release: 0.14.1-stable

L112 - L115 is a suggestion I'm unsure of, but wanted to somehow improve it. Feel free to discard, but I still recommend signup>sign-up on L114 of origin.

On L124, the resulting webpage shows "Active- Directory" (note the space after the hyphen). Not sure how to fix this though.

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.14.0-rc2
+current_version = 0.14.1-stable
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)

.github/workflows/release.yml

@@ -18,11 +18,11 @@ jobs:
       - name: Building Docker Image
         run: docker build
           --no-cache
-          -t beryju/authentik:0.14.0-rc2
+          -t beryju/authentik:0.14.1-stable
           -t beryju/authentik:latest
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik:0.14.0-rc2
+        run: docker push beryju/authentik:0.14.1-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik:latest
   build-proxy:
@@ -48,11 +48,11 @@ jobs:
           cd proxy/
           docker build \
           --no-cache \
-          -t beryju/authentik-proxy:0.14.0-rc2 \
+          -t beryju/authentik-proxy:0.14.1-stable \
           -t beryju/authentik-proxy:latest \
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-proxy:0.14.0-rc2
+        run: docker push beryju/authentik-proxy:0.14.1-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik-proxy:latest
   build-static:
@@ -69,11 +69,11 @@ jobs:
           cd web/
           docker build \
           --no-cache \
-          -t beryju/authentik-static:0.14.0-rc2 \
+          -t beryju/authentik-static:0.14.1-stable \
           -t beryju/authentik-static:latest \
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-static:0.14.0-rc2
+        run: docker push beryju/authentik-static:0.14.1-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik-static:latest
   test-release:
@@ -107,5 +107,5 @@ jobs:
           SENTRY_PROJECT: authentik
           SENTRY_URL: https://sentry.beryju.org
         with:
-          tagName: 0.14.0-rc2
+          tagName: 0.14.1-stable
           environment: beryjuorg-prod

Pipfile.lock

@@ -74,18 +74,18 @@
         },
         "boto3": {
             "hashes": [
-                "sha256:0bb2c3159b9f5e0df50430bf06a155bd7f27f480825b6374dde807d42360a668",
-                "sha256:a49b3ab4bfa2f6394ba60165cfc468410797dd410f32eed47e22f61451ee986e"
+                "sha256:ba8de10d3ede338d51ae47e428b97dcc1d1b507741aa98697e63e879a147f4aa",
+                "sha256:e3f10ed6d9ca98415fdec15c85e50a89ec38d6229bce3fafd5e7965b16c4ebc5"
             ],
             "index": "pypi",
-            "version": "==1.16.43"
+            "version": "==1.16.44"
         },
         "botocore": {
             "hashes": [
-                "sha256:7398c900dbd4e3d61647269215396ea3e8082f494f3e7b65d9b6aca049c1d463",
-                "sha256:795a67338cadb0c3a45014a6c81659da6af623a4e973812f87a6f9d9fb7712e9"
+                "sha256:4ff05bc089ba78a5996f06dcfddf8ca51583e30ce779ed95e9952e90c1907420",
+                "sha256:7725e08c95ae96c4dbd955cb4ae44a0c06d3e41f76a7feb0a941c27a44c63113"
             ],
-            "version": "==1.19.43"
+            "version": "==1.19.44"
         },
         "cachetools": {
             "hashes": [
@@ -152,11 +152,11 @@
         },
         "channels": {
             "hashes": [
-                "sha256:74db79c9eca616be69d38013b22083ab5d3f9ccda1ab5e69096b1bb7da2d9b18",
-                "sha256:f50a6e79757a64c1e45e95e144a2ac5f1e99ee44a0718ab182c501f5e5abd268"
+                "sha256:056b72e51080a517a0f33a0a30003e03833b551d75394d6636c885d4edb8188f",
+                "sha256:3f15bdd2138bb4796e76ea588a0a344b12a7964ea9b2e456f992fddb988a4317"
             ],
             "index": "pypi",
-            "version": "==3.0.2"
+            "version": "==3.0.3"
         },
         "channels-redis": {
             "hashes": [
@@ -899,10 +899,10 @@
         },
         "pytz": {
             "hashes": [
-                "sha256:3e6b7dd2d1e0a59084bcee14a17af60c5c562cdc16d828e8eba2e683d3a7e268",
-                "sha256:5c55e189b682d420be27c6995ba6edce0c0a77dd67bfbe2ae6607134d5851ffd"
+                "sha256:16962c5fb8db4a8f63a26646d8886e9d769b6c511543557bc84e9569fb9a9cb4",
+                "sha256:180befebb1927b16f6b57101720075a984c019ac16b1b7575673bea42c6c3da5"
             ],
-            "version": "==2020.4"
+            "version": "==2020.5"
         },
         "pyyaml": {
             "hashes": [
@@ -1607,10 +1607,10 @@
         },
         "pytz": {
             "hashes": [
-                "sha256:3e6b7dd2d1e0a59084bcee14a17af60c5c562cdc16d828e8eba2e683d3a7e268",
-                "sha256:5c55e189b682d420be27c6995ba6edce0c0a77dd67bfbe2ae6607134d5851ffd"
+                "sha256:16962c5fb8db4a8f63a26646d8886e9d769b6c511543557bc84e9569fb9a9cb4",
+                "sha256:180befebb1927b16f6b57101720075a984c019ac16b1b7575673bea42c6c3da5"
             ],
-            "version": "==2020.4"
+            "version": "==2020.5"
         },
         "pyyaml": {
             "hashes": [

authentik/__init__.py

@@ -1,2 +1,2 @@
 """authentik"""
-__version__ = "0.14.0-rc2"
+__version__ = "0.14.1-stable"

authentik/outposts/controllers/base.py

@@ -1,5 +1,5 @@
 """Base Controller"""
-from typing import Dict, List
+from dataclasses import dataclass
 
 from structlog import get_logger
 from structlog.testing import capture_logs
@@ -7,15 +7,26 @@ from structlog.testing import capture_logs
 from authentik.lib.sentry import SentryIgnoredException
 from authentik.outposts.models import Outpost, OutpostServiceConnection
 
+FIELD_MANAGER = "goauthentik.io"
+
 
 class ControllerException(SentryIgnoredException):
     """Exception raised when anything fails during controller run"""
 
 
+@dataclass
+class DeploymentPort:
+    """Info about deployment's single port."""
+
+    port: int
+    name: str
+    protocol: str
+
+
 class BaseController:
     """Base Outpost deployment controller"""
 
-    deployment_ports: Dict[str, int]
+    deployment_ports: list[DeploymentPort]
 
     outpost: Outpost
     connection: OutpostServiceConnection
@@ -24,14 +35,14 @@ class BaseController:
         self.outpost = outpost
         self.connection = connection
         self.logger = get_logger()
-        self.deployment_ports = {}
+        self.deployment_ports = []
 
     # pylint: disable=invalid-name
     def up(self):
         """Called by scheduled task to reconcile deployment/service/etc"""
         raise NotImplementedError
 
-    def up_with_logs(self) -> List[str]:
+    def up_with_logs(self) -> list[str]:
         """Call .up() but capture all log output and return it."""
         with capture_logs() as logs:
             self.up()

authentik/outposts/controllers/docker.py

@@ -68,7 +68,10 @@ class DockerController(BaseController):
                 "image": image_name,
                 "name": f"authentik-proxy-{self.outpost.uuid.hex}",
                 "detach": True,
-                "ports": {x: x for _, x in self.deployment_ports.items()},
+                "ports": {
+                    f"{port.port}/{port.protocol.lower()}": port.port
+                    for port in self.deployment_ports
+                },
                 "environment": self._get_env(),
                 "labels": self._get_labels(),
             }
@@ -139,7 +142,10 @@ class DockerController(BaseController):
 
     def get_static_deployment(self) -> str:
         """Generate docker-compose yaml for proxy, version 3.5"""
-        ports = [f"{x}:{x}" for _, x in self.deployment_ports.items()]
+        ports = [
+            f"{port.port}:{port.port}/{port.protocol.lower()}"
+            for port in self.deployment_ports
+        ]
         image_prefix = CONFIG.y("outposts.docker_image_base")
         compose = {
             "version": "3.5",

authentik/outposts/controllers/k8s/base.py

@@ -93,7 +93,8 @@ class KubernetesObjectReconciler(Generic[T]):
     def reconcile(self, current: T, reference: T):
         """Check what operations should be done, should be raised as
         ReconcileTrigger"""
-        raise NotImplementedError
+        if current.metadata.annotations != reference.metadata.annotations:
+            raise NeedsUpdate()
 
     def create(self, reference: T):
         """API Wrapper to create object"""

authentik/outposts/controllers/k8s/deployment.py

@@ -18,6 +18,7 @@ from kubernetes.client import (
 
 from authentik import __version__
 from authentik.lib.config import CONFIG
+from authentik.outposts.controllers.base import FIELD_MANAGER
 from authentik.outposts.controllers.k8s.base import (
     KubernetesObjectReconciler,
     NeedsUpdate,
@@ -43,6 +44,7 @@ class DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):
         return f"authentik-outpost-{self.controller.outpost.uuid.hex}"
 
     def reconcile(self, current: V1Deployment, reference: V1Deployment):
+        super().reconcile(current, reference)
         if current.spec.replicas != reference.spec.replicas:
             raise NeedsUpdate()
         if (
@@ -63,8 +65,14 @@ class DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):
         """Get deployment object for outpost"""
         # Generate V1ContainerPort objects
         container_ports = []
-        for port_name, port in self.controller.deployment_ports.items():
-            container_ports.append(V1ContainerPort(container_port=port, name=port_name))
+        for port in self.controller.deployment_ports:
+            container_ports.append(
+                V1ContainerPort(
+                    container_port=port.port,
+                    name=port.name,
+                    protocol=port.protocol.upper(),
+                )
+            )
         meta = self.get_object_meta(name=self.name)
         secret_name = f"authentik-outpost-{self.controller.outpost.uuid.hex}-api"
         image_prefix = CONFIG.y("outposts.docker_image_base")
@@ -118,7 +126,9 @@ class DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):
         )
 
     def create(self, reference: V1Deployment):
-        return self.api.create_namespaced_deployment(self.namespace, reference)
+        return self.api.create_namespaced_deployment(
+            self.namespace, reference, field_manager=FIELD_MANAGER
+        )
 
     def delete(self, reference: V1Deployment):
         return self.api.delete_namespaced_deployment(

authentik/outposts/controllers/k8s/secret.py

@@ -4,6 +4,7 @@ from typing import TYPE_CHECKING
 
 from kubernetes.client import CoreV1Api, V1Secret
 
+from authentik.outposts.controllers.base import FIELD_MANAGER
 from authentik.outposts.controllers.k8s.base import (
     KubernetesObjectReconciler,
     NeedsUpdate,
@@ -30,6 +31,7 @@ class SecretReconciler(KubernetesObjectReconciler[V1Secret]):
         return f"authentik-outpost-{self.controller.outpost.uuid.hex}-api"
 
     def reconcile(self, current: V1Secret, reference: V1Secret):
+        super().reconcile(current, reference)
         for key in reference.data.keys():
             if current.data[key] != reference.data[key]:
                 raise NeedsUpdate()
@@ -51,7 +53,9 @@ class SecretReconciler(KubernetesObjectReconciler[V1Secret]):
         )
 
     def create(self, reference: V1Secret):
-        return self.api.create_namespaced_secret(self.namespace, reference)
+        return self.api.create_namespaced_secret(
+            self.namespace, reference, field_manager=FIELD_MANAGER
+        )
 
     def delete(self, reference: V1Secret):
         return self.api.delete_namespaced_secret(

authentik/outposts/controllers/k8s/service.py

@@ -3,6 +3,7 @@ from typing import TYPE_CHECKING
 
 from kubernetes.client import CoreV1Api, V1Service, V1ServicePort, V1ServiceSpec
 
+from authentik.outposts.controllers.base import FIELD_MANAGER
 from authentik.outposts.controllers.k8s.base import (
     KubernetesObjectReconciler,
     NeedsUpdate,
@@ -25,6 +26,7 @@ class ServiceReconciler(KubernetesObjectReconciler[V1Service]):
         return f"authentik-outpost-{self.controller.outpost.uuid.hex}"
 
     def reconcile(self, current: V1Service, reference: V1Service):
+        super().reconcile(current, reference)
         if len(current.spec.ports) != len(reference.spec.ports):
             raise NeedsUpdate()
         for port in reference.spec.ports:
@@ -35,8 +37,15 @@ class ServiceReconciler(KubernetesObjectReconciler[V1Service]):
         """Get deployment object for outpost"""
         meta = self.get_object_meta(name=self.name)
         ports = []
-        for port_name, port in self.controller.deployment_ports.items():
-            ports.append(V1ServicePort(name=port_name, port=port))
+        for port in self.controller.deployment_ports:
+            ports.append(
+                V1ServicePort(
+                    name=port.name,
+                    port=port.port,
+                    protocol=port.protocol.upper(),
+                    target_port=port.port,
+                )
+            )
         selector_labels = DeploymentReconciler(self.controller).get_pod_meta()
         return V1Service(
             metadata=meta,
@@ -44,7 +53,9 @@ class ServiceReconciler(KubernetesObjectReconciler[V1Service]):
         )
 
     def create(self, reference: V1Service):
-        return self.api.create_namespaced_service(self.namespace, reference)
+        return self.api.create_namespaced_service(
+            self.namespace, reference, field_manager=FIELD_MANAGER
+        )
 
     def delete(self, reference: V1Service):
         return self.api.delete_namespaced_service(

authentik/providers/oauth2/models.py

@@ -461,7 +461,7 @@ class RefreshToken(ExpiringModel, BaseGrantModel):
         self._id_token = json.dumps(asdict(value))
 
     def __str__(self):
-        return f"Refresh Token for {self.provider} for user {self.access_token.user}"
+        return f"Refresh Token for {self.provider} for user {self.user}"
 
     @property
     def at_hash(self):

authentik/providers/proxy/controllers/docker.py

@@ -2,6 +2,7 @@
 from typing import Dict
 from urllib.parse import urlparse
 
+from authentik.outposts.controllers.base import DeploymentPort
 from authentik.outposts.controllers.docker import DockerController
 from authentik.outposts.models import DockerServiceConnection, Outpost
 from authentik.providers.proxy.models import ProxyProvider
@@ -12,10 +13,10 @@ class ProxyDockerController(DockerController):
 
     def __init__(self, outpost: Outpost, connection: DockerServiceConnection):
         super().__init__(outpost, connection)
-        self.deployment_ports = {
-            "http": 4180,
-            "https": 4443,
-        }
+        self.deployment_ports = [
+            DeploymentPort(4180, "http", "tcp"),
+            DeploymentPort(4443, "https", "tcp"),
+        ]
 
     def _get_labels(self) -> Dict[str, str]:
         hosts = []

authentik/providers/proxy/controllers/k8s/ingress.py

@@ -15,6 +15,7 @@ from kubernetes.client.models.networking_v1beta1_ingress_rule import (
     NetworkingV1beta1IngressRule,
 )
 
+from authentik.outposts.controllers.base import FIELD_MANAGER
 from authentik.outposts.controllers.k8s.base import (
     KubernetesObjectReconciler,
     NeedsUpdate,
@@ -39,6 +40,7 @@ class IngressReconciler(KubernetesObjectReconciler[NetworkingV1beta1Ingress]):
     def reconcile(
         self, current: NetworkingV1beta1Ingress, reference: NetworkingV1beta1Ingress
     ):
+        super().reconcile(current, reference)
         # Create a list of all expected host and tls hosts
         expected_hosts = []
         expected_hosts_tls = []
@@ -104,7 +106,7 @@ class IngressReconciler(KubernetesObjectReconciler[NetworkingV1beta1Ingress]):
                         NetworkingV1beta1HTTPIngressPath(
                             backend=NetworkingV1beta1IngressBackend(
                                 service_name=self.name,
-                                service_port=self.controller.deployment_ports["http"],
+                                service_port="http",
                             ),
                             path="/",
                         )
@@ -124,7 +126,9 @@ class IngressReconciler(KubernetesObjectReconciler[NetworkingV1beta1Ingress]):
         )
 
     def create(self, reference: NetworkingV1beta1Ingress):
-        return self.api.create_namespaced_ingress(self.namespace, reference)
+        return self.api.create_namespaced_ingress(
+            self.namespace, reference, field_manager=FIELD_MANAGER
+        )
 
     def delete(self, reference: NetworkingV1beta1Ingress):
         return self.api.delete_namespaced_ingress(

authentik/providers/proxy/controllers/kubernetes.py

@@ -1,4 +1,5 @@
 """Proxy Provider Kubernetes Contoller"""
+from authentik.outposts.controllers.base import DeploymentPort
 from authentik.outposts.controllers.kubernetes import KubernetesController
 from authentik.outposts.models import KubernetesServiceConnection, Outpost
 from authentik.providers.proxy.controllers.k8s.ingress import IngressReconciler
@@ -9,9 +10,9 @@ class ProxyKubernetesController(KubernetesController):
 
     def __init__(self, outpost: Outpost, connection: KubernetesServiceConnection):
         super().__init__(outpost, connection)
-        self.deployment_ports = {
-            "http": 4180,
-            "https": 4443,
-        }
+        self.deployment_ports = [
+            DeploymentPort(4180, "http", "tcp"),
+            DeploymentPort(4443, "https", "tcp"),
+        ]
         self.reconcilers["ingress"] = IngressReconciler
         self.reconcile_order.append("ingress")

docker-compose.yml

@@ -19,7 +19,7 @@ services:
     networks:
       - internal
   server:
-    image: beryju/authentik:${AUTHENTIK_TAG:-0.14.0-rc2}
+    image: beryju/authentik:${AUTHENTIK_TAG:-0.14.1-stable}
     command: server
     environment:
       AUTHENTIK_REDIS__HOST: redis
@@ -44,7 +44,7 @@ services:
     env_file:
       - .env
   worker:
-    image: beryju/authentik:${AUTHENTIK_TAG:-0.14.0-rc2}
+    image: beryju/authentik:${AUTHENTIK_TAG:-0.14.1-stable}
     command: worker
     networks:
       - internal
@@ -60,7 +60,7 @@ services:
     env_file:
       - .env
   static:
-    image: beryju/authentik-static:${AUTHENTIK_TAG:-0.14.0-rc2}
+    image: beryju/authentik-static:${AUTHENTIK_TAG:-0.14.1-stable}
     networks:
       - internal
     labels:

helm/Chart.yaml

@@ -4,7 +4,7 @@ name: authentik
 home: https://goauthentik.io
 sources:
   - https://github.com/BeryJu/authentik
-version: "0.14.0-rc2"
+version: "0.14.1-stable"
 icon: https://raw.githubusercontent.com/BeryJu/authentik/master/web/icons/icon.svg
 dependencies:
   - name: postgresql

helm/README.md

@@ -4,7 +4,7 @@
 |-----------------------------------|-------------------------|-------------|
 | image.name                        | beryju/authentik         | Image used to run the authentik server and worker |
 | image.name_static                 | beryju/authentik-static  | Image used to run the authentik static server (CSS and JS Files) |
-| image.tag                         | 0.14.0-rc2              | Image tag |
+| image.tag                         | 0.14.1-stable              | Image tag |
 | image.pullPolicy                  | IfNotPresent            | Image Pull Policy used for all deployments |
 | serverReplicas                    | 1                       | Replicas for the Server deployment |
 | workerReplicas                    | 1                       | Replicas for the Worker deployment |

helm/values.yaml

@@ -5,7 +5,7 @@ image:
   name: beryju/authentik
   name_static: beryju/authentik-static
   name_outposts: beryju/authentik # Prefix used for Outpost deployments, Outpost type and version is appended
-  tag: 0.14.0-rc2
+  tag: 0.14.1-stable
   pullPolicy: IfNotPresent
 
 serverReplicas: 1

proxy/pkg/version.go

@@ -1,3 +1,3 @@
 package pkg
 
-const VERSION = "0.14.0-rc2"
+const VERSION = "0.14.1-stable"

web/package-lock.json

@@ -393,13 +393,13 @@
             }
         },
         "@typescript-eslint/eslint-plugin": {
-            "version": "4.11.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.11.0.tgz",
-            "integrity": "sha512-x4arJMXBxyD6aBXLm3W7mSDZRiABzy+2PCLJbL7OPqlp53VXhaA1HKK7R2rTee5OlRhnUgnp8lZyVIqjnyPT6g==",
+            "version": "4.11.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.11.1.tgz",
+            "integrity": "sha512-fABclAX2QIEDmTMk6Yd7Muv1CzFLwWM4505nETzRHpP3br6jfahD9UUJkhnJ/g2m7lwfz8IlswcwGGPGiq9exw==",
             "dev": true,
             "requires": {
-                "@typescript-eslint/experimental-utils": "4.11.0",
-                "@typescript-eslint/scope-manager": "4.11.0",
+                "@typescript-eslint/experimental-utils": "4.11.1",
+                "@typescript-eslint/scope-manager": "4.11.1",
                 "debug": "^4.1.1",
                 "functional-red-black-tree": "^1.0.1",
                 "regexpp": "^3.0.0",
@@ -408,71 +408,71 @@
             },
             "dependencies": {
                 "@typescript-eslint/scope-manager": {
-                    "version": "4.11.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.11.0.tgz",
-                    "integrity": "sha512-6VSTm/4vC2dHM3ySDW9Kl48en+yLNfVV6LECU8jodBHQOhO8adAVizaZ1fV0QGZnLQjQ/y0aBj5/KXPp2hBTjA==",
+                    "version": "4.11.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.11.1.tgz",
+                    "integrity": "sha512-Al2P394dx+kXCl61fhrrZ1FTI7qsRDIUiVSuN6rTwss6lUn8uVO2+nnF4AvO0ug8vMsy3ShkbxLu/uWZdTtJMQ==",
                     "dev": true,
                     "requires": {
-                        "@typescript-eslint/types": "4.11.0",
-                        "@typescript-eslint/visitor-keys": "4.11.0"
+                        "@typescript-eslint/types": "4.11.1",
+                        "@typescript-eslint/visitor-keys": "4.11.1"
                     }
                 },
                 "@typescript-eslint/types": {
-                    "version": "4.11.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.11.0.tgz",
-                    "integrity": "sha512-XXOdt/NPX++txOQHM1kUMgJUS43KSlXGdR/aDyEwuAEETwuPt02Nc7v+s57PzuSqMbNLclblQdv3YcWOdXhQ7g==",
+                    "version": "4.11.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.11.1.tgz",
+                    "integrity": "sha512-5kvd38wZpqGY4yP/6W3qhYX6Hz0NwUbijVsX2rxczpY6OXaMxh0+5E5uLJKVFwaBM7PJe1wnMym85NfKYIh6CA==",
                     "dev": true
                 },
                 "@typescript-eslint/visitor-keys": {
-                    "version": "4.11.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.11.0.tgz",
-                    "integrity": "sha512-tRYKyY0i7cMk6v4UIOCjl1LhuepC/pc6adQqJk4Is3YcC6k46HvsV9Wl7vQoLbm9qADgeujiT7KdLrylvFIQ+A==",
+                    "version": "4.11.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.11.1.tgz",
+                    "integrity": "sha512-IrlBhD9bm4bdYcS8xpWarazkKXlE7iYb1HzRuyBP114mIaj5DJPo11Us1HgH60dTt41TCZXMaTCAW+OILIYPOg==",
                     "dev": true,
                     "requires": {
-                        "@typescript-eslint/types": "4.11.0",
+                        "@typescript-eslint/types": "4.11.1",
                         "eslint-visitor-keys": "^2.0.0"
                     }
                 }
             }
         },
         "@typescript-eslint/experimental-utils": {
-            "version": "4.11.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.11.0.tgz",
-            "integrity": "sha512-1VC6mSbYwl1FguKt8OgPs8xxaJgtqFpjY/UzUYDBKq4pfQ5lBvN2WVeqYkzf7evW42axUHYl2jm9tNyFsb8oLg==",
+            "version": "4.11.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.11.1.tgz",
+            "integrity": "sha512-mAlWowT4A6h0TC9F+J5pdbEhjNiEMO+kqPKQ4sc3fVieKL71dEqfkKgtcFVSX3cjSBwYwhImaQ/mXQF0oaI38g==",
             "dev": true,
             "requires": {
                 "@types/json-schema": "^7.0.3",
-                "@typescript-eslint/scope-manager": "4.11.0",
-                "@typescript-eslint/types": "4.11.0",
-                "@typescript-eslint/typescript-estree": "4.11.0",
+                "@typescript-eslint/scope-manager": "4.11.1",
+                "@typescript-eslint/types": "4.11.1",
+                "@typescript-eslint/typescript-estree": "4.11.1",
                 "eslint-scope": "^5.0.0",
                 "eslint-utils": "^2.0.0"
             },
             "dependencies": {
                 "@typescript-eslint/scope-manager": {
-                    "version": "4.11.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.11.0.tgz",
-                    "integrity": "sha512-6VSTm/4vC2dHM3ySDW9Kl48en+yLNfVV6LECU8jodBHQOhO8adAVizaZ1fV0QGZnLQjQ/y0aBj5/KXPp2hBTjA==",
+                    "version": "4.11.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.11.1.tgz",
+                    "integrity": "sha512-Al2P394dx+kXCl61fhrrZ1FTI7qsRDIUiVSuN6rTwss6lUn8uVO2+nnF4AvO0ug8vMsy3ShkbxLu/uWZdTtJMQ==",
                     "dev": true,
                     "requires": {
-                        "@typescript-eslint/types": "4.11.0",
-                        "@typescript-eslint/visitor-keys": "4.11.0"
+                        "@typescript-eslint/types": "4.11.1",
+                        "@typescript-eslint/visitor-keys": "4.11.1"
                     }
                 },
                 "@typescript-eslint/types": {
-                    "version": "4.11.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.11.0.tgz",
-                    "integrity": "sha512-XXOdt/NPX++txOQHM1kUMgJUS43KSlXGdR/aDyEwuAEETwuPt02Nc7v+s57PzuSqMbNLclblQdv3YcWOdXhQ7g==",
+                    "version": "4.11.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.11.1.tgz",
+                    "integrity": "sha512-5kvd38wZpqGY4yP/6W3qhYX6Hz0NwUbijVsX2rxczpY6OXaMxh0+5E5uLJKVFwaBM7PJe1wnMym85NfKYIh6CA==",
                     "dev": true
                 },
                 "@typescript-eslint/typescript-estree": {
-                    "version": "4.11.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.11.0.tgz",
-                    "integrity": "sha512-eA6sT5dE5RHAFhtcC+b5WDlUIGwnO9b0yrfGa1mIOIAjqwSQCpXbLiFmKTdRbQN/xH2EZkGqqLDrKUuYOZ0+Hg==",
+                    "version": "4.11.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.11.1.tgz",
+                    "integrity": "sha512-tC7MKZIMRTYxQhrVAFoJq/DlRwv1bnqA4/S2r3+HuHibqvbrPcyf858lNzU7bFmy4mLeIHFYr34ar/1KumwyRw==",
                     "dev": true,
                     "requires": {
-                        "@typescript-eslint/types": "4.11.0",
-                        "@typescript-eslint/visitor-keys": "4.11.0",
+                        "@typescript-eslint/types": "4.11.1",
+                        "@typescript-eslint/visitor-keys": "4.11.1",
                         "debug": "^4.1.1",
                         "globby": "^11.0.1",
                         "is-glob": "^4.0.1",
@@ -482,12 +482,12 @@
                     }
                 },
                 "@typescript-eslint/visitor-keys": {
-                    "version": "4.11.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.11.0.tgz",
-                    "integrity": "sha512-tRYKyY0i7cMk6v4UIOCjl1LhuepC/pc6adQqJk4Is3YcC6k46HvsV9Wl7vQoLbm9qADgeujiT7KdLrylvFIQ+A==",
+                    "version": "4.11.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.11.1.tgz",
+                    "integrity": "sha512-IrlBhD9bm4bdYcS8xpWarazkKXlE7iYb1HzRuyBP114mIaj5DJPo11Us1HgH60dTt41TCZXMaTCAW+OILIYPOg==",
                     "dev": true,
                     "requires": {
-                        "@typescript-eslint/types": "4.11.0",
+                        "@typescript-eslint/types": "4.11.1",
                         "eslint-visitor-keys": "^2.0.0"
                     }
                 },
@@ -508,41 +508,41 @@
             }
         },
         "@typescript-eslint/parser": {
-            "version": "4.11.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.11.0.tgz",
-            "integrity": "sha512-NBTtKCC7ZtuxEV5CrHUO4Pg2s784pvavc3cnz6V+oJvVbK4tH9135f/RBP6eUA2KHiFKAollSrgSctQGmHbqJQ==",
+            "version": "4.11.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.11.1.tgz",
+            "integrity": "sha512-BJ3jwPQu1jeynJ5BrjLuGfK/UJu6uwHxJ/di7sanqmUmxzmyIcd3vz58PMR7wpi8k3iWq2Q11KMYgZbUpRoIPw==",
             "dev": true,
             "requires": {
-                "@typescript-eslint/scope-manager": "4.11.0",
-                "@typescript-eslint/types": "4.11.0",
-                "@typescript-eslint/typescript-estree": "4.11.0",
+                "@typescript-eslint/scope-manager": "4.11.1",
+                "@typescript-eslint/types": "4.11.1",
+                "@typescript-eslint/typescript-estree": "4.11.1",
                 "debug": "^4.1.1"
             }
         },
         "@typescript-eslint/scope-manager": {
-            "version": "4.11.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.11.0.tgz",
-            "integrity": "sha512-6VSTm/4vC2dHM3ySDW9Kl48en+yLNfVV6LECU8jodBHQOhO8adAVizaZ1fV0QGZnLQjQ/y0aBj5/KXPp2hBTjA==",
+            "version": "4.11.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.11.1.tgz",
+            "integrity": "sha512-Al2P394dx+kXCl61fhrrZ1FTI7qsRDIUiVSuN6rTwss6lUn8uVO2+nnF4AvO0ug8vMsy3ShkbxLu/uWZdTtJMQ==",
             "dev": true,
             "requires": {
-                "@typescript-eslint/types": "4.11.0",
-                "@typescript-eslint/visitor-keys": "4.11.0"
+                "@typescript-eslint/types": "4.11.1",
+                "@typescript-eslint/visitor-keys": "4.11.1"
             }
         },
         "@typescript-eslint/types": {
-            "version": "4.11.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.11.0.tgz",
-            "integrity": "sha512-XXOdt/NPX++txOQHM1kUMgJUS43KSlXGdR/aDyEwuAEETwuPt02Nc7v+s57PzuSqMbNLclblQdv3YcWOdXhQ7g==",
+            "version": "4.11.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.11.1.tgz",
+            "integrity": "sha512-5kvd38wZpqGY4yP/6W3qhYX6Hz0NwUbijVsX2rxczpY6OXaMxh0+5E5uLJKVFwaBM7PJe1wnMym85NfKYIh6CA==",
             "dev": true
         },
         "@typescript-eslint/typescript-estree": {
-            "version": "4.11.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.11.0.tgz",
-            "integrity": "sha512-eA6sT5dE5RHAFhtcC+b5WDlUIGwnO9b0yrfGa1mIOIAjqwSQCpXbLiFmKTdRbQN/xH2EZkGqqLDrKUuYOZ0+Hg==",
+            "version": "4.11.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.11.1.tgz",
+            "integrity": "sha512-tC7MKZIMRTYxQhrVAFoJq/DlRwv1bnqA4/S2r3+HuHibqvbrPcyf858lNzU7bFmy4mLeIHFYr34ar/1KumwyRw==",
             "dev": true,
             "requires": {
-                "@typescript-eslint/types": "4.11.0",
-                "@typescript-eslint/visitor-keys": "4.11.0",
+                "@typescript-eslint/types": "4.11.1",
+                "@typescript-eslint/visitor-keys": "4.11.1",
                 "debug": "^4.1.1",
                 "globby": "^11.0.1",
                 "is-glob": "^4.0.1",
@@ -568,12 +568,12 @@
             }
         },
         "@typescript-eslint/visitor-keys": {
-            "version": "4.11.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.11.0.tgz",
-            "integrity": "sha512-tRYKyY0i7cMk6v4UIOCjl1LhuepC/pc6adQqJk4Is3YcC6k46HvsV9Wl7vQoLbm9qADgeujiT7KdLrylvFIQ+A==",
+            "version": "4.11.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.11.1.tgz",
+            "integrity": "sha512-IrlBhD9bm4bdYcS8xpWarazkKXlE7iYb1HzRuyBP114mIaj5DJPo11Us1HgH60dTt41TCZXMaTCAW+OILIYPOg==",
             "dev": true,
             "requires": {
-                "@typescript-eslint/types": "4.11.0",
+                "@typescript-eslint/types": "4.11.1",
                 "eslint-visitor-keys": "^2.0.0"
             }
         },

web/package.json

@@ -27,8 +27,8 @@
     },
     "devDependencies": {
         "@rollup/plugin-typescript": "^8.1.0",
-        "@typescript-eslint/eslint-plugin": "^4.11.0",
-        "@typescript-eslint/parser": "^4.11.0",
+        "@typescript-eslint/eslint-plugin": "^4.11.1",
+        "@typescript-eslint/parser": "^4.11.1",
         "eslint": "^7.16.0",
         "eslint-config-google": "^0.14.0",
         "eslint-plugin-lit": "^1.3.0",

web/src/constants.ts

@@ -28,4 +28,4 @@ export const ColorStyles = css`
         background-color: var(--pf-global--danger-color--100);
     }
 `;
-export const VERSION = "0.14.0-rc2";
+export const VERSION = "0.14.1-stable";

website/docs/installation/docker-compose.md

@@ -15,7 +15,7 @@ Download the latest `docker-compose.yml` from [here](https://raw.githubuserconte
 
 To optionally enable error-reporting, run `echo AUTHENTIK_ERROR_REPORTING__ENABLED=true >> .env`
 
-To optionally deploy a different version run `echo AUTHENTIK_TAG=0.14.0-rc2 >> .env`
+To optionally deploy a different version run `echo AUTHENTIK_TAG=0.14.1-stable >> .env`
 
 If this is a fresh authentik install run the following commands to generate a password:
 

website/docs/installation/kubernetes.md

@@ -22,7 +22,7 @@ image:
     name: beryju/authentik
     name_static: beryju/authentik-static
     name_outposts: beryju/authentik # Prefix used for Outpost deployments, Outpost type and version is appended
-    tag: 0.14.0-rc2
+    tag: 0.14.1-stable
 
 serverReplicas: 1
 workerReplicas: 1

website/docs/integrations/services/grafana/index.md

@@ -0,0 +1,66 @@
+---
+title: Grafana
+---
+
+## What is Grafana
+
+From https://en.wikipedia.org/wiki/Grafana
+
+:::note
+Grafana is a multi-platform open source analytics and interactive visualization web application. It provides charts, graphs, and alerts for the web when connected to supported data sources, Grafana Enterprise version with additional capabilities is also available. It is expandable through a plug-in system.
+:::
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `grafana.company` is the FQDN of the Grafana install.
+-   `authentik.company` is the FQDN of the authentik install.
+
+Create an application in authentik. Create an OAuth2/OpenID provider with the following parameters:
+
+-   Client Type: `Confidential`
+-   JWT Algorithm: `RS256`
+-   Scopes: OpenID, Email and Profile
+-   RSA Key: Select any available key
+-   Redirect URIs: `https://grafana.company/login/generic_oauth`
+
+Note the Client ID and Client Secret values. Create an application, using the provider you've created above. Note the slug of the application you've created.
+
+## Grafana
+
+If your Grafana is running in docker, set the following environment variables:
+
+```yaml
+environment:
+    GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
+    GF_AUTH_GENERIC_OAUTH_NAME: "authentik"
+    GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "<Client ID from above>"
+    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "<Client Secret from above>"
+    GF_AUTH_GENERIC_OAUTH_SCOPES: "openid profile email"
+    GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://authentik.company/application/o/authorize/"
+    GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/"
+    GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/"
+    GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o/<Slug of the application from above>/end-session/"
+    # Optionally enable auto-login
+    GF_AUTH_OAUTH_AUTO_LOGIN: "true"
+```
+
+If you are using a config-file instead, you have to set these options:
+
+```ini
+[auth]
+signout_redirect_url = https://authentik.company/application/o/<Slug of the application from above>/end-session/
+# Optionally enable auto-login
+oauth_auto_login = true
+
+[auth.generic_oauth]
+name = authentik
+enabled = true
+client_id = <Client ID from above>
+client_secret = <Client Secret from above>
+scopes = openid email profile
+auth_url = https://authentik.company/application/o/authorize/
+token_url = https://authentik.company/application/o/token/
+api_url = https://authentik.company/application/o/userinfo/
+```

website/docs/integrations/services/harbor/index.md

@@ -17,13 +17,14 @@ The following placeholders will be used:
 -   `harbor.company` is the FQDN of the Harbor install.
 -   `authentik.company` is the FQDN of the authentik install.
 
-Create an application in authentik. Create an OpenID provider with the following parameters:
+Create an OAuth2/OpenID provider with the following parameters:
 
 -   Client Type: `Confidential`
--   Response types: `code (Authorization Code Flow)`
 -   JWT Algorithm: `RS256`
 -   Redirect URIs: `https://harbor.company/c/oidc/callback`
--   Scopes: `openid`
+-   Scopes: OpenID, Email and Profile
+
+Note the Client ID and Client Secret values. Create an application, using the provider you've created above.
 
 ## Harbor
 

website/docs/integrations/services/vmware-vcenter/index.md

@@ -51,12 +51,11 @@ Under _Sources_, click _Edit_ and ensure that "Autogenerated Active Directory Ma
 
 ### Step 3
 
-Under _Providers_, create an OAuth2/OpenID Provider with these settings:
+Under _Providers_, create an OAuth2/OpenID provider with these settings:
 
 -   Client Type: Confidential
 -   JWT Algorithm: RS256
 -   Redirect URI: `https://vcenter.company/ui/login/oauth2/authcode`
--   Post Logout Redirect URIs: `https://vcenter.company/ui/login`
 -   Sub Mode: If your Email address Schema matches your UPN, select "Based on the User's Email...", otherwise select "Based on the User's UPN...".
 -   Scopes: Select the Scope Mapping you've created in Step 1
 

website/docs/releases/0.14.md

@@ -20,7 +20,7 @@ title: Release 0.14
 
 - The OAuth2 Provider has been updated to closer match the OpenID Connect Specifications
 
-    Response time now longer has to be configured manually. The issuer field can be configured now (the default behaviour is the same as pre-0.14)
+    Response type no longer has to be configured manually. The issuer field can be configured now (the default behaviour is the same as pre-0.14)
 
     Authorization Codes are now generated as a JWT Token, which is not specified as spec, but seems to be a quasi-standard.
 
@@ -50,7 +50,7 @@ This release does not introduce any new requirements.
 
 ### docker-compose
 
-Download the latest docker-compose file from [here](https://raw.githubusercontent.com/BeryJu/authentik/version-0.14/docker-compose.yml) and run `docker-compose up -d`.
+Download the latest docker-compose file from [here](https://raw.githubusercontent.com/BeryJu/authentik/version-0.14/docker-compose.yml). Aftewards, simply run `docker-compose up -d` and then the normal upgrade command of `docker-compose run --rm server migrate`.
 
 ### Kubernetes
 

website/sidebars.js

@@ -101,6 +101,7 @@ module.exports = {
                         "integrations/services/aws/index",
                         "integrations/services/awx-tower/index",
                         "integrations/services/gitlab/index",
+                        "integrations/services/grafana/index",
                         "integrations/services/harbor/index",
                         "integrations/services/home-assistant/index",
                         "integrations/services/nextcloud/index",

website/src/pages/index.js

@@ -11,8 +11,8 @@ const features = [
         title: "Easy to Use",
         description: (
             <>
-                Identity made easy. authentik makes single-sign on, user
-                enrollment and access control simple.
+                Identity made easy. authentik makes single-sign on (SSO), user
+                enrollment, and access control simple.
             </>
         ),
     },
@@ -20,7 +20,7 @@ const features = [
         title: "Realise your workflow",
         description: (
             <>
-                authentik lets you build your Workflow as you need it, no
+                authentik lets you build your workflow as you need it, no
                 limitations.
             </>
         ),
@@ -109,20 +109,20 @@ function Home() {
                                     authentik is an open-source Identity Provider
                                     focused on flexibility and versatility. You
                                     can use authentik in an existing environment
-                                    to add support for new protocols. authentik
-                                    is also a great solution for implementing
-                                    signup/recovery/etc in your application, so
-                                    you don't have to deal with it.
+                                    to add support for new protocols, implement
+                                    sign-up/recovery/etc. in your application so
+                                    you don't have to deal with it, and many other
+                                    things.
                                 </p>
                             </div>
                         </div>
                         <div className="row">
                             <div className="col col--5 col--offset-2 padding-vert--xl">
-                                <h2>Upmost flexibility</h2>
+                                <h2>Utmost flexibility</h2>
                                 <p>
                                     You can adopt authentik to your environment,
-                                    regardless of your requirements. Need an Active-
-                                    Directory integrated SSO Provider? Do you want
+                                    regardless of your requirements. Need an Active-Directory
+                                    integrated SSO Provider? Do you want
                                     to implement a custom enrollment process for your
                                     customers? Are you developing an application and
                                     don't want to deal with User verification and recovery?