release: 2021.2.6-stable

web: fix colourstyles not being included in common_styles
# Conflicts: # authentik/events/geo.py # web/src/elements/buttons/TokenCopyButton.ts
2021-02-27 18:16:46 +01:00 · 2021-02-27 18:16:32 +01:00 · 2021-02-27 17:36:07 +01:00 · 2021-02-27 17:19:43 +01:00 · 2021-02-27 17:04:16 +01:00 · 2021-02-27 17:04:16 +01:00
445 changed files with 14631 additions and 4617 deletions
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.14.1-stable
+current_version = 2021.2.6-stable
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)
@ -31,6 +31,6 @@ values =

 [bumpversion:file:authentik/__init__.py]

-[bumpversion:file:proxy/pkg/version.go]
+[bumpversion:file:outpost/pkg/version.go]

 [bumpversion:file:web/src/constants.ts]
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -16,6 +16,14 @@ updates:
  open-pull-requests-limit: 10
  assignees:
  - BeryJu
+- package-ecosystem: npm
+  directory: "/website"
+  schedule:
+    interval: daily
+    time: "04:00"
+  open-pull-requests-limit: 10
+  assignees:
+  - BeryJu
 - package-ecosystem: pip
  directory: "/"
  schedule:
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -18,11 +18,11 @@ jobs:
      - name: Building Docker Image
        run: docker build
          --no-cache
-          -t beryju/authentik:0.14.1-stable
+          -t beryju/authentik:2021.2.6-stable
          -t beryju/authentik:latest
          -f Dockerfile .
      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik:0.14.1-stable
+        run: docker push beryju/authentik:2021.2.6-stable
      - name: Push Docker Container to Registry (latest)
        run: docker push beryju/authentik:latest
  build-proxy:
@ -34,7 +34,7 @@ jobs:
          go-version: "^1.15"
      - name: prepare go api client
        run: |
-          cd proxy
+          cd outpost
          go get -u github.com/go-swagger/go-swagger/cmd/swagger
          swagger generate client -f ../swagger.yaml -A authentik -t pkg/
          go build -v .
@ -45,14 +45,14 @@ jobs:
        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
      - name: Building Docker Image
        run: |
-          cd proxy/
+          cd outpost/
          docker build \
          --no-cache \
-          -t beryju/authentik-proxy:0.14.1-stable \
+          -t beryju/authentik-proxy:2021.2.6-stable \
          -t beryju/authentik-proxy:latest \
-          -f Dockerfile .
+          -f proxy.Dockerfile .
      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-proxy:0.14.1-stable
+        run: docker push beryju/authentik-proxy:2021.2.6-stable
      - name: Push Docker Container to Registry (latest)
        run: docker push beryju/authentik-proxy:latest
  build-static:
@ -69,11 +69,11 @@ jobs:
          cd web/
          docker build \
          --no-cache \
-          -t beryju/authentik-static:0.14.1-stable \
+          -t beryju/authentik-static:2021.2.6-stable \
          -t beryju/authentik-static:latest \
          -f Dockerfile .
      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-static:0.14.1-stable
+        run: docker push beryju/authentik-static:2021.2.6-stable
      - name: Push Docker Container to Registry (latest)
        run: docker push beryju/authentik-static:latest
  test-release:
@ -107,5 +107,5 @@ jobs:
          SENTRY_PROJECT: authentik
          SENTRY_URL: https://sentry.beryju.org
        with:
-          tagName: 0.14.1-stable
+          tagName: 2021.2.6-stable
          environment: beryjuorg-prod
--- a/Pipfile.lock
+++ b/Pipfile.lock
@ -25,10 +25,10 @@
        },
        "amqp": {
            "hashes": [
-                "sha256:5b9062d5c0812335c75434bf17ce33d7a20ecfedaa0733faec7379868eb4068a",
-                "sha256:fcd5b3baeeb7fc19b3486ff6d10543099d40ae1f5c9196eae695d1cde1b2f784"
+                "sha256:1e759a7f202d910939de6eca45c23a107f6b71111f41d1282c648e9ac3d21901",
+                "sha256:affdd263d8b8eb3c98170b78bf83867cdb6a14901d586e00ddb65bfe2f0c4e60"
            ],
-            "version": "==5.0.2"
+            "version": "==5.0.5"
        },
        "asgiref": {
            "hashes": [
@ -53,10 +53,10 @@
        },
        "autobahn": {
            "hashes": [
-                "sha256:410a93e0e29882c8b5d5ab05d220b07609b886ef5f23c0b8d39153254ffd6895",
-                "sha256:52ee4236ff9a1fcbbd9500439dcf3284284b37f8a6b31ecc8a36e00cf9f95049"
+                "sha256:93df8fc9d1821c9dabff9fed52181a9ad6eea5e9989d53102c391607d7c1666e",
+                "sha256:cceed2121b7a93024daa93c91fae33007f8346f0e522796421f36a6183abea99"
            ],
-            "version": "==20.12.3"
+            "version": "==21.1.1"
        },
        "automat": {
            "hashes": [
@ -74,25 +74,24 @@
        },
        "boto3": {
            "hashes": [
-                "sha256:197926eaf0065c2c503914a15edc75f4ac259c1e5ae6d17eabd1ba5d8ebd1554",
-                "sha256:d6991e6fd7d0f63bf94282687700a91f5299b807e544cb3367e9b2faeeaf8c62"
+                "sha256:d6aafb804fca2b67c65dda78ad8b4afed901e004071208b84c804d345ad9ebba"
            ],
            "index": "pypi",
-            "version": "==1.16.46"
+            "version": "==1.17.5"
        },
        "botocore": {
            "hashes": [
-                "sha256:85ca6915ad5471e7f6cd1b00610b74601d2970cbf8e9b1bf255697154cf621a3",
-                "sha256:f7d365c689070368a5a0857aa35a81d7c950556189f23065f42798f810a59cae"
+                "sha256:04a1df759681f5f171accb354d863bfed0774d64a4e8ee35ff49835755660a4e",
+                "sha256:3c55f0db5e08920727f4fa24a87aed60060643f4b0b5665c62ec762f79e82d6b"
            ],
-            "version": "==1.19.46"
+            "version": "==1.20.5"
        },
        "cachetools": {
            "hashes": [
-                "sha256:3796e1de094f0eaca982441c92ce96c68c89cced4cd97721ab297ea4b16db90e",
-                "sha256:c6b07a6ded8c78bf36730b3dc452dfff7d95f2a12a2fed856b1a0cb13ca78c61"
+                "sha256:1d9d5f567be80f7c07d765e21b814326d78c61eb0c3a637dffc0e5d1796cb2e2",
+                "sha256:f469e29e7aa4cff64d8de4aad95ce76de8ea1125a16c68e0d93f65c3c3dc92e9"
            ],
-            "version": "==4.2.0"
+            "version": "==4.2.1"
        },
        "celery": {
            "hashes": [
@ -127,6 +126,7 @@
                "sha256:6bc25fc545a6b3d57b5f8618e59fc13d3a3a68431e8ca5fd4c13241cd70d0009",
                "sha256:798caa2a2384b1cbe8a2a139d80734c9db54f9cc155c99d7cc92441a23871c03",
                "sha256:7c6b1dece89874d9541fc974917b631406233ea0440d0bdfbb8e03bf39a49b3b",
+                "sha256:7ef7d4ced6b325e92eb4d3502946c78c5367bc416398d387b39591532536734e",
                "sha256:840793c68105fe031f34d6a086eaea153a0cd5c491cde82a74b420edd0a2b909",
                "sha256:8d6603078baf4e11edc4168a514c5ce5b3ba6e3e9c374298cb88437957960a53",
                "sha256:9cc46bc107224ff5b6d04369e7c595acb700c3613ad7bcf2e2012f62ece80c35",
@ -223,22 +223,15 @@
        },
        "cryptography": {
            "hashes": [
-                "sha256:0003a52a123602e1acee177dc90dd201f9bb1e73f24a070db7d36c588e8f5c7d",
-                "sha256:0e85aaae861d0485eb5a79d33226dd6248d2a9f133b81532c8f5aae37de10ff7",
-                "sha256:594a1db4511bc4d960571536abe21b4e5c3003e8750ab8365fafce71c5d86901",
-                "sha256:69e836c9e5ff4373ce6d3ab311c1a2eed274793083858d3cd4c7d12ce20d5f9c",
-                "sha256:788a3c9942df5e4371c199d10383f44a105d67d401fb4304178020142f020244",
-                "sha256:7e177e4bea2de937a584b13645cab32f25e3d96fc0bc4a4cf99c27dc77682be6",
-                "sha256:83d9d2dfec70364a74f4e7c70ad04d3ca2e6a08b703606993407bf46b97868c5",
-                "sha256:84ef7a0c10c24a7773163f917f1cb6b4444597efd505a8aed0a22e8c4780f27e",
-                "sha256:9e21301f7a1e7c03dbea73e8602905a4ebba641547a462b26dd03451e5769e7c",
-                "sha256:9f6b0492d111b43de5f70052e24c1f0951cb9e6022188ebcb1cc3a3d301469b0",
-                "sha256:a69bd3c68b98298f490e84519b954335154917eaab52cf582fa2c5c7efc6e812",
-                "sha256:b4890d5fb9b7a23e3bf8abf5a8a7da8e228f1e97dc96b30b95685df840b6914a",
-                "sha256:c366df0401d1ec4e548bebe8f91d55ebcc0ec3137900d214dd7aac8427ef3030",
-                "sha256:dc42f645f8f3a489c3dd416730a514e7a91a59510ddaadc09d04224c098d3302"
+                "sha256:287032b6a7d86abc98e8e977b20138c53fea40e5b24e29090d5a675a973dcd10",
+                "sha256:288c65eea20bd89b11102c47b118bc1e0749386b0a0dfebba414076c5d4c8188",
+                "sha256:7eed937ad9b53280a5f53570d3a7dc93cb4412b6a3d58d4c6bb78cc26319c729",
+                "sha256:dab437c2e84628703e3358f0f06555a6259bc5039209d51aa3b05af667ff4fd0",
+                "sha256:ee5e19f0856b6fbbdbab15c2787ca65d203801d2d65d0b8de6218f424206c848",
+                "sha256:f21be9ec6b44c223b2024bbe59d394fadc7be320d18a8d595419afadb6cd5620",
+                "sha256:f6ea140d2736b7e1f0de4f988c43f76b0b3f3d365080e091715429ba218dce28"
            ],
-            "version": "==3.3.1"
+            "version": "==3.4.4"
        },
        "dacite": {
            "hashes": [
@ -265,11 +258,11 @@
        },
        "django": {
            "hashes": [
-                "sha256:5c866205f15e7a7123f1eec6ab939d22d5bde1416635cab259684af66d8e48a2",
-                "sha256:edb10b5c45e7e9c0fb1dc00b76ec7449aca258a39ffd613dbd078c51d19c9f03"
+                "sha256:169e2e7b4839a7910b393eec127fd7cbae62e80fa55f89c6510426abf673fe5f",
+                "sha256:c6c0462b8b361f8691171af1fb87eceb4442da28477e12200c40420176206ba7"
            ],
            "index": "pypi",
-            "version": "==3.1.4"
+            "version": "==3.1.6"
        },
        "django-cors-middleware": {
            "hashes": [
@ -351,7 +344,8 @@
        },
        "djangorestframework": {
            "hashes": [
-                "sha256:0209bafcb7b5010fdfec784034f059d512256424de2a0f084cb82b096d6dd6a7"
+                "sha256:0209bafcb7b5010fdfec784034f059d512256424de2a0f084cb82b096d6dd6a7",
+                "sha256:0898182b4737a7b584a2c73735d89816343369f259fea932d90dc78e35d8ac33"
            ],
            "index": "pypi",
            "version": "==3.12.2"
@ -396,10 +390,10 @@
        },
        "google-auth": {
            "hashes": [
-                "sha256:0b0e026b412a0ad096e753907559e4bdb180d9ba9f68dd9036164db4fdc4ad2e",
-                "sha256:ce752cc51c31f479dbf9928435ef4b07514b20261b021c7383bee4bda646acb8"
+                "sha256:008e23ed080674f69f9d2d7d80db4c2591b9bb307d136cea7b3bc129771d211d",
+                "sha256:514e39f4190ca972200ba33876da5a8857c5665f2b4ccc36c8b8ee21228aae80"
            ],
-            "version": "==1.24.0"
+            "version": "==1.25.0"
        },
        "gunicorn": {
            "hashes": [
@ -411,10 +405,10 @@
        },
        "h11": {
            "hashes": [
-                "sha256:3c6c61d69c6f13d41f1b80ab0322f1872702a3ba26e12aa864c928f6a43fbaab",
-                "sha256:ab6c335e1b6ef34b205d5ca3e228c9299cc7218b049819ec84a388c2525e5d87"
+                "sha256:36a3cb8c0a032f56e2da7084577878a035d3b61d104230d4bd49c0c6b555a9c6",
+                "sha256:47222cb6067e4a307d535814917cd98fd0a57b6788ce715755fa2b6c28b56042"
            ],
-            "version": "==0.11.0"
+            "version": "==0.12.0"
        },
        "hiredis": {
            "hashes": [
@ -486,10 +480,10 @@
        },
        "hyperlink": {
            "hashes": [
-                "sha256:47fcc7cd339c6cb2444463ec3277bdcfe142c8b1daf2160bdd52248deec815af",
-                "sha256:c528d405766f15a2c536230de7e160b65a08e20264d8891b3eb03307b0df3c63"
+                "sha256:427af957daa58bc909471c6c40f74c5450fa123dd093fc53efd2e91d2705a56b",
+                "sha256:e6b14c37ecb73e89c77d78cdb4c2cc8f3fb59a885c5b3f819ff4ed80f25af1b4"
            ],
-            "version": "==20.0.1"
+            "version": "==21.0.0"
        },
        "idna": {
            "hashes": [
@ -521,10 +515,10 @@
        },
        "jinja2": {
            "hashes": [
-                "sha256:89aab215427ef59c34ad58735269eb58b1a5808103067f7bb9d5836c651b3bb0",
-                "sha256:f0a4641d3cf955324a89c04f3d94663aa4d638abe8f733ecd3582848e1c37035"
+                "sha256:03e47ad063331dd6a3f04a43eddca8a966a26ba0c5b7207a9a9e4e08f1b29419",
+                "sha256:a6d58433de0ae800347cab1fa3043cebbabe8baa9d29e668f1c768cb87a333c6"
            ],
-            "version": "==2.11.2"
+            "version": "==2.11.3"
        },
        "jmespath": {
            "hashes": [
@ -557,11 +551,11 @@
        },
        "ldap3": {
            "hashes": [
-                "sha256:37d633e20fa360c302b1263c96fe932d40622d0119f1bddcb829b03462eeeeb7",
-                "sha256:7c3738570766f5e5e74a56fade15470f339d5c436d821cf476ef27da0a4de8b0"
+                "sha256:18c3ee656a6775b9b0d60f7c6c5b094d878d1d90fc03d56731039f0a4b546a91",
+                "sha256:c1df41d89459be6f304e0ceec4b00fdea533dbbcd83c802b1272dcdb94620b57"
            ],
            "index": "pypi",
-            "version": "==2.8.1"
+            "version": "==2.9"
        },
        "lxml": {
            "hashes": [
@ -613,8 +607,12 @@
                "sha256:09c4b7f37d6c648cb13f9230d847adf22f8171b1ccc4d5682398e77f40309235",
                "sha256:1027c282dad077d0bae18be6794e6b6b8c91d58ed8a8d89a89d59693b9131db5",
                "sha256:13d3144e1e340870b25e7b10b98d779608c02016d5184cfb9927a9f10c689f42",
+                "sha256:195d7d2c4fbb0ee8139a6cf67194f3973a6b3042d742ebe0a9ed36d8b6f0c07f",
+                "sha256:22c178a091fc6630d0d045bdb5992d2dfe14e3259760e713c490da5323866c39",
                "sha256:24982cc2533820871eba85ba648cd53d8623687ff11cbb805be4ff7b4c971aff",
                "sha256:29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b",
+                "sha256:2beec1e0de6924ea551859edb9e7679da6e4870d32cb766240ce17e0a0ba2014",
+                "sha256:3b8a6499709d29c2e2399569d96719a1b21dcd94410a586a18526b143ec8470f",
                "sha256:43a55c2930bbc139570ac2452adf3d70cdbb3cfe5912c71cdce1c2c6bbd9c5d1",
                "sha256:46c99d2de99945ec5cb54f23c8cd5689f6d7177305ebff350a58ce5f8de1669e",
                "sha256:500d4957e52ddc3351cabf489e79c91c17f6e0899158447047588650b5e69183",
@ -623,24 +621,39 @@
                "sha256:62fe6c95e3ec8a7fad637b7f3d372c15ec1caa01ab47926cfdf7a75b40e0eac1",
                "sha256:6788b695d50a51edb699cb55e35487e430fa21f1ed838122d722e0ff0ac5ba15",
                "sha256:6dd73240d2af64df90aa7c4e7481e23825ea70af4b4922f8ede5b9e35f78a3b1",
+                "sha256:6f1e273a344928347c1290119b493a1f0303c52f5a5eae5f16d74f48c15d4a85",
+                "sha256:6fffc775d90dcc9aed1b89219549b329a9250d918fd0b8fa8d93d154918422e1",
                "sha256:717ba8fe3ae9cc0006d7c451f0bb265ee07739daf76355d06366154ee68d221e",
                "sha256:79855e1c5b8da654cf486b830bd42c06e8780cea587384cf6545b7d9ac013a0b",
                "sha256:7c1699dfe0cf8ff607dbdcc1e9b9af1755371f92a68f706051cc8c37d447c905",
+                "sha256:7fed13866cf14bba33e7176717346713881f56d9d2bcebab207f7a036f41b850",
+                "sha256:84dee80c15f1b560d55bcfe6d47b27d070b4681c699c572af2e3c7cc90a3b8e0",
                "sha256:88e5fcfb52ee7b911e8bb6d6aa2fd21fbecc674eadd44118a9cc3863f938e735",
                "sha256:8defac2f2ccd6805ebf65f5eeb132adcf2ab57aa11fdf4c0dd5169a004710e7d",
+                "sha256:98bae9582248d6cf62321dcb52aaf5d9adf0bad3b40582925ef7c7f0ed85fceb",
                "sha256:98c7086708b163d425c67c7a91bad6e466bb99d797aa64f965e9d25c12111a5e",
                "sha256:9add70b36c5666a2ed02b43b335fe19002ee5235efd4b8a89bfcf9005bebac0d",
                "sha256:9bf40443012702a1d2070043cb6291650a0841ece432556f784f004937f0f32c",
+                "sha256:a6a744282b7718a2a62d2ed9d993cad6f5f585605ad352c11de459f4108df0a1",
+                "sha256:acf08ac40292838b3cbbb06cfe9b2cb9ec78fce8baca31ddb87aaac2e2dc3bc2",
                "sha256:ade5e387d2ad0d7ebf59146cc00c8044acbd863725f887353a10df825fc8ae21",
                "sha256:b00c1de48212e4cc9603895652c5c410df699856a2853135b3967591e4beebc2",
                "sha256:b1282f8c00509d99fef04d8ba936b156d419be841854fe901d8ae224c59f0be5",
+                "sha256:b1dba4527182c95a0db8b6060cc98ac49b9e2f5e64320e2b56e47cb2831978c7",
                "sha256:b2051432115498d3562c084a49bba65d97cf251f5a331c64a12ee7e04dacc51b",
+                "sha256:b7d644ddb4dbd407d31ffb699f1d140bc35478da613b441c582aeb7c43838dd8",
                "sha256:ba59edeaa2fc6114428f1637ffff42da1e311e29382d81b339c1817d37ec93c6",
+                "sha256:bf5aa3cbcfdf57fa2ee9cd1822c862ef23037f5c832ad09cfea57fa846dec193",
                "sha256:c8716a48d94b06bb3b2524c2b77e055fb313aeb4ea620c8dd03a105574ba704f",
+                "sha256:caabedc8323f1e93231b52fc32bdcde6db817623d33e100708d9a68e1f53b26b",
                "sha256:cd5df75523866410809ca100dc9681e301e3c27567cf498077e8551b6d20e42f",
                "sha256:cdb132fc825c38e1aeec2c8aa9338310d29d337bebbd7baa06889d09a60a1fa2",
+                "sha256:d53bc011414228441014aa71dbec320c66468c1030aae3a6e29778a3382d96e5",
+                "sha256:d73a845f227b0bfe8a7455ee623525ee656a9e2e749e4742706d80a6065d5e2c",
+                "sha256:d9be0ba6c527163cbed5e0857c451fcd092ce83947944d6c14bc95441203f032",
                "sha256:e249096428b3ae81b08327a63a485ad0878de3fb939049038579ac0ef61e17e7",
-                "sha256:e8313f01ba26fbbe36c7be1966a7b7424942f670f38e666995b88d012765b9be"
+                "sha256:e8313f01ba26fbbe36c7be1966a7b7424942f670f38e666995b88d012765b9be",
+                "sha256:feb7b34d6325451ef96bc0e36e1a6c0c1c64bc1fbec4b854f4529e51887b1621"
            ],
            "version": "==1.1.1"
        },
@ -686,11 +699,11 @@
        },
        "packaging": {
            "hashes": [
-                "sha256:24e0da08660a87484d1602c30bb4902d74816b6985b93de36926f5bc95741858",
-                "sha256:78598185a7008a470d64526a8059de9aaa449238f280fc9eb6b13ba6c4109093"
+                "sha256:5b327ac1320dc863dca72f4514ecc086f31186744b84a230374cc1fd776feae5",
+                "sha256:67714da7f7bc052e064859c05c595155bd1ee9f69f76557e21f051443c20947a"
            ],
            "index": "pypi",
-            "version": "==20.8"
+            "version": "==20.9"
        },
        "prometheus-client": {
            "hashes": [
@ -701,10 +714,10 @@
        },
        "prompt-toolkit": {
            "hashes": [
-                "sha256:25c95d2ac813909f813c93fde734b6e44406d1477a9faef7c915ff37d39c0a8c",
-                "sha256:7debb9a521e0b1ee7d2fe96ee4bd60ef03c6492784de0547337ca4433e46aa63"
+                "sha256:7e966747c18ececaec785699626b771c1ba8344c8d31759a1915d6b12fad6525",
+                "sha256:c96b30925025a7635471dc083ffb6af0cc67482a00611bd81aeaeeeb7e5a5e12"
            ],
-            "version": "==3.0.8"
+            "version": "==3.0.14"
        },
        "psycopg2-binary": {
            "hashes": [
@ -770,84 +783,74 @@
        },
        "pycryptodome": {
            "hashes": [
-                "sha256:19cb674df6c74a14b8b408aa30ba8a89bd1c01e23505100fb45f930fbf0ed0d9",
-                "sha256:1cfdb92dca388e27e732caa72a1cc624520fe93752a665c3b6cd8f1a91b34916",
-                "sha256:27397aee992af69d07502126561d851ba3845aa808f0e55c71ad0efa264dd7d4",
-                "sha256:28f75e58d02019a7edc7d4135203d2501dfc47256d175c72c9798f9a129a49a7",
-                "sha256:2a68df525b387201a43b27b879ce8c08948a430e883a756d6c9e3acdaa7d7bd8",
-                "sha256:411745c6dce4eff918906eebcde78771d44795d747e194462abb120d2e537cd9",
-                "sha256:46e96aeb8a9ca8b1edf9b1fd0af4bf6afcf3f1ca7fa35529f5d60b98f3e4e959",
-                "sha256:4ed27951b0a17afd287299e2206a339b5b6d12de9321e1a1575261ef9c4a851b",
-                "sha256:50826b49fbca348a61529693b0031cdb782c39060fb9dca5ac5dff858159dc5a",
-                "sha256:5598dc6c9dbfe882904e54584322893eff185b98960bbe2cdaaa20e8a437b6e5",
-                "sha256:5c3c4865730dfb0263f822b966d6d58429d8b1e560d1ddae37685fd9e7c63161",
-                "sha256:5f19e6ef750f677d924d9c7141f54bade3cd56695bbfd8a9ef15d0378557dfe4",
-                "sha256:60febcf5baf70c566d9d9351c47fbd8321da9a4edf2eff45c4c31c86164ca794",
-                "sha256:62c488a21c253dadc9f731a32f0ac61e4e436d81a1ea6f7d1d9146ed4d20d6bd",
-                "sha256:6d3baaf82681cfb1a842f1c8f77beac791ceedd99af911e4f5fabec32bae2259",
-                "sha256:6e4227849e4231a3f5b35ea5bdedf9a82b3883500e5624f00a19156e9a9ef861",
-                "sha256:6e89bb3826e6f84501e8e3b205c22595d0c5492c2f271cbb9ee1c48eb1866645",
-                "sha256:70d807d11d508433daf96244ec1c64e55039e8a35931fc5ea9eee94dbe3cb6b5",
-                "sha256:76b1a34d74bb2c91bce460cdc74d1347592045627a955e9a252554481c17c52f",
-                "sha256:7798e73225a699651888489fbb1dbc565e03a509942a8ce6194bbe6fb582a41f",
-                "sha256:834b790bbb6bd18956f625af4004d9c15eed12d5186d8e57851454ae76d52215",
-                "sha256:843e5f10ecdf9d307032b8b91afe9da1d6ed5bb89d0bbec5c8dcb4ba44008e11",
-                "sha256:8f9f84059039b672a5a705b3c5aa21747867bacc30a72e28bf0d147cc8ef85ed",
-                "sha256:9000877383e2189dafd1b2fc68c6c726eca9a3cfb6d68148fbb72ccf651959b6",
-                "sha256:910e202a557e1131b1c1b3f17a63914d57aac55cf9fb9b51644962841c3995c4",
-                "sha256:946399d15eccebafc8ce0257fc4caffe383c75e6b0633509bd011e357368306c",
-                "sha256:a199e9ca46fc6e999e5f47fce342af4b56c7de85fae893c69ab6aa17531fb1e1",
-                "sha256:a3d8a9efa213be8232c59cdc6b65600276508e375e0a119d710826248fd18d37",
-                "sha256:a4599c0ca0fc027c780c1c45ed996d5bef03e571470b7b1c7171ec1e1a90914c",
-                "sha256:b4e6b269a8ddaede774e5c3adbef6bf452ee144e6db8a716d23694953348cd86",
-                "sha256:b68794fba45bdb367eeb71249c26d23e61167510a1d0c3d6cf0f2f14636e62ee",
-                "sha256:d7ec2bd8f57c559dd24e71891c51c25266a8deb66fc5f02cc97c7fb593d1780a",
-                "sha256:e15bde67ccb7d4417f627dd16ffe2f5a4c2941ce5278444e884cb26d73ecbc61",
-                "sha256:eb01f9997e4d6a8ec8a1ad1f676ba5a362781ff64e8189fe2985258ba9cb9706",
-                "sha256:faa682c404c218e8788c3126c9a4b8fbcc54dc245b5b6e8ea5b46f3b63bd0c84"
+                "sha256:09c1555a3fa450e7eaca41ea11cd00afe7c91fef52353488e65663777d8524e0",
+                "sha256:12222a5edc9ca4a29de15fbd5339099c4c26c56e13c2ceddf0b920794f26165d",
+                "sha256:1723ebee5561628ce96748501cdaa7afaa67329d753933296321f0be55358dce",
+                "sha256:1c5e1ca507de2ad93474be5cfe2bfa76b7cf039a1a32fc196f40935944871a06",
+                "sha256:2603c98ae04aac675fefcf71a6c87dc4bb74a75e9071ae3923bbc91a59f08d35",
+                "sha256:2dea65df54349cdfa43d6b2e8edb83f5f8d6861e5cf7b1fbc3e34c5694c85e27",
+                "sha256:31c1df17b3dc5f39600a4057d7db53ac372f492c955b9b75dd439f5d8b460129",
+                "sha256:38661348ecb71476037f1e1f553159b80d256c00f6c0b00502acac891f7116d9",
+                "sha256:3e2e3a06580c5f190df843cdb90ea28d61099cf4924334d5297a995de68e4673",
+                "sha256:3f840c49d38986f6e17dbc0673d37947c88bc9d2d9dba1c01b979b36f8447db1",
+                "sha256:501ab36aae360e31d0ec370cf5ce8ace6cb4112060d099b993bc02b36ac83fb6",
+                "sha256:60386d1d4cfaad299803b45a5bc2089696eaf6cdd56f9fc17479a6f89595cfc8",
+                "sha256:6260e24d41149268122dd39d4ebd5941e9d107f49463f7e071fd397e29923b0c",
+                "sha256:6bbf7fee7b7948b29d7e71fcacf48bac0c57fb41332007061a933f2d996f9713",
+                "sha256:6d2df5223b12437e644ce0a3be7809471ffa71de44ccd28b02180401982594a6",
+                "sha256:758949ca62690b1540dfb24ad773c6da9cd0e425189e83e39c038bbd52b8e438",
+                "sha256:77997519d8eb8a4adcd9a47b9cec18f9b323e296986528186c0e9a7a15d6a07e",
+                "sha256:7fd519b89585abf57bf47d90166903ec7b43af4fe23c92273ea09e6336af5c07",
+                "sha256:98213ac2b18dc1969a47bc65a79a8fca02a414249d0c8635abb081c7f38c91b6",
+                "sha256:99b2f3fc51d308286071d0953f92055504a6ffe829a832a9fc7a04318a7683dd",
+                "sha256:9b6f711b25e01931f1c61ce0115245a23cdc8b80bf8539ac0363bdcf27d649b6",
+                "sha256:a3105a0eb63eacf98c2ecb0eb4aa03f77f40fbac2bdde22020bb8a536b226bb8",
+                "sha256:a8eb8b6ea09ec1c2535bf39914377bc8abcab2c7d30fa9225eb4fe412024e427",
+                "sha256:a92d5c414e8ee1249e850789052608f582416e82422502dc0ac8c577808a9067",
+                "sha256:d3d6958d53ad307df5e8469cc44474a75393a434addf20ecd451f38a72fe29b8",
+                "sha256:e0a4d5933a88a2c98bbe19c0c722f5483dc628d7a38338ac2cb64a7dbd34064b",
+                "sha256:e3bf558c6aeb49afa9f0c06cee7fb5947ee5a1ff3bd794b653d39926b49077fa",
+                "sha256:e61e363d9a5d7916f3a4ce984a929514c0df3daf3b1b2eb5e6edbb131ee771cf",
+                "sha256:f977cdf725b20f6b8229b0c87acb98c7717e742ef9f46b113985303ae12a99da",
+                "sha256:fc7489a50323a0df02378bc2fff86eb69d94cc5639914346c736be981c6a02e7"
            ],
            "index": "pypi",
-            "version": "==3.9.9"
+            "version": "==3.10.1"
        },
        "pycryptodomex": {
            "hashes": [
-                "sha256:15c03ffdac17731b126880622823d30d0a3cc7203cd219e6b9814140a44e7fab",
-                "sha256:20fb7f4efc494016eab1bc2f555bc0a12dd5ca61f35c95df8061818ffb2c20a3",
-                "sha256:28ee3bcb4d609aea3040cad995a8e2c9c6dc57c12183dadd69e53880c35333b9",
-                "sha256:305e3c46f20d019cd57543c255e7ba49e432e275d7c0de8913b6dbe57a851bc8",
-                "sha256:3547b87b16aad6afb28c9b3a9cd870e11b5e7b5ac649b74265258d96d8de1130",
-                "sha256:3642252d7bfc4403a42050e18ba748bedebd5a998a8cba89665a4f42aea4c380",
-                "sha256:404faa3e518f8bea516aae2aac47d4d960397199a15b4bd6f66cad97825469a0",
-                "sha256:42669638e4f7937b7141044a2fbd1019caca62bd2cdd8b535f731426ab07bde1",
-                "sha256:4632d55a140b28e20be3cd7a3057af52fb747298ff0fd3290d4e9f245b5004ba",
-                "sha256:4a88c9383d273bdce3afc216020282c9c5c39ec0bd9462b1a206af6afa377cf0",
-                "sha256:4ce1fc1e6d2fd2d6dc197607153327989a128c093e0e94dca63408f506622c3e",
-                "sha256:55cf4e99b3ba0122dee570dc7661b97bf35c16aab3e2ccb5070709d282a1c7ab",
-                "sha256:5e486cab2dfcfaec934dd4f5d5837f4a9428b690f4d92a3b020fd31d1497ca64",
-                "sha256:65ec88c8271448d2ea109d35c1f297b09b872c57214ab7e832e413090d3469a9",
-                "sha256:6c95a3361ce70068cf69526a58751f73ddac5ba27a3c2379b057efa2f5338c8c",
-                "sha256:73240335f4a1baf12880ebac6df66ab4d3a9212db9f3efe809c36a27280d16f8",
-                "sha256:7651211e15109ac0058a49159265d9f6e6423c8a81c65434d3c56d708417a05b",
-                "sha256:7b5b7c5896f8172ea0beb283f7f9428e0ab88ec248ce0a5b8c98d73e26267d51",
-                "sha256:836fe39282e75311ce4c38468be148f7fac0df3d461c5de58c5ff1ddb8966bac",
-                "sha256:871852044f55295449fbf225538c2c4118525093c32f0a6c43c91bed0452d7e3",
-                "sha256:892e93f3e7e10c751d6c17fa0dc422f7984cfd5eb6690011f9264dc73e2775fc",
-                "sha256:934e460c5058346c6f1d62fdf3db5680fbdfbfd212722d24d8277bf47cd9ebdc",
-                "sha256:9736f3f3e1761024200637a080a4f922f5298ad5d780e10dbb5634fe8c65b34c",
-                "sha256:a1d38a96da57e6103423a446079ead600b450cf0f8ebf56a231895abf77e7ffc",
-                "sha256:a385fceaa0cdb97f0098f1c1e9ec0b46cc09186ddf60ec23538e871b1dddb6dc",
-                "sha256:a7cf1c14e47027d9fb9d26aa62e5d603994227bd635e58a8df4b1d2d1b6a8ed7",
-                "sha256:a9aac1a30b00b5038d3d8e48248f3b58ea15c827b67325c0d18a447552e30fc8",
-                "sha256:b696876ee583d15310be57311e90e153a84b7913ac93e6b99675c0c9867926d0",
-                "sha256:bef9e9d39393dc7baec39ba4bac6c73826a4db02114cdeade2552a9d6afa16e2",
-                "sha256:c885fe4d5f26ce8ca20c97d02e88f5fdd92c01e1cc771ad0951b21e1641faf6d",
-                "sha256:d2d1388595cb5d27d9220d5cbaff4f37c6ec696a25882eb06d224d241e6e93fb",
-                "sha256:d2e853e0f9535e693fade97768cf7293f3febabecc5feb1e9b2ffdfe1044ab96",
-                "sha256:d62fbab185a6b01c5469eda9f0795f3d1a5bba24f5a5813f362e4b73a3c4dc70",
-                "sha256:f20a62397e09704049ce9007bea4f6bad965ba9336a760c6f4ef1b4192e12d6d",
-                "sha256:f81f7311250d9480e36dec819127897ae772e7e8de07abfabe931b8566770b8e"
+                "sha256:00a584ee52bf5e27d540129ca9bf7c4a7e7447f24ff4a220faa1304ad0c09bcd",
+                "sha256:04265a7a84ae002001249bd1de2823bcf46832bd4b58f6965567cb8a07cf4f00",
+                "sha256:0bd35af6a18b724c689e56f2dbbdd8e409288be71952d271ba3d9614b31d188c",
+                "sha256:20c45a30f3389148f94edb77f3b216c677a277942f62a2b81a1cc0b6b2dde7fc",
+                "sha256:2959304d1ce31ab303d9fb5db2b294814278b35154d9b30bf7facc52d6088d0a",
+                "sha256:36dab7f506948056ceba2d57c1ade74e898401960de697cefc02f3519bd26c1b",
+                "sha256:37ec1b407ec032c7a0c1fdd2da12813f560bad38ae61ad9c7ce3c0573b3e5e30",
+                "sha256:3b8eb85b3cc7f083d87978c264d10ff9de3b4bfc46f1c6fdc2792e7d7ebc87bb",
+                "sha256:3dfce70c4e425607ae87b8eae67c9c7dbba59a33b62d70f79417aef0bc5c735b",
+                "sha256:418f51c61eab52d9920f4ef468d22c89dab1be5ac796f71cf3802f6a6e667df0",
+                "sha256:4195604f75cdc1db9bccdb9e44d783add3c817319c30aaff011670c9ed167690",
+                "sha256:4344ab16faf6c2d9df2b6772995623698fb2d5f114dace4ab2ff335550cf71d5",
+                "sha256:541cd3e3e252fb19a7b48f420b798b53483302b7fe4d9954c947605d0a263d62",
+                "sha256:564063e3782474c92cbb333effd06e6eb718471783c6e67f28c63f0fc3ac7b23",
+                "sha256:72f44b5be46faef2a1bf2a85902511b31f4dd7b01ce0c3978e92edb2cc812a82",
+                "sha256:8a98e02cbf8f624add45deff444539bf26345b479fc04fa0937b23cd84078d91",
+                "sha256:940db96449d7b2ebb2c7bf190be1514f3d67914bd37e54e8d30a182bd375a1a9",
+                "sha256:961333e7ee896651f02d4692242aa36b787b8e8e0baa2256717b2b9d55ae0a3c",
+                "sha256:9f713ffb4e27b5575bd917c70bbc3f7b348241a351015dbbc514c01b7061ff7e",
+                "sha256:a6584ae58001d17bb4dc0faa8a426919c2c028ef4d90ceb4191802ca6edb8204",
+                "sha256:c2b680987f418858e89dbb4f09c8c919ece62811780a27051ace72b2f69fb1be",
+                "sha256:d8fae5ba3d34c868ae43614e0bd6fb61114b2687ac3255798791ce075d95aece",
+                "sha256:dbd2c361db939a4252589baa94da4404d45e3fc70da1a31e541644cdf354336e",
+                "sha256:e090a8609e2095aa86978559b140cf8968af99ee54b8791b29ff804838f29f10",
+                "sha256:e4a1245e7b846e88ba63e7543483bda61b9acbaee61eadbead5a1ce479d94740",
+                "sha256:ec9901d19cadb80d9235ee41cc58983f18660314a0eb3fc7b11b0522ac3b6c4a",
+                "sha256:f2abeb4c4ce7584912f4d637b2c57f23720d35dd2892bfeb1b2c84b6fb7a8c88",
+                "sha256:f3bb267df679f70a9f40f17d62d22fe12e8b75e490f41807e7560de4d3e6bf9f",
+                "sha256:f933ecf4cb736c7af60a6a533db2bf569717f2318b265f92907acff1db43bc34",
+                "sha256:fc9c55dc1ed57db76595f2d19a479fc1c3a1be2c9da8de798a93d286c5f65f38"
            ],
-            "version": "==3.9.9"
+            "version": "==3.10.1"
        },
        "pyhamcrest": {
            "hashes": [
@ -899,29 +902,37 @@
        },
        "pytz": {
            "hashes": [
-                "sha256:16962c5fb8db4a8f63a26646d8886e9d769b6c511543557bc84e9569fb9a9cb4",
-                "sha256:180befebb1927b16f6b57101720075a984c019ac16b1b7575673bea42c6c3da5"
+                "sha256:83a4a90894bf38e243cf052c8b58f381bfe9a7a483f6a9cab140bc7f702ac4da",
+                "sha256:eb10ce3e7736052ed3623d49975ce333bcd712c7bb19a58b9e2089d4057d0798"
            ],
-            "version": "==2020.5"
+            "version": "==2021.1"
        },
        "pyyaml": {
            "hashes": [
-                "sha256:06a0d7ba600ce0b2d2fe2e78453a470b5a6e000a985dd4a4e54e436cc36b0e97",
-                "sha256:240097ff019d7c70a4922b6869d8a86407758333f02203e0fc6ff79c5dcede76",
-                "sha256:4f4b913ca1a7319b33cfb1369e91e50354d6f07a135f3b901aca02aa95940bd2",
-                "sha256:6034f55dab5fea9e53f436aa68fa3ace2634918e8b5994d82f3621c04ff5ed2e",
-                "sha256:69f00dca373f240f842b2931fb2c7e14ddbacd1397d57157a9b005a6a9942648",
-                "sha256:73f099454b799e05e5ab51423c7bcf361c58d3206fa7b0d555426b1f4d9a3eaf",
-                "sha256:74809a57b329d6cc0fdccee6318f44b9b8649961fa73144a98735b0aaf029f1f",
-                "sha256:7739fc0fa8205b3ee8808aea45e968bc90082c10aef6ea95e855e10abf4a37b2",
-                "sha256:95f71d2af0ff4227885f7a6605c37fd53d3a106fcab511b8860ecca9fcf400ee",
-                "sha256:ad9c67312c84def58f3c04504727ca879cb0013b2517c85a9a253f0cb6380c0a",
-                "sha256:b8eac752c5e14d3eca0e6dd9199cd627518cb5ec06add0de9d32baeee6fe645d",
-                "sha256:cc8955cfbfc7a115fa81d85284ee61147059a753344bc51098f3ccd69b0d7e0c",
-                "sha256:d13155f591e6fcc1ec3b30685d50bf0711574e2c0dfffd7644babf8b5102ca1a"
+                "sha256:08682f6b72c722394747bddaf0aa62277e02557c0fd1c42cb853016a38f8dedf",
+                "sha256:0f5f5786c0e09baddcd8b4b45f20a7b5d61a7e7e99846e3c799b05c7c53fa696",
+                "sha256:129def1b7c1bf22faffd67b8f3724645203b79d8f4cc81f674654d9902cb4393",
+                "sha256:294db365efa064d00b8d1ef65d8ea2c3426ac366c0c4368d930bf1c5fb497f77",
+                "sha256:3b2b1824fe7112845700f815ff6a489360226a5609b96ec2190a45e62a9fc922",
+                "sha256:3bd0e463264cf257d1ffd2e40223b197271046d09dadf73a0fe82b9c1fc385a5",
+                "sha256:4465124ef1b18d9ace298060f4eccc64b0850899ac4ac53294547536533800c8",
+                "sha256:49d4cdd9065b9b6e206d0595fee27a96b5dd22618e7520c33204a4a3239d5b10",
+                "sha256:4e0583d24c881e14342eaf4ec5fbc97f934b999a6828693a99157fde912540cc",
+                "sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
+                "sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
+                "sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
+                "sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
+                "sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
+                "sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
+                "sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
+                "sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
+                "sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
+                "sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
+                "sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
+                "sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc"
            ],
            "index": "pypi",
-            "version": "==5.3.1"
+            "version": "==5.4.1"
        },
        "qrcode": {
            "hashes": [
@ -955,11 +966,11 @@
        },
        "rsa": {
            "hashes": [
-                "sha256:109ea5a66744dd859bf16fe904b8d8b627adafb9408753161e766a92e7d681fa",
-                "sha256:6166864e23d6b5195a5cfed6cd9fed0fe774e226d8f854fcb23b7bbef0350233"
+                "sha256:69805d6b69f56eb05b62daea3a7dbd7aa44324ad1306445e05da8060232d00f4",
+                "sha256:a8774e55b59fd9fc893b0d05e9bfc6f47081f46ff5b46f39ccf24631b7be356b"
            ],
            "markers": "python_version >= '3.6'",
-            "version": "==4.6"
+            "version": "==4.7"
        },
        "ruamel.yaml": {
            "hashes": [
@ -970,10 +981,10 @@
        },
        "s3transfer": {
            "hashes": [
-                "sha256:2482b4259524933a022d59da830f51bd746db62f047d6eb213f2f8855dcb8a13",
-                "sha256:921a37e2aefc64145e7b73d50c71bb4f26f46e4c9f414dc648c6245ff92cf7db"
+                "sha256:1e28620e5b444652ed752cf87c7e0cb15b0e578972568c6609f0f18212f259ed",
+                "sha256:7fdddb4f22275cf1d32129e21f056337fd2a80b6ccef1664528145b72c49e6d2"
            ],
-            "version": "==0.3.3"
+            "version": "==0.3.4"
        },
        "sentry-sdk": {
            "hashes": [
@ -1007,11 +1018,11 @@
        },
        "structlog": {
            "hashes": [
-                "sha256:7a48375db6274ed1d0ae6123c486472aa1d0890b08d314d2b016f3aa7f35990b",
-                "sha256:8a672be150547a93d90a7d74229a29e765be05bd156a35cdcc527ebf68e9af92"
+                "sha256:33dd6bd5f49355e52c1c61bb6a4f20d0b48ce0328cc4a45fe872d38b97a05ccd",
+                "sha256:af79dfa547d104af8d60f86eac12fb54825f54a46bc998e4504ef66177103174"
            ],
            "index": "pypi",
-            "version": "==20.1.0"
+            "version": "==20.2.0"
        },
        "swagger-spec-validator": {
            "hashes": [
@ -1071,12 +1082,11 @@
                "secure"
            ],
            "hashes": [
-                "sha256:19188f96923873c92ccb987120ec4acaa12f0461fa9ce5d3d0772bc965a39e08",
-                "sha256:d8ff90d979214d7b4f8ce956e80f4028fc6860e4431f731ea4a8c08f23f99473"
+                "sha256:1b465e494e3e0d8939b50680403e3aedaa2bc434b7d5af64dfd3c958d7f5ae80",
+                "sha256:de3eedaad74a2683334e282005cd8d7f22f4d55fa690a2a1020a416cb0a47e73"
            ],
            "index": "pypi",
-            "markers": null,
-            "version": "==1.26.2"
+            "version": "==1.26.3"
        },
        "uvicorn": {
            "extras": [
@ -1266,10 +1276,11 @@
        },
        "autopep8": {
            "hashes": [
-                "sha256:d21d3901cb0da6ebd1e83fc9b0dfbde8b46afc2ede4fe32fbda0c7c6118ca094"
+                "sha256:9e136c472c475f4ee4978b51a88a494bfcd4e3ed17950a44a988d9e434837bea",
+                "sha256:cae4bc0fb616408191af41d062d7ec7ef8679c7f27b068875ca3a9e2878d5443"
            ],
            "index": "pypi",
-            "version": "==1.5.4"
+            "version": "==1.5.5"
        },
        "bandit": {
            "hashes": [
@ -1318,66 +1329,66 @@
        },
        "coverage": {
            "hashes": [
-                "sha256:08b3ba72bd981531fd557f67beee376d6700fba183b167857038997ba30dd297",
-                "sha256:2757fa64e11ec12220968f65d086b7a29b6583d16e9a544c889b22ba98555ef1",
-                "sha256:3102bb2c206700a7d28181dbe04d66b30780cde1d1c02c5f3c165cf3d2489497",
-                "sha256:3498b27d8236057def41de3585f317abae235dd3a11d33e01736ffedb2ef8606",
-                "sha256:378ac77af41350a8c6b8801a66021b52da8a05fd77e578b7380e876c0ce4f528",
-                "sha256:38f16b1317b8dd82df67ed5daa5f5e7c959e46579840d77a67a4ceb9cef0a50b",
-                "sha256:3911c2ef96e5ddc748a3c8b4702c61986628bb719b8378bf1e4a6184bbd48fe4",
-                "sha256:3a3c3f8863255f3c31db3889f8055989527173ef6192a283eb6f4db3c579d830",
-                "sha256:3b14b1da110ea50c8bcbadc3b82c3933974dbeea1832e814aab93ca1163cd4c1",
-                "sha256:535dc1e6e68fad5355f9984d5637c33badbdc987b0c0d303ee95a6c979c9516f",
-                "sha256:6f61319e33222591f885c598e3e24f6a4be3533c1d70c19e0dc59e83a71ce27d",
-                "sha256:723d22d324e7997a651478e9c5a3120a0ecbc9a7e94071f7e1954562a8806cf3",
-                "sha256:76b2775dda7e78680d688daabcb485dc87cf5e3184a0b3e012e1d40e38527cc8",
-                "sha256:782a5c7df9f91979a7a21792e09b34a658058896628217ae6362088b123c8500",
-                "sha256:7e4d159021c2029b958b2363abec4a11db0ce8cd43abb0d9ce44284cb97217e7",
-                "sha256:8dacc4073c359f40fcf73aede8428c35f84639baad7e1b46fce5ab7a8a7be4bb",
-                "sha256:8f33d1156241c43755137288dea619105477961cfa7e47f48dbf96bc2c30720b",
-                "sha256:8ffd4b204d7de77b5dd558cdff986a8274796a1e57813ed005b33fd97e29f059",
-                "sha256:93a280c9eb736a0dcca19296f3c30c720cb41a71b1f9e617f341f0a8e791a69b",
-                "sha256:9a4f66259bdd6964d8cf26142733c81fb562252db74ea367d9beb4f815478e72",
-                "sha256:9a9d4ff06804920388aab69c5ea8a77525cf165356db70131616acd269e19b36",
-                "sha256:a2070c5affdb3a5e751f24208c5c4f3d5f008fa04d28731416e023c93b275277",
-                "sha256:a4857f7e2bc6921dbd487c5c88b84f5633de3e7d416c4dc0bb70256775551a6c",
-                "sha256:a607ae05b6c96057ba86c811d9c43423f35e03874ffb03fbdcd45e0637e8b631",
-                "sha256:a66ca3bdf21c653e47f726ca57f46ba7fc1f260ad99ba783acc3e58e3ebdb9ff",
-                "sha256:ab110c48bc3d97b4d19af41865e14531f300b482da21783fdaacd159251890e8",
-                "sha256:b239711e774c8eb910e9b1ac719f02f5ae4bf35fa0420f438cdc3a7e4e7dd6ec",
-                "sha256:be0416074d7f253865bb67630cf7210cbc14eb05f4099cc0f82430135aaa7a3b",
-                "sha256:c46643970dff9f5c976c6512fd35768c4a3819f01f61169d8cdac3f9290903b7",
-                "sha256:c5ec71fd4a43b6d84ddb88c1df94572479d9a26ef3f150cef3dacefecf888105",
-                "sha256:c6e5174f8ca585755988bc278c8bb5d02d9dc2e971591ef4a1baabdf2d99589b",
-                "sha256:c89b558f8a9a5a6f2cfc923c304d49f0ce629c3bd85cb442ca258ec20366394c",
-                "sha256:cc44e3545d908ecf3e5773266c487ad1877be718d9dc65fc7eb6e7d14960985b",
-                "sha256:cc6f8246e74dd210d7e2b56c76ceaba1cc52b025cd75dbe96eb48791e0250e98",
-                "sha256:cd556c79ad665faeae28020a0ab3bda6cd47d94bec48e36970719b0b86e4dcf4",
-                "sha256:ce6f3a147b4b1a8b09aae48517ae91139b1b010c5f36423fa2b866a8b23df879",
-                "sha256:ceb499d2b3d1d7b7ba23abe8bf26df5f06ba8c71127f188333dddcf356b4b63f",
-                "sha256:cef06fb382557f66d81d804230c11ab292d94b840b3cb7bf4450778377b592f4",
-                "sha256:e448f56cfeae7b1b3b5bcd99bb377cde7c4eb1970a525c770720a352bc4c8044",
-                "sha256:e52d3d95df81c8f6b2a1685aabffadf2d2d9ad97203a40f8d61e51b70f191e4e",
-                "sha256:ee2f1d1c223c3d2c24e3afbb2dd38be3f03b1a8d6a83ee3d9eb8c36a52bee899",
-                "sha256:f2c6888eada180814b8583c3e793f3f343a692fc802546eed45f40a001b1169f",
-                "sha256:f51dbba78d68a44e99d484ca8c8f604f17e957c1ca09c3ebc2c7e3bbd9ba0448",
-                "sha256:f54de00baf200b4539a5a092a759f000b5f45fd226d6d25a76b0dff71177a714",
-                "sha256:fa10fee7e32213f5c7b0d6428ea92e3a3fdd6d725590238a3f92c0de1c78b9d2",
-                "sha256:fabeeb121735d47d8eab8671b6b031ce08514c86b7ad8f7d5490a7b6dcd6267d",
-                "sha256:fac3c432851038b3e6afe086f777732bcf7f6ebbfd90951fa04ee53db6d0bcdd",
-                "sha256:fda29412a66099af6d6de0baa6bd7c52674de177ec2ad2630ca264142d69c6c7",
-                "sha256:ff1330e8bc996570221b450e2d539134baa9465f5cb98aff0e0f73f34172e0ae"
+                "sha256:03ed2a641e412e42cc35c244508cf186015c217f0e4d496bf6d7078ebe837ae7",
+                "sha256:04b14e45d6a8e159c9767ae57ecb34563ad93440fc1b26516a89ceb5b33c1ad5",
+                "sha256:0cdde51bfcf6b6bd862ee9be324521ec619b20590787d1655d005c3fb175005f",
+                "sha256:0f48fc7dc82ee14aeaedb986e175a429d24129b7eada1b7e94a864e4f0644dde",
+                "sha256:107d327071061fd4f4a2587d14c389a27e4e5c93c7cba5f1f59987181903902f",
+                "sha256:1375bb8b88cb050a2d4e0da901001347a44302aeadb8ceb4b6e5aa373b8ea68f",
+                "sha256:14a9f1887591684fb59fdba8feef7123a0da2424b0652e1b58dd5b9a7bb1188c",
+                "sha256:16baa799ec09cc0dcb43a10680573269d407c159325972dd7114ee7649e56c66",
+                "sha256:1b811662ecf72eb2d08872731636aee6559cae21862c36f74703be727b45df90",
+                "sha256:1ccae21a076d3d5f471700f6d30eb486da1626c380b23c70ae32ab823e453337",
+                "sha256:2f2cf7a42d4b7654c9a67b9d091ec24374f7c58794858bff632a2039cb15984d",
+                "sha256:322549b880b2d746a7672bf6ff9ed3f895e9c9f108b714e7360292aa5c5d7cf4",
+                "sha256:32ab83016c24c5cf3db2943286b85b0a172dae08c58d0f53875235219b676409",
+                "sha256:3fe50f1cac369b02d34ad904dfe0771acc483f82a1b54c5e93632916ba847b37",
+                "sha256:4a780807e80479f281d47ee4af2eb2df3e4ccf4723484f77da0bb49d027e40a1",
+                "sha256:4a8eb7785bd23565b542b01fb39115a975fefb4a82f23d407503eee2c0106247",
+                "sha256:5bee3970617b3d74759b2d2df2f6a327d372f9732f9ccbf03fa591b5f7581e39",
+                "sha256:60a3307a84ec60578accd35d7f0c71a3a971430ed7eca6567399d2b50ef37b8c",
+                "sha256:6625e52b6f346a283c3d563d1fd8bae8956daafc64bb5bbd2b8f8a07608e3994",
+                "sha256:66a5aae8233d766a877c5ef293ec5ab9520929c2578fd2069308a98b7374ea8c",
+                "sha256:68fb816a5dd901c6aff352ce49e2a0ffadacdf9b6fae282a69e7a16a02dad5fb",
+                "sha256:6b588b5cf51dc0fd1c9e19f622457cc74b7d26fe295432e434525f1c0fae02bc",
+                "sha256:6c4d7165a4e8f41eca6b990c12ee7f44fef3932fac48ca32cecb3a1b2223c21f",
+                "sha256:6d2e262e5e8da6fa56e774fb8e2643417351427604c2b177f8e8c5f75fc928ca",
+                "sha256:6d9c88b787638a451f41f97446a1c9fd416e669b4d9717ae4615bd29de1ac135",
+                "sha256:755c56beeacac6a24c8e1074f89f34f4373abce8b662470d3aa719ae304931f3",
+                "sha256:7e40d3f8eb472c1509b12ac2a7e24158ec352fc8567b77ab02c0db053927e339",
+                "sha256:812eaf4939ef2284d29653bcfee9665f11f013724f07258928f849a2306ea9f9",
+                "sha256:84df004223fd0550d0ea7a37882e5c889f3c6d45535c639ce9802293b39cd5c9",
+                "sha256:859f0add98707b182b4867359e12bde806b82483fb12a9ae868a77880fc3b7af",
+                "sha256:87c4b38288f71acd2106f5d94f575bc2136ea2887fdb5dfe18003c881fa6b370",
+                "sha256:89fc12c6371bf963809abc46cced4a01ca4f99cba17be5e7d416ed7ef1245d19",
+                "sha256:9564ac7eb1652c3701ac691ca72934dd3009997c81266807aef924012df2f4b3",
+                "sha256:9754a5c265f991317de2bac0c70a746efc2b695cf4d49f5d2cddeac36544fb44",
+                "sha256:a565f48c4aae72d1d3d3f8e8fb7218f5609c964e9c6f68604608e5958b9c60c3",
+                "sha256:a636160680c6e526b84f85d304e2f0bb4e94f8284dd765a1911de9a40450b10a",
+                "sha256:a839e25f07e428a87d17d857d9935dd743130e77ff46524abb992b962eb2076c",
+                "sha256:b62046592b44263fa7570f1117d372ae3f310222af1fc1407416f037fb3af21b",
+                "sha256:b7f7421841f8db443855d2854e25914a79a1ff48ae92f70d0a5c2f8907ab98c9",
+                "sha256:ba7ca81b6d60a9f7a0b4b4e175dcc38e8fef4992673d9d6e6879fd6de00dd9b8",
+                "sha256:bb32ca14b4d04e172c541c69eec5f385f9a075b38fb22d765d8b0ce3af3a0c22",
+                "sha256:c0ff1c1b4d13e2240821ef23c1efb1f009207cb3f56e16986f713c2b0e7cd37f",
+                "sha256:c669b440ce46ae3abe9b2d44a913b5fd86bb19eb14a8701e88e3918902ecd345",
+                "sha256:c67734cff78383a1f23ceba3b3239c7deefc62ac2b05fa6a47bcd565771e5880",
+                "sha256:c6809ebcbf6c1049002b9ac09c127ae43929042ec1f1dbd8bb1615f7cd9f70a0",
+                "sha256:cd601187476c6bed26a0398353212684c427e10a903aeafa6da40c63309d438b",
+                "sha256:ebfa374067af240d079ef97b8064478f3bf71038b78b017eb6ec93ede1b6bcec",
+                "sha256:fbb17c0d0822684b7d6c09915677a32319f16ff1115df5ec05bdcaaee40b35f3",
+                "sha256:fff1f3a586246110f34dc762098b5afd2de88de507559e63553d7da643053786"
            ],
            "index": "pypi",
-            "version": "==5.3.1"
+            "version": "==5.4"
        },
        "django": {
            "hashes": [
-                "sha256:5c866205f15e7a7123f1eec6ab939d22d5bde1416635cab259684af66d8e48a2",
-                "sha256:edb10b5c45e7e9c0fb1dc00b76ec7449aca258a39ffd613dbd078c51d19c9f03"
+                "sha256:169e2e7b4839a7910b393eec127fd7cbae62e80fa55f89c6510426abf673fe5f",
+                "sha256:c6c0462b8b361f8691171af1fb87eceb4442da28477e12200c40420176206ba7"
            ],
            "index": "pypi",
-            "version": "==3.1.4"
+            "version": "==3.1.6"
        },
        "django-debug-toolbar": {
            "hashes": [
@ -1417,10 +1428,10 @@
        },
        "gitpython": {
            "hashes": [
-                "sha256:6eea89b655917b500437e9668e4a12eabdcf00229a0df1762aabd692ef9b746b",
-                "sha256:befa4d101f91bad1b632df4308ec64555db684c360bd7d2130b4807d49ce86b8"
+                "sha256:8621a7e777e276a5ec838b59280ba5272dd144a18169c36c903d8b38b99f750a",
+                "sha256:c5347c81d232d9b8e7f47b68a83e5dc92e7952127133c5f2df9133f2c75a1b29"
            ],
-            "version": "==3.1.11"
+            "version": "==3.1.13"
        },
        "iniconfig": {
            "hashes": [
@ -1478,11 +1489,11 @@
        },
        "packaging": {
            "hashes": [
-                "sha256:24e0da08660a87484d1602c30bb4902d74816b6985b93de36926f5bc95741858",
-                "sha256:78598185a7008a470d64526a8059de9aaa449238f280fc9eb6b13ba6c4109093"
+                "sha256:5b327ac1320dc863dca72f4514ecc086f31186744b84a230374cc1fd776feae5",
+                "sha256:67714da7f7bc052e064859c05c595155bd1ee9f69f76557e21f051443c20947a"
            ],
            "index": "pypi",
-            "version": "==20.8"
+            "version": "==20.9"
        },
        "pathspec": {
            "hashes": [
@ -1591,11 +1602,11 @@
        },
        "pytest": {
            "hashes": [
-                "sha256:1969f797a1a0dbd8ccf0fecc80262312729afea9c17f1d70ebf85c5e76c6f7c8",
-                "sha256:66e419b1899bc27346cb2c993e12c5e5e8daba9073c1fbce33b9807abc95c306"
+                "sha256:9d1edf9e7d0b84d72ea3dbcdfd22b35fb543a5e8f2a60092dd578936bf63d7f9",
+                "sha256:b574b57423e818210672e07ca1fa90aaf194a4f63f3ab909a2c67ebb22913839"
            ],
            "index": "pypi",
-            "version": "==6.2.1"
+            "version": "==6.2.2"
        },
        "pytest-django": {
            "hashes": [
@ -1607,29 +1618,37 @@
        },
        "pytz": {
            "hashes": [
-                "sha256:16962c5fb8db4a8f63a26646d8886e9d769b6c511543557bc84e9569fb9a9cb4",
-                "sha256:180befebb1927b16f6b57101720075a984c019ac16b1b7575673bea42c6c3da5"
+                "sha256:83a4a90894bf38e243cf052c8b58f381bfe9a7a483f6a9cab140bc7f702ac4da",
+                "sha256:eb10ce3e7736052ed3623d49975ce333bcd712c7bb19a58b9e2089d4057d0798"
            ],
-            "version": "==2020.5"
+            "version": "==2021.1"
        },
        "pyyaml": {
            "hashes": [
-                "sha256:06a0d7ba600ce0b2d2fe2e78453a470b5a6e000a985dd4a4e54e436cc36b0e97",
-                "sha256:240097ff019d7c70a4922b6869d8a86407758333f02203e0fc6ff79c5dcede76",
-                "sha256:4f4b913ca1a7319b33cfb1369e91e50354d6f07a135f3b901aca02aa95940bd2",
-                "sha256:6034f55dab5fea9e53f436aa68fa3ace2634918e8b5994d82f3621c04ff5ed2e",
-                "sha256:69f00dca373f240f842b2931fb2c7e14ddbacd1397d57157a9b005a6a9942648",
-                "sha256:73f099454b799e05e5ab51423c7bcf361c58d3206fa7b0d555426b1f4d9a3eaf",
-                "sha256:74809a57b329d6cc0fdccee6318f44b9b8649961fa73144a98735b0aaf029f1f",
-                "sha256:7739fc0fa8205b3ee8808aea45e968bc90082c10aef6ea95e855e10abf4a37b2",
-                "sha256:95f71d2af0ff4227885f7a6605c37fd53d3a106fcab511b8860ecca9fcf400ee",
-                "sha256:ad9c67312c84def58f3c04504727ca879cb0013b2517c85a9a253f0cb6380c0a",
-                "sha256:b8eac752c5e14d3eca0e6dd9199cd627518cb5ec06add0de9d32baeee6fe645d",
-                "sha256:cc8955cfbfc7a115fa81d85284ee61147059a753344bc51098f3ccd69b0d7e0c",
-                "sha256:d13155f591e6fcc1ec3b30685d50bf0711574e2c0dfffd7644babf8b5102ca1a"
+                "sha256:08682f6b72c722394747bddaf0aa62277e02557c0fd1c42cb853016a38f8dedf",
+                "sha256:0f5f5786c0e09baddcd8b4b45f20a7b5d61a7e7e99846e3c799b05c7c53fa696",
+                "sha256:129def1b7c1bf22faffd67b8f3724645203b79d8f4cc81f674654d9902cb4393",
+                "sha256:294db365efa064d00b8d1ef65d8ea2c3426ac366c0c4368d930bf1c5fb497f77",
+                "sha256:3b2b1824fe7112845700f815ff6a489360226a5609b96ec2190a45e62a9fc922",
+                "sha256:3bd0e463264cf257d1ffd2e40223b197271046d09dadf73a0fe82b9c1fc385a5",
+                "sha256:4465124ef1b18d9ace298060f4eccc64b0850899ac4ac53294547536533800c8",
+                "sha256:49d4cdd9065b9b6e206d0595fee27a96b5dd22618e7520c33204a4a3239d5b10",
+                "sha256:4e0583d24c881e14342eaf4ec5fbc97f934b999a6828693a99157fde912540cc",
+                "sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
+                "sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
+                "sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
+                "sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
+                "sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
+                "sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
+                "sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
+                "sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
+                "sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
+                "sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
+                "sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
+                "sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc"
            ],
            "index": "pypi",
-            "version": "==5.3.1"
+            "version": "==5.4.1"
        },
        "regex": {
            "hashes": [
@ -1706,17 +1725,17 @@
        },
        "smmap": {
            "hashes": [
-                "sha256:54c44c197c819d5ef1991799a7e30b662d1e520f2ac75c9efbeb54a742214cf4",
-                "sha256:9c98bbd1f9786d22f14b3d4126894d56befb835ec90cef151af566c7e19b5d24"
+                "sha256:7bfcf367828031dc893530a29cb35eb8c8f2d7c8f2d0989354d75d24c8573714",
+                "sha256:84c2751ef3072d4f6b2785ec7ee40244c6f45eb934d9e543e2c51f1bd3d54c50"
            ],
-            "version": "==3.0.4"
+            "version": "==3.0.5"
        },
        "snowballstemmer": {
            "hashes": [
-                "sha256:209f257d7533fdb3cb73bdbd24f436239ca3b2fa67d56f6ff88e86be08cc5ef0",
-                "sha256:df3bac3df4c2c01363f3dd2cfa78cce2840a79b9f1c2d2de9ce8d31683992f52"
+                "sha256:b51b447bea85f9968c13b650126a888aabd4cb4463fca868ec596826325dedc2",
+                "sha256:e997baa4f2e9139951b6f4c631bad912dfd3c792467e2f03d7239464af90e914"
            ],
-            "version": "==2.0.0"
+            "version": "==2.1.0"
        },
        "sqlparse": {
            "hashes": [
@ -1787,12 +1806,11 @@
                "secure"
            ],
            "hashes": [
-                "sha256:19188f96923873c92ccb987120ec4acaa12f0461fa9ce5d3d0772bc965a39e08",
-                "sha256:d8ff90d979214d7b4f8ce956e80f4028fc6860e4431f731ea4a8c08f23f99473"
+                "sha256:1b465e494e3e0d8939b50680403e3aedaa2bc434b7d5af64dfd3c958d7f5ae80",
+                "sha256:de3eedaad74a2683334e282005cd8d7f22f4d55fa690a2a1020a416cb0a47e73"
            ],
            "index": "pypi",
-            "markers": null,
-            "version": "==1.26.2"
+            "version": "==1.26.3"
        },
        "wrapt": {
            "hashes": [
--- a/SECURITY.md
+++ b/SECURITY.md
@ -2,13 +2,11 @@

 ## Supported Versions

-As authentik is currently in a pre-stable, only the latest "stable" version is supported. After authentik 1.0, this will change.
-
-| Version  | Supported          |
-| -------- | ------------------ |
-| 0.12.x   | :white_check_mark: |
-| 0.13.x   | :white_check_mark: |
-| 0.14.x   | :white_check_mark: |
+| Version    | Supported          |
+| ---------- | ------------------ |
+| 0.13.x     | :white_check_mark: |
+| 0.14.x     | :white_check_mark: |
+| 2021.1.x   | :white_check_mark: |

 ## Reporting a Vulnerability

--- a/authentik/init.py
+++ b/authentik/init.py
@ -1,2 +1,2 @@
 """authentik"""
-__version__ = "0.14.1-stable"
+__version__ = "2021.2.6-stable"
--- a/authentik/admin/api/tasks.py
+++ b/authentik/admin/api/tasks.py
@ -14,7 +14,7 @@ from rest_framework.response import Response
 from rest_framework.serializers import Serializer
 from rest_framework.viewsets import ViewSet

-from authentik.lib.tasks import TaskInfo
+from authentik.events.monitored_tasks import TaskInfo


 class TaskSerializer(Serializer):
--- a/authentik/admin/forms/source.py
+++ b/authentik/admin/forms/source.py
@ -1,19 +0,0 @@
-"""authentik core source form fields"""
-
-SOURCE_FORM_FIELDS = [
-    "name",
-    "slug",
-    "enabled",
-    "authentication_flow",
-    "enrollment_flow",
-]
-SOURCE_SERIALIZER_FIELDS = [
-    "pk",
-    "name",
-    "slug",
-    "enabled",
-    "authentication_flow",
-    "enrollment_flow",
-    "verbose_name",
-    "verbose_name_plural",
-]
--- a/authentik/admin/tasks.py
+++ b/authentik/admin/tasks.py
@ -1,17 +1,22 @@
 """authentik admin tasks"""
+import re
+
 from django.core.cache import cache
+from django.core.validators import URLValidator
 from packaging.version import parse
 from requests import RequestException, get
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik import __version__
 from authentik.events.models import Event, EventAction
-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP

 LOGGER = get_logger()
 VERSION_CACHE_KEY = "authentik_latest_version"
-VERSION_CACHE_TIMEOUT = 2 * 60 * 60  # 2 hours
+VERSION_CACHE_TIMEOUT = 8 * 60 * 60  # 8 hours
+# Chop of the first ^ because we want to search the entire string
+URL_FINDER = URLValidator.regex.pattern[1:]


@CELERY_APP.task(bind=True, base=MonitoredTask)
@ -39,7 +44,10 @@ def update_latest_version(self: MonitoredTask):
                context__new_version=upstream_version,
            ).exists():
                return
-            Event.new(EventAction.UPDATE_AVAILABLE, new_version=upstream_version).save()
+            event_dict = {"new_version": upstream_version}
+            if match := re.search(URL_FINDER, data.get("body", "")):
+                event_dict["message"] = f"Changelog: {match.group()}"
+            Event.new(EventAction.UPDATE_AVAILABLE, **event_dict).save()
    except (RequestException, IndexError) as exc:
        cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
        self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
--- a/authentik/admin/templates/administration/certificatekeypair/generate.html
+++ b/authentik/admin/templates/administration/certificatekeypair/generate.html
@ -0,0 +1,14 @@
+{% extends base_template|default:"generic/form.html" %}
+
+{% load authentik_utils %}
+{% load i18n %}
+
+{% block above_form %}
+<h1>
+    {% trans 'Generate Certificate-Key Pair' %}
+</h1>
+{% endblock %}
+
+{% block action %}
+{% trans 'Generate Certificate-Key Pair' %}
+{% endblock %}
--- a/authentik/admin/templates/administration/certificatekeypair/list.html
+++ b/authentik/admin/templates/administration/certificatekeypair/list.html
@ -26,6 +26,12 @@
                        </ak-spinner-button>
                        <div slot="modal"></div>
                    </ak-modal-button>
+                    <ak-modal-button href="{% url 'authentik_admin:certificatekeypair-generate' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Generate' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
                        {% trans 'Refresh' %}
                    </button>
--- a/authentik/admin/templates/administration/outpost/list.html
+++ b/authentik/admin/templates/administration/outpost/list.html
@ -1,149 +0,0 @@
-{% extends "administration/base.html" %}
-
-{% load i18n %}
-{% load humanize %}
-{% load authentik_utils %}
-{% load admin_reflection %}
-
-{% block content %}
-<section class="pf-c-page__main-section pf-m-light">
-    <div class="pf-c-content">
-        <h1>
-            <i class="pf-icon pf-icon-zone"></i>
-            {% trans 'Outposts' %}
-        </h1>
-        <p>{% trans "Outposts are deployments of authentik components to support different environments and protocols, like reverse proxies." %}</p>
-    </div>
-</section>
-<section class="pf-c-page__main-section pf-m-no-padding-mobile">
-    <div class="pf-c-card">
-        {% if object_list %}
-        <div class="pf-c-toolbar">
-            <div class="pf-c-toolbar__content">
-                {% include 'partials/toolbar_search.html' %}
-                <div class="pf-c-toolbar__bulk-select">
-                    <ak-modal-button href="{% url 'authentik_admin:outpost-create' %}">
-                        <ak-spinner-button slot="trigger" class="pf-m-primary">
-                            {% trans 'Create' %}
-                        </ak-spinner-button>
-                        <div slot="modal"></div>
-                    </ak-modal-button>
-                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
-                        {% trans 'Refresh' %}
-                    </button>
-                </div>
-                {% include 'partials/pagination.html' %}
-            </div>
-        </div>
-        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
-            <thead>
-                <tr role="row">
-                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
-                    <th role="columnheader" scope="col">{% trans 'Providers' %}</th>
-                    <th role="columnheader" scope="col">{% trans 'Health' %}</th>
-                    <th role="columnheader" scope="col">{% trans 'Version' %}</th>
-                    <th role="cell"></th>
-                </tr>
-            </thead>
-            <tbody role="rowgroup">
-                {% for outpost in object_list %}
-                <tr role="row">
-                    <th role="columnheader">
-                        <span>{{ outpost.name }}</span>
-                    </th>
-                    <td role="cell">
-                        <span>
-                            {{ outpost.providers.all.select_subclasses|join:", " }}
-                        </span>
-                    </td>
-                    {% with states=outpost.state %}
-                    {% if states|length > 0 %}
-                        <td role="cell">
-                            {% for state in states %}
-                            <div>
-                                {% if state.last_seen %}
-                                <i class="fas fa-check pf-m-success"></i> {{ state.last_seen|naturaltime }}
-                                {% else %}
-                                <i class="fas fa-times pf-m-danger"></i> {% trans 'Unhealthy' %}
-                                {% endif %}
-                            </div>
-                            {% endfor %}
-                        </td>
-                        <td role="cell">
-                            {% for state in states %}
-                                <div>
-                                    {% if not state.version %}
-                                    <i class="fas fa-question-circle"></i>
-                                    {% elif state.version_outdated %}
-                                    <i class="fas fa-times pf-m-danger"></i> {% blocktrans with is=state.version should=state.version_should %}{{ is }}, should be {{ should }}{% endblocktrans %}
-                                    {% else %}
-                                    <i class="fas fa-check pf-m-success"></i> {{ state.version }}
-                                    {% endif %}
-                                </div>
-                            {% endfor %}
-                        </td>
-                    {% else %}
-                        <td role="cell">
-                            <i class="fas fa-question-circle"></i>
-                        </td>
-                        <td role="cell">
-                            <i class="fas fa-question-circle"></i>
-                        </td>
-                    {% endif %}
-                    {% endwith %}
-                    <td>
-                        <ak-modal-button href="{% url 'authentik_admin:outpost-update' pk=outpost.pk %}">
-                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
-                                {% trans 'Edit' %}
-                            </ak-spinner-button>
-                            <div slot="modal"></div>
-                        </ak-modal-button>
-                        <ak-modal-button href="{% url 'authentik_admin:outpost-delete' pk=outpost.pk %}">
-                            <ak-spinner-button slot="trigger" class="pf-m-danger">
-                                {% trans 'Delete' %}
-                            </ak-spinner-button>
-                            <div slot="modal"></div>
-                        </ak-modal-button>
-                        {% get_htmls outpost as htmls %}
-                        {% for html in htmls %}
-                        {{ html|safe }}
-                        {% endfor %}
-                    </td>
-                </tr>
-                {% endfor %}
-            </tbody>
-        </table>
-        <div class="pf-c-pagination pf-m-bottom">
-            {% include 'partials/pagination.html' %}
-        </div>
-        {% else %}
-        <div class="pf-c-toolbar">
-            <div class="pf-c-toolbar__content">
-                {% include 'partials/toolbar_search.html' %}
-            </div>
-        </div>
-        <div class="pf-c-empty-state">
-            <div class="pf-c-empty-state__content">
-                <i class="fas fa-map-marker pf-c-empty-state__icon" aria-hidden="true"></i>
-                <h1 class="pf-c-title pf-m-lg">
-                    {% trans 'No Outposts.' %}
-                </h1>
-                <div class="pf-c-empty-state__body">
-                {% if request.GET.search != "" %}
-                    {% trans "Your search query doesn't match any outposts." %}
-                {% else %}
-                    {% trans 'Currently no outposts exist. Click the button below to create one.' %}
-                {% endif %}
-                </div>
-                <ak-modal-button href="{% url 'authentik_admin:outpost-create' %}">
-                    <ak-spinner-button slot="trigger" class="pf-m-primary">
-                        {% trans 'Create' %}
-                    </ak-spinner-button>
-                    <div slot="modal"></div>
-                </ak-modal-button>
-            </div>
-        </div>
-        {% endif %}
-    </div>
-</section>
-{% endblock %}
--- a/authentik/admin/templates/administration/outpost_service_connection/list.html
+++ b/authentik/admin/templates/administration/outpost_service_connection/list.html
@ -3,7 +3,6 @@
 {% load i18n %}
 {% load humanize %}
 {% load authentik_utils %}
-{% load admin_reflection %}

 {% block content %}
 <section class="pf-c-page__main-section pf-m-light">
--- a/authentik/admin/templates/administration/policy/list.html
+++ b/authentik/admin/templates/administration/policy/list.html
@ -41,6 +41,9 @@
                            {% endfor %}
                        </ul>
                    </ak-dropdown>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
                </div>
                {% include 'partials/pagination.html' %}
            </div>
--- a/authentik/admin/templates/administration/policy/test.html
+++ b/authentik/admin/templates/administration/policy/test.html
@ -3,7 +3,42 @@
 {% load i18n %}

 {% block above_form %}
-<h1>{% blocktrans with policy=policy %}Test policy {{ policy }}{% endblocktrans %}</h1>
+<h1>{% blocktrans with policy=policy %}Test {{ policy }}{% endblocktrans %}</h1>
+{% endblock %}
+
+{% block beneath_form %}
+{% if result %}
+<div class="pf-c-form__group ">
+    <div class="pf-c-form__group-label">
+        <label class="pf-c-form__label" for="context-1">
+            <span class="pf-c-form__label-text">{% trans 'Passing' %}</span>
+        </label>
+    </div>
+    <div class="pf-c-form__group-label">
+        <div class="c-form__horizontal-group">
+            <span class="pf-c-form__label-text">{{ result.passing|yesno:"Yes,No" }}</span>
+        </div>
+    </div>
+</div>
+<div class="pf-c-form__group ">
+    <div class="pf-c-form__group-label">
+        <label class="pf-c-form__label" for="context-1">
+            <span class="pf-c-form__label-text">{% trans 'Messages' %}</span>
+        </label>
+    </div>
+    <div class="pf-c-form__group-label">
+        <div class="c-form__horizontal-group">
+            <ul>
+                {% for m in result.messages %}
+                <li><span class="pf-c-form__label-text">{{ m }}</span></li>
+                {% empty %}
+                <li><span class="pf-c-form__label-text">-</span></li>
+                {% endfor %}
+            </ul>
+        </div>
+    </div>
+</div>
+{% endif %}
 {% endblock %}

 {% block action %}
--- a/authentik/admin/templates/administration/property_mapping/list.html
+++ b/authentik/admin/templates/administration/property_mapping/list.html
@ -1,139 +0,0 @@
-{% extends "administration/base.html" %}
-
-{% load i18n %}
-{% load authentik_utils %}
-
-{% block content %}
-<section class="pf-c-page__main-section pf-m-light">
-    <div class="pf-c-content">
-        <h1>
-            <i class="pf-icon pf-icon-blueprint"></i>
-            {% trans 'Property Mappings' %}
-        </h1>
-        <p>{% trans "Control how authentik exposes and interprets information." %}
-        </p>
-    </div>
-</section>
-<section class="pf-c-page__main-section pf-m-no-padding-mobile">
-    <div class="pf-c-card">
-        {% if object_list %}
-        <div class="pf-c-toolbar">
-            <div class="pf-c-toolbar__content">
-                {% include 'partials/toolbar_search.html' %}
-                <div class="pf-c-toolbar__bulk-select">
-                    <ak-dropdown class="pf-c-dropdown">
-                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                        </button>
-                        <ul class="pf-c-dropdown__menu" hidden>
-                            {% for type, name in types.items %}
-                            <li>
-                                <ak-modal-button href="{% url 'authentik_admin:property-mapping-create' %}?type={{ type }}">
-                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
-                                        {{ name|verbose_name }}<br>
-                                        <small>
-                                            {{ name|doc }}
-                                        </small>
-                                    </button>
-                                    <div slot="modal"></div>
-                                </ak-modal-button>
-                            </li>
-                            {% endfor %}
-                        </ul>
-                    </ak-dropdown>
-                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
-                        {% trans 'Refresh' %}
-                    </button>
-                </div>
-                {% include 'partials/pagination.html' %}
-            </div>
-        </div>
-        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
-            <thead>
-                <tr role="row">
-                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
-                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
-                    <th role="cell"></th>
-                </tr>
-            </thead>
-            <tbody role="rowgroup">
-                {% for property_mapping in object_list %}
-                <tr role="row">
-                    <td role="cell">
-                        <span>
-                            {{ property_mapping.name }}
-                        </span>
-                    </td>
-                    <td role="cell">
-                        <span>
-                            {{ property_mapping|verbose_name }}
-                        </span>
-                    </td>
-                    <td>
-                        <ak-modal-button href="{% url 'authentik_admin:property-mapping-update' pk=property_mapping.pk %}">
-                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
-                                {% trans 'Edit' %}
-                            </ak-spinner-button>
-                            <div slot="modal"></div>
-                        </ak-modal-button>
-                        <ak-modal-button href="{% url 'authentik_admin:property-mapping-delete' pk=property_mapping.pk %}">
-                            <ak-spinner-button slot="trigger" class="pf-m-danger">
-                                {% trans 'Delete' %}
-                            </ak-spinner-button>
-                            <div slot="modal"></div>
-                        </ak-modal-button>
-                    </td>
-                </tr>
-                {% endfor %}
-            </tbody>
-        </table>
-        <div class="pf-c-pagination pf-m-bottom">
-            {% include 'partials/pagination.html' %}
-        </div>
-        {% else %}
-        <div class="pf-c-toolbar">
-            <div class="pf-c-toolbar__content">
-                {% include 'partials/toolbar_search.html' %}
-            </div>
-        </div>
-        <div class="pf-c-empty-state">
-            <div class="pf-c-empty-state__content">
-                <i class="pf-icon pf-icon-blueprint pf-c-empty-state__icon" aria-hidden="true"></i>
-                <h1 class="pf-c-title pf-m-lg">
-                    {% trans 'No Property Mappings.' %}
-                </h1>
-                <div class="pf-c-empty-state__body">
-                {% if request.GET.search != "" %}
-                    {% trans "Your search query doesn't match any property mappings." %}
-                {% else %}
-                    {% trans 'Currently no property mappings exist. Click the button below to create one.' %}
-                {% endif %}
-                </div>
-                <ak-dropdown class="pf-c-dropdown">
-                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                    </button>
-                    <ul class="pf-c-dropdown__menu" hidden>
-                        {% for type, name in types.items %}
-                        <li>
-                            <ak-modal-button href="{% url 'authentik_admin:property-mapping-create' %}?type={{ type }}">
-                                <button slot="trigger" class="pf-c-dropdown__menu-item">
-                                    {{ name|verbose_name }}<br>
-                                    <small>
-                                        {{ name|doc }}
-                                    </small>
-                                </button>
-                                <div slot="modal"></div>
-                            </ak-modal-button>
-                        </li>
-                        {% endfor %}
-                    </ul>
-                </ak-dropdown>
-            </div>
-        </div>
-        {% endif %}
-    </div>
-</section>
-{% endblock %}
--- a/authentik/admin/templates/administration/property_mapping/test.html
+++ b/authentik/admin/templates/administration/property_mapping/test.html
@ -0,0 +1,28 @@
+{% extends 'generic/form.html' %}
+
+{% load i18n %}
+
+{% block above_form %}
+<h1>{% blocktrans with property_mapping=property_mapping %}Test {{ property_mapping }}{% endblocktrans %}</h1>
+{% endblock %}
+
+{% block beneath_form %}
+{% if result %}
+<div class="pf-c-form__group ">
+    <div class="pf-c-form__group-label">
+        <label class="pf-c-form__label" for="context-1">
+            <span class="pf-c-form__label-text">{% trans 'Result' %}</span>
+        </label>
+    </div>
+    <div class="pf-c-form__group-control">
+        <div class="c-form__horizontal-group">
+            <ak-codemirror mode="javascript"><textarea class="pf-c-form-control">{{ result }}</textarea></ak-codemirror>
+        </div>
+    </div>
+</div>
+{% endif %}
+{% endblock %}
+
+{% block action %}
+{% trans 'Test' %}
+{% endblock %}
--- a/authentik/admin/templates/administration/provider/list.html
+++ b/authentik/admin/templates/administration/provider/list.html
@ -1,170 +0,0 @@
-{% extends "administration/base.html" %}
-
-{% load i18n %}
-{% load authentik_utils %}
-{% load admin_reflection %}
-
-{% block content %}
-<section class="pf-c-page__main-section pf-m-light">
-    <div class="pf-c-content">
-        <h1>
-            <i class="pf-icon pf-icon-integration"></i>
-            {% trans 'Providers' %}
-        </h1>
-        <p>{% trans "Provide support for protocols like SAML and OAuth to assigned applications." %}
-    </p>
-    </div>
-</section>
-<section class="pf-c-page__main-section pf-m-no-padding-mobile">
-    <div class="pf-c-card">
-        {% if object_list %}
-        <div class="pf-c-toolbar">
-            <div class="pf-c-toolbar__content">
-                {% include 'partials/toolbar_search.html' %}
-                <div class="pf-c-toolbar__bulk-select">
-                    <ak-dropdown class="pf-c-dropdown">
-                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                        </button>
-                        <ul class="pf-c-dropdown__menu" hidden>
-                            {% for type, name in types.items %}
-                            <li>
-                                <ak-modal-button href="{% url 'authentik_admin:provider-create' %}?type={{ type }}">
-                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
-                                        {{ name|verbose_name }}<br>
-                                        <small>
-                                            {{ name|doc }}
-                                        </small>
-                                    </button>
-                                    <div slot="modal"></div>
-                                </ak-modal-button>
-                            </li>
-                            {% endfor %}
-                            <li>
-                                <ak-modal-button href="{% url 'authentik_admin:provider-saml-from-metadata' %}">
-                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
-                                        {% trans 'SAML Provider from Metadata' %}<br>
-                                        <small>
-                                            {% trans "Create a SAML Provider by importing its Metadata." %}
-                                        </small>
-                                    </button>
-                                    <div slot="modal"></div>
-                                </ak-modal-button>
-                            </li>
-                        </ul>
-                    </ak-dropdown>
-                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
-                        {% trans 'Refresh' %}
-                    </button>
-                </div>
-                {% include 'partials/pagination.html' %}
-            </div>
-        </div>
-        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
-            <thead>
-                <tr role="row">
-                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
-                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
-                    <th role="cell"></th>
-                </tr>
-            </thead>
-            <tbody role="rowgroup">
-                {% for provider in object_list %}
-                <tr role="row">
-                    <th role="columnheader">
-                        <div>
-                            <div>{{ provider.name }}</div>
-                            {% if not provider.application %}
-                            <i class="pf-icon pf-icon-warning-triangle"></i>
-                            <small>{% trans 'Warning: Provider not assigned to any application.' %}</small>
-                            {% else %}
-                            <i class="pf-icon pf-icon-ok"></i>
-                            <small>
-                                {% blocktrans with app=provider.application %}
-                                    Assigned to application {{ app }}.
-                                {% endblocktrans %}
-                            </small>
-                            {% endif %}
-                        </div>
-                    </th>
-                    <td role="cell">
-                        <span>
-                            {{ provider|verbose_name }}
-                        </span>
-                    </td>
-                    <td>
-                        <ak-modal-button href="{% url 'authentik_admin:provider-update' pk=provider.pk %}">
-                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
-                                {% trans 'Edit' %}
-                            </ak-spinner-button>
-                            <div slot="modal"></div>
-                        </ak-modal-button>
-                        <ak-modal-button href="{% url 'authentik_admin:provider-delete' pk=provider.pk %}">
-                            <ak-spinner-button slot="trigger" class="pf-m-danger">
-                                {% trans 'Delete' %}
-                            </ak-spinner-button>
-                            <div slot="modal"></div>
-                        </ak-modal-button>
-                        {% get_links provider as links %}
-                        {% for name, href in links.items %}
-                            <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
-                        {% endfor %}
-                        {% get_htmls provider as htmls %}
-                        {% for html in htmls %}
-                            {{ html|safe }}
-                        {% endfor %}
-                    </td>
-                </tr>
-                {% endfor %}
-            </tbody>
-        </table>
-        <div class="pf-c-pagination pf-m-bottom">
-            {% include 'partials/pagination.html' %}
-        </div>
-        {% else %}
-        <div class="pf-c-toolbar">
-            <div class="pf-c-toolbar__content">
-                {% include 'partials/toolbar_search.html' %}
-            </div>
-        </div>
-        <div class="pf-c-empty-state">
-            <div class="pf-c-empty-state__content">
-                <i class="pf-icon-integration pf-c-empty-state__icon" aria-hidden="true"></i>
-                <h1 class="pf-c-title pf-m-lg">
-                    {% trans 'No Providers.' %}
-                </h1>
-                <div class="pf-c-empty-state__body">
-                {% if request.GET.search != "" %}
-                    {% trans "Your search query doesn't match any providers." %}
-                {% else %}
-                    {% trans 'Currently no providers exist. Click the button below to create one.' %}
-                {% endif %}
-                </div>
-                <ak-dropdown class="pf-c-dropdown">
-                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
-                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
-                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
-                    </button>
-                    <ul class="pf-c-dropdown__menu" hidden>
-                        {% for type, name in types.items %}
-                        <li>
-                            <ak-modal-button href="{% url 'authentik_admin:provider-create' %}?type={{ type }}">
-                                <button slot="trigger" class="pf-c-dropdown__menu-item">
-                                    {{ name|verbose_name }}<br>
-                                    <small>
-                                        {{ name|doc }}
-                                    </small>
-                                </button>
-                                <div slot="modal"></div>
-                            </ak-modal-button>
-                        </li>
-                        {% endfor %}
-                    </ul>
-                </ak-dropdown>
-            </div>
-        </div>
-        {% endif %}
-    </div>
-</section>
-{% endblock %}
--- a/authentik/admin/templates/administration/source/list.html
+++ b/authentik/admin/templates/administration/source/list.html
@ -2,7 +2,6 @@

 {% load i18n %}
 {% load authentik_utils %}
-{% load admin_reflection %}

 {% block content %}
 <section class="pf-c-page__main-section pf-m-light">
@ -63,7 +62,7 @@
                {% for source in object_list %}
                <tr role="row">
                    <th role="columnheader">
-                        <a href="/sources/{{ source.slug }}/">
+                        <a href="/sources/{{ source.slug }}">
                            <div>{{ source.name }}</div>
                            {% if not source.enabled %}
                            <small>{% trans 'Disabled' %}</small>
@ -93,10 +92,6 @@
                            </ak-spinner-button>
                            <div slot="modal"></div>
                        </ak-modal-button>
-                        {% get_links source as links %}
-                        {% for name, href in links %}
-                            <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
-                        {% endfor %}
                    </td>
                </tr>
                {% endfor %}
--- a/authentik/admin/templates/administration/stage/list.html
+++ b/authentik/admin/templates/administration/stage/list.html
@ -2,7 +2,6 @@

 {% load i18n %}
 {% load authentik_utils %}
-{% load admin_reflection %}

 {% block content %}
 <section class="pf-c-page__main-section pf-m-light">
@ -88,10 +87,6 @@
                            </ak-spinner-button>
                            <div slot="modal"></div>
                        </ak-modal-button>
-                        {% get_links stage as links %}
-                        {% for name, href in links.items %}
-                        <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
-                        {% endfor %}
                    </td>
                </tr>
                {% endfor %}
--- a/authentik/admin/templates/administration/stage_prompt/list.html
+++ b/authentik/admin/templates/administration/stage_prompt/list.html
@ -2,7 +2,6 @@

 {% load i18n %}
 {% load authentik_utils %}
-{% load admin_reflection %}

 {% block content %}
 <section class="pf-c-page__main-section pf-m-light">
@ -90,10 +89,6 @@
                            </ak-spinner-button>
                            <div slot="modal"></div>
                        </ak-modal-button>
-                        {% get_links prompt as links %}
-                        {% for name, href in links.items %}
-                        <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
-                        {% endfor %}
                    </td>
                </tr>
                {% endfor %}
--- a/authentik/admin/templates/administration/task/list.html
+++ b/authentik/admin/templates/administration/task/list.html
@ -38,7 +38,7 @@
                {% for task in object_list %}
                <tr role="row">
                    <th role="columnheader">
-                        <pre>{{ task.task_name }}</pre>
+                        <span>{{ task.html_name|join:"_&shy;" }}</span>
                    </th>
                    <td role="cell">
                        <span>
--- a/authentik/admin/templatetags/admin_reflection.py
+++ b/authentik/admin/templatetags/admin_reflection.py
@ -1,62 +0,0 @@
-"""authentik admin templatetags"""
-from django import template
-from django.db.models import Model
-from django.utils.html import mark_safe
-from structlog import get_logger
-
-register = template.Library()
-LOGGER = get_logger()
-
-
-@register.simple_tag()
-def get_links(model_instance):
-    """Find all link_ methods on an object instance, run them and return as dict"""
-    prefix = "link_"
-    links = {}
-
-    if not isinstance(model_instance, Model):
-        LOGGER.warning("Model is not instance of Model", model_instance=model_instance)
-        return links
-
-    try:
-        for name in dir(model_instance):
-            if not name.startswith(prefix):
-                continue
-            value = getattr(model_instance, name)
-            if not callable(value):
-                continue
-            human_name = name.replace(prefix, "").replace("_", " ").capitalize()
-            link = value()
-            if link:
-                links[human_name] = link
-    except NotImplementedError:
-        pass
-
-    return links
-
-
-@register.simple_tag(takes_context=True)
-def get_htmls(context, model_instance):
-    """Find all html_ methods on an object instance, run them and return as dict"""
-    prefix = "html_"
-    htmls = []
-
-    if not isinstance(model_instance, Model):
-        LOGGER.warning("Model is not instance of Model", model_instance=model_instance)
-        return htmls
-
-    try:
-        for name in dir(model_instance):
-            if not name.startswith(prefix):
-                continue
-            value = getattr(model_instance, name)
-            if not callable(value):
-                continue
-            if name.startswith(prefix):
-                html = value(context.get("request"))
-                if html:
-                    htmls.append(mark_safe(html))
-    except NotImplementedError:
-        pass
-
-    return htmls
--- a/authentik/admin/tests/test_tasks.py
+++ b/authentik/admin/tests/test_tasks.py
@ -32,7 +32,8 @@ REQUEST_MOCK_VALID = Mock(
    return_value=MockResponse(
        200,
        """{
-            "tag_name": "version/1.2.3"
+            "tag_name": "version/99999999.9999999",
+            "body": "https://goauthentik.io/test"
        }""",
    )
 )
@ -47,10 +48,12 @@ class TestAdminTasks(TestCase):
    def test_version_valid_response(self):
        """Test Update checker with valid response"""
        update_latest_version.delay().get()
-        self.assertEqual(cache.get(VERSION_CACHE_KEY), "1.2.3")
+        self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
        self.assertTrue(
            Event.objects.filter(
-                action=EventAction.UPDATE_AVAILABLE, context__new_version="1.2.3"
+                action=EventAction.UPDATE_AVAILABLE,
+                context__new_version="99999999.9999999",
+                context__message="Changelog: https://goauthentik.io/test",
            ).exists()
        )
        # test that a consecutive check doesn't create a duplicate event
@ -58,7 +61,9 @@ class TestAdminTasks(TestCase):
        self.assertEqual(
            len(
                Event.objects.filter(
-                    action=EventAction.UPDATE_AVAILABLE, context__new_version="1.2.3"
+                    action=EventAction.UPDATE_AVAILABLE,
+                    context__new_version="99999999.9999999",
+                    context__message="Changelog: https://goauthentik.io/test",
                )
            ),
            1,
--- a/authentik/admin/urls.py
+++ b/authentik/admin/urls.py
@ -4,6 +4,8 @@ from django.urls import path
 from authentik.admin.views import (
    applications,
    certificate_key_pair,
+    events_notifications_rules,
+    events_notifications_transports,
    flows,
    groups,
    outposts,
@ -22,7 +24,7 @@ from authentik.admin.views import (
    tokens,
    users,
 )
-from authentik.providers.saml.views import MetadataImportView
+from authentik.providers.saml.views.metadata import MetadataImportView

 urlpatterns = [
    path(
@ -59,7 +61,6 @@ urlpatterns = [
        name="token-delete",
    ),
    # Sources
-    path("sources/", sources.SourceListView.as_view(), name="sources"),
    path("sources/create/", sources.SourceCreateView.as_view(), name="source-create"),
    path(
        "sources/<uuid:pk>/update/",
@ -111,7 +112,6 @@ urlpatterns = [
        name="policy-binding-delete",
    ),
    # Providers
-    path("providers/", providers.ProviderListView.as_view(), name="providers"),
    path(
        "providers/create/",
        providers.ProviderCreateView.as_view(),
@ -168,22 +168,22 @@ urlpatterns = [
    ),
    # Stage Prompts
    path(
-        "stages/prompts/",
+        "stages_prompts/",
        stages_prompts.PromptListView.as_view(),
        name="stage-prompts",
    ),
    path(
-        "stages/prompts/create/",
+        "stages_prompts/create/",
        stages_prompts.PromptCreateView.as_view(),
        name="stage-prompt-create",
    ),
    path(
-        "stages/prompts/<uuid:pk>/update/",
+        "stages_prompts/<uuid:pk>/update/",
        stages_prompts.PromptUpdateView.as_view(),
        name="stage-prompt-update",
    ),
    path(
-        "stages/prompts/<uuid:pk>/delete/",
+        "stages_prompts/<uuid:pk>/delete/",
        stages_prompts.PromptDeleteView.as_view(),
        name="stage-prompt-delete",
    ),
@ -236,11 +236,6 @@ urlpatterns = [
        name="flow-delete",
    ),
    # Property Mappings
-    path(
-        "property-mappings/",
-        property_mappings.PropertyMappingListView.as_view(),
-        name="property-mappings",
-    ),
    path(
        "property-mappings/create/",
        property_mappings.PropertyMappingCreateView.as_view(),
@ -256,6 +251,11 @@ urlpatterns = [
        property_mappings.PropertyMappingDeleteView.as_view(),
        name="property-mapping-delete",
    ),
+    path(
+        "property-mappings/<uuid:pk>/test/",
+        property_mappings.PropertyMappingTestView.as_view(),
+        name="property-mapping-test",
+    ),
    # Users
    path("users/", users.UserListView.as_view(), name="users"),
    path("users/create/", users.UserCreateView.as_view(), name="user-create"),
@ -294,6 +294,11 @@ urlpatterns = [
        certificate_key_pair.CertificateKeyPairCreateView.as_view(),
        name="certificatekeypair-create",
    ),
+    path(
+        "crypto/certificates/generate/",
+        certificate_key_pair.CertificateKeyPairGenerateView.as_view(),
+        name="certificatekeypair-generate",
+    ),
    path(
        "crypto/certificates/<uuid:pk>/update/",
        certificate_key_pair.CertificateKeyPairUpdateView.as_view(),
@ -305,11 +310,6 @@ urlpatterns = [
        name="certificatekeypair-delete",
    ),
    # Outposts
-    path(
-        "outposts/",
-        outposts.OutpostListView.as_view(),
-        name="outposts",
-    ),
    path(
        "outposts/create/",
        outposts.OutpostCreateView.as_view(),
@ -327,22 +327,22 @@ urlpatterns = [
    ),
    # Outpost Service Connections
    path(
-        "outposts/service_connections/",
+        "outpost_service_connections/",
        outposts_service_connections.OutpostServiceConnectionListView.as_view(),
        name="outpost-service-connections",
    ),
    path(
-        "outposts/service_connections/create/",
+        "outpost_service_connections/create/",
        outposts_service_connections.OutpostServiceConnectionCreateView.as_view(),
        name="outpost-service-connection-create",
    ),
    path(
-        "outposts/service_connections/<uuid:pk>/update/",
+        "outpost_service_connections/<uuid:pk>/update/",
        outposts_service_connections.OutpostServiceConnectionUpdateView.as_view(),
        name="outpost-service-connection-update",
    ),
    path(
-        "outposts/service_connections/<uuid:pk>/delete/",
+        "outpost_service_connections/<uuid:pk>/delete/",
        outposts_service_connections.OutpostServiceConnectionDeleteView.as_view(),
        name="outpost-service-connection-delete",
    ),
@ -352,4 +352,36 @@ urlpatterns = [
        tasks.TaskListView.as_view(),
        name="tasks",
    ),
+    # Event Notification Transpots
+    path(
+        "events/transports/create/",
+        events_notifications_transports.NotificationTransportCreateView.as_view(),
+        name="notification-transport-create",
+    ),
+    path(
+        "events/transports/<uuid:pk>/update/",
+        events_notifications_transports.NotificationTransportUpdateView.as_view(),
+        name="notification-transport-update",
+    ),
+    path(
+        "events/transports/<uuid:pk>/delete/",
+        events_notifications_transports.NotificationTransportDeleteView.as_view(),
+        name="notification-transport-delete",
+    ),
+    # Event Notification Rules
+    path(
+        "events/rules/create/",
+        events_notifications_rules.NotificationRuleCreateView.as_view(),
+        name="notification-rule-create",
+    ),
+    path(
+        "events/rules/<uuid:pk>/update/",
+        events_notifications_rules.NotificationRuleUpdateView.as_view(),
+        name="notification-rule-update",
+    ),
+    path(
+        "events/rules/<uuid:pk>/delete/",
+        events_notifications_rules.NotificationRuleDeleteView.as_view(),
+        name="notification-rule-delete",
+    ),
 ]
--- a/authentik/admin/views/applications.py
+++ b/authentik/admin/views/applications.py
@ -4,7 +4,6 @@ from django.contrib.auth.mixins import (
    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
 from django.views.generic import UpdateView
 from guardian.mixins import PermissionRequiredMixin
@ -28,8 +27,8 @@ class ApplicationCreateView(
    form_class = ApplicationForm
    permission_required = "authentik_core.add_application"

+    success_url = "/"
    template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
    success_message = _("Successfully created Application")


@ -46,8 +45,8 @@ class ApplicationUpdateView(
    form_class = ApplicationForm
    permission_required = "authentik_core.change_application"

+    success_url = "/"
    template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
    success_message = _("Successfully updated Application")


@ -59,6 +58,6 @@ class ApplicationDeleteView(
    model = Application
    permission_required = "authentik_core.delete_application"

+    success_url = "/"
    template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
    success_message = _("Successfully deleted Application")
--- a/authentik/admin/views/certificate_key_pair.py
+++ b/authentik/admin/views/certificate_key_pair.py
@ -4,9 +4,11 @@ from django.contrib.auth.mixins import (
    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.http.response import HttpResponse
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
 from django.views.generic import ListView, UpdateView
+from django.views.generic.edit import FormView
 from guardian.mixins import PermissionListMixin, PermissionRequiredMixin

 from authentik.admin.views.utils import (
@ -15,7 +17,11 @@ from authentik.admin.views.utils import (
    SearchListMixin,
    UserPaginateListMixin,
 )
-from authentik.crypto.forms import CertificateKeyPairForm
+from authentik.crypto.builder import CertificateBuilder
+from authentik.crypto.forms import (
+    CertificateKeyPairForm,
+    CertificateKeyPairGenerateForm,
+)
 from authentik.crypto.models import CertificateKeyPair
 from authentik.lib.views import CreateAssignPermView

@ -52,7 +58,35 @@ class CertificateKeyPairCreateView(

    template_name = "generic/create.html"
    success_url = reverse_lazy("authentik_admin:certificate_key_pair")
-    success_message = _("Successfully created CertificateKeyPair")
+    success_message = _("Successfully created Certificate-Key Pair")
+
+
+class CertificateKeyPairGenerateView(
+    SuccessMessageMixin,
+    BackSuccessUrlMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    FormView,
+):
+    """Generate new CertificateKeyPair"""
+
+    model = CertificateKeyPair
+    form_class = CertificateKeyPairGenerateForm
+    permission_required = "authentik_crypto.add_certificatekeypair"
+
+    template_name = "administration/certificatekeypair/generate.html"
+    success_url = reverse_lazy("authentik_admin:certificate_key_pair")
+    success_message = _("Successfully generated Certificate-Key Pair")
+
+    def form_valid(self, form: CertificateKeyPairGenerateForm) -> HttpResponse:
+        builder = CertificateBuilder()
+        builder.common_name = form.data["common_name"]
+        builder.build(
+            subject_alt_names=form.data.get("subject_alt_name", "").split(","),
+            validity_days=int(form.data["validity_days"]),
+        )
+        builder.save()
+        return super().form_valid(form)


 class CertificateKeyPairUpdateView(
--- a/authentik/admin/views/events_notifications_rules.py
+++ b/authentik/admin/views/events_notifications_rules.py
@ -0,0 +1,63 @@
+"""authentik NotificationRule administration"""
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
+from django.contrib.messages.views import SuccessMessageMixin
+from django.utils.translation import gettext as _
+from django.views.generic import UpdateView
+from guardian.mixins import PermissionRequiredMixin
+
+from authentik.admin.views.utils import BackSuccessUrlMixin, DeleteMessageView
+from authentik.events.forms import NotificationRuleForm
+from authentik.events.models import NotificationRule
+from authentik.lib.views import CreateAssignPermView
+
+
+class NotificationRuleCreateView(
+    SuccessMessageMixin,
+    BackSuccessUrlMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
+    """Create new NotificationRule"""
+
+    model = NotificationRule
+    form_class = NotificationRuleForm
+    permission_required = "authentik_events.add_NotificationRule"
+
+    success_url = "/"
+    template_name = "generic/create.html"
+    success_message = _("Successfully created Notification Rule")
+
+
+class NotificationRuleUpdateView(
+    SuccessMessageMixin,
+    BackSuccessUrlMixin,
+    LoginRequiredMixin,
+    PermissionRequiredMixin,
+    UpdateView,
+):
+    """Update application"""
+
+    model = NotificationRule
+    form_class = NotificationRuleForm
+    permission_required = "authentik_events.change_NotificationRule"
+
+    success_url = "/"
+    template_name = "generic/update.html"
+    success_message = _("Successfully updated Notification Rule")
+
+
+class NotificationRuleDeleteView(
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
+):
+    """Delete application"""
+
+    model = NotificationRule
+    permission_required = "authentik_events.delete_NotificationRule"
+
+    success_url = "/"
+    template_name = "generic/delete.html"
+    success_message = _("Successfully deleted Notification Rule")
--- a/authentik/admin/views/events_notifications_transports.py
+++ b/authentik/admin/views/events_notifications_transports.py
@ -0,0 +1,60 @@
+"""authentik NotificationTransport administration"""
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
+from django.contrib.messages.views import SuccessMessageMixin
+from django.utils.translation import gettext as _
+from django.views.generic import UpdateView
+from guardian.mixins import PermissionRequiredMixin
+
+from authentik.admin.views.utils import BackSuccessUrlMixin, DeleteMessageView
+from authentik.events.forms import NotificationTransportForm
+from authentik.events.models import NotificationTransport
+from authentik.lib.views import CreateAssignPermView
+
+
+class NotificationTransportCreateView(
+    SuccessMessageMixin,
+    BackSuccessUrlMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
+    """Create new NotificationTransport"""
+
+    model = NotificationTransport
+    form_class = NotificationTransportForm
+    permission_required = "authentik_events.add_notificationtransport"
+    success_url = "/"
+    template_name = "generic/create.html"
+    success_message = _("Successfully created Notification Transport")
+
+
+class NotificationTransportUpdateView(
+    SuccessMessageMixin,
+    BackSuccessUrlMixin,
+    LoginRequiredMixin,
+    PermissionRequiredMixin,
+    UpdateView,
+):
+    """Update application"""
+
+    model = NotificationTransport
+    form_class = NotificationTransportForm
+    permission_required = "authentik_events.change_notificationtransport"
+    success_url = "/"
+    template_name = "generic/update.html"
+    success_message = _("Successfully updated Notification Transport")
+
+
+class NotificationTransportDeleteView(
+    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
+):
+    """Delete application"""
+
+    model = NotificationTransport
+    permission_required = "authentik_events.delete_notificationtransport"
+    success_url = "/"
+    template_name = "generic/delete.html"
+    success_message = _("Successfully deleted Notification Transport")
--- a/authentik/admin/views/flows.py
+++ b/authentik/admin/views/flows.py
@ -17,6 +17,7 @@ from authentik.admin.views.utils import (
    SearchListMixin,
    UserPaginateListMixin,
 )
+from authentik.flows.exceptions import FlowNonApplicableException
 from authentik.flows.forms import FlowForm, FlowImportForm
 from authentik.flows.models import Flow
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
@ -25,7 +26,7 @@ from authentik.flows.transfer.exporter import FlowExporter
 from authentik.flows.transfer.importer import FlowImporter
 from authentik.flows.views import SESSION_KEY_PLAN, FlowPlanner
 from authentik.lib.utils.urls import redirect_with_qs
-from authentik.lib.views import CreateAssignPermView
+from authentik.lib.views import CreateAssignPermView, bad_request_message


 class FlowListView(
@ -103,8 +104,17 @@ class FlowDebugExecuteView(LoginRequiredMixin, PermissionRequiredMixin, DetailVi
        flow: Flow = self.get_object()
        planner = FlowPlanner(flow)
        planner.use_cache = False
-        plan = planner.plan(self.request, {PLAN_CONTEXT_PENDING_USER: request.user})
-        self.request.session[SESSION_KEY_PLAN] = plan
+        try:
+            plan = planner.plan(self.request, {PLAN_CONTEXT_PENDING_USER: request.user})
+            self.request.session[SESSION_KEY_PLAN] = plan
+        except FlowNonApplicableException as exc:
+            return bad_request_message(
+                request,
+                _(
+                    "Flow not applicable to current user/request: %(messages)s"
+                    % {"messages": str(exc)}
+                ),
+            )
        return redirect_with_qs(
            "authentik_flows:flow-executor-shell",
            self.request.GET,
--- a/authentik/admin/views/outposts.py
+++ b/authentik/admin/views/outposts.py
@ -7,38 +7,16 @@ from django.contrib.auth.mixins import (
    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import ListView, UpdateView
-from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
+from django.views.generic import UpdateView
+from guardian.mixins import PermissionRequiredMixin

-from authentik.admin.views.utils import (
-    BackSuccessUrlMixin,
-    DeleteMessageView,
-    SearchListMixin,
-    UserPaginateListMixin,
-)
+from authentik.admin.views.utils import BackSuccessUrlMixin, DeleteMessageView
 from authentik.lib.views import CreateAssignPermView
 from authentik.outposts.forms import OutpostForm
 from authentik.outposts.models import Outpost, OutpostConfig


-class OutpostListView(
-    LoginRequiredMixin,
-    PermissionListMixin,
-    UserPaginateListMixin,
-    SearchListMixin,
-    ListView,
-):
-    """Show list of all outposts"""
-
-    model = Outpost
-    permission_required = "authentik_outposts.view_outpost"
-    ordering = "name"
-    template_name = "administration/outpost/list.html"
-    search_fields = ["name", "_config"]
-
-
 class OutpostCreateView(
    SuccessMessageMixin,
    BackSuccessUrlMixin,
@ -51,9 +29,8 @@ class OutpostCreateView(
    model = Outpost
    form_class = OutpostForm
    permission_required = "authentik_outposts.add_outpost"
-
+    success_url = "/"
    template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_admin:outposts")
    success_message = _("Successfully created Outpost")

    def get_initial(self) -> Dict[str, Any]:
@ -76,9 +53,8 @@ class OutpostUpdateView(
    model = Outpost
    form_class = OutpostForm
    permission_required = "authentik_outposts.change_outpost"
-
+    success_url = "/"
    template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_admin:outposts")
    success_message = _("Successfully updated Outpost")


@ -87,7 +63,6 @@ class OutpostDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessa

    model = Outpost
    permission_required = "authentik_outposts.delete_outpost"
-
+    success_url = "/"
    template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_admin:outposts")
    success_message = _("Successfully deleted Outpost")
--- a/authentik/admin/views/overview.py
+++ b/authentik/admin/views/overview.py
@ -5,10 +5,11 @@ from django.http.request import HttpRequest
 from django.http.response import HttpResponse
 from django.utils.translation import gettext as _
 from django.views.generic import FormView
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.admin.forms.overview import FlowCacheClearForm, PolicyCacheClearForm
 from authentik.admin.mixins import AdminRequiredMixin
+from authentik.core.api.applications import user_app_cache_key

 LOGGER = get_logger()

@ -17,15 +18,17 @@ class PolicyCacheClearView(AdminRequiredMixin, SuccessMessageMixin, FormView):
    """View to clear Policy cache"""

    form_class = PolicyCacheClearForm
-
-    template_name = "generic/form_non_model.html"
    success_url = "/"
+    template_name = "generic/form_non_model.html"
    success_message = _("Successfully cleared Policy cache")

    def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
        keys = cache.keys("policy_*")
        cache.delete_many(keys)
        LOGGER.debug("Cleared Policy cache", keys=len(keys))
+        # Also delete user application cache
+        keys = cache.keys(user_app_cache_key("*"))
+        cache.delete_many(keys)
        return super().post(request, *args, **kwargs)


@ -33,9 +36,8 @@ class FlowCacheClearView(AdminRequiredMixin, SuccessMessageMixin, FormView):
    """View to clear Flow cache"""

    form_class = FlowCacheClearForm
-
-    template_name = "generic/form_non_model.html"
    success_url = "/"
+    template_name = "generic/form_non_model.html"
    success_message = _("Successfully cleared Flow cache")

    def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
--- a/authentik/admin/views/policies.py
+++ b/authentik/admin/views/policies.py
@ -1,13 +1,11 @@
 """authentik Policy administration"""
 from typing import Any, Dict

-from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.db.models import QuerySet
 from django.http import HttpResponse
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
@ -99,7 +97,7 @@ class PolicyTestView(LoginRequiredMixin, DetailView, PermissionRequiredMixin, Fo
    template_name = "administration/policy/test.html"
    object = None

-    def get_object(self, queryset=None) -> QuerySet:
+    def get_object(self, queryset=None) -> Policy:
        return (
            Policy.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
        )
@ -117,13 +115,12 @@ class PolicyTestView(LoginRequiredMixin, DetailView, PermissionRequiredMixin, Fo
        user = form.cleaned_data.get("user")

        p_request = PolicyRequest(user)
+        p_request.debug = True
        p_request.http_request = self.request
-        p_request.context = form.cleaned_data
+        p_request.context = form.cleaned_data.get("context", {})

        proc = PolicyProcess(PolicyBinding(policy=policy), p_request, None)
        result = proc.execute()
-        if result.passing:
-            messages.success(self.request, _("User successfully passed policy."))
-        else:
-            messages.error(self.request, _("User didn't pass policy."))
-        return self.render_to_response(self.get_context_data(form=form, result=result))
+        context = self.get_context_data(form=form)
+        context["result"] = result
+        return self.render_to_response(context)
--- a/authentik/admin/views/property_mappings.py
+++ b/authentik/admin/views/property_mappings.py
@ -1,41 +1,28 @@
 """authentik PropertyMapping administration"""
+from json import dumps
+from typing import Any
+
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.urls import reverse_lazy
+from django.http import HttpResponse
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
+from django.views.generic import FormView
+from django.views.generic.detail import DetailView
+from guardian.mixins import PermissionRequiredMixin

+from authentik.admin.forms.policies import PolicyTestForm
 from authentik.admin.views.utils import (
    BackSuccessUrlMixin,
    DeleteMessageView,
    InheritanceCreateView,
-    InheritanceListView,
    InheritanceUpdateView,
-    SearchListMixin,
-    UserPaginateListMixin,
 )
 from authentik.core.models import PropertyMapping


-class PropertyMappingListView(
-    LoginRequiredMixin,
-    PermissionListMixin,
-    UserPaginateListMixin,
-    SearchListMixin,
-    InheritanceListView,
-):
-    """Show list of all property_mappings"""
-
-    model = PropertyMapping
-    permission_required = "authentik_core.view_propertymapping"
-    template_name = "administration/property_mapping/list.html"
-    ordering = "name"
-    search_fields = ["name", "expression"]
-
-
 class PropertyMappingCreateView(
    SuccessMessageMixin,
    BackSuccessUrlMixin,
@ -47,9 +34,8 @@ class PropertyMappingCreateView(

    model = PropertyMapping
    permission_required = "authentik_core.add_propertymapping"
-
+    success_url = "/"
    template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_admin:property-mappings")
    success_message = _("Successfully created Property Mapping")


@ -64,9 +50,8 @@ class PropertyMappingUpdateView(

    model = PropertyMapping
    permission_required = "authentik_core.change_propertymapping"
-
+    success_url = "/"
    template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_admin:property-mappings")
    success_message = _("Successfully updated Property Mapping")


@ -77,7 +62,47 @@ class PropertyMappingDeleteView(

    model = PropertyMapping
    permission_required = "authentik_core.delete_propertymapping"
-
+    success_url = "/"
    template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_admin:property-mappings")
    success_message = _("Successfully deleted Property Mapping")
+
+
+class PropertyMappingTestView(
+    LoginRequiredMixin, DetailView, PermissionRequiredMixin, FormView
+):
+    """View to test property mappings"""
+
+    model = PropertyMapping
+    form_class = PolicyTestForm
+    permission_required = "authentik_core.view_propertymapping"
+    template_name = "administration/property_mapping/test.html"
+    object = None
+
+    def get_object(self, queryset=None) -> PropertyMapping:
+        return (
+            PropertyMapping.objects.filter(pk=self.kwargs.get("pk"))
+            .select_subclasses()
+            .first()
+        )
+
+    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
+        kwargs["property_mapping"] = self.get_object()
+        return super().get_context_data(**kwargs)
+
+    def post(self, *args, **kwargs) -> HttpResponse:
+        self.object = self.get_object()
+        return super().post(*args, **kwargs)
+
+    def form_valid(self, form: PolicyTestForm) -> HttpResponse:
+        mapping = self.get_object()
+        user = form.cleaned_data.get("user")
+
+        context = self.get_context_data(form=form)
+        try:
+            result = mapping.evaluate(
+                user, self.request, **form.cleaned_data.get("context", {})
+            )
+            context["result"] = dumps(result, indent=4)
+        except Exception as exc:  # pylint: disable=broad-except
+            context["result"] = str(exc)
+        return self.render_to_response(context)
--- a/authentik/admin/views/providers.py
+++ b/authentik/admin/views/providers.py
@ -4,38 +4,18 @@ from django.contrib.auth.mixins import (
    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
+from guardian.mixins import PermissionRequiredMixin

 from authentik.admin.views.utils import (
    BackSuccessUrlMixin,
    DeleteMessageView,
    InheritanceCreateView,
-    InheritanceListView,
    InheritanceUpdateView,
-    SearchListMixin,
-    UserPaginateListMixin,
 )
 from authentik.core.models import Provider


-class ProviderListView(
-    LoginRequiredMixin,
-    PermissionListMixin,
-    UserPaginateListMixin,
-    SearchListMixin,
-    InheritanceListView,
-):
-    """Show list of all providers"""
-
-    model = Provider
-    permission_required = "authentik_core.add_provider"
-    template_name = "administration/provider/list.html"
-    ordering = "pk"
-    search_fields = ["pk", "name"]
-
-
 class ProviderCreateView(
    SuccessMessageMixin,
    BackSuccessUrlMixin,
@ -47,9 +27,8 @@ class ProviderCreateView(

    model = Provider
    permission_required = "authentik_core.add_provider"
-
+    success_url = "/"
    template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_admin:providers")
    success_message = _("Successfully created Provider")


@ -64,9 +43,8 @@ class ProviderUpdateView(

    model = Provider
    permission_required = "authentik_core.change_provider"
-
+    success_url = "/"
    template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_admin:providers")
    success_message = _("Successfully updated Provider")


@ -77,7 +55,6 @@ class ProviderDeleteView(

    model = Provider
    permission_required = "authentik_core.delete_provider"
-
+    success_url = "/"
    template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_admin:providers")
    success_message = _("Successfully deleted Provider")
--- a/authentik/admin/views/sources.py
+++ b/authentik/admin/views/sources.py
@ -4,38 +4,18 @@ from django.contrib.auth.mixins import (
    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
+from guardian.mixins import PermissionRequiredMixin

 from authentik.admin.views.utils import (
    BackSuccessUrlMixin,
    DeleteMessageView,
    InheritanceCreateView,
-    InheritanceListView,
    InheritanceUpdateView,
-    SearchListMixin,
-    UserPaginateListMixin,
 )
 from authentik.core.models import Source


-class SourceListView(
-    LoginRequiredMixin,
-    PermissionListMixin,
-    UserPaginateListMixin,
-    SearchListMixin,
-    InheritanceListView,
-):
-    """Show list of all sources"""
-
-    model = Source
-    permission_required = "authentik_core.view_source"
-    ordering = "name"
-    template_name = "administration/source/list.html"
-    search_fields = ["name", "slug"]
-
-
 class SourceCreateView(
    SuccessMessageMixin,
    BackSuccessUrlMixin,
@ -48,8 +28,8 @@ class SourceCreateView(
    model = Source
    permission_required = "authentik_core.add_source"

+    success_url = "/"
    template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_admin:sources")
    success_message = _("Successfully created Source")


@ -65,8 +45,8 @@ class SourceUpdateView(
    model = Source
    permission_required = "authentik_core.change_source"

+    success_url = "/"
    template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_admin:sources")
    success_message = _("Successfully updated Source")


@ -76,6 +56,6 @@ class SourceDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessag
    model = Source
    permission_required = "authentik_core.delete_source"

+    success_url = "/"
    template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_admin:sources")
    success_message = _("Successfully deleted Source")
--- a/authentik/admin/views/tasks.py
+++ b/authentik/admin/views/tasks.py
@ -4,7 +4,7 @@ from typing import Any, Dict
 from django.views.generic.base import TemplateView

 from authentik.admin.mixins import AdminRequiredMixin
-from authentik.lib.tasks import TaskInfo, TaskResultStatus
+from authentik.events.monitored_tasks import TaskInfo, TaskResultStatus


 class TaskListView(AdminRequiredMixin, TemplateView):
--- a/authentik/api/auth.py
+++ b/authentik/api/auth.py
@ -5,7 +5,7 @@ from typing import Any, Optional, Tuple, Union

 from rest_framework.authentication import BaseAuthentication, get_authorization_header
 from rest_framework.request import Request
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.core.models import Token, TokenIntents, User

--- a/authentik/api/templates/rest_framework/api.html
+++ b/authentik/api/templates/rest_framework/api.html
@ -1,7 +1,31 @@
 {% extends "rest_framework/base.html" %}

+{% block title %}{% if name %}{{ name }} – {% endif %}authentik{% endblock %}
+
 {% block branding %}
 <span class='navbar-brand'>
    authentik
 </span>
 {% endblock %}
+
+{% block style %}
+{{ block.super }}
+<style>
+    body {
+        background-color: #18191a;
+        color: #fafafa;
+    }
+    .prettyprint {
+        background-color: #1c1e21;
+        color: #fafafa;
+        border: 1px solid #2b2e33;
+    }
+    .pln {
+        color: #fafafa;
+    }
+    .well {
+        background-color: #1c1e21;
+        border: 1px solid #2b2e33;
+    }
+</style>
+{% endblock %}
--- a/authentik/api/v2/urls.py
+++ b/authentik/api/v2/urls.py
@ -19,24 +19,29 @@ from authentik.core.api.sources import SourceViewSet
 from authentik.core.api.tokens import TokenViewSet
 from authentik.core.api.users import UserViewSet
 from authentik.crypto.api import CertificateKeyPairViewSet
-from authentik.events.api import EventViewSet
+from authentik.events.api.event import EventViewSet
+from authentik.events.api.notification import NotificationViewSet
+from authentik.events.api.notification_rule import NotificationRuleViewSet
+from authentik.events.api.notification_transport import NotificationTransportViewSet
 from authentik.flows.api import (
    FlowCacheViewSet,
    FlowStageBindingViewSet,
    FlowViewSet,
    StageViewSet,
 )
-from authentik.outposts.api import (
+from authentik.outposts.api.outpost_service_connections import (
    DockerServiceConnectionViewSet,
    KubernetesServiceConnectionViewSet,
-    OutpostViewSet,
+    ServiceConnectionViewSet,
 )
+from authentik.outposts.api.outposts import OutpostViewSet
 from authentik.policies.api import (
    PolicyBindingViewSet,
    PolicyCacheViewSet,
    PolicyViewSet,
 )
 from authentik.policies.dummy.api import DummyPolicyViewSet
+from authentik.policies.event_matcher.api import EventMatcherPolicyViewSet
 from authentik.policies.expiry.api import PasswordExpiryPolicyViewSet
 from authentik.policies.expression.api import ExpressionPolicyViewSet
 from authentik.policies.group_membership.api import GroupMembershipPolicyViewSet
@ -84,6 +89,7 @@ router.register("core/users", UserViewSet)
 router.register("core/tokens", TokenViewSet)

 router.register("outposts/outposts", OutpostViewSet)
+router.register("outposts/service_connections/all", ServiceConnectionViewSet)
 router.register("outposts/service_connections/docker", DockerServiceConnectionViewSet)
 router.register(
    "outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet
@ -97,6 +103,9 @@ router.register("flows/bindings", FlowStageBindingViewSet)
 router.register("crypto/certificatekeypairs", CertificateKeyPairViewSet)

 router.register("events/events", EventViewSet)
+router.register("events/notifications", NotificationViewSet)
+router.register("events/transports", NotificationTransportViewSet)
+router.register("events/rules", NotificationRuleViewSet)

 router.register("sources/all", SourceViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
@ -107,6 +116,7 @@ router.register("policies/all", PolicyViewSet)
 router.register("policies/cached", PolicyCacheViewSet, basename="policies_cache")
 router.register("policies/bindings", PolicyBindingViewSet)
 router.register("policies/expression", ExpressionPolicyViewSet)
+router.register("policies/event_matcher", EventMatcherPolicyViewSet)
 router.register("policies/group_membership", GroupMembershipPolicyViewSet)
 router.register("policies/haveibeenpwned", HaveIBeenPwendPolicyViewSet)
 router.register("policies/password_expiry", PasswordExpiryPolicyViewSet)
--- a/authentik/core/admin.py
+++ b/authentik/core/admin.py
@ -4,9 +4,6 @@ from django.apps import AppConfig, apps
 from django.contrib import admin
 from django.contrib.admin.sites import AlreadyRegistered
 from guardian.admin import GuardedModelAdmin
-from structlog import get_logger
-
-LOGGER = get_logger()


 def admin_autoregister(app: AppConfig):
@ -20,5 +17,4 @@ def admin_autoregister(app: AppConfig):

 for _app in apps.get_app_configs():
    if _app.label.startswith("authentik_"):
-        LOGGER.debug("Registering application for dj-admin", application=_app.label)
        admin_autoregister(_app)
--- a/authentik/core/api/applications.py
+++ b/authentik/core/api/applications.py
@ -1,4 +1,5 @@
 """Application API Views"""
+from django.core.cache import cache
 from django.db.models import QuerySet
 from django.http.response import Http404
 from guardian.shortcuts import get_objects_for_user
@ -10,6 +11,7 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
+from structlog.stdlib import get_logger

 from authentik.admin.api.metrics import get_events_per_1h
 from authentik.core.api.providers import ProviderSerializer
@ -17,6 +19,13 @@ from authentik.core.models import Application
 from authentik.events.models import EventAction
 from authentik.policies.engine import PolicyEngine

+LOGGER = get_logger()
+
+
+def user_app_cache_key(user_pk: str) -> str:
+    """Cache key where application list for user is saved"""
+    return f"user_app_cache_{user_pk}"
+

 class ApplicationSerializer(ModelSerializer):
    """Application Serializer"""
@ -68,16 +77,35 @@ class ApplicationViewSet(ModelViewSet):
            queryset = backend().filter_queryset(self.request, queryset, self)
        return queryset

-    def list(self, request: Request) -> Response:
-        """Custom list method that checks Policy based access instead of guardian"""
-        queryset = self._filter_queryset_for_list(self.get_queryset())
-        self.paginate_queryset(queryset)
-        allowed_applications = []
+    def _get_allowed_applications(self, queryset: QuerySet) -> list[Application]:
+        applications = []
        for application in queryset:
            engine = PolicyEngine(application, self.request.user, self.request)
            engine.build()
            if engine.passing:
-                allowed_applications.append(application)
+                applications.append(application)
+        return applications
+
+    def list(self, request: Request) -> Response:
+        """Custom list method that checks Policy based access instead of guardian"""
+        queryset = self._filter_queryset_for_list(self.get_queryset())
+        self.paginate_queryset(queryset)
+
+        should_cache = request.GET.get("search", "") == ""
+
+        allowed_applications = []
+        if not should_cache:
+            allowed_applications = self._get_allowed_applications(queryset)
+        if should_cache:
+            LOGGER.debug("Caching allowed application list")
+            allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
+            if not allowed_applications:
+                allowed_applications = self._get_allowed_applications(queryset)
+                cache.set(
+                    user_app_cache_key(self.request.user.pk),
+                    allowed_applications,
+                    timeout=86400,
+                )
        serializer = self.get_serializer(allowed_applications, many=True)
        return self.get_paginated_response(serializer.data)

--- a/authentik/core/api/propertymappings.py
+++ b/authentik/core/api/propertymappings.py
@ -2,29 +2,48 @@
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import ReadOnlyModelViewSet

+from authentik.core.api.utils import MetaNameSerializer
 from authentik.core.models import PropertyMapping


-class PropertyMappingSerializer(ModelSerializer):
+class PropertyMappingSerializer(ModelSerializer, MetaNameSerializer):
    """PropertyMapping Serializer"""

-    __type__ = SerializerMethodField(method_name="get_type")
+    object_type = SerializerMethodField(method_name="get_type")

    def get_type(self, obj):
        """Get object type so that we know which API Endpoint to use to get the full object"""
        return obj._meta.object_name.lower().replace("propertymapping", "")

+    def to_representation(self, instance: PropertyMapping):
+        # pyright: reportGeneralTypeIssues=false
+        if instance.__class__ == PropertyMapping:
+            return super().to_representation(instance)
+        return instance.serializer(instance=instance).data
+
    class Meta:

        model = PropertyMapping
-        fields = ["pk", "name", "expression", "__type__"]
+        fields = [
+            "pk",
+            "name",
+            "expression",
+            "object_type",
+            "verbose_name",
+            "verbose_name_plural",
+        ]


 class PropertyMappingViewSet(ReadOnlyModelViewSet):
    """PropertyMapping Viewset"""

-    queryset = PropertyMapping.objects.all()
+    queryset = PropertyMapping.objects.none()
    serializer_class = PropertyMappingSerializer
+    search_fields = [
+        "name",
+    ]
+    filterset_fields = {"managed": ["isnull"]}
+    ordering = ["name"]

    def get_queryset(self):
        return PropertyMapping.objects.select_subclasses()
--- a/authentik/core/api/providers.py
+++ b/authentik/core/api/providers.py
@ -1,26 +1,32 @@
 """Provider API Views"""
+from django.shortcuts import reverse
+from django.utils.translation import gettext_lazy as _
+from drf_yasg2.utils import swagger_auto_schema
+from rest_framework.decorators import action
+from rest_framework.fields import ReadOnlyField
+from rest_framework.request import Request
+from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import ModelViewSet

-from authentik.core.api.utils import MetaNameSerializer
+from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Provider
+from authentik.lib.templatetags.authentik_utils import verbose_name
+from authentik.lib.utils.reflection import all_subclasses


 class ProviderSerializer(ModelSerializer, MetaNameSerializer):
    """Provider Serializer"""

+    assigned_application_slug = ReadOnlyField(source="application.slug")
+    assigned_application_name = ReadOnlyField(source="application.name")
+
    object_type = SerializerMethodField()

    def get_object_type(self, obj):
        """Get object type so that we know which API Endpoint to use to get the full object"""
        return obj._meta.object_name.lower().replace("provider", "")

-    def to_representation(self, instance: Provider):
-        # pyright: reportGeneralTypeIssues=false
-        if instance.__class__ == Provider:
-            return super().to_representation(instance)
-        return instance.serializer(instance=instance).data
-
    class Meta:

        model = Provider
@ -31,6 +37,8 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
            "authorization_flow",
            "property_mappings",
            "object_type",
+            "assigned_application_slug",
+            "assigned_application_name",
            "verbose_name",
            "verbose_name_plural",
        ]
@ -39,11 +47,38 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
 class ProviderViewSet(ModelViewSet):
    """Provider Viewset"""

-    queryset = Provider.objects.all()
+    queryset = Provider.objects.none()
    serializer_class = ProviderSerializer
    filterset_fields = {
        "application": ["isnull"],
    }
+    search_fields = [
+        "name",
+        "application__name",
+    ]

    def get_queryset(self):
        return Provider.objects.select_subclasses()
+
+    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @action(detail=False)
+    def types(self, request: Request) -> Response:
+        """Get all creatable provider types"""
+        data = []
+        for subclass in all_subclasses(self.queryset.model):
+            data.append(
+                {
+                    "name": verbose_name(subclass),
+                    "description": subclass.__doc__,
+                    "link": reverse("authentik_admin:provider-create")
+                    + f"?type={subclass.__name__}",
+                }
+            )
+        data.append(
+            {
+                "name": _("SAML Provider from Metadata"),
+                "description": _("Create a SAML Provider by importing its Metadata."),
+                "link": reverse("authentik_admin:provider-saml-from-metadata"),
+            }
+        )
+        return Response(TypeCreateSerializer(data, many=True).data)
--- a/authentik/core/api/sources.py
+++ b/authentik/core/api/sources.py
@ -1,39 +1,65 @@
 """Source API Views"""
+from django.shortcuts import reverse
+from drf_yasg2.utils import swagger_auto_schema
+from rest_framework.decorators import action
+from rest_framework.request import Request
+from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import ReadOnlyModelViewSet

-from authentik.admin.forms.source import SOURCE_SERIALIZER_FIELDS
-from authentik.core.api.utils import MetaNameSerializer
+from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Source
+from authentik.lib.templatetags.authentik_utils import verbose_name
+from authentik.lib.utils.reflection import all_subclasses


 class SourceSerializer(ModelSerializer, MetaNameSerializer):
    """Source Serializer"""

-    __type__ = SerializerMethodField(method_name="get_type")
+    object_type = SerializerMethodField()

-    def get_type(self, obj):
+    def get_object_type(self, obj):
        """Get object type so that we know which API Endpoint to use to get the full object"""
        return obj._meta.object_name.lower().replace("source", "")

-    def to_representation(self, instance: Source):
-        # pyright: reportGeneralTypeIssues=false
-        if instance.__class__ == Source:
-            return super().to_representation(instance)
-        return instance.serializer(instance=instance).data
-
    class Meta:

        model = Source
-        fields = SOURCE_SERIALIZER_FIELDS + ["__type__"]
+        fields = SOURCE_SERIALIZER_FIELDS = [
+            "pk",
+            "name",
+            "slug",
+            "enabled",
+            "authentication_flow",
+            "enrollment_flow",
+            "object_type",
+            "verbose_name",
+            "verbose_name_plural",
+        ]


 class SourceViewSet(ReadOnlyModelViewSet):
    """Source Viewset"""

-    queryset = Source.objects.all()
+    queryset = Source.objects.none()
    serializer_class = SourceSerializer
    lookup_field = "slug"

    def get_queryset(self):
        return Source.objects.select_subclasses()
+
+    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @action(detail=False)
+    def types(self, request: Request) -> Response:
+        """Get all creatable source types"""
+        data = []
+        for subclass in all_subclasses(self.queryset.model):
+            data.append(
+                {
+                    "name": verbose_name(subclass),
+                    "description": subclass.__doc__,
+                    "link": reverse("authentik_admin:source-create")
+                    + f"?type={subclass.__name__}",
+                }
+            )
+        return Response(TypeCreateSerializer(data, many=True).data)
--- a/authentik/core/api/tokens.py
+++ b/authentik/core/api/tokens.py
@ -1,9 +1,12 @@
 """Tokens API Viewset"""
+from django.db.models.base import Model
 from django.http.response import Http404
+from drf_yasg2.utils import swagger_auto_schema
 from rest_framework.decorators import action
+from rest_framework.fields import CharField
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer
+from rest_framework.serializers import ModelSerializer, Serializer
 from rest_framework.viewsets import ModelViewSet

 from authentik.core.models import Token
@ -19,6 +22,18 @@ class TokenSerializer(ModelSerializer):
        fields = ["pk", "identifier", "intent", "user", "description"]


+class TokenViewSerializer(Serializer):
+    """Show token's current key"""
+
+    key = CharField(read_only=True)
+
+    def create(self, validated_data: dict) -> Model:
+        raise NotImplementedError
+
+    def update(self, instance: Model, validated_data: dict) -> Model:
+        raise NotImplementedError
+
+
 class TokenViewSet(ModelViewSet):
    """Token Viewset"""

@ -26,12 +41,15 @@ class TokenViewSet(ModelViewSet):
    queryset = Token.filter_not_expired()
    serializer_class = TokenSerializer

+    @swagger_auto_schema(responses={200: TokenViewSerializer(many=False)})
    @action(detail=True)
+    # pylint: disable=unused-argument
    def view_key(self, request: Request, identifier: str) -> Response:
        """Return token key and log access"""
-        tokens = Token.filter_not_expired(identifier=identifier)
-        if not tokens.exists():
+        token: Token = self.get_object()
+        if token.is_expired:
            raise Http404
-        token = tokens.first()
-        Event.new(EventAction.TOKEN_VIEW, token=token).from_http(request)
-        return Response({"key": token.key})
+        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(  # noqa # nosec
+            request
+        )
+        return Response(TokenViewSerializer({"key": token.key}).data)
--- a/authentik/core/api/users.py
+++ b/authentik/core/api/users.py
@ -34,7 +34,7 @@ class UserSerializer(ModelSerializer):
 class UserViewSet(ModelViewSet):
    """User Viewset"""

-    queryset = User.objects.all()
+    queryset = User.objects.none()
    serializer_class = UserSerializer

    def get_queryset(self):
--- a/authentik/core/api/utils.py
+++ b/authentik/core/api/utils.py
@ -1,5 +1,6 @@
 """API Utilities"""
 from django.db.models import Model
+from rest_framework.fields import CharField
 from rest_framework.serializers import Serializer, SerializerMethodField


@ -22,3 +23,17 @@ class MetaNameSerializer(Serializer):
    def get_verbose_name_plural(self, obj: Model) -> str:
        """Return object's plural verbose_name"""
        return obj._meta.verbose_name_plural
+
+
+class TypeCreateSerializer(Serializer):
+    """Types of an object that can be created"""
+
+    name = CharField(read_only=True)
+    description = CharField(read_only=True)
+    link = CharField(read_only=True)
+
+    def create(self, validated_data: dict) -> Model:
+        raise NotImplementedError
+
+    def update(self, instance: Model, validated_data: dict) -> Model:
+        raise NotImplementedError
--- a/authentik/core/apps.py
+++ b/authentik/core/apps.py
@ -1,4 +1,6 @@
 """authentik core app config"""
+from importlib import import_module
+
 from django.apps import AppConfig


@ -9,3 +11,6 @@ class AuthentikCoreConfig(AppConfig):
    label = "authentik_core"
    verbose_name = "authentik Core"
    mountpoint = ""
+
+    def ready(self):
+        import_module("authentik.core.signals")
--- a/authentik/core/channels.py
+++ b/authentik/core/channels.py
@ -1,7 +1,7 @@
 """Channels base classes"""
 from channels.exceptions import DenyConnection
 from channels.generic.websocket import JsonWebsocketConsumer
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.api.auth import token_from_header
 from authentik.core.models import User
--- a/authentik/core/expression.py
+++ b/authentik/core/expression.py
@ -28,7 +28,7 @@ class PropertyMappingEvaluator(BaseEvaluator):
        event = Event.new(
            EventAction.PROPERTY_MAPPING_EXCEPTION,
            expression=expression_source,
-            error=error_string,
+            message=error_string,
        )
        if "user" in self._context:
            event.set_user(self._context["user"])
--- a/authentik/core/middleware.py
+++ b/authentik/core/middleware.py
@ -9,6 +9,7 @@ from django.http import HttpRequest, HttpResponse
 SESSION_IMPERSONATE_USER = "authentik_impersonate_user"
 SESSION_IMPERSONATE_ORIGINAL_USER = "authentik_impersonate_original_user"
 LOCAL = local()
+RESPONSE_HEADER_ID = "X-authentik-id"


 class ImpersonateMiddleware:
@ -43,7 +44,7 @@ class RequestIDMiddleware:
            setattr(request, "request_id", request_id)
            LOCAL.authentik = {"request_id": request_id}
        response = self.get_response(request)
-        response["X-authentik-id"] = request.request_id
+        response[RESPONSE_HEADER_ID] = request.request_id
        del LOCAL.authentik["request_id"]
        return response

--- a/authentik/core/migrations/0017_managed.py
+++ b/authentik/core/migrations/0017_managed.py
@ -0,0 +1,35 @@
+# Generated by Django 3.1.4 on 2021-01-30 18:28
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0016_auto_20201202_2234"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="propertymapping",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                verbose_name="Managed by authentik",
+                unique=True,
+            ),
+        ),
+        migrations.AddField(
+            model_name="token",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                verbose_name="Managed by authentik",
+                unique=True,
+            ),
+        ),
+    ]
--- a/authentik/core/models.py
+++ b/authentik/core/models.py
@ -15,13 +15,14 @@ from django.utils.translation import gettext_lazy as _
 from guardian.mixins import GuardianUserMixin
 from model_utils.managers import InheritanceManager
 from rest_framework.serializers import Serializer
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.core.exceptions import PropertyMappingExpressionException
 from authentik.core.signals import password_changed
 from authentik.core.types import UILoginButton
 from authentik.flows.models import Flow
 from authentik.lib.models import CreatedUpdatedModel, SerializerModel
+from authentik.managed.models import ManagedModel
 from authentik.policies.models import PolicyBindingModel

 LOGGER = get_logger()
@ -313,7 +314,7 @@ class TokenIntents(models.TextChoices):
    INTENT_RECOVERY = "recovery"


-class Token(ExpiringModel):
+class Token(ManagedModel, ExpiringModel):
    """Token used to authenticate the User for API Access or confirm another Stage like Email."""

    token_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
@ -341,7 +342,7 @@ class Token(ExpiringModel):
        ]


-class PropertyMapping(models.Model):
+class PropertyMapping(SerializerModel, ManagedModel):
    """User-defined key -> x mapping which can be used by providers to expose extra data."""

    pm_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
@ -355,6 +356,11 @@ class PropertyMapping(models.Model):
        """Return Form class used to edit this object"""
        raise NotImplementedError

+    @property
+    def serializer(self) -> Type[Serializer]:
+        """Get serializer for this model"""
+        raise NotImplementedError
+
    def evaluate(
        self, user: Optional[User], request: Optional[HttpRequest], **kwargs
    ) -> Any:
--- a/authentik/core/signals.py
+++ b/authentik/core/signals.py
@ -1,5 +1,24 @@
 """authentik core signals"""
+from django.core.cache import cache
 from django.core.signals import Signal
+from django.db.models.signals import post_save
+from django.dispatch import receiver

 # Arguments: user: User, password: str
 password_changed = Signal()
+
+
+@receiver(post_save)
+# pylint: disable=unused-argument
+def post_save_application(sender, instance, created: bool, **_):
+    """Clear user's application cache upon application creation"""
+    from authentik.core.models import Application
+    from authentik.core.api.applications import user_app_cache_key
+
+    if sender != Application:
+        return
+    if not created:
+        return
+    # Also delete user application cache
+    keys = cache.keys(user_app_cache_key("*"))
+    cache.delete_many(keys)
--- a/authentik/core/tasks.py
+++ b/authentik/core/tasks.py
@ -8,10 +8,10 @@ from dbbackup.db.exceptions import CommandConnectorError
 from django.contrib.humanize.templatetags.humanize import naturaltime
 from django.core import management
 from django.utils.timezone import now
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.core.models import ExpiringModel
-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP

 LOGGER = get_logger()
--- a/authentik/core/templates/base/skeleton.html
+++ b/authentik/core/templates/base/skeleton.html
@ -9,14 +9,14 @@
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
        <title>{% block title %}{% trans title|default:config.authentik.branding.title %}{% endblock %}</title>
-        <link rel="icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
-        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-addons.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/fontawesome.min.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">
-        <script src="{% url 'javascript-catalog' %}"></script>
-        <script src="{% static 'dist/main.js' %}" type="module"></script>
+        <link rel="icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
+        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-addons.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/fontawesome.min.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}?v={{ ak_version }}">
+        <script src="{% url 'javascript-catalog' %}?v={{ ak_version }}"></script>
+        <script src="{% static 'dist/main.js' %}?v={{ ak_version }}" type="module"></script>
        {% block head %}
        {% endblock %}
    </head>
--- a/authentik/core/templates/user/settings.html
+++ b/authentik/core/templates/user/settings.html
@ -1,5 +1,6 @@
 {% load i18n %}
 {% load authentik_user_settings %}
+{% load authentik_utils %}

 <div class="pf-c-page">
    <main role="main" class="pf-c-page__main" tabindex="-1">
@ -12,47 +13,45 @@
                <p>{% trans "Configure settings relevant to your user profile." %}</p>
            </div>
        </section>
-        <section class="pf-c-page__main-section">
-            <div class="pf-u-display-flex pf-u-justify-content-center">
-                <div class="pf-u-w-75">
-                    <ak-site-shell url="{% url 'authentik_core:user-details' %}">
-                        <div slot="body"></div>
-                    </ak-site-shell>
+        <ak-tabs>
+            <section slot="page-1" data-tab-title="{% trans 'User details' %}" class="pf-c-page__main-section pf-m-no-padding-mobile">
+                <div class="pf-u-display-flex pf-u-justify-content-center">
+                    <div class="pf-u-w-75">
+                        <ak-site-shell url="{% url 'authentik_core:user-details' %}">
+                            <div slot="body"></div>
+                        </ak-site-shell>
+                    </div>
                </div>
-            </div>
-        </section>
-        <section class="pf-c-page__main-section">
-            <div class="pf-u-display-flex pf-u-justify-content-center">
-                <div class="pf-u-w-75">
-                    <ak-site-shell url="{% url 'authentik_core:user-tokens' %}">
-                        <div slot="body"></div>
-                    </ak-site-shell>
+            </section>
+            <section slot="page-2" data-tab-title="{% trans 'Tokens' %}" class="pf-c-page__main-section pf-m-no-padding-mobile">
+                <ak-site-shell url="{% url 'authentik_core:user-tokens' %}">
+                    <div slot="body"></div>
+                </ak-site-shell>
+            </section>
+            {% user_stages as user_stages_loc %}
+            {% for stage, stage_link in user_stages_loc.items %}
+            <section slot="page-{{ stage.pk }}" data-tab-title="{{ stage|verbose_name }}" class="pf-c-page__main-section pf-m-no-padding-mobile">
+                <div class="pf-u-display-flex pf-u-justify-content-center">
+                    <div class="pf-u-w-75">
+                        <ak-site-shell url="{{ stage_link }}">
+                            <div slot="body"></div>
+                        </ak-site-shell>
+                    </div>
                </div>
-            </div>
-        </section>
-        {% user_stages as user_stages_loc %}
-        {% for stage in user_stages_loc %}
-        <section class="pf-c-page__main-section">
-            <div class="pf-u-display-flex pf-u-justify-content-center">
-                <div class="pf-u-w-75">
-                    <ak-site-shell url="{{ stage }}">
-                        <div slot="body"></div>
-                    </ak-site-shell>
+            </section>
+            {% endfor %}
+            {% user_sources as user_sources_loc %}
+            {% for source, source_link in user_sources_loc.items %}
+            <section slot="page-{{ source.pk }}" data-tab-title="{{ source.name }}" class="pf-c-page__main-section pf-m-no-padding-mobile">
+                <div class="pf-u-display-flex pf-u-justify-content-center">
+                    <div class="pf-u-w-75">
+                        <ak-site-shell url="{{ source_link }}">
+                            <div slot="body"></div>
+                        </ak-site-shell>
+                    </div>
                </div>
-            </div>
-        </section>
-        {% endfor %}
-        {% user_sources as user_sources_loc %}
-        {% for source in user_sources_loc %}
-        <section class="pf-c-page__main-section">
-            <div class="pf-u-display-flex pf-u-justify-content-center">
-                <div class="pf-u-w-75">
-                    <ak-site-shell url="{{ source }}">
-                        <div slot="body"></div>
-                    </ak-site-shell>
-                </div>
-            </div>
-        </section>
-        {% endfor %}
+            </section>
+            {% endfor %}
+        </ak-tabs>
    </main>
 </div>
--- a/authentik/core/templatetags/authentik_user_settings.py
+++ b/authentik/core/templatetags/authentik_user_settings.py
@ -13,26 +13,26 @@ register = template.Library()

@register.simple_tag(takes_context=True)
 # pylint: disable=unused-argument
-def user_stages(context: RequestContext) -> list[str]:
+def user_stages(context: RequestContext) -> dict[Stage, str]:
    """Return list of all stages which apply to user"""
    _all_stages: Iterable[Stage] = Stage.objects.all().select_subclasses()
-    matching_stages: list[str] = []
+    matching_stages: dict[Stage, str] = {}
    for stage in _all_stages:
        user_settings = stage.ui_user_settings
        if not user_settings:
            continue
-        matching_stages.append(user_settings)
+        matching_stages[stage] = user_settings
    return matching_stages


@register.simple_tag(takes_context=True)
-def user_sources(context: RequestContext) -> list[str]:
+def user_sources(context: RequestContext) -> dict[Source, str]:
    """Return a list of all sources which are enabled for the user"""
    user = context.get("request").user
    _all_sources: Iterable[Source] = Source.objects.filter(
        enabled=True
    ).select_subclasses()
-    matching_sources: list[str] = []
+    matching_sources: dict[Source, str] = {}
    for source in _all_sources:
        user_settings = source.ui_user_settings
        if not user_settings:
@ -40,5 +40,5 @@ def user_sources(context: RequestContext) -> list[str]:
        policy_engine = PolicyEngine(source, user, context.get("request"))
        policy_engine.build()
        if policy_engine.passing:
-            matching_sources.append(user_settings)
+            matching_sources[source] = user_settings
    return matching_sources
--- a/authentik/core/views/impersonate.py
+++ b/authentik/core/views/impersonate.py
@ -3,7 +3,7 @@
 from django.http import HttpRequest, HttpResponse
 from django.shortcuts import get_object_or_404, redirect
 from django.views import View
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.core.middleware import (
    SESSION_IMPERSONATE_ORIGINAL_USER,
--- a/authentik/crypto/api.py
+++ b/authentik/crypto/api.py
@ -2,15 +2,29 @@
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
 from cryptography.x509 import load_pem_x509_certificate
-from rest_framework.serializers import ModelSerializer, ValidationError
+from django.db.models import Model
+from drf_yasg2.utils import swagger_auto_schema
+from rest_framework.decorators import action
+from rest_framework.fields import CharField, DateTimeField, SerializerMethodField
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.serializers import ModelSerializer, Serializer, ValidationError
 from rest_framework.viewsets import ModelViewSet

 from authentik.crypto.models import CertificateKeyPair
+from authentik.events.models import Event, EventAction


 class CertificateKeyPairSerializer(ModelSerializer):
    """CertificateKeyPair Serializer"""

+    cert_expiry = DateTimeField(source="certificate.not_valid_after", read_only=True)
+    cert_subject = SerializerMethodField()
+
+    def get_cert_subject(self, instance: CertificateKeyPair) -> str:
+        """Get certificate subject as full rfc4514"""
+        return instance.certificate.subject.rfc4514_string()
+
    def validate_certificate_data(self, value):
        """Verify that input is a valid PEM x509 Certificate"""
        try:
@ -36,7 +50,31 @@ class CertificateKeyPairSerializer(ModelSerializer):
    class Meta:

        model = CertificateKeyPair
-        fields = ["pk", "name", "certificate_data", "key_data"]
+        fields = [
+            "pk",
+            "name",
+            "fingerprint",
+            "certificate_data",
+            "key_data",
+            "cert_expiry",
+            "cert_subject",
+        ]
+        extra_kwargs = {
+            "key_data": {"write_only": True},
+            "certificate_data": {"write_only": True},
+        }
+
+
+class CertificateDataSerializer(Serializer):
+    """Get CertificateKeyPair's data"""
+
+    data = CharField(read_only=True)
+
+    def create(self, validated_data: dict) -> Model:
+        raise NotImplementedError
+
+    def update(self, instance: Model, validated_data: dict) -> Model:
+        raise NotImplementedError


 class CertificateKeyPairViewSet(ModelViewSet):
@ -44,3 +82,31 @@ class CertificateKeyPairViewSet(ModelViewSet):

    queryset = CertificateKeyPair.objects.all()
    serializer_class = CertificateKeyPairSerializer
+
+    @swagger_auto_schema(responses={200: CertificateDataSerializer(many=False)})
+    @action(detail=True)
+    # pylint: disable=invalid-name, unused-argument
+    def view_certificate(self, request: Request, pk: str) -> Response:
+        """Return certificate-key pairs certificate and log access"""
+        certificate: CertificateKeyPair = self.get_object()
+        Event.new(  # noqa # nosec
+            EventAction.SECRET_VIEW,
+            secret=certificate,
+            type="certificate",
+        ).from_http(request)
+        return Response(
+            CertificateDataSerializer({"data": certificate.certificate_data}).data
+        )
+
+    @swagger_auto_schema(responses={200: CertificateDataSerializer(many=False)})
+    @action(detail=True)
+    # pylint: disable=invalid-name, unused-argument
+    def view_private_key(self, request: Request, pk: str) -> Response:
+        """Return certificate-key pairs private key and log access"""
+        certificate: CertificateKeyPair = self.get_object()
+        Event.new(  # noqa # nosec
+            EventAction.SECRET_VIEW,
+            secret=certificate,
+            type="private_key",
+        ).from_http(request)
+        return Response(CertificateDataSerializer({"data": certificate.key_data}).data)
--- a/authentik/crypto/builder.py
+++ b/authentik/crypto/builder.py
@ -1,6 +1,7 @@
 """Create self-signed certificates"""
 import datetime
 import uuid
+from typing import Optional

 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
@ -8,6 +9,9 @@ from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.x509.oid import NameOID

+from authentik import __version__
+from authentik.crypto.models import CertificateKeyPair
+

 class CertificateBuilder:
    """Build self-signed certificates"""
@ -17,19 +21,39 @@ class CertificateBuilder:
    __builder = None
    __certificate = None

+    common_name: str
+
    def __init__(self):
        self.__public_key = None
        self.__private_key = None
        self.__builder = None
        self.__certificate = None
+        self.common_name = "authentik Self-signed Certificate"

-    def build(self):
+    def save(self) -> Optional[CertificateKeyPair]:
+        """Save generated certificate as model"""
+        if not self.__certificate:
+            return None
+        return CertificateKeyPair.objects.create(
+            name=self.common_name,
+            certificate_data=self.certificate,
+            key_data=self.private_key,
+        )
+
+    def build(
+        self,
+        validity_days: int = 365,
+        subject_alt_names: Optional[list[str]] = None,
+    ):
        """Build self-signed certificate"""
        one_day = datetime.timedelta(1, 0, 0)
        self.__private_key = rsa.generate_private_key(
            public_exponent=65537, key_size=2048, backend=default_backend()
        )
        self.__public_key = self.__private_key.public_key()
+        alt_names: list[x509.GeneralName] = [
+            x509.DNSName(x) for x in subject_alt_names or []
+        ]
        self.__builder = (
            x509.CertificateBuilder()
            .subject_name(
@ -37,7 +61,7 @@ class CertificateBuilder:
                    [
                        x509.NameAttribute(
                            NameOID.COMMON_NAME,
-                            "authentik Self-signed Certificate",
+                            self.common_name,
                        ),
                        x509.NameAttribute(NameOID.ORGANIZATION_NAME, "authentik"),
                        x509.NameAttribute(
@ -51,13 +75,16 @@ class CertificateBuilder:
                    [
                        x509.NameAttribute(
                            NameOID.COMMON_NAME,
-                            "authentik Self-signed Certificate",
+                            f"authentik {__version__}",
                        ),
                    ]
                )
            )
+            .add_extension(x509.SubjectAlternativeName(alt_names), critical=True)
            .not_valid_before(datetime.datetime.today() - one_day)
-            .not_valid_after(datetime.datetime.today() + datetime.timedelta(days=365))
+            .not_valid_after(
+                datetime.datetime.today() + datetime.timedelta(days=validity_days)
+            )
            .serial_number(int(uuid.uuid4()))
            .public_key(self.__public_key)
        )
--- a/authentik/crypto/forms.py
+++ b/authentik/crypto/forms.py
@ -8,6 +8,14 @@ from django.utils.translation import gettext_lazy as _
 from authentik.crypto.models import CertificateKeyPair


+class CertificateKeyPairGenerateForm(forms.Form):
+    """CertificateKeyPair generation form"""
+
+    common_name = forms.CharField()
+    subject_alt_name = forms.CharField(required=False, label=_("Subject-alt name"))
+    validity_days = forms.IntegerField(initial=365)
+
+
 class CertificateKeyPairForm(forms.ModelForm):
    """CertificateKeyPair Form"""

--- a/authentik/admin/templatetags/init.py
+++ b/authentik/admin/templatetags/init.py
--- a/authentik/events/api/event.py
+++ b/authentik/events/api/event.py
@ -50,6 +50,7 @@ class EventViewSet(ReadOnlyModelViewSet):
    serializer_class = EventSerializer
    ordering = ["-created"]
    search_fields = [
+        "event_uuid",
        "user",
        "action",
        "app",
--- a/authentik/events/api/notification.py
+++ b/authentik/events/api/notification.py
@ -0,0 +1,53 @@
+"""Notification API Views"""
+from rest_framework import mixins
+from rest_framework.fields import ReadOnlyField
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import GenericViewSet
+
+from authentik.events.api.event import EventSerializer
+from authentik.events.models import Notification
+
+
+class NotificationSerializer(ModelSerializer):
+    """Notification Serializer"""
+
+    body = ReadOnlyField()
+    severity = ReadOnlyField()
+    event = EventSerializer()
+
+    class Meta:
+
+        model = Notification
+        fields = [
+            "pk",
+            "severity",
+            "body",
+            "created",
+            "event",
+            "seen",
+        ]
+
+
+class NotificationViewSet(
+    mixins.RetrieveModelMixin,
+    mixins.UpdateModelMixin,
+    mixins.DestroyModelMixin,
+    mixins.ListModelMixin,
+    GenericViewSet,
+):
+    """Notification Viewset"""
+
+    queryset = Notification.objects.all()
+    serializer_class = NotificationSerializer
+    filterset_fields = [
+        "severity",
+        "body",
+        "created",
+        "event",
+        "seen",
+    ]
+
+    def get_queryset(self):
+        if not self.request:
+            return super().get_queryset()
+        return Notification.objects.filter(user=self.request.user)
--- a/authentik/events/api/notification_rule.py
+++ b/authentik/events/api/notification_rule.py
@ -0,0 +1,28 @@
+"""NotificationRule API Views"""
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from authentik.events.models import NotificationRule
+
+
+class NotificationRuleSerializer(ModelSerializer):
+    """NotificationRule Serializer"""
+
+    class Meta:
+
+        model = NotificationRule
+        depth = 2
+        fields = [
+            "pk",
+            "name",
+            "transports",
+            "severity",
+            "group",
+        ]
+
+
+class NotificationRuleViewSet(ModelViewSet):
+    """NotificationRule Viewset"""
+
+    queryset = NotificationRule.objects.all()
+    serializer_class = NotificationRuleSerializer
--- a/authentik/events/api/notification_transport.py
+++ b/authentik/events/api/notification_transport.py
@ -0,0 +1,66 @@
+"""NotificationTransport API Views"""
+from django.http.response import Http404
+from guardian.shortcuts import get_objects_for_user
+from rest_framework.decorators import action
+from rest_framework.fields import SerializerMethodField
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from authentik.events.models import (
+    Notification,
+    NotificationSeverity,
+    NotificationTransport,
+    NotificationTransportError,
+    TransportMode,
+)
+
+
+class NotificationTransportSerializer(ModelSerializer):
+    """NotificationTransport Serializer"""
+
+    mode_verbose = SerializerMethodField()
+
+    def get_mode_verbose(self, instance: NotificationTransport):
+        """Return selected mode with a UI Label"""
+        return TransportMode(instance.mode).label
+
+    class Meta:
+
+        model = NotificationTransport
+        fields = [
+            "pk",
+            "name",
+            "mode",
+            "mode_verbose",
+            "webhook_url",
+        ]
+
+
+class NotificationTransportViewSet(ModelViewSet):
+    """NotificationTransport Viewset"""
+
+    queryset = NotificationTransport.objects.all()
+    serializer_class = NotificationTransportSerializer
+
+    @action(detail=True, methods=["post"])
+    # pylint: disable=invalid-name
+    def test(self, request: Request, pk=None) -> Response:
+        """Send example notification using selected transport. Requires
+        Modify permissions."""
+        transports = get_objects_for_user(
+            request.user, "authentik_events.change_notificationtransport"
+        ).filter(pk=pk)
+        if not transports.exists():
+            raise Http404
+        transport: NotificationTransport = transports.first()
+        notification = Notification(
+            severity=NotificationSeverity.NOTICE,
+            body=f"Test Notification from transport {transport.name}",
+            user=request.user,
+        )
+        try:
+            return Response(transport.send(notification))
+        except NotificationTransportError as exc:
+            return Response(str(exc.__cause__ or None), status=503)
--- a/authentik/events/forms.py
+++ b/authentik/events/forms.py
@ -0,0 +1,48 @@
+"""authentik events NotificationTransport forms"""
+from django import forms
+from django.utils.translation import gettext_lazy as _
+
+from authentik.events.models import NotificationRule, NotificationTransport
+
+
+class NotificationTransportForm(forms.ModelForm):
+    """NotificationTransport Form"""
+
+    class Meta:
+
+        model = NotificationTransport
+        fields = [
+            "name",
+            "mode",
+            "webhook_url",
+            "send_once",
+        ]
+        widgets = {
+            "name": forms.TextInput(),
+            "webhook_url": forms.TextInput(),
+        }
+        labels = {
+            "webhook_url": _("Webhook URL"),
+        }
+        help_texts = {
+            "webhook_url": _(
+                ("Only required when the Generic or Slack Webhook is used.")
+            ),
+        }
+
+
+class NotificationRuleForm(forms.ModelForm):
+    """NotificationRule Form"""
+
+    class Meta:
+
+        model = NotificationRule
+        fields = [
+            "name",
+            "group",
+            "transports",
+            "severity",
+        ]
+        widgets = {
+            "name": forms.TextInput(),
+        }
--- a/authentik/events/middleware.py
+++ b/authentik/events/middleware.py
@ -6,9 +6,10 @@ from django.contrib.auth.models import User
 from django.db.models import Model
 from django.db.models.signals import post_save, pre_delete
 from django.http import HttpRequest, HttpResponse
+from guardian.models import UserObjectPermission

 from authentik.core.middleware import LOCAL
-from authentik.events.models import Event, EventAction
+from authentik.events.models import Event, EventAction, Notification
 from authentik.events.signals import EventNewThread
 from authentik.events.utils import model_to_dict

@ -63,7 +64,7 @@ class AuditMiddleware:
        user: User, request: HttpRequest, sender, instance: Model, created: bool, **_
    ):
        """Signal handler for all object's post_save"""
-        if isinstance(instance, Event):
+        if isinstance(instance, (Event, Notification, UserObjectPermission)):
            return

        action = EventAction.MODEL_CREATED if created else EventAction.MODEL_UPDATED
@ -75,7 +76,7 @@ class AuditMiddleware:
        user: User, request: HttpRequest, sender, instance: Model, **_
    ):
        """Signal handler for all object's pre_delete"""
-        if isinstance(instance, Event):
+        if isinstance(instance, (Event, Notification, UserObjectPermission)):
            return

        EventNewThread(
--- a/authentik/events/migrations/0010_notification_notificationtransport_notificationrule.py
+++ b/authentik/events/migrations/0010_notification_notificationtransport_notificationrule.py
@ -0,0 +1,148 @@
+# Generated by Django 3.1.4 on 2021-01-11 16:36
+
+import uuid
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ("authentik_policies", "0004_policy_execution_logging"),
+        ("authentik_core", "0016_auto_20201202_2234"),
+        ("authentik_events", "0009_auto_20201227_1210"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="NotificationTransport",
+            fields=[
+                (
+                    "uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4,
+                        editable=False,
+                        primary_key=True,
+                        serialize=False,
+                    ),
+                ),
+                ("name", models.TextField(unique=True)),
+                (
+                    "mode",
+                    models.TextField(
+                        choices=[
+                            ("webhook", "Generic Webhook"),
+                            ("webhook_slack", "Slack Webhook (Slack/Discord)"),
+                            ("email", "Email"),
+                        ]
+                    ),
+                ),
+                ("webhook_url", models.TextField(blank=True)),
+            ],
+            options={
+                "verbose_name": "Notification Transport",
+                "verbose_name_plural": "Notification Transports",
+            },
+        ),
+        migrations.CreateModel(
+            name="NotificationRule",
+            fields=[
+                (
+                    "policybindingmodel_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="authentik_policies.policybindingmodel",
+                    ),
+                ),
+                ("name", models.TextField(unique=True)),
+                (
+                    "severity",
+                    models.TextField(
+                        choices=[
+                            ("notice", "Notice"),
+                            ("warning", "Warning"),
+                            ("alert", "Alert"),
+                        ],
+                        default="notice",
+                        help_text="Controls which severity level the created notifications will have.",
+                    ),
+                ),
+                (
+                    "group",
+                    models.ForeignKey(
+                        blank=True,
+                        help_text="Define which group of users this notification should be sent and shown to. If left empty, Notification won't ben sent.",
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        to="authentik_core.group",
+                    ),
+                ),
+                (
+                    "transports",
+                    models.ManyToManyField(
+                        help_text="Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI.",
+                        to="authentik_events.NotificationTransport",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Notification Rule",
+                "verbose_name_plural": "Notification Rules",
+            },
+            bases=("authentik_policies.policybindingmodel",),
+        ),
+        migrations.CreateModel(
+            name="Notification",
+            fields=[
+                (
+                    "uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4,
+                        editable=False,
+                        primary_key=True,
+                        serialize=False,
+                    ),
+                ),
+                (
+                    "severity",
+                    models.TextField(
+                        choices=[
+                            ("notice", "Notice"),
+                            ("warning", "Warning"),
+                            ("alert", "Alert"),
+                        ]
+                    ),
+                ),
+                ("body", models.TextField()),
+                ("created", models.DateTimeField(auto_now_add=True)),
+                ("seen", models.BooleanField(default=False)),
+                (
+                    "event",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        to="authentik_events.event",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Notification",
+                "verbose_name_plural": "Notifications",
+            },
+        ),
+    ]
--- a/authentik/events/migrations/0011_notification_rules_default_v1.py
+++ b/authentik/events/migrations/0011_notification_rules_default_v1.py
@ -0,0 +1,165 @@
+# Generated by Django 3.1.4 on 2021-01-10 18:57
+
+from django.apps.registry import Apps
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+from authentik.events.models import EventAction, NotificationSeverity, TransportMode
+
+
+def notify_configuration_error(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    Group = apps.get_model("authentik_core", "Group")
+    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
+    EventMatcherPolicy = apps.get_model(
+        "authentik_policies_event_matcher", "EventMatcherPolicy"
+    )
+    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
+    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
+
+    admin_group = (
+        Group.objects.using(db_alias)
+        .filter(name="authentik Admins", is_superuser=True)
+        .first()
+    )
+
+    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
+        name="default-match-configuration-error",
+        defaults={"action": EventAction.CONFIGURATION_ERROR},
+    )
+    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
+        name="default-notify-configuration-error",
+        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
+    )
+    trigger.transports.set(
+        NotificationTransport.objects.using(db_alias).filter(
+            name="default-email-transport"
+        )
+    )
+    trigger.save()
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        target=trigger,
+        policy=policy,
+        defaults={
+            "order": 0,
+        },
+    )
+
+
+def notify_update(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    Group = apps.get_model("authentik_core", "Group")
+    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
+    EventMatcherPolicy = apps.get_model(
+        "authentik_policies_event_matcher", "EventMatcherPolicy"
+    )
+    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
+    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
+
+    admin_group = (
+        Group.objects.using(db_alias)
+        .filter(name="authentik Admins", is_superuser=True)
+        .first()
+    )
+
+    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
+        name="default-match-update",
+        defaults={"action": EventAction.UPDATE_AVAILABLE},
+    )
+    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
+        name="default-notify-update",
+        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
+    )
+    trigger.transports.set(
+        NotificationTransport.objects.using(db_alias).filter(
+            name="default-email-transport"
+        )
+    )
+    trigger.save()
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        target=trigger,
+        policy=policy,
+        defaults={
+            "order": 0,
+        },
+    )
+
+
+def notify_exception(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    Group = apps.get_model("authentik_core", "Group")
+    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
+    EventMatcherPolicy = apps.get_model(
+        "authentik_policies_event_matcher", "EventMatcherPolicy"
+    )
+    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
+    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
+
+    admin_group = (
+        Group.objects.using(db_alias)
+        .filter(name="authentik Admins", is_superuser=True)
+        .first()
+    )
+
+    policy_policy_exc, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
+        name="default-match-policy-exception",
+        defaults={"action": EventAction.POLICY_EXCEPTION},
+    )
+    policy_pm_exc, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
+        name="default-match-property-mapping-exception",
+        defaults={"action": EventAction.PROPERTY_MAPPING_EXCEPTION},
+    )
+    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
+        name="default-notify-exception",
+        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
+    )
+    trigger.transports.set(
+        NotificationTransport.objects.using(db_alias).filter(
+            name="default-email-transport"
+        )
+    )
+    trigger.save()
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        target=trigger,
+        policy=policy_policy_exc,
+        defaults={
+            "order": 0,
+        },
+    )
+    PolicyBinding.objects.using(db_alias).update_or_create(
+        target=trigger,
+        policy=policy_pm_exc,
+        defaults={
+            "order": 1,
+        },
+    )
+
+
+def transport_email_global(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
+
+    NotificationTransport.objects.using(db_alias).update_or_create(
+        name="default-email-transport",
+        defaults={"mode": TransportMode.EMAIL},
+    )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        (
+            "authentik_events",
+            "0010_notification_notificationtransport_notificationrule",
+        ),
+        ("authentik_core", "0016_auto_20201202_2234"),
+        ("authentik_policies_event_matcher", "0003_auto_20210110_1907"),
+        ("authentik_policies", "0004_policy_execution_logging"),
+    ]
+
+    operations = [
+        migrations.RunPython(transport_email_global),
+        migrations.RunPython(notify_configuration_error),
+        migrations.RunPython(notify_update),
+        migrations.RunPython(notify_exception),
+    ]
--- a/authentik/events/migrations/0012_auto_20210202_1821.py
+++ b/authentik/events/migrations/0012_auto_20210202_1821.py
@ -0,0 +1,52 @@
+# Generated by Django 3.1.6 on 2021-02-02 18:21
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_events", "0011_notification_rules_default_v1"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="notificationtransport",
+            name="send_once",
+            field=models.BooleanField(
+                default=False,
+                help_text="Only send notification once, for example when sending a webhook into a chat channel.",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="event",
+            name="action",
+            field=models.TextField(
+                choices=[
+                    ("login", "Login"),
+                    ("login_failed", "Login Failed"),
+                    ("logout", "Logout"),
+                    ("user_write", "User Write"),
+                    ("suspicious_request", "Suspicious Request"),
+                    ("password_set", "Password Set"),
+                    ("token_view", "Token View"),
+                    ("invitation_used", "Invite Used"),
+                    ("authorize_application", "Authorize Application"),
+                    ("source_linked", "Source Linked"),
+                    ("impersonation_started", "Impersonation Started"),
+                    ("impersonation_ended", "Impersonation Ended"),
+                    ("policy_execution", "Policy Execution"),
+                    ("policy_exception", "Policy Exception"),
+                    ("property_mapping_exception", "Property Mapping Exception"),
+                    ("system_task_execution", "System Task Execution"),
+                    ("system_task_exception", "System Task Exception"),
+                    ("configuration_error", "Configuration Error"),
+                    ("model_created", "Model Created"),
+                    ("model_updated", "Model Updated"),
+                    ("model_deleted", "Model Deleted"),
+                    ("update_available", "Update Available"),
+                    ("custom_", "Custom Prefix"),
+                ]
+            ),
+        ),
+    ]
--- a/authentik/events/migrations/0013_auto_20210209_1657.py
+++ b/authentik/events/migrations/0013_auto_20210209_1657.py
@ -0,0 +1,61 @@
+# Generated by Django 3.1.6 on 2021-02-09 16:57
+from django.apps.registry import Apps
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def token_view_to_secret_view(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    from authentik.events.models import EventAction
+
+    db_alias = schema_editor.connection.alias
+    Event = apps.get_model("authentik_events", "Event")
+
+    events = Event.objects.using(db_alias).filter(action="token_view")
+
+    for event in events:
+        event.context["secret"] = event.context.pop("token")
+        event.action = EventAction.SECRET_VIEW
+
+    Event.objects.using(db_alias).bulk_update(events, ["context", "action"])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_events", "0012_auto_20210202_1821"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="event",
+            name="action",
+            field=models.TextField(
+                choices=[
+                    ("login", "Login"),
+                    ("login_failed", "Login Failed"),
+                    ("logout", "Logout"),
+                    ("user_write", "User Write"),
+                    ("suspicious_request", "Suspicious Request"),
+                    ("password_set", "Password Set"),
+                    ("secret_view", "Secret View"),
+                    ("invitation_used", "Invite Used"),
+                    ("authorize_application", "Authorize Application"),
+                    ("source_linked", "Source Linked"),
+                    ("impersonation_started", "Impersonation Started"),
+                    ("impersonation_ended", "Impersonation Ended"),
+                    ("policy_execution", "Policy Execution"),
+                    ("policy_exception", "Policy Exception"),
+                    ("property_mapping_exception", "Property Mapping Exception"),
+                    ("system_task_execution", "System Task Execution"),
+                    ("system_task_exception", "System Task Exception"),
+                    ("configuration_error", "Configuration Error"),
+                    ("model_created", "Model Created"),
+                    ("model_updated", "Model Updated"),
+                    ("model_deleted", "Model Deleted"),
+                    ("update_available", "Update Available"),
+                    ("custom_", "Custom Prefix"),
+                ]
+            ),
+        ),
+        migrations.RunPython(token_view_to_secret_view),
+    ]
--- a/authentik/events/models.py
+++ b/authentik/events/models.py
@ -1,6 +1,6 @@
 """authentik events models"""
-
 from inspect import getmodule, stack
+from smtplib import SMTPException
 from typing import Optional, Union
 from uuid import uuid4

@ -9,19 +9,28 @@ from django.core.exceptions import ValidationError
 from django.db import models
 from django.http import HttpRequest
 from django.utils.translation import gettext as _
-from structlog import get_logger
+from requests import RequestException, post
+from structlog.stdlib import get_logger

+from authentik import __version__
 from authentik.core.middleware import (
    SESSION_IMPERSONATE_ORIGINAL_USER,
    SESSION_IMPERSONATE_USER,
 )
-from authentik.core.models import User
+from authentik.core.models import Group, User
 from authentik.events.utils import cleanse_dict, get_user, sanitize_dict
+from authentik.lib.sentry import SentryIgnoredException
 from authentik.lib.utils.http import get_client_ip
+from authentik.policies.models import PolicyBindingModel
+from authentik.stages.email.utils import TemplateEmailMessage

 LOGGER = get_logger("authentik.events")


+class NotificationTransportError(SentryIgnoredException):
+    """Error raised when a notification fails to be delivered"""
+
+
 class EventAction(models.TextChoices):
    """All possible actions to save into the events log"""

@ -33,7 +42,7 @@ class EventAction(models.TextChoices):
    SUSPICIOUS_REQUEST = "suspicious_request"
    PASSWORD_SET = "password_set"  # noqa # nosec

-    TOKEN_VIEW = "token_view"  # nosec
+    SECRET_VIEW = "secret_view"  # noqa # nosec

    INVITE_USED = "invitation_used"

@ -47,6 +56,9 @@ class EventAction(models.TextChoices):
    POLICY_EXCEPTION = "policy_exception"
    PROPERTY_MAPPING_EXCEPTION = "property_mapping_exception"

+    SYSTEM_TASK_EXECUTION = "system_task_execution"
+    SYSTEM_TASK_EXCEPTION = "system_task_exception"
+
    CONFIGURATION_ERROR = "configuration_error"

    MODEL_CREATED = "model_created"
@ -104,10 +116,12 @@ class Event(models.Model):
        Events independently from requests.
        `user` arguments optionally overrides user from requests."""
        if hasattr(request, "user"):
-            self.user = get_user(
-                request.user,
-                request.session.get(SESSION_IMPERSONATE_ORIGINAL_USER, None),
-            )
+            original_user = None
+            if hasattr(request, "session"):
+                original_user = request.session.get(
+                    SESSION_IMPERSONATE_ORIGINAL_USER, None
+                )
+            self.user = get_user(request.user, original_user)
        if user:
            self.user = get_user(user)
        # Check if we're currently impersonating, and add that user
@ -127,9 +141,7 @@ class Event(models.Model):

    def save(self, *args, **kwargs):
        if not self._state.adding:
-            raise ValidationError(
-                "you may not edit an existing %s" % self._meta.model_name
-            )
+            raise ValidationError("you may not edit an existing Event")
        LOGGER.debug(
            "Created Event",
            action=self.action,
@ -139,7 +151,231 @@ class Event(models.Model):
        )
        return super().save(*args, **kwargs)

+    @property
+    def summary(self) -> str:
+        """Return a summary of this event."""
+        if "message" in self.context:
+            return self.context["message"]
+        return f"{self.action}: {self.context}"
+
+    def __str__(self) -> str:
+        return f"<Event action={self.action} user={self.user} context={self.context}>"
+
    class Meta:

        verbose_name = _("Event")
        verbose_name_plural = _("Events")
+
+
+class TransportMode(models.TextChoices):
+    """Modes that a notification transport can send a notification"""
+
+    WEBHOOK = "webhook", _("Generic Webhook")
+    WEBHOOK_SLACK = "webhook_slack", _("Slack Webhook (Slack/Discord)")
+    EMAIL = "email", _("Email")
+
+
+class NotificationTransport(models.Model):
+    """Action which is executed when a Rule matches"""
+
+    uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
+
+    name = models.TextField(unique=True)
+    mode = models.TextField(choices=TransportMode.choices)
+
+    webhook_url = models.TextField(blank=True)
+    send_once = models.BooleanField(
+        default=False,
+        help_text=_(
+            "Only send notification once, for example when sending a webhook into a chat channel."
+        ),
+    )
+
+    def send(self, notification: "Notification") -> list[str]:
+        """Send notification to user, called from async task"""
+        if self.mode == TransportMode.WEBHOOK:
+            return self.send_webhook(notification)
+        if self.mode == TransportMode.WEBHOOK_SLACK:
+            return self.send_webhook_slack(notification)
+        if self.mode == TransportMode.EMAIL:
+            return self.send_email(notification)
+        raise ValueError(f"Invalid mode {self.mode} set")
+
+    def send_webhook(self, notification: "Notification") -> list[str]:
+        """Send notification to generic webhook"""
+        try:
+            response = post(
+                self.webhook_url,
+                json={
+                    "body": notification.body,
+                    "severity": notification.severity,
+                    "user_email": notification.user.email,
+                    "user_username": notification.user.username,
+                },
+            )
+            response.raise_for_status()
+        except RequestException as exc:
+            raise NotificationTransportError(exc.response.text) from exc
+        return [
+            response.status_code,
+            response.text,
+        ]
+
+    def send_webhook_slack(self, notification: "Notification") -> list[str]:
+        """Send notification to slack or slack-compatible endpoints"""
+        fields = [
+            {
+                "title": _("Severity"),
+                "value": notification.severity,
+                "short": True,
+            },
+            {
+                "title": _("Dispatched for user"),
+                "value": str(notification.user),
+                "short": True,
+            },
+        ]
+        if notification.event:
+            for key, value in notification.event.context.items():
+                if not isinstance(value, str):
+                    continue
+                # https://birdie0.github.io/discord-webhooks-guide/other/field_limits.html
+                if len(fields) >= 25:
+                    continue
+                fields.append({"title": key[:256], "value": value[:1024]})
+        body = {
+            "username": "authentik",
+            "icon_url": "https://goauthentik.io/img/icon.png",
+            "attachments": [
+                {
+                    "author_name": "authentik",
+                    "author_link": "https://goauthentik.io",
+                    "author_icon": "https://goauthentik.io/img/icon.png",
+                    "title": notification.body,
+                    "color": "#fd4b2d",
+                    "fields": fields,
+                    "footer": f"authentik v{__version__}",
+                }
+            ],
+        }
+        if notification.event:
+            body["attachments"][0]["title"] = notification.event.action
+        try:
+            response = post(self.webhook_url, json=body)
+            response.raise_for_status()
+        except RequestException as exc:
+            raise NotificationTransportError(exc.response.text) from exc
+        return [
+            response.status_code,
+            response.text,
+        ]
+
+    def send_email(self, notification: "Notification") -> list[str]:
+        """Send notification via global email configuration"""
+        subject = "authentik Notification: "
+        key_value = {}
+        if notification.event:
+            subject += notification.event.action
+            for key, value in notification.event.context.items():
+                if not isinstance(value, str):
+                    continue
+                key_value[key] = value
+        else:
+            subject += notification.body[:75]
+        mail = TemplateEmailMessage(
+            subject=subject,
+            template_name="email/generic.html",
+            to=[notification.user.email],
+            template_context={
+                "title": subject,
+                "body": notification.body,
+                "key_value": key_value,
+            },
+        )
+        # Email is sent directly here, as the call to send() should have been from a task.
+        try:
+            from authentik.stages.email.tasks import send_mail
+
+            # pyright: reportGeneralTypeIssues=false
+            return send_mail(mail.__dict__)  # pylint: disable=no-value-for-parameter
+        except (SMTPException, ConnectionError, OSError) as exc:
+            raise NotificationTransportError from exc
+
+    def __str__(self) -> str:
+        return f"Notification Transport {self.name}"
+
+    class Meta:
+
+        verbose_name = _("Notification Transport")
+        verbose_name_plural = _("Notification Transports")
+
+
+class NotificationSeverity(models.TextChoices):
+    """Severity images that a notification can have"""
+
+    NOTICE = "notice", _("Notice")
+    WARNING = "warning", _("Warning")
+    ALERT = "alert", _("Alert")
+
+
+class Notification(models.Model):
+    """Event Notification"""
+
+    uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
+    severity = models.TextField(choices=NotificationSeverity.choices)
+    body = models.TextField()
+    created = models.DateTimeField(auto_now_add=True)
+    event = models.ForeignKey(Event, on_delete=models.SET_NULL, null=True, blank=True)
+    seen = models.BooleanField(default=False)
+    user = models.ForeignKey(User, on_delete=models.CASCADE)
+
+    def __str__(self) -> str:
+        body_trunc = (self.body[:75] + "..") if len(self.body) > 75 else self.body
+        return f"Notification for user {self.user}: {body_trunc}"
+
+    class Meta:
+
+        verbose_name = _("Notification")
+        verbose_name_plural = _("Notifications")
+
+
+class NotificationRule(PolicyBindingModel):
+    """Decide when to create a Notification based on policies attached to this object."""
+
+    name = models.TextField(unique=True)
+    transports = models.ManyToManyField(
+        NotificationTransport,
+        help_text=_(
+            (
+                "Select which transports should be used to notify the user. If none are "
+                "selected, the notification will only be shown in the authentik UI."
+            )
+        ),
+    )
+    severity = models.TextField(
+        choices=NotificationSeverity.choices,
+        default=NotificationSeverity.NOTICE,
+        help_text=_(
+            "Controls which severity level the created notifications will have."
+        ),
+    )
+    group = models.ForeignKey(
+        Group,
+        help_text=_(
+            (
+                "Define which group of users this notification should be sent and shown to. "
+                "If left empty, Notification won't ben sent."
+            )
+        ),
+        null=True,
+        blank=True,
+        on_delete=models.SET_NULL,
+    )
+
+    def __str__(self) -> str:
+        return f"Notification Rule {self.name}"
+
+    class Meta:
+
+        verbose_name = _("Notification Rule")
+        verbose_name_plural = _("Notification Rules")
--- a/authentik/events/monitored_tasks.py
+++ b/authentik/events/monitored_tasks.py
@ -8,6 +8,8 @@ from typing import Any, Dict, List, Optional
 from celery import Task
 from django.core.cache import cache

+from authentik.events.models import Event, EventAction
+

 class TaskResultStatus(Enum):
    """Possible states of tasks"""
@ -52,6 +54,11 @@ class TaskInfo:

    task_description: Optional[str] = field(default=None)

+    @property
+    def html_name(self) -> list[str]:
+        """Get task_name, but split on underscores, so we can join in the html template."""
+        return self.task_name.split("_")
+
    @staticmethod
    def all() -> Dict[str, "TaskInfo"]:
        """Get all TaskInfo objects"""
@ -133,6 +140,13 @@ class MonitoredTask(Task):
            task_call_args=args,
            task_call_kwargs=kwargs,
        ).save(self.result_timeout_hours)
+        Event.new(
+            EventAction.SYSTEM_TASK_EXCEPTION,
+            message=(
+                f"Task {self.__name__} encountered an error: "
+                "\n".join(self._result.messages)
+            ),
+        ).save()
        return super().on_failure(exc, task_id, args, kwargs, einfo=einfo)

    def run(self, *args, **kwargs):
--- a/authentik/events/signals.py
+++ b/authentik/events/signals.py
@ -7,12 +7,16 @@ from django.contrib.auth.signals import (
    user_logged_out,
    user_login_failed,
 )
+from django.db.models.signals import post_save
 from django.dispatch import receiver
 from django.http import HttpRequest

 from authentik.core.models import User
 from authentik.core.signals import password_changed
 from authentik.events.models import Event, EventAction
+from authentik.events.tasks import event_notification_handler
+from authentik.flows.planner import PLAN_CONTEXT_SOURCE, FlowPlan
+from authentik.flows.views import SESSION_KEY_PLAN
 from authentik.stages.invitation.models import Invitation
 from authentik.stages.invitation.signals import invitation_used
 from authentik.stages.user_write.signals import user_write
@ -44,6 +48,11 @@ class EventNewThread(Thread):
 def on_user_logged_in(sender, request: HttpRequest, user: User, **_):
    """Log successful login"""
    thread = EventNewThread(EventAction.LOGIN, request)
+    if SESSION_KEY_PLAN in request.session:
+        flow_plan: FlowPlan = request.session[SESSION_KEY_PLAN]
+        if PLAN_CONTEXT_SOURCE in flow_plan.context:
+            # Login request came from an external source, save it in the context
+            thread.kwargs["using_source"] = flow_plan.context[PLAN_CONTEXT_SOURCE]
    thread.user = user
    thread.run()

@ -95,3 +104,10 @@ def on_password_changed(sender, user: User, password: str, **_):
    """Log password change"""
    thread = EventNewThread(EventAction.PASSWORD_SET, None, user=user)
    thread.run()
+
+
+@receiver(post_save, sender=Event)
+# pylint: disable=unused-argument
+def event_post_save_notification(sender, instance: Event, **_):
+    """Start task to check if any policies trigger an notification on this event"""
+    event_notification_handler.delay(instance.event_uuid.hex)
--- a/authentik/events/tasks.py
+++ b/authentik/events/tasks.py
@ -0,0 +1,107 @@
+"""Event notification tasks"""
+from guardian.shortcuts import get_anonymous_user
+from structlog import get_logger
+
+from authentik.core.models import User
+from authentik.events.models import (
+    Event,
+    Notification,
+    NotificationRule,
+    NotificationTransport,
+    NotificationTransportError,
+)
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.policies.engine import PolicyEngine, PolicyEngineMode
+from authentik.policies.models import PolicyBinding
+from authentik.root.celery import CELERY_APP
+
+LOGGER = get_logger()
+
+
+@CELERY_APP.task()
+def event_notification_handler(event_uuid: str):
+    """Start task for each trigger definition"""
+    for trigger in NotificationRule.objects.all():
+        event_trigger_handler.apply_async(
+            args=[event_uuid, trigger.name], queue="authentik_events"
+        )
+
+
+@CELERY_APP.task()
+def event_trigger_handler(event_uuid: str, trigger_name: str):
+    """Check if policies attached to NotificationRule match event"""
+    events = Event.objects.filter(event_uuid=event_uuid)
+    if not events.exists():
+        LOGGER.warning("event doesn't exist yet or anymore", event_uuid=event_uuid)
+        return
+    event: Event = events.first()
+    trigger: NotificationRule = NotificationRule.objects.get(name=trigger_name)
+
+    if "policy_uuid" in event.context:
+        policy_uuid = event.context["policy_uuid"]
+        if PolicyBinding.objects.filter(
+            target__in=NotificationRule.objects.all().values_list(
+                "pbm_uuid", flat=True
+            ),
+            policy=policy_uuid,
+        ).exists():
+            # If policy that caused this event to be created is attached
+            # to *any* NotificationRule, we return early.
+            # This is the most effective way to prevent infinite loops.
+            LOGGER.debug(
+                "e(trigger): attempting to prevent infinite loop", trigger=trigger
+            )
+            return
+
+    if not trigger.group:
+        LOGGER.debug("e(trigger): trigger has no group", trigger=trigger)
+        return
+
+    LOGGER.debug("e(trigger): checking if trigger applies", trigger=trigger)
+    user = User.objects.filter(pk=event.user.get("pk")).first() or get_anonymous_user()
+    policy_engine = PolicyEngine(trigger, user)
+    policy_engine.mode = PolicyEngineMode.MODE_OR
+    policy_engine.empty_result = False
+    policy_engine.use_cache = False
+    policy_engine.request.context["event"] = event
+    policy_engine.build()
+    result = policy_engine.result
+    if not result.passing:
+        return
+
+    LOGGER.debug("e(trigger): event trigger matched", trigger=trigger)
+    # Create the notification objects
+    for transport in trigger.transports.all():
+        for user in trigger.group.users.all():
+            LOGGER.debug("created notification")
+            notification = Notification.objects.create(
+                severity=trigger.severity, body=event.summary, event=event, user=user
+            )
+            notification_transport.apply_async(
+                args=[notification.pk, transport.pk], queue="authentik_events"
+            )
+            if transport.send_once:
+                break
+
+
+@CELERY_APP.task(
+    bind=True,
+    autoretry_for=(NotificationTransportError,),
+    retry_backoff=True,
+    base=MonitoredTask,
+)
+def notification_transport(
+    self: MonitoredTask, notification_pk: int, transport_pk: int
+):
+    """Send notification over specified transport"""
+    self.save_on_success = False
+    try:
+        notification: Notification = Notification.objects.get(pk=notification_pk)
+        transport: NotificationTransport = NotificationTransport.objects.get(
+            pk=transport_pk
+        )
+        transport.send(notification)
+        self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL))
+    except NotificationTransportError as exc:
+        self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
+        raise exc
--- a/authentik/events/tests/test_api.py
+++ b/authentik/events/tests/test_api.py
@ -0,0 +1,24 @@
+"""Event API tests"""
+
+from django.shortcuts import reverse
+from rest_framework.test import APITestCase
+
+from authentik.core.models import User
+from authentik.events.models import Event, EventAction
+
+
+class TestEventsAPI(APITestCase):
+    """Test Event API"""
+
+    def test_top_n(self):
+        """Test top_per_user"""
+        user = User.objects.get(username="akadmin")
+        self.client.force_login(user)
+
+        event = Event.new(EventAction.AUTHORIZE_APPLICATION)
+        event.save()  # We save to ensure nothing is un-saveable
+        response = self.client.get(
+            reverse("authentik_api:event-top-per-user"),
+            data={"filter_action": EventAction.AUTHORIZE_APPLICATION},
+        )
+        self.assertEqual(response.status_code, 200)
--- a/authentik/events/tests/test_event.py
+++ b/authentik/events/tests/test_event.py
@ -1,9 +1,10 @@
-"""events event tests"""
+"""event tests"""

 from django.contrib.contenttypes.models import ContentType
 from django.test import TestCase
 from guardian.shortcuts import get_anonymous_user

+from authentik.core.models import Group
 from authentik.events.models import Event
 from authentik.policies.dummy.models import DummyPolicy

@ -13,14 +14,24 @@ class TestEvents(TestCase):

    def test_new_with_model(self):
        """Create a new Event passing a model as kwarg"""
-        event = Event.new("unittest", test={"model": get_anonymous_user()})
+        test_model = Group.objects.create(name="test")
+        event = Event.new("unittest", test={"model": test_model})
        event.save()  # We save to ensure nothing is un-saveable
-        model_content_type = ContentType.objects.get_for_model(get_anonymous_user())
+        model_content_type = ContentType.objects.get_for_model(test_model)
        self.assertEqual(
            event.context.get("test").get("model").get("app"),
            model_content_type.app_label,
        )

+    def test_new_with_user(self):
+        """Create a new Event passing a user as kwarg"""
+        event = Event.new("unittest", test={"model": get_anonymous_user()})
+        event.save()  # We save to ensure nothing is un-saveable
+        self.assertEqual(
+            event.context.get("test").get("model").get("username"),
+            get_anonymous_user().username,
+        )
+
    def test_new_with_uuid_model(self):
        """Create a new Event passing a model (with UUID PK) as kwarg"""
        temp_model = DummyPolicy.objects.create(name="test", result=True)
--- a/authentik/events/tests/test_middleware.py
+++ b/authentik/events/tests/test_middleware.py
@ -0,0 +1,48 @@
+"""Event Middleware tests"""
+
+from django.shortcuts import reverse
+from rest_framework.test import APITestCase
+
+from authentik.core.models import Application, User
+from authentik.events.models import Event, EventAction
+
+
+class TestEventsMiddleware(APITestCase):
+    """Test Event Middleware"""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.user = User.objects.get(username="akadmin")
+        self.client.force_login(self.user)
+
+    def test_create(self):
+        """Test model creation event"""
+        self.client.post(
+            reverse("authentik_api:application-list"),
+            data={"name": "test-create", "slug": "test-create"},
+        )
+        self.assertTrue(Application.objects.filter(name="test-create").exists())
+        self.assertTrue(
+            Event.objects.filter(
+                action=EventAction.MODEL_CREATED,
+                context__model__model_name="application",
+                context__model__app="authentik_core",
+                context__model__name="test-create",
+            ).exists()
+        )
+
+    def test_delete(self):
+        """Test model creation event"""
+        Application.objects.create(name="test-delete", slug="test-delete")
+        self.client.delete(
+            reverse("authentik_api:application-detail", kwargs={"slug": "test-delete"})
+        )
+        self.assertFalse(Application.objects.filter(name="test").exists())
+        self.assertTrue(
+            Event.objects.filter(
+                action=EventAction.MODEL_DELETED,
+                context__model__model_name="application",
+                context__model__app="authentik_core",
+                context__model__name="test-delete",
+            ).exists()
+        )
--- a/authentik/events/tests/test_notifications.py
+++ b/authentik/events/tests/test_notifications.py
@ -0,0 +1,114 @@
+"""Notification tests"""
+
+from unittest.mock import MagicMock, patch
+
+from django.test import TestCase
+
+from authentik.core.models import Group, User
+from authentik.events.models import (
+    Event,
+    EventAction,
+    Notification,
+    NotificationRule,
+    NotificationTransport,
+)
+from authentik.policies.event_matcher.models import EventMatcherPolicy
+from authentik.policies.exceptions import PolicyException
+from authentik.policies.models import PolicyBinding
+
+
+class TestEventsNotifications(TestCase):
+    """Test Event Notifications"""
+
+    def setUp(self) -> None:
+        self.group = Group.objects.create(name="test-group")
+        self.user = User.objects.create(name="test-user", username="test")
+        self.group.users.add(self.user)
+        self.group.save()
+
+    def test_trigger_empty(self):
+        """Test trigger without any policies attached"""
+        transport = NotificationTransport.objects.create(name="transport")
+        trigger = NotificationRule.objects.create(name="trigger", group=self.group)
+        trigger.transports.add(transport)
+        trigger.save()
+
+        execute_mock = MagicMock()
+        with patch("authentik.events.models.NotificationTransport.send", execute_mock):
+            Event.new(EventAction.CUSTOM_PREFIX).save()
+        self.assertEqual(execute_mock.call_count, 0)
+
+    def test_trigger_single(self):
+        """Test simple transport triggering"""
+        transport = NotificationTransport.objects.create(name="transport")
+        trigger = NotificationRule.objects.create(name="trigger", group=self.group)
+        trigger.transports.add(transport)
+        trigger.save()
+        matcher = EventMatcherPolicy.objects.create(
+            name="matcher", action=EventAction.CUSTOM_PREFIX
+        )
+        PolicyBinding.objects.create(target=trigger, policy=matcher, order=0)
+
+        execute_mock = MagicMock()
+        with patch("authentik.events.models.NotificationTransport.send", execute_mock):
+            Event.new(EventAction.CUSTOM_PREFIX).save()
+        self.assertEqual(execute_mock.call_count, 1)
+
+    def test_trigger_no_group(self):
+        """Test trigger without group"""
+        trigger = NotificationRule.objects.create(name="trigger")
+        matcher = EventMatcherPolicy.objects.create(
+            name="matcher", action=EventAction.CUSTOM_PREFIX
+        )
+        PolicyBinding.objects.create(target=trigger, policy=matcher, order=0)
+
+        execute_mock = MagicMock()
+        with patch("authentik.events.models.NotificationTransport.send", execute_mock):
+            Event.new(EventAction.CUSTOM_PREFIX).save()
+        self.assertEqual(execute_mock.call_count, 0)
+
+    def test_policy_error_recursive(self):
+        """Test Policy error which would cause recursion"""
+        transport = NotificationTransport.objects.create(name="transport")
+        NotificationRule.objects.filter(name__startswith="default").delete()
+        trigger = NotificationRule.objects.create(name="trigger", group=self.group)
+        trigger.transports.add(transport)
+        trigger.save()
+        matcher = EventMatcherPolicy.objects.create(
+            name="matcher", action=EventAction.CUSTOM_PREFIX
+        )
+        PolicyBinding.objects.create(target=trigger, policy=matcher, order=0)
+
+        execute_mock = MagicMock()
+        passes = MagicMock(side_effect=PolicyException)
+        with patch(
+            "authentik.policies.event_matcher.models.EventMatcherPolicy.passes", passes
+        ):
+            with patch(
+                "authentik.events.models.NotificationTransport.send", execute_mock
+            ):
+                Event.new(EventAction.CUSTOM_PREFIX).save()
+        self.assertEqual(passes.call_count, 1)
+
+    def test_transport_once(self):
+        """Test transport's send_once"""
+        user2 = User.objects.create(name="test2-user", username="test2")
+        self.group.users.add(user2)
+        self.group.save()
+
+        transport = NotificationTransport.objects.create(
+            name="transport", send_once=True
+        )
+        NotificationRule.objects.filter(name__startswith="default").delete()
+        trigger = NotificationRule.objects.create(name="trigger", group=self.group)
+        trigger.transports.add(transport)
+        trigger.save()
+        matcher = EventMatcherPolicy.objects.create(
+            name="matcher", action=EventAction.CUSTOM_PREFIX
+        )
+        PolicyBinding.objects.create(target=trigger, policy=matcher, order=0)
+
+        execute_mock = MagicMock()
+        with patch("authentik.events.models.NotificationTransport.send", execute_mock):
+            Event.new(EventAction.CUSTOM_PREFIX).save()
+        self.assertEqual(Notification.objects.count(), 1)
--- a/authentik/events/utils.py
+++ b/authentik/events/utils.py
@ -5,8 +5,10 @@ from typing import Any, Dict, Optional
 from uuid import UUID

 from django.contrib.auth.models import AnonymousUser
+from django.core.handlers.wsgi import WSGIRequest
 from django.db import models
 from django.db.models.base import Model
+from django.http.request import HttpRequest
 from django.views.debug import SafeExceptionReporterFilter
 from guardian.utils import get_anonymous_user

@ -83,10 +85,14 @@ def sanitize_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
            value = asdict(value)
        if isinstance(value, dict):
            final_dict[key] = sanitize_dict(value)
+        elif isinstance(value, User):
+            final_dict[key] = sanitize_dict(get_user(value))
        elif isinstance(value, models.Model):
            final_dict[key] = sanitize_dict(model_to_dict(value))
        elif isinstance(value, UUID):
            final_dict[key] = value.hex
+        elif isinstance(value, (HttpRequest, WSGIRequest)):
+            continue
        else:
            final_dict[key] = value
    return final_dict
--- a/authentik/flows/exceptions.py
+++ b/authentik/flows/exceptions.py
@ -1,9 +1,11 @@
 """flow exceptions"""

+from authentik.lib.sentry import SentryIgnoredException

-class FlowNonApplicableException(BaseException):
+
+class FlowNonApplicableException(SentryIgnoredException):
    """Flow does not apply to current user (denied by policy)."""


-class EmptyFlowException(BaseException):
+class EmptyFlowException(SentryIgnoredException):
    """Flow has no stages."""
--- a/authentik/flows/management/commands/benchmark.py
+++ b/authentik/flows/management/commands/benchmark.py
@ -1,13 +1,13 @@
 """authentik benchmark command"""
 from csv import DictWriter
-from multiprocessing import Manager, Process, cpu_count
+from multiprocessing import Manager, cpu_count, get_context
 from sys import stdout
 from time import time

 from django import db
 from django.core.management.base import BaseCommand
 from django.test import RequestFactory
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik import __version__
 from authentik.core.models import User
@ -15,9 +15,11 @@ from authentik.flows.models import Flow
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner

 LOGGER = get_logger()
+FORK_CTX = get_context("fork")
+PROCESS_CLASS = FORK_CTX.Process


-class FlowPlanProcess(Process):  # pragma: no cover
+class FlowPlanProcess(PROCESS_CLASS):  # pragma: no cover
    """Test process which executes flow planner"""

    def __init__(self, index, return_dict, flow, user) -> None:
--- a/authentik/flows/markers.py
+++ b/authentik/flows/markers.py
@ -3,7 +3,7 @@ from dataclasses import dataclass
 from typing import TYPE_CHECKING, Optional

 from django.http.request import HttpRequest
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.core.models import User
 from authentik.flows.models import Stage
--- a/authentik/flows/models.py
+++ b/authentik/flows/models.py
@ -8,7 +8,7 @@ from django.http import HttpRequest
 from django.utils.translation import gettext_lazy as _
 from model_utils.managers import InheritanceManager
 from rest_framework.serializers import BaseSerializer
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.lib.models import InheritanceForeignKey, SerializerModel
 from authentik.policies.models import PolicyBindingModel
--- a/authentik/flows/planner.py
+++ b/authentik/flows/planner.py
@ -6,7 +6,7 @@ from django.core.cache import cache
 from django.http import HttpRequest
 from sentry_sdk.hub import Hub
 from sentry_sdk.tracing import Span
-from structlog import get_logger
+from structlog.stdlib import BoundLogger, get_logger

 from authentik.core.models import User
 from authentik.events.models import cleanse_dict
@ -16,11 +16,11 @@ from authentik.flows.models import Flow, FlowStageBinding, Stage
 from authentik.policies.engine import PolicyEngine

 LOGGER = get_logger()
-
 PLAN_CONTEXT_PENDING_USER = "pending_user"
 PLAN_CONTEXT_SSO = "is_sso"
 PLAN_CONTEXT_REDIRECT = "redirect"
 PLAN_CONTEXT_APPLICATION = "application"
+PLAN_CONTEXT_SOURCE = "source"


 def cache_key(flow: Flow, user: Optional[User] = None) -> str:
@ -87,10 +87,13 @@ class FlowPlanner:

    flow: Flow

+    _logger: BoundLogger
+
    def __init__(self, flow: Flow):
        self.use_cache = True
        self.allow_empty_flows = False
        self.flow = flow
+        self._logger = get_logger().bind(flow=flow)

    def plan(
        self, request: HttpRequest, default_context: Optional[Dict[str, Any]] = None
@ -102,7 +105,9 @@ class FlowPlanner:
            span.set_data("flow", self.flow)
            span.set_data("request", request)

-            LOGGER.debug("f(plan): Starting planning process", flow=self.flow)
+            self._logger.debug(
+                "f(plan): starting planning process",
+            )
            # Bit of a workaround here, if there is a pending user set in the default context
            # we use that user for our cache key
            # to make sure they don't get the generic response
@ -119,20 +124,21 @@ class FlowPlanner:
            engine.build()
            result = engine.result
            if not result.passing:
-                raise FlowNonApplicableException(result.messages)
+                raise FlowNonApplicableException(",".join(result.messages))
            # User is passing so far, check if we have a cached plan
            cached_plan_key = cache_key(self.flow, user)
            cached_plan = cache.get(cached_plan_key, None)
            if cached_plan and self.use_cache:
-                LOGGER.debug(
-                    "f(plan): Taking plan from cache",
-                    flow=self.flow,
+                self._logger.debug(
+                    "f(plan): taking plan from cache",
                    key=cached_plan_key,
                )
                # Reset the context as this isn't factored into caching
                cached_plan.context = default_context or {}
                return cached_plan
-            LOGGER.debug("f(plan): building plan", flow=self.flow)
+            self._logger.debug(
+                "f(plan): building plan",
+            )
            plan = self._build_plan(user, request, default_context)
            cache.set(cache_key(self.flow, user), plan)
            if not plan.stages and not self.allow_empty_flows:
@ -164,39 +170,34 @@ class FlowPlanner:
                stage = binding.stage
                marker = StageMarker()
                if binding.evaluate_on_plan:
-                    LOGGER.debug(
+                    self._logger.debug(
                        "f(plan): evaluating on plan",
                        stage=binding.stage,
-                        flow=self.flow,
                    )
                    engine = PolicyEngine(binding, user, request)
                    engine.request.context = plan.context
                    engine.build()
                    if engine.passing:
-                        LOGGER.debug(
-                            "f(plan): Stage passing",
+                        self._logger.debug(
+                            "f(plan): stage passing",
                            stage=binding.stage,
-                            flow=self.flow,
                        )
                    else:
                        stage = None
                else:
-                    LOGGER.debug(
+                    self._logger.debug(
                        "f(plan): not evaluating on plan",
                        stage=binding.stage,
-                        flow=self.flow,
                    )
                if binding.re_evaluate_policies and stage:
-                    LOGGER.debug(
-                        "f(plan): Stage has re-evaluate marker",
+                    self._logger.debug(
+                        "f(plan): stage has re-evaluate marker",
                        stage=binding.stage,
-                        flow=self.flow,
                    )
                    marker = ReevaluateMarker(binding=binding, user=user)
                if stage:
                    plan.append(stage, marker)
-        LOGGER.debug(
-            "f(plan): Finished building",
-            flow=self.flow,
+        self._logger.debug(
+            "f(plan): finished building",
        )
        return plan
--- a/authentik/flows/signals.py
+++ b/authentik/flows/signals.py
@ -2,7 +2,7 @@
 from django.core.cache import cache
 from django.db.models.signals import post_save
 from django.dispatch import receiver
-from structlog import get_logger
+from structlog.stdlib import get_logger

 LOGGER = get_logger()

--- a/authentik/flows/tests/test_transfer_docs.py
+++ b/authentik/flows/tests/test_transfer_docs.py
@ -24,6 +24,6 @@ def pbflow_tester(file_name: str) -> Callable:
    return tester


-for flow_file in glob("website/static/flows/*.pbflow"):
+for flow_file in glob("website/static/flows/*.akflow"):
    method_name = Path(flow_file).stem.replace("-", "_").replace(".", "_")
    setattr(TestTransferDocs, f"test_flow_{method_name}", pbflow_tester(flow_file))
--- a/authentik/flows/transfer/importer.py
+++ b/authentik/flows/transfer/importer.py
@ -152,7 +152,13 @@ class FlowImporter:
        entries = deepcopy(self.__import.entries)
        for entry in entries:
            model_app_label, model_name = entry.model.split(".")
-            model: SerializerModel = apps.get_model(model_app_label, model_name)
+            try:
+                model: SerializerModel = apps.get_model(model_app_label, model_name)
+            except LookupError:
+                self.logger.error(
+                    "app or model does not exist", app=model_app_label, model=model_name
+                )
+                return False
            # Validate each single entry
            try:
                serializer = self._validate_single(entry)
--- a/authentik/flows/views.py
+++ b/authentik/flows/views.py
@ -15,7 +15,7 @@ from django.template.response import TemplateResponse
 from django.utils.decorators import method_decorator
 from django.views.decorators.clickjacking import xframe_options_sameorigin
 from django.views.generic import TemplateView, View
-from structlog import get_logger
+from structlog.stdlib import BoundLogger, get_logger

 from authentik.core.models import USER_ATTRIBUTE_DEBUG
 from authentik.events.models import cleanse_dict
@ -49,45 +49,48 @@ class FlowExecutorView(View):
    current_stage: Stage
    current_stage_view: View

+    _logger: BoundLogger
+
    def setup(self, request: HttpRequest, flow_slug: str):
        super().setup(request, flow_slug=flow_slug)
        self.flow = get_object_or_404(Flow.objects.select_related(), slug=flow_slug)
+        self._logger = get_logger().bind(flow_slug=flow_slug)

    def handle_invalid_flow(self, exc: BaseException) -> HttpResponse:
        """When a flow is non-applicable check if user is on the correct domain"""
        if NEXT_ARG_NAME in self.request.GET:
            if not is_url_absolute(self.request.GET.get(NEXT_ARG_NAME)):
-                LOGGER.debug("f(exec): Redirecting to next on fail")
+                self._logger.debug("f(exec): Redirecting to next on fail")
                return redirect(self.request.GET.get(NEXT_ARG_NAME))
        message = exc.__doc__ if exc.__doc__ else str(exc)
        return self.stage_invalid(error_message=message)

+    # pylint: disable=unused-argument
    def dispatch(self, request: HttpRequest, flow_slug: str) -> HttpResponse:
        # Early check if theres an active Plan for the current session
        if SESSION_KEY_PLAN in self.request.session:
            self.plan = self.request.session[SESSION_KEY_PLAN]
            if self.plan.flow_pk != self.flow.pk.hex:
-                LOGGER.warning(
+                self._logger.warning(
                    "f(exec): Found existing plan for other flow, deleteing plan",
-                    flow_slug=flow_slug,
                )
                # Existing plan is deleted from session and instance
                self.plan = None
                self.cancel()
-            LOGGER.debug("f(exec): Continuing existing plan", flow_slug=flow_slug)
+            self._logger.debug("f(exec): Continuing existing plan")

        # Don't check session again as we've either already loaded the plan or we need to plan
        if not self.plan:
-            LOGGER.debug(
-                "f(exec): No active Plan found, initiating planner", flow_slug=flow_slug
-            )
+            self._logger.debug("f(exec): No active Plan found, initiating planner")
            try:
                self.plan = self._initiate_plan()
            except FlowNonApplicableException as exc:
-                LOGGER.warning("f(exec): Flow not applicable to current user", exc=exc)
+                self._logger.warning(
+                    "f(exec): Flow not applicable to current user", exc=exc
+                )
                return to_stage_response(self.request, self.handle_invalid_flow(exc))
            except EmptyFlowException as exc:
-                LOGGER.warning("f(exec): Flow is empty", exc=exc)
+                self._logger.warning("f(exec): Flow is empty", exc=exc)
                # To match behaviour with loading an empty flow plan from cache,
                # we don't show an error message here, but rather call _flow_done()
                return self._flow_done()
@ -95,10 +98,10 @@ class FlowExecutorView(View):
        # as it hasn't been successfully passed yet
        next_stage = self.plan.next(self.request)
        if not next_stage:
-            LOGGER.debug("f(exec): no more stages, flow is done.")
+            self._logger.debug("f(exec): no more stages, flow is done.")
            return self._flow_done()
        self.current_stage = next_stage
-        LOGGER.debug(
+        self._logger.debug(
            "f(exec): Current stage",
            current_stage=self.current_stage,
            flow_slug=self.flow.slug,
@ -112,32 +115,30 @@ class FlowExecutorView(View):

    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
        """pass get request to current stage"""
-        LOGGER.debug(
+        self._logger.debug(
            "f(exec): Passing GET",
            view_class=class_to_path(self.current_stage_view.__class__),
            stage=self.current_stage,
-            flow_slug=self.flow.slug,
        )
        try:
            stage_response = self.current_stage_view.get(request, *args, **kwargs)
            return to_stage_response(request, stage_response)
        except Exception as exc:  # pylint: disable=broad-except
-            LOGGER.exception(exc)
+            self._logger.exception(exc)
            return to_stage_response(request, FlowErrorResponse(request, exc))

    def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
        """pass post request to current stage"""
-        LOGGER.debug(
+        self._logger.debug(
            "f(exec): Passing POST",
            view_class=class_to_path(self.current_stage_view.__class__),
            stage=self.current_stage,
-            flow_slug=self.flow.slug,
        )
        try:
            stage_response = self.current_stage_view.post(request, *args, **kwargs)
            return to_stage_response(request, stage_response)
        except Exception as exc:  # pylint: disable=broad-except
-            LOGGER.exception(exc)
+            self._logger.exception(exc)
            return to_stage_response(request, FlowErrorResponse(request, exc))

    def _initiate_plan(self) -> FlowPlan:
@ -163,26 +164,23 @@ class FlowExecutorView(View):
    def stage_ok(self) -> HttpResponse:
        """Callback called by stages upon successful completion.
        Persists updated plan and context to session."""
-        LOGGER.debug(
+        self._logger.debug(
            "f(exec): Stage ok",
            stage_class=class_to_path(self.current_stage_view.__class__),
-            flow_slug=self.flow.slug,
        )
        self.plan.pop()
        self.request.session[SESSION_KEY_PLAN] = self.plan
        if self.plan.stages:
-            LOGGER.debug(
+            self._logger.debug(
                "f(exec): Continuing with next stage",
                reamining=len(self.plan.stages),
-                flow_slug=self.flow.slug,
            )
            return redirect_with_qs(
                "authentik_flows:flow-executor", self.request.GET, **self.kwargs
            )
        # User passed all stages
-        LOGGER.debug(
+        self._logger.debug(
            "f(exec): User passed all stages",
-            flow_slug=self.flow.slug,
            context=cleanse_dict(self.plan.context),
        )
        return self._flow_done()
@ -193,7 +191,7 @@ class FlowExecutorView(View):

        Optionally, an exception can be passed, which will be shown if the current user
        is a superuser."""
-        LOGGER.debug("f(exec): Stage invalid", flow_slug=self.flow.slug)
+        self._logger.debug("f(exec): Stage invalid")
        self.cancel()
        response = AccessDeniedResponse(
            self.request, template="flows/denied_shell.html"
--- a/authentik/lib/config.py
+++ b/authentik/lib/config.py
@ -5,13 +5,15 @@ from contextlib import contextmanager
 from glob import glob
 from json import dumps
 from time import time
-from typing import Any, Dict
+from typing import Any
 from urllib.parse import urlparse

 import yaml
 from django.conf import ImproperlyConfigured
 from django.http import HttpRequest

+from authentik import __version__
+
 SEARCH_PATHS = ["authentik/lib/default.yml", "/etc/authentik/config.yml", ""] + glob(
    "/etc/authentik/config.d/*.yml", recursive=True
 )
@ -19,10 +21,9 @@ ENV_PREFIX = "AUTHENTIK"
 ENVIRONMENT = os.getenv(f"{ENV_PREFIX}_ENV", "local")


-def context_processor(request: HttpRequest) -> Dict[str, Any]:
+def context_processor(request: HttpRequest) -> dict[str, Any]:
    """Context Processor that injects config object into every template"""
-    kwargs = {"config": CONFIG.raw}
-    return kwargs
+    return {"config": CONFIG.raw, "ak_version": __version__}


 class ConfigLoader:
--- a/authentik/lib/default.yml
+++ b/authentik/lib/default.yml
@ -21,6 +21,17 @@ error_reporting:
  environment: customer
  send_pii: false

+# Global email settings
+email:
+  host: localhost
+  port: 25
+  username: ""
+  password: ""
+  use_tls: false
+  use_ssl: false
+  timeout: 10
+  from: authentik@localhost
+
 outposts:
  docker_image_base: "beryju/authentik" # this is prepended to -proxy:version

--- a/authentik/lib/expression/evaluator.py
+++ b/authentik/lib/expression/evaluator.py
@ -7,7 +7,7 @@ from django.core.exceptions import ValidationError
 from requests import Session
 from sentry_sdk.hub import Hub
 from sentry_sdk.tracing import Span
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.core.models import User

@ -60,7 +60,7 @@ class BaseEvaluator:
    @staticmethod
    def expr_func_is_group_member(user: User, **group_filters) -> bool:
        """Check if `user` is member of group with name `group_name`"""
-        return user.groups.filter(**group_filters).exists()
+        return user.ak_groups.filter(**group_filters).exists()

    def wrap_expression(self, expression: str, params: Iterable[str]) -> str:
        """Wrap expression in a function, call it, and save the result as `result`"""
@ -98,6 +98,10 @@ class BaseEvaluator:
                exec(ast_obj, self._globals, _locals)  # nosec # noqa
                result = _locals["result"]
            except Exception as exc:
+                # So, this is a bit questionable. Essentially, we are edit the stacktrace
+                # so the user only sees information relevant to them
+                # and none of our surrounding error handling
+                exc.__traceback__ = exc.__traceback__.tb_next
                self.handle_error(exc, expression_source)
                raise exc
            return result
--- a/authentik/lib/logging.py
+++ b/authentik/lib/logging.py
@ -1,7 +1,6 @@
 """logging helpers"""
 from logging import Logger
 from os import getpid
-from typing import Callable


 # pylint: disable=unused-argument
@ -9,15 +8,3 @@ def add_process_id(logger: Logger, method_name: str, event_dict):
    """Add the current process ID"""
    event_dict["pid"] = getpid()
    return event_dict
-
-
-def add_common_fields(environment: str) -> Callable:
-    """Add a common field to easily search for authentik logs"""
-
-    def add_common_field(logger: Logger, method_name: str, event_dict):
-        """Add a common field to easily search for authentik logs"""
-        event_dict["app"] = "authentik"
-        event_dict["app_environment"] = environment
-        return event_dict
-
-    return add_common_field
--- a/authentik/lib/sentry.py
+++ b/authentik/lib/sentry.py
@ -11,7 +11,7 @@ from ldap3.core.exceptions import LDAPException
 from redis.exceptions import ConnectionError as RedisConnectionError
 from redis.exceptions import RedisError, ResponseError
 from rest_framework.exceptions import APIException
-from structlog import get_logger
+from structlog.stdlib import get_logger
 from websockets.exceptions import WebSocketException

 LOGGER = get_logger()
@ -59,6 +59,5 @@ def before_send(event, hint):
    if "exc_info" in hint:
        _, exc_value, _ = hint["exc_info"]
        if isinstance(exc_value, ignored_classes):
-            LOGGER.info("Supressing error %r", exc_value)
            return None
    return event
--- a/authentik/lib/templatetags/authentik_utils.py
+++ b/authentik/lib/templatetags/authentik_utils.py
@ -8,7 +8,7 @@ from django.http.request import HttpRequest
 from django.template import Context
 from django.templatetags.static import static
 from django.utils.html import escape, mark_safe
-from structlog import get_logger
+from structlog.stdlib import get_logger

 from authentik.core.models import User
 from authentik.lib.config import CONFIG
--- a/authentik/lib/utils/urls.py
+++ b/authentik/lib/utils/urls.py
@ -5,7 +5,7 @@ from django.http import HttpResponse
 from django.shortcuts import redirect, reverse
 from django.urls import NoReverseMatch
 from django.utils.http import urlencode
-from structlog import get_logger
+from structlog.stdlib import get_logger

 LOGGER = get_logger()

--- a/authentik/managed/init.py
+++ b/authentik/managed/init.py
--- a/Show More
+++ b/Show More