release: 2021.7.1-rc1

website/docs: add 2021.7
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
2021-07-21 10:44:40 +02:00 · 2021-07-21 09:41:49 +02:00 · 2021-07-21 09:41:16 +02:00 · 2021-07-21 09:41:08 +02:00 · 2021-07-21 09:19:25 +02:00 · 2021-07-21 09:18:55 +02:00
140 changed files with 9613 additions and 7473 deletions
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2021.6.4
+current_version = 2021.7.1-rc1
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)
@ -29,8 +29,6 @@ values =

 [bumpversion:file:internal/constants/constants.go]

-[bumpversion:file:outpost/pkg/version.go]
-
 [bumpversion:file:web/src/constants.ts]

 [bumpversion:file:website/docs/outposts/manual-deploy-docker-compose.md]
--- a/.dockerignore
+++ b/.dockerignore
@ -3,3 +3,6 @@ static
 htmlcov
 *.env.yml
 **/node_modules
+dist/**
+build/**
+build_docs/**
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -9,7 +9,7 @@ updates:
  assignees:
  - BeryJu
 - package-ecosystem: gomod
-  directory: "/outpost"
+  directory: "/"
  schedule:
    interval: daily
    time: "04:00"
@ -48,11 +48,3 @@ updates:
  open-pull-requests-limit: 10
  assignees:
  - BeryJu
- package-ecosystem: docker
-  directory: "/outpost"
-  schedule:
-    interval: daily
-    time: "04:00"
-  open-pull-requests-limit: 10
-  assignees:
-  - BeryJu
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -33,14 +33,14 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik:2021.6.4,
+            beryju/authentik:2021.7.1-rc1,
            beryju/authentik:latest,
-            ghcr.io/goauthentik/server:2021.6.4,
+            ghcr.io/goauthentik/server:2021.7.1-rc1,
            ghcr.io/goauthentik/server:latest
          platforms: linux/amd64,linux/arm64
          context: .
      - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.6.4', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.7.1-rc1', 'rc') }}
        run: |
          docker pull beryju/authentik:latest
          docker tag beryju/authentik:latest beryju/authentik:stable
@ -75,14 +75,14 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik-proxy:2021.6.4,
+            beryju/authentik-proxy:2021.7.1-rc1,
            beryju/authentik-proxy:latest,
-            ghcr.io/goauthentik/proxy:2021.6.4,
+            ghcr.io/goauthentik/proxy:2021.7.1-rc1,
            ghcr.io/goauthentik/proxy:latest
-          file: outpost/proxy.Dockerfile
+          file: proxy.Dockerfile
          platforms: linux/amd64,linux/arm64
      - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.6.4', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.7.1-rc1', 'rc') }}
        run: |
          docker pull beryju/authentik-proxy:latest
          docker tag beryju/authentik-proxy:latest beryju/authentik-proxy:stable
@ -117,14 +117,14 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik-ldap:2021.6.4,
+            beryju/authentik-ldap:2021.7.1-rc1,
            beryju/authentik-ldap:latest,
-            ghcr.io/goauthentik/ldap:2021.6.4,
+            ghcr.io/goauthentik/ldap:2021.7.1-rc1,
            ghcr.io/goauthentik/ldap:latest
-          file: outpost/ldap.Dockerfile
+          file: ldap.Dockerfile
          platforms: linux/amd64,linux/arm64
      - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.6.4', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.7.1-rc1', 'rc') }}
        run: |
          docker pull beryju/authentik-ldap:latest
          docker tag beryju/authentik-ldap:latest beryju/authentik-ldap:stable
@ -157,7 +157,7 @@ jobs:
    steps:
      - uses: actions/checkout@v2
      - name: Setup Node.js environment
-        uses: actions/setup-node@v2.2.0
+        uses: actions/setup-node@v2.3.0
        with:
          node-version: 12.x
      - name: Build web api client and web ui
@ -176,7 +176,6 @@ jobs:
          SENTRY_PROJECT: authentik
          SENTRY_URL: https://sentry.beryju.org
        with:
-          version: authentik@2021.6.4
+          version: authentik@2021.7.1-rc1
          environment: beryjuorg-prod
          sourcemaps: './web/dist'
-          finalize: false
--- a/.gitignore
+++ b/.gitignore
@ -200,3 +200,4 @@ media/
 *mmdb

 .idea/
+api/
--- a/50
+++ b/50
@ -10,8 +10,16 @@ RUN pip install pipenv && \
    pipenv lock -r > requirements.txt && \
    pipenv lock -r --dev-only > requirements-dev.txt

-# Stage 2: Build web API
-FROM openapitools/openapi-generator-cli as api-builder
+# Stage 2: Build website
+FROM node as website-builder
+
+COPY ./website /static/
+
+ENV NODE_ENV=production
+RUN cd /static && npm i && npm run build-docs-only
+
+# Stage 3: Build web API
+FROM openapitools/openapi-generator-cli as web-api-builder

 COPY ./schema.yml /local/schema.yml

@ -21,34 +29,52 @@ RUN	docker-entrypoint.sh generate \
    -o /local/web/api \
    --additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0

-# Stage 3: Build webui
-FROM node as npm-builder
+# Stage 3: Generate API Client
+FROM openapitools/openapi-generator-cli as go-api-builder
+
+COPY ./schema.yml /local/schema.yml
+
+RUN	docker-entrypoint.sh generate \
+    --git-host goauthentik.io \
+    --git-repo-id outpost \
+    --git-user-id api \
+    -i /local/schema.yml \
+    -g go \
+    -o /local/api \
+    --additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true && \
+    rm -f /local/api/go.mod /local/api/go.sum
+
+# Stage 4: Build webui
+FROM node as web-builder

 COPY ./web /static/
-COPY --from=api-builder /local/web/api /static/api
+COPY --from=web-api-builder /local/web/api /static/api

 ENV NODE_ENV=production
 RUN cd /static && npm i && npm run build

-# Stage 4: Build go proxy
-FROM golang:1.16.5 AS builder
+# Stage 5: Build go proxy
+FROM golang:1.16.6 AS builder

 WORKDIR /work

-COPY --from=npm-builder /static/robots.txt /work/web/robots.txt
-COPY --from=npm-builder /static/security.txt /work/web/security.txt
-COPY --from=npm-builder /static/dist/ /work/web/dist/
-COPY --from=npm-builder /static/authentik/ /work/web/authentik/
+COPY --from=web-builder /static/robots.txt /work/web/robots.txt
+COPY --from=web-builder /static/security.txt /work/web/security.txt
+COPY --from=web-builder /static/dist/ /work/web/dist/
+COPY --from=web-builder /static/authentik/ /work/web/authentik/
+COPY --from=website-builder /static/help/ /work/website/help/

+COPY --from=go-api-builder /local/api api
 COPY ./cmd /work/cmd
 COPY ./web/static.go /work/web/static.go
+COPY ./website/static.go /work/website/static.go
 COPY ./internal /work/internal
 COPY ./go.mod /work/go.mod
 COPY ./go.sum /work/go.sum

 RUN go build -o /work/authentik ./cmd/server/main.go

-# Stage 5: Run
+# Stage 6: Run
 FROM python:3.9-slim-buster

 WORKDIR /
--- a/9
+++ b/9
@ -32,7 +32,7 @@ gen-build:

 gen-clean:
 	rm -rf web/api/src/
-	rm -rf outpost/api/
+	rm -rf api/

 gen-web:
 	docker run \
@ -55,11 +55,14 @@ gen-outpost:
 		--git-user-id api \
 		-i /local/schema.yml \
 		-g go \
-		-o /local/outpost/api \
+		-o /local/api \
 		--additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true
-	rm -f outpost/api/go.mod outpost/api/go.sum
+	rm -f api/go.mod api/go.sum

 gen: gen-build gen-clean gen-web gen-outpost

+migrate:
+	python -m lifecycle.migrate
+
 run:
 	go run -v cmd/server/main.go
--- a/1
+++ b/1
@ -47,6 +47,7 @@ xmlsec = "*"
 duo-client = "*"
 ua-parser = "*"
 deepmerge = "*"
+colorama = "*"

 [requires]
 python_version = "3.9"
--- a/Pipfile.lock
+++ b/Pipfile.lock
@ -1,7 +1,7 @@
 {
    "_meta": {
        "hash": {
-            "sha256": "f90d9fb4713eaf9c5ffe6a3858e64843670f79ab5007e7debf914c1f094c8d63"
+            "sha256": "e4f2e57bd5c709809515ab2b95eb3f5fa337d4a9334f4110a24bf28c3f9d5f8f"
        },
        "pipfile-spec": 6,
        "requires": {
@ -122,19 +122,19 @@
        },
        "boto3": {
            "hashes": [
-                "sha256:3b35689c215c982fe9f7ef78d748aa9b0cd15c3b2eb04f9b460aaa63fe2fbd03",
-                "sha256:b1cbeb92123799001b97f2ee1cdf470e21f1be08314ae28fc7ea357925186f1c"
+                "sha256:13e60f88d13161df951d6e52bd483cdbe1a36a31f818746289d8ba0879465710",
+                "sha256:3be2f259b279d69495433e3288db3670817fdb1813cfde92abf867bba3ad8148"
            ],
            "index": "pypi",
-            "version": "==1.17.105"
+            "version": "==1.18.3"
        },
        "botocore": {
            "hashes": [
-                "sha256:b0fda4edf8eb105453890700d49011ada576d0cc7326a0699dfabe9e872f552c",
-                "sha256:b5ba72d22212b0355f339c2a98b3296b3b2202a48e6a2b1366e866bc65a64b67"
+                "sha256:0b6f378c9efbc72eee61aba1e16cab90bde53a37bd2d861f6435552fd7030adf",
+                "sha256:285ab9459cdd49d4a9322692c6e13772b97af723a03c0eed519b589446491a5b"
            ],
-            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
-            "version": "==1.20.105"
+            "markers": "python_version >= '3.6'",
+            "version": "==1.21.3"
        },
        "cachetools": {
            "hashes": [
@ -180,65 +180,61 @@
        },
        "cffi": {
            "hashes": [
-                "sha256:005a36f41773e148deac64b08f233873a4d0c18b053d37da83f6af4d9087b813",
-                "sha256:04c468b622ed31d408fea2346bec5bbffba2cc44226302a0de1ade9f5ea3d373",
-                "sha256:06d7cd1abac2ffd92e65c0609661866709b4b2d82dd15f611e602b9b188b0b69",
-                "sha256:06db6321b7a68b2bd6df96d08a5adadc1fa0e8f419226e25b2a5fbf6ccc7350f",
-                "sha256:0857f0ae312d855239a55c81ef453ee8fd24136eaba8e87a2eceba644c0d4c06",
-                "sha256:0f861a89e0043afec2a51fd177a567005847973be86f709bbb044d7f42fc4e05",
-                "sha256:1071534bbbf8cbb31b498d5d9db0f274f2f7a865adca4ae429e147ba40f73dea",
-                "sha256:158d0d15119b4b7ff6b926536763dc0714313aa59e320ddf787502c70c4d4bee",
-                "sha256:1bf1ac1984eaa7675ca8d5745a8cb87ef7abecb5592178406e55858d411eadc0",
-                "sha256:1f436816fc868b098b0d63b8920de7d208c90a67212546d02f84fe78a9c26396",
-                "sha256:24a570cd11895b60829e941f2613a4f79df1a27344cbbb82164ef2e0116f09c7",
-                "sha256:24ec4ff2c5c0c8f9c6b87d5bb53555bf267e1e6f70e52e5a9740d32861d36b6f",
-                "sha256:2894f2df484ff56d717bead0a5c2abb6b9d2bf26d6960c4604d5c48bbc30ee73",
-                "sha256:29314480e958fd8aab22e4a58b355b629c59bf5f2ac2492b61e3dc06d8c7a315",
-                "sha256:293e7ea41280cb28c6fcaaa0b1aa1f533b8ce060b9e701d78511e1e6c4a1de76",
-                "sha256:34eff4b97f3d982fb93e2831e6750127d1355a923ebaeeb565407b3d2f8d41a1",
-                "sha256:35f27e6eb43380fa080dccf676dece30bef72e4a67617ffda586641cd4508d49",
-                "sha256:3c3f39fa737542161d8b0d680df2ec249334cd70a8f420f71c9304bd83c3cbed",
-                "sha256:3d3dd4c9e559eb172ecf00a2a7517e97d1e96de2a5e610bd9b68cea3925b4892",
-                "sha256:43e0b9d9e2c9e5d152946b9c5fe062c151614b262fda2e7b201204de0b99e482",
-                "sha256:48e1c69bbacfc3d932221851b39d49e81567a4d4aac3b21258d9c24578280058",
-                "sha256:51182f8927c5af975fece87b1b369f722c570fe169f9880764b1ee3bca8347b5",
-                "sha256:58e3f59d583d413809d60779492342801d6e82fefb89c86a38e040c16883be53",
-                "sha256:5de7970188bb46b7bf9858eb6890aad302577a5f6f75091fd7cdd3ef13ef3045",
-                "sha256:65fa59693c62cf06e45ddbb822165394a288edce9e276647f0046e1ec26920f3",
-                "sha256:681d07b0d1e3c462dd15585ef5e33cb021321588bebd910124ef4f4fb71aef55",
-                "sha256:69e395c24fc60aad6bb4fa7e583698ea6cc684648e1ffb7fe85e3c1ca131a7d5",
-                "sha256:6c97d7350133666fbb5cf4abdc1178c812cb205dc6f41d174a7b0f18fb93337e",
-                "sha256:6e4714cc64f474e4d6e37cfff31a814b509a35cb17de4fb1999907575684479c",
-                "sha256:72d8d3ef52c208ee1c7b2e341f7d71c6fd3157138abf1a95166e6165dd5d4369",
-                "sha256:8ae6299f6c68de06f136f1f9e69458eae58f1dacf10af5c17353eae03aa0d827",
-                "sha256:8b198cec6c72df5289c05b05b8b0969819783f9418e0409865dac47288d2a053",
-                "sha256:99cd03ae7988a93dd00bcd9d0b75e1f6c426063d6f03d2f90b89e29b25b82dfa",
-                "sha256:9cf8022fb8d07a97c178b02327b284521c7708d7c71a9c9c355c178ac4bbd3d4",
-                "sha256:9de2e279153a443c656f2defd67769e6d1e4163952b3c622dcea5b08a6405322",
-                "sha256:9e93e79c2551ff263400e1e4be085a1210e12073a31c2011dbbda14bda0c6132",
-                "sha256:9ff227395193126d82e60319a673a037d5de84633f11279e336f9c0f189ecc62",
-                "sha256:a465da611f6fa124963b91bf432d960a555563efe4ed1cc403ba5077b15370aa",
-                "sha256:ad17025d226ee5beec591b52800c11680fca3df50b8b29fe51d882576e039ee0",
-                "sha256:afb29c1ba2e5a3736f1c301d9d0abe3ec8b86957d04ddfa9d7a6a42b9367e396",
-                "sha256:b85eb46a81787c50650f2392b9b4ef23e1f126313b9e0e9013b35c15e4288e2e",
-                "sha256:bb89f306e5da99f4d922728ddcd6f7fcebb3241fc40edebcb7284d7514741991",
-                "sha256:cbde590d4faaa07c72bf979734738f328d239913ba3e043b1e98fe9a39f8b2b6",
-                "sha256:cc5a8e069b9ebfa22e26d0e6b97d6f9781302fe7f4f2b8776c3e1daea35f1adc",
-                "sha256:cd2868886d547469123fadc46eac7ea5253ea7fcb139f12e1dfc2bbd406427d1",
-                "sha256:d42b11d692e11b6634f7613ad8df5d6d5f8875f5d48939520d351007b3c13406",
-                "sha256:df5052c5d867c1ea0b311fb7c3cd28b19df469c056f7fdcfe88c7473aa63e333",
-                "sha256:f2d45f97ab6bb54753eab54fffe75aaf3de4ff2341c9daee1987ee1837636f1d",
-                "sha256:fd78e5fee591709f32ef6edb9a015b4aa1a5022598e36227500c8f4e02328d9c"
+                "sha256:06c54a68935738d206570b20da5ef2b6b6d92b38ef3ec45c5422c0ebaf338d4d",
+                "sha256:0c0591bee64e438883b0c92a7bed78f6290d40bf02e54c5bf0978eaf36061771",
+                "sha256:19ca0dbdeda3b2615421d54bef8985f72af6e0c47082a8d26122adac81a95872",
+                "sha256:22b9c3c320171c108e903d61a3723b51e37aaa8c81255b5e7ce102775bd01e2c",
+                "sha256:26bb2549b72708c833f5abe62b756176022a7b9a7f689b571e74c8478ead51dc",
+                "sha256:33791e8a2dc2953f28b8d8d300dde42dd929ac28f974c4b4c6272cb2955cb762",
+                "sha256:3c8d896becff2fa653dc4438b54a5a25a971d1f4110b32bd3068db3722c80202",
+                "sha256:4373612d59c404baeb7cbd788a18b2b2a8331abcc84c3ba40051fcd18b17a4d5",
+                "sha256:487d63e1454627c8e47dd230025780e91869cfba4c753a74fda196a1f6ad6548",
+                "sha256:48916e459c54c4a70e52745639f1db524542140433599e13911b2f329834276a",
+                "sha256:4922cd707b25e623b902c86188aca466d3620892db76c0bdd7b99a3d5e61d35f",
+                "sha256:55af55e32ae468e9946f741a5d51f9896da6b9bf0bbdd326843fec05c730eb20",
+                "sha256:57e555a9feb4a8460415f1aac331a2dc833b1115284f7ded7278b54afc5bd218",
+                "sha256:5d4b68e216fc65e9fe4f524c177b54964af043dde734807586cf5435af84045c",
+                "sha256:64fda793737bc4037521d4899be780534b9aea552eb673b9833b01f945904c2e",
+                "sha256:6d6169cb3c6c2ad50db5b868db6491a790300ade1ed5d1da29289d73bbe40b56",
+                "sha256:7bcac9a2b4fdbed2c16fa5681356d7121ecabf041f18d97ed5b8e0dd38a80224",
+                "sha256:80b06212075346b5546b0417b9f2bf467fea3bfe7352f781ffc05a8ab24ba14a",
+                "sha256:818014c754cd3dba7229c0f5884396264d51ffb87ec86e927ef0be140bfdb0d2",
+                "sha256:8eb687582ed7cd8c4bdbff3df6c0da443eb89c3c72e6e5dcdd9c81729712791a",
+                "sha256:99f27fefe34c37ba9875f224a8f36e31d744d8083e00f520f133cab79ad5e819",
+                "sha256:9f3e33c28cd39d1b655ed1ba7247133b6f7fc16fa16887b120c0c670e35ce346",
+                "sha256:a8661b2ce9694ca01c529bfa204dbb144b275a31685a075ce123f12331be790b",
+                "sha256:a9da7010cec5a12193d1af9872a00888f396aba3dc79186604a09ea3ee7c029e",
+                "sha256:aedb15f0a5a5949ecb129a82b72b19df97bbbca024081ed2ef88bd5c0a610534",
+                "sha256:b315d709717a99f4b27b59b021e6207c64620790ca3e0bde636a6c7f14618abb",
+                "sha256:ba6f2b3f452e150945d58f4badd92310449876c4c954836cfb1803bdd7b422f0",
+                "sha256:c33d18eb6e6bc36f09d793c0dc58b0211fccc6ae5149b808da4a62660678b156",
+                "sha256:c9a875ce9d7fe32887784274dd533c57909b7b1dcadcc128a2ac21331a9765dd",
+                "sha256:c9e005e9bd57bc987764c32a1bee4364c44fdc11a3cc20a40b93b444984f2b87",
+                "sha256:d2ad4d668a5c0645d281dcd17aff2be3212bc109b33814bbb15c4939f44181cc",
+                "sha256:d950695ae4381ecd856bcaf2b1e866720e4ab9a1498cba61c602e56630ca7195",
+                "sha256:e22dcb48709fc51a7b58a927391b23ab37eb3737a98ac4338e2448bef8559b33",
+                "sha256:e8c6a99be100371dbb046880e7a282152aa5d6127ae01783e37662ef73850d8f",
+                "sha256:e9dc245e3ac69c92ee4c167fbdd7428ec1956d4e754223124991ef29eb57a09d",
+                "sha256:eb687a11f0a7a1839719edd80f41e459cc5366857ecbed383ff376c4e3cc6afd",
+                "sha256:eb9e2a346c5238a30a746893f23a9535e700f8192a68c07c0258e7ece6ff3728",
+                "sha256:ed38b924ce794e505647f7c331b22a693bee1538fdf46b0222c4717b42f744e7",
+                "sha256:f0010c6f9d1a4011e429109fda55a225921e3206e7f62a0c22a35344bfd13cca",
+                "sha256:f0c5d1acbfca6ebdd6b1e3eded8d261affb6ddcf2186205518f1428b8569bb99",
+                "sha256:f10afb1004f102c7868ebfe91c28f4a712227fe4cb24974350ace1f90e1febbf",
+                "sha256:f174135f5609428cc6e1b9090f9268f5c8935fddb1b25ccb8255a2d50de6789e",
+                "sha256:f3ebe6e73c319340830a9b2825d32eb6d8475c1dac020b4f0aa774ee3b898d1c",
+                "sha256:f627688813d0a4140153ff532537fbe4afea5a3dffce1f9deb7f91f848a832b5",
+                "sha256:fd4305f86f53dfd8cd3522269ed7fc34856a8ee3709a5e28b2836b2db9d4cd69"
            ],
-            "version": "==1.14.5"
+            "version": "==1.14.6"
        },
        "channels": {
            "hashes": [
-                "sha256:056b72e51080a517a0f33a0a30003e03833b551d75394d6636c885d4edb8188f",
-                "sha256:3f15bdd2138bb4796e76ea588a0a344b12a7964ea9b2e456f992fddb988a4317"
+                "sha256:0ff0422b4224d10efac76e451575517f155fe7c97d369b5973b116f22eeaf86c",
+                "sha256:fdd9a94987a23d8d7ebd97498ed8b8cc83163f37e53fc6c85098aba7a3bb8b75"
            ],
            "index": "pypi",
-            "version": "==3.0.3"
+            "version": "==3.0.4"
        },
        "channels-redis": {
            "hashes": [
@ -256,6 +252,14 @@
            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
            "version": "==4.0.0"
        },
+        "charset-normalizer": {
+            "hashes": [
+                "sha256:88fce3fa5b1a84fdcb3f603d889f723d1dd89b26059d0123ca435570e848d5e1",
+                "sha256:c46c3ace2d744cfbdebceaa3c19ae691f53ae621b39fd7570f59d14fb7f2fd12"
+            ],
+            "markers": "python_version >= '3'",
+            "version": "==2.0.3"
+        },
        "click": {
            "hashes": [
                "sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a",
@ -284,6 +288,14 @@
            ],
            "version": "==0.2.0"
        },
+        "colorama": {
+            "hashes": [
+                "sha256:5941b2b48a20143d2267e95b1c2a7603ce057ee39fd88e7329b0c292aa16869b",
+                "sha256:9f47eda37229f68eee03b24b9748937c7dc3868f906e8ba69fbcbdd3bc5dc3e2"
+            ],
+            "index": "pypi",
+            "version": "==0.4.4"
+        },
        "constantly": {
            "hashes": [
                "sha256:586372eb92059873e29eba4f9dec8381541b4d3834660707faf8ba59146dfc35",
@ -473,11 +485,11 @@
        },
        "google-auth": {
            "hashes": [
-                "sha256:9266252e11393943410354cf14a77bcca24dd2ccd9c4e1aef23034fe0fbae630",
-                "sha256:c7c215c74348ef24faef2f7b62f6d8e6b38824fe08b1e7b7b09a02d397eda7b3"
+                "sha256:036dd68c1e8baa422b6b61619b8e02793da2e20f55e69514612de6c080468755",
+                "sha256:7665c04f2df13cc938dc7d9066cddb1f8af62b038bc8b2306848c1b23121865f"
            ],
            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
-            "version": "==1.32.1"
+            "version": "==1.33.1"
        },
        "gunicorn": {
            "hashes": [
@ -571,10 +583,10 @@
        },
        "idna": {
            "hashes": [
-                "sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6",
-                "sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0"
+                "sha256:14475042e284991034cb48e06f6851428fb14c4dc953acd9be9a5e95c7b6dd7a",
+                "sha256:467fbad99067910785144ce333826c71fb0e63a425657295239737f7ecd125f3"
            ],
-            "version": "==2.10"
+            "version": "==3.2"
        },
        "incremental": {
            "hashes": [
@ -624,14 +636,14 @@
        },
        "ldap3": {
            "hashes": [
-                "sha256:18c3ee656a6775b9b0d60f7c6c5b094d878d1d90fc03d56731039f0a4b546a91",
-                "sha256:4139c91f0eef9782df7b77c8cbc6243086affcb6a8a249b768a9658438e5da59",
-                "sha256:8c949edbad2be8a03e719ba48bd6779f327ec156929562814b3e84ab56889c8c",
-                "sha256:afc6fc0d01f02af82cd7bfabd3bbfd5dc96a6ae91e97db0a2dab8a0f1b436056",
-                "sha256:c1df41d89459be6f304e0ceec4b00fdea533dbbcd83c802b1272dcdb94620b57"
+                "sha256:2bc966556fc4d4fa9f445a1c31dc484ee81d44a51ab0e2d0fd05b62cac75daa6",
+                "sha256:5630d1383e09ba94839e253e013f1aa1a2cf7a547628ba1265cb7b9a844b5687",
+                "sha256:5869596fc4948797020d3f03b7939da938778a0f9e2009f7a072ccf92b8e8d70",
+                "sha256:5ab7febc00689181375de40c396dcad4f2659cd260fc5e94c508b6d77c17e9d5",
+                "sha256:f3e7fc4718e3f09dda568b57100095e0ce58633bcabbed8667ce3f8fbaa4229f"
            ],
            "index": "pypi",
-            "version": "==2.9"
+            "version": "==2.9.1"
        },
        "lxml": {
            "hashes": [
@ -975,11 +987,11 @@
        },
        "python-dateutil": {
            "hashes": [
-                "sha256:73ebfe9dbf22e832286dafa60473e4cd239f8592f699aa5adaf10050e6e1823c",
-                "sha256:75bb3f31ea686f1197762692a9ee6a7550b59fc6ca3a1f4b5d7e32fb98e2da2a"
+                "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86",
+                "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
            ],
            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
-            "version": "==2.8.1"
+            "version": "==2.8.2"
        },
        "python-dotenv": {
            "hashes": [
@ -1040,11 +1052,11 @@
        },
        "requests": {
            "hashes": [
-                "sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-                "sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+                "sha256:6c1246513ecd5ecd4528a0906f910e8f0f9c6b8ec72030dc9fd154dc1a6efd24",
+                "sha256:b8aa58f8cf793ffd8782d3d8cb19e66ef36f7aba4353eec859e74678b01b07a7"
            ],
-            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
-            "version": "==2.25.1"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
+            "version": "==2.26.0"
        },
        "requests-oauthlib": {
            "hashes": [
@ -1065,18 +1077,19 @@
        },
        "s3transfer": {
            "hashes": [
-                "sha256:9b3752887a2880690ce628bc263d6d13a3864083aeacff4890c1c9839a5eb0bc",
-                "sha256:cb022f4b16551edebbb31a377d3f09600dbada7363d8c5db7976e7f47732e1b2"
+                "sha256:50ed823e1dc5868ad40c8dc92072f757aa0e653a192845c94a3b676f4a62da4c",
+                "sha256:9c1dc369814391a6bda20ebbf4b70a0f34630592c9aa520856bf384916af2803"
            ],
-            "version": "==0.4.2"
+            "markers": "python_version >= '3.6'",
+            "version": "==0.5.0"
        },
        "sentry-sdk": {
            "hashes": [
-                "sha256:c1227d38dca315ba35182373f129c3e2722e8ed999e52584e6aca7d287870739",
-                "sha256:c7d380a21281e15be3d9f67a3c4fbb4f800c481d88ff8d8931f39486dd7b4ada"
+                "sha256:5210a712dd57d88d225c1fc3fe3a3626fee493637bcd54e204826cf04b8d769c",
+                "sha256:6864dcb6f7dec692635e5518c2a5c80010adf673c70340817f1a1b713d65bb41"
            ],
            "index": "pypi",
-            "version": "==1.1.0"
+            "version": "==1.3.0"
        },
        "service-identity": {
            "hashes": [
@ -1206,18 +1219,18 @@
        },
        "uvloop": {
            "hashes": [
-                "sha256:114543c84e95df1b4ff546e6e3a27521580466a30127f12172a3278172ad68bc",
-                "sha256:19fa1d56c91341318ac5d417e7b61c56e9a41183946cc70c411341173de02c69",
-                "sha256:2bb0624a8a70834e54dde8feed62ed63b50bad7a1265c40d6403a2ac447bce01",
-                "sha256:42eda9f525a208fbc4f7cecd00fa15c57cc57646c76632b3ba2fe005004f051d",
-                "sha256:44cac8575bf168601424302045234d74e3561fbdbac39b2b54cc1d1d00b70760",
-                "sha256:6de130d0cb78985a5d080e323b86c5ecaf3af82f4890492c05981707852f983c",
-                "sha256:7ae39b11a5f4cec1432d706c21ecc62f9e04d116883178b09671aa29c46f7a47",
-                "sha256:90e56f17755e41b425ad19a08c41dc358fa7bf1226c0f8e54d4d02d556f7af7c",
-                "sha256:b45218c99795803fb8bdbc9435ff7f54e3a591b44cd4c121b02fa83affb61c7c",
-                "sha256:e5e5f855c9bf483ee6cd1eb9a179b740de80cb0ae2988e3fa22309b78e2ea0e7"
+                "sha256:0de811931e90ae2da9e19ce70ffad73047ab0c1dba7c6e74f9ae1a3aabeb89bd",
+                "sha256:1ff05116ede1ebdd81802df339e5b1d4cab1dfbd99295bf27e90b4cec64d70e9",
+                "sha256:2d8ffe44ae709f839c54bacf14ed283f41bee90430c3b398e521e10f8d117b3a",
+                "sha256:5cda65fc60a645470b8525ce014516b120b7057b576fa876cdfdd5e60ab1efbb",
+                "sha256:63a3288abbc9c8ee979d7e34c34e780b2fbab3e7e53d00b6c80271119f277399",
+                "sha256:7522df4e45e4f25b50adbbbeb5bb9847495c438a628177099d2721f2751ff825",
+                "sha256:7f4b8a905df909a407c5791fb582f6c03b0d3b491ecdc1cdceaefbc9bf9e08f6",
+                "sha256:905f0adb0c09c9f44222ee02f6b96fd88b493478fffb7a345287f9444e926030",
+                "sha256:ae2b325c0f6d748027f7463077e457006b4fdb35a8788f01754aadba825285ee",
+                "sha256:e71fb9038bfcd7646ca126c5ef19b17e48d4af9e838b2bcfda7a9f55a6552a32"
            ],
-            "version": "==0.15.2"
+            "version": "==0.15.3"
        },
        "vine": {
            "hashes": [
@ -1423,11 +1436,11 @@
        },
        "astroid": {
            "hashes": [
-                "sha256:38b95085e9d92e2ca06cf8b35c12a74fa81da395a6f9e65803742e6509c05892",
-                "sha256:606b2911d10c3dcf35e58d2ee5c97360e8477d7b9f3efc3f24811c93e6fc2cd9"
+                "sha256:6021561b2e87ed6b3c93c2682ac50079c65ab08f1e4e0277ba38f97e0e492185",
+                "sha256:a670dd7af3fe603f51aa7117462588b7c3bdcd58007edfaee752bf82eceecd28"
            ],
            "markers": "python_version ~= '3.6'",
-            "version": "==2.6.2"
+            "version": "==2.6.4"
        },
        "attrs": {
            "hashes": [
@ -1468,13 +1481,13 @@
            ],
            "version": "==2021.5.30"
        },
-        "chardet": {
+        "charset-normalizer": {
            "hashes": [
-                "sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa",
-                "sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5"
+                "sha256:88fce3fa5b1a84fdcb3f603d889f723d1dd89b26059d0123ca435570e848d5e1",
+                "sha256:c46c3ace2d744cfbdebceaa3c19ae691f53ae621b39fd7570f59d14fb7f2fd12"
            ],
-            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
-            "version": "==4.0.0"
+            "markers": "python_version >= '3'",
+            "version": "==2.0.3"
        },
        "click": {
            "hashes": [
@ -1568,10 +1581,10 @@
        },
        "idna": {
            "hashes": [
-                "sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6",
-                "sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0"
+                "sha256:14475042e284991034cb48e06f6851428fb14c4dc953acd9be9a5e95c7b6dd7a",
+                "sha256:467fbad99067910785144ce333826c71fb0e63a425657295239737f7ecd125f3"
            ],
-            "version": "==2.10"
+            "version": "==3.2"
        },
        "iniconfig": {
            "hashes": [
@ -1582,11 +1595,11 @@
        },
        "isort": {
            "hashes": [
-                "sha256:83510593e07e433b77bd5bff0f6f607dbafa06d1a89022616f02d8b699cfcd56",
-                "sha256:8e2c107091cfec7286bc0f68a547d0ba4c094d460b732075b6fba674f1035c0c"
+                "sha256:eed17b53c3e7912425579853d078a0832820f023191561fcee9d7cae424e0813",
+                "sha256:f65ce5bd4cbc6abdfbe29afc2f0245538ab358c14590912df638033f157d555e"
            ],
            "markers": "python_version < '4.0' and python_full_version >= '3.6.1'",
-            "version": "==5.9.1"
+            "version": "==5.9.2"
        },
        "lazy-object-proxy": {
            "hashes": [
@ -1640,10 +1653,10 @@
        },
        "pathspec": {
            "hashes": [
-                "sha256:86379d6b86d75816baba717e64b1a3a3469deb93bb76d613c9ce79edc5cb68fd",
-                "sha256:aa0cb481c4041bf52ffa7b0d8fa6cd3e88a2ca4879c533c9153882ee2556790d"
+                "sha256:7d15c4ddb0b5c802d161efc417ec1a2558ea2653c2e8ad9c19098201dc1c993a",
+                "sha256:e564499435a2673d586f6b2130bb5b95f04a3ba06f81b8f895b651a3c76aabb1"
            ],
-            "version": "==0.8.1"
+            "version": "==0.9.0"
        },
        "pbr": {
            "hashes": [
@ -1671,11 +1684,11 @@
        },
        "pylint": {
            "hashes": [
-                "sha256:23a1dc8b30459d78e9ff25942c61bb936108ccbe29dd9e71c01dc8274961709a",
-                "sha256:5d46330e6b8886c31b5e3aba5ff48c10f4aa5e76cbf9002c6544306221e63fbc"
+                "sha256:2a971129fb2d594068913a7e531d4b6d2785b2a68c6857e2baa40d3214da30f4",
+                "sha256:a622c4c4c79dc8fe5e784efccacec3afe9d5e5ffab5fda2264fb5afa7c9b5797"
            ],
            "index": "pypi",
-            "version": "==2.9.3"
+            "version": "==2.9.4"
        },
        "pylint-django": {
            "hashes": [
@ -1753,53 +1766,57 @@
        },
        "regex": {
            "hashes": [
-                "sha256:0e46c1191b2eb293a6912269ed08b4512e7e241bbf591f97e527492e04c77e93",
-                "sha256:18040755606b0c21281493ec309214bd61e41a170509e5014f41d6a5a586e161",
-                "sha256:1806370b2bef4d4193eebe8ee59a9fd7547836a34917b7badbe6561a8594d9cb",
-                "sha256:1ccbd41dbee3a31e18938096510b7d4ee53aa9fce2ee3dcc8ec82ae264f6acfd",
-                "sha256:1d386402ae7f3c9b107ae5863f7ecccb0167762c82a687ae6526b040feaa5ac6",
-                "sha256:210c359e6ee5b83f7d8c529ba3c75ba405481d50f35a420609b0db827e2e3bb5",
-                "sha256:268fe9dd1deb4a30c8593cabd63f7a241dfdc5bd9dd0233906c718db22cdd49a",
-                "sha256:361be4d311ac995a8c7ad577025a3ae3a538531b1f2cf32efd8b7e5d33a13e5a",
-                "sha256:3f7a92e60930f8fca2623d9e326c173b7cf2c8b7e4fdcf984b75a1d2fb08114d",
-                "sha256:444723ebaeb7fa8125f29c01a31101a3854ac3de293e317944022ae5effa53a4",
-                "sha256:494d0172774dc0beeea984b94c95389143db029575f7ca908edd74469321ea99",
-                "sha256:4b1999ef60c45357598935c12508abf56edbbb9c380df6f336de38a6c3a294ae",
-                "sha256:4fc86b729ab88fe8ac3ec92287df253c64aa71560d76da5acd8a2e245839c629",
-                "sha256:5049d00dbb78f9d166d1c704e93934d42cce0570842bb1a61695123d6b01de09",
-                "sha256:56bef6b414949e2c9acf96cb5d78de8b529c7b99752619494e78dc76f99fd005",
-                "sha256:59845101de68fd5d3a1145df9ea022e85ecd1b49300ea68307ad4302320f6f61",
-                "sha256:6b8b629f93246e507287ee07e26744beaffb4c56ed520576deac8b615bd76012",
-                "sha256:6c72ebb72e64e9bd195cb35a9b9bbfb955fd953b295255b8ae3e4ad4a146b615",
-                "sha256:7743798dfb573d006f1143d745bf17efad39775a5190b347da5d83079646be56",
-                "sha256:78a2a885345a2d60b5e68099e877757d5ed12e46ba1e87507175f14f80892af3",
-                "sha256:849802379a660206277675aa5a5c327f5c910c690649535863ddf329b0ba8c87",
-                "sha256:8cf6728f89b071bd3ab37cb8a0e306f4de897553a0ed07442015ee65fbf53d62",
-                "sha256:a1b6a3f600d6aff97e3f28c34192c9ed93fee293bd96ef327b64adb51a74b2f6",
-                "sha256:a548bb51c4476332ce4139df8e637386730f79a92652a907d12c696b6252b64d",
-                "sha256:a8a5826d8a1b64e2ff9af488cc179e1a4d0f144d11ce486a9f34ea38ccedf4ef",
-                "sha256:b024ee43ee6b310fad5acaee23e6485b21468718cb792a9d1693eecacc3f0b7e",
-                "sha256:b092754c06852e8a8b022004aff56c24b06310189186805800d09313c37ce1f8",
-                "sha256:b1dbeef938281f240347d50f28ae53c4b046a23389cd1fc4acec5ea0eae646a1",
-                "sha256:bf819c5b77ff44accc9a24e31f1f7ceaaf6c960816913ed3ef8443b9d20d81b6",
-                "sha256:c11f2fca544b5e30a0e813023196a63b1cb9869106ef9a26e9dae28bce3e4e26",
-                "sha256:ce269e903b00d1ab4746793e9c50a57eec5d5388681abef074d7b9a65748fca5",
-                "sha256:d0cf2651a8804f6325747c7e55e3be0f90ee2848e25d6b817aa2728d263f9abb",
-                "sha256:e07e92935040c67f49571779d115ecb3e727016d42fb36ee0d8757db4ca12ee0",
-                "sha256:e80d2851109e56420b71f9702ad1646e2f0364528adbf6af85527bc61e49f394",
-                "sha256:ed77b97896312bc2deafe137ca2626e8b63808f5bedb944f73665c68093688a7",
-                "sha256:f32f47fb22c988c0b35756024b61d156e5c4011cb8004aa53d93b03323c45657",
-                "sha256:fdad3122b69cdabdb3da4c2a4107875913ac78dab0117fc73f988ad589c66b66"
+                "sha256:0eb2c6e0fcec5e0f1d3bcc1133556563222a2ffd2211945d7b1480c1b1a42a6f",
+                "sha256:15dddb19823f5147e7517bb12635b3c82e6f2a3a6b696cc3e321522e8b9308ad",
+                "sha256:173bc44ff95bc1e96398c38f3629d86fa72e539c79900283afa895694229fe6a",
+                "sha256:1c78780bf46d620ff4fff40728f98b8afd8b8e35c3efd638c7df67be2d5cddbf",
+                "sha256:2366fe0479ca0e9afa534174faa2beae87847d208d457d200183f28c74eaea59",
+                "sha256:2bceeb491b38225b1fee4517107b8491ba54fba77cf22a12e996d96a3c55613d",
+                "sha256:2ddeabc7652024803666ea09f32dd1ed40a0579b6fbb2a213eba590683025895",
+                "sha256:2fe5e71e11a54e3355fa272137d521a40aace5d937d08b494bed4529964c19c4",
+                "sha256:319eb2a8d0888fa6f1d9177705f341bc9455a2c8aca130016e52c7fe8d6c37a3",
+                "sha256:3f5716923d3d0bfb27048242a6e0f14eecdb2e2a7fac47eda1d055288595f222",
+                "sha256:422dec1e7cbb2efbbe50e3f1de36b82906def93ed48da12d1714cabcd993d7f0",
+                "sha256:4c9c3155fe74269f61e27617529b7f09552fbb12e44b1189cebbdb24294e6e1c",
+                "sha256:4f64fc59fd5b10557f6cd0937e1597af022ad9b27d454e182485f1db3008f417",
+                "sha256:564a4c8a29435d1f2256ba247a0315325ea63335508ad8ed938a4f14c4116a5d",
+                "sha256:59506c6e8bd9306cd8a41511e32d16d5d1194110b8cfe5a11d102d8b63cf945d",
+                "sha256:598c0a79b4b851b922f504f9f39a863d83ebdfff787261a5ed061c21e67dd761",
+                "sha256:59c00bb8dd8775473cbfb967925ad2c3ecc8886b3b2d0c90a8e2707e06c743f0",
+                "sha256:6110bab7eab6566492618540c70edd4d2a18f40ca1d51d704f1d81c52d245026",
+                "sha256:6afe6a627888c9a6cfbb603d1d017ce204cebd589d66e0703309b8048c3b0854",
+                "sha256:791aa1b300e5b6e5d597c37c346fb4d66422178566bbb426dd87eaae475053fb",
+                "sha256:8394e266005f2d8c6f0bc6780001f7afa3ef81a7a2111fa35058ded6fce79e4d",
+                "sha256:875c355360d0f8d3d827e462b29ea7682bf52327d500a4f837e934e9e4656068",
+                "sha256:89e5528803566af4df368df2d6f503c84fbfb8249e6631c7b025fe23e6bd0cde",
+                "sha256:99d8ab206a5270c1002bfcf25c51bf329ca951e5a169f3b43214fdda1f0b5f0d",
+                "sha256:9a854b916806c7e3b40e6616ac9e85d3cdb7649d9e6590653deb5b341a736cec",
+                "sha256:b85ac458354165405c8a84725de7bbd07b00d9f72c31a60ffbf96bb38d3e25fa",
+                "sha256:bc84fb254a875a9f66616ed4538542fb7965db6356f3df571d783f7c8d256edd",
+                "sha256:c92831dac113a6e0ab28bc98f33781383fe294df1a2c3dfd1e850114da35fd5b",
+                "sha256:cbe23b323988a04c3e5b0c387fe3f8f363bf06c0680daf775875d979e376bd26",
+                "sha256:ccb3d2190476d00414aab36cca453e4596e8f70a206e2aa8db3d495a109153d2",
+                "sha256:d8bbce0c96462dbceaa7ac4a7dfbbee92745b801b24bce10a98d2f2b1ea9432f",
+                "sha256:db2b7df831c3187a37f3bb80ec095f249fa276dbe09abd3d35297fc250385694",
+                "sha256:e586f448df2bbc37dfadccdb7ccd125c62b4348cb90c10840d695592aa1b29e0",
+                "sha256:e5983c19d0beb6af88cb4d47afb92d96751fb3fa1784d8785b1cdf14c6519407",
+                "sha256:e6a1e5ca97d411a461041d057348e578dc344ecd2add3555aedba3b408c9f874",
+                "sha256:eaf58b9e30e0e546cdc3ac06cf9165a1ca5b3de8221e9df679416ca667972035",
+                "sha256:ed693137a9187052fc46eedfafdcb74e09917166362af4cc4fddc3b31560e93d",
+                "sha256:edd1a68f79b89b0c57339bce297ad5d5ffcc6ae7e1afdb10f1947706ed066c9c",
+                "sha256:f080248b3e029d052bf74a897b9d74cfb7643537fbde97fe8225a6467fb559b5",
+                "sha256:f9392a4555f3e4cb45310a65b403d86b589adc773898c25a39184b1ba4db8985",
+                "sha256:f98dc35ab9a749276f1a4a38ab3e0e2ba1662ce710f6530f5b0a6656f1c32b58"
            ],
-            "version": "==2021.7.1"
+            "version": "==2021.7.6"
        },
        "requests": {
            "hashes": [
-                "sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-                "sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+                "sha256:6c1246513ecd5ecd4528a0906f910e8f0f9c6b8ec72030dc9fd154dc1a6efd24",
+                "sha256:b8aa58f8cf793ffd8782d3d8cb19e66ef36f7aba4353eec859e74678b01b07a7"
            ],
-            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
-            "version": "==2.25.1"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
+            "version": "==2.26.0"
        },
        "requests-mock": {
            "hashes": [
--- a/authentik/init.py
+++ b/authentik/init.py
@ -1,3 +1,3 @@
 """authentik"""
-__version__ = "2021.6.4"
+__version__ = "2021.7.1-rc1"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
--- a/authentik/api/v2/config.py
+++ b/authentik/api/v2/config.py
@ -49,7 +49,7 @@ class ConfigView(APIView):
            caps.append(Capabilities.CAN_GEO_IP)
        if SERVICE_HOST_ENV_NAME in environ:
            # Running in k8s, only s3 backup is supported
-            if CONFIG.y("postgresql.s3_backup"):
+            if CONFIG.y_bool("postgresql.s3_backup"):
                caps.append(Capabilities.CAN_BACKUP)
        else:
            # Running in compose, backup is always supported
--- a/authentik/api/v2/sentry.py
+++ b/authentik/api/v2/sentry.py
@ -0,0 +1,38 @@
+"""Sentry tunnel"""
+from json import loads
+
+from django.conf import settings
+from django.http.request import HttpRequest
+from django.http.response import HttpResponse
+from django.views.generic.base import View
+from requests import post
+from requests.exceptions import RequestException
+
+from authentik.lib.config import CONFIG
+
+
+class SentryTunnelView(View):
+    """Sentry tunnel, to prevent ad blockers from blocking sentry"""
+
+    def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        """Sentry tunnel, to prevent ad blockers from blocking sentry"""
+        # Only allow usage of this endpoint when error reporting is enabled
+        if not CONFIG.y_bool("error_reporting.enabled", False):
+            return HttpResponse(status=400)
+        # Body is 2 json objects separated by \n
+        full_body = request.body
+        header = loads(full_body.splitlines()[0])
+        # Check that the DSN is what we expect
+        dsn = header.get("dsn", "")
+        if dsn != settings.SENTRY_DSN:
+            return HttpResponse(status=400)
+        response = post(
+            "https://sentry.beryju.org/api/8/envelope/",
+            data=full_body,
+            headers={"Content-Type": "application/octet-stream"},
+        )
+        try:
+            response.raise_for_status()
+        except RequestException:
+            return HttpResponse(status=500)
+        return HttpResponse(status=response.status_code)
--- a/authentik/api/v2/urls.py
+++ b/authentik/api/v2/urls.py
@ -1,5 +1,6 @@
 """api v2 urls"""
 from django.urls import path
+from django.views.decorators.csrf import csrf_exempt
 from drf_spectacular.views import SpectacularAPIView
 from rest_framework import routers

@ -10,6 +11,7 @@ from authentik.admin.api.tasks import TaskViewSet
 from authentik.admin.api.version import VersionView
 from authentik.admin.api.workers import WorkerView
 from authentik.api.v2.config import ConfigView
+from authentik.api.v2.sentry import SentryTunnelView
 from authentik.api.views import APIBrowserView
 from authentik.core.api.applications import ApplicationViewSet
 from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
@ -235,6 +237,7 @@ urlpatterns = (
            FlowExecutorView.as_view(),
            name="flow-executor",
        ),
+        path("sentry/", csrf_exempt(SentryTunnelView.as_view()), name="sentry"),
        path("schema/", SpectacularAPIView.as_view(), name="schema"),
    ]
 )
--- a/authentik/core/api/groups.py
+++ b/authentik/core/api/groups.py
@ -1,24 +1,60 @@
 """Groups API Viewset"""
 from django.db.models.query import QuerySet
-from rest_framework.fields import JSONField
-from rest_framework.serializers import ModelSerializer
+from rest_framework.fields import BooleanField, CharField, JSONField
+from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter

 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import is_dict
-from authentik.core.models import Group
+from authentik.core.models import Group, User
+
+
+class GroupMemberSerializer(ModelSerializer):
+    """Stripped down user serializer to show relevant users for groups"""
+
+    is_superuser = BooleanField(read_only=True)
+    avatar = CharField(read_only=True)
+    attributes = JSONField(validators=[is_dict], required=False)
+    uid = CharField(read_only=True)
+
+    class Meta:
+
+        model = User
+        fields = [
+            "pk",
+            "username",
+            "name",
+            "is_active",
+            "last_login",
+            "is_superuser",
+            "email",
+            "avatar",
+            "attributes",
+            "uid",
+        ]


 class GroupSerializer(ModelSerializer):
    """Group Serializer"""

    attributes = JSONField(validators=[is_dict], required=False)
+    users_obj = ListSerializer(
+        child=GroupMemberSerializer(), read_only=True, source="users", required=False
+    )

    class Meta:

        model = Group
-        fields = ["pk", "name", "is_superuser", "parent", "users", "attributes"]
+        fields = [
+            "pk",
+            "name",
+            "is_superuser",
+            "parent",
+            "users",
+            "attributes",
+            "users_obj",
+        ]


 class GroupViewSet(UsedByMixin, ModelViewSet):
--- a/authentik/core/api/tokens.py
+++ b/authentik/core/api/tokens.py
@ -12,7 +12,7 @@ from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import Token, TokenIntents
+from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
 from authentik.events.models import Event, EventAction
 from authentik.managed.api import ManagedSerializer

@ -61,11 +61,19 @@ class TokenViewSet(UsedByMixin, ModelViewSet):
        "intent",
        "user__username",
        "description",
+        "expires",
+        "expiring",
    ]
    ordering = ["expires"]

    def perform_create(self, serializer: TokenSerializer):
-        serializer.save(user=self.request.user, intent=TokenIntents.INTENT_API)
+        serializer.save(
+            user=self.request.user,
+            intent=TokenIntents.INTENT_API,
+            expiring=self.request.user.attributes.get(
+                USER_ATTRIBUTE_TOKEN_EXPIRING, True
+            ),
+        )

    @permission_required("authentik_core.view_token_key")
    @extend_schema(
--- a/authentik/core/migrations/0026_alter_application_meta_icon.py
+++ b/authentik/core/migrations/0026_alter_application_meta_icon.py
@ -0,0 +1,20 @@
+# Generated by Django 3.2.5 on 2021-07-09 17:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0025_alter_application_meta_icon"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="application",
+            name="meta_icon",
+            field=models.FileField(
+                default=None, max_length=500, null=True, upload_to="application-icons/"
+            ),
+        ),
+    ]
--- a/authentik/core/models.py
+++ b/authentik/core/models.py
@ -37,6 +37,8 @@ LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
 USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
 USER_ATTRIBUTE_SOURCES = "goauthentik.io/user/sources"
+USER_ATTRIBUTE_TOKEN_EXPIRING = "goauthentik.io/user/token-expires"  # nosec
+USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"

 GRAVATAR_URL = "https://secure.gravatar.com"
 DEFAULT_AVATAR = static("dist/assets/images/user_default.png")
@ -228,7 +230,10 @@ class Application(PolicyBindingModel):
    )
    # For template applications, this can be set to /static/authentik/applications/*
    meta_icon = models.FileField(
-        upload_to="application-icons/", default=None, null=True
+        upload_to="application-icons/",
+        default=None,
+        null=True,
+        max_length=500,
    )
    meta_description = models.TextField(default="", blank=True)
    meta_publisher = models.TextField(default="", blank=True)
@ -377,6 +382,13 @@ class ExpiringModel(models.Model):
    expires = models.DateTimeField(default=default_token_duration)
    expiring = models.BooleanField(default=True)

+    def expire_action(self, *args, **kwargs):
+        """Handler which is called when this object is expired. By
+        default the object is deleted. This is less efficient compared
+        to bulk deleting objects, but classes like Token() need to change
+        values instead of being deleted."""
+        return self.delete(*args, **kwargs)
+
    @classmethod
    def filter_not_expired(cls, **kwargs) -> QuerySet:
        """Filer for tokens which are not expired yet or are not expiring,
@ -421,6 +433,18 @@ class Token(ManagedModel, ExpiringModel):
    user = models.ForeignKey("User", on_delete=models.CASCADE, related_name="+")
    description = models.TextField(default="", blank=True)

+    def expire_action(self, *args, **kwargs):
+        """Handler which is called when this object is expired."""
+        from authentik.events.models import Event, EventAction
+
+        self.key = default_token_key()
+        self.save(*args, **kwargs)
+        Event.new(
+            action=EventAction.SECRET_ROTATE,
+            token=self,
+            message=f"Token {self.identifier}'s secret was rotated.",
+        ).save()
+
    def __str__(self):
        description = f"{self.identifier}"
        if self.expiring:
--- a/authentik/core/tasks.py
+++ b/authentik/core/tasks.py
@ -26,14 +26,16 @@ def clean_expired_models(self: MonitoredTask):
    messages = []
    for cls in ExpiringModel.__subclasses__():
        cls: ExpiringModel
-        amount, _ = (
+        objects = (
            cls.objects.all()
            .exclude(expiring=False)
            .exclude(expiring=True, expires__gt=now())
-            .delete()
        )
-        LOGGER.debug("Deleted expired models", model=cls, amount=amount)
-        messages.append(f"Deleted {amount} expired {cls._meta.verbose_name_plural}")
+        for obj in objects:
+            obj.expire_action()
+        amount = objects.count()
+        LOGGER.debug("Expired models", model=cls, amount=amount)
+        messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
    self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL, messages))


--- a/authentik/core/tests/test_tasks.py
+++ b/authentik/core/tests/test_tasks.py
@ -1,18 +0,0 @@
-"""authentik core task tests"""
-from django.test import TestCase
-from django.utils.timezone import now
-from guardian.shortcuts import get_anonymous_user
-
-from authentik.core.models import Token
-from authentik.core.tasks import clean_expired_models
-
-
-class TestTasks(TestCase):
-    """Test Tasks"""
-
-    def test_token_cleanup(self):
-        """Test Token cleanup task"""
-        Token.objects.create(expires=now(), user=get_anonymous_user())
-        self.assertEqual(Token.objects.all().count(), 1)
-        clean_expired_models.delay().get()
-        self.assertEqual(Token.objects.all().count(), 0)
--- a/authentik/core/tests/test_token_api.py
+++ b/authentik/core/tests/test_token_api.py
@ -1,8 +1,16 @@
 """Test token API"""
 from django.urls.base import reverse
+from django.utils.timezone import now
+from guardian.shortcuts import get_anonymous_user
 from rest_framework.test import APITestCase

-from authentik.core.models import Token, TokenIntents, User
+from authentik.core.models import (
+    USER_ATTRIBUTE_TOKEN_EXPIRING,
+    Token,
+    TokenIntents,
+    User,
+)
+from authentik.core.tasks import clean_expired_models


 class TestTokenAPI(APITestCase):
@ -22,3 +30,25 @@ class TestTokenAPI(APITestCase):
        token = Token.objects.get(identifier="test-token")
        self.assertEqual(token.user, self.user)
        self.assertEqual(token.intent, TokenIntents.INTENT_API)
+        self.assertEqual(token.expiring, True)
+
+    def test_token_create_non_expiring(self):
+        """Test token creation endpoint"""
+        self.user.attributes[USER_ATTRIBUTE_TOKEN_EXPIRING] = False
+        self.user.save()
+        response = self.client.post(
+            reverse("authentik_api:token-list"), {"identifier": "test-token"}
+        )
+        self.assertEqual(response.status_code, 201)
+        token = Token.objects.get(identifier="test-token")
+        self.assertEqual(token.user, self.user)
+        self.assertEqual(token.intent, TokenIntents.INTENT_API)
+        self.assertEqual(token.expiring, False)
+
+    def test_token_expire(self):
+        """Test Token expire task"""
+        token: Token = Token.objects.create(expires=now(), user=get_anonymous_user())
+        key = token.key
+        clean_expired_models.delay().get()
+        token.refresh_from_db()
+        self.assertNotEqual(key, token.key)
--- a/authentik/events/migrations/0017_alter_event_action.py
+++ b/authentik/events/migrations/0017_alter_event_action.py
@ -0,0 +1,47 @@
+# Generated by Django 3.2.5 on 2021-07-14 19:15
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_events", "0016_add_tenant"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="event",
+            name="action",
+            field=models.TextField(
+                choices=[
+                    ("login", "Login"),
+                    ("login_failed", "Login Failed"),
+                    ("logout", "Logout"),
+                    ("user_write", "User Write"),
+                    ("suspicious_request", "Suspicious Request"),
+                    ("password_set", "Password Set"),
+                    ("secret_view", "Secret View"),
+                    ("secret_rotate", "Secret Rotate"),
+                    ("invitation_used", "Invite Used"),
+                    ("authorize_application", "Authorize Application"),
+                    ("source_linked", "Source Linked"),
+                    ("impersonation_started", "Impersonation Started"),
+                    ("impersonation_ended", "Impersonation Ended"),
+                    ("policy_execution", "Policy Execution"),
+                    ("policy_exception", "Policy Exception"),
+                    ("property_mapping_exception", "Property Mapping Exception"),
+                    ("system_task_execution", "System Task Execution"),
+                    ("system_task_exception", "System Task Exception"),
+                    ("system_exception", "System Exception"),
+                    ("configuration_error", "Configuration Error"),
+                    ("model_created", "Model Created"),
+                    ("model_updated", "Model Updated"),
+                    ("model_deleted", "Model Deleted"),
+                    ("email_sent", "Email Sent"),
+                    ("update_available", "Update Available"),
+                    ("custom_", "Custom Prefix"),
+                ]
+            ),
+        ),
+    ]
--- a/authentik/events/models.py
+++ b/authentik/events/models.py
@ -62,6 +62,7 @@ class EventAction(models.TextChoices):
    PASSWORD_SET = "password_set"  # noqa # nosec

    SECRET_VIEW = "secret_view"  # noqa # nosec
+    SECRET_ROTATE = "secret_rotate"  # noqa # nosec

    INVITE_USED = "invitation_used"

@ -313,7 +314,8 @@ class NotificationTransport(models.Model):
            response = post(self.webhook_url, json=body)
            response.raise_for_status()
        except RequestException as exc:
-            raise NotificationTransportError(exc.response.text) from exc
+            text = exc.response.text if exc.response else str(exc)
+            raise NotificationTransportError(text) from exc
        return [
            response.status_code,
            response.text,
--- a/authentik/flows/migrations/0023_alter_flow_background.py
+++ b/authentik/flows/migrations/0023_alter_flow_background.py
@ -0,0 +1,24 @@
+# Generated by Django 3.2.5 on 2021-07-09 17:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_flows", "0022_alter_flowstagebinding_invalid_response_action"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="flow",
+            name="background",
+            field=models.FileField(
+                default=None,
+                help_text="Background shown during execution",
+                max_length=500,
+                null=True,
+                upload_to="flow-backgrounds/",
+            ),
+        ),
+    ]
--- a/authentik/flows/models.py
+++ b/authentik/flows/models.py
@ -121,6 +121,7 @@ class Flow(SerializerModel, PolicyBindingModel):
        default=None,
        null=True,
        help_text=_("Background shown during execution"),
+        max_length=500,
    )

    compatibility_mode = models.BooleanField(
--- a/authentik/flows/stage.py
+++ b/authentik/flows/stage.py
@ -17,7 +17,7 @@ from authentik.flows.challenge import (
    WithUserInfoChallenge,
 )
 from authentik.flows.models import InvalidResponseAction
-from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
+from authentik.flows.planner import PLAN_CONTEXT_APPLICATION, PLAN_CONTEXT_PENDING_USER
 from authentik.flows.views import FlowExecutorView

 PLAN_CONTEXT_PENDING_USER_IDENTIFIER = "pending_user_identifier"
@ -102,12 +102,18 @@ class ChallengeStageView(StageView):
            return self.challenge_invalid(challenge)
        return self.challenge_valid(challenge)

+    def format_title(self) -> str:
+        """Allow usage of placeholder in flow title."""
+        return self.executor.flow.title % {
+            "app": self.executor.plan.context.get(PLAN_CONTEXT_APPLICATION, "")
+        }
+
    def _get_challenge(self, *args, **kwargs) -> Challenge:
        challenge = self.get_challenge(*args, **kwargs)
        if "flow_info" not in challenge.initial_data:
            flow_info = ContextualFlowInfo(
                data={
-                    "title": self.executor.flow.title,
+                    "title": self.format_title(),
                    "background": self.executor.flow.background_url,
                    "cancel_url": reverse("authentik_flows:cancel"),
                }
--- a/authentik/lib/default.yml
+++ b/authentik/lib/default.yml
@ -13,7 +13,10 @@ web:

 redis:
  host: localhost
+  port: 6379
  password: ''
+  tls: false
+  tls_reqs: "none"
  cache_db: 0
  message_queue_db: 1
  ws_db: 2
--- a/authentik/lib/utils/http.py
+++ b/authentik/lib/utils/http.py
@ -2,10 +2,12 @@
 from typing import Any, Optional

 from django.http import HttpRequest
+from structlog.stdlib import get_logger

 OUTPOST_REMOTE_IP_HEADER = "HTTP_X_AUTHENTIK_REMOTE_IP"
-USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
+OUTPOST_TOKEN_HEADER = "HTTP_X_AUTHENTIK_OUTPOST_TOKEN"  # nosec
 DEFAULT_IP = "255.255.255.255"
+LOGGER = get_logger()


 def _get_client_ip_from_meta(meta: dict[str, Any]) -> str:
@ -27,13 +29,25 @@ def _get_outpost_override_ip(request: HttpRequest) -> Optional[str]:
    """Get the actual remote IP when set by an outpost. Only
    allowed when the request is authenticated, by a user with USER_ATTRIBUTE_CAN_OVERRIDE_IP set
    to outpost"""
-    if not hasattr(request, "user"):
+    from authentik.core.models import (
+        USER_ATTRIBUTE_CAN_OVERRIDE_IP,
+        Token,
+        TokenIntents,
+    )
+
+    if (
+        OUTPOST_REMOTE_IP_HEADER not in request.META
+        or OUTPOST_TOKEN_HEADER not in request.META
+    ):
        return None
-    if not request.user.is_authenticated:
+    tokens = Token.filter_not_expired(
+        key=request.META.get(OUTPOST_TOKEN_HEADER), intent=TokenIntents.INTENT_API
+    )
+    if not tokens.exists():
+        LOGGER.warning("Attempted remote-ip override without token")
        return None
-    if OUTPOST_REMOTE_IP_HEADER not in request.META:
-        return None
-    if request.user.group_attributes().get(USER_ATTRIBUTE_CAN_OVERRIDE_IP, False):
+    user = tokens.first().user
+    if user.group_attributes().get(USER_ATTRIBUTE_CAN_OVERRIDE_IP, False):
        return None
    return request.META[OUTPOST_REMOTE_IP_HEADER]

--- a/authentik/outposts/api/outposts.py
+++ b/authentik/outposts/api/outposts.py
@ -77,6 +77,7 @@ class OutpostSerializer(ModelSerializer):
            "service_connection_obj",
            "token_identifier",
            "config",
+            "managed",
        ]
        extra_kwargs = {"type": {"required": True}}

--- a/authentik/outposts/managed.py
+++ b/authentik/outposts/managed.py
@ -0,0 +1,18 @@
+"""Outpost managed objects"""
+from authentik.managed.manager import EnsureExists, ObjectManager
+from authentik.outposts.models import Outpost, OutpostType
+
+
+class OutpostManager(ObjectManager):
+    """Outpost managed objects"""
+
+    def reconcile(self):
+        return [
+            EnsureExists(
+                Outpost,
+                "goauthentik.io/outposts/inbuilt",
+                name="authentik Bundeled Outpost",
+                object_field="name",
+                type=OutpostType.PROXY,
+            ),
+        ]
--- a/authentik/outposts/migrations/0017_outpost_managed.py
+++ b/authentik/outposts/migrations/0017_outpost_managed.py
@ -0,0 +1,24 @@
+# Generated by Django 3.2.4 on 2021-06-23 19:25
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_outposts", "0016_alter_outpost_type"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="outpost",
+            name="managed",
+            field=models.TextField(
+                default=None,
+                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                null=True,
+                unique=True,
+                verbose_name="Managed by authentik",
+            ),
+        ),
+    ]
--- a/authentik/outposts/models.py
+++ b/authentik/outposts/models.py
@ -28,12 +28,19 @@ from structlog.stdlib import get_logger
 from urllib3.exceptions import HTTPError

 from authentik import ENV_GIT_HASH_KEY, __version__
-from authentik.core.models import USER_ATTRIBUTE_SA, Provider, Token, TokenIntents, User
+from authentik.core.models import (
+    USER_ATTRIBUTE_CAN_OVERRIDE_IP,
+    USER_ATTRIBUTE_SA,
+    Provider,
+    Token,
+    TokenIntents,
+    User,
+)
 from authentik.crypto.models import CertificateKeyPair
 from authentik.lib.config import CONFIG
 from authentik.lib.models import InheritanceForeignKey
 from authentik.lib.sentry import SentryIgnoredException
-from authentik.lib.utils.http import USER_ATTRIBUTE_CAN_OVERRIDE_IP
+from authentik.managed.models import ManagedModel
 from authentik.outposts.controllers.k8s.utils import get_namespace
 from authentik.outposts.docker_tls import DockerInlineTLS

@ -281,7 +288,7 @@ class KubernetesServiceConnection(OutpostServiceConnection):
        verbose_name_plural = _("Kubernetes Service-Connections")


-class Outpost(models.Model):
+class Outpost(ManagedModel):
    """Outpost instance which manages a service user and token"""

    uuid = models.UUIDField(default=uuid4, editable=False, primary_key=True)
--- a/authentik/policies/event_matcher/migrations/0018_alter_eventmatcherpolicy_action.py
+++ b/authentik/policies/event_matcher/migrations/0018_alter_eventmatcherpolicy_action.py
@ -0,0 +1,49 @@
+# Generated by Django 3.2.5 on 2021-07-14 19:15
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_policies_event_matcher", "0017_alter_eventmatcherpolicy_action"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="eventmatcherpolicy",
+            name="action",
+            field=models.TextField(
+                blank=True,
+                choices=[
+                    ("login", "Login"),
+                    ("login_failed", "Login Failed"),
+                    ("logout", "Logout"),
+                    ("user_write", "User Write"),
+                    ("suspicious_request", "Suspicious Request"),
+                    ("password_set", "Password Set"),
+                    ("secret_view", "Secret View"),
+                    ("secret_rotate", "Secret Rotate"),
+                    ("invitation_used", "Invite Used"),
+                    ("authorize_application", "Authorize Application"),
+                    ("source_linked", "Source Linked"),
+                    ("impersonation_started", "Impersonation Started"),
+                    ("impersonation_ended", "Impersonation Ended"),
+                    ("policy_execution", "Policy Execution"),
+                    ("policy_exception", "Policy Exception"),
+                    ("property_mapping_exception", "Property Mapping Exception"),
+                    ("system_task_execution", "System Task Execution"),
+                    ("system_task_exception", "System Task Exception"),
+                    ("system_exception", "System Exception"),
+                    ("configuration_error", "Configuration Error"),
+                    ("model_created", "Model Created"),
+                    ("model_updated", "Model Updated"),
+                    ("model_deleted", "Model Deleted"),
+                    ("email_sent", "Email Sent"),
+                    ("update_available", "Update Available"),
+                    ("custom_", "Custom Prefix"),
+                ],
+                help_text="Match created events with this action type. When left empty, all action types will be matched.",
+            ),
+        ),
+    ]
--- a/authentik/policies/reputation/signals.py
+++ b/authentik/policies/reputation/signals.py
@ -21,12 +21,15 @@ def update_score(request: HttpRequest, username: str, amount: int):
    """Update score for IP and User"""
    remote_ip = get_client_ip(request)

-    # We only update the cache here, as its faster than writing to the DB
-    cache.get_or_set(CACHE_KEY_IP_PREFIX + remote_ip, 0, CACHE_TIMEOUT)
-    cache.incr(CACHE_KEY_IP_PREFIX + remote_ip, amount)
+    try:
+        # We only update the cache here, as its faster than writing to the DB
+        cache.get_or_set(CACHE_KEY_IP_PREFIX + remote_ip, 0, CACHE_TIMEOUT)
+        cache.incr(CACHE_KEY_IP_PREFIX + remote_ip, amount)

-    cache.get_or_set(CACHE_KEY_USER_PREFIX + username, 0, CACHE_TIMEOUT)
-    cache.incr(CACHE_KEY_USER_PREFIX + username, amount)
+        cache.get_or_set(CACHE_KEY_USER_PREFIX + username, 0, CACHE_TIMEOUT)
+        cache.incr(CACHE_KEY_USER_PREFIX + username, amount)
+    except ValueError as exc:
+        LOGGER.warning("failed to set reputation", exc=exc)

    LOGGER.debug("Updated score", amount=amount, for_user=username, for_ip=remote_ip)

--- a/authentik/providers/ldap/api.py
+++ b/authentik/providers/ldap/api.py
@ -17,6 +17,10 @@ class LDAPProviderSerializer(ProviderSerializer):
        fields = ProviderSerializer.Meta.fields + [
            "base_dn",
            "search_group",
+            "certificate",
+            "tls_server_name",
+            "uid_start_number",
+            "gid_start_number",
        ]


@ -44,6 +48,10 @@ class LDAPOutpostConfigSerializer(ModelSerializer):
            "bind_flow_slug",
            "application_slug",
            "search_group",
+            "certificate",
+            "tls_server_name",
+            "uid_start_number",
+            "gid_start_number",
        ]


--- a/authentik/providers/ldap/controllers/docker.py
+++ b/authentik/providers/ldap/controllers/docker.py
@ -11,4 +11,5 @@ class LDAPDockerController(DockerController):
        super().__init__(outpost, connection)
        self.deployment_ports = [
            DeploymentPort(389, "ldap", "tcp", 3389),
+            DeploymentPort(636, "ldaps", "tcp", 6636),
        ]
--- a/authentik/providers/ldap/controllers/kubernetes.py
+++ b/authentik/providers/ldap/controllers/kubernetes.py
@ -11,4 +11,5 @@ class LDAPKubernetesController(KubernetesController):
        super().__init__(outpost, connection)
        self.deployment_ports = [
            DeploymentPort(389, "ldap", "tcp", 3389),
+            DeploymentPort(636, "ldaps", "tcp", 6636),
        ]
--- a/authentik/providers/ldap/migrations/0003_auto_20210713_1138.py
+++ b/authentik/providers/ldap/migrations/0003_auto_20210713_1138.py
@ -0,0 +1,30 @@
+# Generated by Django 3.2.5 on 2021-07-13 11:38
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_crypto", "0002_create_self_signed_kp"),
+        ("authentik_providers_ldap", "0002_ldapprovider_search_group"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="ldapprovider",
+            name="certificate",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                to="authentik_crypto.certificatekeypair",
+            ),
+        ),
+        migrations.AddField(
+            model_name="ldapprovider",
+            name="tls_server_name",
+            field=models.TextField(blank=True, default=""),
+        ),
+    ]
--- a/authentik/providers/ldap/migrations/0004_auto_20210713_2115.py
+++ b/authentik/providers/ldap/migrations/0004_auto_20210713_2115.py
@ -0,0 +1,29 @@
+# Generated by Django 3.2.5 on 2021-07-13 21:15
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_providers_ldap", "0003_auto_20210713_1138"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="ldapprovider",
+            name="gid_start_number",
+            field=models.IntegerField(
+                default=4000,
+                help_text="The start for gidNumbers, this number is added to a number generated from the group.Pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber",
+            ),
+        ),
+        migrations.AddField(
+            model_name="ldapprovider",
+            name="uid_start_number",
+            field=models.IntegerField(
+                default=2000,
+                help_text="The start for uidNumbers, this number is added to the user.Pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber",
+            ),
+        ),
+    ]
--- a/authentik/providers/ldap/models.py
+++ b/authentik/providers/ldap/models.py
@ -6,6 +6,7 @@ from django.utils.translation import gettext_lazy as _
 from rest_framework.serializers import Serializer

 from authentik.core.models import Group, Provider
+from authentik.crypto.models import CertificateKeyPair
 from authentik.outposts.models import OutpostModel


@ -28,6 +29,36 @@ class LDAPProvider(OutpostModel, Provider):
        ),
    )

+    tls_server_name = models.TextField(
+        default="",
+        blank=True,
+    )
+    certificate = models.ForeignKey(
+        CertificateKeyPair,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+    )
+
+    uid_start_number = models.IntegerField(
+        default=2000,
+        help_text=_(
+            "The start for uidNumbers, this number is added to the user.Pk to make sure that the "
+            "numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't "
+            "collide with local users uidNumber"
+        ),
+    )
+
+    gid_start_number = models.IntegerField(
+        default=4000,
+        help_text=_(
+            "The start for gidNumbers, this number is added to a number generated from the "
+            "group.Pk to make sure that the numbers aren't too low for POSIX groups. Default "
+            "is 4000 to ensure that we don't collide with local groups or users "
+            "primary groups gidNumber"
+        ),
+    )
+
    @property
    def launch_url(self) -> Optional[str]:
        """LDAP never has a launch URL"""
--- a/authentik/providers/oauth2/migrations/0001_initial.py
+++ b/authentik/providers/oauth2/migrations/0001_initial.py
@ -109,6 +109,7 @@ class Migration(migrations.Migration):
                    "redirect_uris",
                    models.TextField(
                        default="",
+                        blank=True,
                        help_text="Enter each URI on a new line.",
                        verbose_name="Redirect URIs",
                    ),
--- a/authentik/providers/oauth2/migrations/0016_alter_authorizationcode_nonce.py
+++ b/authentik/providers/oauth2/migrations/0016_alter_authorizationcode_nonce.py
@ -0,0 +1,18 @@
+# Generated by Django 3.2.5 on 2021-07-20 22:32
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_providers_oauth2", "0015_auto_20210703_1313"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="authorizationcode",
+            name="nonce",
+            field=models.TextField(default=None, null=True, verbose_name="Nonce"),
+        ),
+    ]
--- a/authentik/providers/oauth2/models.py
+++ b/authentik/providers/oauth2/models.py
@ -158,6 +158,7 @@ class OAuth2Provider(Provider):
    )
    redirect_uris = models.TextField(
        default="",
+        blank=True,
        verbose_name=_("Redirect URIs"),
        help_text=_("Enter each URI on a new line."),
    )
@ -337,7 +338,7 @@ class AuthorizationCode(ExpiringModel, BaseGrantModel):
    """OAuth2 Authorization Code"""

    code = models.CharField(max_length=255, unique=True, verbose_name=_("Code"))
-    nonce = models.TextField(blank=True, default="", verbose_name=_("Nonce"))
+    nonce = models.TextField(null=True, default=None, verbose_name=_("Nonce"))
    is_open_id = models.BooleanField(
        default=False, verbose_name=_("Is Authentication?")
    )
--- a/authentik/providers/oauth2/tests/test_authorize.py
+++ b/authentik/providers/oauth2/tests/test_authorize.py
@ -67,7 +67,7 @@ class TestAuthorize(OAuthTestCase):
            )
            OAuthAuthorizationParams.from_request(request)

-    def test_redirect_uri(self):
+    def test_invalid_redirect_uri(self):
        """test missing/invalid redirect URI"""
        OAuth2Provider.objects.create(
            name="test",
@ -91,6 +91,28 @@ class TestAuthorize(OAuthTestCase):
            )
            OAuthAuthorizationParams.from_request(request)

+    def test_empty_redirect_uri(self):
+        """test empty redirect URI (configure in provider)"""
+        OAuth2Provider.objects.create(
+            name="test",
+            client_id="test",
+            authorization_flow=Flow.objects.first(),
+        )
+        with self.assertRaises(RedirectUriError):
+            request = self.factory.get(
+                "/", data={"response_type": "code", "client_id": "test"}
+            )
+            OAuthAuthorizationParams.from_request(request)
+        request = self.factory.get(
+            "/",
+            data={
+                "response_type": "code",
+                "client_id": "test",
+                "redirect_uri": "http://localhost",
+            },
+        )
+        OAuthAuthorizationParams.from_request(request)
+
    def test_response_type(self):
        """test response_type"""
        OAuth2Provider.objects.create(
--- a/authentik/providers/oauth2/views/authorize.py
+++ b/authentik/providers/oauth2/views/authorize.py
@ -156,20 +156,23 @@ class OAuthAuthorizationParams:

    def check_redirect_uri(self):
        """Redirect URI validation."""
+        allowed_redirect_urls = self.provider.redirect_uris.split()
        if not self.redirect_uri:
            LOGGER.warning("Missing redirect uri.")
-            raise RedirectUriError("", self.provider.redirect_uris.split())
-        if self.redirect_uri.lower() not in [
-            x.lower() for x in self.provider.redirect_uris.split()
-        ]:
+            raise RedirectUriError("", allowed_redirect_urls)
+        if len(allowed_redirect_urls) < 1:
+            LOGGER.warning(
+                "Provider has no allowed redirect_uri set, allowing all.",
+                allow=self.redirect_uri.lower(),
+            )
+            return
+        if self.redirect_uri.lower() not in [x.lower() for x in allowed_redirect_urls]:
            LOGGER.warning(
                "Invalid redirect uri",
                redirect_uri=self.redirect_uri,
-                excepted=self.provider.redirect_uris.split(),
-            )
-            raise RedirectUriError(
-                self.redirect_uri, self.provider.redirect_uris.split()
+                excepted=allowed_redirect_urls,
            )
+            raise RedirectUriError(self.redirect_uri, allowed_redirect_urls)
        if self.request:
            raise AuthorizeError(
                self.redirect_uri, "request_not_supported", self.grant_type, self.state
@ -189,6 +192,10 @@ class OAuthAuthorizationParams:

    def check_nonce(self):
        """Nonce parameter validation."""
+        # https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDTValidation
+        # Nonce is only required for Implicit flows
+        if self.grant_type != GrantTypes.IMPLICIT:
+            return
        if not self.nonce:
            self.nonce = self.state
            LOGGER.warning("Using state as nonce for OpenID Request")
--- a/authentik/providers/saml/processors/request_parser.py
+++ b/authentik/providers/saml/processors/request_parser.py
@ -1,7 +1,7 @@
 """SAML AuthNRequest Parser and dataclass"""
 from base64 import b64decode
 from dataclasses import dataclass
-from typing import Optional
+from typing import Optional, Union
 from urllib.parse import quote_plus

 import xmlsec
@ -54,7 +54,9 @@ class AuthNRequestParser:
    def __init__(self, provider: SAMLProvider):
        self.provider = provider

-    def _parse_xml(self, decoded_xml: str, relay_state: Optional[str]) -> AuthNRequest:
+    def _parse_xml(
+        self, decoded_xml: Union[str, bytes], relay_state: Optional[str]
+    ) -> AuthNRequest:
        root = ElementTree.fromstring(decoded_xml)

        request_acs_url = root.attrib["AssertionConsumerServiceURL"]
@ -79,10 +81,12 @@ class AuthNRequestParser:

        return auth_n_request

-    def parse(self, saml_request: str, relay_state: Optional[str]) -> AuthNRequest:
+    def parse(
+        self, saml_request: str, relay_state: Optional[str] = None
+    ) -> AuthNRequest:
        """Validate and parse raw request with enveloped signautre."""
        try:
-            decoded_xml = b64decode(saml_request.encode()).decode()
+            decoded_xml = b64decode(saml_request.encode())
        except UnicodeDecodeError:
            raise CannotHandleAssertion(ERROR_CANNOT_DECODE_REQUEST)

@ -93,8 +97,9 @@ class AuthNRequestParser:
        signature_nodes = root.xpath(
            "/samlp:AuthnRequest/ds:Signature", namespaces=NS_MAP
        )
-        if len(signature_nodes) != 1:
-            raise CannotHandleAssertion(ERROR_SIGNATURE_REQUIRED_BUT_ABSENT)
+        # No signatures, no verifier configured -> decode xml directly
+        if len(signature_nodes) < 1 and not verifier:
+            return self._parse_xml(decoded_xml, relay_state)

        signature_node = signature_nodes[0]

--- a/authentik/providers/saml/tests/test_auth_n_request.py
+++ b/authentik/providers/saml/tests/test_auth_n_request.py
@ -14,13 +14,29 @@ from authentik.providers.saml.processors.assertion import AssertionProcessor
 from authentik.providers.saml.processors.request_parser import AuthNRequestParser
 from authentik.sources.saml.exceptions import MismatchedRequestID
 from authentik.sources.saml.models import SAMLSource
-from authentik.sources.saml.processors.constants import SAML_NAME_ID_FORMAT_UNSPECIFIED
+from authentik.sources.saml.processors.constants import (
+    SAML_NAME_ID_FORMAT_EMAIL,
+    SAML_NAME_ID_FORMAT_UNSPECIFIED,
+)
 from authentik.sources.saml.processors.request import (
    SESSION_REQUEST_ID,
    RequestProcessor,
 )
 from authentik.sources.saml.processors.response import ResponseProcessor

+POST_REQUEST = (
+    "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1sMn"
+    "A9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCIgQXNzZXJ0aW9uQ29uc3VtZXJTZXJ2aWNlVVJMPSJo"
+    "dHRwczovL2V1LWNlbnRyYWwtMS5zaWduaW4uYXdzLmFtYXpvbi5jb20vcGxhdGZvcm0vc2FtbC9hY3MvMmQ3MzdmOTYtNT"
+    "VmYi00MDM1LTk1M2UtNWUyNDEzNGViNzc4IiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9pZC5iZXJ5anUub3JnL2FwcGxpY2F0"
+    "aW9uL3NhbWwvYXdzLXNzby9zc28vYmluZGluZy9wb3N0LyIgSUQ9ImF3c19MRHhMR2V1YnBjNWx4MTJneENnUzZ1UGJpeD"
+    "F5ZDVyZSIgSXNzdWVJbnN0YW50PSIyMDIxLTA3LTA2VDE0OjIzOjA2LjM4OFoiIFByb3RvY29sQmluZGluZz0idXJuOm9h"
+    "c2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmJpbmRpbmdzOkhUVFAtUE9TVCIgVmVyc2lvbj0iMi4wIj48c2FtbDI6SXNzdWVyIH"
+    "htbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwczovL2V1LWNlbnRyYWwt"
+    "MS5zaWduaW4uYXdzLmFtYXpvbi5jb20vcGxhdGZvcm0vc2FtbC9kLTk5NjcyZjgyNzg8L3NhbWwyOklzc3Vlcj48c2FtbD"
+    "JwOk5hbWVJRFBvbGljeSBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OmVtYWls"
+    "QWRkcmVzcyIvPjwvc2FtbDJwOkF1dGhuUmVxdWVzdD4="
+)
 REDIRECT_REQUEST = (
    "fZLNbsIwEIRfJfIdbKeFgEUipXAoEm0jSHvopTLJplhK7NTr9Oft6yRUKhekPdk73+yOdoWyqVuRdu6k9/DRAbrgu6k1iu"
    "EjJp3VwkhUKLRsAIUrxCF92IlwykRrjTOFqUmQIoJ1yui10dg1YA9gP1UBz/tdTE7OtSgo5WzKQzYditGeP8GW9rSQZk+H"
@ -208,3 +224,22 @@ class TestAuthNRequest(TestCase):
        self.assertEqual(parsed_request.id, "_dcf55fcd27a887e60a7ef9ee6fd3adab")
        self.assertEqual(parsed_request.name_id_policy, SAML_NAME_ID_FORMAT_UNSPECIFIED)
        self.assertEqual(parsed_request.relay_state, REDIRECT_RELAY_STATE)
+
+    def test_signed_static(self):
+        """Test post request with static request"""
+        provider = SAMLProvider(
+            name="aws",
+            authorization_flow=Flow.objects.get(
+                slug="default-provider-authorization-implicit-consent"
+            ),
+            acs_url=(
+                "https://eu-central-1.signin.aws.amazon.com/platform/"
+                "saml/acs/2d737f96-55fb-4035-953e-5e24134eb778"
+            ),
+            audience="https://10.120.20.200/saml-sp/SAML2/POST",
+            issuer="https://10.120.20.200/saml-sp/SAML2/POST",
+            signing_kp=CertificateKeyPair.objects.first(),
+        )
+        parsed_request = AuthNRequestParser(provider).parse(POST_REQUEST)
+        self.assertEqual(parsed_request.id, "aws_LDxLGeubpc5lx12gxCgS6uPbix1yd5re")
+        self.assertEqual(parsed_request.name_id_policy, SAML_NAME_ID_FORMAT_EMAIL)
--- a/authentik/root/middleware.py
+++ b/authentik/root/middleware.py
@ -0,0 +1,94 @@
+"""Dynamically set SameSite depending if the upstream connection is TLS or not"""
+import time
+
+from django.conf import settings
+from django.contrib.sessions.backends.base import UpdateError
+from django.contrib.sessions.exceptions import SessionInterrupted
+from django.contrib.sessions.middleware import (
+    SessionMiddleware as UpstreamSessionMiddleware,
+)
+from django.http.request import HttpRequest
+from django.http.response import HttpResponse
+from django.utils.cache import patch_vary_headers
+from django.utils.http import http_date
+
+
+class SessionMiddleware(UpstreamSessionMiddleware):
+    """Dynamically set SameSite depending if the upstream connection is TLS or not"""
+
+    @staticmethod
+    def is_secure(request: HttpRequest) -> bool:
+        """Check if request is TLS'd or localhost"""
+        if request.is_secure():
+            return True
+        host, _, _ = request.get_host().partition(":")
+        if host == "localhost" and settings.DEBUG:
+            # Since go does not consider localhost with http a secure origin
+            # we can't set the secure flag.
+            user_agent = request.META.get("HTTP_USER_AGENT", "")
+            if user_agent.startswith("authentik-outpost@"):
+                return False
+            return True
+        return False
+
+    def process_response(
+        self, request: HttpRequest, response: HttpResponse
+    ) -> HttpResponse:
+        """
+        If request.session was modified, or if the configuration is to save the
+        session every time, save the changes and set a session cookie or delete
+        the session cookie if the session has been emptied.
+        """
+        try:
+            accessed = request.session.accessed
+            modified = request.session.modified
+            empty = request.session.is_empty()
+        except AttributeError:
+            return response
+        # Set SameSite based on whether or not the request is secure
+        secure = SessionMiddleware.is_secure(request)
+        same_site = "None" if secure else "Lax"
+        # First check if we need to delete this cookie.
+        # The session should be deleted only if the session is entirely empty.
+        if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
+            response.delete_cookie(
+                settings.SESSION_COOKIE_NAME,
+                path=settings.SESSION_COOKIE_PATH,
+                domain=settings.SESSION_COOKIE_DOMAIN,
+                samesite=same_site,
+            )
+            patch_vary_headers(response, ("Cookie",))
+        else:
+            if accessed:
+                patch_vary_headers(response, ("Cookie",))
+            if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
+                if request.session.get_expire_at_browser_close():
+                    max_age = None
+                    expires = None
+                else:
+                    max_age = request.session.get_expiry_age()
+                    expires_time = time.time() + max_age
+                    expires = http_date(expires_time)
+                # Save the session data and refresh the client cookie.
+                # Skip session save for 500 responses, refs #3881.
+                if response.status_code != 500:
+                    try:
+                        request.session.save()
+                    except UpdateError:
+                        raise SessionInterrupted(
+                            "The request's session was deleted before the "
+                            "request completed. The user may have logged "
+                            "out in a concurrent request, for example."
+                        )
+                    response.set_cookie(
+                        settings.SESSION_COOKIE_NAME,
+                        request.session.session_key,
+                        max_age=max_age,
+                        expires=expires,
+                        domain=settings.SESSION_COOKIE_DOMAIN,
+                        path=settings.SESSION_COOKIE_PATH,
+                        secure=secure,
+                        httponly=settings.SESSION_COOKIE_HTTPONLY or None,
+                        samesite=same_site,
+                    )
+        return response
--- a/authentik/root/settings.py
+++ b/authentik/root/settings.py
@ -188,12 +188,19 @@ REST_FRAMEWORK = {
    "DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema",
 }

+REDIS_PROTOCOL_PREFIX = "redis://"
+REDIS_CELERY_TLS_REQUIREMENTS = ""
+if CONFIG.y_bool("redis.tls", False):
+    REDIS_PROTOCOL_PREFIX = "rediss://"
+    REDIS_CELERY_TLS_REQUIREMENTS = f"?ssl_cert_reqs={CONFIG.y('redis.tls_reqs')}"
+
 CACHES = {
    "default": {
        "BACKEND": "django_redis.cache.RedisCache",
        "LOCATION": (
-            f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:6379"
-            f"/{CONFIG.y('redis.cache_db')}"
+            f"{REDIS_PROTOCOL_PREFIX}:"
+            f"{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:"
+            f"{int(CONFIG.y('redis.port'))}/{CONFIG.y('redis.cache_db')}"
        ),
        "TIMEOUT": int(CONFIG.y("redis.cache_timeout", 300)),
        "OPTIONS": {"CLIENT_CLASS": "django_redis.client.DefaultClient"},
@ -203,14 +210,16 @@ DJANGO_REDIS_IGNORE_EXCEPTIONS = True
 DJANGO_REDIS_LOG_IGNORED_EXCEPTIONS = True
 SESSION_ENGINE = "django.contrib.sessions.backends.cache"
 SESSION_CACHE_ALIAS = "default"
-SESSION_COOKIE_SAMESITE = "lax"
+# Configured via custom SessionMiddleware
+# SESSION_COOKIE_SAMESITE = "None"
+# SESSION_COOKIE_SECURE = True
 SESSION_EXPIRE_AT_BROWSER_CLOSE = True

 MESSAGE_STORAGE = "authentik.root.messages.storage.ChannelsStorage"

 MIDDLEWARE = [
    "django_prometheus.middleware.PrometheusBeforeMiddleware",
-    "django.contrib.sessions.middleware.SessionMiddleware",
+    "authentik.root.middleware.SessionMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "authentik.core.middleware.RequestIDMiddleware",
    "authentik.tenants.middleware.TenantMiddleware",
@ -250,8 +259,9 @@ CHANNEL_LAYERS = {
        "BACKEND": "channels_redis.core.RedisChannelLayer",
        "CONFIG": {
            "hosts": [
-                f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:6379"
-                f"/{CONFIG.y('redis.ws_db')}"
+                f"{REDIS_PROTOCOL_PREFIX}:"
+                f"{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:"
+                f"{int(CONFIG.y('redis.port'))}/{CONFIG.y('redis.ws_db')}"
            ],
        },
    },
@ -329,12 +339,16 @@ CELERY_BEAT_SCHEDULE = {
 CELERY_TASK_CREATE_MISSING_QUEUES = True
 CELERY_TASK_DEFAULT_QUEUE = "authentik"
 CELERY_BROKER_URL = (
-    f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}"
-    f":6379/{CONFIG.y('redis.message_queue_db')}"
+    f"{REDIS_PROTOCOL_PREFIX}:"
+    f"{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:"
+    f"{int(CONFIG.y('redis.port'))}/{CONFIG.y('redis.message_queue_db')}"
+    f"{REDIS_CELERY_TLS_REQUIREMENTS}"
 )
 CELERY_RESULT_BACKEND = (
-    f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}"
-    f":6379/{CONFIG.y('redis.message_queue_db')}"
+    f"{REDIS_PROTOCOL_PREFIX}:"
+    f"{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:"
+    f"{int(CONFIG.y('redis.port'))}/{CONFIG.y('redis.message_queue_db')}"
+    f"{REDIS_CELERY_TLS_REQUIREMENTS}"
 )

 # Database backup
@ -362,11 +376,12 @@ if CONFIG.y("postgresql.s3_backup"):
    )

 # Sentry integration
+SENTRY_DSN = "https://a579bb09306d4f8b8d8847c052d3a1d3@sentry.beryju.org/8"
 _ERROR_REPORTING = CONFIG.y_bool("error_reporting.enabled", False)
 if _ERROR_REPORTING:
    # pylint: disable=abstract-class-instantiated
    sentry_init(
-        dsn="https://a579bb09306d4f8b8d8847c052d3a1d3@sentry.beryju.org/8",
+        dsn=SENTRY_DSN,
        integrations=[
            DjangoIntegration(transaction_style="function_name"),
            CeleryIntegration(),
@ -401,9 +416,8 @@ MEDIA_URL = "/media/"

 TEST = False
 TEST_RUNNER = "authentik.root.test_runner.PytestTestRunner"
-
-LOG_LEVEL = CONFIG.y("log_level").upper() if not TEST else "DEBUG"
-
+# We can't check TEST here as its set later by the test runner
+LOG_LEVEL = CONFIG.y("log_level").upper() if "TF_BUILD" not in os.environ else "DEBUG"

 structlog.configure_once(
    processors=[
--- a/azure-pipelines-outpost.yml
+++ b/azure-pipelines-outpost.yml
@ -27,7 +27,7 @@ stages:
              script: make gen-outpost
          - task: PublishPipelineArtifact@1
            inputs:
-              targetPath: 'outpost/api/'
+              targetPath: 'api/'
              artifact: 'go_api_client'
              publishLocation: 'pipeline'
  - stage: lint
@ -43,17 +43,19 @@ stages:
            inputs:
              buildType: 'current'
              artifactName: 'go_api_client'
-              path: "outpost/api/"
+              path: "api/"
          - task: CmdLine@2
            inputs:
              script: |
+                mkdir -p web/dist
+                mkdir -p website/help
+                touch web/dist/test website/help/test
                docker run \
                  --rm \
                  -v $(pwd):/app \
                  -w /app \
                  golangci/golangci-lint:v1.39.0 \
                  golangci-lint run -v --timeout 200s
-              workingDirectory: 'outpost/'
  - stage: build_docker
    jobs:
      - job: proxy_build_docker
@ -73,7 +75,7 @@ stages:
              containerRegistry: 'beryjuorg-harbor'
              repository: 'authentik/outpost-proxy'
              command: 'build'
-              Dockerfile: 'outpost/proxy.Dockerfile'
+              Dockerfile: 'proxy.Dockerfile'
              buildContext: '$(Build.SourcesDirectory)'
              tags: |
                gh-$(branchName)
@ -106,7 +108,7 @@ stages:
              containerRegistry: 'beryjuorg-harbor'
              repository: 'authentik/outpost-ldap'
              command: 'build'
-              Dockerfile: 'outpost/ldap.Dockerfile'
+              Dockerfile: 'ldap.Dockerfile'
              buildContext: '$(Build.SourcesDirectory)'
              tags: |
                gh-$(branchName)
--- a/outpost/cmd/ldap/server.go
+++ b/outpost/cmd/ldap/server.go
@ -2,16 +2,14 @@ package main

 import (
 	"fmt"
-	"math/rand"
 	"net/url"
 	"os"
-	"os/signal"
-	"time"

 	log "github.com/sirupsen/logrus"

-	"goauthentik.io/outpost/pkg/ak"
-	"goauthentik.io/outpost/pkg/ldap"
+	"goauthentik.io/internal/common"
+	"goauthentik.io/internal/outpost/ak"
+	"goauthentik.io/internal/outpost/ldap"
 )

 const helpMessage = `authentik ldap
@ -23,32 +21,30 @@ Required environment variables:

 func main() {
 	log.SetLevel(log.DebugLevel)
-	pbURL, found := os.LookupEnv("AUTHENTIK_HOST")
+	akURL, found := os.LookupEnv("AUTHENTIK_HOST")
 	if !found {
 		fmt.Println("env AUTHENTIK_HOST not set!")
 		fmt.Println(helpMessage)
 		os.Exit(1)
 	}
-	pbToken, found := os.LookupEnv("AUTHENTIK_TOKEN")
+	akToken, found := os.LookupEnv("AUTHENTIK_TOKEN")
 	if !found {
 		fmt.Println("env AUTHENTIK_TOKEN not set!")
 		fmt.Println(helpMessage)
 		os.Exit(1)
 	}

-	pbURLActual, err := url.Parse(pbURL)
+	akURLActual, err := url.Parse(akURL)
 	if err != nil {
 		fmt.Println(err)
 		fmt.Println(helpMessage)
 		os.Exit(1)
 	}

-	rand.Seed(time.Now().UnixNano())
+	ex := common.Init()
+	defer common.Defer()

-	ac := ak.NewAPIController(*pbURLActual, pbToken)
-
-	interrupt := make(chan os.Signal, 1)
-	signal.Notify(interrupt, os.Interrupt)
+	ac := ak.NewAPIController(*akURLActual, akToken)

 	ac.Server = ldap.NewServer(ac)

@ -58,7 +54,7 @@ func main() {
 	}

 	for {
-		<-interrupt
+		<-ex
 		ac.Shutdown()
 		os.Exit(0)
 	}
--- a/outpost/cmd/proxy/server.go
+++ b/outpost/cmd/proxy/server.go
@ -2,16 +2,14 @@ package main

 import (
 	"fmt"
-	"math/rand"
 	"net/url"
 	"os"
-	"os/signal"
-	"time"

 	log "github.com/sirupsen/logrus"

-	"goauthentik.io/outpost/pkg/ak"
-	"goauthentik.io/outpost/pkg/proxy"
+	"goauthentik.io/internal/common"
+	"goauthentik.io/internal/outpost/ak"
+	"goauthentik.io/internal/outpost/proxy"
 )

 const helpMessage = `authentik proxy
@ -23,32 +21,30 @@ Required environment variables:

 func main() {
 	log.SetLevel(log.DebugLevel)
-	pbURL, found := os.LookupEnv("AUTHENTIK_HOST")
+	akURL, found := os.LookupEnv("AUTHENTIK_HOST")
 	if !found {
 		fmt.Println("env AUTHENTIK_HOST not set!")
 		fmt.Println(helpMessage)
 		os.Exit(1)
 	}
-	pbToken, found := os.LookupEnv("AUTHENTIK_TOKEN")
+	akToken, found := os.LookupEnv("AUTHENTIK_TOKEN")
 	if !found {
 		fmt.Println("env AUTHENTIK_TOKEN not set!")
 		fmt.Println(helpMessage)
 		os.Exit(1)
 	}

-	pbURLActual, err := url.Parse(pbURL)
+	akURLActual, err := url.Parse(akURL)
 	if err != nil {
 		fmt.Println(err)
 		fmt.Println(helpMessage)
 		os.Exit(1)
 	}

-	rand.Seed(time.Now().UnixNano())
+	ex := common.Init()
+	defer common.Defer()

-	ac := ak.NewAPIController(*pbURLActual, pbToken)
-
-	interrupt := make(chan os.Signal, 1)
-	signal.Notify(interrupt, os.Interrupt)
+	ac := ak.NewAPIController(*akURLActual, akToken)

 	ac.Server = proxy.NewServer(ac)

@ -58,7 +54,7 @@ func main() {
 	}

 	for {
-		<-interrupt
+		<-ex
 		ac.Shutdown()
 		os.Exit(0)
 	}
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@ -2,51 +2,106 @@ package main

 import (
 	"fmt"
-	"sync"
-	"time"

 	"github.com/getsentry/sentry-go"
 	log "github.com/sirupsen/logrus"
+	"goauthentik.io/internal/common"
 	"goauthentik.io/internal/config"
 	"goauthentik.io/internal/constants"
 	"goauthentik.io/internal/gounicorn"
 	"goauthentik.io/internal/web"
 )

+var running = true
+
 func main() {
 	log.SetLevel(log.DebugLevel)
 	config.DefaultConfig()
-	config.LoadConfig("./authentik/lib/default.yml")
-	config.LoadConfig("./local.env.yml")
+	err := config.LoadConfig("./authentik/lib/default.yml")
+	if err != nil {
+		log.WithError(err).Warning("failed to load default config")
+	}
+	err = config.LoadConfig("./local.env.yml")
+	if err != nil {
+		log.WithError(err).Debug("failed to local config")
+	}
 	config.ConfigureLogger()

 	if config.G.ErrorReporting.Enabled {
-		sentry.Init(sentry.ClientOptions{
+		err := sentry.Init(sentry.ClientOptions{
 			Dsn:              "https://a579bb09306d4f8b8d8847c052d3a1d3@sentry.beryju.org/8",
 			AttachStacktrace: true,
 			TracesSampleRate: 0.6,
 			Release:          fmt.Sprintf("authentik@%s", constants.VERSION),
 			Environment:      config.G.ErrorReporting.Environment,
 		})
-		defer sentry.Flush(time.Second * 5)
-		defer sentry.Recover()
+		if err != nil {
+			log.WithError(err).Warning("failed to init sentry")
+		}
 	}

-	rl := log.WithField("logger", "authentik.g")
-	wg := sync.WaitGroup{}
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		g := gounicorn.NewGoUnicorn()
-		for {
-			err := g.Start()
-			rl.WithError(err).Warning("gunicorn process died, restarting")
-		}
-	}()
-	go func() {
-		defer wg.Done()
-		ws := web.NewWebServer()
-		ws.Run()
-	}()
-	wg.Wait()
+	ex := common.Init()
+	defer common.Defer()
+
+	// u, _ := url.Parse("http://localhost:8000")
+
+	g := gounicorn.NewGoUnicorn()
+	ws := web.NewWebServer()
+	defer g.Kill()
+	defer ws.Shutdown()
+	for {
+		go attemptStartBackend(g)
+		ws.Start()
+		// go attemptProxyStart(u)
+
+		<-ex
+		running = false
+		log.WithField("logger", "authentik").Info("shutting down webserver")
+		go ws.Shutdown()
+		log.WithField("logger", "authentik").Info("killing gunicorn")
+		g.Kill()
+	}
 }
+
+func attemptStartBackend(g *gounicorn.GoUnicorn) {
+	for {
+		err := g.Start()
+		if !running {
+			return
+		}
+		log.WithField("logger", "authentik.g").WithError(err).Warning("gunicorn process died, restarting")
+	}
+}
+
+// func attemptProxyStart(u *url.URL) error {
+// 	maxTries := 100
+// 	attempt := 0
+// 	for {
+// 		log.WithField("logger", "authentik").Debug("attempting to init outpost")
+// 		ac := ak.NewAPIController(*u, config.G.SecretKey)
+// 		if ac == nil {
+// 			attempt += 1
+// 			time.Sleep(1 * time.Second)
+// 			if attempt > maxTries {
+// 				break
+// 			}
+// 			continue
+// 		}
+// 		ac.Server = proxy.NewServer(ac)
+// 		err := ac.Start()
+// 		log.WithField("logger", "authentik").Debug("attempting to start outpost")
+// 		if err != nil {
+// 			attempt += 1
+// 			time.Sleep(5 * time.Second)
+// 			if attempt > maxTries {
+// 				break
+// 			}
+// 			continue
+// 		}
+// 		if !running {
+// 			ac.Shutdown()
+// 			return nil
+// 		}
+// 	}
+// 	return nil
+// }
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -21,7 +21,7 @@ services:
    networks:
      - internal
  server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.6.4}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.7.1-rc1}
    restart: unless-stopped
    command: server
    environment:
@ -44,7 +44,7 @@ services:
      - "0.0.0.0:9000:9000"
      - "0.0.0.0:9443:9443"
  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.6.4}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.7.1-rc1}
    restart: unless-stopped
    command: worker
    networks:
--- a/go.mod
+++ b/go.mod
@ -3,11 +3,49 @@ module goauthentik.io
 go 1.16

 require (
-	github.com/getsentry/sentry-go v0.10.0 // indirect
-	github.com/gorilla/handlers v1.5.1 // indirect
-	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/pkg/errors v0.8.1 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
+	github.com/coreos/go-oidc v2.2.1+incompatible
+	github.com/getsentry/sentry-go v0.11.0
+	github.com/go-ldap/ldap/v3 v3.3.0
+	github.com/go-openapi/analysis v0.20.1 // indirect
+	github.com/go-openapi/errors v0.20.0 // indirect
+	github.com/go-openapi/runtime v0.19.29
+	github.com/go-openapi/strfmt v0.20.1
+	github.com/go-openapi/swag v0.19.15 // indirect
+	github.com/go-openapi/validate v0.20.2 // indirect
+	github.com/go-redis/redis/v7 v7.4.0 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/uuid v1.3.0
+	github.com/gorilla/handlers v1.5.1
+	github.com/gorilla/mux v1.8.0
+	github.com/gorilla/websocket v1.4.2
+	github.com/imdario/mergo v0.3.12
+	github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a
+	github.com/justinas/alice v1.2.0
+	github.com/kr/pretty v0.2.1 // indirect
+	github.com/magiconair/properties v1.8.5 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 // indirect
+	github.com/nmcclain/ldap v0.0.0-20191021200707-3b3b69a7e9e3
+	github.com/oauth2-proxy/oauth2-proxy v0.0.0-20200831161845-e4e5580852dc
+	github.com/pelletier/go-toml v1.9.1 // indirect
+	github.com/pires/go-proxyproto v0.6.0 // indirect
+	github.com/pkg/errors v0.9.1
+	github.com/pquerna/cachecontrol v0.0.0-20201205024021-ac21108117ac // indirect
+	github.com/recws-org/recws v1.3.1
 	github.com/sirupsen/logrus v1.8.1
-	gopkg.in/yaml.v2 v2.3.0 // indirect
+	github.com/spf13/afero v1.6.0 // indirect
+	github.com/spf13/cast v1.3.1 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/viper v1.7.1 // indirect
+	go.mongodb.org/mongo-driver v1.5.2 // indirect
+	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 // indirect
+	golang.org/x/net v0.0.0-20210510120150-4163338589ed // indirect
+	golang.org/x/oauth2 v0.0.0-20210323180902-22b0adad7558 // indirect
+	golang.org/x/sys v0.0.0-20210514084401-e8d321eab015 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	gopkg.in/ini.v1 v1.62.0 // indirect
+	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0
 )
--- a/go.sum
+++ b/go.sum
--- a/internal/common/global.go
+++ b/internal/common/global.go
@ -0,0 +1,22 @@
+package common
+
+import (
+	"math/rand"
+	"os"
+	"os/signal"
+	"time"
+
+	"github.com/getsentry/sentry-go"
+)
+
+func Init() chan os.Signal {
+	rand.Seed(time.Now().UnixNano())
+	interrupt := make(chan os.Signal, 1)
+	signal.Notify(interrupt, os.Interrupt)
+	return interrupt
+}
+
+func Defer() {
+	defer sentry.Flush(time.Second * 5)
+	defer sentry.Recover()
+}
--- a/internal/config/struct.go
+++ b/internal/config/struct.go
@ -2,6 +2,7 @@ package config

 type Config struct {
 	Debug          bool                 `yaml:"debug"`
+	SecretKey      string               `yaml:"secret_key"`
 	Web            WebConfig            `yaml:"web"`
 	Paths          PathsConfig          `yaml:"paths"`
 	LogLevel       string               `yaml:"log_level"`
--- a/internal/constants/constants.go
+++ b/internal/constants/constants.go
@ -1,3 +1,20 @@
 package constants

-const VERSION = "2021.6.4"
+import (
+	"fmt"
+	"os"
+)
+
+func BUILD() string {
+	build := os.Getenv("GIT_BUILD_HASH")
+	if build == "" {
+		return "tagged"
+	}
+	return build
+}
+
+func OutpostUserAgent() string {
+	return fmt.Sprintf("authentik-outpost@%s (%s)", VERSION, BUILD())
+}
+
+const VERSION = "2021.7.1-rc1"
--- a/internal/gounicorn/gounicorn.go
+++ b/internal/gounicorn/gounicorn.go
@ -9,16 +9,24 @@ import (
 )

 type GoUnicorn struct {
-	log *log.Entry
+	log     *log.Entry
+	p       *exec.Cmd
+	started bool
+	killed  bool
 }

 func NewGoUnicorn() *GoUnicorn {
-	return &GoUnicorn{
-		log: log.WithField("logger", "authentik.g.unicorn"),
+	logger := log.WithField("logger", "authentik.g.unicorn")
+	g := &GoUnicorn{
+		log:     logger,
+		started: false,
+		killed:  false,
 	}
+	g.initCmd()
+	return g
 }

-func (g *GoUnicorn) Start() error {
+func (g *GoUnicorn) initCmd() {
 	command := "gunicorn"
 	args := []string{"-c", "./lifecycle/gunicorn.conf.py", "authentik.root.asgi:application"}
 	if config.G.Debug {
@ -26,11 +34,28 @@ func (g *GoUnicorn) Start() error {
 		args = []string{"manage.py", "runserver", "localhost:8000"}
 	}
 	g.log.WithField("args", args).WithField("cmd", command).Debug("Starting gunicorn")
-	p := exec.Command(command, args...)
-	p.Env = append(os.Environ(),
-		"WORKERS=2",
-	)
-	p.Stdout = os.Stdout
-	p.Stderr = os.Stderr
-	return p.Run()
+	g.p = exec.Command(command, args...)
+	g.p.Env = os.Environ()
+	g.p.Stdout = os.Stdout
+	g.p.Stderr = os.Stderr
+}
+
+func (g *GoUnicorn) Start() error {
+	if g.killed {
+		g.log.Debug("Not restarting gunicorn since we're killed")
+		return nil
+	}
+	if g.started {
+		g.initCmd()
+	}
+	g.started = true
+	return g.p.Run()
+}
+
+func (g *GoUnicorn) Kill() {
+	g.killed = true
+	err := g.p.Process.Kill()
+	if err != nil {
+		g.log.WithError(err).Warning("failed to kill gunicorn")
+	}
 }
--- a/internal/outpost/ak/api.go
+++ b/internal/outpost/ak/api.go
@ -6,15 +6,14 @@ import (
 	"math/rand"
 	"net/http"
 	"net/url"
-	"os"
 	"time"

 	"github.com/go-openapi/strfmt"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"github.com/recws-org/recws"
-	"goauthentik.io/outpost/api"
-	"goauthentik.io/outpost/pkg"
+	"goauthentik.io/api"
+	"goauthentik.io/internal/constants"

 	log "github.com/sirupsen/logrus"
 )
@ -41,10 +40,11 @@ type APIController struct {
 // NewAPIController initialise new API Controller instance from URL and API token
 func NewAPIController(akURL url.URL, token string) *APIController {
 	config := api.NewConfiguration()
+	config.UserAgent = constants.OutpostUserAgent()
 	config.Host = akURL.Host
 	config.Scheme = akURL.Scheme
 	config.HTTPClient = &http.Client{
-		Transport: SetUserAgent(GetTLSTransport(), pkg.UserAgent()),
+		Transport: GetTLSTransport(),
 	}
 	config.AddDefaultHeader("Authorization", fmt.Sprintf("Bearer %s", token))

@ -59,7 +59,7 @@ func NewAPIController(akURL url.URL, token string) *APIController {

 	if err != nil {
 		log.WithError(err).Error("Failed to fetch configuration")
-		os.Exit(1)
+		return nil
 	}
 	outpost := outposts.Results[0]
 	doGlobalSetup(outpost.Config)
--- a/internal/outpost/ak/api_update.go
+++ b/internal/outpost/ak/api_update.go
@ -3,7 +3,7 @@ package ak
 import (
 	"context"

-	"goauthentik.io/outpost/api"
+	"goauthentik.io/api"
 )

 func (a *APIController) Update() ([]api.ProxyOutpostConfig, error) {
--- a/internal/outpost/ak/api_ws.go
+++ b/internal/outpost/ak/api_ws.go
@ -12,7 +12,7 @@ import (
 	"github.com/go-openapi/strfmt"
 	"github.com/gorilla/websocket"
 	"github.com/recws-org/recws"
-	"goauthentik.io/outpost/pkg"
+	"goauthentik.io/internal/constants"
 )

 func (ac *APIController) initWS(akURL url.URL, outpostUUID strfmt.UUID) {
@ -23,7 +23,7 @@ func (ac *APIController) initWS(akURL url.URL, outpostUUID strfmt.UUID) {

 	header := http.Header{
 		"Authorization": []string{authHeader},
-		"User-Agent":    []string{pkg.UserAgent()},
+		"User-Agent":    []string{constants.OutpostUserAgent()},
 	}

 	value, set := os.LookupEnv("AUTHENTIK_INSECURE")
@ -46,8 +46,8 @@ func (ac *APIController) initWS(akURL url.URL, outpostUUID strfmt.UUID) {
 	msg := websocketMessage{
 		Instruction: WebsocketInstructionHello,
 		Args: map[string]interface{}{
-			"version":   pkg.VERSION,
-			"buildHash": pkg.BUILD(),
+			"version":   constants.VERSION,
+			"buildHash": constants.BUILD(),
 			"uuid":      ac.instanceUUID.String(),
 		},
 	}
@ -101,8 +101,8 @@ func (ac *APIController) startWSHealth() {
 		aliveMsg := websocketMessage{
 			Instruction: WebsocketInstructionHello,
 			Args: map[string]interface{}{
-				"version":   pkg.VERSION,
-				"buildHash": pkg.BUILD(),
+				"version":   constants.VERSION,
+				"buildHash": constants.BUILD(),
 				"uuid":      ac.instanceUUID.String(),
 			},
 		}
--- a/internal/outpost/ak/api_ws_msg.go
+++ b/internal/outpost/ak/api_ws_msg.go
--- a/internal/outpost/ak/global.go
+++ b/internal/outpost/ak/global.go
@ -1,6 +1,8 @@
 package ak

 import (
+	"context"
+	"crypto/tls"
 	"net/http"
 	"os"
 	"strings"
@ -9,7 +11,8 @@ import (
 	"github.com/getsentry/sentry-go"
 	httptransport "github.com/go-openapi/runtime/client"
 	log "github.com/sirupsen/logrus"
-	"goauthentik.io/outpost/pkg"
+	"goauthentik.io/api"
+	"goauthentik.io/internal/constants"
 )

 func doGlobalSetup(config map[string]interface{}) {
@ -33,7 +36,7 @@ func doGlobalSetup(config map[string]interface{}) {
 	default:
 		log.SetLevel(log.DebugLevel)
 	}
-	log.WithField("buildHash", pkg.BUILD()).WithField("version", pkg.VERSION).Info("Starting authentik outpost")
+	log.WithField("buildHash", constants.BUILD()).WithField("version", constants.VERSION).Info("Starting authentik outpost")

 	var dsn string
 	if config[ConfigErrorReportingEnabled].(bool) {
@ -66,3 +69,21 @@ func GetTLSTransport() http.RoundTripper {
 	}
 	return tlsTransport
 }
+
+// ParseCertificate Load certificate from Keyepair UUID and parse it into a go Certificate
+func ParseCertificate(kpUuid string, cryptoApi *api.CryptoApiService) (*tls.Certificate, error) {
+	cert, _, err := cryptoApi.CryptoCertificatekeypairsViewCertificateRetrieve(context.Background(), kpUuid).Execute()
+	if err != nil {
+		return nil, err
+	}
+	key, _, err := cryptoApi.CryptoCertificatekeypairsViewPrivateKeyRetrieve(context.Background(), kpUuid).Execute()
+	if err != nil {
+		return nil, err
+	}
+
+	x509cert, err := tls.X509KeyPair([]byte(cert.Data), []byte(key.Data))
+	if err != nil {
+		return nil, err
+	}
+	return &x509cert, nil
+}
--- a/internal/outpost/ak/outpost.go
+++ b/internal/outpost/ak/outpost.go
--- a/internal/outpost/flow.go
+++ b/internal/outpost/flow.go
@ -0,0 +1,177 @@
+package outpost
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/cookiejar"
+	"net/url"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"goauthentik.io/api"
+	"goauthentik.io/internal/constants"
+	"goauthentik.io/internal/outpost/ak"
+)
+
+type StageComponent string
+
+const (
+	StageIdentification        = StageComponent("ak-stage-identification")
+	StagePassword              = StageComponent("ak-stage-password")
+	StageAuthenticatorValidate = StageComponent("ak-stage-authenticator-validate")
+	StageAccessDenied          = StageComponent("ak-stage-access-denied")
+)
+
+const (
+	HeaderAuthentikRemoteIP     = "X-authentik-remote-ip"
+	HeaderAuthentikOutpostToken = "X-authentik-outpost-token"
+)
+
+type FlowExecutor struct {
+	Params  url.Values
+	Answers map[StageComponent]string
+
+	api      *api.APIClient
+	flowSlug string
+	log      *log.Entry
+	token    string
+}
+
+func NewFlowExecutor(flowSlug string, refConfig *api.Configuration, logFields log.Fields) *FlowExecutor {
+	l := log.WithField("flow", flowSlug).WithFields(logFields)
+	jar, err := cookiejar.New(nil)
+	if err != nil {
+		l.WithError(err).Warning("Failed to create cookiejar")
+		panic(err)
+	}
+	// Create new http client that also sets the correct ip
+	config := api.NewConfiguration()
+	config.Host = refConfig.Host
+	config.Scheme = refConfig.Scheme
+	config.UserAgent = constants.OutpostUserAgent()
+	config.HTTPClient = &http.Client{
+		Jar:       jar,
+		Transport: ak.GetTLSTransport(),
+	}
+	apiClient := api.NewAPIClient(config)
+	return &FlowExecutor{
+		Params:   url.Values{},
+		Answers:  make(map[StageComponent]string),
+		api:      apiClient,
+		flowSlug: flowSlug,
+		log:      l,
+		token:    strings.Split(refConfig.DefaultHeader["Authorization"], " ")[1],
+	}
+}
+
+func (fe *FlowExecutor) ApiClient() *api.APIClient {
+	return fe.api
+}
+
+type ChallengeInt interface {
+	GetComponent() string
+	GetType() api.ChallengeChoices
+	GetResponseErrors() map[string][]api.ErrorDetail
+}
+
+func (fe *FlowExecutor) DelegateClientIP(a net.Addr) {
+	host, _, err := net.SplitHostPort(a.String())
+	if err != nil {
+		fe.log.WithError(err).Warning("Failed to get remote IP")
+		return
+	}
+	fe.api.GetConfig().AddDefaultHeader(HeaderAuthentikRemoteIP, host)
+	fe.api.GetConfig().AddDefaultHeader(HeaderAuthentikOutpostToken, fe.token)
+}
+
+func (fe *FlowExecutor) CheckApplicationAccess(appSlug string) (bool, error) {
+	p, _, err := fe.api.CoreApi.CoreApplicationsCheckAccessRetrieve(context.Background(), appSlug).Execute()
+	if !p.Passing {
+		fe.log.Info("Access denied for user")
+		return false, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("failed to check access: %w", err)
+	}
+	fe.log.Debug("User has access")
+	return true, nil
+}
+
+func (fe *FlowExecutor) getAnswer(stage StageComponent) string {
+	if v, o := fe.Answers[stage]; o {
+		return v
+	}
+	return ""
+}
+
+func (fe *FlowExecutor) Execute() (bool, error) {
+	return fe.solveFlowChallenge(1)
+}
+
+func (fe *FlowExecutor) solveFlowChallenge(depth int) (bool, error) {
+	req := fe.api.FlowsApi.FlowsExecutorGet(context.Background(), fe.flowSlug).Query(fe.Params.Encode())
+	challenge, _, err := req.Execute()
+	if err != nil {
+		return false, errors.New("failed to get challenge")
+	}
+	ch := challenge.GetActualInstance().(ChallengeInt)
+	fe.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got challenge")
+	responseReq := fe.api.FlowsApi.FlowsExecutorSolve(context.Background(), fe.flowSlug).Query(fe.Params.Encode())
+	switch ch.GetComponent() {
+	case string(StageIdentification):
+		responseReq = responseReq.FlowChallengeResponseRequest(api.IdentificationChallengeResponseRequestAsFlowChallengeResponseRequest(api.NewIdentificationChallengeResponseRequest(fe.getAnswer(StageIdentification))))
+	case string(StagePassword):
+		responseReq = responseReq.FlowChallengeResponseRequest(api.PasswordChallengeResponseRequestAsFlowChallengeResponseRequest(api.NewPasswordChallengeResponseRequest(fe.getAnswer(StagePassword))))
+	case string(StageAuthenticatorValidate):
+		// We only support duo as authenticator, check if that's allowed
+		var deviceChallenge *api.DeviceChallenge
+		for _, devCh := range challenge.AuthenticatorValidationChallenge.DeviceChallenges {
+			if devCh.DeviceClass == string(api.DEVICECLASSESENUM_DUO) {
+				deviceChallenge = &devCh
+			}
+		}
+		if deviceChallenge == nil {
+			return false, errors.New("got ak-stage-authenticator-validate without duo")
+		}
+		devId, err := strconv.Atoi(deviceChallenge.DeviceUid)
+		if err != nil {
+			return false, errors.New("failed to convert duo device id to int")
+		}
+		devId32 := int32(devId)
+		inner := api.NewAuthenticatorValidationChallengeResponseRequest()
+		inner.Duo = &devId32
+		responseReq = responseReq.FlowChallengeResponseRequest(api.AuthenticatorValidationChallengeResponseRequestAsFlowChallengeResponseRequest(inner))
+	case string(StageAccessDenied):
+		return false, errors.New("got ak-stage-access-denied")
+	default:
+		return false, fmt.Errorf("unsupported challenge type %s", ch.GetComponent())
+	}
+	response, _, err := responseReq.Execute()
+	ch = response.GetActualInstance().(ChallengeInt)
+	fe.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got response")
+	switch ch.GetComponent() {
+	case string(StageAccessDenied):
+		return false, errors.New("got ak-stage-access-denied")
+	}
+	if ch.GetType() == "redirect" {
+		return true, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("failed to submit challenge %w", err)
+	}
+	if len(ch.GetResponseErrors()) > 0 {
+		for key, errs := range ch.GetResponseErrors() {
+			for _, err := range errs {
+				return false, fmt.Errorf("flow error %s: %s", key, err.String)
+			}
+		}
+	}
+	if depth >= 10 {
+		return false, errors.New("exceeded stage recursion depth")
+	}
+	return fe.solveFlowChallenge(depth + 1)
+}
--- a/internal/outpost/ldap/api.go
+++ b/internal/outpost/ldap/api.go
@ -2,14 +2,18 @@ package ldap

 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"strings"
 	"sync"

 	"github.com/go-openapi/strfmt"
+	"github.com/pires/go-proxyproto"
 	log "github.com/sirupsen/logrus"
+	"goauthentik.io/internal/outpost/ak"
 )

 func (ls *LDAPServer) Refresh() error {
@ -24,6 +28,7 @@ func (ls *LDAPServer) Refresh() error {
 	for idx, provider := range outposts.Results {
 		userDN := strings.ToLower(fmt.Sprintf("ou=users,%s", *provider.BaseDn))
 		groupDN := strings.ToLower(fmt.Sprintf("ou=groups,%s", *provider.BaseDn))
+		logger := log.WithField("logger", "authentik.outpost.ldap").WithField("provider", provider.Name)
 		providers[idx] = &ProviderInstance{
 			BaseDN:              *provider.BaseDn,
 			GroupDN:             groupDN,
@ -34,7 +39,20 @@ func (ls *LDAPServer) Refresh() error {
 			boundUsersMutex:     sync.RWMutex{},
 			boundUsers:          make(map[string]UserFlags),
 			s:                   ls,
-			log:                 log.WithField("logger", "authentik.outpost.ldap").WithField("provider", provider.Name),
+			log:                 logger,
+			tlsServerName:       provider.TlsServerName,
+			uidStartNumber:      *provider.UidStartNumber,
+			gidStartNumber:      *provider.GidStartNumber,
+		}
+		if provider.Certificate.Get() != nil {
+			logger.WithField("provider", provider.Name).Debug("Enabling TLS")
+			cert, err := ak.ParseCertificate(*provider.Certificate.Get(), ls.ac.Client.CryptoApi)
+			if err != nil {
+				logger.WithField("provider", provider.Name).WithError(err).Warning("Failed to fetch certificate")
+			} else {
+				providers[idx].cert = cert
+				logger.WithField("provider", provider.Name).Debug("Loaded certificates")
+			}
 		}
 	}
 	ls.providers = providers
@ -54,13 +72,53 @@ func (ls *LDAPServer) StartHTTPServer() error {

 func (ls *LDAPServer) StartLDAPServer() error {
 	listen := "0.0.0.0:3389"
+
+	ln, err := net.Listen("tcp", listen)
+	if err != nil {
+		ls.log.Fatalf("FATAL: listen (%s) failed - %s", listen, err)
+	}
+	proxyListener := &proxyproto.Listener{Listener: ln}
+	defer proxyListener.Close()
+
 	ls.log.WithField("listen", listen).Info("Starting ldap server")
+	err = ls.s.Serve(proxyListener)
+	if err != nil {
+		return err
+	}
+	ls.log.Printf("closing %s", ln.Addr())
+	return ls.s.ListenAndServe(listen)
+}
+
+func (ls *LDAPServer) StartLDAPTLSServer() error {
+	listen := "0.0.0.0:6636"
+	tlsConfig := &tls.Config{
+		MinVersion:     tls.VersionTLS12,
+		MaxVersion:     tls.VersionTLS12,
+		GetCertificate: ls.getCertificates,
+	}
+
+	ln, err := net.Listen("tcp", listen)
+	if err != nil {
+		ls.log.Fatalf("FATAL: listen (%s) failed - %s", listen, err)
+	}
+
+	proxyListener := &proxyproto.Listener{Listener: ln}
+	defer proxyListener.Close()
+
+	tln := tls.NewListener(proxyListener, tlsConfig)
+
+	ls.log.WithField("listen", listen).Info("Starting ldap tls server")
+	err = ls.s.Serve(tln)
+	if err != nil {
+		return err
+	}
+	ls.log.Printf("closing %s", ln.Addr())
 	return ls.s.ListenAndServe(listen)
 }

 func (ls *LDAPServer) Start() error {
 	wg := sync.WaitGroup{}
-	wg.Add(2)
+	wg.Add(3)
 	go func() {
 		defer wg.Done()
 		err := ls.StartHTTPServer()
@ -75,24 +133,13 @@ func (ls *LDAPServer) Start() error {
 			panic(err)
 		}
 	}()
+	go func() {
+		defer wg.Done()
+		err := ls.StartLDAPTLSServer()
+		if err != nil {
+			panic(err)
+		}
+	}()
 	wg.Wait()
 	return nil
 }
-
-type transport struct {
-	headers map[string]string
-	inner   http.RoundTripper
-}
-
-func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
-	for key, value := range t.headers {
-		req.Header.Add(key, value)
-	}
-	return t.inner.RoundTrip(req)
-}
-func newTransport(inner http.RoundTripper, headers map[string]string) *transport {
-	return &transport{
-		inner:   inner,
-		headers: headers,
-	}
-}
--- a/internal/outpost/ldap/api_tls.go
+++ b/internal/outpost/ldap/api_tls.go
@ -0,0 +1,23 @@
+package ldap
+
+import "crypto/tls"
+
+func (ls *LDAPServer) getCertificates(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	if len(ls.providers) == 1 {
+		if ls.providers[0].cert != nil {
+			ls.log.WithField("server-name", info.ServerName).Debug("We only have a single provider, using their cert")
+			return ls.providers[0].cert, nil
+		}
+	}
+	for _, provider := range ls.providers {
+		if provider.tlsServerName == &info.ServerName {
+			if provider.cert == nil {
+				ls.log.WithField("server-name", info.ServerName).Debug("Handler does not have a certificate")
+				return ls.defaultCert, nil
+			}
+			return provider.cert, nil
+		}
+	}
+	ls.log.WithField("server-name", info.ServerName).Debug("Fallback to default cert")
+	return ls.defaultCert, nil
+}
--- a/internal/outpost/ldap/bind.go
+++ b/internal/outpost/ldap/bind.go
@ -0,0 +1,41 @@
+package ldap
+
+import (
+	"net"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/nmcclain/ldap"
+	log "github.com/sirupsen/logrus"
+)
+
+type BindRequest struct {
+	BindDN string
+	BindPW string
+	id     string
+	conn   net.Conn
+	log    *log.Entry
+}
+
+func (ls *LDAPServer) Bind(bindDN string, bindPW string, conn net.Conn) (ldap.LDAPResultCode, error) {
+	bindDN = strings.ToLower(bindDN)
+	rid := uuid.New().String()
+	req := BindRequest{
+		BindDN: bindDN,
+		BindPW: bindPW,
+		conn:   conn,
+		log:    ls.log.WithField("bindDN", bindDN).WithField("requestId", rid).WithField("client", conn.RemoteAddr().String()),
+		id:     rid,
+	}
+	req.log.Info("Bind request")
+	for _, instance := range ls.providers {
+		username, err := instance.getUsername(bindDN)
+		if err == nil {
+			return instance.Bind(username, req)
+		} else {
+			ls.log.WithError(err).Debug("Username not for instance")
+		}
+	}
+	req.log.WithField("request", "bind").Warning("No provider found for request")
+	return ldap.LDAPResultOperationsError, nil
+}
--- a/internal/outpost/ldap/instance_bind.go
+++ b/internal/outpost/ldap/instance_bind.go
@ -0,0 +1,117 @@
+package ldap
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+
+	goldap "github.com/go-ldap/ldap/v3"
+	"github.com/nmcclain/ldap"
+	log "github.com/sirupsen/logrus"
+	"goauthentik.io/api"
+	"goauthentik.io/internal/outpost"
+)
+
+const ContextUserKey = "ak_user"
+
+func (pi *ProviderInstance) getUsername(dn string) (string, error) {
+	if !strings.HasSuffix(strings.ToLower(dn), strings.ToLower(pi.BaseDN)) {
+		return "", errors.New("invalid base DN")
+	}
+	dns, err := goldap.ParseDN(dn)
+	if err != nil {
+		return "", err
+	}
+	for _, part := range dns.RDNs {
+		for _, attribute := range part.Attributes {
+			if strings.ToLower(attribute.Type) == "cn" {
+				return attribute.Value, nil
+			}
+		}
+	}
+	return "", errors.New("failed to find cn")
+}
+
+func (pi *ProviderInstance) Bind(username string, req BindRequest) (ldap.LDAPResultCode, error) {
+	fe := outpost.NewFlowExecutor(pi.flowSlug, pi.s.ac.Client.GetConfig(), log.Fields{
+		"bindDN":    req.BindDN,
+		"client":    req.conn.RemoteAddr().String(),
+		"requestId": req.id,
+	})
+	fe.DelegateClientIP(req.conn.RemoteAddr())
+	fe.Params.Add("goauthentik.io/outpost/ldap", "true")
+
+	fe.Answers[outpost.StageIdentification] = username
+	fe.Answers[outpost.StagePassword] = req.BindPW
+
+	passed, err := fe.Execute()
+	if !passed {
+		return ldap.LDAPResultInvalidCredentials, nil
+	}
+	if err != nil {
+		req.log.WithError(err).Warning("failed to execute flow")
+		return ldap.LDAPResultOperationsError, nil
+	}
+	access, err := fe.CheckApplicationAccess(pi.appSlug)
+	if !access {
+		req.log.Info("Access denied for user")
+		return ldap.LDAPResultInsufficientAccessRights, nil
+	}
+	if err != nil {
+		req.log.WithError(err).Warning("failed to check access")
+		return ldap.LDAPResultOperationsError, nil
+	}
+	req.log.Info("User has access")
+	// Get user info to store in context
+	userInfo, _, err := fe.ApiClient().CoreApi.CoreUsersMeRetrieve(context.Background()).Execute()
+	if err != nil {
+		req.log.WithError(err).Warning("failed to get user info")
+		return ldap.LDAPResultOperationsError, nil
+	}
+	pi.boundUsersMutex.Lock()
+	cs := pi.SearchAccessCheck(userInfo.User)
+	pi.boundUsers[req.BindDN] = UserFlags{
+		UserInfo:  userInfo.User,
+		CanSearch: cs != nil,
+	}
+	if pi.boundUsers[req.BindDN].CanSearch {
+		req.log.WithField("group", cs).Info("Allowed access to search")
+	}
+
+	defer pi.boundUsersMutex.Unlock()
+	pi.delayDeleteUserInfo(username)
+	return ldap.LDAPResultSuccess, nil
+}
+
+// SearchAccessCheck Check if the current user is allowed to search
+func (pi *ProviderInstance) SearchAccessCheck(user api.User) *string {
+	for _, group := range user.Groups {
+		for _, allowedGroup := range pi.searchAllowedGroups {
+			pi.log.WithField("userGroup", group.Pk).WithField("allowedGroup", allowedGroup).Trace("Checking search access")
+			if group.Pk == allowedGroup.String() {
+				return &group.Name
+			}
+		}
+	}
+	return nil
+}
+
+func (pi *ProviderInstance) delayDeleteUserInfo(dn string) {
+	ticker := time.NewTicker(30 * time.Second)
+	quit := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-ticker.C:
+				pi.boundUsersMutex.Lock()
+				delete(pi.boundUsers, dn)
+				pi.boundUsersMutex.Unlock()
+				close(quit)
+			case <-quit:
+				ticker.Stop()
+				return
+			}
+		}
+	}()
+}
--- a/internal/outpost/ldap/instance_search.go
+++ b/internal/outpost/ldap/instance_search.go
@ -4,58 +4,66 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net"
 	"strings"

 	"github.com/nmcclain/ldap"
-	"goauthentik.io/outpost/api"
+	"goauthentik.io/api"
 )

-func (pi *ProviderInstance) SearchMe(user api.User, searchReq ldap.SearchRequest, conn net.Conn) (ldap.ServerSearchResult, error) {
+func (pi *ProviderInstance) SearchMe(user api.User) (ldap.ServerSearchResult, error) {
 	entries := make([]*ldap.Entry, 1)
 	entries[0] = pi.UserEntry(user)
 	return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
 }

-func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest, conn net.Conn) (ldap.ServerSearchResult, error) {
-	bindDN = strings.ToLower(bindDN)
+func (pi *ProviderInstance) Search(req SearchRequest) (ldap.ServerSearchResult, error) {
 	baseDN := strings.ToLower("," + pi.BaseDN)

 	entries := []*ldap.Entry{}
-	filterEntity, err := ldap.GetFilterObjectClass(searchReq.Filter)
+	filterEntity, err := ldap.GetFilterObjectClass(req.Filter)
 	if err != nil {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: error parsing filter: %s", searchReq.Filter)
+		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: error parsing filter: %s", req.Filter)
 	}
-	if len(bindDN) < 1 {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: Anonymous BindDN not allowed %s", bindDN)
+	if len(req.BindDN) < 1 {
+		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: Anonymous BindDN not allowed %s", req.BindDN)
 	}
-	if !strings.HasSuffix(bindDN, baseDN) {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: BindDN %s not in our BaseDN %s", bindDN, pi.BaseDN)
+	if !strings.HasSuffix(req.BindDN, baseDN) {
+		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: BindDN %s not in our BaseDN %s", req.BindDN, pi.BaseDN)
 	}

 	pi.boundUsersMutex.RLock()
 	defer pi.boundUsersMutex.RUnlock()
-	flags, ok := pi.boundUsers[bindDN]
+	flags, ok := pi.boundUsers[req.BindDN]
 	if !ok {
 		pi.log.Debug("User info not cached")
 		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, errors.New("access denied")
 	}
 	if !flags.CanSearch {
 		pi.log.Debug("User can't search, showing info about user")
-		return pi.SearchMe(flags.UserInfo, searchReq, conn)
+		return pi.SearchMe(flags.UserInfo)
 	}

 	switch filterEntity {
 	default:
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: unhandled filter type: %s [%s]", filterEntity, searchReq.Filter)
+		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: unhandled filter type: %s [%s]", filterEntity, req.Filter)
 	case GroupObjectClass:
 		groups, _, err := pi.s.ac.Client.CoreApi.CoreGroupsList(context.Background()).Execute()
 		if err != nil {
 			return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("API Error: %s", err)
 		}
 		pi.log.WithField("count", len(groups.Results)).Trace("Got results from API")
+
 		for _, g := range groups.Results {
-			entries = append(entries, pi.GroupEntry(g))
+			entries = append(entries, pi.GroupEntry(pi.APIGroupToLDAPGroup(g)))
+		}
+
+		users, _, err := pi.s.ac.Client.CoreApi.CoreUsersList(context.Background()).Execute()
+		if err != nil {
+			return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("API Error: %s", err)
+		}
+
+		for _, u := range users.Results {
+			entries = append(entries, pi.GroupEntry(pi.APIUserToLDAPGroup(u)))
 		}
 	case UserObjectClass, "":
 		users, _, err := pi.s.ac.Client.CoreApi.CoreUsersList(context.Background()).Execute()
@ -66,7 +74,7 @@ func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest,
 			entries = append(entries, pi.UserEntry(u))
 		}
 	}
-	pi.log.WithField("filter", searchReq.Filter).Debug("Search OK")
+	pi.log.WithField("filter", req.Filter).Debug("Search OK")
 	return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
 }

@ -96,6 +104,14 @@ func (pi *ProviderInstance) UserEntry(u api.User) *ldap.Entry {
 			Name:   "objectClass",
 			Values: []string{UserObjectClass, "organizationalPerson", "goauthentik.io/ldap/user"},
 		},
+		{
+			Name:   "uidNumber",
+			Values: []string{pi.GetUidNumber(u)},
+		},
+		{
+			Name:   "gidNumber",
+			Values: []string{pi.GetUidNumber(u)},
+		},
 	}

 	attrs = append(attrs, &ldap.EntryAttribute{Name: "memberOf", Values: pi.GroupsForUser(u)})
@ -109,28 +125,45 @@ func (pi *ProviderInstance) UserEntry(u api.User) *ldap.Entry {

 	attrs = append(attrs, AKAttrsToLDAP(u.Attributes)...)

-	dn := fmt.Sprintf("cn=%s,%s", u.Username, pi.UserDN)
+	dn := pi.GetUserDN(u.Username)

 	return &ldap.Entry{DN: dn, Attributes: attrs}
 }

-func (pi *ProviderInstance) GroupEntry(g api.Group) *ldap.Entry {
+func (pi *ProviderInstance) GroupEntry(g LDAPGroup) *ldap.Entry {
 	attrs := []*ldap.EntryAttribute{
 		{
 			Name:   "cn",
-			Values: []string{g.Name},
+			Values: []string{g.cn},
 		},
 		{
 			Name:   "uid",
-			Values: []string{string(g.Pk)},
+			Values: []string{g.uid},
 		},
 		{
-			Name:   "objectClass",
-			Values: []string{GroupObjectClass, "goauthentik.io/ldap/group"},
+			Name:   "gidNumber",
+			Values: []string{g.gidNumber},
 		},
 	}
-	attrs = append(attrs, AKAttrsToLDAP(g.Attributes)...)

-	dn := pi.GetGroupDN(g)
-	return &ldap.Entry{DN: dn, Attributes: attrs}
+	if g.isVirtualGroup {
+		attrs = append(attrs, &ldap.EntryAttribute{
+			Name:   "objectClass",
+			Values: []string{GroupObjectClass, "goauthentik.io/ldap/group", "goauthentik.io/ldap/virtual-group"},
+		})
+	} else {
+		attrs = append(attrs, &ldap.EntryAttribute{
+			Name:   "objectClass",
+			Values: []string{GroupObjectClass, "goauthentik.io/ldap/group"},
+		})
+	}
+
+	attrs = append(attrs, &ldap.EntryAttribute{Name: "member", Values: g.member})
+	attrs = append(attrs, &ldap.EntryAttribute{Name: "goauthentik.io/ldap/superuser", Values: []string{BoolToString(g.isSuperuser)}})
+
+	if g.akAttributes != nil {
+		attrs = append(attrs, AKAttrsToLDAP(g.akAttributes)...)
+	}
+
+	return &ldap.Entry{DN: g.dn, Attributes: attrs}
 }
--- a/internal/outpost/ldap/ldap.go
+++ b/internal/outpost/ldap/ldap.go
@ -1,12 +1,14 @@
 package ldap

 import (
+	"crypto/tls"
 	"sync"

 	"github.com/go-openapi/strfmt"
 	log "github.com/sirupsen/logrus"
-	"goauthentik.io/outpost/api"
-	"goauthentik.io/outpost/pkg/ak"
+	"goauthentik.io/api"
+	"goauthentik.io/internal/crypto"
+	"goauthentik.io/internal/outpost/ak"

 	"github.com/nmcclain/ldap"
 )
@ -25,9 +27,15 @@ type ProviderInstance struct {
 	s        *LDAPServer
 	log      *log.Entry

+	tlsServerName *string
+	cert          *tls.Certificate
+
 	searchAllowedGroups []*strfmt.UUID
 	boundUsersMutex     sync.RWMutex
 	boundUsers          map[string]UserFlags
+
+	uidStartNumber int32
+	gidStartNumber int32
 }

 type UserFlags struct {
@ -36,11 +44,22 @@ type UserFlags struct {
 }

 type LDAPServer struct {
-	s   *ldap.Server
-	log *log.Entry
-	ac  *ak.APIController
+	s           *ldap.Server
+	log         *log.Entry
+	ac          *ak.APIController
+	defaultCert *tls.Certificate
+	providers   []*ProviderInstance
+}

-	providers []*ProviderInstance
+type LDAPGroup struct {
+	dn             string
+	cn             string
+	uid            string
+	gidNumber      string
+	member         []string
+	isSuperuser    bool
+	isVirtualGroup bool
+	akAttributes   interface{}
 }

 func NewServer(ac *ak.APIController) *LDAPServer {
@ -52,6 +71,11 @@ func NewServer(ac *ak.APIController) *LDAPServer {
 		ac:        ac,
 		providers: []*ProviderInstance{},
 	}
+	defaultCert, err := crypto.GenerateSelfSignedCert()
+	if err != nil {
+		log.Warning(err)
+	}
+	ls.defaultCert = &defaultCert
 	s.BindFunc("", ls)
 	s.SearchFunc("", ls)
 	return ls
--- a/internal/outpost/ldap/search.go
+++ b/internal/outpost/ldap/search.go
@ -3,25 +3,46 @@ package ldap
 import (
 	"errors"
 	"net"
+	"strings"

 	goldap "github.com/go-ldap/ldap/v3"
+	"github.com/google/uuid"
 	"github.com/nmcclain/ldap"
+	log "github.com/sirupsen/logrus"
 )

+type SearchRequest struct {
+	ldap.SearchRequest
+	BindDN string
+	id     string
+	conn   net.Conn
+	log    *log.Entry
+}
+
 func (ls *LDAPServer) Search(bindDN string, searchReq ldap.SearchRequest, conn net.Conn) (ldap.ServerSearchResult, error) {
-	ls.log.WithField("bindDN", bindDN).WithField("baseDN", searchReq.BaseDN).Info("search")
+	bindDN = strings.ToLower(bindDN)
+	rid := uuid.New().String()
+	req := SearchRequest{
+		SearchRequest: searchReq,
+		BindDN:        bindDN,
+		conn:          conn,
+		log:           ls.log.WithField("bindDN", bindDN).WithField("requestId", rid).WithField("client", conn.RemoteAddr().String()).WithField("filter", searchReq.Filter).WithField("baseDN", searchReq.BaseDN),
+		id:            rid,
+	}
+	req.log.Info("Search request")
+
 	if searchReq.BaseDN == "" {
 		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultSuccess}, nil
 	}
 	bd, err := goldap.ParseDN(searchReq.BaseDN)
 	if err != nil {
-		ls.log.WithField("baseDN", searchReq.BaseDN).WithError(err).Info("failed to parse basedn")
+		req.log.WithError(err).Info("failed to parse basedn")
 		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, errors.New("invalid DN")
 	}
 	for _, provider := range ls.providers {
 		providerBase, _ := goldap.ParseDN(provider.BaseDN)
 		if providerBase.AncestorOf(bd) {
-			return provider.Search(bindDN, searchReq, conn)
+			return provider.Search(req)
 		}
 	}
 	return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, errors.New("no provider could handle request")
--- a/internal/outpost/ldap/utils.go
+++ b/internal/outpost/ldap/utils.go
@ -0,0 +1,138 @@
+package ldap
+
+import (
+	"fmt"
+	"math/big"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"github.com/nmcclain/ldap"
+	log "github.com/sirupsen/logrus"
+	"goauthentik.io/api"
+)
+
+func BoolToString(in bool) string {
+	if in {
+		return "true"
+	}
+	return "false"
+}
+
+func ldapResolveTypeSingle(in interface{}) *string {
+	switch t := in.(type) {
+	case string:
+		return &t
+	case *string:
+		return t
+	case bool:
+		s := BoolToString(t)
+		return &s
+	case *bool:
+		s := BoolToString(*t)
+		return &s
+	default:
+		log.WithField("type", reflect.TypeOf(in).String()).Warning("Type can't be mapped to LDAP yet")
+		return nil
+	}
+}
+
+func AKAttrsToLDAP(attrs interface{}) []*ldap.EntryAttribute {
+	attrList := []*ldap.EntryAttribute{}
+	a := attrs.(*map[string]interface{})
+	for attrKey, attrValue := range *a {
+		entry := &ldap.EntryAttribute{Name: attrKey}
+		switch t := attrValue.(type) {
+		case []string:
+			entry.Values = t
+		case *[]string:
+			entry.Values = *t
+		case []interface{}:
+			entry.Values = make([]string, len(t))
+			for idx, v := range t {
+				v := ldapResolveTypeSingle(v)
+				entry.Values[idx] = *v
+			}
+		default:
+			v := ldapResolveTypeSingle(t)
+			if v != nil {
+				entry.Values = []string{*v}
+			}
+		}
+		attrList = append(attrList, entry)
+	}
+	return attrList
+}
+
+func (pi *ProviderInstance) GroupsForUser(user api.User) []string {
+	groups := make([]string, len(user.Groups))
+	for i, group := range user.Groups {
+		groups[i] = pi.GetGroupDN(group.Name)
+	}
+	return groups
+}
+
+func (pi *ProviderInstance) UsersForGroup(group api.Group) []string {
+	users := make([]string, len(group.UsersObj))
+	for i, user := range group.UsersObj {
+		users[i] = pi.GetUserDN(user.Username)
+	}
+	return users
+}
+
+func (pi *ProviderInstance) APIGroupToLDAPGroup(g api.Group) LDAPGroup {
+	return LDAPGroup{
+		dn:             pi.GetGroupDN(g.Name),
+		cn:             g.Name,
+		uid:            string(g.Pk),
+		gidNumber:      pi.GetGidNumber(g),
+		member:         pi.UsersForGroup(g),
+		isVirtualGroup: false,
+		isSuperuser:    *g.IsSuperuser,
+		akAttributes:   g.Attributes,
+	}
+}
+
+func (pi *ProviderInstance) APIUserToLDAPGroup(u api.User) LDAPGroup {
+	return LDAPGroup{
+		dn:             pi.GetGroupDN(u.Username),
+		cn:             u.Username,
+		uid:            u.Uid,
+		gidNumber:      pi.GetUidNumber(u),
+		member:         []string{pi.GetUserDN(u.Username)},
+		isVirtualGroup: true,
+		isSuperuser:    false,
+		akAttributes:   nil,
+	}
+}
+
+func (pi *ProviderInstance) GetUserDN(user string) string {
+	return fmt.Sprintf("cn=%s,%s", user, pi.UserDN)
+}
+
+func (pi *ProviderInstance) GetGroupDN(group string) string {
+	return fmt.Sprintf("cn=%s,%s", group, pi.GroupDN)
+}
+
+func (pi *ProviderInstance) GetUidNumber(user api.User) string {
+	return strconv.FormatInt(int64(pi.uidStartNumber+user.Pk), 10)
+}
+
+func (pi *ProviderInstance) GetGidNumber(group api.Group) string {
+	return strconv.FormatInt(int64(pi.gidStartNumber+pi.GetRIDForGroup(group.Pk)), 10)
+}
+
+func (pi *ProviderInstance) GetRIDForGroup(uid string) int32 {
+	var i big.Int
+	i.SetString(strings.Replace(uid, "-", "", -1), 16)
+	intStr := i.String()
+
+	// Get the last 5 characters/digits of the int-version of the UUID
+	gid, err := strconv.Atoi(intStr[len(intStr)-5:])
+
+	if err != nil {
+		panic(err)
+	}
+
+	return int32(gid)
+}
--- a/internal/outpost/proxy/api.go
+++ b/internal/outpost/proxy/api.go
@ -4,7 +4,7 @@ import (
 	"net/url"

 	log "github.com/sirupsen/logrus"
-	"goauthentik.io/outpost/api"
+	"goauthentik.io/api"
 )

 func (s *Server) Refresh() error {
--- a/internal/outpost/proxy/api_bundle.go
+++ b/internal/outpost/proxy/api_bundle.go
@ -1,7 +1,6 @@
 package proxy

 import (
-	"context"
 	"crypto/tls"
 	"net"
 	"net/http"
@ -15,7 +14,8 @@ import (
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/middleware"
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/validation"
 	log "github.com/sirupsen/logrus"
-	"goauthentik.io/outpost/api"
+	"goauthentik.io/api"
+	"goauthentik.io/internal/outpost/ak"
 )

 type providerBundle struct {
@ -90,23 +90,12 @@ func (pb *providerBundle) prepareOpts(provider api.ProxyOutpostConfig) *options.

 	if provider.Certificate.Get() != nil {
 		pb.log.WithField("provider", provider.Name).Debug("Enabling TLS")
-		cert, _, err := pb.s.ak.Client.CryptoApi.CryptoCertificatekeypairsViewCertificateRetrieve(context.Background(), *provider.Certificate.Get()).Execute()
+		cert, err := ak.ParseCertificate(*provider.Certificate.Get(), pb.s.ak.Client.CryptoApi)
 		if err != nil {
 			pb.log.WithField("provider", provider.Name).WithError(err).Warning("Failed to fetch certificate")
 			return providerOpts
 		}
-		key, _, err := pb.s.ak.Client.CryptoApi.CryptoCertificatekeypairsViewPrivateKeyRetrieve(context.Background(), *provider.Certificate.Get()).Execute()
-		if err != nil {
-			pb.log.WithField("provider", provider.Name).WithError(err).Warning("Failed to fetch private key")
-			return providerOpts
-		}
-
-		x509cert, err := tls.X509KeyPair([]byte(cert.Data), []byte(key.Data))
-		if err != nil {
-			pb.log.WithField("provider", provider.Name).WithError(err).Warning("Failed to parse certificate")
-			return providerOpts
-		}
-		pb.cert = &x509cert
+		pb.cert = cert
 		pb.log.WithField("provider", provider.Name).Debug("Loaded certificates")
 	}
 	return providerOpts
--- a/internal/outpost/proxy/claims.go
+++ b/internal/outpost/proxy/claims.go
--- a/internal/outpost/proxy/common.go
+++ b/internal/outpost/proxy/common.go
--- a/internal/outpost/proxy/cookies.go
+++ b/internal/outpost/proxy/cookies.go
@ -8,7 +8,6 @@ import (

 	sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/cookies"
-	"github.com/oauth2-proxy/oauth2-proxy/pkg/util"
 )

 // MakeCSRFCookie creates a cookie for CSRF
@ -20,7 +19,7 @@ func (p *OAuthProxy) makeCookie(req *http.Request, name string, value string, ex
 	cookieDomain := cookies.GetCookieDomain(req, p.CookieDomains)

 	if cookieDomain != "" {
-		domain := util.GetRequestHost(req)
+		domain := getHost(req)
 		if h, _, err := net.SplitHostPort(domain); err == nil {
 			domain = h
 		}
--- a/internal/outpost/proxy/middleware.go
+++ b/internal/outpost/proxy/middleware.go
--- a/internal/outpost/proxy/oauth.go
+++ b/internal/outpost/proxy/oauth.go
@ -10,7 +10,6 @@ import (

 	sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
-	"github.com/oauth2-proxy/oauth2-proxy/pkg/ip"
 )

 // GetRedirectURI returns the redirectURL that the upstream OAuth Provider will
@ -165,8 +164,6 @@ func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {
 // OAuthCallback is the OAuth2 authentication flow callback that finishes the
 // OAuth2 authentication flow
 func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
-	remoteAddr := ip.GetClientString(p.realClientIPParser, req, true)
-
 	// finish the oauth cycle
 	err := req.ParseForm()
 	if err != nil {
@ -218,7 +215,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
 		p.logger.WithField("user", session.Email).WithField("status", "AuthFailure").Infof("Authenticated via OAuth2: %s", session)
 		err := p.SaveSession(rw, req, session)
 		if err != nil {
-			p.logger.Printf("Error saving session state for %s: %v", remoteAddr, err)
+			p.logger.Printf("Error saving session state for client %v", err)
 			p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())
 			return
 		}
--- a/internal/outpost/proxy/proxy.go
+++ b/internal/outpost/proxy/proxy.go
@ -14,14 +14,13 @@ import (

 	"github.com/coreos/go-oidc"
 	"github.com/justinas/alice"
-	ipapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/ip"
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
 	sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/middleware"
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/sessions"
 	"github.com/oauth2-proxy/oauth2-proxy/pkg/upstream"
 	"github.com/oauth2-proxy/oauth2-proxy/providers"
-	"goauthentik.io/outpost/api"
+	"goauthentik.io/api"

 	log "github.com/sirupsen/logrus"
 )
@ -91,7 +90,6 @@ type OAuthProxy struct {
 	extraJwtBearerVerifiers []*oidc.IDTokenVerifier
 	compiledRegex           []*regexp.Regexp
 	templates               *template.Template
-	realClientIPParser      ipapi.RealClientIPParser

 	sessionChain alice.Chain

@ -160,7 +158,6 @@ func NewOAuthProxy(opts *options.Options, provider api.ProxyOutpostConfig, c *ht
 		mainJwtBearerVerifier:   opts.GetOIDCVerifier(),
 		extraJwtBearerVerifiers: opts.GetJWTBearerVerifiers(),
 		compiledRegex:           opts.GetCompiledRegex(),
-		realClientIPParser:      opts.GetRealClientIPParser(),
 		SetXAuthRequest:         opts.SetXAuthRequest,
 		SetBasicAuth:            opts.SetBasicAuth,
 		PassUserHeaders:         opts.PassUserHeaders,
@ -238,6 +235,7 @@ func (p *OAuthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	if req.URL.Path != p.AuthOnlyPath && strings.HasPrefix(req.URL.Path, p.ProxyPrefix) {
 		prepareNoCache(rw)
 	}
+	rw.Header().Set("Server", "authentik-outpost")

 	switch path := req.URL.Path; {
 	case path == p.RobotsPath:
@ -410,6 +408,8 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R

 // addHeadersForProxying adds the appropriate headers the request / response for proxying
 func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Request, session *sessionsapi.SessionState) {
+	// req is the request that is forwarded to the upstream server
+	// rw is the response writer that goes back to the client
 	req.Header["X-Forwarded-User"] = []string{session.User}
 	if session.Email != "" {
 		req.Header["X-Forwarded-Email"] = []string{session.Email}
--- a/internal/outpost/proxy/server.go
+++ b/internal/outpost/proxy/server.go
@ -10,7 +10,8 @@ import (
 	"time"

 	log "github.com/sirupsen/logrus"
-	"goauthentik.io/outpost/pkg/ak"
+	"goauthentik.io/internal/crypto"
+	"goauthentik.io/internal/outpost/ak"
 )

 // Server represents an HTTP server
@ -25,7 +26,7 @@ type Server struct {

 // NewServer initialise a new HTTP Server
 func NewServer(ac *ak.APIController) *Server {
-	defaultCert, err := ak.GenerateSelfSignedCert()
+	defaultCert, err := crypto.GenerateSelfSignedCert()
 	if err != nil {
 		log.Warning(err)
 	}
--- a/internal/outpost/proxy/server_https.go
+++ b/internal/outpost/proxy/server_https.go
@ -4,6 +4,8 @@ import (
 	"crypto/tls"
 	"net"
 	"sync"
+
+	"github.com/pires/go-proxyproto"
 )

 // ServeHTTP constructs a net.Listener and starts handling HTTP requests
@ -13,8 +15,11 @@ func (s *Server) ServeHTTP() {
 	if err != nil {
 		s.logger.Fatalf("FATAL: listen (%s) failed - %s", listenAddress, err)
 	}
+	proxyListener := &proxyproto.Listener{Listener: listener}
+	defer proxyListener.Close()
+
 	s.logger.Printf("listening on %s", listener.Addr())
-	s.serve(listener)
+	s.serve(proxyListener)
 	s.logger.Printf("closing %s", listener.Addr())
 }

@ -46,7 +51,10 @@ func (s *Server) ServeHTTPS() {
 	}
 	s.logger.Printf("listening on %s", ln.Addr())

-	tlsListener := tls.NewListener(tcpKeepAliveListener{ln.(*net.TCPListener)}, config)
+	proxyListener := &proxyproto.Listener{Listener: tcpKeepAliveListener{ln.(*net.TCPListener)}}
+	defer proxyListener.Close()
+
+	tlsListener := tls.NewListener(proxyListener, config)
 	s.serve(tlsListener)
 	s.logger.Printf("closing %s", tlsListener.Addr())
 }
--- a/internal/outpost/proxy/templates.go
+++ b/internal/outpost/proxy/templates.go
--- a/internal/outpost/proxy/utils.go
+++ b/internal/outpost/proxy/utils.go
--- a/internal/web/middleware_sentry.go
+++ b/internal/web/middleware_sentry.go
@ -5,10 +5,12 @@ import (
 	"net/http"

 	sentryhttp "github.com/getsentry/sentry-go/http"
+	log "github.com/sirupsen/logrus"
 )

 func recoveryMiddleware() func(next http.Handler) http.Handler {
 	sentryHandler := sentryhttp.New(sentryhttp.Options{})
+	l := log.WithField("logger", "authentik.sentry")
 	return func(next http.Handler) http.Handler {
 		sentryHandler.Handle(next)
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@ -20,6 +22,7 @@ func recoveryMiddleware() func(next http.Handler) http.Handler {
 				}
 				err := re.(error)
 				if err != nil {
+					l.WithError(err).Warning("global panic handler")
 					jsonBody, _ := json.Marshal(struct {
 						Successful bool
 						Error      string
@ -30,7 +33,10 @@ func recoveryMiddleware() func(next http.Handler) http.Handler {

 					w.Header().Set("Content-Type", "application/json")
 					w.WriteHeader(http.StatusInternalServerError)
-					w.Write(jsonBody)
+					_, err := w.Write(jsonBody)
+					if err != nil {
+						l.WithError(err).Warning("Failed to write sentry error body")
+					}
 				}
 			}()
 		})
--- a/internal/web/web.go
+++ b/internal/web/web.go
@ -5,10 +5,10 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"sync"

 	"github.com/gorilla/handlers"
 	"github.com/gorilla/mux"
+	"github.com/pires/go-proxyproto"
 	log "github.com/sirupsen/logrus"
 	"goauthentik.io/internal/config"
 )
@ -48,18 +48,13 @@ func NewWebServer() *WebServer {
 	return ws
 }

-func (ws *WebServer) Run() {
-	wg := sync.WaitGroup{}
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		ws.listenPlain()
-	}()
-	go func() {
-		defer wg.Done()
-		ws.listenTLS()
-	}()
-	wg.Done()
+func (ws *WebServer) Start() {
+	go ws.listenPlain()
+	go ws.listenTLS()
+}
+
+func (ws *WebServer) Shutdown() {
+	ws.stop <- struct{}{}
 }

 func (ws *WebServer) listenPlain() {
@ -69,10 +64,16 @@ func (ws *WebServer) listenPlain() {
 	}
 	ws.log.WithField("addr", config.G.Web.Listen).Info("Running")

-	ws.serve(ln)
+	proxyListener := &proxyproto.Listener{Listener: ln}
+	defer proxyListener.Close()
+
+	ws.serve(proxyListener)

 	ws.log.WithField("addr", config.G.Web.Listen).Info("Running")
-	http.ListenAndServe(config.G.Web.Listen, ws.m)
+	err = http.ListenAndServe(config.G.Web.Listen, ws.m)
+	if err != nil && !errors.Is(err, http.ErrServerClosed) {
+		ws.log.Errorf("ERROR: http.Serve() - %s", err)
+	}
 }

 func (ws *WebServer) serve(listener net.Listener) {
--- a/internal/web/web_ssl.go
+++ b/internal/web/web_ssl.go
@ -4,6 +4,7 @@ import (
 	"crypto/tls"
 	"net"

+	"github.com/pires/go-proxyproto"
 	"goauthentik.io/internal/config"
 	"goauthentik.io/internal/crypto"
 )
@ -23,10 +24,14 @@ func (ws *WebServer) listenTLS() {
 	ln, err := net.Listen("tcp", config.G.Web.ListenTLS)
 	if err != nil {
 		ws.log.WithError(err).Fatalf("failed to listen")
+		return
 	}
 	ws.log.WithField("addr", config.G.Web.ListenTLS).Info("Running")

-	tlsListener := tls.NewListener(tcpKeepAliveListener{ln.(*net.TCPListener)}, tlsConfig)
+	proxyListener := &proxyproto.Listener{Listener: tcpKeepAliveListener{ln.(*net.TCPListener)}}
+	defer proxyListener.Close()
+
+	tlsListener := tls.NewListener(proxyListener, tlsConfig)
 	ws.serve(tlsListener)
 	ws.log.Printf("closing %s", tlsListener.Addr())
 }
--- a/internal/web/web_static.go
+++ b/internal/web/web_static.go
@ -6,6 +6,7 @@ import (
 	"goauthentik.io/internal/config"
 	"goauthentik.io/internal/constants"
 	staticWeb "goauthentik.io/web"
+	staticDocs "goauthentik.io/website"
 )

 func (ws *WebServer) configureStatic() {
@ -16,23 +17,30 @@ func (ws *WebServer) configureStatic() {
 		ws.log.Debug("Using local static files")
 		statRouter.PathPrefix("/static/dist").Handler(http.StripPrefix("/static/dist", http.FileServer(http.Dir("./web/dist"))))
 		statRouter.PathPrefix("/static/authentik").Handler(http.StripPrefix("/static/authentik", http.FileServer(http.Dir("./web/authentik"))))
-		statRouter.PathPrefix("/media").Handler(http.StripPrefix("/media", fs))
+		statRouter.PathPrefix("/help").Handler(http.StripPrefix("/help", http.FileServer(http.Dir("./website/help"))))
 	} else {
 		statRouter.Use(ws.staticHeaderMiddleware)
 		ws.log.Debug("Using packaged static files with aggressive caching")
 		statRouter.PathPrefix("/static/dist").Handler(http.StripPrefix("/static", http.FileServer(http.FS(staticWeb.StaticDist))))
 		statRouter.PathPrefix("/static/authentik").Handler(http.StripPrefix("/static", http.FileServer(http.FS(staticWeb.StaticAuthentik))))
-		statRouter.PathPrefix("/media").Handler(http.StripPrefix("/media", fs))
+		statRouter.PathPrefix("/help").Handler(http.FileServer(http.FS(staticDocs.Help)))
 	}
+	statRouter.PathPrefix("/media").Handler(http.StripPrefix("/media", fs))
 	ws.lh.Path("/robots.txt").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header()["Content-Type"] = []string{"text/plain"}
 		rw.WriteHeader(200)
-		rw.Write(staticWeb.RobotsTxt)
+		_, err := rw.Write(staticWeb.RobotsTxt)
+		if err != nil {
+			ws.log.WithError(err).Warning("failed to write response")
+		}
 	})
 	ws.lh.Path("/.well-known/security.txt").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header()["Content-Type"] = []string{"text/plain"}
 		rw.WriteHeader(200)
-		rw.Write(staticWeb.SecurityTxt)
+		_, err := rw.Write(staticWeb.SecurityTxt)
+		if err != nil {
+			ws.log.WithError(err).Warning("failed to write response")
+		}
 	})
 }

--- a/outpost/ldap.Dockerfile
+++ b/outpost/ldap.Dockerfile
@ -9,19 +9,19 @@ RUN	docker-entrypoint.sh generate \
    --git-user-id api \
    -i /local/schema.yml \
    -g go \
-    -o /local/outpost/api \
+    -o /local/api \
    --additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true && \
-    rm -f /local/outpost/api/go.mod /local/outpost/api/go.sum
+    rm -f /local/api/go.mod /local/api/go.sum

 # Stage 2: Build
-FROM golang:1.16.5 AS builder
+FROM golang:1.16.6 AS builder
 ARG GIT_BUILD_HASH
 ENV GIT_BUILD_HASH=$GIT_BUILD_HASH

-WORKDIR /go/src/goauthentik.io/outpost
+WORKDIR /go/src/goauthentik.io

-COPY ./outpost .
-COPY --from=api-builder /local/outpost/api api
+COPY . .
+COPY --from=api-builder /local/api api

 RUN go build -o /go/ldap ./cmd/ldap

--- a/lifecycle/migrate.py
+++ b/lifecycle/migrate.py
@ -40,6 +40,7 @@ if __name__ == "__main__":
        user=CONFIG.y("postgresql.user"),
        password=CONFIG.y("postgresql.password"),
        host=CONFIG.y("postgresql.host"),
+        port=int(CONFIG.y("postgresql.port")),
    )
    curr = conn.cursor()
    # lock an advisory lock to prevent multiple instances from migrating at once
--- a/lifecycle/wait_for_db.py
+++ b/lifecycle/wait_for_db.py
@ -40,11 +40,15 @@ while True:
        sleep(1)
        j_print(f"PostgreSQL Connection failed, retrying... ({exc})")

+REDIS_PROTOCOL_PREFIX = "redis://"
+if CONFIG.y_bool("redis.tls", False):
+    REDIS_PROTOCOL_PREFIX = "rediss://"
 while True:
    try:
        redis = Redis.from_url(
-            f"redis://:{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:6379"
-            f"/{CONFIG.y('redis.ws_db')}"
+            f"{REDIS_PROTOCOL_PREFIX}:"
+            f"{CONFIG.y('redis.password')}@{CONFIG.y('redis.host')}:"
+            f"{int(CONFIG.y('redis.port'))}/{CONFIG.y('redis.ws_db')}"
        )
        redis.ping()
        break
--- a/outpost/.dockerignore
+++ b/outpost/.dockerignore
@ -1,2 +0,0 @@
-Dockerfile.*
-.git
--- a/outpost/.gitignore
+++ b/outpost/.gitignore
@ -1 +0,0 @@
-api/
--- a/outpost/Makefile
+++ b/outpost/Makefile
@ -1,5 +0,0 @@
-all: clean
-
-clean:
-	go mod tidy
-	go clean .
--- a/outpost/README.md
+++ b/outpost/README.md
@ -1,27 +0,0 @@
-# authentik outpost
-
-[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/8?style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=8)
-![Docker pulls (proxy)](https://img.shields.io/docker/pulls/beryju/authentik-proxy.svg?style=flat-square)
-![Docker pulls (ldap)](https://img.shields.io/docker/pulls/beryju/authentik-ldap.svg?style=flat-square)
-
-Reverse Proxy based on [oauth2_proxy](https://github.com/oauth2-proxy/oauth2-proxy), completely managed and monitored by authentik.
-
-LDAP Server using [ldap](https://github.com/nmcclain/ldap), completely managed and monitored by authentik.
-
-## Usage
-
-authentik Outpost is built to be configured by authentik itself, hence the only options you can directly give it are connection params.
-
-The following environment variable are implemented:
-
-`AUTHENTIK_HOST`: Full URL to the authentik instance with protocol, i.e. "https://authentik.company.tld"
-
-`AUTHENTIK_TOKEN`: Token used to authenticate against authentik. This is generated after an Outpost instance is created.
-
-`AUTHENTIK_INSECURE`: This environment variable can optionally be set to ignore the SSL Certificate of the authentik instance. Applies to both HTTP and WS connections.
-
-## Development
-
-authentik outpost uses an auto-generated API Client to communicate with authentik. This client is not kept in git. To generate the client locally, run `make gen-outpost` in the root directory of the repo.
-
-Afterwards you can build the outpost like any other Go project, using `go build ./cmd/proxy/server.go` or `go build ./cmd/ldap/server.go`.
--- a/outpost/go.mod
+++ b/outpost/go.mod
@ -1,46 +0,0 @@
-module goauthentik.io/outpost
-
-go 1.16
-
-require (
-	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/coreos/go-oidc v2.2.1+incompatible
-	github.com/getsentry/sentry-go v0.11.0
-	github.com/go-ldap/ldap/v3 v3.3.0
-	github.com/go-openapi/analysis v0.20.1 // indirect
-	github.com/go-openapi/errors v0.20.0 // indirect
-	github.com/go-openapi/runtime v0.19.29
-	github.com/go-openapi/strfmt v0.20.1
-	github.com/go-openapi/swag v0.19.15 // indirect
-	github.com/go-openapi/validate v0.20.2 // indirect
-	github.com/go-redis/redis/v7 v7.4.0 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.2.0
-	github.com/gorilla/websocket v1.4.2
-	github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a
-	github.com/justinas/alice v1.2.0
-	github.com/kr/pretty v0.2.1 // indirect
-	github.com/magiconair/properties v1.8.5 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 // indirect
-	github.com/nmcclain/ldap v0.0.0-20191021200707-3b3b69a7e9e3
-	github.com/oauth2-proxy/oauth2-proxy v0.0.0-20200831161845-e4e5580852dc
-	github.com/pelletier/go-toml v1.9.1 // indirect
-	github.com/pkg/errors v0.9.1
-	github.com/pquerna/cachecontrol v0.0.0-20201205024021-ac21108117ac // indirect
-	github.com/recws-org/recws v1.3.1
-	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/afero v1.6.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/spf13/viper v1.7.1 // indirect
-	go.mongodb.org/mongo-driver v1.5.2 // indirect
-	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 // indirect
-	golang.org/x/net v0.0.0-20210510120150-4163338589ed // indirect
-	golang.org/x/oauth2 v0.0.0-20210323180902-22b0adad7558 // indirect
-	golang.org/x/sys v0.0.0-20210514084401-e8d321eab015 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	gopkg.in/ini.v1 v1.62.0 // indirect
-	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
-)
--- a/outpost/go.sum
+++ b/outpost/go.sum
--- a/outpost/pkg/ak/api_uag.go
+++ b/outpost/pkg/ak/api_uag.go
@ -1,20 +0,0 @@
-package ak
-
-import "net/http"
-
-func SetUserAgent(inner http.RoundTripper, userAgent string) http.RoundTripper {
-	return &addUGA{
-		inner: inner,
-		Agent: userAgent,
-	}
-}
-
-type addUGA struct {
-	inner http.RoundTripper
-	Agent string
-}
-
-func (ug *addUGA) RoundTrip(r *http.Request) (*http.Response, error) {
-	r.Header.Set("User-Agent", ug.Agent)
-	return ug.inner.RoundTrip(r)
-}
--- a/Show More
+++ b/Show More