""API URLs"""
+from authentik.policies.api.bindings import PolicyBindingViewSet
+from authentik.policies.api.policies import PolicyViewSet
+
+api_urlpatterns = [
+    ("policies/all", PolicyViewSet),
+    ("policies/bindings", PolicyBindingViewSet),
+]

authentik/policies/utils.py

@@ -2,7 +2,7 @@
 from typing import Any
 
 
-def delete_none_keys(dict_: dict[Any, Any]) -> dict[Any, Any]:
+def delete_none_values(dict_: dict[Any, Any]) -> dict[Any, Any]:
     """Remove any keys from `dict_` that are None."""
     new_dict = {}
     for key, value in dict_.items():

authentik/providers/ldap/api.py

@@ -1,5 +1,5 @@
 """LDAPProvider API Views"""
-from rest_framework.fields import CharField, ListField
+from rest_framework.fields import CharField, ListField, SerializerMethodField
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
 
@@ -54,9 +54,15 @@ class LDAPProviderViewSet(UsedByMixin, ModelViewSet):
 class LDAPOutpostConfigSerializer(ModelSerializer):
     """LDAPProvider Serializer"""
 
-    application_slug = CharField(source="application.slug")
+    application_slug = SerializerMethodField()
     bind_flow_slug = CharField(source="authorization_flow.slug")
 
+    def get_application_slug(self, instance: LDAPProvider) -> str:
+        """Prioritise backchannel slug over direct application slug"""
+        if instance.backchannel_application:
+            return instance.backchannel_application.slug
+        return instance.application.slug
+
     class Meta:
         model = LDAPProvider
         fields = [

authentik/providers/ldap/models.py

@@ -5,7 +5,7 @@ from django.db import models
 from django.utils.translation import gettext_lazy as _
 from rest_framework.serializers import Serializer
 
-from authentik.core.models import Group, Provider
+from authentik.core.models import BackchannelProvider, Group
 from authentik.crypto.models import CertificateKeyPair
 from authentik.outposts.models import OutpostModel
 
@@ -17,7 +17,7 @@ class APIAccessMode(models.TextChoices):
     CACHED = "cached"
 
 
-class LDAPProvider(OutpostModel, Provider):
+class LDAPProvider(OutpostModel, BackchannelProvider):
     """Allow applications to authenticate against authentik's users using LDAP."""
 
     base_dn = models.TextField(

authentik/providers/ldap/urls.py

@@ -0,0 +1,7 @@
+"""API URLs"""
+from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
+
+api_urlpatterns = [
+    ("outposts/ldap", LDAPOutpostConfigViewSet),
+    ("providers/ldap", LDAPProviderViewSet),
+]

authentik/providers/oauth2/id_token.py

@@ -26,6 +26,7 @@ class SubModes(models.TextChoices):
 
     HASHED_USER_ID = "hashed_user_id", _("Based on the Hashed User ID")
     USER_ID = "user_id", _("Based on user ID")
+    USER_UUID = "user_uuid", _("Based on user UUID")
     USER_USERNAME = "user_username", _("Based on the username")
     USER_EMAIL = (
         "user_email",
@@ -96,6 +97,8 @@ class IDToken:
             id_token.sub = token.user.uid
         elif provider.sub_mode == SubModes.USER_ID:
             id_token.sub = str(token.user.pk)
+        elif provider.sub_mode == SubModes.USER_UUID:
+            id_token.sub = str(token.user.uuid)
         elif provider.sub_mode == SubModes.USER_EMAIL:
             id_token.sub = token.user.email
         elif provider.sub_mode == SubModes.USER_USERNAME:

authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py

@@ -0,0 +1,46 @@
+# Generated by Django 4.1.7 on 2023-05-06 16:18
+
+from django.db import migrations, models
+
+import authentik.providers.oauth2.models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        (
+            "authentik_providers_oauth2",
+            "0015_accesstoken_auth_time_authorizationcode_auth_time_and_more",
+        ),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="refreshtoken",
+            name="token",
+            field=models.TextField(
+                default=authentik.providers.oauth2.models.generate_client_secret
+            ),
+        ),
+        migrations.AlterField(
+            model_name="oauth2provider",
+            name="sub_mode",
+            field=models.TextField(
+                choices=[
+                    ("hashed_user_id", "Based on the Hashed User ID"),
+                    ("user_id", "Based on user ID"),
+                    ("user_uuid", "Based on user UUID"),
+                    ("user_username", "Based on the username"),
+                    (
+                        "user_email",
+                        "Based on the User's Email. This is recommended over the UPN method.",
+                    ),
+                    (
+                        "user_upn",
+                        "Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.",
+                    ),
+                ],
+                default="hashed_user_id",
+                help_text="Configure what data should be used as unique User Identifier. For most cases, the default should be fine.",
+            ),
+        ),
+    ]

authentik/providers/oauth2/models.py

@@ -382,7 +382,7 @@ class AccessToken(SerializerModel, ExpiringModel, BaseGrantModel):
 class RefreshToken(SerializerModel, ExpiringModel, BaseGrantModel):
     """OAuth2 Refresh Token, opaque"""
 
-    token = models.TextField(default=generate_key)
+    token = models.TextField(default=generate_client_secret)
     _id_token = models.TextField(verbose_name=_("ID Token"))
 
     @property

authentik/providers/oauth2/tests/test_userinfo.py

@@ -92,5 +92,5 @@ class TestUserinfo(OAuthTestCase):
         self.assertTrue(events.exists())
         self.assertEqual(
             events.first().context["message"],
-            "Failed to evaluate property-mapping: name 'q' is not defined",
+            "Failed to evaluate property-mapping: 'test'",
         )

authentik/providers/oauth2/tests/utils.py

@@ -25,7 +25,6 @@ class OAuthTestCase(TestCase):
     def setUpClass(cls) -> None:
         cls.keypair = create_test_cert()
         super().setUpClass()
-        cls.maxDiff = None
 
     def assert_non_none_or_unset(self, container: dict, key: str):
         """Check that a key, if set, is not none"""

authentik/providers/oauth2/urls.py

@@ -2,6 +2,13 @@
 from django.urls import path
 from django.views.generic.base import RedirectView
 
+from authentik.providers.oauth2.api.providers import OAuth2ProviderViewSet
+from authentik.providers.oauth2.api.scopes import ScopeMappingViewSet
+from authentik.providers.oauth2.api.tokens import (
+    AccessTokenViewSet,
+    AuthorizationCodeViewSet,
+    RefreshTokenViewSet,
+)
 from authentik.providers.oauth2.views.authorize import AuthorizationFlowInitView
 from authentik.providers.oauth2.views.device_backchannel import DeviceView
 from authentik.providers.oauth2.views.introspection import TokenIntrospectionView
@@ -51,3 +58,11 @@ urlpatterns = [
         name="provider-info",
     ),
 ]
+
+api_urlpatterns = [
+    ("providers/oauth2", OAuth2ProviderViewSet),
+    ("propertymappings/scope", ScopeMappingViewSet),
+    ("oauth2/authorization_codes", AuthorizationCodeViewSet),
+    ("oauth2/refresh_tokens", RefreshTokenViewSet),
+    ("oauth2/access_tokens", AccessTokenViewSet),
+]

authentik/providers/oauth2/views/userinfo.py

@@ -82,9 +82,11 @@ class UserInfoView(View):
             except PropertyMappingExpressionException as exc:
                 Event.new(
                     EventAction.CONFIGURATION_ERROR,
-                    message=f"Failed to evaluate property-mapping: {str(exc)}",
+                    message=f"Failed to evaluate property-mapping: '{scope.name}'",
+                    provider=provider,
                     mapping=scope,
                 ).from_http(self.request)
+                LOGGER.warning("Failed to evaluate property mapping", exc=exc)
             if value is None:
                 continue
             if not isinstance(value, dict):

authentik/providers/proxy/controllers/k8s/traefik.py

@@ -1,185 +1,40 @@
 """Kubernetes Traefik Middleware Reconciler"""
-from dataclasses import asdict, dataclass, field
-from typing import TYPE_CHECKING
-
-from dacite.core import from_dict
-from kubernetes.client import ApiextensionsV1Api, CustomObjectsApi
-
-from authentik.outposts.controllers.base import FIELD_MANAGER
 from authentik.outposts.controllers.k8s.base import KubernetesObjectReconciler
-from authentik.outposts.controllers.k8s.triggers import NeedsUpdate
-from authentik.providers.proxy.models import ProxyMode, ProxyProvider
-
-if TYPE_CHECKING:
-    from authentik.outposts.controllers.kubernetes import KubernetesController
+from authentik.outposts.controllers.kubernetes import KubernetesController
+from authentik.providers.proxy.controllers.k8s.traefik_2 import Traefik2MiddlewareReconciler
+from authentik.providers.proxy.controllers.k8s.traefik_3 import (
+    Traefik3MiddlewareReconciler,
+    TraefikMiddleware,
+)
 
 
-@dataclass
-class TraefikMiddlewareSpecForwardAuth:
-    """traefik middleware forwardAuth spec"""
-
-    address: str
-    # pylint: disable=invalid-name
-    authResponseHeadersRegex: str = field(default="")
-    # pylint: disable=invalid-name
-    authResponseHeaders: list[str] = field(default_factory=list)
-    # pylint: disable=invalid-name
-    trustForwardHeader: bool = field(default=True)
-
-
-@dataclass
-class TraefikMiddlewareSpec:
-    """Traefik middleware spec"""
-
-    # pylint: disable=invalid-name
-    forwardAuth: TraefikMiddlewareSpecForwardAuth
-
-
-@dataclass
-class TraefikMiddlewareMetadata:
-    """Traefik Middleware metadata"""
-
-    name: str
-    namespace: str
-    labels: dict = field(default_factory=dict)
-
-
-@dataclass
-class TraefikMiddleware:
-    """Traefik Middleware"""
-
-    # pylint: disable=invalid-name
-    apiVersion: str
-    kind: str
-    metadata: TraefikMiddlewareMetadata
-    spec: TraefikMiddlewareSpec
-
-
-CRD_NAME = "middlewares.traefik.containo.us"
-CRD_GROUP = "traefik.containo.us"
-CRD_VERSION = "v1alpha1"
-CRD_PLURAL = "middlewares"
-
-
-class TraefikMiddlewareReconciler(KubernetesObjectReconciler[TraefikMiddleware]):
+class TraefikMiddlewareReconciler(KubernetesObjectReconciler):
     """Kubernetes Traefik Middleware Reconciler"""
 
     def __init__(self, controller: "KubernetesController") -> None:
         super().__init__(controller)
-        self.api_ex = ApiextensionsV1Api(controller.client)
-        self.api = CustomObjectsApi(controller.client)
+        self.reconciler = Traefik3MiddlewareReconciler(controller)
+        if not self.reconciler.crd_exists():
+            self.reconciler = Traefik2MiddlewareReconciler(controller)
 
     @property
     def noop(self) -> bool:
-        if not ProxyProvider.objects.filter(
-            outpost__in=[self.controller.outpost],
-            mode__in=[ProxyMode.FORWARD_SINGLE, ProxyMode.FORWARD_DOMAIN],
-        ).exists():
-            self.logger.debug("No providers with forward auth enabled.")
-            return True
-        if not self._crd_exists():
-            self.logger.debug("CRD doesn't exist")
-            return True
-        return False
-
-    def _crd_exists(self) -> bool:
-        """Check if the traefik middleware exists"""
-        return bool(
-            len(
-                self.api_ex.list_custom_resource_definition(
-                    field_selector=f"metadata.name={CRD_NAME}"
-                ).items
-            )
-        )
+        return self.reconciler.noop
 
     def reconcile(self, current: TraefikMiddleware, reference: TraefikMiddleware):
-        super().reconcile(current, reference)
-        if current.spec.forwardAuth.address != reference.spec.forwardAuth.address:
-            raise NeedsUpdate()
-        if (
-            current.spec.forwardAuth.authResponseHeadersRegex
-            != reference.spec.forwardAuth.authResponseHeadersRegex
-        ):
-            raise NeedsUpdate()
-        # Ensure all of our headers are set, others can be added by the user.
-        if not set(current.spec.forwardAuth.authResponseHeaders).issubset(
-            reference.spec.forwardAuth.authResponseHeaders
-        ):
-            raise NeedsUpdate()
+        return self.reconcile(current, reference)
 
     def get_reference_object(self) -> TraefikMiddleware:
-        """Get deployment object for outpost"""
-        return TraefikMiddleware(
-            apiVersion=f"{CRD_GROUP}/{CRD_VERSION}",
-            kind="Middleware",
-            metadata=TraefikMiddlewareMetadata(
-                name=self.name,
-                namespace=self.namespace,
-                labels=self.get_object_meta().labels,
-            ),
-            spec=TraefikMiddlewareSpec(
-                forwardAuth=TraefikMiddlewareSpecForwardAuth(
-                    address=(
-                        f"http://{self.name}.{self.namespace}:9000/"
-                        "outpost.goauthentik.io/auth/traefik"
-                    ),
-                    authResponseHeaders=[
-                        "X-authentik-username",
-                        "X-authentik-groups",
-                        "X-authentik-email",
-                        "X-authentik-name",
-                        "X-authentik-uid",
-                        "X-authentik-jwt",
-                        "X-authentik-meta-jwks",
-                        "X-authentik-meta-outpost",
-                        "X-authentik-meta-provider",
-                        "X-authentik-meta-app",
-                        "X-authentik-meta-version",
-                    ],
-                    authResponseHeadersRegex="",
-                    trustForwardHeader=True,
-                )
-            ),
-        )
+        return self.get_reference_object()
 
     def create(self, reference: TraefikMiddleware):
-        return self.api.create_namespaced_custom_object(
-            group=CRD_GROUP,
-            version=CRD_VERSION,
-            plural=CRD_PLURAL,
-            namespace=self.namespace,
-            body=asdict(reference),
-            field_manager=FIELD_MANAGER,
-        )
+        return self.create(reference)
 
     def delete(self, reference: TraefikMiddleware):
-        return self.api.delete_namespaced_custom_object(
-            group=CRD_GROUP,
-            version=CRD_VERSION,
-            namespace=self.namespace,
-            plural=CRD_PLURAL,
-            name=self.name,
-        )
+        return self.delete(reference)
 
     def retrieve(self) -> TraefikMiddleware:
-        return from_dict(
-            TraefikMiddleware,
-            self.api.get_namespaced_custom_object(
-                group=CRD_GROUP,
-                version=CRD_VERSION,
-                namespace=self.namespace,
-                plural=CRD_PLURAL,
-                name=self.name,
-            ),
-        )
+        return self.retrieve()
 
     def update(self, current: TraefikMiddleware, reference: TraefikMiddleware):
-        return self.api.patch_namespaced_custom_object(
-            group=CRD_GROUP,
-            version=CRD_VERSION,
-            namespace=self.namespace,
-            plural=CRD_PLURAL,
-            name=self.name,
-            body=asdict(reference),
-            field_manager=FIELD_MANAGER,
-        )
+        return self.update(current, reference)

authentik/providers/proxy/controllers/k8s/traefik_2.py

@@ -0,0 +1,18 @@
+"""Kubernetes Traefik Middleware Reconciler"""
+from typing import TYPE_CHECKING
+
+from authentik.providers.proxy.controllers.k8s.traefik_3 import Traefik3MiddlewareReconciler
+
+if TYPE_CHECKING:
+    from authentik.outposts.controllers.kubernetes import KubernetesController
+
+
+class Traefik2MiddlewareReconciler(Traefik3MiddlewareReconciler):
+    """Kubernetes Traefik Middleware Reconciler"""
+
+    def __init__(self, controller: "KubernetesController") -> None:
+        super().__init__(controller)
+        self.crd_name = "middlewares.traefik.containo.us"
+        self.crd_group = "traefik.containo.us"
+        self.crd_version = "v1alpha1"
+        self.crd_plural = "middlewares"

authentik/providers/proxy/controllers/k8s/traefik_3.py

@@ -0,0 +1,183 @@
+"""Kubernetes Traefik Middleware Reconciler"""
+from dataclasses import asdict, dataclass, field
+from typing import TYPE_CHECKING
+
+from dacite.core import from_dict
+from kubernetes.client import ApiextensionsV1Api, CustomObjectsApi
+
+from authentik.outposts.controllers.base import FIELD_MANAGER
+from authentik.outposts.controllers.k8s.base import KubernetesObjectReconciler
+from authentik.outposts.controllers.k8s.triggers import NeedsUpdate
+from authentik.providers.proxy.models import ProxyMode, ProxyProvider
+
+if TYPE_CHECKING:
+    from authentik.outposts.controllers.kubernetes import KubernetesController
+
+
+@dataclass
+class TraefikMiddlewareSpecForwardAuth:
+    """traefik middleware forwardAuth spec"""
+
+    address: str
+    # pylint: disable=invalid-name
+    authResponseHeadersRegex: str = field(default="")
+    # pylint: disable=invalid-name
+    authResponseHeaders: list[str] = field(default_factory=list)
+    # pylint: disable=invalid-name
+    trustForwardHeader: bool = field(default=True)
+
+
+@dataclass
+class TraefikMiddlewareSpec:
+    """Traefik middleware spec"""
+
+    # pylint: disable=invalid-name
+    forwardAuth: TraefikMiddlewareSpecForwardAuth
+
+
+@dataclass
+class TraefikMiddlewareMetadata:
+    """Traefik Middleware metadata"""
+
+    name: str
+    namespace: str
+    labels: dict = field(default_factory=dict)
+
+
+@dataclass
+class TraefikMiddleware:
+    """Traefik Middleware"""
+
+    # pylint: disable=invalid-name
+    apiVersion: str
+    kind: str
+    metadata: TraefikMiddlewareMetadata
+    spec: TraefikMiddlewareSpec
+
+
+class Traefik3MiddlewareReconciler(KubernetesObjectReconciler[TraefikMiddleware]):
+    """Kubernetes Traefik Middleware Reconciler"""
+
+    def __init__(self, controller: "KubernetesController") -> None:
+        super().__init__(controller)
+        self.api_ex = ApiextensionsV1Api(controller.client)
+        self.api = CustomObjectsApi(controller.client)
+        self.crd_name = "middlewares.traefik.io"
+        self.crd_group = "traefik.io"
+        self.crd_version = "v1alpha1"
+        self.crd_plural = "middlewares"
+
+    @property
+    def noop(self) -> bool:
+        if not ProxyProvider.objects.filter(
+            outpost__in=[self.controller.outpost],
+            mode__in=[ProxyMode.FORWARD_SINGLE, ProxyMode.FORWARD_DOMAIN],
+        ).exists():
+            self.logger.debug("No providers with forward auth enabled.")
+            return True
+        if not self.crd_exists():
+            self.logger.debug("CRD doesn't exist")
+            return True
+        return False
+
+    def crd_exists(self) -> bool:
+        """Check if the traefik middleware exists"""
+        return bool(
+            len(
+                self.api_ex.list_custom_resource_definition(
+                    field_selector=f"metadata.name={self.crd_name}"
+                ).items
+            )
+        )
+
+    def reconcile(self, current: TraefikMiddleware, reference: TraefikMiddleware):
+        super().reconcile(current, reference)
+        if current.spec.forwardAuth.address != reference.spec.forwardAuth.address:
+            raise NeedsUpdate()
+        if (
+            current.spec.forwardAuth.authResponseHeadersRegex
+            != reference.spec.forwardAuth.authResponseHeadersRegex
+        ):
+            raise NeedsUpdate()
+        # Ensure all of our headers are set, others can be added by the user.
+        if not set(current.spec.forwardAuth.authResponseHeaders).issubset(
+            reference.spec.forwardAuth.authResponseHeaders
+        ):
+            raise NeedsUpdate()
+
+    def get_reference_object(self) -> TraefikMiddleware:
+        """Get deployment object for outpost"""
+        return TraefikMiddleware(
+            apiVersion=f"{self.crd_group}/{self.crd_version}",
+            kind="Middleware",
+            metadata=TraefikMiddlewareMetadata(
+                name=self.name,
+                namespace=self.namespace,
+                labels=self.get_object_meta().labels,
+            ),
+            spec=TraefikMiddlewareSpec(
+                forwardAuth=TraefikMiddlewareSpecForwardAuth(
+                    address=(
+                        f"http://{self.name}.{self.namespace}:9000/"
+                        "outpost.goauthentik.io/auth/traefik"
+                    ),
+                    authResponseHeaders=[
+                        "X-authentik-username",
+                        "X-authentik-groups",
+                        "X-authentik-email",
+                        "X-authentik-name",
+                        "X-authentik-uid",
+                        "X-authentik-jwt",
+                        "X-authentik-meta-jwks",
+                        "X-authentik-meta-outpost",
+                        "X-authentik-meta-provider",
+                        "X-authentik-meta-app",
+                        "X-authentik-meta-version",
+                    ],
+                    authResponseHeadersRegex="",
+                    trustForwardHeader=True,
+                )
+            ),
+        )
+
+    def create(self, reference: TraefikMiddleware):
+        return self.api.create_namespaced_custom_object(
+            group=self.crd_group,
+            version=self.crd_version,
+            plural=self.crd_plural,
+            namespace=self.namespace,
+            body=asdict(reference),
+            field_manager=FIELD_MANAGER,
+        )
+
+    def delete(self, reference: TraefikMiddleware):
+        return self.api.delete_namespaced_custom_object(
+            group=self.crd_group,
+            version=self.crd_version,
+            plural=self.crd_plural,
+            namespace=self.namespace,
+            name=self.name,
+        )
+
+    def retrieve(self) -> TraefikMiddleware:
+        return from_dict(
+            TraefikMiddleware,
+            self.api.get_namespaced_custom_object(
+                group=self.crd_group,
+                version=self.crd_version,
+                plural=self.crd_plural,
+                namespace=self.namespace,
+                name=self.name,
+            ),
+        )
+
+    def update(self, current: TraefikMiddleware, reference: TraefikMiddleware):
+        return self.api.patch_namespaced_custom_object(
+            group=self.crd_group,
+            version=self.crd_version,
+            plural=self.crd_plural,
+            namespace=self.namespace,
+            name=self.name,
+            body=asdict(reference),
+            field_manager=FIELD_MANAGER,
+        )

authentik/providers/proxy/urls.py

@@ -0,0 +1,7 @@
+"""API URLs"""
+from authentik.providers.proxy.api import ProxyOutpostConfigViewSet, ProxyProviderViewSet
+
+api_urlpatterns = [
+    ("outposts/proxy", ProxyOutpostConfigViewSet),
+    ("providers/proxy", ProxyProviderViewSet),
+]

authentik/providers/radius/api.py

@@ -1,5 +1,5 @@
 """RadiusProvider API Views"""
-from rest_framework.fields import CharField
+from rest_framework.fields import CharField, ListField
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
 
@@ -11,6 +11,8 @@ from authentik.providers.radius.models import RadiusProvider
 class RadiusProviderSerializer(ProviderSerializer):
     """RadiusProvider Serializer"""
 
+    outpost_set = ListField(child=CharField(), read_only=True, source="outpost_set.all")
+
     class Meta:
         model = RadiusProvider
         fields = ProviderSerializer.Meta.fields + [
@@ -18,6 +20,7 @@ class RadiusProviderSerializer(ProviderSerializer):
             # Shared secret is not a write-only field, as
             # an admin might have to view it
             "shared_secret",
+            "outpost_set",
         ]
         extra_kwargs = ProviderSerializer.Meta.extra_kwargs
 

authentik/providers/radius/urls.py

@@ -0,0 +1,7 @@
+"""API URLs"""
+from authentik.providers.radius.api import RadiusOutpostConfigViewSet, RadiusProviderViewSet
+
+api_urlpatterns = [
+    ("outposts/radius", RadiusOutpostConfigViewSet),
+    ("providers/radius", RadiusProviderViewSet),
+]

authentik/providers/saml/processors/assertion.py

@@ -108,9 +108,11 @@ class AssertionProcessor:
                 # Value error can be raised when assigning invalid data to an attribute
                 Event.new(
                     EventAction.CONFIGURATION_ERROR,
-                    message=f"Failed to evaluate property-mapping: {str(exc)}",
+                    message=f"Failed to evaluate property-mapping: '{mapping.name}'",
+                    provider=self.provider,
                     mapping=mapping,
                 ).from_http(self.http_request)
+                LOGGER.warning("Failed to evaluate property mapping", exc=exc)
                 continue
         return attribute_statement
 
@@ -185,9 +187,14 @@ class AssertionProcessor:
             except PropertyMappingExpressionException as exc:
                 Event.new(
                     EventAction.CONFIGURATION_ERROR,
-                    message=f"Failed to evaluate property-mapping: {str(exc)}",
+                    message=(
+                        "Failed to evaluate property-mapping: "
+                        f"'{self.provider.name_id_mapping.name}'",
+                    ),
+                    provider=self.provider,
                     mapping=self.provider.name_id_mapping,
                 ).from_http(self.http_request)
+                LOGGER.warning("Failed to evaluate property mapping", exc=exc)
                 return name_id
         if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_EMAIL:
             name_id.text = self.http_request.user.email

authentik/providers/saml/tests/test_auth_n_request.py

@@ -90,6 +90,7 @@ class TestAuthNRequest(TestCase):
             issuer="authentik",
             pre_authentication_flow=create_test_flow(),
             signing_kp=cert,
+            verification_kp=cert,
         )
 
     def test_signed_valid(self):
@@ -261,5 +262,5 @@ class TestAuthNRequest(TestCase):
         self.assertTrue(events.exists())
         self.assertEqual(
             events.first().context["message"],
-            "Failed to evaluate property-mapping: name 'q' is not defined",
+            "Failed to evaluate property-mapping: 'test'",
         )

authentik/providers/saml/urls.py

@@ -1,6 +1,8 @@
 """authentik SAML IDP URLs"""
 from django.urls import path
 
+from authentik.providers.saml.api.property_mapping import SAMLPropertyMappingViewSet
+from authentik.providers.saml.api.providers import SAMLProviderViewSet
 from authentik.providers.saml.views import metadata, slo, sso
 
 urlpatterns = [
@@ -39,3 +41,8 @@ urlpatterns = [
         name="metadata-download",
     ),
 ]
+
+api_urlpatterns = [
+    ("propertymappings/saml", SAMLPropertyMappingViewSet),
+    ("providers/saml", SAMLProviderViewSet),
+]

authentik/providers/scim/api/providers.py

@@ -24,8 +24,8 @@ class SCIMProviderSerializer(ProviderSerializer):
             "property_mappings",
             "property_mappings_group",
             "component",
-            "assigned_application_slug",
-            "assigned_application_name",
+            "assigned_backchannel_application_slug",
+            "assigned_backchannel_application_name",
             "verbose_name",
             "verbose_name_plural",
             "meta_model_name",

authentik/providers/scim/clients/base.py

@@ -51,7 +51,7 @@ class SCIMClient(Generic[T, SchemaType]):
                 },
             )
         except RequestException as exc:
-            raise SCIMRequestException(None) from exc
+            raise SCIMRequestException(message="Failed to send request") from exc
         self.logger.debug("scim request", path=path, method=method, **kwargs)
         if response.status_code >= 400:
             if response.status_code == 404:

authentik/providers/scim/clients/exceptions.py

@@ -2,10 +2,10 @@
 from typing import Optional
 
 from pydantic import ValidationError
-from pydanticscim.responses import SCIMError
 from requests import Response
 
 from authentik.lib.sentry import SentryIgnoredException
+from authentik.providers.scim.clients.schema import SCIMError
 
 
 class StopSync(SentryIgnoredException):
@@ -16,7 +16,8 @@ class StopSync(SentryIgnoredException):
         self.obj = obj
         self.mapping = mapping
 
-    def __str__(self) -> str:
+    def detail(self) -> str:
+        """Get human readable details of this error"""
         msg = f"Error {str(self.exc)}, caused by {self.obj}"
 
         if self.mapping:
@@ -28,19 +29,22 @@ class SCIMRequestException(SentryIgnoredException):
     """Exception raised when an SCIM request fails"""
 
     _response: Optional[Response]
+    _message: Optional[str]
 
-    def __init__(self, response: Optional[Response] = None) -> None:
+    def __init__(self, response: Optional[Response] = None, message: Optional[str] = None) -> None:
         self._response = response
+        self._message = message
 
-    def __str__(self) -> str:
+    def detail(self) -> str:
+        """Get human readable details of this error"""
         if not self._response:
-            return super().__str__()
+            return self._message
         try:
             error = SCIMError.parse_raw(self._response.text)
             return error.detail
         except ValidationError:
             pass
-        return super().__str__()
+        return self._message
 
 
 class ResourceMissing(SCIMRequestException):

authentik/providers/scim/clients/group.py

@@ -8,7 +8,7 @@ from authentik.core.exceptions import PropertyMappingExpressionException
 from authentik.core.models import Group
 from authentik.events.models import Event, EventAction
 from authentik.lib.utils.errors import exception_to_string
-from authentik.policies.utils import delete_none_keys
+from authentik.policies.utils import delete_none_values
 from authentik.providers.scim.clients.base import SCIMClient
 from authentik.providers.scim.clients.exceptions import (
     ResourceMissing,
@@ -74,7 +74,7 @@ class SCIMGroupClient(SCIMClient[Group, SCIMGroupSchema]):
         if not raw_scim_group:
             raise StopSync(ValueError("No group mappings configured"), obj)
         try:
-            scim_group = SCIMGroupSchema.parse_obj(delete_none_keys(raw_scim_group))
+            scim_group = SCIMGroupSchema.parse_obj(delete_none_values(raw_scim_group))
         except ValidationError as exc:
             raise StopSync(exc, obj) from exc
         if not scim_group.externalId:
@@ -117,20 +117,23 @@ class SCIMGroupClient(SCIMClient[Group, SCIMGroupSchema]):
                     exclude_unset=True,
                 ),
             )
+        except ResourceMissing:
+            # Resource missing is handled by self.write, which will re-create the group
+            raise
         except SCIMRequestException:
             # Some providers don't support PUT on groups, so this is mainly a fix for the initial
             # sync, send patch add requests for all the users the group currently has
-            # TODO: send patch request for group name
             users = list(group.users.order_by("id").values_list("id", flat=True))
-            return self._patch_add_users(group, users)
-
-    def _patch(
-        self,
-        group_id: str,
-        *ops: PatchOperation,
-    ):
-        req = PatchRequest(Operations=ops)
-        self._request("PATCH", f"/Groups/{group_id}", data=req.json())
+            self._patch_add_users(group, users)
+            # Also update the group name
+            return self._patch(
+                scim_group.id,
+                PatchOperation(
+                    op=PatchOp.replace,
+                    path="displayName",
+                    value=scim_group.displayName,
+                ),
+            )
 
     def update_group(self, group: Group, action: PatchOp, users_set: set[int]):
         """Update a group, either using PUT to replace it or PATCH if supported"""
@@ -151,6 +154,14 @@ class SCIMGroupClient(SCIMClient[Group, SCIMGroupSchema]):
                     return self._patch_remove_users(group, users_set)
             raise exc
 
+    def _patch(
+        self,
+        group_id: str,
+        *ops: PatchOperation,
+    ):
+        req = PatchRequest(Operations=ops)
+        self._request("PATCH", f"/Groups/{group_id}", data=req.json())
+
     def _patch_add_users(self, group: Group, users_set: set[int]):
         """Add users in users_set to group"""
         if len(users_set) < 1: