release: 2023.5.6

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.6.1
+current_version = 2023.5.6
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)

.github/ISSUE_TEMPLATE/hackathon_idea.md

@@ -1,17 +0,0 @@
----
-name: Hackathon Idea
-about: Propose an idea for the hackathon
-title: ""
-labels: hackathon
-assignees: ""
----
-
-**Describe the idea**
-
-A clear concise description of the idea you want to implement
-
-You're also free to work on existing GitHub issues, whether they be feature requests or bugs, just link the existing GitHub issue here.
-
-<!-- Don't modify below here -->
-
-If you want to help working on this idea or want to contribute in any other way, react to this issue with a :rocket:

.github/dependabot.yml

@@ -24,18 +24,6 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "web:"
-    groups:
-      sentry:
-        patterns:
-          - "@sentry/*"
-      babel:
-        patterns:
-          - "@babel/*"
-          - "babel-*"
-      storybook:
-        patterns:
-          - "@storybook/*"
-          - "*storybook*"
   - package-ecosystem: npm
     directory: "/website"
     schedule:
@@ -44,10 +32,6 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "website:"
-    groups:
-      docusaurus:
-        patterns:
-          - "@docusaurus/*"
   - package-ecosystem: pip
     directory: "/"
     schedule:

.github/stale.yml

@@ -0,0 +1,19 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 60
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - pinned
+  - security
+  - pr_wanted
+  - enhancement
+  - bug/confirmed
+  - enhancement/confirmed
+  - question
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.
+only: issues

.github/transifex.yml

@@ -2,11 +2,11 @@ git:
   filters:
     - filter_type: file
       # all supported i18n types: https://docs.transifex.com/formats
-      file_format: XLIFF
+      file_format: PO
       source_language: en
-      source_file: web/xliff/en.xlf
+      source_file: web/src/locales/en.po
       # path expression to translation files, must contain <lang> placeholder
-      translation_files_expression: "web/xliff/<lang>.xlf"
+      translation_files_expression: "web/src/locales/<lang>.po"
     - filter_type: file
       # all supported i18n types: https://docs.transifex.com/formats
       file_format: PO

.github/workflows/ci-main.yml

@@ -112,7 +112,7 @@ jobs:
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.8.0
+        uses: helm/kind-action@v1.7.0
       - name: run integration
         run: |
           poetry run coverage run manage.py test tests/integration
@@ -190,7 +190,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.2.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -218,7 +218,6 @@ jobs:
             ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
-            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
       - name: Comment on PR
         if: github.event_name == 'pull_request'
@@ -235,7 +234,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.2.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -263,6 +262,5 @@ jobs:
             ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}-arm64
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
-            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/arm64

.github/workflows/ci-outpost.yml

@@ -29,8 +29,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.52.2
-          args: --timeout 5000s --verbose
+          args: --timeout 5000s
           skip-pkg-cache: true
   test-unittest:
     runs-on: ubuntu-latest
@@ -68,7 +67,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.2.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -95,7 +94,6 @@ jobs:
           file: ${{ matrix.type }}.Dockerfile
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
-            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/amd64,linux/arm64
           context: .
@@ -120,7 +118,7 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/ci-web.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/ci-website.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"
@@ -50,7 +50,7 @@ jobs:
           - build-docs-only
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/release-next-branch.yml

@@ -1,20 +0,0 @@
-name: authentik-on-release-next-branch
-
-on:
-  schedule:
-    - cron: "0 12 * * *" # every day at noon
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  update-next:
-    runs-on: ubuntu-latest
-    environment: internal-production
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          ref: main
-      - run: |
-          git push origin --force main:next

.github/workflows/release-publish.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.2.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -43,7 +43,6 @@ jobs:
             ghcr.io/goauthentik/server:latest
           platforms: linux/amd64,linux/arm64
           build-args: |
-            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost:
     runs-on: ubuntu-latest
@@ -60,7 +59,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.2.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -91,7 +90,6 @@ jobs:
           file: ${{ matrix.type }}.Dockerfile
           platforms: linux/amd64,linux/arm64
           build-args: |
-            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost-binary:
     timeout-minutes: 120
@@ -110,7 +108,7 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/repo-stale.yml

@@ -1,33 +0,0 @@
-name: 'authentik-repo-stale'
-
-on:
-  schedule:
-    - cron: '30 1 * * *'
-  workflow_dispatch:
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - id: generate_token
-        uses: tibdex/github-app-token@v1
-        with:
-          app_id: ${{ secrets.GH_APP_ID }}
-          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - uses: actions/stale@v8
-        with:
-          repo-token: ${{ steps.generate_token.outputs.token }}
-          days-before-stale: 60
-          days-before-close: 7
-          exempt-issue-labels: pinned,security,pr_wanted,enhancement,bug/confirmed,enhancement/confirmed,question
-          stale-issue-label: wontfix
-          stale-issue-message: >
-            This issue has been automatically marked as stale because it has not had
-            recent activity. It will be closed if no further activity occurs. Thank you
-            for your contributions.
-          # Don't stale PRs, so only apply to PRs with a non-existent label
-          only-pr-labels: foo

.github/workflows/web-api-publish.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3.6.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -45,8 +45,8 @@ jobs:
           body: "web: bump API Client version"
           delete-branch: true
           signoff: true
-          # ID from https://api.github.com/users/authentik-automation[bot]
-          author: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
+          team-reviewers: "@goauthentik/core"
+          author: authentik bot <github-bot@goauthentik.io>
       - uses: peter-evans/enable-pull-request-automerge@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}

.gitignore

@@ -166,7 +166,6 @@ dmypy.json
 # SageMath parsed files
 
 # Environments
-**/.DS_Store
 
 # Spyder project settings
 
@@ -204,4 +203,3 @@ data/
 
 # Local Netlify folder
 .netlify
-.ruff_cache

.vscode/launch.json

@@ -1,27 +0,0 @@
-{
-    "version": "0.2.0",
-    "configurations": [
-        {
-            "name": "Python: PDB attach Server",
-            "type": "python",
-            "request": "attach",
-            "connect": {
-                "host": "localhost",
-                "port": 6800
-            },
-            "justMyCode": true,
-            "django": true
-        },
-        {
-            "name": "Python: PDB attach Worker",
-            "type": "python",
-            "request": "attach",
-            "connect": {
-                "host": "localhost",
-                "port": 6900
-            },
-            "justMyCode": true,
-            "django": true
-        },
-    ]
-}

Dockerfile

@@ -20,7 +20,7 @@ WORKDIR /work/web
 RUN npm ci --include=dev && npm run build
 
 # Stage 3: Poetry to requirements.txt export
-FROM docker.io/python:3.11.4-slim-bullseye AS poetry-locker
+FROM docker.io/python:3.11.3-slim-bullseye AS poetry-locker
 
 WORKDIR /work
 COPY ./pyproject.toml /work
@@ -31,7 +31,7 @@ RUN pip install --no-cache-dir poetry && \
     poetry export -f requirements.txt --dev --output requirements-dev.txt
 
 # Stage 4: Build go proxy
-FROM docker.io/golang:1.20.6-bullseye AS go-builder
+FROM docker.io/golang:1.20.4-bullseye AS go-builder
 
 WORKDIR /work
 
@@ -47,34 +47,33 @@ COPY ./go.sum /work/go.sum
 RUN go build -o /work/authentik ./cmd/server/
 
 # Stage 5: MaxMind GeoIP
-FROM ghcr.io/maxmind/geoipupdate:v6.0 as geoip
+FROM ghcr.io/maxmind/geoipupdate:v5.1 as geoip
 
 ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City"
 ENV GEOIPUPDATE_VERBOSE="true"
-ENV GEOIPUPDATE_ACCOUNT_ID_FILE="/run/secrets/GEOIPUPDATE_ACCOUNT_ID"
-ENV GEOIPUPDATE_LICENSE_KEY_FILE="/run/secrets/GEOIPUPDATE_LICENSE_KEY"
 
 USER root
 RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     --mount=type=secret,id=GEOIPUPDATE_LICENSE_KEY \
     mkdir -p /usr/share/GeoIP && \
-    /bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
+    /bin/sh -c "\
+        export GEOIPUPDATE_ACCOUNT_ID=$(cat /run/secrets/GEOIPUPDATE_ACCOUNT_ID); \
+        export GEOIPUPDATE_LICENSE_KEY=$(cat /run/secrets/GEOIPUPDATE_LICENSE_KEY); \
+        /usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0 \
+    "
 
 # Stage 6: Run
-FROM docker.io/python:3.11.4-slim-bullseye AS final-image
-
-ARG GIT_BUILD_HASH
-ARG VERSION
-ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
+FROM docker.io/python:3.11.3-slim-bullseye AS final-image
 
 LABEL org.opencontainers.image.url https://goauthentik.io
 LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.
 LABEL org.opencontainers.image.source https://github.com/goauthentik/authentik
-LABEL org.opencontainers.image.version ${VERSION}
-LABEL org.opencontainers.image.revision ${GIT_BUILD_HASH}
 
 WORKDIR /
 
+ARG GIT_BUILD_HASH
+ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
+
 COPY --from=poetry-locker /work/requirements.txt /
 COPY --from=poetry-locker /work/requirements-dev.txt /
 COPY --from=geoip /usr/share/GeoIP /geoip

Makefile

@@ -52,7 +52,7 @@ lint:
 migrate:
 	python -m lifecycle.migrate
 
-i18n-extract: i18n-extract-core web-i18n-extract
+i18n-extract: i18n-extract-core web-extract
 
 i18n-extract-core:
 	ak makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
@@ -145,14 +145,13 @@ web-lint-fix:
 
 web-lint:
 	cd web && npm run lint
-	# TODO: The analyzer hasn't run correctly in awhile.
-	# cd web && npm run lit-analyse
+	cd web && npm run lit-analyse
 
 web-check-compile:
 	cd web && npm run tsc
 
-web-i18n-extract:
-	cd web && npm run extract-locales
+web-extract:
+	cd web && npm run extract
 
 #########################
 ## Website

README.md

@@ -15,7 +15,7 @@
 
 ## What is authentik?
 
-authentik is an open-source Identity Provider that emphasizes flexibility and versatility. It can be seamlessly integrated into existing environments to support new protocols. authentik is also a great solution for implementing sign-up, recovery, and other similar features in your application, saving you the hassle of dealing with them.
+Authentik is an open-source Identity Provider that emphasizes flexibility and versatility. It can be seamlessly integrated into existing environments to support new protocols. Authentik is also a great solution for implementing sign-up, recovery, and other similar features in your application, saving you the hassle of dealing with them.
 
 ## Installation
 

SECURITY.md

@@ -1,48 +1,44 @@
-authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
-
-## What authentik classifies as a CVE
-
-CVE (Common Vulnerability and Exposure) is a system designed to aggregate all vulnerabilities. As such, a CVE will be issued when there is a either vulnerability or exposure. Per NIST, A vulnerability is:
-
-“Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.”
-
-If it is determined that the issue does qualify as a CVE, a CVE number will be issued to the reporter from GitHub.
-
-Even if the issue is not a CVE, we still greatly appreciate your help in hardening authentik.
+Authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
 
 ## Supported Versions
 
 (.x being the latest patch release for each version)
 
-| Version | Supported |
-| --- | --- |
-| 2023.5.x | ✅ |
-| 2023.6.x | ✅ |
+| Version   | Supported          |
+| --------- | ------------------ |
+| 2023.4.x  | :white_check_mark: |
+| 2023.5.x  | :white_check_mark: |
 
 ## Reporting a Vulnerability
 
-To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the issue.
+To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the bug.
 
-## Severity levels
+## Criticality levels
 
-authentik reserves the right to reclassify CVSS as necessary. To determine severity, we will use the CVSS calculator from NVD (https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator). The calculated CVSS score will then be translated into one of the following categories:
+### High
 
-| 0.0 | None |
-| 0.1 – 3.9 | Low |
-| 4.0 – 6.9 | Medium |
-| 7.0 – 8.9 | High |
-| 9.0 – 10.0 | Critical |
+-   Authorization bypass
+-   Circumvention of policies
+
+### Moderate
+
+-   Denial-of-Service attacks
+
+### Low
+
+-   Unvalidated redirects
+-   Issues requiring uncommon setups
 
 ## Disclosure process
 
-1. Report from Github or Issue is reported via Email as listed above.
+1. Issue is reported via Email as listed above.
 2. The authentik Security team will try to reproduce the issue and ask for more information if required.
-3. A severity level is assigned.
+3. A criticality level is assigned.
 4. A fix is created, and if possible tested by the issue reporter.
 5. The fix is backported to other supported versions, and if possible a workaround for other versions is created.
-6. An announcement is sent out with a fixed release date and severity level of the issue. The announcement will be sent at least 24 hours before the release of the security fix.
+6. An announcement is sent out with a fixed release date and criticality level of the issue. The announcement will be sent at least 24 hours before the release of the fix
 7. The fixed version is released for the supported versions.
 
 ## Getting security notifications
 
-To get security notifications, subscribe to the mailing list [here](https://groups.google.com/g/authentik-security-announcements) or join the [discord](https://goauthentik.io/discord) server.
+To get security notifications, subscribe to the mailing list [here](https://groups.google.com/g/authentik-security-announcements) or join the [discord](https://goauthentik.io/discord) server.

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2023.6.1"
+__version__ = "2023.5.6"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/meta.py

@@ -8,7 +8,6 @@ from rest_framework.viewsets import ViewSet
 
 from authentik.core.api.utils import PassiveSerializer
 from authentik.lib.utils.reflection import get_apps
-from authentik.policies.event_matcher.models import model_choices
 
 
 class AppSerializer(PassiveSerializer):
@@ -30,17 +29,3 @@ class AppsViewSet(ViewSet):
         for app in sorted(get_apps(), key=lambda app: app.name):
             data.append({"name": app.name, "label": app.verbose_name})
         return Response(AppSerializer(data, many=True).data)
-
-
-class ModelViewSet(ViewSet):
-    """Read-only view list all installed models"""
-
-    permission_classes = [IsAdminUser]
-
-    @extend_schema(responses={200: AppSerializer(many=True)})
-    def list(self, request: Request) -> Response:
-        """Read-only view list all installed models"""
-        data = []
-        for name, label in model_choices():
-            data.append({"name": name, "label": label})
-        return Response(AppSerializer(data, many=True).data)

authentik/admin/api/workers.py

@@ -19,7 +19,7 @@ class WorkerView(APIView):
     def get(self, request: Request) -> Response:
         """Get currently connected worker count."""
         count = len(CELERY_APP.control.ping(timeout=0.5))
-        # In debug we run with `task_always_eager`, so tasks are ran on the main process
+        # In debug we run with `CELERY_TASK_ALWAYS_EAGER`, so tasks are ran on the main process
         if settings.DEBUG:  # pragma: no cover
             count += 1
         return Response({"count": count})

authentik/admin/tasks.py

@@ -58,7 +58,7 @@ def clear_update_notifications():
 @prefill_task
 def update_latest_version(self: MonitoredTask):
     """Update latest version info"""
-    if CONFIG.get_bool("disable_update_check"):
+    if CONFIG.y_bool("disable_update_check"):
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_status(TaskResult(TaskResultStatus.WARNING, messages=["Version check disabled."]))
         return

authentik/admin/tests/test_api.py

@@ -94,11 +94,6 @@ class TestAdminAPI(TestCase):
         response = self.client.get(reverse("authentik_api:apps-list"))
         self.assertEqual(response.status_code, 200)
 
-    def test_models(self):
-        """Test models API"""
-        response = self.client.get(reverse("authentik_api:models-list"))
-        self.assertEqual(response.status_code, 200)
-
     @reconcile_app("authentik_outposts")
     def test_system(self):
         """Test system API"""

authentik/admin/urls.py

@@ -1,7 +1,7 @@
 """API URLs"""
 from django.urls import path
 
-from authentik.admin.api.meta import AppsViewSet, ModelViewSet
+from authentik.admin.api.meta import AppsViewSet
 from authentik.admin.api.metrics import AdministrationMetricsViewSet
 from authentik.admin.api.system import SystemView
 from authentik.admin.api.tasks import TaskViewSet
@@ -11,7 +11,6 @@ from authentik.admin.api.workers import WorkerView
 api_urlpatterns = [
     ("admin/system_tasks", TaskViewSet, "admin_system_tasks"),
     ("admin/apps", AppsViewSet, "apps"),
-    ("admin/models", ModelViewSet, "models"),
     path(
         "admin/metrics/",
         AdministrationMetricsViewSet.as_view(),

authentik/api/templates/api/browser.html

@@ -10,6 +10,8 @@ API Browser - {{ tenant.branding_title }}
 <script src="{% static 'dist/standalone/api-browser/index.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#151515" media="(prefers-color-scheme: light)">
 <meta name="theme-color" content="#151515" media="(prefers-color-scheme: dark)">
+<link rel="icon" href="{{ tenant.branding_favicon }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% endblock %}
 
 {% block body %}

authentik/api/tests/test_auth.py

@@ -9,7 +9,7 @@ from rest_framework.exceptions import AuthenticationFailed
 
 from authentik.api.authentication import bearer_auth
 from authentik.blueprints.tests import reconcile_app
-from authentik.core.models import Token, TokenIntents, User, UserTypes
+from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.lib.generators import generate_id
 from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
@@ -57,8 +57,8 @@ class TestAPIAuth(TestCase):
     @reconcile_app("authentik_outposts")
     def test_managed_outpost_success(self):
         """Test managed outpost"""
-        user: User = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
-        self.assertEqual(user.type, UserTypes.INTERNAL_SERVICE_ACCOUNT)
+        user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
+        self.assertEqual(user.attributes[USER_ATTRIBUTE_SA], True)
 
     def test_jwt_valid(self):
         """Test valid JWT"""

authentik/api/v3/config.py

@@ -3,7 +3,6 @@ from pathlib import Path
 
 from django.conf import settings
 from django.db import models
-from django.dispatch import Signal
 from drf_spectacular.utils import extend_schema
 from rest_framework.fields import (
     BooleanField,
@@ -22,8 +21,6 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.events.geo import GEOIP_READER
 from authentik.lib.config import CONFIG
 
-capabilities = Signal()
-
 
 class Capabilities(models.TextChoices):
     """Define capabilities which influence which APIs can/should be used"""
@@ -70,15 +67,12 @@ class ConfigView(APIView):
             caps.append(Capabilities.CAN_SAVE_MEDIA)
         if GEOIP_READER.enabled:
             caps.append(Capabilities.CAN_GEO_IP)
-        if CONFIG.get_bool("impersonation"):
+        if CONFIG.y_bool("impersonation"):
             caps.append(Capabilities.CAN_IMPERSONATE)
         if settings.DEBUG:  # pragma: no cover
             caps.append(Capabilities.CAN_DEBUG)
         if "authentik.enterprise" in settings.INSTALLED_APPS:
             caps.append(Capabilities.IS_ENTERPRISE)
-        for _, result in capabilities.send(sender=self):
-            if result:
-                caps.append(result)
         return caps
 
     def get_config(self) -> ConfigSerializer:
@@ -86,17 +80,17 @@ class ConfigView(APIView):
         return ConfigSerializer(
             {
                 "error_reporting": {
-                    "enabled": CONFIG.get("error_reporting.enabled"),
-                    "sentry_dsn": CONFIG.get("error_reporting.sentry_dsn"),
-                    "environment": CONFIG.get("error_reporting.environment"),
-                    "send_pii": CONFIG.get("error_reporting.send_pii"),
-                    "traces_sample_rate": float(CONFIG.get("error_reporting.sample_rate", 0.4)),
+                    "enabled": CONFIG.y("error_reporting.enabled"),
+                    "sentry_dsn": CONFIG.y("error_reporting.sentry_dsn"),
+                    "environment": CONFIG.y("error_reporting.environment"),
+                    "send_pii": CONFIG.y("error_reporting.send_pii"),
+                    "traces_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.4)),
                 },
                 "capabilities": self.get_capabilities(),
-                "cache_timeout": int(CONFIG.get("redis.cache_timeout")),
-                "cache_timeout_flows": int(CONFIG.get("redis.cache_timeout_flows")),
-                "cache_timeout_policies": int(CONFIG.get("redis.cache_timeout_policies")),
-                "cache_timeout_reputation": int(CONFIG.get("redis.cache_timeout_reputation")),
+                "cache_timeout": int(CONFIG.y("redis.cache_timeout")),
+                "cache_timeout_flows": int(CONFIG.y("redis.cache_timeout_flows")),
+                "cache_timeout_policies": int(CONFIG.y("redis.cache_timeout_policies")),
+                "cache_timeout_reputation": int(CONFIG.y("redis.cache_timeout_reputation")),
             }
         )
 

authentik/blueprints/migrations/0001_initial.py

@@ -30,7 +30,7 @@ def check_blueprint_v1_file(BlueprintInstance: type, path: Path):
             return
         blueprint_file.seek(0)
     instance: BlueprintInstance = BlueprintInstance.objects.filter(path=path).first()
-    rel_path = path.relative_to(Path(CONFIG.get("blueprints_dir")))
+    rel_path = path.relative_to(Path(CONFIG.y("blueprints_dir")))
     meta = None
     if metadata:
         meta = from_dict(BlueprintMetadata, metadata)
@@ -55,7 +55,7 @@ def migration_blueprint_import(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
     Flow = apps.get_model("authentik_flows", "Flow")
 
     db_alias = schema_editor.connection.alias
-    for file in glob(f"{CONFIG.get('blueprints_dir')}/**/*.yaml", recursive=True):
+    for file in glob(f"{CONFIG.y('blueprints_dir')}/**/*.yaml", recursive=True):
         check_blueprint_v1_file(BlueprintInstance, Path(file))
 
     for blueprint in BlueprintInstance.objects.using(db_alias).all():

authentik/blueprints/models.py

@@ -82,7 +82,7 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     def retrieve_file(self) -> str:
         """Get blueprint from path"""
         try:
-            base = Path(CONFIG.get("blueprints_dir"))
+            base = Path(CONFIG.y("blueprints_dir"))
             full_path = base.joinpath(Path(self.path)).resolve()
             if not str(full_path).startswith(str(base.resolve())):
                 raise BlueprintRetrievalFailed("Invalid blueprint path")

authentik/blueprints/tests/fixtures/conditional_fields.yaml

@@ -11,37 +11,31 @@ metadata:
 entries:
   - model: authentik_core.token
     identifiers:
-      identifier: "%(uid)s-token"
+      identifier: %(uid)s-token
     attrs:
-      key: "%(uid)s"
-      user: "%(user)s"
+      key: %(uid)s
+      user: %(user)s
       intent: api
   - model: authentik_core.application
     identifiers:
-      slug: "%(uid)s-app"
+      slug: %(uid)s-app
     attrs:
-      name: "%(uid)s-app"
+      name: %(uid)s-app
       icon: https://goauthentik.io/img/icon.png
   - model: authentik_sources_oauth.oauthsource
     identifiers:
-      slug: "%(uid)s-source"
+      slug: %(uid)s-source
     attrs:
-      name: "%(uid)s-source"
+      name: %(uid)s-source
       provider_type: azuread
-      consumer_key: "%(uid)s"
-      consumer_secret: "%(uid)s"
+      consumer_key: %(uid)s
+      consumer_secret: %(uid)s
       icon: https://goauthentik.io/img/icon.png
   - model: authentik_flows.flow
     identifiers:
-      slug: "%(uid)s-flow"
+      slug: %(uid)s-flow
     attrs:
-      name: "%(uid)s-flow"
-      title: "%(uid)s-flow"
+      name: %(uid)s-flow
+      title: %(uid)s-flow
       designation: authentication
       background: https://goauthentik.io/img/icon.png
-  - model: authentik_core.user
-    identifiers:
-      username: "%(uid)s"
-    attrs:
-      name: "%(uid)s"
-      password: "%(uid)s"

authentik/blueprints/tests/test_v1_conditional_fields.py

@@ -2,7 +2,7 @@
 from django.test import TransactionTestCase
 
 from authentik.blueprints.v1.importer import Importer
-from authentik.core.models import Application, Token, User
+from authentik.core.models import Application, Token
 from authentik.core.tests.utils import create_test_admin_user
 from authentik.flows.models import Flow
 from authentik.lib.generators import generate_id
@@ -45,9 +45,3 @@ class TestBlueprintsV1ConditionalFields(TransactionTestCase):
         flow = Flow.objects.filter(slug=f"{self.uid}-flow").first()
         self.assertIsNotNone(flow)
         self.assertEqual(flow.background, "https://goauthentik.io/img/icon.png")
-
-    def test_user(self):
-        """Test user"""
-        user: User = User.objects.filter(username=self.uid).first()
-        self.assertIsNotNone(user)
-        self.assertTrue(user.check_password(self.uid))

authentik/blueprints/v1/tasks.py

@@ -62,7 +62,7 @@ def start_blueprint_watcher():
     if _file_watcher_started:
         return
     observer = Observer()
-    observer.schedule(BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True)
+    observer.schedule(BlueprintEventHandler(), CONFIG.y("blueprints_dir"), recursive=True)
     observer.start()
     _file_watcher_started = True
 
@@ -80,7 +80,7 @@ class BlueprintEventHandler(FileSystemEventHandler):
             blueprints_discovery.delay()
         if isinstance(event, FileModifiedEvent):
             path = Path(event.src_path)
-            root = Path(CONFIG.get("blueprints_dir")).absolute()
+            root = Path(CONFIG.y("blueprints_dir")).absolute()
             rel_path = str(path.relative_to(root))
             for instance in BlueprintInstance.objects.filter(path=rel_path):
                 LOGGER.debug("modified blueprint file, starting apply", instance=instance)
@@ -101,7 +101,7 @@ def blueprints_find_dict():
 def blueprints_find():
     """Find blueprints and return valid ones"""
     blueprints = []
-    root = Path(CONFIG.get("blueprints_dir"))
+    root = Path(CONFIG.y("blueprints_dir"))
     for path in root.rglob("**/*.yaml"):
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):
@@ -185,9 +185,9 @@ def apply_blueprint(self: MonitoredTask, instance_pk: str):
     instance: Optional[BlueprintInstance] = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
+        self.set_uid(slugify(instance.name))
         if not instance or not instance.enabled:
             return
-        self.set_uid(slugify(instance.name))
         blueprint_content = instance.retrieve()
         file_hash = sha512(blueprint_content.encode()).hexdigest()
         importer = Importer(blueprint_content, instance.context)

authentik/core/api/groups.py

@@ -1,6 +1,5 @@
 """Groups API Viewset"""
 from json import loads
-from typing import Optional
 
 from django.db.models.query import QuerySet
 from django.http import Http404
@@ -53,14 +52,6 @@ class GroupSerializer(ModelSerializer):
 
     num_pk = IntegerField(read_only=True)
 
-    def validate_parent(self, parent: Optional[Group]):
-        """Validate group parent (if set), ensuring the parent isn't itself"""
-        if not self.instance or not parent:
-            return parent
-        if str(parent.group_uuid) == str(self.instance.group_uuid):
-            raise ValidationError("Cannot set group as parent of itself.")
-        return parent
-
     class Meta:
         model = Group
         fields = [

authentik/core/api/tokens.py

@@ -33,7 +33,7 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
-            self.fields["key"] = CharField(required=False)
+            self.fields["key"] = CharField()
 
     def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
         """Ensure only API or App password tokens are created."""

authentik/core/api/users.py

@@ -15,7 +15,7 @@ from django.utils.http import urlencode
 from django.utils.text import slugify
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
-from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter, UUIDFilter
+from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter
 from django_filters.filterset import FilterSet
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import (
@@ -51,7 +51,6 @@ from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import CoordinateSerializer
 from authentik.api.decorators import permission_required
-from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
 from authentik.core.middleware import (
@@ -59,6 +58,7 @@ from authentik.core.middleware import (
     SESSION_KEY_IMPERSONATE_USER,
 )
 from authentik.core.models import (
+    USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
     USER_PATH_SERVICE_ACCOUNT,
     AuthenticatedSession,
@@ -66,7 +66,6 @@ from authentik.core.models import (
     Token,
     TokenIntents,
     User,
-    UserTypes,
 )
 from authentik.events.models import Event, EventAction
 from authentik.flows.exceptions import FlowNonApplicableException
@@ -114,30 +113,6 @@ class UserSerializer(ModelSerializer):
     uid = CharField(read_only=True)
     username = CharField(max_length=150, validators=[UniqueValidator(queryset=User.objects.all())])
 
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
-            self.fields["password"] = CharField(required=False)
-
-    def create(self, validated_data: dict) -> User:
-        """If this serializer is used in the blueprint context, we allow for
-        directly setting a password. However should be done via the `set_password`
-        method instead of directly setting it like rest_framework."""
-        instance: User = super().create(validated_data)
-        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
-            instance.set_password(validated_data["password"])
-            instance.save()
-        return instance
-
-    def update(self, instance: User, validated_data: dict) -> User:
-        """Same as `create` above, set the password directly if we're in a blueprint
-        context"""
-        instance = super().update(instance, validated_data)
-        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
-            instance.set_password(validated_data["password"])
-            instance.save()
-        return instance
-
     def validate_path(self, path: str) -> str:
         """Validate path"""
         if path[:1] == "/" or path[-1] == "/":
@@ -147,18 +122,6 @@ class UserSerializer(ModelSerializer):
                 raise ValidationError(_("No empty segments in user path allowed."))
         return path
 
-    def validate_type(self, user_type: str) -> str:
-        """Validate user type, internal_service_account is an internal value"""
-        if (
-            self.instance
-            and self.instance.type == UserTypes.INTERNAL_SERVICE_ACCOUNT
-            and user_type != UserTypes.INTERNAL_SERVICE_ACCOUNT.value
-        ):
-            raise ValidationError("Can't change internal service account to other user type.")
-        if not self.instance and user_type == UserTypes.INTERNAL_SERVICE_ACCOUNT.value:
-            raise ValidationError("Setting a user to internal service account is not allowed.")
-        return user_type
-
     class Meta:
         model = User
         fields = [
@@ -175,7 +138,6 @@ class UserSerializer(ModelSerializer):
             "attributes",
             "uid",
             "path",
-            "type",
         ]
         extra_kwargs = {
             "name": {"allow_blank": True},
@@ -224,7 +186,6 @@ class UserSelfSerializer(ModelSerializer):
             "avatar",
             "uid",
             "settings",
-            "type",
         ]
         extra_kwargs = {
             "is_active": {"read_only": True},
@@ -298,7 +259,7 @@ class UsersFilter(FilterSet):
     )
 
     is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")
-    uuid = UUIDFilter(field_name="uuid")
+    uuid = CharFilter(field_name="uuid")
 
     path = CharFilter(
         field_name="path",
@@ -343,7 +304,6 @@ class UsersFilter(FilterSet):
             "attributes",
             "groups_by_name",
             "groups_by_pk",
-            "type",
         ]
 
 
@@ -436,8 +396,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 user: User = User.objects.create(
                     username=username,
                     name=username,
-                    type=UserTypes.SERVICE_ACCOUNT,
-                    attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: expiring},
+                    attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: expiring},
                     path=USER_PATH_SERVICE_ACCOUNT,
                 )
                 user.set_unusable_password()
@@ -596,7 +555,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     @action(detail=True, methods=["POST"])
     def impersonate(self, request: Request, pk: int) -> Response:
         """Impersonate a user"""
-        if not CONFIG.get_bool("impersonation"):
+        if not CONFIG.y_bool("impersonation"):
             LOGGER.debug("User attempted to impersonate", user=request.user)
             return Response(status=401)
         if not request.user.has_perm("impersonate"):

authentik/core/management/commands/worker.py

@@ -1,40 +0,0 @@
-"""Run worker"""
-from sys import exit as sysexit
-from tempfile import tempdir
-
-from celery.apps.worker import Worker
-from django.core.management.base import BaseCommand
-from django.db import close_old_connections
-from structlog.stdlib import get_logger
-
-from authentik.lib.config import CONFIG
-from authentik.root.celery import CELERY_APP
-
-LOGGER = get_logger()
-
-
-class Command(BaseCommand):
-    """Run worker"""
-
-    def handle(self, **options):
-        close_old_connections()
-        if CONFIG.get_bool("remote_debug"):
-            import debugpy
-
-            debugpy.listen(("0.0.0.0", 6900))  # nosec
-        worker: Worker = CELERY_APP.Worker(
-            no_color=False,
-            quiet=True,
-            optimization="fair",
-            max_tasks_per_child=1,
-            autoscale=(3, 1),
-            task_events=True,
-            beat=True,
-            schedule_filename=f"{tempdir}/celerybeat-schedule",
-            queues=["authentik", "authentik_scheduled", "authentik_events"],
-        )
-        for task in CELERY_APP.tasks:
-            LOGGER.debug("Registered task", task=task)
-
-        worker.start()
-        sysexit(worker.exitcode)

authentik/core/migrations/0029_provider_backchannel_applications_and_more.py

@@ -11,7 +11,7 @@ def backport_is_backchannel(apps: Apps, schema_editor: BaseDatabaseSchemaEditor)
 
     for model in BackchannelProvider.__subclasses__():
         try:
-            for obj in model.objects.only("is_backchannel"):
+            for obj in model.objects.all():
                 obj.is_backchannel = True
                 obj.save()
         except (DatabaseError, InternalError, ProgrammingError):

authentik/core/migrations/0030_user_type.py

@@ -1,43 +0,0 @@
-# Generated by Django 4.1.7 on 2023-05-21 11:44
-
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-
-def migrate_user_type(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    User = apps.get_model("authentik_core", "User")
-
-    from authentik.core.models import UserTypes
-
-    for user in User.objects.using(db_alias).all():
-        user.type = UserTypes.DEFAULT
-        if "goauthentik.io/user/service-account" in user.attributes:
-            user.type = UserTypes.SERVICE_ACCOUNT
-        if "goauthentik.io/user/override-ips" in user.attributes:
-            user.type = UserTypes.INTERNAL_SERVICE_ACCOUNT
-        user.save()
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("authentik_core", "0029_provider_backchannel_applications_and_more"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="user",
-            name="type",
-            field=models.TextField(
-                choices=[
-                    ("default", "Default"),
-                    ("external", "External"),
-                    ("service_account", "Service Account"),
-                    ("internal_service_account", "Internal Service Account"),
-                ],
-                default="default",
-            ),
-        ),
-        migrations.RunPython(migrate_user_type),
-    ]

authentik/core/models.py

@@ -5,6 +5,7 @@ from typing import Any, Optional
 from uuid import uuid4
 
 from deepmerge import always_merger
+from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.models import AbstractUser
 from django.contrib.auth.models import UserManager as DjangoUserManager
@@ -32,10 +33,10 @@ from authentik.lib.models import (
 )
 from authentik.lib.utils.http import get_client_ip
 from authentik.policies.models import PolicyBindingModel
-from authentik.root.install_id import get_install_id
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
+USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
 USER_ATTRIBUTE_GENERATED = "goauthentik.io/user/generated"
 USER_ATTRIBUTE_EXPIRES = "goauthentik.io/user/expires"
 USER_ATTRIBUTE_DELETE_ON_LOGOUT = "goauthentik.io/user/delete-on-logout"
@@ -44,6 +45,8 @@ USER_ATTRIBUTE_TOKEN_EXPIRING = "goauthentik.io/user/token-expires"  # nosec
 USER_ATTRIBUTE_CHANGE_USERNAME = "goauthentik.io/user/can-change-username"
 USER_ATTRIBUTE_CHANGE_NAME = "goauthentik.io/user/can-change-name"
 USER_ATTRIBUTE_CHANGE_EMAIL = "goauthentik.io/user/can-change-email"
+USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
+
 USER_PATH_SYSTEM_PREFIX = "goauthentik.io"
 USER_PATH_SERVICE_ACCOUNT = USER_PATH_SYSTEM_PREFIX + "/service-accounts"
 
@@ -60,22 +63,7 @@ def default_token_key():
     """Default token key"""
     # We use generate_id since the chars in the key should be easy
     # to use in Emails (for verification) and URLs (for recovery)
-    return generate_id(int(CONFIG.get("default_token_length")))
-
-
-class UserTypes(models.TextChoices):
-    """User types, both for grouping, licensing and permissions in the case
-    of the internal_service_account"""
-
-    DEFAULT = "default"
-    EXTERNAL = "external"
-
-    # User-created service accounts
-    SERVICE_ACCOUNT = "service_account"
-
-    # Special user type for internally managed and created service
-    # accounts, such as outpost users
-    INTERNAL_SERVICE_ACCOUNT = "internal_service_account"
+    return generate_id(int(CONFIG.y("default_token_length")))
 
 
 class Group(SerializerModel):
@@ -161,7 +149,6 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     uuid = models.UUIDField(default=uuid4, editable=False, unique=True)
     name = models.TextField(help_text=_("User's display name."))
     path = models.TextField(default="users")
-    type = models.TextField(choices=UserTypes.choices, default=UserTypes.DEFAULT)
 
     sources = models.ManyToManyField("Source", through="UserSourceConnection")
     ak_groups = models.ManyToManyField("Group", related_name="users")
@@ -230,7 +217,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def uid(self) -> str:
         """Generate a globally unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{get_install_id()}".encode("ascii")).hexdigest()
+        return sha256(f"{self.id}-{settings.SECRET_KEY}".encode("ascii")).hexdigest()
 
     def locale(self, request: Optional[HttpRequest] = None) -> str:
         """Get the locale the user has configured"""
@@ -389,10 +376,10 @@ class Application(SerializerModel, PolicyBindingModel):
     def get_launch_url(self, user: Optional["User"] = None) -> Optional[str]:
         """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
         url = None
+        if provider := self.get_provider():
+            url = provider.launch_url
         if self.meta_launch_url:
             url = self.meta_launch_url
-        elif provider := self.get_provider():
-            url = provider.launch_url
         if user and url:
             if isinstance(user, SimpleLazyObject):
                 user._setup()

authentik/core/signals.py

@@ -1,4 +1,6 @@
 """authentik core signals"""
+from typing import TYPE_CHECKING
+
 from django.contrib.auth.signals import user_logged_in, user_logged_out
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
@@ -8,13 +10,16 @@ from django.db.models.signals import post_save, pre_delete, pre_save
 from django.dispatch import receiver
 from django.http.request import HttpRequest
 
-from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider, User
+from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider
 
 # Arguments: user: User, password: str
 password_changed = Signal()
 # Arguments: credentials: dict[str, any], request: HttpRequest, stage: Stage
 login_failed = Signal()
 
+if TYPE_CHECKING:
+    from authentik.core.models import User
+
 
 @receiver(post_save, sender=Application)
 def post_save_application(sender: type[Model], instance, created: bool, **_):
@@ -30,7 +35,7 @@ def post_save_application(sender: type[Model], instance, created: bool, **_):
 
 
 @receiver(user_logged_in)
-def user_logged_in_session(sender, request: HttpRequest, user: User, **_):
+def user_logged_in_session(sender, request: HttpRequest, user: "User", **_):
     """Create an AuthenticatedSession from request"""
 
     session = AuthenticatedSession.from_request(request, user)
@@ -39,7 +44,7 @@ def user_logged_in_session(sender, request: HttpRequest, user: User, **_):
 
 
 @receiver(user_logged_out)
-def user_logged_out_session(sender, request: HttpRequest, user: User, **_):
+def user_logged_out_session(sender, request: HttpRequest, user: "User", **_):
     """Delete AuthenticatedSession if it exists"""
     AuthenticatedSession.objects.filter(session_key=request.session.session_key).delete()
 

authentik/core/templates/base/skeleton.html

@@ -8,8 +8,7 @@
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
         <title>{% block title %}{% trans title|default:tenant.branding_title %}{% endblock %}</title>
-        <link rel="icon" href="{{ tenant.branding_favicon }}">
-        <link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
+        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
         {% block head_before %}
         {% endblock %}
         <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">

authentik/core/templates/if/admin.html

@@ -6,6 +6,8 @@
 <script src="{% static 'dist/admin/AdminInterface.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#18191a" media="(prefers-color-scheme: dark)">
 <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
+<link rel="icon" href="{{ tenant.branding_favicon }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% include "base/header_js.html" %}
 {% endblock %}
 

authentik/core/templates/if/flow.html

@@ -5,6 +5,8 @@
 {% block head_before %}
 {{ block.super }}
 <link rel="prefetch" href="{{ flow.background_url }}" />
+<link rel="icon" href="{{ tenant.branding_favicon }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% if flow.compatibility_mode and not inspector %}
 <script>ShadyDOM = { force: !navigator.webdriver };</script>
 {% endif %}

authentik/core/templates/if/user.html

@@ -6,6 +6,8 @@
 <script src="{% static 'dist/user/UserInterface.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#1c1e21" media="(prefers-color-scheme: light)">
 <meta name="theme-color" content="#1c1e21" media="(prefers-color-scheme: dark)">
+<link rel="icon" href="{{ tenant.branding_favicon }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% include "base/header_js.html" %}
 {% endblock %}
 

authentik/core/tests/test_groups_api.py

@@ -67,16 +67,3 @@ class TestGroupsAPI(APITestCase):
             },
         )
         self.assertEqual(res.status_code, 404)
-
-    def test_parent_self(self):
-        """Test parent"""
-        group = Group.objects.create(name=generate_id())
-        self.client.force_login(self.admin)
-        res = self.client.patch(
-            reverse("authentik_api:group-detail", kwargs={"pk": group.pk}),
-            data={
-                "pk": self.user.pk + 3,
-                "parent": group.pk,
-            },
-        )
-        self.assertEqual(res.status_code, 400)

authentik/core/tests/test_users_api.py

@@ -8,11 +8,11 @@ from django.urls.base import reverse
 from rest_framework.test import APITestCase
 
 from authentik.core.models import (
+    USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
     AuthenticatedSession,
     Token,
     User,
-    UserTypes,
 )
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow, create_test_tenant
 from authentik.flows.models import FlowDesignation
@@ -141,8 +141,7 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            type=UserTypes.SERVICE_ACCOUNT,
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -167,8 +166,7 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            type=UserTypes.SERVICE_ACCOUNT,
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: False},
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: False, USER_ATTRIBUTE_SA: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -194,8 +192,7 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            type=UserTypes.SERVICE_ACCOUNT,
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -221,8 +218,7 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            type=UserTypes.SERVICE_ACCOUNT,
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()

authentik/core/types.py

@@ -8,7 +8,7 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.flows.challenge import Challenge
 
 
-@dataclass(slots=True)
+@dataclass
 class UILoginButton:
     """Dataclass for Source's ui_login_button"""
 

authentik/crypto/builder.py

@@ -7,7 +7,7 @@ from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import ec, rsa
-from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
+from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES
 from cryptography.x509.oid import NameOID
 
 from authentik import __version__
@@ -40,7 +40,7 @@ class CertificateBuilder:
         self.cert.save()
         return self.cert
 
-    def generate_private_key(self) -> PrivateKeyTypes:
+    def generate_private_key(self) -> PRIVATE_KEY_TYPES:
         """Generate private key"""
         if self._use_ec_private_key:
             return ec.generate_private_key(curve=ec.SECP256R1)

authentik/crypto/models.py

@@ -6,7 +6,7 @@ from uuid import uuid4
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes, PublicKeyTypes
+from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES, PUBLIC_KEY_TYPES
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
 from cryptography.x509 import Certificate, load_pem_x509_certificate
 from django.db import models
@@ -37,8 +37,8 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     )
 
     _cert: Optional[Certificate] = None
-    _private_key: Optional[PrivateKeyTypes] = None
-    _public_key: Optional[PublicKeyTypes] = None
+    _private_key: Optional[PRIVATE_KEY_TYPES] = None
+    _public_key: Optional[PUBLIC_KEY_TYPES] = None
 
     @property
     def serializer(self) -> Serializer:
@@ -56,7 +56,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return self._cert
 
     @property
-    def public_key(self) -> Optional[PublicKeyTypes]:
+    def public_key(self) -> Optional[PUBLIC_KEY_TYPES]:
         """Get public key of the private key"""
         if not self._public_key:
             self._public_key = self.private_key.public_key()
@@ -65,7 +65,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     @property
     def private_key(
         self,
-    ) -> Optional[PrivateKeyTypes]:
+    ) -> Optional[PRIVATE_KEY_TYPES]:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self.key_data != "":
             try:

authentik/crypto/tasks.py

@@ -46,7 +46,7 @@ def certificate_discovery(self: MonitoredTask):
     certs = {}
     private_keys = {}
     discovered = 0
-    for file in glob(CONFIG.get("cert_discovery_dir") + "/**", recursive=True):
+    for file in glob(CONFIG.y("cert_discovery_dir") + "/**", recursive=True):
         path = Path(file)
         if not path.exists():
             continue

authentik/enterprise/api.py

@@ -1,154 +0,0 @@
-"""Enterprise API Views"""
-from datetime import datetime, timedelta
-
-from django.utils.timezone import now
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import extend_schema, inline_serializer
-from rest_framework.decorators import action
-from rest_framework.fields import BooleanField, CharField, DateTimeField, IntegerField
-from rest_framework.permissions import IsAdminUser, IsAuthenticated
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer
-from rest_framework.viewsets import ModelViewSet
-
-from authentik.api.decorators import permission_required
-from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import User, UserTypes
-from authentik.enterprise.models import License, LicenseKey
-from authentik.root.install_id import get_install_id
-
-
-class LicenseSerializer(ModelSerializer):
-    """License Serializer"""
-
-    def validate_key(self, key: str) -> str:
-        """Validate the license key (install_id and signature)"""
-        LicenseKey.validate(key)
-        return key
-
-    class Meta:
-        model = License
-        fields = [
-            "license_uuid",
-            "name",
-            "key",
-            "expiry",
-            "users",
-            "external_users",
-        ]
-        extra_kwargs = {
-            "name": {"read_only": True},
-            "expiry": {"read_only": True},
-            "users": {"read_only": True},
-            "external_users": {"read_only": True},
-        }
-
-
-class LicenseSummary(PassiveSerializer):
-    """Serializer for license status"""
-
-    users = IntegerField(required=True)
-    external_users = IntegerField(required=True)
-    valid = BooleanField()
-    show_admin_warning = BooleanField()
-    show_user_warning = BooleanField()
-    read_only = BooleanField()
-    latest_valid = DateTimeField()
-    has_license = BooleanField()
-
-
-class LicenseForecastSerializer(PassiveSerializer):
-    """Serializer for license forecast"""
-
-    users = IntegerField(required=True)
-    external_users = IntegerField(required=True)
-    forecasted_users = IntegerField(required=True)
-    forecasted_external_users = IntegerField(required=True)
-
-
-class LicenseViewSet(UsedByMixin, ModelViewSet):
-    """License Viewset"""
-
-    queryset = License.objects.all()
-    serializer_class = LicenseSerializer
-    search_fields = ["name"]
-    ordering = ["name"]
-    filterset_fields = ["name"]
-
-    @permission_required(None, ["authentik_enterprise.view_license"])
-    @extend_schema(
-        request=OpenApiTypes.NONE,
-        responses={
-            200: inline_serializer("InstallIDSerializer", {"install_id": CharField(required=True)}),
-        },
-    )
-    @action(detail=False, methods=["GET"], permission_classes=[IsAdminUser])
-    def get_install_id(self, request: Request) -> Response:
-        """Get install_id"""
-        return Response(
-            data={
-                "install_id": get_install_id(),
-            }
-        )
-
-    @extend_schema(
-        request=OpenApiTypes.NONE,
-        responses={
-            200: LicenseSummary(),
-        },
-    )
-    @action(detail=False, methods=["GET"], permission_classes=[IsAuthenticated])
-    def summary(self, request: Request) -> Response:
-        """Get the total license status"""
-        total = LicenseKey.get_total()
-        last_valid = LicenseKey.last_valid_date()
-        # TODO: move this to a different place?
-        show_admin_warning = last_valid < now() - timedelta(weeks=2)
-        show_user_warning = last_valid < now() - timedelta(weeks=4)
-        read_only = last_valid < now() - timedelta(weeks=6)
-        latest_valid = datetime.fromtimestamp(total.exp)
-        response = LicenseSummary(
-            data={
-                "users": total.users,
-                "external_users": total.external_users,
-                "valid": total.is_valid(),
-                "show_admin_warning": show_admin_warning,
-                "show_user_warning": show_user_warning,
-                "read_only": read_only,
-                "latest_valid": latest_valid,
-                "has_license": License.objects.all().count() > 0,
-            }
-        )
-        response.is_valid(raise_exception=True)
-        return Response(response.data)
-
-    @permission_required(None, ["authentik_enterprise.view_license"])
-    @extend_schema(
-        request=OpenApiTypes.NONE,
-        responses={
-            200: LicenseForecastSerializer(),
-        },
-    )
-    @action(detail=False, methods=["GET"])
-    def forecast(self, request: Request) -> Response:
-        """Forecast how many users will be required in a year"""
-        last_month = now() - timedelta(days=30)
-        # Forecast for default users
-        users_in_last_month = User.objects.filter(
-            type=UserTypes.DEFAULT, date_joined__gte=last_month
-        ).count()
-        # Forecast for external users
-        external_in_last_month = LicenseKey.get_external_user_count()
-        forecast_for_months = 12
-        response = LicenseForecastSerializer(
-            data={
-                "users": LicenseKey.get_default_user_count(),
-                "external_users": LicenseKey.get_external_user_count(),
-                "forecasted_users": (users_in_last_month * forecast_for_months),
-                "forecasted_external_users": (external_in_last_month * forecast_for_months),
-            }
-        )
-        response.is_valid(raise_exception=True)
-        return Response(response.data)

authentik/enterprise/apps.py

@@ -9,7 +9,3 @@ class AuthentikEnterpriseConfig(ManagedAppConfig):
     label = "authentik_enterprise"
     verbose_name = "authentik Enterprise"
     default = True
-
-    def reconcile_load_enterprise_signals(self):
-        """Load enterprise signals"""
-        self.import_module("authentik.enterprise.signals")

authentik/enterprise/migrations/0001_initial.py

@@ -1,52 +0,0 @@
-# Generated by Django 4.1.10 on 2023-07-06 12:51
-
-import uuid
-
-from django.db import migrations, models
-
-import authentik.enterprise.models
-
-
-class Migration(migrations.Migration):
-    initial = True
-
-    dependencies = []
-
-    operations = [
-        migrations.CreateModel(
-            name="License",
-            fields=[
-                (
-                    "license_uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                ("key", models.TextField(unique=True)),
-                ("name", models.TextField()),
-                ("expiry", models.DateTimeField()),
-                ("users", models.BigIntegerField()),
-                ("external_users", models.BigIntegerField()),
-            ],
-        ),
-        migrations.CreateModel(
-            name="LicenseUsage",
-            fields=[
-                ("expiring", models.BooleanField(default=True)),
-                ("expires", models.DateTimeField(default=authentik.enterprise.models.usage_expiry)),
-                (
-                    "usage_uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                ("user_count", models.BigIntegerField()),
-                ("external_user_count", models.BigIntegerField()),
-                ("within_limits", models.BooleanField()),
-                ("record_date", models.DateTimeField(auto_now_add=True)),
-            ],
-            options={
-                "abstract": False,
-            },
-        ),
-    ]

authentik/enterprise/models.py

@@ -1,185 +0,0 @@
-"""Enterprise models"""
-from base64 import b64decode
-from binascii import Error
-from dataclasses import dataclass, field
-from datetime import datetime, timedelta
-from enum import Enum
-from functools import lru_cache
-from time import mktime
-from uuid import uuid4
-
-from cryptography.exceptions import InvalidSignature
-from cryptography.x509 import Certificate, load_pem_x509_certificate
-from dacite import from_dict
-from django.db import models
-from django.db.models.query import QuerySet
-from django.utils.timezone import now
-from guardian.shortcuts import get_anonymous_user
-from jwt import PyJWTError, decode, get_unverified_header
-from rest_framework.exceptions import ValidationError
-
-from authentik.core.models import ExpiringModel, User, UserTypes
-from authentik.root.install_id import get_install_id
-
-
-@lru_cache()
-def get_licensing_key() -> Certificate:
-    """Get Root CA PEM"""
-    with open("authentik/enterprise/public.pem", "rb") as _key:
-        return load_pem_x509_certificate(_key.read())
-
-
-def get_license_aud() -> str:
-    """Get the JWT audience field"""
-    return f"enterprise.goauthentik.io/license/{get_install_id()}"
-
-
-class LicenseFlags(Enum):
-    """License flags"""
-
-
-@dataclass
-class LicenseKey:
-    """License JWT claims"""
-
-    aud: str
-    exp: int
-
-    name: str
-    users: int
-    external_users: int
-    flags: list[LicenseFlags] = field(default_factory=list)
-
-    @staticmethod
-    def validate(jwt: str) -> "LicenseKey":
-        """Validate the license from a given JWT"""
-        try:
-            headers = get_unverified_header(jwt)
-        except PyJWTError:
-            raise ValidationError("Unable to verify license")
-        x5c: list[str] = headers.get("x5c", [])
-        if len(x5c) < 1:
-            raise ValidationError("Unable to verify license")
-        try:
-            our_cert = load_pem_x509_certificate(b64decode(x5c[0]))
-            intermediate = load_pem_x509_certificate(b64decode(x5c[1]))
-            our_cert.verify_directly_issued_by(intermediate)
-            intermediate.verify_directly_issued_by(get_licensing_key())
-        except (InvalidSignature, TypeError, ValueError, Error):
-            raise ValidationError("Unable to verify license")
-        try:
-            body = from_dict(
-                LicenseKey,
-                decode(
-                    jwt,
-                    our_cert.public_key(),
-                    algorithms=["ES521"],
-                    audience=get_license_aud(),
-                ),
-            )
-        except PyJWTError:
-            raise ValidationError("Unable to verify license")
-        return body
-
-    @staticmethod
-    def get_total() -> "LicenseKey":
-        """Get a summarized version of all (not expired) licenses"""
-        active_licenses = License.objects.filter(expiry__gte=now())
-        total = LicenseKey(get_license_aud(), 0, "Summarized license", 0, 0)
-        for lic in active_licenses:
-            total.users += lic.users
-            total.external_users += lic.external_users
-            exp_ts = int(mktime(lic.expiry.timetuple()))
-            if total.exp == 0:
-                total.exp = exp_ts
-            if exp_ts <= total.exp:
-                total.exp = exp_ts
-            total.flags.extend(lic.status.flags)
-        return total
-
-    @staticmethod
-    def base_user_qs() -> QuerySet:
-        """Base query set for all users"""
-        return User.objects.all().exclude(pk=get_anonymous_user().pk)
-
-    @staticmethod
-    def get_default_user_count():
-        """Get current default user count"""
-        return LicenseKey.base_user_qs().filter(type=UserTypes.DEFAULT).count()
-
-    @staticmethod
-    def get_external_user_count():
-        """Get current external user count"""
-        # Count since start of the month
-        last_month = now().replace(day=1)
-        return (
-            LicenseKey.base_user_qs()
-            .filter(type=UserTypes.EXTERNAL, last_login__gte=last_month)
-            .count()
-        )
-
-    def is_valid(self) -> bool:
-        """Check if the given license body covers all users
-
-        Only checks the current count, no historical data is checked"""
-        default_users = self.get_default_user_count()
-        if default_users > self.users:
-            return False
-        active_users = self.get_external_user_count()
-        if active_users > self.external_users:
-            return False
-        return True
-
-    def record_usage(self):
-        """Capture the current validity status and metrics and save them"""
-        LicenseUsage.objects.create(
-            user_count=self.get_default_user_count(),
-            external_user_count=self.get_external_user_count(),
-            within_limits=self.is_valid(),
-        )
-
-    @staticmethod
-    def last_valid_date() -> datetime:
-        """Get the last date the license was valid"""
-        usage: LicenseUsage = (
-            LicenseUsage.filter_not_expired(within_limits=True).order_by("-record_date").first()
-        )
-        if not usage:
-            return now()
-        return usage.record_date
-
-
-class License(models.Model):
-    """An authentik enterprise license"""
-
-    license_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
-    key = models.TextField(unique=True)
-
-    name = models.TextField()
-    expiry = models.DateTimeField()
-    users = models.BigIntegerField()
-    external_users = models.BigIntegerField()
-
-    @property
-    def status(self) -> LicenseKey:
-        """Get parsed license status"""
-        return LicenseKey.validate(self.key)
-
-
-def usage_expiry():
-    """Keep license usage records for 3 months"""
-    return now() + timedelta(days=30 * 3)
-
-
-class LicenseUsage(ExpiringModel):
-    """a single license usage record"""
-
-    expires = models.DateTimeField(default=usage_expiry)
-
-    usage_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
-
-    user_count = models.BigIntegerField()
-    external_user_count = models.BigIntegerField()
-    within_limits = models.BooleanField()
-
-    record_date = models.DateTimeField(auto_now_add=True)

authentik/enterprise/policy.py

@@ -1,46 +0,0 @@
-"""Enterprise license policies"""
-from typing import Optional
-
-from rest_framework.serializers import BaseSerializer
-
-from authentik.core.models import User, UserTypes
-from authentik.enterprise.models import LicenseKey
-from authentik.policies.models import Policy
-from authentik.policies.types import PolicyRequest, PolicyResult
-from authentik.policies.views import PolicyAccessView
-
-
-class EnterprisePolicy(Policy):
-    """Check that a user is correctly licensed for the request"""
-
-    @property
-    def component(self) -> str:
-        return ""
-
-    @property
-    def serializer(self) -> type[BaseSerializer]:
-        raise NotImplementedError
-
-    def passes(self, request: PolicyRequest) -> PolicyResult:
-        if not LicenseKey.get_total().is_valid():
-            return PolicyResult(False)
-        if request.user.type != UserTypes.DEFAULT:
-            return PolicyResult(False)
-        return PolicyResult(True)
-
-
-class EnterprisePolicyAccessView(PolicyAccessView):
-    """PolicyAccessView which also checks enterprise licensing"""
-
-    def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
-        user = user or self.request.user
-        request = PolicyRequest(user)
-        request.http_request = self.request
-        result = super().user_has_access(user)
-        enterprise_result = EnterprisePolicy().passes(request)
-        if not enterprise_result.passing:
-            return enterprise_result
-        return result
-
-    def resolve_provider_application(self):
-        raise NotImplementedError

authentik/enterprise/public.pem

@@ -1,26 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEdzCCA/6gAwIBAgIUQrj1jxn4q/BB38B2SwTrvGyrZLMwCgYIKoZIzj0EAwMw
-ge8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
-YW4gRnJhbmNpc2NvMSQwIgYDVQQJExs1NDggTWFya2V0IFN0cmVldCBQbWIgNzAx
-NDgxDjAMBgNVBBETBTk0MTA0MSAwHgYDVQQKExdBdXRoZW50aWsgU2VjdXJpdHkg
-SW5jLjEcMBoGA1UECxMTRW50ZXJwcmlzZSBMaWNlbnNlczE9MDsGA1UEAxM0QXV0
-aGVudGlrIFNlY3VyaXR5IEluYy4gRW50ZXJwcmlzZSBMaWNlbnNpbmcgUm9vdCBY
-MTAgFw0yMzA3MDQxNzQ3NDBaGA8yMTIzMDYxMDE3NDgxMFowge8xCzAJBgNVBAYT
-AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
-MSQwIgYDVQQJExs1NDggTWFya2V0IFN0cmVldCBQbWIgNzAxNDgxDjAMBgNVBBET
-BTk0MTA0MSAwHgYDVQQKExdBdXRoZW50aWsgU2VjdXJpdHkgSW5jLjEcMBoGA1UE
-CxMTRW50ZXJwcmlzZSBMaWNlbnNlczE9MDsGA1UEAxM0QXV0aGVudGlrIFNlY3Vy
-aXR5IEluYy4gRW50ZXJwcmlzZSBMaWNlbnNpbmcgUm9vdCBYMTB2MBAGByqGSM49
-AgEGBSuBBAAiA2IABNbPJH6nDbSshpDsDHBRL0UcZVXWCK30txqcMKU+YFmLB6iR
-PJiHjHA8Z+5aP4eNH6onA5xqykQf65tvbFBA1LB/6HqMArU/tYVVQx4+o9hRBxF5
-RrzXucUg2br+RX8aa6OCAVUwggFRMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBRHpR3/ptPgN0yHVfUjyJOEmsPZqTAfBgNVHSMEGDAW
-gBRHpR3/ptPgN0yHVfUjyJOEmsPZqTCBoAYIKwYBBQUHAQEEgZMwgZAwRwYIKwYB
-BQUHMAGGO2h0dHBzOi8vdmF1bHQuY3VzdG9tZXJzLmdvYXV0aGVudGlrLmlvL3Yx
-L2xpY2Vuc2luZy1jYS9vY3NwMEUGCCsGAQUFBzAChjlodHRwczovL3ZhdWx0LmN1
-c3RvbWVycy5nb2F1dGhlbnRpay5pby92MS9saWNlbnNpbmctY2EvY2EwSwYDVR0f
-BEQwQjBAoD6gPIY6aHR0cHM6Ly92YXVsdC5jdXN0b21lcnMuZ29hdXRoZW50aWsu
-aW8vdjEvbGljZW5zaW5nLWNhL2NybDAKBggqhkjOPQQDAwNnADBkAjB0+YA1yjEO
-g43CCYUJXz9m9CNIkjOPUI0jO4UtvSj8j067TKRbX6IL/29HxPtQoYACME8eZHBJ
-Ljcog0oeBgjr4wK8bobgknr5wrm70rrNNpbSAjDvTvXMQeAShGgsftEquQ==
------END CERTIFICATE-----

authentik/enterprise/settings.py

@@ -1,12 +1 @@
 """Enterprise additional settings"""
-from celery.schedules import crontab
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "enterprise_calculate_license": {
-        "task": "authentik.enterprise.tasks.calculate_license",
-        "schedule": crontab(minute=fqdn_rand("calculate_license"), hour="*/8"),
-        "options": {"queue": "authentik_scheduled"},
-    }
-}

authentik/enterprise/signals.py

@@ -1,18 +0,0 @@
-"""Enterprise signals"""
-from datetime import datetime
-
-from django.db.models.signals import pre_save
-from django.dispatch import receiver
-from django.utils.timezone import get_current_timezone
-
-from authentik.enterprise.models import License
-
-
-@receiver(pre_save, sender=License)
-def pre_save_license(sender: type[License], instance: License, **_):
-    """Extract data from license jwt and save it into model"""
-    status = instance.status
-    instance.name = status.name
-    instance.users = status.users
-    instance.external_users = status.external_users
-    instance.expiry = datetime.fromtimestamp(status.exp, tz=get_current_timezone())

authentik/enterprise/tasks.py

@@ -1,10 +0,0 @@
-"""Enterprise tasks"""
-from authentik.enterprise.models import LicenseKey
-from authentik.root.celery import CELERY_APP
-
-
-@CELERY_APP.task()
-def calculate_license():
-    """Calculate licensing status"""
-    total = LicenseKey.get_total()
-    total.record_usage()

authentik/enterprise/tests/test_license.py

@@ -1,64 +0,0 @@
-"""Enterprise license tests"""
-from datetime import timedelta
-from time import mktime
-from unittest.mock import MagicMock, patch
-
-from django.test import TestCase
-from django.utils.timezone import now
-from rest_framework.exceptions import ValidationError
-
-from authentik.enterprise.models import License, LicenseKey
-from authentik.lib.generators import generate_id
-
-_exp = int(mktime((now() + timedelta(days=3000)).timetuple()))
-
-
-class TestEnterpriseLicense(TestCase):
-    """Enterprise license tests"""
-
-    @patch(
-        "authentik.enterprise.models.LicenseKey.validate",
-        MagicMock(
-            return_value=LicenseKey(
-                aud="",
-                exp=_exp,
-                name=generate_id(),
-                users=100,
-                external_users=100,
-            )
-        ),
-    )
-    def test_valid(self):
-        """Check license verification"""
-        lic = License.objects.create(key=generate_id())
-        self.assertTrue(lic.status.is_valid())
-        self.assertEqual(lic.users, 100)
-
-    def test_invalid(self):
-        """Test invalid license"""
-        with self.assertRaises(ValidationError):
-            License.objects.create(key=generate_id())
-
-    @patch(
-        "authentik.enterprise.models.LicenseKey.validate",
-        MagicMock(
-            return_value=LicenseKey(
-                aud="",
-                exp=_exp,
-                name=generate_id(),
-                users=100,
-                external_users=100,
-            )
-        ),
-    )
-    def test_valid_multiple(self):
-        """Check license verification"""
-        lic = License.objects.create(key=generate_id())
-        self.assertTrue(lic.status.is_valid())
-        lic2 = License.objects.create(key=generate_id())
-        self.assertTrue(lic2.status.is_valid())
-        total = LicenseKey.get_total()
-        self.assertEqual(total.users, 200)
-        self.assertEqual(total.external_users, 200)
-        self.assertEqual(total.exp, _exp)
-        self.assertTrue(total.is_valid())

authentik/enterprise/urls.py

@@ -1,7 +0,0 @@
-"""API URLs"""
-
-from authentik.enterprise.api import LicenseViewSet
-
-api_urlpatterns = [
-    ("enterprise/license", LicenseViewSet),
-]

authentik/events/geo.py

@@ -33,7 +33,7 @@ class GeoIPReader:
 
     def __open(self):
         """Get GeoIP Reader, if configured, otherwise none"""
-        path = CONFIG.get("geoip")
+        path = CONFIG.y("geoip")
         if path == "" or not path:
             return
         try:
@@ -46,7 +46,7 @@ class GeoIPReader:
     def __check_expired(self):
         """Check if the modification date of the GeoIP database has
         changed, and reload it if so"""
-        path = CONFIG.get("geoip")
+        path = CONFIG.y("geoip")
         try:
             mtime = stat(path).st_mtime
             diff = self.__last_mtime < mtime

authentik/events/monitored_tasks.py

@@ -41,7 +41,6 @@ class TaskResult:
 
     def with_error(self, exc: Exception) -> "TaskResult":
         """Since errors might not always be pickle-able, set the traceback"""
-        # TODO: Mark exception somehow so that is rendered as <pre> in frontend
         self.messages.append(exception_to_string(exc))
         return self
 
@@ -70,10 +69,8 @@ class TaskInfo:
         return cache.get_many(cache.keys(CACHE_KEY_PREFIX + "*"))
 
     @staticmethod
-    def by_name(name: str) -> Optional["TaskInfo"] | Optional[list["TaskInfo"]]:
+    def by_name(name: str) -> Optional["TaskInfo"]:
         """Get TaskInfo Object by name"""
-        if "*" in name:
-            return cache.get_many(cache.keys(CACHE_KEY_PREFIX + name)).values()
         return cache.get(CACHE_KEY_PREFIX + name, None)
 
     def delete(self):
@@ -92,7 +89,7 @@ class TaskInfo:
         GAUGE_TASKS.labels(
             task_name=self.task_name.split(":")[0],
             task_uid=self.result.uid or "",
-            status=self.result.status.name.lower(),
+            status=self.result.status.value,
         ).set(duration)
 
     def save(self, timeout_hours=6):

authentik/flows/challenge.py

@@ -154,7 +154,7 @@ class AutosubmitChallenge(Challenge):
     """Autosubmit challenge used to send and navigate a POST request"""
 
     url = CharField()
-    attrs = DictField(child=CharField(allow_blank=True), allow_empty=True)
+    attrs = DictField(child=CharField())
     title = CharField(required=False)
     component = CharField(default="ak-stage-autosubmit")
 

authentik/flows/markers.py

@@ -30,7 +30,7 @@ class StageMarker:
         return binding
 
 
-@dataclass(slots=True)
+@dataclass
 class ReevaluateMarker(StageMarker):
     """Reevaluate Marker, forces stage's policies to be evaluated again."""
 

authentik/flows/planner.py

@@ -33,7 +33,7 @@ PLAN_CONTEXT_SOURCE = "source"
 # Is set by the Flow Planner when a FlowToken was used, and the currently active flow plan
 # was restored.
 PLAN_CONTEXT_IS_RESTORED = "is_restored"
-CACHE_TIMEOUT = int(CONFIG.get("redis.cache_timeout_flows"))
+CACHE_TIMEOUT = int(CONFIG.y("redis.cache_timeout_flows"))
 CACHE_PREFIX = "goauthentik.io/flows/planner/"
 
 
@@ -45,7 +45,7 @@ def cache_key(flow: Flow, user: Optional[User] = None) -> str:
     return prefix
 
 
-@dataclass(slots=True)
+@dataclass
 class FlowPlan:
     """This data-class is the output of a FlowPlanner. It holds a flat list
     of all Stages that should be run."""

authentik/flows/tests/test_challenges.py

@@ -1,28 +0,0 @@
-"""flow views tests"""
-from django.test import TestCase
-
-from authentik.flows.challenge import AutosubmitChallenge, ChallengeTypes
-
-
-class TestChallenges(TestCase):
-    """Test generic challenges"""
-
-    def test_autosubmit_blank(self):
-        """Test blank autosubmit"""
-        challenge = AutosubmitChallenge(
-            data={
-                "type": ChallengeTypes.NATIVE.value,
-                "url": "http://localhost",
-                "attrs": {},
-            }
-        )
-        self.assertTrue(challenge.is_valid(raise_exception=True))
-        # Test with an empty value
-        challenge = AutosubmitChallenge(
-            data={
-                "type": ChallengeTypes.NATIVE.value,
-                "url": "http://localhost",
-                "attrs": {"foo": ""},
-            }
-        )
-        self.assertTrue(challenge.is_valid(raise_exception=True))

authentik/flows/tests/test_executor.py

@@ -18,6 +18,7 @@ from authentik.flows.planner import FlowPlan, FlowPlanner
 from authentik.flows.stage import PLAN_CONTEXT_PENDING_USER_IDENTIFIER, StageView
 from authentik.flows.tests import FlowTestCase
 from authentik.flows.views.executor import NEXT_ARG_NAME, SESSION_KEY_PLAN, FlowExecutorView
+from authentik.lib.config import CONFIG
 from authentik.lib.generators import generate_id
 from authentik.policies.dummy.models import DummyPolicy
 from authentik.policies.models import PolicyBinding
@@ -84,6 +85,7 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
+        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )
@@ -109,6 +111,7 @@ class TestFlowExecutor(FlowTestCase):
             denied_action=FlowDeniedAction.CONTINUE,
         )
 
+        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )
@@ -125,6 +128,7 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
+        CONFIG.update_from_dict({"domain": "testserver"})
         dest = "/unique-string"
         url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
         response = self.client.get(url + f"?{NEXT_ARG_NAME}={dest}")
@@ -141,6 +145,7 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
+        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )

authentik/flows/views/inspector.py

@@ -23,7 +23,6 @@ from authentik.flows.api.bindings import FlowStageBindingSerializer
 from authentik.flows.models import Flow
 from authentik.flows.planner import FlowPlan
 from authentik.flows.views.executor import SESSION_KEY_HISTORY, SESSION_KEY_PLAN
-from authentik.root.install_id import get_install_id
 
 
 class FlowInspectorPlanSerializer(PassiveSerializer):
@@ -52,7 +51,7 @@ class FlowInspectorPlanSerializer(PassiveSerializer):
         """Get a unique session ID"""
         request: Request = self.context["request"]
         return sha256(
-            f"{request._request.session.session_key}-{get_install_id()}".encode("ascii")
+            f"{request._request.session.session_key}-{settings.SECRET_KEY}".encode("ascii")
         ).hexdigest()
 
 

authentik/lib/avatars.py

@@ -175,7 +175,7 @@ def get_avatar(user: "User") -> str:
         "initials": avatar_mode_generated,
         "gravatar": avatar_mode_gravatar,
     }
-    modes: str = CONFIG.get("avatars", "none")
+    modes: str = CONFIG.y("avatars", "none")
     for mode in modes.split(","):
         avatar = None
         if mode in mode_map:

authentik/lib/config.py

@@ -2,15 +2,13 @@
 import os
 from collections.abc import Mapping
 from contextlib import contextmanager
-from dataclasses import dataclass, field
-from enum import Enum
 from glob import glob
-from json import JSONEncoder, dumps, loads
+from json import dumps, loads
 from json.decoder import JSONDecodeError
 from pathlib import Path
 from sys import argv, stderr
 from time import time
-from typing import Any, Optional
+from typing import Any
 from urllib.parse import urlparse
 
 import yaml
@@ -34,44 +32,15 @@ def get_path_from_dict(root: dict, path: str, sep=".", default=None) -> Any:
     return root
 
 
-@dataclass
-class Attr:
-    """Single configuration attribute"""
-
-    class Source(Enum):
-        """Sources a configuration attribute can come from, determines what should be done with
-        Attr.source (and if it's set at all)"""
-
-        UNSPECIFIED = "unspecified"
-        ENV = "env"
-        CONFIG_FILE = "config_file"
-        URI = "uri"
-
-    value: Any
-
-    source_type: Source = field(default=Source.UNSPECIFIED)
-
-    # depending on source_type, might contain the environment variable or the path
-    # to the config file containing this change or the file containing this value
-    source: Optional[str] = field(default=None)
-
-
-class AttrEncoder(JSONEncoder):
-    """JSON encoder that can deal with `Attr` classes"""
-
-    def default(self, o: Any) -> Any:
-        if isinstance(o, Attr):
-            return o.value
-        return super().default(o)
-
-
 class ConfigLoader:
     """Search through SEARCH_PATHS and load configuration. Environment variables starting with
     `ENV_PREFIX` are also applied.
 
     A variable like AUTHENTIK_POSTGRESQL__HOST would translate to postgresql.host"""
 
-    def __init__(self, **kwargs):
+    loaded_file = []
+
+    def __init__(self):
         super().__init__()
         self.__config = {}
         base_dir = Path(__file__).parent.joinpath(Path("../..")).resolve()
@@ -96,7 +65,6 @@ class ConfigLoader:
                         # Update config with env file
                         self.update_from_file(env_file)
         self.update_from_env()
-        self.update(self.__config, kwargs)
 
     def log(self, level: str, message: str, **kwargs):
         """Custom Log method, we want to ensure ConfigLoader always logs JSON even when
@@ -118,34 +86,22 @@ class ConfigLoader:
             else:
                 if isinstance(value, str):
                     value = self.parse_uri(value)
-                elif isinstance(value, Attr) and isinstance(value.value, str):
-                    value = self.parse_uri(value.value)
-                elif not isinstance(value, Attr):
-                    value = Attr(value)
                 root[key] = value
         return root
 
-    def refresh(self, key: str):
-        """Update a single value"""
-        attr: Attr = get_path_from_dict(self.raw, key)
-        if attr.source_type != Attr.Source.URI:
-            return
-        attr.value = self.parse_uri(attr.source).value
-
-    def parse_uri(self, value: str) -> Attr:
+    def parse_uri(self, value: str) -> str:
         """Parse string values which start with a URI"""
         url = urlparse(value)
-        parsed_value = value
         if url.scheme == "env":
-            parsed_value = os.getenv(url.netloc, url.query)
+            value = os.getenv(url.netloc, url.query)
         if url.scheme == "file":
             try:
                 with open(url.path, "r", encoding="utf8") as _file:
-                    parsed_value = _file.read().strip()
+                    value = _file.read().strip()
             except OSError as exc:
                 self.log("error", f"Failed to read config value from {url.path}: {exc}")
-                parsed_value = url.query
-        return Attr(parsed_value, Attr.Source.URI, value)
+                value = url.query
+        return value
 
     def update_from_file(self, path: Path):
         """Update config from file contents"""
@@ -154,6 +110,7 @@ class ConfigLoader:
                 try:
                     self.update(self.__config, yaml.safe_load(file))
                     self.log("debug", "Loaded config", file=str(path))
+                    self.loaded_file.append(path)
                 except yaml.YAMLError as exc:
                     raise ImproperlyConfigured from exc
         except PermissionError as exc:
@@ -164,6 +121,10 @@ class ConfigLoader:
                 error=str(exc),
             )
 
+    def update_from_dict(self, update: dict):
+        """Update config from dict"""
+        self.__config.update(update)
+
     def update_from_env(self):
         """Check environment variables"""
         outer = {}
@@ -184,7 +145,7 @@ class ConfigLoader:
                 value = loads(value)
             except JSONDecodeError:
                 pass
-            current_obj[dot_parts[-1]] = Attr(value, Attr.Source.ENV, key)
+            current_obj[dot_parts[-1]] = value
             idx += 1
         if idx > 0:
             self.log("debug", "Loaded environment variables", count=idx)
@@ -193,32 +154,28 @@ class ConfigLoader:
     @contextmanager
     def patch(self, path: str, value: Any):
         """Context manager for unittests to patch a value"""
-        original_value = self.get(path)
-        self.set(path, value)
+        original_value = self.y(path)
+        self.y_set(path, value)
         try:
             yield
         finally:
-            self.set(path, original_value)
+            self.y_set(path, original_value)
 
     @property
     def raw(self) -> dict:
         """Get raw config dictionary"""
         return self.__config
 
-    def get(self, path: str, default=None, sep=".") -> Any:
+    # pylint: disable=invalid-name
+    def y(self, path: str, default=None, sep=".") -> Any:
         """Access attribute by using yaml path"""
         # Walk sub_dicts before parsing path
         root = self.raw
         # Walk each component of the path
-        attr: Attr = get_path_from_dict(root, path, sep=sep, default=Attr(default))
-        return attr.value
+        return get_path_from_dict(root, path, sep=sep, default=default)
 
-    def get_bool(self, path: str, default=False) -> bool:
-        """Wrapper for get that converts value into boolean"""
-        return str(self.get(path, default)).lower() == "true"
-
-    def set(self, path: str, value: Any, sep="."):
-        """Set value using same syntax as get()"""
+    def y_set(self, path: str, value: Any, sep="."):
+        """Set value using same syntax as y()"""
         # Walk sub_dicts before parsing path
         root = self.raw
         # Walk each component of the path
@@ -227,14 +184,17 @@ class ConfigLoader:
             if comp not in root:
                 root[comp] = {}
             root = root.get(comp, {})
-        root[path_parts[-1]] = Attr(value)
+        root[path_parts[-1]] = value
+
+    def y_bool(self, path: str, default=False) -> bool:
+        """Wrapper for y that converts value into boolean"""
+        return str(self.y(path, default)).lower() == "true"
 
 
 CONFIG = ConfigLoader()
 
-
 if __name__ == "__main__":
     if len(argv) < 2:
-        print(dumps(CONFIG.raw, indent=4, cls=AttrEncoder))
+        print(dumps(CONFIG.raw, indent=4))
     else:
-        print(CONFIG.get(argv[1]))
+        print(CONFIG.y(argv[1]))

authentik/lib/default.yml

@@ -33,7 +33,6 @@ redis:
   cache_timeout_reputation: 300
 
 debug: false
-remote_debug: false
 
 log_level: info
 
@@ -73,7 +72,6 @@ outposts:
 
 ldap:
   task_timeout_hours: 2
-  page_size: 50
   tls:
     ciphers: null
 

authentik/lib/sentry.py

@@ -51,18 +51,18 @@ class SentryTransport(HttpTransport):
 
 def sentry_init(**sentry_init_kwargs):
     """Configure sentry SDK"""
-    sentry_env = CONFIG.get("error_reporting.environment", "customer")
+    sentry_env = CONFIG.y("error_reporting.environment", "customer")
     kwargs = {
         "environment": sentry_env,
-        "send_default_pii": CONFIG.get_bool("error_reporting.send_pii", False),
+        "send_default_pii": CONFIG.y_bool("error_reporting.send_pii", False),
         "_experiments": {
-            "profiles_sample_rate": float(CONFIG.get("error_reporting.sample_rate", 0.1)),
+            "profiles_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.1)),
         },
     }
     kwargs.update(**sentry_init_kwargs)
     # pylint: disable=abstract-class-instantiated
     sentry_sdk_init(
-        dsn=CONFIG.get("error_reporting.sentry_dsn"),
+        dsn=CONFIG.y("error_reporting.sentry_dsn"),
         integrations=[
             ArgvIntegration(),
             StdlibIntegration(),
@@ -92,7 +92,7 @@ def traces_sampler(sampling_context: dict) -> float:
         return 0
     if _type == "websocket":
         return 0
-    return float(CONFIG.get("error_reporting.sample_rate", 0.1))
+    return float(CONFIG.y("error_reporting.sample_rate", 0.1))
 
 
 def before_send(event: dict, hint: dict) -> Optional[dict]:

authentik/lib/tests/test_config.py

@@ -16,23 +16,23 @@ class TestConfig(TestCase):
         config = ConfigLoader()
         environ[ENV_PREFIX + "_test__test"] = "bar"
         config.update_from_env()
-        self.assertEqual(config.get("test.test"), "bar")
+        self.assertEqual(config.y("test.test"), "bar")
 
     def test_patch(self):
         """Test patch decorator"""
         config = ConfigLoader()
-        config.set("foo.bar", "bar")
-        self.assertEqual(config.get("foo.bar"), "bar")
+        config.y_set("foo.bar", "bar")
+        self.assertEqual(config.y("foo.bar"), "bar")
         with config.patch("foo.bar", "baz"):
-            self.assertEqual(config.get("foo.bar"), "baz")
-        self.assertEqual(config.get("foo.bar"), "bar")
+            self.assertEqual(config.y("foo.bar"), "baz")
+        self.assertEqual(config.y("foo.bar"), "bar")
 
     def test_uri_env(self):
         """Test URI parsing (environment)"""
         config = ConfigLoader()
         environ["foo"] = "bar"
-        self.assertEqual(config.parse_uri("env://foo").value, "bar")
-        self.assertEqual(config.parse_uri("env://foo?bar").value, "bar")
+        self.assertEqual(config.parse_uri("env://foo"), "bar")
+        self.assertEqual(config.parse_uri("env://foo?bar"), "bar")
 
     def test_uri_file(self):
         """Test URI parsing (file load)"""
@@ -41,31 +41,11 @@ class TestConfig(TestCase):
         write(file, "foo".encode())
         _, file2_name = mkstemp()
         chmod(file2_name, 0o000)  # Remove all permissions so we can't read the file
-        self.assertEqual(config.parse_uri(f"file://{file_name}").value, "foo")
-        self.assertEqual(config.parse_uri(f"file://{file2_name}?def").value, "def")
+        self.assertEqual(config.parse_uri(f"file://{file_name}"), "foo")
+        self.assertEqual(config.parse_uri(f"file://{file2_name}?def"), "def")
         unlink(file_name)
         unlink(file2_name)
 
-    def test_uri_file_update(self):
-        """Test URI parsing (file load and update)"""
-        file, file_name = mkstemp()
-        write(file, "foo".encode())
-        config = ConfigLoader(file_test=f"file://{file_name}")
-        self.assertEqual(config.get("file_test"), "foo")
-
-        # Update config file
-        write(file, "bar".encode())
-        config.refresh("file_test")
-        self.assertEqual(config.get("file_test"), "foobar")
-
-        unlink(file_name)
-
-    def test_uri_env_full(self):
-        """Test URI set as env variable"""
-        environ["AUTHENTIK_TEST_VAR"] = "file:///foo?bar"
-        config = ConfigLoader()
-        self.assertEqual(config.get("test_var"), "bar")
-
     def test_file_update(self):
         """Test update_from_file"""
         config = ConfigLoader()

authentik/lib/tests/test_http.py

@@ -1,7 +1,7 @@
 """Test HTTP Helpers"""
 from django.test import RequestFactory, TestCase
 
-from authentik.core.models import Token, TokenIntents, UserTypes
+from authentik.core.models import USER_ATTRIBUTE_CAN_OVERRIDE_IP, Token, TokenIntents
 from authentik.core.tests.utils import create_test_admin_user
 from authentik.lib.utils.http import OUTPOST_REMOTE_IP_HEADER, OUTPOST_TOKEN_HEADER, get_client_ip
 from authentik.lib.views import bad_request_message
@@ -53,7 +53,7 @@ class TestHTTP(TestCase):
         )
         self.assertEqual(get_client_ip(request), "127.0.0.1")
         # Valid
-        self.user.type = UserTypes.INTERNAL_SERVICE_ACCOUNT
+        self.user.attributes[USER_ATTRIBUTE_CAN_OVERRIDE_IP] = True
         self.user.save()
         request = self.factory.get(
             "/",

authentik/lib/utils/http.py

@@ -33,8 +33,9 @@ def _get_client_ip_from_meta(meta: dict[str, Any]) -> str:
 
 def _get_outpost_override_ip(request: HttpRequest) -> Optional[str]:
     """Get the actual remote IP when set by an outpost. Only
-    allowed when the request is authenticated, by an outpost internal service account"""
-    from authentik.core.models import Token, TokenIntents, UserTypes
+    allowed when the request is authenticated, by a user with USER_ATTRIBUTE_CAN_OVERRIDE_IP set
+    to outpost"""
+    from authentik.core.models import USER_ATTRIBUTE_CAN_OVERRIDE_IP, Token, TokenIntents
 
     if OUTPOST_REMOTE_IP_HEADER not in request.META or OUTPOST_TOKEN_HEADER not in request.META:
         return None
@@ -50,7 +51,7 @@ def _get_outpost_override_ip(request: HttpRequest) -> Optional[str]:
         LOGGER.warning("Attempted remote-ip override without token", fake_ip=fake_ip)
         return None
     user = token.user
-    if user.type != UserTypes.INTERNAL_SERVICE_ACCOUNT:
+    if not user.group_attributes(request).get(USER_ATTRIBUTE_CAN_OVERRIDE_IP, False):
         LOGGER.warning(
             "Remote-IP override: user doesn't have permission",
             user=user,

authentik/lib/utils/reflection.py

@@ -50,7 +50,7 @@ def get_env() -> str:
     """Get environment in which authentik is currently running"""
     if "CI" in os.environ:
         return "ci"
-    if CONFIG.get_bool("debug"):
+    if CONFIG.y_bool("debug"):
         return "dev"
     if SERVICE_HOST_ENV_NAME in os.environ:
         return "kubernetes"

authentik/outposts/channels.py

@@ -28,7 +28,7 @@ class WebsocketMessageInstruction(IntEnum):
     TRIGGER_UPDATE = 2
 
 
-@dataclass(slots=True)
+@dataclass
 class WebsocketMessage:
     """Complete Websocket Message that is being sent"""
 

authentik/outposts/controllers/base.py

@@ -97,7 +97,7 @@ class BaseController:
         if self.outpost.config.container_image is not None:
             return self.outpost.config.container_image
 
-        image_name_template: str = CONFIG.get("outposts.container_image_base")
+        image_name_template: str = CONFIG.y("outposts.container_image_base")
         return image_name_template % {
             "type": self.outpost.type,
             "version": __version__,

authentik/outposts/models.py

@@ -20,12 +20,13 @@ from structlog.stdlib import get_logger
 from authentik import __version__, get_build_hash
 from authentik.blueprints.models import ManagedModel
 from authentik.core.models import (
+    USER_ATTRIBUTE_CAN_OVERRIDE_IP,
+    USER_ATTRIBUTE_SA,
     USER_PATH_SYSTEM_PREFIX,
     Provider,
     Token,
     TokenIntents,
     User,
-    UserTypes,
 )
 from authentik.crypto.models import CertificateKeyPair
 from authentik.events.models import Event, EventAction
@@ -58,7 +59,7 @@ class OutpostConfig:
     authentik_host_insecure: bool = False
     authentik_host_browser: str = ""
 
-    log_level: str = CONFIG.get("log_level")
+    log_level: str = CONFIG.y("log_level")
     object_naming_template: str = field(default="ak-outpost-%(name)s")
 
     container_image: Optional[str] = field(default=None)
@@ -345,7 +346,8 @@ class Outpost(SerializerModel, ManagedModel):
             user: User = User.objects.create(username=self.user_identifier)
             user.set_unusable_password()
             user_created = True
-        user.type = UserTypes.INTERNAL_SERVICE_ACCOUNT
+        user.attributes[USER_ATTRIBUTE_SA] = True
+        user.attributes[USER_ATTRIBUTE_CAN_OVERRIDE_IP] = True
         user.name = f"Outpost {self.name} Service-Account"
         user.path = USER_PATH_OUTPOSTS
         user.save()

authentik/outposts/tasks.py

@@ -256,7 +256,7 @@ def _outpost_single_update(outpost: Outpost, layer=None):
 def outpost_connection_discovery(self: MonitoredTask):
     """Checks the local environment and create Service connections."""
     status = TaskResult(TaskResultStatus.SUCCESSFUL)
-    if not CONFIG.get_bool("outposts.discover"):
+    if not CONFIG.y_bool("outposts.discover"):
         status.messages.append("Outpost integration discovery is disabled")
         self.set_status(status)
         return

authentik/policies/engine.py

@@ -64,7 +64,7 @@ class PolicyEngine:
         self.use_cache = True
         self.__expected_result_count = 0
 
-    def iterate_bindings(self) -> Iterator[PolicyBinding]:
+    def _iter_bindings(self) -> Iterator[PolicyBinding]:
         """Make sure all Policies are their respective classes"""
         return (
             PolicyBinding.objects.filter(target=self.__pbm, enabled=True)
@@ -88,7 +88,7 @@ class PolicyEngine:
             span: Span
             span.set_data("pbm", self.__pbm)
             span.set_data("request", self.request)
-            for binding in self.iterate_bindings():
+            for binding in self._iter_bindings():
                 self.__expected_result_count += 1
 
                 self._check_policy_type(binding)

authentik/policies/event_matcher/api.py

@@ -6,7 +6,7 @@ from rest_framework.viewsets import ModelViewSet
 
 from authentik.core.api.used_by import UsedByMixin
 from authentik.policies.api.policies import PolicySerializer
-from authentik.policies.event_matcher.models import EventMatcherPolicy, app_choices, model_choices
+from authentik.policies.event_matcher.models import EventMatcherPolicy, app_choices
 
 
 class EventMatcherPolicySerializer(PolicySerializer):
@@ -15,30 +15,15 @@ class EventMatcherPolicySerializer(PolicySerializer):
     app = ChoiceField(
         choices=app_choices(),
         required=False,
-        allow_null=True,
+        allow_blank=True,
         help_text=_(
             "Match events created by selected application. When left empty, "
             "all applications are matched."
         ),
     )
-    model = ChoiceField(
-        choices=model_choices(),
-        required=False,
-        allow_null=True,
-        help_text=_(
-            "Match events created by selected model. "
-            "When left empty, all models are matched. When an app is selected, "
-            "all the application's models are matched."
-        ),
-    )
 
     def validate(self, attrs: dict) -> dict:
-        if (
-            attrs["action"] == ""
-            and attrs["client_ip"] == ""
-            and attrs["app"] == ""
-            and attrs["model"] == ""
-        ):
+        if attrs["action"] == "" and attrs["client_ip"] == "" and attrs["app"] == "":
             raise ValidationError(_("At least one criteria must be set."))
         return super().validate(attrs)
 
@@ -48,7 +33,6 @@ class EventMatcherPolicySerializer(PolicySerializer):
             "action",
             "client_ip",
             "app",
-            "model",
         ]
 
 

authentik/policies/event_matcher/migrations/0022_eventmatcherpolicy_model.py

@@ -1,21 +0,0 @@
-# Generated by Django 4.1.7 on 2023-05-29 15:24
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("authentik_policies_event_matcher", "0021_alter_eventmatcherpolicy_app"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="eventmatcherpolicy",
-            name="model",
-            field=models.TextField(
-                blank=True,
-                default="",
-                help_text="Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.",
-            ),
-        ),
-    ]

authentik/policies/event_matcher/migrations/0023_alter_eventmatcherpolicy_action_and_more.py

@@ -1,103 +0,0 @@
-# Generated by Django 4.1.7 on 2023-06-21 12:45
-
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-
-def replace_defaults(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-
-    eventmatcherpolicy = apps.get_model("authentik_policies_event_matcher", "eventmatcherpolicy")
-    for policy in eventmatcherpolicy.objects.using(db_alias).all():
-        changed = False
-        if policy.action == "":
-            policy.action = None
-            changed = True
-        if policy.app == "":
-            policy.app = None
-            changed = True
-        if policy.client_ip == "":
-            policy.client_ip = None
-            changed = True
-        if policy.model == "":
-            policy.model = None
-            changed = True
-        if not changed:
-            continue
-        policy.save()
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("authentik_policies_event_matcher", "0022_eventmatcherpolicy_model"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="eventmatcherpolicy",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("secret_view", "Secret View"),
-                    ("secret_rotate", "Secret Rotate"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("flow_execution", "Flow Execution"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("system_task_execution", "System Task Execution"),
-                    ("system_task_exception", "System Task Exception"),
-                    ("system_exception", "System Exception"),
-                    ("configuration_error", "Configuration Error"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("email_sent", "Email Sent"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ],
-                default=None,
-                help_text="Match created events with this action type. When left empty, all action types will be matched.",
-                null=True,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="eventmatcherpolicy",
-            name="app",
-            field=models.TextField(
-                default=None,
-                help_text="Match events created by selected application. When left empty, all applications are matched.",
-                null=True,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="eventmatcherpolicy",
-            name="client_ip",
-            field=models.TextField(
-                default=None,
-                help_text="Matches Event's Client IP (strict matching, for network matching use an Expression Policy)",
-                null=True,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="eventmatcherpolicy",
-            name="model",
-            field=models.TextField(
-                default=None,
-                help_text="Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.",
-                null=True,
-            ),
-        ),
-        migrations.RunPython(replace_defaults),
-    ]

authentik/policies/event_matcher/models.py

@@ -1,19 +1,13 @@
 """Event Matcher models"""
-from itertools import chain
-
 from django.apps import apps
 from django.db import models
 from django.utils.translation import gettext as _
 from rest_framework.serializers import BaseSerializer
-from structlog.stdlib import get_logger
 
-from authentik.blueprints.v1.importer import is_model_allowed
 from authentik.events.models import Event, EventAction
 from authentik.policies.models import Policy
 from authentik.policies.types import PolicyRequest, PolicyResult
 
-LOGGER = get_logger()
-
 
 def app_choices() -> list[tuple[str, str]]:
     """Get a list of all installed applications that create events.
@@ -25,50 +19,27 @@ def app_choices() -> list[tuple[str, str]]:
     return choices
 
 
-def model_choices() -> list[tuple[str, str]]:
-    """Get a list of all installed models
-    Returns a list of tuples containing (dotted.model.path, name)"""
-    choices = []
-    for model in apps.get_models():
-        if not is_model_allowed(model):
-            continue
-        name = f"{model._meta.app_label}.{model._meta.model_name}"
-        choices.append((name, model._meta.verbose_name))
-    return choices
-
-
 class EventMatcherPolicy(Policy):
     """Passes when Event matches selected criteria."""
 
     action = models.TextField(
         choices=EventAction.choices,
-        null=True,
-        default=None,
+        blank=True,
         help_text=_(
             "Match created events with this action type. "
             "When left empty, all action types will be matched."
         ),
     )
     app = models.TextField(
-        null=True,
-        default=None,
+        blank=True,
+        default="",
         help_text=_(
             "Match events created by selected application. "
             "When left empty, all applications are matched."
         ),
     )
-    model = models.TextField(
-        null=True,
-        default=None,
-        help_text=_(
-            "Match events created by selected model. "
-            "When left empty, all models are matched. When an app is selected, "
-            "all the application's models are matched."
-        ),
-    )
     client_ip = models.TextField(
-        null=True,
-        default=None,
+        blank=True,
         help_text=_(
             "Matches Event's Client IP (strict matching, "
             "for network matching use an Expression Policy)"
@@ -89,55 +60,13 @@ class EventMatcherPolicy(Policy):
         if "event" not in request.context:
             return PolicyResult(False)
         event: Event = request.context["event"]
-        matches: list[PolicyResult] = []
-        messages = []
-        checks = [
-            self.passes_action,
-            self.passes_client_ip,
-            self.passes_app,
-            self.passes_model,
-        ]
-        for checker in checks:
-            result = checker(request, event)
-            if result is None:
-                continue
-            LOGGER.info(
-                "Event matcher check result",
-                checker=checker.__name__,
-                result=result,
-            )
-            matches.append(result)
-        passing = any(x.passing for x in matches)
-        messages = chain(*[x.messages for x in matches])
-        result = PolicyResult(passing, *messages)
-        result.source_results = matches
-        return result
-
-    def passes_action(self, request: PolicyRequest, event: Event) -> PolicyResult | None:
-        """Check if `self.action` matches"""
-        if self.action is None:
-            return None
-        return PolicyResult(self.action == event.action, "Action matched.")
-
-    def passes_client_ip(self, request: PolicyRequest, event: Event) -> PolicyResult | None:
-        """Check if `self.client_ip` matches"""
-        if self.client_ip is None:
-            return None
-        return PolicyResult(self.client_ip == event.client_ip, "Client IP matched.")
-
-    def passes_app(self, request: PolicyRequest, event: Event) -> PolicyResult | None:
-        """Check if `self.app` matches"""
-        if self.app is None:
-            return None
-        return PolicyResult(self.app == event.app, "App matched.")
-
-    def passes_model(self, request: PolicyRequest, event: Event) -> PolicyResult | None:
-        """Check if `self.model` is set, and pass if it matches the event's model"""
-        if self.model is None:
-            return None
-        event_model_info = event.context.get("model", {})
-        event_model = f"{event_model_info.get('app')}.{event_model_info.get('model_name')}"
-        return PolicyResult(event_model == self.model, "Model matched.")
+        if event.action == self.action:
+            return PolicyResult(True, "Action matched.")
+        if event.client_ip == self.client_ip:
+            return PolicyResult(True, "Client IP matched.")
+        if event.app == self.app:
+            return PolicyResult(True, "App matched.")
+        return PolicyResult(False)
 
     class Meta(Policy.PolicyMeta):
         verbose_name = _("Event Matcher Policy")

authentik/policies/event_matcher/tests.py

@@ -42,22 +42,6 @@ class TestEventMatcherPolicy(TestCase):
         self.assertTrue(response.passing)
         self.assertTupleEqual(response.messages, ("App matched.",))
 
-    def test_match_model(self):
-        """Test match model"""
-        event = Event.new(EventAction.LOGIN)
-        event.context = {
-            "model": {
-                "app": "foo",
-                "model_name": "bar",
-            }
-        }
-        request = PolicyRequest(get_anonymous_user())
-        request.context["event"] = event
-        policy: EventMatcherPolicy = EventMatcherPolicy.objects.create(model="foo.bar")
-        response = policy.passes(request)
-        self.assertTrue(response.passing)
-        self.assertTupleEqual(response.messages, ("Model matched.",))
-
     def test_drop(self):
         """Test drop event"""
         event = Event.new(EventAction.LOGIN)
@@ -68,19 +52,6 @@ class TestEventMatcherPolicy(TestCase):
         response = policy.passes(request)
         self.assertFalse(response.passing)
 
-    def test_drop_multiple(self):
-        """Test drop event"""
-        event = Event.new(EventAction.LOGIN)
-        event.app = "foo"
-        event.client_ip = "1.2.3.4"
-        request = PolicyRequest(get_anonymous_user())
-        request.context["event"] = event
-        policy: EventMatcherPolicy = EventMatcherPolicy.objects.create(
-            client_ip="1.2.3.5", app="bar"
-        )
-        response = policy.passes(request)
-        self.assertFalse(response.passing)
-
     def test_invalid(self):
         """Test passing event"""
         request = PolicyRequest(get_anonymous_user())

authentik/policies/process.py

@@ -19,7 +19,7 @@ from authentik.policies.types import CACHE_PREFIX, PolicyRequest, PolicyResult
 LOGGER = get_logger()
 
 FORK_CTX = get_context("fork")
-CACHE_TIMEOUT = int(CONFIG.get("redis.cache_timeout_policies"))
+CACHE_TIMEOUT = int(CONFIG.y("redis.cache_timeout_policies"))
 PROCESS_CLASS = FORK_CTX.Process
 
 

authentik/policies/reputation/signals.py

@@ -13,7 +13,7 @@ from authentik.policies.reputation.tasks import save_reputation
 from authentik.stages.identification.signals import identification_failed
 
 LOGGER = get_logger()
-CACHE_TIMEOUT = int(CONFIG.get("redis.cache_timeout_reputation"))
+CACHE_TIMEOUT = int(CONFIG.y("redis.cache_timeout_reputation"))
 
 
 def update_score(request: HttpRequest, identifier: str, amount: int):

authentik/policies/types.py

@@ -19,7 +19,7 @@ LOGGER = get_logger()
 CACHE_PREFIX = "goauthentik.io/policies/"
 
 
-@dataclass(slots=True)
+@dataclass
 class PolicyRequest:
     """Data-class to hold policy request data"""
 
@@ -27,14 +27,14 @@ class PolicyRequest:
     http_request: Optional[HttpRequest]
     obj: Optional[Model]
     context: dict[str, Any]
-    debug: bool
+    debug: bool = False
 
     def __init__(self, user: User):
+        super().__init__()
         self.user = user
         self.http_request = None
         self.obj = None
         self.context = {}
-        self.debug = False
 
     def set_http_request(self, request: HttpRequest):  # pragma: no cover
         """Load data from HTTP request, including geoip when enabled"""
@@ -67,7 +67,7 @@ class PolicyRequest:
         return text + ">"
 
 
-@dataclass(slots=True)
+@dataclass
 class PolicyResult:
     """Result from evaluating a policy."""
 
@@ -81,6 +81,7 @@ class PolicyResult:
     log_messages: Optional[list[dict]]
 
     def __init__(self, passing: bool, *messages: str):
+        super().__init__()
         self.passing = passing
         self.messages = messages
         self.raw_result = None

authentik/providers/ldap/api.py

@@ -29,7 +29,6 @@ class LDAPProviderSerializer(ProviderSerializer):
             "outpost_set",
             "search_mode",
             "bind_mode",
-            "mfa_support",
         ]
         extra_kwargs = ProviderSerializer.Meta.extra_kwargs
 
@@ -100,16 +99,13 @@ class LDAPOutpostConfigSerializer(ModelSerializer):
             "gid_start_number",
             "search_mode",
             "bind_mode",
-            "mfa_support",
         ]
 
 
 class LDAPOutpostConfigViewSet(ReadOnlyModelViewSet):
     """LDAPProvider Viewset"""
 
-    queryset = LDAPProvider.objects.filter(
-        Q(application__isnull=False) | Q(backchannel_application__isnull=False)
-    )
+    queryset = LDAPProvider.objects.filter(application__isnull=False)
     serializer_class = LDAPOutpostConfigSerializer
     ordering = ["name"]
     search_fields = ["name"]

authentik/providers/ldap/migrations/0003_ldapprovider_mfa_support_and_more.py

@@ -1,37 +0,0 @@
-# Generated by Django 4.1.7 on 2023-06-19 17:30
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("authentik_providers_ldap", "0002_ldapprovider_bind_mode"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="ldapprovider",
-            name="mfa_support",
-            field=models.BooleanField(
-                default=True,
-                help_text="When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.",
-                verbose_name="MFA Support",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="ldapprovider",
-            name="gid_start_number",
-            field=models.IntegerField(
-                default=4000,
-                help_text="The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="ldapprovider",
-            name="uid_start_number",
-            field=models.IntegerField(
-                default=2000,
-                help_text="The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber",
-            ),
-        ),
-    ]

authentik/providers/ldap/models.py

@@ -50,7 +50,7 @@ class LDAPProvider(OutpostModel, BackchannelProvider):
     uid_start_number = models.IntegerField(
         default=2000,
         help_text=_(
-            "The start for uidNumbers, this number is added to the user.pk to make sure that the "
+            "The start for uidNumbers, this number is added to the user.Pk to make sure that the "
             "numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't "
             "collide with local users uidNumber"
         ),
@@ -60,7 +60,7 @@ class LDAPProvider(OutpostModel, BackchannelProvider):
         default=4000,
         help_text=_(
             "The start for gidNumbers, this number is added to a number generated from the "
-            "group.pk to make sure that the numbers aren't too low for POSIX groups. Default "
+            "group.Pk to make sure that the numbers aren't too low for POSIX groups. Default "
             "is 4000 to ensure that we don't collide with local groups or users "
             "primary groups gidNumber"
         ),
@@ -69,17 +69,6 @@ class LDAPProvider(OutpostModel, BackchannelProvider):
     bind_mode = models.TextField(default=APIAccessMode.DIRECT, choices=APIAccessMode.choices)
     search_mode = models.TextField(default=APIAccessMode.DIRECT, choices=APIAccessMode.choices)
 
-    mfa_support = models.BooleanField(
-        default=True,
-        verbose_name="MFA Support",
-        help_text=_(
-            "When enabled, code-based multi-factor authentication can be used by appending a "
-            "semicolon and the TOTP code to the password. This should only be enabled if all "
-            "users that will bind to this provider have a TOTP device configured, as otherwise "
-            "a password may incorrectly be rejected if it contains a semicolon."
-        ),
-    )
-
     @property
     def launch_url(self) -> Optional[str]:
         """LDAP never has a launch URL"""

authentik/providers/ldap/tests/test_api.py

@@ -1,52 +0,0 @@
-"""LDAP Provider API tests"""
-from json import loads
-
-from django.urls import reverse
-from rest_framework.test import APITestCase
-
-from authentik.core.models import Application
-from authentik.core.tests.utils import create_test_admin_user, create_test_flow
-from authentik.lib.generators import generate_id
-from authentik.providers.ldap.models import LDAPProvider
-
-
-class TestLDAPProviderAPI(APITestCase):
-    """LDAP Provider API tests"""
-
-    def test_outpost_application(self):
-        """Test outpost-like provider retrieval (direct connection)"""
-        provider = LDAPProvider.objects.create(
-            name=generate_id(),
-            authorization_flow=create_test_flow(),
-        )
-        Application.objects.create(
-            name=generate_id(),
-            slug=generate_id(),
-            provider=provider,
-        )
-        user = create_test_admin_user()
-        self.client.force_login(user)
-        res = self.client.get(reverse("authentik_api:ldapprovideroutpost-list"))
-        self.assertEqual(res.status_code, 200)
-        data = loads(res.content.decode())
-        self.assertEqual(data["pagination"]["count"], 1)
-        self.assertEqual(len(data["results"]), 1)
-
-    def test_outpost_application_backchannel(self):
-        """Test outpost-like provider retrieval (backchannel connection)"""
-        provider = LDAPProvider.objects.create(
-            name=generate_id(),
-            authorization_flow=create_test_flow(),
-        )
-        app: Application = Application.objects.create(
-            name=generate_id(),
-            slug=generate_id(),
-        )
-        app.backchannel_providers.add(provider)
-        user = create_test_admin_user()
-        self.client.force_login(user)
-        res = self.client.get(reverse("authentik_api:ldapprovideroutpost-list"))
-        self.assertEqual(res.status_code, 200)
-        data = loads(res.content.decode())
-        self.assertEqual(data["pagination"]["count"], 1)
-        self.assertEqual(len(data["results"]), 1)

authentik/providers/ldap/urls.py

@@ -2,6 +2,6 @@
 from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
 
 api_urlpatterns = [
-    ("outposts/ldap", LDAPOutpostConfigViewSet, "ldapprovideroutpost"),
+    ("outposts/ldap", LDAPOutpostConfigViewSet),
     ("providers/ldap", LDAPProviderViewSet),
 ]

authentik/providers/oauth2/constants.py

@@ -19,11 +19,6 @@ SCOPE_OPENID = "openid"
 SCOPE_OPENID_PROFILE = "profile"
 SCOPE_OPENID_EMAIL = "email"
 
-# https://www.iana.org/assignments/oauth-parameters/\
-#   oauth-parameters.xhtml#pkce-code-challenge-method
-PKCE_METHOD_PLAIN = "plain"
-PKCE_METHOD_S256 = "S256"
-
 TOKEN_TYPE = "Bearer"  # nosec
 
 SCOPE_AUTHENTIK_API = "goauthentik.io/api"