add Registration closed note

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.5.3
+current_version = 2023.6.1
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)

.github/ISSUE_TEMPLATE/hackathon_idea.md

@@ -0,0 +1,17 @@
+---
+name: Hackathon Idea
+about: Propose an idea for the hackathon
+title: ""
+labels: hackathon
+assignees: ""
+---
+
+**Describe the idea**
+
+A clear concise description of the idea you want to implement
+
+You're also free to work on existing GitHub issues, whether they be feature requests or bugs, just link the existing GitHub issue here.
+
+<!-- Don't modify below here -->
+
+If you want to help working on this idea or want to contribute in any other way, react to this issue with a :rocket:

.github/dependabot.yml

@@ -24,6 +24,18 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "web:"
+    groups:
+      sentry:
+        patterns:
+          - "@sentry/*"
+      babel:
+        patterns:
+          - "@babel/*"
+          - "babel-*"
+      storybook:
+        patterns:
+          - "@storybook/*"
+          - "*storybook*"
   - package-ecosystem: npm
     directory: "/website"
     schedule:
@@ -32,6 +44,10 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "website:"
+    groups:
+      docusaurus:
+        patterns:
+          - "@docusaurus/*"
   - package-ecosystem: pip
     directory: "/"
     schedule:

.github/stale.yml

@@ -1,19 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 60
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - pinned
-  - security
-  - pr_wanted
-  - enhancement
-  - bug/confirmed
-  - enhancement/confirmed
-  - question
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-only: issues

.github/transifex.yml

@@ -2,11 +2,11 @@ git:
   filters:
     - filter_type: file
       # all supported i18n types: https://docs.transifex.com/formats
-      file_format: PO
+      file_format: XLIFF
       source_language: en
-      source_file: web/src/locales/en.po
+      source_file: web/xliff/en.xlf
       # path expression to translation files, must contain <lang> placeholder
-      translation_files_expression: "web/src/locales/<lang>.po"
+      translation_files_expression: "web/xliff/<lang>.xlf"
     - filter_type: file
       # all supported i18n types: https://docs.transifex.com/formats
       file_format: PO

.github/workflows/ci-main.yml

@@ -112,7 +112,7 @@ jobs:
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.7.0
+        uses: helm/kind-action@v1.8.0
       - name: run integration
         run: |
           poetry run coverage run manage.py test tests/integration
@@ -190,7 +190,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.1.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -218,6 +218,7 @@ jobs:
             ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
       - name: Comment on PR
         if: github.event_name == 'pull_request'
@@ -234,7 +235,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.1.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -262,5 +263,6 @@ jobs:
             ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}-arm64
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/arm64

.github/workflows/ci-outpost.yml

@@ -29,7 +29,8 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
-          args: --timeout 5000s
+          version: v1.52.2
+          args: --timeout 5000s --verbose
           skip-pkg-cache: true
   test-unittest:
     runs-on: ubuntu-latest
@@ -67,7 +68,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.1.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -94,6 +95,7 @@ jobs:
           file: ${{ matrix.type }}.Dockerfile
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/amd64,linux/arm64
           context: .
@@ -118,7 +120,7 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/ci-web.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/ci-website.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"
@@ -50,7 +50,7 @@ jobs:
           - build-docs-only
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/release-next-branch.yml

@@ -0,0 +1,20 @@
+name: authentik-on-release-next-branch
+
+on:
+  schedule:
+    - cron: "0 12 * * *" # every day at noon
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  update-next:
+    runs-on: ubuntu-latest
+    environment: internal-production
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: main
+      - run: |
+          git push origin --force main:next

.github/workflows/release-publish.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.1.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -43,6 +43,7 @@ jobs:
             ghcr.io/goauthentik/server:latest
           platforms: linux/amd64,linux/arm64
           build-args: |
+            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost:
     runs-on: ubuntu-latest
@@ -59,7 +60,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.1.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -90,6 +91,7 @@ jobs:
           file: ${{ matrix.type }}.Dockerfile
           platforms: linux/amd64,linux/arm64
           build-args: |
+            VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost-binary:
     timeout-minutes: 120
@@ -108,7 +110,7 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/repo-stale.yml

@@ -0,0 +1,33 @@
+name: 'authentik-repo-stale'
+
+on:
+  schedule:
+    - cron: '30 1 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - id: generate_token
+        uses: tibdex/github-app-token@v1
+        with:
+          app_id: ${{ secrets.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+      - uses: actions/stale@v8
+        with:
+          repo-token: ${{ steps.generate_token.outputs.token }}
+          days-before-stale: 60
+          days-before-close: 7
+          exempt-issue-labels: pinned,security,pr_wanted,enhancement,bug/confirmed,enhancement/confirmed,question
+          stale-issue-label: wontfix
+          stale-issue-message: >
+            This issue has been automatically marked as stale because it has not had
+            recent activity. It will be closed if no further activity occurs. Thank you
+            for your contributions.
+          # Don't stale PRs, so only apply to PRs with a non-existent label
+          only-pr-labels: foo

.github/workflows/translation-rename.yml

@@ -0,0 +1,39 @@
+# Rename transifex pull requests to have a correct naming
+name: authentik-translation-transifex-rename
+
+on:
+  pull_request:
+    types: [opened, reopened]
+
+jobs:
+  rename_pr:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.pull_request.user.login == 'transifex-integration[bot]'}}
+    steps:
+      - id: generate_token
+        uses: tibdex/github-app-token@v1
+        with:
+          app_id: ${{ secrets.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+      - name: Get current title
+        id: title
+        env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          title=$(curl -q -L \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${{ github.event.pull_request.number }} | jq -r .title)
+          echo "title=${title}" >> "$GITHUB_OUTPUT"
+      - name: Rename
+        env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          curl -L \
+            -X PATCH \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${{ github.event.pull_request.number }} \
+            -d "{\"title\":\"translate: ${{ steps.title.outputs.title }}\"}"

.github/workflows/web-api-publish.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}
-      - uses: actions/setup-node@v3.6.0
+      - uses: actions/setup-node@v3.7.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -45,8 +45,8 @@ jobs:
           body: "web: bump API Client version"
           delete-branch: true
           signoff: true
-          team-reviewers: "@goauthentik/core"
-          author: authentik bot <github-bot@goauthentik.io>
+          # ID from https://api.github.com/users/authentik-automation[bot]
+          author: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
       - uses: peter-evans/enable-pull-request-automerge@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}

.gitignore

@@ -166,6 +166,7 @@ dmypy.json
 # SageMath parsed files
 
 # Environments
+**/.DS_Store
 
 # Spyder project settings
 
@@ -203,3 +204,4 @@ data/
 
 # Local Netlify folder
 .netlify
+.ruff_cache

.vscode/launch.json

@@ -0,0 +1,27 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Python: PDB attach Server",
+            "type": "python",
+            "request": "attach",
+            "connect": {
+                "host": "localhost",
+                "port": 6800
+            },
+            "justMyCode": true,
+            "django": true
+        },
+        {
+            "name": "Python: PDB attach Worker",
+            "type": "python",
+            "request": "attach",
+            "connect": {
+                "host": "localhost",
+                "port": 6900
+            },
+            "justMyCode": true,
+            "django": true
+        },
+    ]
+}

Dockerfile

@@ -20,7 +20,7 @@ WORKDIR /work/web
 RUN npm ci --include=dev && npm run build
 
 # Stage 3: Poetry to requirements.txt export
-FROM docker.io/python:3.11.3-slim-bullseye AS poetry-locker
+FROM docker.io/python:3.11.4-slim-bullseye AS poetry-locker
 
 WORKDIR /work
 COPY ./pyproject.toml /work
@@ -31,7 +31,7 @@ RUN pip install --no-cache-dir poetry && \
     poetry export -f requirements.txt --dev --output requirements-dev.txt
 
 # Stage 4: Build go proxy
-FROM docker.io/golang:1.20.4-bullseye AS go-builder
+FROM docker.io/golang:1.20.6-bullseye AS go-builder
 
 WORKDIR /work
 
@@ -47,33 +47,34 @@ COPY ./go.sum /work/go.sum
 RUN go build -o /work/authentik ./cmd/server/
 
 # Stage 5: MaxMind GeoIP
-FROM ghcr.io/maxmind/geoipupdate:v5.1 as geoip
+FROM ghcr.io/maxmind/geoipupdate:v6.0 as geoip
 
 ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City"
 ENV GEOIPUPDATE_VERBOSE="true"
+ENV GEOIPUPDATE_ACCOUNT_ID_FILE="/run/secrets/GEOIPUPDATE_ACCOUNT_ID"
+ENV GEOIPUPDATE_LICENSE_KEY_FILE="/run/secrets/GEOIPUPDATE_LICENSE_KEY"
 
 USER root
 RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     --mount=type=secret,id=GEOIPUPDATE_LICENSE_KEY \
     mkdir -p /usr/share/GeoIP && \
-    /bin/sh -c "\
-        export GEOIPUPDATE_ACCOUNT_ID=$(cat /run/secrets/GEOIPUPDATE_ACCOUNT_ID); \
-        export GEOIPUPDATE_LICENSE_KEY=$(cat /run/secrets/GEOIPUPDATE_LICENSE_KEY); \
-        /usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0 \
-    "
+    /bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
 
 # Stage 6: Run
-FROM docker.io/python:3.11.3-slim-bullseye AS final-image
+FROM docker.io/python:3.11.4-slim-bullseye AS final-image
+
+ARG GIT_BUILD_HASH
+ARG VERSION
+ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
 
 LABEL org.opencontainers.image.url https://goauthentik.io
 LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.
 LABEL org.opencontainers.image.source https://github.com/goauthentik/authentik
+LABEL org.opencontainers.image.version ${VERSION}
+LABEL org.opencontainers.image.revision ${GIT_BUILD_HASH}
 
 WORKDIR /
 
-ARG GIT_BUILD_HASH
-ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
-
 COPY --from=poetry-locker /work/requirements.txt /
 COPY --from=poetry-locker /work/requirements-dev.txt /
 COPY --from=geoip /usr/share/GeoIP /geoip

Makefile

@@ -52,7 +52,7 @@ lint:
 migrate:
 	python -m lifecycle.migrate
 
-i18n-extract: i18n-extract-core web-extract
+i18n-extract: i18n-extract-core web-i18n-extract
 
 i18n-extract-core:
 	ak makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
@@ -145,13 +145,14 @@ web-lint-fix:
 
 web-lint:
 	cd web && npm run lint
-	cd web && npm run lit-analyse
+	# TODO: The analyzer hasn't run correctly in awhile.
+	# cd web && npm run lit-analyse
 
 web-check-compile:
 	cd web && npm run tsc
 
-web-extract:
-	cd web && npm run extract
+web-i18n-extract:
+	cd web && npm run extract-locales
 
 #########################
 ## Website

README.md

@@ -15,7 +15,7 @@
 
 ## What is authentik?
 
-Authentik is an open-source Identity Provider that emphasizes flexibility and versatility. It can be seamlessly integrated into existing environments to support new protocols. Authentik is also a great solution for implementing sign-up, recovery, and other similar features in your application, saving you the hassle of dealing with them.
+authentik is an open-source Identity Provider that emphasizes flexibility and versatility. It can be seamlessly integrated into existing environments to support new protocols. authentik is also a great solution for implementing sign-up, recovery, and other similar features in your application, saving you the hassle of dealing with them.
 
 ## Installation
 

SECURITY.md

@@ -1,44 +1,48 @@
-Authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
+authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
+
+## What authentik classifies as a CVE
+
+CVE (Common Vulnerability and Exposure) is a system designed to aggregate all vulnerabilities. As such, a CVE will be issued when there is a either vulnerability or exposure. Per NIST, A vulnerability is:
+
+“Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.”
+
+If it is determined that the issue does qualify as a CVE, a CVE number will be issued to the reporter from GitHub.
+
+Even if the issue is not a CVE, we still greatly appreciate your help in hardening authentik.
 
 ## Supported Versions
 
 (.x being the latest patch release for each version)
 
-| Version   | Supported          |
-| --------- | ------------------ |
-| 2023.4.x  | :white_check_mark: |
-| 2023.5.x  | :white_check_mark: |
+| Version | Supported |
+| --- | --- |
+| 2023.5.x | ✅ |
+| 2023.6.x | ✅ |
 
 ## Reporting a Vulnerability
 
-To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the bug.
+To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the issue.
 
-## Criticality levels
+## Severity levels
 
-### High
+authentik reserves the right to reclassify CVSS as necessary. To determine severity, we will use the CVSS calculator from NVD (https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator). The calculated CVSS score will then be translated into one of the following categories:
 
--   Authorization bypass
--   Circumvention of policies
-
-### Moderate
-
--   Denial-of-Service attacks
-
-### Low
-
--   Unvalidated redirects
--   Issues requiring uncommon setups
+| 0.0 | None |
+| 0.1 – 3.9 | Low |
+| 4.0 – 6.9 | Medium |
+| 7.0 – 8.9 | High |
+| 9.0 – 10.0 | Critical |
 
 ## Disclosure process
 
-1. Issue is reported via Email as listed above.
+1. Report from Github or Issue is reported via Email as listed above.
 2. The authentik Security team will try to reproduce the issue and ask for more information if required.
-3. A criticality level is assigned.
+3. A severity level is assigned.
 4. A fix is created, and if possible tested by the issue reporter.
 5. The fix is backported to other supported versions, and if possible a workaround for other versions is created.
-6. An announcement is sent out with a fixed release date and criticality level of the issue. The announcement will be sent at least 24 hours before the release of the fix
+6. An announcement is sent out with a fixed release date and severity level of the issue. The announcement will be sent at least 24 hours before the release of the security fix.
 7. The fixed version is released for the supported versions.
 
 ## Getting security notifications
 
-To get security notifications, subscribe to the mailing list [here](https://groups.google.com/g/authentik-security-announcements) or join the [discord](https://goauthentik.io/discord) server.
+To get security notifications, subscribe to the mailing list [here](https://groups.google.com/g/authentik-security-announcements) or join the [discord](https://goauthentik.io/discord) server.

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2023.5.3"
+__version__ = "2023.6.1"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/meta.py

@@ -8,6 +8,7 @@ from rest_framework.viewsets import ViewSet
 
 from authentik.core.api.utils import PassiveSerializer
 from authentik.lib.utils.reflection import get_apps
+from authentik.policies.event_matcher.models import model_choices
 
 
 class AppSerializer(PassiveSerializer):
@@ -29,3 +30,17 @@ class AppsViewSet(ViewSet):
         for app in sorted(get_apps(), key=lambda app: app.name):
             data.append({"name": app.name, "label": app.verbose_name})
         return Response(AppSerializer(data, many=True).data)
+
+
+class ModelViewSet(ViewSet):
+    """Read-only view list all installed models"""
+
+    permission_classes = [IsAdminUser]
+
+    @extend_schema(responses={200: AppSerializer(many=True)})
+    def list(self, request: Request) -> Response:
+        """Read-only view list all installed models"""
+        data = []
+        for name, label in model_choices():
+            data.append({"name": name, "label": label})
+        return Response(AppSerializer(data, many=True).data)

authentik/admin/api/system.py

@@ -1,5 +1,4 @@
 """authentik administration overview"""
-import os
 import platform
 from datetime import datetime
 from sys import version as python_version
@@ -34,7 +33,6 @@ class RuntimeDict(TypedDict):
 class SystemSerializer(PassiveSerializer):
     """Get system information."""
 
-    env = SerializerMethodField()
     http_headers = SerializerMethodField()
     http_host = SerializerMethodField()
     http_is_secure = SerializerMethodField()
@@ -43,10 +41,6 @@ class SystemSerializer(PassiveSerializer):
     server_time = SerializerMethodField()
     embedded_outpost_host = SerializerMethodField()
 
-    def get_env(self, request: Request) -> dict[str, str]:
-        """Get Environment"""
-        return os.environ.copy()
-
     def get_http_headers(self, request: Request) -> dict[str, str]:
         """Get HTTP Request headers"""
         headers = {}

authentik/admin/api/workers.py

@@ -19,7 +19,7 @@ class WorkerView(APIView):
     def get(self, request: Request) -> Response:
         """Get currently connected worker count."""
         count = len(CELERY_APP.control.ping(timeout=0.5))
-        # In debug we run with `CELERY_TASK_ALWAYS_EAGER`, so tasks are ran on the main process
+        # In debug we run with `task_always_eager`, so tasks are ran on the main process
         if settings.DEBUG:  # pragma: no cover
             count += 1
         return Response({"count": count})

authentik/admin/tasks.py

@@ -58,7 +58,7 @@ def clear_update_notifications():
 @prefill_task
 def update_latest_version(self: MonitoredTask):
     """Update latest version info"""
-    if CONFIG.y_bool("disable_update_check"):
+    if CONFIG.get_bool("disable_update_check"):
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_status(TaskResult(TaskResultStatus.WARNING, messages=["Version check disabled."]))
         return

authentik/admin/tests/test_api.py

@@ -94,6 +94,11 @@ class TestAdminAPI(TestCase):
         response = self.client.get(reverse("authentik_api:apps-list"))
         self.assertEqual(response.status_code, 200)
 
+    def test_models(self):
+        """Test models API"""
+        response = self.client.get(reverse("authentik_api:models-list"))
+        self.assertEqual(response.status_code, 200)
+
     @reconcile_app("authentik_outposts")
     def test_system(self):
         """Test system API"""

authentik/admin/urls.py

@@ -1,7 +1,7 @@
 """API URLs"""
 from django.urls import path
 
-from authentik.admin.api.meta import AppsViewSet
+from authentik.admin.api.meta import AppsViewSet, ModelViewSet
 from authentik.admin.api.metrics import AdministrationMetricsViewSet
 from authentik.admin.api.system import SystemView
 from authentik.admin.api.tasks import TaskViewSet
@@ -11,6 +11,7 @@ from authentik.admin.api.workers import WorkerView
 api_urlpatterns = [
     ("admin/system_tasks", TaskViewSet, "admin_system_tasks"),
     ("admin/apps", AppsViewSet, "apps"),
+    ("admin/models", ModelViewSet, "models"),
     path(
         "admin/metrics/",
         AdministrationMetricsViewSet.as_view(),

authentik/api/authentication.py

@@ -1,4 +1,5 @@
 """API Authentication"""
+from hmac import compare_digest
 from typing import Any, Optional
 
 from django.conf import settings
@@ -78,7 +79,7 @@ def token_secret_key(value: str) -> Optional[User]:
     and return the service account for the managed outpost"""
     from authentik.outposts.apps import MANAGED_OUTPOST
 
-    if value != settings.SECRET_KEY:
+    if not compare_digest(value, settings.SECRET_KEY):
         return None
     outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
     if not outposts:

authentik/api/templates/api/browser.html

@@ -10,8 +10,6 @@ API Browser - {{ tenant.branding_title }}
 <script src="{% static 'dist/standalone/api-browser/index.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#151515" media="(prefers-color-scheme: light)">
 <meta name="theme-color" content="#151515" media="(prefers-color-scheme: dark)">
-<link rel="icon" href="{{ tenant.branding_favicon }}">
-<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% endblock %}
 
 {% block body %}

authentik/api/tests/test_auth.py

@@ -9,7 +9,7 @@ from rest_framework.exceptions import AuthenticationFailed
 
 from authentik.api.authentication import bearer_auth
 from authentik.blueprints.tests import reconcile_app
-from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
+from authentik.core.models import Token, TokenIntents, User, UserTypes
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.lib.generators import generate_id
 from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
@@ -57,8 +57,8 @@ class TestAPIAuth(TestCase):
     @reconcile_app("authentik_outposts")
     def test_managed_outpost_success(self):
         """Test managed outpost"""
-        user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
-        self.assertEqual(user.attributes[USER_ATTRIBUTE_SA], True)
+        user: User = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
+        self.assertEqual(user.type, UserTypes.INTERNAL_SERVICE_ACCOUNT)
 
     def test_jwt_valid(self):
         """Test valid JWT"""

authentik/api/v3/config.py

@@ -3,6 +3,7 @@ from pathlib import Path
 
 from django.conf import settings
 from django.db import models
+from django.dispatch import Signal
 from drf_spectacular.utils import extend_schema
 from rest_framework.fields import (
     BooleanField,
@@ -21,6 +22,8 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.events.geo import GEOIP_READER
 from authentik.lib.config import CONFIG
 
+capabilities = Signal()
+
 
 class Capabilities(models.TextChoices):
     """Define capabilities which influence which APIs can/should be used"""
@@ -67,12 +70,15 @@ class ConfigView(APIView):
             caps.append(Capabilities.CAN_SAVE_MEDIA)
         if GEOIP_READER.enabled:
             caps.append(Capabilities.CAN_GEO_IP)
-        if CONFIG.y_bool("impersonation"):
+        if CONFIG.get_bool("impersonation"):
             caps.append(Capabilities.CAN_IMPERSONATE)
         if settings.DEBUG:  # pragma: no cover
             caps.append(Capabilities.CAN_DEBUG)
         if "authentik.enterprise" in settings.INSTALLED_APPS:
             caps.append(Capabilities.IS_ENTERPRISE)
+        for _, result in capabilities.send(sender=self):
+            if result:
+                caps.append(result)
         return caps
 
     def get_config(self) -> ConfigSerializer:
@@ -80,17 +86,17 @@ class ConfigView(APIView):
         return ConfigSerializer(
             {
                 "error_reporting": {
-                    "enabled": CONFIG.y("error_reporting.enabled"),
-                    "sentry_dsn": CONFIG.y("error_reporting.sentry_dsn"),
-                    "environment": CONFIG.y("error_reporting.environment"),
-                    "send_pii": CONFIG.y("error_reporting.send_pii"),
-                    "traces_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.4)),
+                    "enabled": CONFIG.get("error_reporting.enabled"),
+                    "sentry_dsn": CONFIG.get("error_reporting.sentry_dsn"),
+                    "environment": CONFIG.get("error_reporting.environment"),
+                    "send_pii": CONFIG.get("error_reporting.send_pii"),
+                    "traces_sample_rate": float(CONFIG.get("error_reporting.sample_rate", 0.4)),
                 },
                 "capabilities": self.get_capabilities(),
-                "cache_timeout": int(CONFIG.y("redis.cache_timeout")),
-                "cache_timeout_flows": int(CONFIG.y("redis.cache_timeout_flows")),
-                "cache_timeout_policies": int(CONFIG.y("redis.cache_timeout_policies")),
-                "cache_timeout_reputation": int(CONFIG.y("redis.cache_timeout_reputation")),
+                "cache_timeout": int(CONFIG.get("redis.cache_timeout")),
+                "cache_timeout_flows": int(CONFIG.get("redis.cache_timeout_flows")),
+                "cache_timeout_policies": int(CONFIG.get("redis.cache_timeout_policies")),
+                "cache_timeout_reputation": int(CONFIG.get("redis.cache_timeout_reputation")),
             }
         )
 

authentik/api/v3/urls.py

@@ -21,9 +21,14 @@ _other_urls = []
 for _authentik_app in get_apps():
     try:
         api_urls = import_module(f"{_authentik_app.name}.urls")
-    except (ModuleNotFoundError, ImportError):
+    except (ModuleNotFoundError, ImportError) as exc:
+        LOGGER.warning("Could not import app's URLs", app_name=_authentik_app.name, exc=exc)
         continue
     if not hasattr(api_urls, "api_urlpatterns"):
+        LOGGER.debug(
+            "App does not define API URLs",
+            app_name=_authentik_app.name,
+        )
         continue
     urls: list = getattr(api_urls, "api_urlpatterns")
     for url in urls:

authentik/blueprints/migrations/0001_initial.py

@@ -30,7 +30,7 @@ def check_blueprint_v1_file(BlueprintInstance: type, path: Path):
             return
         blueprint_file.seek(0)
     instance: BlueprintInstance = BlueprintInstance.objects.filter(path=path).first()
-    rel_path = path.relative_to(Path(CONFIG.y("blueprints_dir")))
+    rel_path = path.relative_to(Path(CONFIG.get("blueprints_dir")))
     meta = None
     if metadata:
         meta = from_dict(BlueprintMetadata, metadata)
@@ -55,7 +55,7 @@ def migration_blueprint_import(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
     Flow = apps.get_model("authentik_flows", "Flow")
 
     db_alias = schema_editor.connection.alias
-    for file in glob(f"{CONFIG.y('blueprints_dir')}/**/*.yaml", recursive=True):
+    for file in glob(f"{CONFIG.get('blueprints_dir')}/**/*.yaml", recursive=True):
         check_blueprint_v1_file(BlueprintInstance, Path(file))
 
     for blueprint in BlueprintInstance.objects.using(db_alias).all():

authentik/blueprints/models.py

@@ -82,7 +82,10 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     def retrieve_file(self) -> str:
         """Get blueprint from path"""
         try:
-            full_path = Path(CONFIG.y("blueprints_dir")).joinpath(Path(self.path))
+            base = Path(CONFIG.get("blueprints_dir"))
+            full_path = base.joinpath(Path(self.path)).resolve()
+            if not str(full_path).startswith(str(base.resolve())):
+                raise BlueprintRetrievalFailed("Invalid blueprint path")
             with full_path.open("r", encoding="utf-8") as _file:
                 return _file.read()
         except (IOError, OSError) as exc:

authentik/blueprints/tests/fixtures/conditional_fields.yaml

@@ -11,31 +11,37 @@ metadata:
 entries:
   - model: authentik_core.token
     identifiers:
-      identifier: %(uid)s-token
+      identifier: "%(uid)s-token"
     attrs:
-      key: %(uid)s
-      user: %(user)s
+      key: "%(uid)s"
+      user: "%(user)s"
       intent: api
   - model: authentik_core.application
     identifiers:
-      slug: %(uid)s-app
+      slug: "%(uid)s-app"
     attrs:
-      name: %(uid)s-app
+      name: "%(uid)s-app"
       icon: https://goauthentik.io/img/icon.png
   - model: authentik_sources_oauth.oauthsource
     identifiers:
-      slug: %(uid)s-source
+      slug: "%(uid)s-source"
     attrs:
-      name: %(uid)s-source
+      name: "%(uid)s-source"
       provider_type: azuread
-      consumer_key: %(uid)s
-      consumer_secret: %(uid)s
+      consumer_key: "%(uid)s"
+      consumer_secret: "%(uid)s"
       icon: https://goauthentik.io/img/icon.png
   - model: authentik_flows.flow
     identifiers:
-      slug: %(uid)s-flow
+      slug: "%(uid)s-flow"
     attrs:
-      name: %(uid)s-flow
-      title: %(uid)s-flow
+      name: "%(uid)s-flow"
+      title: "%(uid)s-flow"
       designation: authentication
       background: https://goauthentik.io/img/icon.png
+  - model: authentik_core.user
+    identifiers:
+      username: "%(uid)s"
+    attrs:
+      name: "%(uid)s"
+      password: "%(uid)s"

authentik/blueprints/tests/test_models.py

@@ -1,34 +1,15 @@
 """authentik managed models tests"""
-from typing import Callable, Type
-
-from django.apps import apps
 from django.test import TestCase
 
-from authentik.blueprints.v1.importer import is_model_allowed
-from authentik.lib.models import SerializerModel
+from authentik.blueprints.models import BlueprintInstance, BlueprintRetrievalFailed
+from authentik.lib.generators import generate_id
 
 
 class TestModels(TestCase):
     """Test Models"""
 
-
-def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
-    """Test serializer"""
-
-    def tester(self: TestModels):
-        if test_model._meta.abstract:  # pragma: no cover
-            return
-        model_class = test_model()
-        self.assertTrue(isinstance(model_class, SerializerModel))
-        self.assertIsNotNone(model_class.serializer)
-
-    return tester
-
-
-for app in apps.get_app_configs():
-    if not app.label.startswith("authentik"):
-        continue
-    for model in app.get_models():
-        if not is_model_allowed(model):
-            continue
-        setattr(TestModels, f"test_{app.label}_{model.__name__}", serializer_tester_factory(model))
+    def test_retrieve_file(self):
+        """Test retrieve_file"""
+        instance = BlueprintInstance.objects.create(name=generate_id(), path="../etc/hosts")
+        with self.assertRaises(BlueprintRetrievalFailed):
+            instance.retrieve()

authentik/blueprints/tests/test_serializer_models.py

@@ -0,0 +1,34 @@
+"""authentik managed models tests"""
+from typing import Callable, Type
+
+from django.apps import apps
+from django.test import TestCase
+
+from authentik.blueprints.v1.importer import is_model_allowed
+from authentik.lib.models import SerializerModel
+
+
+class TestModels(TestCase):
+    """Test Models"""
+
+
+def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
+    """Test serializer"""
+
+    def tester(self: TestModels):
+        if test_model._meta.abstract:  # pragma: no cover
+            return
+        model_class = test_model()
+        self.assertTrue(isinstance(model_class, SerializerModel))
+        self.assertIsNotNone(model_class.serializer)
+
+    return tester
+
+
+for app in apps.get_app_configs():
+    if not app.label.startswith("authentik"):
+        continue
+    for model in app.get_models():
+        if not is_model_allowed(model):
+            continue
+        setattr(TestModels, f"test_{app.label}_{model.__name__}", serializer_tester_factory(model))

authentik/blueprints/tests/test_v1_conditional_fields.py

@@ -2,7 +2,7 @@
 from django.test import TransactionTestCase
 
 from authentik.blueprints.v1.importer import Importer
-from authentik.core.models import Application, Token
+from authentik.core.models import Application, Token, User
 from authentik.core.tests.utils import create_test_admin_user
 from authentik.flows.models import Flow
 from authentik.lib.generators import generate_id
@@ -45,3 +45,9 @@ class TestBlueprintsV1ConditionalFields(TransactionTestCase):
         flow = Flow.objects.filter(slug=f"{self.uid}-flow").first()
         self.assertIsNotNone(flow)
         self.assertEqual(flow.background, "https://goauthentik.io/img/icon.png")
+
+    def test_user(self):
+        """Test user"""
+        user: User = User.objects.filter(username=self.uid).first()
+        self.assertIsNotNone(user)
+        self.assertTrue(user.check_password(self.uid))

authentik/blueprints/v1/tasks.py

@@ -62,7 +62,7 @@ def start_blueprint_watcher():
     if _file_watcher_started:
         return
     observer = Observer()
-    observer.schedule(BlueprintEventHandler(), CONFIG.y("blueprints_dir"), recursive=True)
+    observer.schedule(BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True)
     observer.start()
     _file_watcher_started = True
 
@@ -80,7 +80,7 @@ class BlueprintEventHandler(FileSystemEventHandler):
             blueprints_discovery.delay()
         if isinstance(event, FileModifiedEvent):
             path = Path(event.src_path)
-            root = Path(CONFIG.y("blueprints_dir")).absolute()
+            root = Path(CONFIG.get("blueprints_dir")).absolute()
             rel_path = str(path.relative_to(root))
             for instance in BlueprintInstance.objects.filter(path=rel_path):
                 LOGGER.debug("modified blueprint file, starting apply", instance=instance)
@@ -101,7 +101,7 @@ def blueprints_find_dict():
 def blueprints_find():
     """Find blueprints and return valid ones"""
     blueprints = []
-    root = Path(CONFIG.y("blueprints_dir"))
+    root = Path(CONFIG.get("blueprints_dir"))
     for path in root.rglob("**/*.yaml"):
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):
@@ -185,9 +185,9 @@ def apply_blueprint(self: MonitoredTask, instance_pk: str):
     instance: Optional[BlueprintInstance] = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
-        self.set_uid(slugify(instance.name))
         if not instance or not instance.enabled:
             return
+        self.set_uid(slugify(instance.name))
         blueprint_content = instance.retrieve()
         file_hash = sha512(blueprint_content.encode()).hexdigest()
         importer = Importer(blueprint_content, instance.context)

authentik/core/api/groups.py

@@ -1,5 +1,6 @@
 """Groups API Viewset"""
 from json import loads
+from typing import Optional
 
 from django.db.models.query import QuerySet
 from django.http import Http404
@@ -52,6 +53,14 @@ class GroupSerializer(ModelSerializer):
 
     num_pk = IntegerField(read_only=True)
 
+    def validate_parent(self, parent: Optional[Group]):
+        """Validate group parent (if set), ensuring the parent isn't itself"""
+        if not self.instance or not parent:
+            return parent
+        if str(parent.group_uuid) == str(self.instance.group_uuid):
+            raise ValidationError("Cannot set group as parent of itself.")
+        return parent
+
     class Meta:
         model = Group
         fields = [

authentik/core/api/tokens.py

@@ -33,7 +33,7 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
-            self.fields["key"] = CharField()
+            self.fields["key"] = CharField(required=False)
 
     def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
         """Ensure only API or App password tokens are created."""

authentik/core/api/users.py

@@ -15,7 +15,7 @@ from django.utils.http import urlencode
 from django.utils.text import slugify
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
-from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter
+from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter, UUIDFilter
 from django_filters.filterset import FilterSet
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import (
@@ -51,6 +51,7 @@ from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import CoordinateSerializer
 from authentik.api.decorators import permission_required
+from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
 from authentik.core.middleware import (
@@ -58,7 +59,6 @@ from authentik.core.middleware import (
     SESSION_KEY_IMPERSONATE_USER,
 )
 from authentik.core.models import (
-    USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
     USER_PATH_SERVICE_ACCOUNT,
     AuthenticatedSession,
@@ -66,12 +66,14 @@ from authentik.core.models import (
     Token,
     TokenIntents,
     User,
+    UserTypes,
 )
-from authentik.events.models import EventAction
+from authentik.events.models import Event, EventAction
 from authentik.flows.exceptions import FlowNonApplicableException
 from authentik.flows.models import FlowToken
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner
 from authentik.flows.views.executor import QS_KEY_TOKEN
+from authentik.lib.config import CONFIG
 from authentik.stages.email.models import EmailStage
 from authentik.stages.email.tasks import send_mails
 from authentik.stages.email.utils import TemplateEmailMessage
@@ -112,6 +114,30 @@ class UserSerializer(ModelSerializer):
     uid = CharField(read_only=True)
     username = CharField(max_length=150, validators=[UniqueValidator(queryset=User.objects.all())])
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
+            self.fields["password"] = CharField(required=False)
+
+    def create(self, validated_data: dict) -> User:
+        """If this serializer is used in the blueprint context, we allow for
+        directly setting a password. However should be done via the `set_password`
+        method instead of directly setting it like rest_framework."""
+        instance: User = super().create(validated_data)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
+            instance.set_password(validated_data["password"])
+            instance.save()
+        return instance
+
+    def update(self, instance: User, validated_data: dict) -> User:
+        """Same as `create` above, set the password directly if we're in a blueprint
+        context"""
+        instance = super().update(instance, validated_data)
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
+            instance.set_password(validated_data["password"])
+            instance.save()
+        return instance
+
     def validate_path(self, path: str) -> str:
         """Validate path"""
         if path[:1] == "/" or path[-1] == "/":
@@ -121,6 +147,18 @@ class UserSerializer(ModelSerializer):
                 raise ValidationError(_("No empty segments in user path allowed."))
         return path
 
+    def validate_type(self, user_type: str) -> str:
+        """Validate user type, internal_service_account is an internal value"""
+        if (
+            self.instance
+            and self.instance.type == UserTypes.INTERNAL_SERVICE_ACCOUNT
+            and user_type != UserTypes.INTERNAL_SERVICE_ACCOUNT.value
+        ):
+            raise ValidationError("Can't change internal service account to other user type.")
+        if not self.instance and user_type == UserTypes.INTERNAL_SERVICE_ACCOUNT.value:
+            raise ValidationError("Setting a user to internal service account is not allowed.")
+        return user_type
+
     class Meta:
         model = User
         fields = [
@@ -137,6 +175,7 @@ class UserSerializer(ModelSerializer):
             "attributes",
             "uid",
             "path",
+            "type",
         ]
         extra_kwargs = {
             "name": {"allow_blank": True},
@@ -185,6 +224,7 @@ class UserSelfSerializer(ModelSerializer):
             "avatar",
             "uid",
             "settings",
+            "type",
         ]
         extra_kwargs = {
             "is_active": {"read_only": True},
@@ -258,7 +298,7 @@ class UsersFilter(FilterSet):
     )
 
     is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")
-    uuid = CharFilter(field_name="uuid")
+    uuid = UUIDFilter(field_name="uuid")
 
     path = CharFilter(
         field_name="path",
@@ -303,6 +343,7 @@ class UsersFilter(FilterSet):
             "attributes",
             "groups_by_name",
             "groups_by_pk",
+            "type",
         ]
 
 
@@ -395,7 +436,8 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 user: User = User.objects.create(
                     username=username,
                     name=username,
-                    attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: expiring},
+                    type=UserTypes.SERVICE_ACCOUNT,
+                    attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: expiring},
                     path=USER_PATH_SERVICE_ACCOUNT,
                 )
                 user.set_unusable_password()
@@ -543,6 +585,58 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         send_mails(email_stage, message)
         return Response(status=204)
 
+    @permission_required("authentik_core.impersonate")
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            "204": OpenApiResponse(description="Successfully started impersonation"),
+            "401": OpenApiResponse(description="Access denied"),
+        },
+    )
+    @action(detail=True, methods=["POST"])
+    def impersonate(self, request: Request, pk: int) -> Response:
+        """Impersonate a user"""
+        if not CONFIG.get_bool("impersonation"):
+            LOGGER.debug("User attempted to impersonate", user=request.user)
+            return Response(status=401)
+        if not request.user.has_perm("impersonate"):
+            LOGGER.debug("User attempted to impersonate without permissions", user=request.user)
+            return Response(status=401)
+
+        user_to_be = self.get_object()
+
+        request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER] = request.user
+        request.session[SESSION_KEY_IMPERSONATE_USER] = user_to_be
+
+        Event.new(EventAction.IMPERSONATION_STARTED).from_http(request, user_to_be)
+
+        return Response(status=201)
+
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            "204": OpenApiResponse(description="Successfully started impersonation"),
+        },
+    )
+    @action(detail=False, methods=["GET"])
+    def impersonate_end(self, request: Request) -> Response:
+        """End Impersonation a user"""
+        if (
+            SESSION_KEY_IMPERSONATE_USER not in request.session
+            or SESSION_KEY_IMPERSONATE_ORIGINAL_USER not in request.session
+        ):
+            LOGGER.debug("Can't end impersonation", user=request.user)
+            return Response(status=204)
+
+        original_user = request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER]
+
+        del request.session[SESSION_KEY_IMPERSONATE_USER]
+        del request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER]
+
+        Event.new(EventAction.IMPERSONATION_ENDED).from_http(request, original_user)
+
+        return Response(status=204)
+
     def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
         """Custom filter_queryset method which ignores guardian, but still supports sorting"""
         for backend in list(self.filter_backends):

authentik/core/management/commands/worker.py

@@ -0,0 +1,40 @@
+"""Run worker"""
+from sys import exit as sysexit
+from tempfile import tempdir
+
+from celery.apps.worker import Worker
+from django.core.management.base import BaseCommand
+from django.db import close_old_connections
+from structlog.stdlib import get_logger
+
+from authentik.lib.config import CONFIG
+from authentik.root.celery import CELERY_APP
+
+LOGGER = get_logger()
+
+
+class Command(BaseCommand):
+    """Run worker"""
+
+    def handle(self, **options):
+        close_old_connections()
+        if CONFIG.get_bool("remote_debug"):
+            import debugpy
+
+            debugpy.listen(("0.0.0.0", 6900))  # nosec
+        worker: Worker = CELERY_APP.Worker(
+            no_color=False,
+            quiet=True,
+            optimization="fair",
+            max_tasks_per_child=1,
+            autoscale=(3, 1),
+            task_events=True,
+            beat=True,
+            schedule_filename=f"{tempdir}/celerybeat-schedule",
+            queues=["authentik", "authentik_scheduled", "authentik_events"],
+        )
+        for task in CELERY_APP.tasks:
+            LOGGER.debug("Registered task", task=task)
+
+        worker.start()
+        sysexit(worker.exitcode)

authentik/core/migrations/0029_provider_backchannel_applications_and_more.py

@@ -11,7 +11,7 @@ def backport_is_backchannel(apps: Apps, schema_editor: BaseDatabaseSchemaEditor)
 
     for model in BackchannelProvider.__subclasses__():
         try:
-            for obj in model.objects.all():
+            for obj in model.objects.only("is_backchannel"):
                 obj.is_backchannel = True
                 obj.save()
         except (DatabaseError, InternalError, ProgrammingError):

authentik/core/migrations/0030_user_type.py

@@ -0,0 +1,43 @@
+# Generated by Django 4.1.7 on 2023-05-21 11:44
+
+from django.apps.registry import Apps
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def migrate_user_type(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    User = apps.get_model("authentik_core", "User")
+
+    from authentik.core.models import UserTypes
+
+    for user in User.objects.using(db_alias).all():
+        user.type = UserTypes.INTERNAL
+        if "goauthentik.io/user/service-account" in user.attributes:
+            user.type = UserTypes.SERVICE_ACCOUNT
+        if "goauthentik.io/user/override-ips" in user.attributes:
+            user.type = UserTypes.INTERNAL_SERVICE_ACCOUNT
+        user.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_core", "0029_provider_backchannel_applications_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="type",
+            field=models.TextField(
+                choices=[
+                    ("default", "Default"),
+                    ("external", "External"),
+                    ("service_account", "Service Account"),
+                    ("internal_service_account", "Internal Service Account"),
+                ],
+                default="default",
+            ),
+        ),
+        migrations.RunPython(migrate_user_type),
+    ]

authentik/core/migrations/0031_alter_user_type.py

@@ -0,0 +1,41 @@
+# Generated by Django 4.1.10 on 2023-07-21 12:54
+
+from django.apps.registry import Apps
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def migrate_user_type_v2(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    User = apps.get_model("authentik_core", "User")
+
+    from authentik.core.models import UserTypes
+
+    for user in User.objects.using(db_alias).all():
+        if user.type != "default":
+            continue
+        user.type = UserTypes.INTERNAL
+        user.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_core", "0030_user_type"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="user",
+            name="type",
+            field=models.TextField(
+                choices=[
+                    ("internal", "Internal"),
+                    ("external", "External"),
+                    ("service_account", "Service Account"),
+                    ("internal_service_account", "Internal Service Account"),
+                ],
+                default="internal",
+            ),
+        ),
+        migrations.RunPython(migrate_user_type_v2),
+    ]

authentik/core/models.py

@@ -5,7 +5,6 @@ from typing import Any, Optional
 from uuid import uuid4
 
 from deepmerge import always_merger
-from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.models import AbstractUser
 from django.contrib.auth.models import UserManager as DjangoUserManager
@@ -33,10 +32,10 @@ from authentik.lib.models import (
 )
 from authentik.lib.utils.http import get_client_ip
 from authentik.policies.models import PolicyBindingModel
+from authentik.root.install_id import get_install_id
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
-USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
 USER_ATTRIBUTE_GENERATED = "goauthentik.io/user/generated"
 USER_ATTRIBUTE_EXPIRES = "goauthentik.io/user/expires"
 USER_ATTRIBUTE_DELETE_ON_LOGOUT = "goauthentik.io/user/delete-on-logout"
@@ -45,8 +44,6 @@ USER_ATTRIBUTE_TOKEN_EXPIRING = "goauthentik.io/user/token-expires"  # nosec
 USER_ATTRIBUTE_CHANGE_USERNAME = "goauthentik.io/user/can-change-username"
 USER_ATTRIBUTE_CHANGE_NAME = "goauthentik.io/user/can-change-name"
 USER_ATTRIBUTE_CHANGE_EMAIL = "goauthentik.io/user/can-change-email"
-USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
-
 USER_PATH_SYSTEM_PREFIX = "goauthentik.io"
 USER_PATH_SERVICE_ACCOUNT = USER_PATH_SYSTEM_PREFIX + "/service-accounts"
 
@@ -63,7 +60,22 @@ def default_token_key():
     """Default token key"""
     # We use generate_id since the chars in the key should be easy
     # to use in Emails (for verification) and URLs (for recovery)
-    return generate_id(int(CONFIG.y("default_token_length")))
+    return generate_id(int(CONFIG.get("default_token_length")))
+
+
+class UserTypes(models.TextChoices):
+    """User types, both for grouping, licensing and permissions in the case
+    of the internal_service_account"""
+
+    INTERNAL = "internal"
+    EXTERNAL = "external"
+
+    # User-created service accounts
+    SERVICE_ACCOUNT = "service_account"
+
+    # Special user type for internally managed and created service
+    # accounts, such as outpost users
+    INTERNAL_SERVICE_ACCOUNT = "internal_service_account"
 
 
 class Group(SerializerModel):
@@ -149,6 +161,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     uuid = models.UUIDField(default=uuid4, editable=False, unique=True)
     name = models.TextField(help_text=_("User's display name."))
     path = models.TextField(default="users")
+    type = models.TextField(choices=UserTypes.choices, default=UserTypes.INTERNAL)
 
     sources = models.ManyToManyField("Source", through="UserSourceConnection")
     ak_groups = models.ManyToManyField("Group", related_name="users")
@@ -217,7 +230,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def uid(self) -> str:
         """Generate a globally unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{settings.SECRET_KEY}".encode("ascii")).hexdigest()
+        return sha256(f"{self.id}-{get_install_id()}".encode("ascii")).hexdigest()
 
     def locale(self, request: Optional[HttpRequest] = None) -> str:
         """Get the locale the user has configured"""
@@ -376,10 +389,10 @@ class Application(SerializerModel, PolicyBindingModel):
     def get_launch_url(self, user: Optional["User"] = None) -> Optional[str]:
         """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
         url = None
-        if provider := self.get_provider():
-            url = provider.launch_url
         if self.meta_launch_url:
             url = self.meta_launch_url
+        elif provider := self.get_provider():
+            url = provider.launch_url
         if user and url:
             if isinstance(user, SimpleLazyObject):
                 user._setup()

authentik/core/signals.py

@@ -1,6 +1,4 @@
 """authentik core signals"""
-from typing import TYPE_CHECKING
-
 from django.contrib.auth.signals import user_logged_in, user_logged_out
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
@@ -10,16 +8,13 @@ from django.db.models.signals import post_save, pre_delete, pre_save
 from django.dispatch import receiver
 from django.http.request import HttpRequest
 
-from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider
+from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider, User
 
 # Arguments: user: User, password: str
 password_changed = Signal()
 # Arguments: credentials: dict[str, any], request: HttpRequest, stage: Stage
 login_failed = Signal()
 
-if TYPE_CHECKING:
-    from authentik.core.models import User
-
 
 @receiver(post_save, sender=Application)
 def post_save_application(sender: type[Model], instance, created: bool, **_):
@@ -35,7 +30,7 @@ def post_save_application(sender: type[Model], instance, created: bool, **_):
 
 
 @receiver(user_logged_in)
-def user_logged_in_session(sender, request: HttpRequest, user: "User", **_):
+def user_logged_in_session(sender, request: HttpRequest, user: User, **_):
     """Create an AuthenticatedSession from request"""
 
     session = AuthenticatedSession.from_request(request, user)
@@ -44,7 +39,7 @@ def user_logged_in_session(sender, request: HttpRequest, user: "User", **_):
 
 
 @receiver(user_logged_out)
-def user_logged_out_session(sender, request: HttpRequest, user: "User", **_):
+def user_logged_out_session(sender, request: HttpRequest, user: User, **_):
     """Delete AuthenticatedSession if it exists"""
     AuthenticatedSession.objects.filter(session_key=request.session.session_key).delete()
 

authentik/core/templates/base/skeleton.html

@@ -8,7 +8,8 @@
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
         <title>{% block title %}{% trans title|default:tenant.branding_title %}{% endblock %}</title>
-        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
+        <link rel="icon" href="{{ tenant.branding_favicon }}">
+        <link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
         {% block head_before %}
         {% endblock %}
         <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">

authentik/core/templates/if/admin.html

@@ -6,8 +6,6 @@
 <script src="{% static 'dist/admin/AdminInterface.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#18191a" media="(prefers-color-scheme: dark)">
 <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
-<link rel="icon" href="{{ tenant.branding_favicon }}">
-<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% include "base/header_js.html" %}
 {% endblock %}
 

authentik/core/templates/if/flow.html

@@ -5,8 +5,6 @@
 {% block head_before %}
 {{ block.super }}
 <link rel="prefetch" href="{{ flow.background_url }}" />
-<link rel="icon" href="{{ tenant.branding_favicon }}">
-<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% if flow.compatibility_mode and not inspector %}
 <script>ShadyDOM = { force: !navigator.webdriver };</script>
 {% endif %}

authentik/core/templates/if/user.html

@@ -6,8 +6,6 @@
 <script src="{% static 'dist/user/UserInterface.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#1c1e21" media="(prefers-color-scheme: light)">
 <meta name="theme-color" content="#1c1e21" media="(prefers-color-scheme: dark)">
-<link rel="icon" href="{{ tenant.branding_favicon }}">
-<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% include "base/header_js.html" %}
 {% endblock %}
 

authentik/core/tests/test_groups_api.py

@@ -67,3 +67,16 @@ class TestGroupsAPI(APITestCase):
             },
         )
         self.assertEqual(res.status_code, 404)
+
+    def test_parent_self(self):
+        """Test parent"""
+        group = Group.objects.create(name=generate_id())
+        self.client.force_login(self.admin)
+        res = self.client.patch(
+            reverse("authentik_api:group-detail", kwargs={"pk": group.pk}),
+            data={
+                "pk": self.user.pk + 3,
+                "parent": group.pk,
+            },
+        )
+        self.assertEqual(res.status_code, 400)

authentik/core/tests/test_impersonation.py

@@ -1,14 +1,14 @@
 """impersonation tests"""
 from json import loads
 
-from django.test.testcases import TestCase
 from django.urls import reverse
+from rest_framework.test import APITestCase
 
 from authentik.core.models import User
 from authentik.core.tests.utils import create_test_admin_user
 
 
-class TestImpersonation(TestCase):
+class TestImpersonation(APITestCase):
     """impersonation tests"""
 
     def setUp(self) -> None:
@@ -23,10 +23,10 @@ class TestImpersonation(TestCase):
         self.other_user.save()
         self.client.force_login(self.user)
 
-        self.client.get(
+        self.client.post(
             reverse(
-                "authentik_core:impersonate-init",
-                kwargs={"user_id": self.other_user.pk},
+                "authentik_api:user-impersonate",
+                kwargs={"pk": self.other_user.pk},
             )
         )
 
@@ -35,7 +35,7 @@ class TestImpersonation(TestCase):
         self.assertEqual(response_body["user"]["username"], self.other_user.username)
         self.assertEqual(response_body["original"]["username"], self.user.username)
 
-        self.client.get(reverse("authentik_core:impersonate-end"))
+        self.client.get(reverse("authentik_api:user-impersonate-end"))
 
         response = self.client.get(reverse("authentik_api:user-me"))
         response_body = loads(response.content.decode())
@@ -46,9 +46,7 @@ class TestImpersonation(TestCase):
         """test impersonation without permissions"""
         self.client.force_login(self.other_user)
 
-        self.client.get(
-            reverse("authentik_core:impersonate-init", kwargs={"user_id": self.user.pk})
-        )
+        self.client.get(reverse("authentik_api:user-impersonate", kwargs={"pk": self.user.pk}))
 
         response = self.client.get(reverse("authentik_api:user-me"))
         response_body = loads(response.content.decode())
@@ -58,5 +56,5 @@ class TestImpersonation(TestCase):
         """test un-impersonation without impersonating first"""
         self.client.force_login(self.other_user)
 
-        response = self.client.get(reverse("authentik_core:impersonate-end"))
-        self.assertRedirects(response, reverse("authentik_core:if-user"))
+        response = self.client.get(reverse("authentik_api:user-impersonate-end"))
+        self.assertEqual(response.status_code, 204)

authentik/core/tests/test_users_api.py

@@ -8,11 +8,11 @@ from django.urls.base import reverse
 from rest_framework.test import APITestCase
 
 from authentik.core.models import (
-    USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
     AuthenticatedSession,
     Token,
     User,
+    UserTypes,
 )
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow, create_test_tenant
 from authentik.flows.models import FlowDesignation
@@ -141,7 +141,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -166,7 +167,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: False, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: False},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -192,7 +194,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -218,7 +221,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()

authentik/core/types.py

@@ -8,7 +8,7 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.flows.challenge import Challenge
 
 
-@dataclass
+@dataclass(slots=True)
 class UILoginButton:
     """Dataclass for Source's ui_login_button"""
 

authentik/core/urls.py

@@ -16,7 +16,7 @@ from authentik.core.api.providers import ProviderViewSet
 from authentik.core.api.sources import SourceViewSet, UserSourceConnectionViewSet
 from authentik.core.api.tokens import TokenViewSet
 from authentik.core.api.users import UserViewSet
-from authentik.core.views import apps, impersonate
+from authentik.core.views import apps
 from authentik.core.views.debug import AccessDeniedView
 from authentik.core.views.interface import FlowInterfaceView, InterfaceView
 from authentik.core.views.session import EndSessionView
@@ -38,17 +38,6 @@ urlpatterns = [
         apps.RedirectToAppLaunch.as_view(),
         name="application-launch",
     ),
-    # Impersonation
-    path(
-        "-/impersonation/<int:user_id>/",
-        impersonate.ImpersonateInitView.as_view(),
-        name="impersonate-init",
-    ),
-    path(
-        "-/impersonation/end/",
-        impersonate.ImpersonateEndView.as_view(),
-        name="impersonate-end",
-    ),
     # Interfaces
     path(
         "if/admin/",

authentik/core/views/impersonate.py

@@ -1,60 +0,0 @@
-"""authentik impersonation views"""
-
-from django.http import HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404, redirect
-from django.views import View
-from structlog.stdlib import get_logger
-
-from authentik.core.middleware import (
-    SESSION_KEY_IMPERSONATE_ORIGINAL_USER,
-    SESSION_KEY_IMPERSONATE_USER,
-)
-from authentik.core.models import User
-from authentik.events.models import Event, EventAction
-from authentik.lib.config import CONFIG
-
-LOGGER = get_logger()
-
-
-class ImpersonateInitView(View):
-    """Initiate Impersonation"""
-
-    def get(self, request: HttpRequest, user_id: int) -> HttpResponse:
-        """Impersonation handler, checks permissions"""
-        if not CONFIG.y_bool("impersonation"):
-            LOGGER.debug("User attempted to impersonate", user=request.user)
-            return HttpResponse("Unauthorized", status=401)
-        if not request.user.has_perm("impersonate"):
-            LOGGER.debug("User attempted to impersonate without permissions", user=request.user)
-            return HttpResponse("Unauthorized", status=401)
-
-        user_to_be = get_object_or_404(User, pk=user_id)
-
-        request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER] = request.user
-        request.session[SESSION_KEY_IMPERSONATE_USER] = user_to_be
-
-        Event.new(EventAction.IMPERSONATION_STARTED).from_http(request, user_to_be)
-
-        return redirect("authentik_core:if-user")
-
-
-class ImpersonateEndView(View):
-    """End User impersonation"""
-
-    def get(self, request: HttpRequest) -> HttpResponse:
-        """End Impersonation handler"""
-        if (
-            SESSION_KEY_IMPERSONATE_USER not in request.session
-            or SESSION_KEY_IMPERSONATE_ORIGINAL_USER not in request.session
-        ):
-            LOGGER.debug("Can't end impersonation", user=request.user)
-            return redirect("authentik_core:if-user")
-
-        original_user = request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER]
-
-        del request.session[SESSION_KEY_IMPERSONATE_USER]
-        del request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER]
-
-        Event.new(EventAction.IMPERSONATION_ENDED).from_http(request, original_user)
-
-        return redirect("authentik_core:root-redirect")

authentik/crypto/builder.py

@@ -7,7 +7,7 @@ from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import ec, rsa
-from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES
+from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
 from cryptography.x509.oid import NameOID
 
 from authentik import __version__
@@ -40,7 +40,7 @@ class CertificateBuilder:
         self.cert.save()
         return self.cert
 
-    def generate_private_key(self) -> PRIVATE_KEY_TYPES:
+    def generate_private_key(self) -> PrivateKeyTypes:
         """Generate private key"""
         if self._use_ec_private_key:
             return ec.generate_private_key(curve=ec.SECP256R1)

authentik/crypto/models.py

@@ -6,7 +6,7 @@ from uuid import uuid4
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES, PUBLIC_KEY_TYPES
+from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes, PublicKeyTypes
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
 from cryptography.x509 import Certificate, load_pem_x509_certificate
 from django.db import models
@@ -37,8 +37,8 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     )
 
     _cert: Optional[Certificate] = None
-    _private_key: Optional[PRIVATE_KEY_TYPES] = None
-    _public_key: Optional[PUBLIC_KEY_TYPES] = None
+    _private_key: Optional[PrivateKeyTypes] = None
+    _public_key: Optional[PublicKeyTypes] = None
 
     @property
     def serializer(self) -> Serializer:
@@ -56,7 +56,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return self._cert
 
     @property
-    def public_key(self) -> Optional[PUBLIC_KEY_TYPES]:
+    def public_key(self) -> Optional[PublicKeyTypes]:
         """Get public key of the private key"""
         if not self._public_key:
             self._public_key = self.private_key.public_key()
@@ -65,7 +65,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     @property
     def private_key(
         self,
-    ) -> Optional[PRIVATE_KEY_TYPES]:
+    ) -> Optional[PrivateKeyTypes]:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self.key_data != "":
             try:

authentik/crypto/tasks.py

@@ -46,7 +46,7 @@ def certificate_discovery(self: MonitoredTask):
     certs = {}
     private_keys = {}
     discovered = 0
-    for file in glob(CONFIG.y("cert_discovery_dir") + "/**", recursive=True):
+    for file in glob(CONFIG.get("cert_discovery_dir") + "/**", recursive=True):
         path = Path(file)
         if not path.exists():
             continue

authentik/enterprise/api.py

@@ -0,0 +1,154 @@
+"""Enterprise API Views"""
+from datetime import datetime, timedelta
+
+from django.utils.timezone import now
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import extend_schema, inline_serializer
+from rest_framework.decorators import action
+from rest_framework.fields import BooleanField, CharField, DateTimeField, IntegerField
+from rest_framework.permissions import IsAdminUser, IsAuthenticated
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from authentik.api.decorators import permission_required
+from authentik.core.api.used_by import UsedByMixin
+from authentik.core.api.utils import PassiveSerializer
+from authentik.core.models import User, UserTypes
+from authentik.enterprise.models import License, LicenseKey
+from authentik.root.install_id import get_install_id
+
+
+class LicenseSerializer(ModelSerializer):
+    """License Serializer"""
+
+    def validate_key(self, key: str) -> str:
+        """Validate the license key (install_id and signature)"""
+        LicenseKey.validate(key)
+        return key
+
+    class Meta:
+        model = License
+        fields = [
+            "license_uuid",
+            "name",
+            "key",
+            "expiry",
+            "users",
+            "external_users",
+        ]
+        extra_kwargs = {
+            "name": {"read_only": True},
+            "expiry": {"read_only": True},
+            "users": {"read_only": True},
+            "external_users": {"read_only": True},
+        }
+
+
+class LicenseSummary(PassiveSerializer):
+    """Serializer for license status"""
+
+    users = IntegerField(required=True)
+    external_users = IntegerField(required=True)
+    valid = BooleanField()
+    show_admin_warning = BooleanField()
+    show_user_warning = BooleanField()
+    read_only = BooleanField()
+    latest_valid = DateTimeField()
+    has_license = BooleanField()
+
+
+class LicenseForecastSerializer(PassiveSerializer):
+    """Serializer for license forecast"""
+
+    users = IntegerField(required=True)
+    external_users = IntegerField(required=True)
+    forecasted_users = IntegerField(required=True)
+    forecasted_external_users = IntegerField(required=True)
+
+
+class LicenseViewSet(UsedByMixin, ModelViewSet):
+    """License Viewset"""
+
+    queryset = License.objects.all()
+    serializer_class = LicenseSerializer
+    search_fields = ["name"]
+    ordering = ["name"]
+    filterset_fields = ["name"]
+
+    @permission_required(None, ["authentik_enterprise.view_license"])
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            200: inline_serializer("InstallIDSerializer", {"install_id": CharField(required=True)}),
+        },
+    )
+    @action(detail=False, methods=["GET"], permission_classes=[IsAdminUser])
+    def get_install_id(self, request: Request) -> Response:
+        """Get install_id"""
+        return Response(
+            data={
+                "install_id": get_install_id(),
+            }
+        )
+
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            200: LicenseSummary(),
+        },
+    )
+    @action(detail=False, methods=["GET"], permission_classes=[IsAuthenticated])
+    def summary(self, request: Request) -> Response:
+        """Get the total license status"""
+        total = LicenseKey.get_total()
+        last_valid = LicenseKey.last_valid_date()
+        # TODO: move this to a different place?
+        show_admin_warning = last_valid < now() - timedelta(weeks=2)
+        show_user_warning = last_valid < now() - timedelta(weeks=4)
+        read_only = last_valid < now() - timedelta(weeks=6)
+        latest_valid = datetime.fromtimestamp(total.exp)
+        response = LicenseSummary(
+            data={
+                "users": total.users,
+                "external_users": total.external_users,
+                "valid": total.is_valid(),
+                "show_admin_warning": show_admin_warning,
+                "show_user_warning": show_user_warning,
+                "read_only": read_only,
+                "latest_valid": latest_valid,
+                "has_license": License.objects.all().count() > 0,
+            }
+        )
+        response.is_valid(raise_exception=True)
+        return Response(response.data)
+
+    @permission_required(None, ["authentik_enterprise.view_license"])
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            200: LicenseForecastSerializer(),
+        },
+    )
+    @action(detail=False, methods=["GET"])
+    def forecast(self, request: Request) -> Response:
+        """Forecast how many users will be required in a year"""
+        last_month = now() - timedelta(days=30)
+        # Forecast for default users
+        users_in_last_month = User.objects.filter(
+            type=UserTypes.INTERNAL, date_joined__gte=last_month
+        ).count()
+        # Forecast for external users
+        external_in_last_month = LicenseKey.get_external_user_count()
+        forecast_for_months = 12
+        response = LicenseForecastSerializer(
+            data={
+                "users": LicenseKey.get_default_user_count(),
+                "external_users": LicenseKey.get_external_user_count(),
+                "forecasted_users": (users_in_last_month * forecast_for_months),
+                "forecasted_external_users": (external_in_last_month * forecast_for_months),
+            }
+        )
+        response.is_valid(raise_exception=True)
+        return Response(response.data)

authentik/enterprise/apps.py

@@ -9,3 +9,7 @@ class AuthentikEnterpriseConfig(ManagedAppConfig):
     label = "authentik_enterprise"
     verbose_name = "authentik Enterprise"
     default = True
+
+    def reconcile_load_enterprise_signals(self):
+        """Load enterprise signals"""
+        self.import_module("authentik.enterprise.signals")

authentik/enterprise/migrations/0001_initial.py

@@ -0,0 +1,52 @@
+# Generated by Django 4.1.10 on 2023-07-06 12:51
+
+import uuid
+
+from django.db import migrations, models
+
+import authentik.enterprise.models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = []
+
+    operations = [
+        migrations.CreateModel(
+            name="License",
+            fields=[
+                (
+                    "license_uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("key", models.TextField(unique=True)),
+                ("name", models.TextField()),
+                ("expiry", models.DateTimeField()),
+                ("users", models.BigIntegerField()),
+                ("external_users", models.BigIntegerField()),
+            ],
+        ),
+        migrations.CreateModel(
+            name="LicenseUsage",
+            fields=[
+                ("expiring", models.BooleanField(default=True)),
+                ("expires", models.DateTimeField(default=authentik.enterprise.models.usage_expiry)),
+                (
+                    "usage_uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("user_count", models.BigIntegerField()),
+                ("external_user_count", models.BigIntegerField()),
+                ("within_limits", models.BooleanField()),
+                ("record_date", models.DateTimeField(auto_now_add=True)),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+    ]

authentik/enterprise/models.py

@@ -0,0 +1,185 @@
+"""Enterprise models"""
+from base64 import b64decode
+from binascii import Error
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+from enum import Enum
+from functools import lru_cache
+from time import mktime
+from uuid import uuid4
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.x509 import Certificate, load_der_x509_certificate, load_pem_x509_certificate
+from dacite import from_dict
+from django.db import models
+from django.db.models.query import QuerySet
+from django.utils.timezone import now
+from guardian.shortcuts import get_anonymous_user
+from jwt import PyJWTError, decode, get_unverified_header
+from rest_framework.exceptions import ValidationError
+
+from authentik.core.models import ExpiringModel, User, UserTypes
+from authentik.root.install_id import get_install_id
+
+
+@lru_cache()
+def get_licensing_key() -> Certificate:
+    """Get Root CA PEM"""
+    with open("authentik/enterprise/public.pem", "rb") as _key:
+        return load_pem_x509_certificate(_key.read())
+
+
+def get_license_aud() -> str:
+    """Get the JWT audience field"""
+    return f"enterprise.goauthentik.io/license/{get_install_id()}"
+
+
+class LicenseFlags(Enum):
+    """License flags"""
+
+
+@dataclass
+class LicenseKey:
+    """License JWT claims"""
+
+    aud: str
+    exp: int
+
+    name: str
+    users: int
+    external_users: int
+    flags: list[LicenseFlags] = field(default_factory=list)
+
+    @staticmethod
+    def validate(jwt: str) -> "LicenseKey":
+        """Validate the license from a given JWT"""
+        try:
+            headers = get_unverified_header(jwt)
+        except PyJWTError:
+            raise ValidationError("Unable to verify license")
+        x5c: list[str] = headers.get("x5c", [])
+        if len(x5c) < 1:
+            raise ValidationError("Unable to verify license")
+        try:
+            our_cert = load_der_x509_certificate(b64decode(x5c[0]))
+            intermediate = load_der_x509_certificate(b64decode(x5c[1]))
+            our_cert.verify_directly_issued_by(intermediate)
+            intermediate.verify_directly_issued_by(get_licensing_key())
+        except (InvalidSignature, TypeError, ValueError, Error):
+            raise ValidationError("Unable to verify license")
+        try:
+            body = from_dict(
+                LicenseKey,
+                decode(
+                    jwt,
+                    our_cert.public_key(),
+                    algorithms=["ES512"],
+                    audience=get_license_aud(),
+                ),
+            )
+        except PyJWTError:
+            raise ValidationError("Unable to verify license")
+        return body
+
+    @staticmethod
+    def get_total() -> "LicenseKey":
+        """Get a summarized version of all (not expired) licenses"""
+        active_licenses = License.objects.filter(expiry__gte=now())
+        total = LicenseKey(get_license_aud(), 0, "Summarized license", 0, 0)
+        for lic in active_licenses:
+            total.users += lic.users
+            total.external_users += lic.external_users
+            exp_ts = int(mktime(lic.expiry.timetuple()))
+            if total.exp == 0:
+                total.exp = exp_ts
+            if exp_ts <= total.exp:
+                total.exp = exp_ts
+            total.flags.extend(lic.status.flags)
+        return total
+
+    @staticmethod
+    def base_user_qs() -> QuerySet:
+        """Base query set for all users"""
+        return User.objects.all().exclude(pk=get_anonymous_user().pk)
+
+    @staticmethod
+    def get_default_user_count():
+        """Get current default user count"""
+        return LicenseKey.base_user_qs().filter(type=UserTypes.INTERNAL).count()
+
+    @staticmethod
+    def get_external_user_count():
+        """Get current external user count"""
+        # Count since start of the month
+        last_month = now().replace(day=1)
+        return (
+            LicenseKey.base_user_qs()
+            .filter(type=UserTypes.EXTERNAL, last_login__gte=last_month)
+            .count()
+        )
+
+    def is_valid(self) -> bool:
+        """Check if the given license body covers all users
+
+        Only checks the current count, no historical data is checked"""
+        default_users = self.get_default_user_count()
+        if default_users > self.users:
+            return False
+        active_users = self.get_external_user_count()
+        if active_users > self.external_users:
+            return False
+        return True
+
+    def record_usage(self):
+        """Capture the current validity status and metrics and save them"""
+        LicenseUsage.objects.create(
+            user_count=self.get_default_user_count(),
+            external_user_count=self.get_external_user_count(),
+            within_limits=self.is_valid(),
+        )
+
+    @staticmethod
+    def last_valid_date() -> datetime:
+        """Get the last date the license was valid"""
+        usage: LicenseUsage = (
+            LicenseUsage.filter_not_expired(within_limits=True).order_by("-record_date").first()
+        )
+        if not usage:
+            return now()
+        return usage.record_date
+
+
+class License(models.Model):
+    """An authentik enterprise license"""
+
+    license_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
+    key = models.TextField(unique=True)
+
+    name = models.TextField()
+    expiry = models.DateTimeField()
+    users = models.BigIntegerField()
+    external_users = models.BigIntegerField()
+
+    @property
+    def status(self) -> LicenseKey:
+        """Get parsed license status"""
+        return LicenseKey.validate(self.key)
+
+
+def usage_expiry():
+    """Keep license usage records for 3 months"""
+    return now() + timedelta(days=30 * 3)
+
+
+class LicenseUsage(ExpiringModel):
+    """a single license usage record"""
+
+    expires = models.DateTimeField(default=usage_expiry)
+
+    usage_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
+
+    user_count = models.BigIntegerField()
+    external_user_count = models.BigIntegerField()
+    within_limits = models.BooleanField()
+
+    record_date = models.DateTimeField(auto_now_add=True)

authentik/enterprise/policy.py

@@ -0,0 +1,46 @@
+"""Enterprise license policies"""
+from typing import Optional
+
+from rest_framework.serializers import BaseSerializer
+
+from authentik.core.models import User, UserTypes
+from authentik.enterprise.models import LicenseKey
+from authentik.policies.models import Policy
+from authentik.policies.types import PolicyRequest, PolicyResult
+from authentik.policies.views import PolicyAccessView
+
+
+class EnterprisePolicy(Policy):
+    """Check that a user is correctly licensed for the request"""
+
+    @property
+    def component(self) -> str:
+        return ""
+
+    @property
+    def serializer(self) -> type[BaseSerializer]:
+        raise NotImplementedError
+
+    def passes(self, request: PolicyRequest) -> PolicyResult:
+        if not LicenseKey.get_total().is_valid():
+            return PolicyResult(False)
+        if request.user.type != UserTypes.INTERNAL:
+            return PolicyResult(False)
+        return PolicyResult(True)
+
+
+class EnterprisePolicyAccessView(PolicyAccessView):
+    """PolicyAccessView which also checks enterprise licensing"""
+
+    def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
+        user = user or self.request.user
+        request = PolicyRequest(user)
+        request.http_request = self.request
+        result = super().user_has_access(user)
+        enterprise_result = EnterprisePolicy().passes(request)
+        if not enterprise_result.passing:
+            return enterprise_result
+        return result
+
+    def resolve_provider_application(self):
+        raise NotImplementedError

authentik/enterprise/public.pem

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEdzCCA/6gAwIBAgIUQrj1jxn4q/BB38B2SwTrvGyrZLMwCgYIKoZIzj0EAwMw
+ge8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
+YW4gRnJhbmNpc2NvMSQwIgYDVQQJExs1NDggTWFya2V0IFN0cmVldCBQbWIgNzAx
+NDgxDjAMBgNVBBETBTk0MTA0MSAwHgYDVQQKExdBdXRoZW50aWsgU2VjdXJpdHkg
+SW5jLjEcMBoGA1UECxMTRW50ZXJwcmlzZSBMaWNlbnNlczE9MDsGA1UEAxM0QXV0
+aGVudGlrIFNlY3VyaXR5IEluYy4gRW50ZXJwcmlzZSBMaWNlbnNpbmcgUm9vdCBY
+MTAgFw0yMzA3MDQxNzQ3NDBaGA8yMTIzMDYxMDE3NDgxMFowge8xCzAJBgNVBAYT
+AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
+MSQwIgYDVQQJExs1NDggTWFya2V0IFN0cmVldCBQbWIgNzAxNDgxDjAMBgNVBBET
+BTk0MTA0MSAwHgYDVQQKExdBdXRoZW50aWsgU2VjdXJpdHkgSW5jLjEcMBoGA1UE
+CxMTRW50ZXJwcmlzZSBMaWNlbnNlczE9MDsGA1UEAxM0QXV0aGVudGlrIFNlY3Vy
+aXR5IEluYy4gRW50ZXJwcmlzZSBMaWNlbnNpbmcgUm9vdCBYMTB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABNbPJH6nDbSshpDsDHBRL0UcZVXWCK30txqcMKU+YFmLB6iR
+PJiHjHA8Z+5aP4eNH6onA5xqykQf65tvbFBA1LB/6HqMArU/tYVVQx4+o9hRBxF5
+RrzXucUg2br+RX8aa6OCAVUwggFRMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBRHpR3/ptPgN0yHVfUjyJOEmsPZqTAfBgNVHSMEGDAW
+gBRHpR3/ptPgN0yHVfUjyJOEmsPZqTCBoAYIKwYBBQUHAQEEgZMwgZAwRwYIKwYB
+BQUHMAGGO2h0dHBzOi8vdmF1bHQuY3VzdG9tZXJzLmdvYXV0aGVudGlrLmlvL3Yx
+L2xpY2Vuc2luZy1jYS9vY3NwMEUGCCsGAQUFBzAChjlodHRwczovL3ZhdWx0LmN1
+c3RvbWVycy5nb2F1dGhlbnRpay5pby92MS9saWNlbnNpbmctY2EvY2EwSwYDVR0f
+BEQwQjBAoD6gPIY6aHR0cHM6Ly92YXVsdC5jdXN0b21lcnMuZ29hdXRoZW50aWsu
+aW8vdjEvbGljZW5zaW5nLWNhL2NybDAKBggqhkjOPQQDAwNnADBkAjB0+YA1yjEO
+g43CCYUJXz9m9CNIkjOPUI0jO4UtvSj8j067TKRbX6IL/29HxPtQoYACME8eZHBJ
+Ljcog0oeBgjr4wK8bobgknr5wrm70rrNNpbSAjDvTvXMQeAShGgsftEquQ==
+-----END CERTIFICATE-----

authentik/enterprise/settings.py

@@ -1 +1,12 @@
 """Enterprise additional settings"""
+from celery.schedules import crontab
+
+from authentik.lib.utils.time import fqdn_rand
+
+CELERY_BEAT_SCHEDULE = {
+    "enterprise_calculate_license": {
+        "task": "authentik.enterprise.tasks.calculate_license",
+        "schedule": crontab(minute=fqdn_rand("calculate_license"), hour="*/8"),
+        "options": {"queue": "authentik_scheduled"},
+    }
+}

authentik/enterprise/signals.py

@@ -0,0 +1,18 @@
+"""Enterprise signals"""
+from datetime import datetime
+
+from django.db.models.signals import pre_save
+from django.dispatch import receiver
+from django.utils.timezone import get_current_timezone
+
+from authentik.enterprise.models import License
+
+
+@receiver(pre_save, sender=License)
+def pre_save_license(sender: type[License], instance: License, **_):
+    """Extract data from license jwt and save it into model"""
+    status = instance.status
+    instance.name = status.name
+    instance.users = status.users
+    instance.external_users = status.external_users
+    instance.expiry = datetime.fromtimestamp(status.exp, tz=get_current_timezone())

authentik/enterprise/tasks.py

@@ -0,0 +1,10 @@
+"""Enterprise tasks"""
+from authentik.enterprise.models import LicenseKey
+from authentik.root.celery import CELERY_APP
+
+
+@CELERY_APP.task()
+def calculate_license():
+    """Calculate licensing status"""
+    total = LicenseKey.get_total()
+    total.record_usage()

authentik/enterprise/tests/test_license.py

@@ -0,0 +1,64 @@
+"""Enterprise license tests"""
+from datetime import timedelta
+from time import mktime
+from unittest.mock import MagicMock, patch
+
+from django.test import TestCase
+from django.utils.timezone import now
+from rest_framework.exceptions import ValidationError
+
+from authentik.enterprise.models import License, LicenseKey
+from authentik.lib.generators import generate_id
+
+_exp = int(mktime((now() + timedelta(days=3000)).timetuple()))
+
+
+class TestEnterpriseLicense(TestCase):
+    """Enterprise license tests"""
+
+    @patch(
+        "authentik.enterprise.models.LicenseKey.validate",
+        MagicMock(
+            return_value=LicenseKey(
+                aud="",
+                exp=_exp,
+                name=generate_id(),
+                users=100,
+                external_users=100,
+            )
+        ),
+    )
+    def test_valid(self):
+        """Check license verification"""
+        lic = License.objects.create(key=generate_id())
+        self.assertTrue(lic.status.is_valid())
+        self.assertEqual(lic.users, 100)
+
+    def test_invalid(self):
+        """Test invalid license"""
+        with self.assertRaises(ValidationError):
+            License.objects.create(key=generate_id())
+
+    @patch(
+        "authentik.enterprise.models.LicenseKey.validate",
+        MagicMock(
+            return_value=LicenseKey(
+                aud="",
+                exp=_exp,
+                name=generate_id(),
+                users=100,
+                external_users=100,
+            )
+        ),
+    )
+    def test_valid_multiple(self):
+        """Check license verification"""
+        lic = License.objects.create(key=generate_id())
+        self.assertTrue(lic.status.is_valid())
+        lic2 = License.objects.create(key=generate_id())
+        self.assertTrue(lic2.status.is_valid())
+        total = LicenseKey.get_total()
+        self.assertEqual(total.users, 200)
+        self.assertEqual(total.external_users, 200)
+        self.assertEqual(total.exp, _exp)
+        self.assertTrue(total.is_valid())

authentik/enterprise/urls.py

@@ -0,0 +1,7 @@
+"""API URLs"""
+
+from authentik.enterprise.api import LicenseViewSet
+
+api_urlpatterns = [
+    ("enterprise/license", LicenseViewSet),
+]

authentik/events/geo.py

@@ -33,7 +33,7 @@ class GeoIPReader:
 
     def __open(self):
         """Get GeoIP Reader, if configured, otherwise none"""
-        path = CONFIG.y("geoip")
+        path = CONFIG.get("geoip")
         if path == "" or not path:
             return
         try:
@@ -46,7 +46,7 @@ class GeoIPReader:
     def __check_expired(self):
         """Check if the modification date of the GeoIP database has
         changed, and reload it if so"""
-        path = CONFIG.y("geoip")
+        path = CONFIG.get("geoip")
         try:
             mtime = stat(path).st_mtime
             diff = self.__last_mtime < mtime

authentik/events/monitored_tasks.py

@@ -41,6 +41,7 @@ class TaskResult:
 
     def with_error(self, exc: Exception) -> "TaskResult":
         """Since errors might not always be pickle-able, set the traceback"""
+        # TODO: Mark exception somehow so that is rendered as <pre> in frontend
         self.messages.append(exception_to_string(exc))
         return self
 
@@ -69,13 +70,26 @@ class TaskInfo:
         return cache.get_many(cache.keys(CACHE_KEY_PREFIX + "*"))
 
     @staticmethod
-    def by_name(name: str) -> Optional["TaskInfo"]:
+    def by_name(name: str) -> Optional["TaskInfo"] | Optional[list["TaskInfo"]]:
         """Get TaskInfo Object by name"""
+        if "*" in name:
+            return cache.get_many(cache.keys(CACHE_KEY_PREFIX + name)).values()
         return cache.get(CACHE_KEY_PREFIX + name, None)
 
+    @property
+    def full_name(self) -> str:
+        """Get the full cache key with task name and UID"""
+        key = CACHE_KEY_PREFIX + self.task_name
+        if self.result.uid:
+            uid_suffix = f":{self.result.uid}"
+            key += uid_suffix
+            if not self.task_name.endswith(uid_suffix):
+                self.task_name += uid_suffix
+        return key
+
     def delete(self):
         """Delete task info from cache"""
-        return cache.delete(CACHE_KEY_PREFIX + self.task_name)
+        return cache.delete(self.full_name)
 
     def update_metrics(self):
         """Update prometheus metrics"""
@@ -89,17 +103,13 @@ class TaskInfo:
         GAUGE_TASKS.labels(
             task_name=self.task_name.split(":")[0],
             task_uid=self.result.uid or "",
-            status=self.result.status.value,
+            status=self.result.status.name.lower(),
         ).set(duration)
 
     def save(self, timeout_hours=6):
         """Save task into cache"""
-        key = CACHE_KEY_PREFIX + self.task_name
-        if self.result.uid:
-            key += f":{self.result.uid}"
-            self.task_name += f":{self.result.uid}"
         self.update_metrics()
-        cache.set(key, self, timeout=timeout_hours * 60 * 60)
+        cache.set(self.full_name, self, timeout=timeout_hours * 60 * 60)
 
 
 class MonitoredTask(Task):

authentik/events/tests/test_tasks.py

@@ -0,0 +1,43 @@
+"""Test Monitored tasks"""
+from django.test import TestCase
+
+from authentik.events.monitored_tasks import MonitoredTask, TaskInfo, TaskResult, TaskResultStatus
+from authentik.lib.generators import generate_id
+from authentik.root.celery import CELERY_APP
+
+
+class TestMonitoredTasks(TestCase):
+    """Test Monitored tasks"""
+
+    def test_failed_successful_remove_state(self):
+        """Test that a task with `save_on_success` set to `False` that failed saves
+        a state, and upon successful completion will delete the state"""
+        should_fail = True
+        uid = generate_id()
+
+        @CELERY_APP.task(
+            bind=True,
+            base=MonitoredTask,
+        )
+        def test_task(self: MonitoredTask):
+            self.save_on_success = False
+            self.set_uid(uid)
+            self.set_status(
+                TaskResult(TaskResultStatus.ERROR if should_fail else TaskResultStatus.SUCCESSFUL)
+            )
+
+        # First test successful run
+        should_fail = False
+        test_task.delay().get()
+        self.assertIsNone(TaskInfo.by_name(f"test_task:{uid}"))
+
+        # Then test failed
+        should_fail = True
+        test_task.delay().get()
+        info = TaskInfo.by_name(f"test_task:{uid}")
+        self.assertEqual(info.result.status, TaskResultStatus.ERROR)
+
+        # Then after that, the state should be removed
+        should_fail = False
+        test_task.delay().get()
+        self.assertIsNone(TaskInfo.by_name(f"test_task:{uid}"))

authentik/flows/api/flows_diagram.py

@@ -23,7 +23,8 @@ class DiagramElement:
     style: list[str] = field(default_factory=lambda: ["[", "]"])
 
     def __str__(self) -> str:
-        element = f'{self.identifier}{self.style[0]}"{self.description}"{self.style[1]}'
+        description = self.description.replace('"', "#quot;")
+        element = f'{self.identifier}{self.style[0]}"{description}"{self.style[1]}'
         if self.action is not None:
             if self.action != "":
                 element = f"--{self.action}--> {element}"

authentik/flows/challenge.py

@@ -154,7 +154,7 @@ class AutosubmitChallenge(Challenge):
     """Autosubmit challenge used to send and navigate a POST request"""
 
     url = CharField()
-    attrs = DictField(child=CharField())
+    attrs = DictField(child=CharField(allow_blank=True), allow_empty=True)
     title = CharField(required=False)
     component = CharField(default="ak-stage-autosubmit")
 

authentik/flows/markers.py

@@ -30,7 +30,7 @@ class StageMarker:
         return binding
 
 
-@dataclass
+@dataclass(slots=True)
 class ReevaluateMarker(StageMarker):
     """Reevaluate Marker, forces stage's policies to be evaluated again."""
 

authentik/flows/planner.py

@@ -33,7 +33,7 @@ PLAN_CONTEXT_SOURCE = "source"
 # Is set by the Flow Planner when a FlowToken was used, and the currently active flow plan
 # was restored.
 PLAN_CONTEXT_IS_RESTORED = "is_restored"
-CACHE_TIMEOUT = int(CONFIG.y("redis.cache_timeout_flows"))
+CACHE_TIMEOUT = int(CONFIG.get("redis.cache_timeout_flows"))
 CACHE_PREFIX = "goauthentik.io/flows/planner/"
 
 
@@ -45,7 +45,7 @@ def cache_key(flow: Flow, user: Optional[User] = None) -> str:
     return prefix
 
 
-@dataclass
+@dataclass(slots=True)
 class FlowPlan:
     """This data-class is the output of a FlowPlanner. It holds a flat list
     of all Stages that should be run."""

authentik/flows/stage.py

@@ -204,12 +204,12 @@ class ChallengeStageView(StageView):
         for field, errors in response.errors.items():
             for error in errors:
                 full_errors.setdefault(field, [])
-                full_errors[field].append(
-                    {
-                        "string": str(error),
-                        "code": error.code,
-                    }
-                )
+                field_error = {
+                    "string": str(error),
+                }
+                if hasattr(error, "code"):
+                    field_error["code"] = error.code
+                full_errors[field].append(field_error)
         challenge_response.initial_data["response_errors"] = full_errors
         if not challenge_response.is_valid():
             self.logger.error(

authentik/flows/tests/test_challenges.py

@@ -0,0 +1,28 @@
+"""flow views tests"""
+from django.test import TestCase
+
+from authentik.flows.challenge import AutosubmitChallenge, ChallengeTypes
+
+
+class TestChallenges(TestCase):
+    """Test generic challenges"""
+
+    def test_autosubmit_blank(self):
+        """Test blank autosubmit"""
+        challenge = AutosubmitChallenge(
+            data={
+                "type": ChallengeTypes.NATIVE.value,
+                "url": "http://localhost",
+                "attrs": {},
+            }
+        )
+        self.assertTrue(challenge.is_valid(raise_exception=True))
+        # Test with an empty value
+        challenge = AutosubmitChallenge(
+            data={
+                "type": ChallengeTypes.NATIVE.value,
+                "url": "http://localhost",
+                "attrs": {"foo": ""},
+            }
+        )
+        self.assertTrue(challenge.is_valid(raise_exception=True))

authentik/flows/tests/test_executor.py

@@ -18,7 +18,6 @@ from authentik.flows.planner import FlowPlan, FlowPlanner
 from authentik.flows.stage import PLAN_CONTEXT_PENDING_USER_IDENTIFIER, StageView
 from authentik.flows.tests import FlowTestCase
 from authentik.flows.views.executor import NEXT_ARG_NAME, SESSION_KEY_PLAN, FlowExecutorView
-from authentik.lib.config import CONFIG
 from authentik.lib.generators import generate_id
 from authentik.policies.dummy.models import DummyPolicy
 from authentik.policies.models import PolicyBinding
@@ -85,7 +84,6 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )
@@ -111,7 +109,6 @@ class TestFlowExecutor(FlowTestCase):
             denied_action=FlowDeniedAction.CONTINUE,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )
@@ -128,7 +125,6 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         dest = "/unique-string"
         url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
         response = self.client.get(url + f"?{NEXT_ARG_NAME}={dest}")
@@ -145,7 +141,6 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )

authentik/flows/views/inspector.py

@@ -23,6 +23,7 @@ from authentik.flows.api.bindings import FlowStageBindingSerializer
 from authentik.flows.models import Flow
 from authentik.flows.planner import FlowPlan
 from authentik.flows.views.executor import SESSION_KEY_HISTORY, SESSION_KEY_PLAN
+from authentik.root.install_id import get_install_id
 
 
 class FlowInspectorPlanSerializer(PassiveSerializer):
@@ -51,7 +52,7 @@ class FlowInspectorPlanSerializer(PassiveSerializer):
         """Get a unique session ID"""
         request: Request = self.context["request"]
         return sha256(
-            f"{request._request.session.session_key}-{settings.SECRET_KEY}".encode("ascii")
+            f"{request._request.session.session_key}-{get_install_id()}".encode("ascii")
         ).hexdigest()
 
 

authentik/lib/apps.py

@@ -1,10 +0,0 @@
-"""authentik lib app config"""
-from django.apps import AppConfig
-
-
-class AuthentikLibConfig(AppConfig):
-    """authentik lib app config"""
-
-    name = "authentik.lib"
-    label = "authentik_lib"
-    verbose_name = "authentik lib"

authentik/lib/avatars.py

@@ -175,7 +175,7 @@ def get_avatar(user: "User") -> str:
         "initials": avatar_mode_generated,
         "gravatar": avatar_mode_gravatar,
     }
-    modes: str = CONFIG.y("avatars", "none")
+    modes: str = CONFIG.get("avatars", "none")
     for mode in modes.split(","):
         avatar = None
         if mode in mode_map:

authentik/lib/config.py

@@ -2,13 +2,15 @@
 import os
 from collections.abc import Mapping
 from contextlib import contextmanager
+from dataclasses import dataclass, field
+from enum import Enum
 from glob import glob
-from json import dumps, loads
+from json import JSONEncoder, dumps, loads
 from json.decoder import JSONDecodeError
 from pathlib import Path
 from sys import argv, stderr
 from time import time
-from typing import Any
+from typing import Any, Optional
 from urllib.parse import urlparse
 
 import yaml
@@ -32,15 +34,44 @@ def get_path_from_dict(root: dict, path: str, sep=".", default=None) -> Any:
     return root
 
 
+@dataclass
+class Attr:
+    """Single configuration attribute"""
+
+    class Source(Enum):
+        """Sources a configuration attribute can come from, determines what should be done with
+        Attr.source (and if it's set at all)"""
+
+        UNSPECIFIED = "unspecified"
+        ENV = "env"
+        CONFIG_FILE = "config_file"
+        URI = "uri"
+
+    value: Any
+
+    source_type: Source = field(default=Source.UNSPECIFIED)
+
+    # depending on source_type, might contain the environment variable or the path
+    # to the config file containing this change or the file containing this value
+    source: Optional[str] = field(default=None)
+
+
+class AttrEncoder(JSONEncoder):
+    """JSON encoder that can deal with `Attr` classes"""
+
+    def default(self, o: Any) -> Any:
+        if isinstance(o, Attr):
+            return o.value
+        return super().default(o)
+
+
 class ConfigLoader:
     """Search through SEARCH_PATHS and load configuration. Environment variables starting with
     `ENV_PREFIX` are also applied.
 
     A variable like AUTHENTIK_POSTGRESQL__HOST would translate to postgresql.host"""
 
-    loaded_file = []
-
-    def __init__(self):
+    def __init__(self, **kwargs):
         super().__init__()
         self.__config = {}
         base_dir = Path(__file__).parent.joinpath(Path("../..")).resolve()
@@ -65,6 +96,7 @@ class ConfigLoader:
                         # Update config with env file
                         self.update_from_file(env_file)
         self.update_from_env()
+        self.update(self.__config, kwargs)
 
     def log(self, level: str, message: str, **kwargs):
         """Custom Log method, we want to ensure ConfigLoader always logs JSON even when
@@ -86,22 +118,34 @@ class ConfigLoader:
             else:
                 if isinstance(value, str):
                     value = self.parse_uri(value)
+                elif isinstance(value, Attr) and isinstance(value.value, str):
+                    value = self.parse_uri(value.value)
+                elif not isinstance(value, Attr):
+                    value = Attr(value)
                 root[key] = value
         return root
 
-    def parse_uri(self, value: str) -> str:
+    def refresh(self, key: str):
+        """Update a single value"""
+        attr: Attr = get_path_from_dict(self.raw, key)
+        if attr.source_type != Attr.Source.URI:
+            return
+        attr.value = self.parse_uri(attr.source).value
+
+    def parse_uri(self, value: str) -> Attr:
         """Parse string values which start with a URI"""
         url = urlparse(value)
+        parsed_value = value
         if url.scheme == "env":
-            value = os.getenv(url.netloc, url.query)
+            parsed_value = os.getenv(url.netloc, url.query)
         if url.scheme == "file":
             try:
                 with open(url.path, "r", encoding="utf8") as _file:
-                    value = _file.read().strip()
+                    parsed_value = _file.read().strip()
             except OSError as exc:
                 self.log("error", f"Failed to read config value from {url.path}: {exc}")
-                value = url.query
-        return value
+                parsed_value = url.query
+        return Attr(parsed_value, Attr.Source.URI, value)
 
     def update_from_file(self, path: Path):
         """Update config from file contents"""
@@ -110,7 +154,6 @@ class ConfigLoader:
                 try:
                     self.update(self.__config, yaml.safe_load(file))
                     self.log("debug", "Loaded config", file=str(path))
-                    self.loaded_file.append(path)
                 except yaml.YAMLError as exc:
                     raise ImproperlyConfigured from exc
         except PermissionError as exc:
@@ -121,10 +164,6 @@ class ConfigLoader:
                 error=str(exc),
             )
 
-    def update_from_dict(self, update: dict):
-        """Update config from dict"""
-        self.__config.update(update)
-
     def update_from_env(self):
         """Check environment variables"""
         outer = {}
@@ -145,7 +184,7 @@ class ConfigLoader:
                 value = loads(value)
             except JSONDecodeError:
                 pass
-            current_obj[dot_parts[-1]] = value
+            current_obj[dot_parts[-1]] = Attr(value, Attr.Source.ENV, key)
             idx += 1
         if idx > 0:
             self.log("debug", "Loaded environment variables", count=idx)
@@ -154,28 +193,32 @@ class ConfigLoader:
     @contextmanager
     def patch(self, path: str, value: Any):
         """Context manager for unittests to patch a value"""
-        original_value = self.y(path)
-        self.y_set(path, value)
+        original_value = self.get(path)
+        self.set(path, value)
         try:
             yield
         finally:
-            self.y_set(path, original_value)
+            self.set(path, original_value)
 
     @property
     def raw(self) -> dict:
         """Get raw config dictionary"""
         return self.__config
 
-    # pylint: disable=invalid-name
-    def y(self, path: str, default=None, sep=".") -> Any:
+    def get(self, path: str, default=None, sep=".") -> Any:
         """Access attribute by using yaml path"""
         # Walk sub_dicts before parsing path
         root = self.raw
         # Walk each component of the path
-        return get_path_from_dict(root, path, sep=sep, default=default)
+        attr: Attr = get_path_from_dict(root, path, sep=sep, default=Attr(default))
+        return attr.value
 
-    def y_set(self, path: str, value: Any, sep="."):
-        """Set value using same syntax as y()"""
+    def get_bool(self, path: str, default=False) -> bool:
+        """Wrapper for get that converts value into boolean"""
+        return str(self.get(path, default)).lower() == "true"
+
+    def set(self, path: str, value: Any, sep="."):
+        """Set value using same syntax as get()"""
         # Walk sub_dicts before parsing path
         root = self.raw
         # Walk each component of the path
@@ -184,17 +227,14 @@ class ConfigLoader:
             if comp not in root:
                 root[comp] = {}
             root = root.get(comp, {})
-        root[path_parts[-1]] = value
-
-    def y_bool(self, path: str, default=False) -> bool:
-        """Wrapper for y that converts value into boolean"""
-        return str(self.y(path, default)).lower() == "true"
+        root[path_parts[-1]] = Attr(value)
 
 
 CONFIG = ConfigLoader()
 
+
 if __name__ == "__main__":
     if len(argv) < 2:
-        print(dumps(CONFIG.raw, indent=4))
+        print(dumps(CONFIG.raw, indent=4, cls=AttrEncoder))
     else:
-        print(CONFIG.y(argv[1]))
+        print(CONFIG.get(argv[1]))

authentik/lib/default.yml

@@ -5,18 +5,25 @@ postgresql:
   name: authentik
   user: authentik
   port: 5432
-  password: 'env://POSTGRES_PASSWORD'
+  password: "env://POSTGRES_PASSWORD"
   use_pgbouncer: false
 
 listen:
   listen_http: 0.0.0.0:9000
   listen_https: 0.0.0.0:9443
   listen_metrics: 0.0.0.0:9300
+  trusted_proxy_cidrs:
+    - 127.0.0.0/8
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - fe80::/10
+    - ::1/128
 
 redis:
   host: localhost
   port: 6379
-  password: ''
+  password: ""
   tls: false
   tls_reqs: "none"
   db: 0
@@ -26,6 +33,7 @@ redis:
   cache_timeout_reputation: 300
 
 debug: false
+remote_debug: false
 
 log_level: info
 
@@ -65,6 +73,7 @@ outposts:
 
 ldap:
   task_timeout_hours: 2
+  page_size: 50
   tls:
     ciphers: null
 

authentik/lib/sentry.py

@@ -51,18 +51,18 @@ class SentryTransport(HttpTransport):
 
 def sentry_init(**sentry_init_kwargs):
     """Configure sentry SDK"""
-    sentry_env = CONFIG.y("error_reporting.environment", "customer")
+    sentry_env = CONFIG.get("error_reporting.environment", "customer")
     kwargs = {
         "environment": sentry_env,
-        "send_default_pii": CONFIG.y_bool("error_reporting.send_pii", False),
+        "send_default_pii": CONFIG.get_bool("error_reporting.send_pii", False),
         "_experiments": {
-            "profiles_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.1)),
+            "profiles_sample_rate": float(CONFIG.get("error_reporting.sample_rate", 0.1)),
         },
     }
     kwargs.update(**sentry_init_kwargs)
     # pylint: disable=abstract-class-instantiated
     sentry_sdk_init(
-        dsn=CONFIG.y("error_reporting.sentry_dsn"),
+        dsn=CONFIG.get("error_reporting.sentry_dsn"),
         integrations=[
             ArgvIntegration(),
             StdlibIntegration(),
@@ -92,7 +92,7 @@ def traces_sampler(sampling_context: dict) -> float:
         return 0
     if _type == "websocket":
         return 0
-    return float(CONFIG.y("error_reporting.sample_rate", 0.1))
+    return float(CONFIG.get("error_reporting.sample_rate", 0.1))
 
 
 def before_send(event: dict, hint: dict) -> Optional[dict]:

authentik/lib/tests/test_config.py

@@ -16,23 +16,23 @@ class TestConfig(TestCase):
         config = ConfigLoader()
         environ[ENV_PREFIX + "_test__test"] = "bar"
         config.update_from_env()
-        self.assertEqual(config.y("test.test"), "bar")
+        self.assertEqual(config.get("test.test"), "bar")
 
     def test_patch(self):
         """Test patch decorator"""
         config = ConfigLoader()
-        config.y_set("foo.bar", "bar")
-        self.assertEqual(config.y("foo.bar"), "bar")
+        config.set("foo.bar", "bar")
+        self.assertEqual(config.get("foo.bar"), "bar")
         with config.patch("foo.bar", "baz"):
-            self.assertEqual(config.y("foo.bar"), "baz")
-        self.assertEqual(config.y("foo.bar"), "bar")
+            self.assertEqual(config.get("foo.bar"), "baz")
+        self.assertEqual(config.get("foo.bar"), "bar")
 
     def test_uri_env(self):
         """Test URI parsing (environment)"""
         config = ConfigLoader()
         environ["foo"] = "bar"
-        self.assertEqual(config.parse_uri("env://foo"), "bar")
-        self.assertEqual(config.parse_uri("env://foo?bar"), "bar")
+        self.assertEqual(config.parse_uri("env://foo").value, "bar")
+        self.assertEqual(config.parse_uri("env://foo?bar").value, "bar")
 
     def test_uri_file(self):
         """Test URI parsing (file load)"""
@@ -41,11 +41,31 @@ class TestConfig(TestCase):
         write(file, "foo".encode())
         _, file2_name = mkstemp()
         chmod(file2_name, 0o000)  # Remove all permissions so we can't read the file
-        self.assertEqual(config.parse_uri(f"file://{file_name}"), "foo")
-        self.assertEqual(config.parse_uri(f"file://{file2_name}?def"), "def")
+        self.assertEqual(config.parse_uri(f"file://{file_name}").value, "foo")
+        self.assertEqual(config.parse_uri(f"file://{file2_name}?def").value, "def")
         unlink(file_name)
         unlink(file2_name)
 
+    def test_uri_file_update(self):
+        """Test URI parsing (file load and update)"""
+        file, file_name = mkstemp()
+        write(file, "foo".encode())
+        config = ConfigLoader(file_test=f"file://{file_name}")
+        self.assertEqual(config.get("file_test"), "foo")
+
+        # Update config file
+        write(file, "bar".encode())
+        config.refresh("file_test")
+        self.assertEqual(config.get("file_test"), "foobar")
+
+        unlink(file_name)
+
+    def test_uri_env_full(self):
+        """Test URI set as env variable"""
+        environ["AUTHENTIK_TEST_VAR"] = "file:///foo?bar"
+        config = ConfigLoader()
+        self.assertEqual(config.get("test_var"), "bar")
+
     def test_file_update(self):
         """Test update_from_file"""
         config = ConfigLoader()

authentik/lib/tests/test_http.py

@@ -1,7 +1,7 @@
 """Test HTTP Helpers"""
 from django.test import RequestFactory, TestCase
 
-from authentik.core.models import USER_ATTRIBUTE_CAN_OVERRIDE_IP, Token, TokenIntents
+from authentik.core.models import Token, TokenIntents, UserTypes
 from authentik.core.tests.utils import create_test_admin_user
 from authentik.lib.utils.http import OUTPOST_REMOTE_IP_HEADER, OUTPOST_TOKEN_HEADER, get_client_ip
 from authentik.lib.views import bad_request_message
@@ -53,7 +53,7 @@ class TestHTTP(TestCase):
         )
         self.assertEqual(get_client_ip(request), "127.0.0.1")
         # Valid
-        self.user.attributes[USER_ATTRIBUTE_CAN_OVERRIDE_IP] = True
+        self.user.type = UserTypes.INTERNAL_SERVICE_ACCOUNT
         self.user.save()
         request = self.factory.get(
             "/",

authentik/lib/utils/http.py

@@ -16,10 +16,12 @@ LOGGER = get_logger()
 
 def _get_client_ip_from_meta(meta: dict[str, Any]) -> str:
     """Attempt to get the client's IP by checking common HTTP Headers.
-    Returns none if no IP Could be found"""
+    Returns none if no IP Could be found
+
+    No additional validation is done here as requests are expected to only arrive here
+    via the go proxy, which deals with validating these headers for us"""
     headers = (
         "HTTP_X_FORWARDED_FOR",
-        "HTTP_X_REAL_IP",
         "REMOTE_ADDR",
     )
     for _header in headers:
@@ -31,9 +33,8 @@ def _get_client_ip_from_meta(meta: dict[str, Any]) -> str:
 
 def _get_outpost_override_ip(request: HttpRequest) -> Optional[str]:
     """Get the actual remote IP when set by an outpost. Only
-    allowed when the request is authenticated, by a user with USER_ATTRIBUTE_CAN_OVERRIDE_IP set
-    to outpost"""
-    from authentik.core.models import USER_ATTRIBUTE_CAN_OVERRIDE_IP, Token, TokenIntents
+    allowed when the request is authenticated, by an outpost internal service account"""
+    from authentik.core.models import Token, TokenIntents, UserTypes
 
     if OUTPOST_REMOTE_IP_HEADER not in request.META or OUTPOST_TOKEN_HEADER not in request.META:
         return None
@@ -49,7 +50,7 @@ def _get_outpost_override_ip(request: HttpRequest) -> Optional[str]:
         LOGGER.warning("Attempted remote-ip override without token", fake_ip=fake_ip)
         return None
     user = token.user
-    if not user.group_attributes(request).get(USER_ATTRIBUTE_CAN_OVERRIDE_IP, False):
+    if user.type != UserTypes.INTERNAL_SERVICE_ACCOUNT:
         LOGGER.warning(
             "Remote-IP override: user doesn't have permission",
             user=user,

authentik/lib/utils/reflection.py

@@ -50,7 +50,7 @@ def get_env() -> str:
     """Get environment in which authentik is currently running"""
     if "CI" in os.environ:
         return "ci"
-    if CONFIG.y_bool("debug"):
+    if CONFIG.get_bool("debug"):
         return "dev"
     if SERVICE_HOST_ENV_NAME in os.environ:
         return "kubernetes"

authentik/outposts/channels.py

@@ -28,7 +28,7 @@ class WebsocketMessageInstruction(IntEnum):
     TRIGGER_UPDATE = 2
 
 
-@dataclass
+@dataclass(slots=True)
 class WebsocketMessage:
     """Complete Websocket Message that is being sent"""
 

authentik/outposts/controllers/base.py

@@ -97,7 +97,7 @@ class BaseController:
         if self.outpost.config.container_image is not None:
             return self.outpost.config.container_image
 
-        image_name_template: str = CONFIG.y("outposts.container_image_base")
+        image_name_template: str = CONFIG.get("outposts.container_image_base")
         return image_name_template % {
             "type": self.outpost.type,
             "version": __version__,

authentik/outposts/controllers/k8s/base.py

@@ -1,16 +1,22 @@
 """Base Kubernetes Reconciler"""
+from dataclasses import asdict
+from json import dumps
 from typing import TYPE_CHECKING, Generic, Optional, TypeVar
 
+from dacite.core import from_dict
 from django.utils.text import slugify
-from kubernetes.client import V1ObjectMeta
+from jsonpatch import JsonPatchConflict, JsonPatchException, JsonPatchTestFailed, apply_patch
+from kubernetes.client import ApiClient, V1ObjectMeta
 from kubernetes.client.exceptions import ApiException, OpenApiException
 from kubernetes.client.models.v1_deployment import V1Deployment
 from kubernetes.client.models.v1_pod import V1Pod
+from requests import Response
 from structlog.stdlib import get_logger
 from urllib3.exceptions import HTTPError
 
 from authentik import __version__
 from authentik.outposts.apps import MANAGED_OUTPOST
+from authentik.outposts.controllers.base import ControllerException
 from authentik.outposts.controllers.k8s.triggers import NeedsRecreate, NeedsUpdate
 
 if TYPE_CHECKING:
@@ -34,11 +40,23 @@ class KubernetesObjectReconciler(Generic[T]):
         self.namespace = controller.outpost.config.kubernetes_namespace
         self.logger = get_logger().bind(type=self.__class__.__name__)
 
+    def get_patch(self):
+        """Get any patches that apply to this CRD"""
+        patches = self.controller.outpost.config.kubernetes_json_patches
+        if not patches:
+            return None
+        return patches.get(self.reconciler_name(), None)
+
     @property
     def is_embedded(self) -> bool:
         """Return true if the current outpost is embedded"""
         return self.controller.outpost.managed == MANAGED_OUTPOST
 
+    @staticmethod
+    def reconciler_name() -> str:
+        """A name this reconciler is identified by in the configuration"""
+        raise NotImplementedError
+
     @property
     def noop(self) -> bool:
         """Return true if this object should not be created/updated/deleted in this cluster"""
@@ -55,6 +73,32 @@ class KubernetesObjectReconciler(Generic[T]):
             }
         ).lower()
 
+    def get_patched_reference_object(self) -> T:
+        """Get patched reference object"""
+        reference = self.get_reference_object()
+        patch = self.get_patch()
+        try:
+            json = ApiClient().sanitize_for_serialization(reference)
+        # Custom objects will not be known to the clients openapi types
+        except AttributeError:
+            json = asdict(reference)
+        try:
+            ref = json
+            if patch is not None:
+                ref = apply_patch(json, patch)
+        except (JsonPatchException, JsonPatchConflict, JsonPatchTestFailed) as exc:
+            raise ControllerException(f"JSON Patch failed: {exc}") from exc
+        mock_response = Response()
+        mock_response.data = dumps(ref)
+
+        try:
+            result = ApiClient().deserialize(mock_response, reference.__class__.__name__)
+        # Custom objects will not be known to the clients openapi types
+        except AttributeError:
+            result = from_dict(reference.__class__, data=ref)
+
+        return result
+
     # pylint: disable=invalid-name
     def up(self):
         """Create object if it doesn't exist, update if needed or recreate if needed."""
@@ -62,7 +106,7 @@ class KubernetesObjectReconciler(Generic[T]):
         if self.noop:
             self.logger.debug("Object is noop")
             return
-        reference = self.get_reference_object()
+        reference = self.get_patched_reference_object()
         try:
             try:
                 current = self.retrieve()
@@ -129,6 +173,16 @@ class KubernetesObjectReconciler(Generic[T]):
         if current.metadata.labels != reference.metadata.labels:
             raise NeedsUpdate()
 
+        patch = self.get_patch()
+        if patch is not None:
+            current_json = ApiClient().sanitize_for_serialization(current)
+
+            try:
+                if apply_patch(current_json, patch) != current_json:
+                    raise NeedsUpdate()
+            except (JsonPatchException, JsonPatchConflict, JsonPatchTestFailed) as exc:
+                raise ControllerException(f"JSON Patch failed: {exc}") from exc
+
     def create(self, reference: T):
         """API Wrapper to create object"""
         raise NotImplementedError

authentik/outposts/controllers/k8s/deployment.py

@@ -43,6 +43,10 @@ class DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):
         self.api = AppsV1Api(controller.client)
         self.outpost = self.controller.outpost
 
+    @staticmethod
+    def reconciler_name() -> str:
+        return "deployment"
+
     def reconcile(self, current: V1Deployment, reference: V1Deployment):
         compare_ports(
             current.spec.template.spec.containers[0].ports,

authentik/outposts/controllers/k8s/secret.py

@@ -24,6 +24,10 @@ class SecretReconciler(KubernetesObjectReconciler[V1Secret]):
         super().__init__(controller)
         self.api = CoreV1Api(controller.client)
 
+    @staticmethod
+    def reconciler_name() -> str:
+        return "secret"
+
     def reconcile(self, current: V1Secret, reference: V1Secret):
         super().reconcile(current, reference)
         for key in reference.data.keys():