release: 2021.1.4-stable

build(deps): bump rollup from 2.38.0 to 2.38.1 in /web (#505 )
Bumps [rollup](https://github.com/rollup/rollup) from 2.38.0 to 2.38.1. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](https://github.com/rollup/rollup/compare/v2.38.0...v2.38.1) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-01-29 10:29:06 +01:00 · 2021-01-29 09:31:59 +01:00 · 2021-01-29 09:31:37 +01:00 · 2021-01-28 23:34:51 +01:00 · 2021-01-28 23:32:36 +01:00 · 2021-01-28 23:16:51 +01:00
60 changed files with 661 additions and 362 deletions
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2021.1.1-rc2
+current_version = 2021.1.4-stable
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -18,11 +18,11 @@ jobs:
      - name: Building Docker Image
        run: docker build
          --no-cache
-          -t beryju/authentik:2021.1.1-rc2
+          -t beryju/authentik:2021.1.4-stable
          -t beryju/authentik:latest
          -f Dockerfile .
      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik:2021.1.1-rc2
+        run: docker push beryju/authentik:2021.1.4-stable
      - name: Push Docker Container to Registry (latest)
        run: docker push beryju/authentik:latest
  build-proxy:
@ -48,11 +48,11 @@ jobs:
          cd outpost/
          docker build \
          --no-cache \
-          -t beryju/authentik-proxy:2021.1.1-rc2 \
+          -t beryju/authentik-proxy:2021.1.4-stable \
          -t beryju/authentik-proxy:latest \
          -f proxy.Dockerfile .
      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-proxy:2021.1.1-rc2
+        run: docker push beryju/authentik-proxy:2021.1.4-stable
      - name: Push Docker Container to Registry (latest)
        run: docker push beryju/authentik-proxy:latest
  build-static:
@ -69,11 +69,11 @@ jobs:
          cd web/
          docker build \
          --no-cache \
-          -t beryju/authentik-static:2021.1.1-rc2 \
+          -t beryju/authentik-static:2021.1.4-stable \
          -t beryju/authentik-static:latest \
          -f Dockerfile .
      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-static:2021.1.1-rc2
+        run: docker push beryju/authentik-static:2021.1.4-stable
      - name: Push Docker Container to Registry (latest)
        run: docker push beryju/authentik-static:latest
  test-release:
@ -107,5 +107,5 @@ jobs:
          SENTRY_PROJECT: authentik
          SENTRY_URL: https://sentry.beryju.org
        with:
-          tagName: 2021.1.1-rc2
+          tagName: 2021.1.4-stable
          environment: beryjuorg-prod
--- a/Pipfile.lock
+++ b/Pipfile.lock
@ -25,10 +25,10 @@
        },
        "amqp": {
            "hashes": [
-                "sha256:5b9062d5c0812335c75434bf17ce33d7a20ecfedaa0733faec7379868eb4068a",
-                "sha256:fcd5b3baeeb7fc19b3486ff6d10543099d40ae1f5c9196eae695d1cde1b2f784"
+                "sha256:1e759a7f202d910939de6eca45c23a107f6b71111f41d1282c648e9ac3d21901",
+                "sha256:affdd263d8b8eb3c98170b78bf83867cdb6a14901d586e00ddb65bfe2f0c4e60"
            ],
-            "version": "==5.0.2"
+            "version": "==5.0.5"
        },
        "asgiref": {
            "hashes": [
@ -74,25 +74,25 @@
        },
        "boto3": {
            "hashes": [
-                "sha256:b5052144034e490358c659d0e480c17a4e604fd3aee9a97ddfe6e361a245a4a5",
-                "sha256:efd6c96c98900e9fbf217f13cb58f59b793e51f69a1ce61817eefd31f17c6ef5"
+                "sha256:a280123db79e73478bd23933486f3a0ffa2397d1a6381f32573f2731ff48c59a",
+                "sha256:bb91fecf982e1bbfb68bb6bd2c9a0cce3c84ac6f97dd338d1ef9e47780679091"
            ],
            "index": "pypi",
-            "version": "==1.16.55"
+            "version": "==1.16.62"
        },
        "botocore": {
            "hashes": [
-                "sha256:760d0c16c1474c2a46e3fa45e33ae7457b5cab7410737ab1692340ade764cc73",
-                "sha256:b34327d84b3bb5620fb54603677a9a973b167290c2c1e7ab69c4a46b201c6d46"
+                "sha256:1046c152e5865aabbe6b10b2d33e652b3dd072516f3976e96cacc6b7c4460d02",
+                "sha256:29b4b9be5b40f392a033926c08c004c01bd6471384ef6f12eaa49ee3870a010c"
            ],
-            "version": "==1.19.55"
+            "version": "==1.19.62"
        },
        "cachetools": {
            "hashes": [
-                "sha256:3796e1de094f0eaca982441c92ce96c68c89cced4cd97721ab297ea4b16db90e",
-                "sha256:c6b07a6ded8c78bf36730b3dc452dfff7d95f2a12a2fed856b1a0cb13ca78c61"
+                "sha256:1d9d5f567be80f7c07d765e21b814326d78c61eb0c3a637dffc0e5d1796cb2e2",
+                "sha256:f469e29e7aa4cff64d8de4aad95ce76de8ea1125a16c68e0d93f65c3c3dc92e9"
            ],
-            "version": "==4.2.0"
+            "version": "==4.2.1"
        },
        "celery": {
            "hashes": [
@ -558,11 +558,11 @@
        },
        "ldap3": {
            "hashes": [
-                "sha256:37d633e20fa360c302b1263c96fe932d40622d0119f1bddcb829b03462eeeeb7",
-                "sha256:7c3738570766f5e5e74a56fade15470f339d5c436d821cf476ef27da0a4de8b0"
+                "sha256:18c3ee656a6775b9b0d60f7c6c5b094d878d1d90fc03d56731039f0a4b546a91",
+                "sha256:c1df41d89459be6f304e0ceec4b00fdea533dbbcd83c802b1272dcdb94620b57"
            ],
            "index": "pypi",
-            "version": "==2.8.1"
+            "version": "==2.9"
        },
        "lxml": {
            "hashes": [
@ -702,10 +702,10 @@
        },
        "prompt-toolkit": {
            "hashes": [
-                "sha256:ac329c69bd8564cb491940511957312c7b8959bb5b3cf3582b406068a51d5bb7",
-                "sha256:b8b3d0bde65da350290c46a8f54f336b3cbf5464a4ac11239668d986852e79d5"
+                "sha256:7e966747c18ececaec785699626b771c1ba8344c8d31759a1915d6b12fad6525",
+                "sha256:c96b30925025a7635471dc083ffb6af0cc67482a00611bd81aeaeeeb7e5a5e12"
            ],
-            "version": "==3.0.10"
+            "version": "==3.0.14"
        },
        "psycopg2-binary": {
            "hashes": [
@ -907,22 +907,30 @@
        },
        "pyyaml": {
            "hashes": [
-                "sha256:06a0d7ba600ce0b2d2fe2e78453a470b5a6e000a985dd4a4e54e436cc36b0e97",
-                "sha256:240097ff019d7c70a4922b6869d8a86407758333f02203e0fc6ff79c5dcede76",
-                "sha256:4f4b913ca1a7319b33cfb1369e91e50354d6f07a135f3b901aca02aa95940bd2",
-                "sha256:6034f55dab5fea9e53f436aa68fa3ace2634918e8b5994d82f3621c04ff5ed2e",
-                "sha256:69f00dca373f240f842b2931fb2c7e14ddbacd1397d57157a9b005a6a9942648",
-                "sha256:73f099454b799e05e5ab51423c7bcf361c58d3206fa7b0d555426b1f4d9a3eaf",
-                "sha256:74809a57b329d6cc0fdccee6318f44b9b8649961fa73144a98735b0aaf029f1f",
-                "sha256:7739fc0fa8205b3ee8808aea45e968bc90082c10aef6ea95e855e10abf4a37b2",
-                "sha256:95f71d2af0ff4227885f7a6605c37fd53d3a106fcab511b8860ecca9fcf400ee",
-                "sha256:ad9c67312c84def58f3c04504727ca879cb0013b2517c85a9a253f0cb6380c0a",
-                "sha256:b8eac752c5e14d3eca0e6dd9199cd627518cb5ec06add0de9d32baeee6fe645d",
-                "sha256:cc8955cfbfc7a115fa81d85284ee61147059a753344bc51098f3ccd69b0d7e0c",
-                "sha256:d13155f591e6fcc1ec3b30685d50bf0711574e2c0dfffd7644babf8b5102ca1a"
+                "sha256:08682f6b72c722394747bddaf0aa62277e02557c0fd1c42cb853016a38f8dedf",
+                "sha256:0f5f5786c0e09baddcd8b4b45f20a7b5d61a7e7e99846e3c799b05c7c53fa696",
+                "sha256:129def1b7c1bf22faffd67b8f3724645203b79d8f4cc81f674654d9902cb4393",
+                "sha256:294db365efa064d00b8d1ef65d8ea2c3426ac366c0c4368d930bf1c5fb497f77",
+                "sha256:3b2b1824fe7112845700f815ff6a489360226a5609b96ec2190a45e62a9fc922",
+                "sha256:3bd0e463264cf257d1ffd2e40223b197271046d09dadf73a0fe82b9c1fc385a5",
+                "sha256:4465124ef1b18d9ace298060f4eccc64b0850899ac4ac53294547536533800c8",
+                "sha256:49d4cdd9065b9b6e206d0595fee27a96b5dd22618e7520c33204a4a3239d5b10",
+                "sha256:4e0583d24c881e14342eaf4ec5fbc97f934b999a6828693a99157fde912540cc",
+                "sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
+                "sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
+                "sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
+                "sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
+                "sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
+                "sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
+                "sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
+                "sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
+                "sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
+                "sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
+                "sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
+                "sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc"
            ],
            "index": "pypi",
-            "version": "==5.3.1"
+            "version": "==5.4.1"
        },
        "qrcode": {
            "hashes": [
@ -1072,12 +1080,12 @@
                "secure"
            ],
            "hashes": [
-                "sha256:19188f96923873c92ccb987120ec4acaa12f0461fa9ce5d3d0772bc965a39e08",
-                "sha256:d8ff90d979214d7b4f8ce956e80f4028fc6860e4431f731ea4a8c08f23f99473"
+                "sha256:1b465e494e3e0d8939b50680403e3aedaa2bc434b7d5af64dfd3c958d7f5ae80",
+                "sha256:de3eedaad74a2683334e282005cd8d7f22f4d55fa690a2a1020a416cb0a47e73"
            ],
            "index": "pypi",
            "markers": null,
-            "version": "==1.26.2"
+            "version": "==1.26.3"
        },
        "uvicorn": {
            "extras": [
@ -1319,58 +1327,58 @@
        },
        "coverage": {
            "hashes": [
-                "sha256:08b3ba72bd981531fd557f67beee376d6700fba183b167857038997ba30dd297",
-                "sha256:2757fa64e11ec12220968f65d086b7a29b6583d16e9a544c889b22ba98555ef1",
-                "sha256:3102bb2c206700a7d28181dbe04d66b30780cde1d1c02c5f3c165cf3d2489497",
-                "sha256:3498b27d8236057def41de3585f317abae235dd3a11d33e01736ffedb2ef8606",
-                "sha256:378ac77af41350a8c6b8801a66021b52da8a05fd77e578b7380e876c0ce4f528",
-                "sha256:38f16b1317b8dd82df67ed5daa5f5e7c959e46579840d77a67a4ceb9cef0a50b",
-                "sha256:3911c2ef96e5ddc748a3c8b4702c61986628bb719b8378bf1e4a6184bbd48fe4",
-                "sha256:3a3c3f8863255f3c31db3889f8055989527173ef6192a283eb6f4db3c579d830",
-                "sha256:3b14b1da110ea50c8bcbadc3b82c3933974dbeea1832e814aab93ca1163cd4c1",
-                "sha256:535dc1e6e68fad5355f9984d5637c33badbdc987b0c0d303ee95a6c979c9516f",
-                "sha256:6f61319e33222591f885c598e3e24f6a4be3533c1d70c19e0dc59e83a71ce27d",
-                "sha256:723d22d324e7997a651478e9c5a3120a0ecbc9a7e94071f7e1954562a8806cf3",
-                "sha256:76b2775dda7e78680d688daabcb485dc87cf5e3184a0b3e012e1d40e38527cc8",
-                "sha256:782a5c7df9f91979a7a21792e09b34a658058896628217ae6362088b123c8500",
-                "sha256:7e4d159021c2029b958b2363abec4a11db0ce8cd43abb0d9ce44284cb97217e7",
-                "sha256:8dacc4073c359f40fcf73aede8428c35f84639baad7e1b46fce5ab7a8a7be4bb",
-                "sha256:8f33d1156241c43755137288dea619105477961cfa7e47f48dbf96bc2c30720b",
-                "sha256:8ffd4b204d7de77b5dd558cdff986a8274796a1e57813ed005b33fd97e29f059",
-                "sha256:93a280c9eb736a0dcca19296f3c30c720cb41a71b1f9e617f341f0a8e791a69b",
-                "sha256:9a4f66259bdd6964d8cf26142733c81fb562252db74ea367d9beb4f815478e72",
-                "sha256:9a9d4ff06804920388aab69c5ea8a77525cf165356db70131616acd269e19b36",
-                "sha256:a2070c5affdb3a5e751f24208c5c4f3d5f008fa04d28731416e023c93b275277",
-                "sha256:a4857f7e2bc6921dbd487c5c88b84f5633de3e7d416c4dc0bb70256775551a6c",
-                "sha256:a607ae05b6c96057ba86c811d9c43423f35e03874ffb03fbdcd45e0637e8b631",
-                "sha256:a66ca3bdf21c653e47f726ca57f46ba7fc1f260ad99ba783acc3e58e3ebdb9ff",
-                "sha256:ab110c48bc3d97b4d19af41865e14531f300b482da21783fdaacd159251890e8",
-                "sha256:b239711e774c8eb910e9b1ac719f02f5ae4bf35fa0420f438cdc3a7e4e7dd6ec",
-                "sha256:be0416074d7f253865bb67630cf7210cbc14eb05f4099cc0f82430135aaa7a3b",
-                "sha256:c46643970dff9f5c976c6512fd35768c4a3819f01f61169d8cdac3f9290903b7",
-                "sha256:c5ec71fd4a43b6d84ddb88c1df94572479d9a26ef3f150cef3dacefecf888105",
-                "sha256:c6e5174f8ca585755988bc278c8bb5d02d9dc2e971591ef4a1baabdf2d99589b",
-                "sha256:c89b558f8a9a5a6f2cfc923c304d49f0ce629c3bd85cb442ca258ec20366394c",
-                "sha256:cc44e3545d908ecf3e5773266c487ad1877be718d9dc65fc7eb6e7d14960985b",
-                "sha256:cc6f8246e74dd210d7e2b56c76ceaba1cc52b025cd75dbe96eb48791e0250e98",
-                "sha256:cd556c79ad665faeae28020a0ab3bda6cd47d94bec48e36970719b0b86e4dcf4",
-                "sha256:ce6f3a147b4b1a8b09aae48517ae91139b1b010c5f36423fa2b866a8b23df879",
-                "sha256:ceb499d2b3d1d7b7ba23abe8bf26df5f06ba8c71127f188333dddcf356b4b63f",
-                "sha256:cef06fb382557f66d81d804230c11ab292d94b840b3cb7bf4450778377b592f4",
-                "sha256:e448f56cfeae7b1b3b5bcd99bb377cde7c4eb1970a525c770720a352bc4c8044",
-                "sha256:e52d3d95df81c8f6b2a1685aabffadf2d2d9ad97203a40f8d61e51b70f191e4e",
-                "sha256:ee2f1d1c223c3d2c24e3afbb2dd38be3f03b1a8d6a83ee3d9eb8c36a52bee899",
-                "sha256:f2c6888eada180814b8583c3e793f3f343a692fc802546eed45f40a001b1169f",
-                "sha256:f51dbba78d68a44e99d484ca8c8f604f17e957c1ca09c3ebc2c7e3bbd9ba0448",
-                "sha256:f54de00baf200b4539a5a092a759f000b5f45fd226d6d25a76b0dff71177a714",
-                "sha256:fa10fee7e32213f5c7b0d6428ea92e3a3fdd6d725590238a3f92c0de1c78b9d2",
-                "sha256:fabeeb121735d47d8eab8671b6b031ce08514c86b7ad8f7d5490a7b6dcd6267d",
-                "sha256:fac3c432851038b3e6afe086f777732bcf7f6ebbfd90951fa04ee53db6d0bcdd",
-                "sha256:fda29412a66099af6d6de0baa6bd7c52674de177ec2ad2630ca264142d69c6c7",
-                "sha256:ff1330e8bc996570221b450e2d539134baa9465f5cb98aff0e0f73f34172e0ae"
+                "sha256:03ed2a641e412e42cc35c244508cf186015c217f0e4d496bf6d7078ebe837ae7",
+                "sha256:04b14e45d6a8e159c9767ae57ecb34563ad93440fc1b26516a89ceb5b33c1ad5",
+                "sha256:0cdde51bfcf6b6bd862ee9be324521ec619b20590787d1655d005c3fb175005f",
+                "sha256:0f48fc7dc82ee14aeaedb986e175a429d24129b7eada1b7e94a864e4f0644dde",
+                "sha256:107d327071061fd4f4a2587d14c389a27e4e5c93c7cba5f1f59987181903902f",
+                "sha256:1375bb8b88cb050a2d4e0da901001347a44302aeadb8ceb4b6e5aa373b8ea68f",
+                "sha256:14a9f1887591684fb59fdba8feef7123a0da2424b0652e1b58dd5b9a7bb1188c",
+                "sha256:16baa799ec09cc0dcb43a10680573269d407c159325972dd7114ee7649e56c66",
+                "sha256:1b811662ecf72eb2d08872731636aee6559cae21862c36f74703be727b45df90",
+                "sha256:1ccae21a076d3d5f471700f6d30eb486da1626c380b23c70ae32ab823e453337",
+                "sha256:2f2cf7a42d4b7654c9a67b9d091ec24374f7c58794858bff632a2039cb15984d",
+                "sha256:322549b880b2d746a7672bf6ff9ed3f895e9c9f108b714e7360292aa5c5d7cf4",
+                "sha256:32ab83016c24c5cf3db2943286b85b0a172dae08c58d0f53875235219b676409",
+                "sha256:3fe50f1cac369b02d34ad904dfe0771acc483f82a1b54c5e93632916ba847b37",
+                "sha256:4a780807e80479f281d47ee4af2eb2df3e4ccf4723484f77da0bb49d027e40a1",
+                "sha256:4a8eb7785bd23565b542b01fb39115a975fefb4a82f23d407503eee2c0106247",
+                "sha256:5bee3970617b3d74759b2d2df2f6a327d372f9732f9ccbf03fa591b5f7581e39",
+                "sha256:60a3307a84ec60578accd35d7f0c71a3a971430ed7eca6567399d2b50ef37b8c",
+                "sha256:6625e52b6f346a283c3d563d1fd8bae8956daafc64bb5bbd2b8f8a07608e3994",
+                "sha256:66a5aae8233d766a877c5ef293ec5ab9520929c2578fd2069308a98b7374ea8c",
+                "sha256:68fb816a5dd901c6aff352ce49e2a0ffadacdf9b6fae282a69e7a16a02dad5fb",
+                "sha256:6b588b5cf51dc0fd1c9e19f622457cc74b7d26fe295432e434525f1c0fae02bc",
+                "sha256:6c4d7165a4e8f41eca6b990c12ee7f44fef3932fac48ca32cecb3a1b2223c21f",
+                "sha256:6d2e262e5e8da6fa56e774fb8e2643417351427604c2b177f8e8c5f75fc928ca",
+                "sha256:6d9c88b787638a451f41f97446a1c9fd416e669b4d9717ae4615bd29de1ac135",
+                "sha256:755c56beeacac6a24c8e1074f89f34f4373abce8b662470d3aa719ae304931f3",
+                "sha256:7e40d3f8eb472c1509b12ac2a7e24158ec352fc8567b77ab02c0db053927e339",
+                "sha256:812eaf4939ef2284d29653bcfee9665f11f013724f07258928f849a2306ea9f9",
+                "sha256:84df004223fd0550d0ea7a37882e5c889f3c6d45535c639ce9802293b39cd5c9",
+                "sha256:859f0add98707b182b4867359e12bde806b82483fb12a9ae868a77880fc3b7af",
+                "sha256:87c4b38288f71acd2106f5d94f575bc2136ea2887fdb5dfe18003c881fa6b370",
+                "sha256:89fc12c6371bf963809abc46cced4a01ca4f99cba17be5e7d416ed7ef1245d19",
+                "sha256:9564ac7eb1652c3701ac691ca72934dd3009997c81266807aef924012df2f4b3",
+                "sha256:9754a5c265f991317de2bac0c70a746efc2b695cf4d49f5d2cddeac36544fb44",
+                "sha256:a565f48c4aae72d1d3d3f8e8fb7218f5609c964e9c6f68604608e5958b9c60c3",
+                "sha256:a636160680c6e526b84f85d304e2f0bb4e94f8284dd765a1911de9a40450b10a",
+                "sha256:a839e25f07e428a87d17d857d9935dd743130e77ff46524abb992b962eb2076c",
+                "sha256:b62046592b44263fa7570f1117d372ae3f310222af1fc1407416f037fb3af21b",
+                "sha256:b7f7421841f8db443855d2854e25914a79a1ff48ae92f70d0a5c2f8907ab98c9",
+                "sha256:ba7ca81b6d60a9f7a0b4b4e175dcc38e8fef4992673d9d6e6879fd6de00dd9b8",
+                "sha256:bb32ca14b4d04e172c541c69eec5f385f9a075b38fb22d765d8b0ce3af3a0c22",
+                "sha256:c0ff1c1b4d13e2240821ef23c1efb1f009207cb3f56e16986f713c2b0e7cd37f",
+                "sha256:c669b440ce46ae3abe9b2d44a913b5fd86bb19eb14a8701e88e3918902ecd345",
+                "sha256:c67734cff78383a1f23ceba3b3239c7deefc62ac2b05fa6a47bcd565771e5880",
+                "sha256:c6809ebcbf6c1049002b9ac09c127ae43929042ec1f1dbd8bb1615f7cd9f70a0",
+                "sha256:cd601187476c6bed26a0398353212684c427e10a903aeafa6da40c63309d438b",
+                "sha256:ebfa374067af240d079ef97b8064478f3bf71038b78b017eb6ec93ede1b6bcec",
+                "sha256:fbb17c0d0822684b7d6c09915677a32319f16ff1115df5ec05bdcaaee40b35f3",
+                "sha256:fff1f3a586246110f34dc762098b5afd2de88de507559e63553d7da643053786"
            ],
            "index": "pypi",
-            "version": "==5.3.1"
+            "version": "==5.4"
        },
        "django": {
            "hashes": [
@ -1592,11 +1600,11 @@
        },
        "pytest": {
            "hashes": [
-                "sha256:1969f797a1a0dbd8ccf0fecc80262312729afea9c17f1d70ebf85c5e76c6f7c8",
-                "sha256:66e419b1899bc27346cb2c993e12c5e5e8daba9073c1fbce33b9807abc95c306"
+                "sha256:9d1edf9e7d0b84d72ea3dbcdfd22b35fb543a5e8f2a60092dd578936bf63d7f9",
+                "sha256:b574b57423e818210672e07ca1fa90aaf194a4f63f3ab909a2c67ebb22913839"
            ],
            "index": "pypi",
-            "version": "==6.2.1"
+            "version": "==6.2.2"
        },
        "pytest-django": {
            "hashes": [
@ -1615,22 +1623,30 @@
        },
        "pyyaml": {
            "hashes": [
-                "sha256:06a0d7ba600ce0b2d2fe2e78453a470b5a6e000a985dd4a4e54e436cc36b0e97",
-                "sha256:240097ff019d7c70a4922b6869d8a86407758333f02203e0fc6ff79c5dcede76",
-                "sha256:4f4b913ca1a7319b33cfb1369e91e50354d6f07a135f3b901aca02aa95940bd2",
-                "sha256:6034f55dab5fea9e53f436aa68fa3ace2634918e8b5994d82f3621c04ff5ed2e",
-                "sha256:69f00dca373f240f842b2931fb2c7e14ddbacd1397d57157a9b005a6a9942648",
-                "sha256:73f099454b799e05e5ab51423c7bcf361c58d3206fa7b0d555426b1f4d9a3eaf",
-                "sha256:74809a57b329d6cc0fdccee6318f44b9b8649961fa73144a98735b0aaf029f1f",
-                "sha256:7739fc0fa8205b3ee8808aea45e968bc90082c10aef6ea95e855e10abf4a37b2",
-                "sha256:95f71d2af0ff4227885f7a6605c37fd53d3a106fcab511b8860ecca9fcf400ee",
-                "sha256:ad9c67312c84def58f3c04504727ca879cb0013b2517c85a9a253f0cb6380c0a",
-                "sha256:b8eac752c5e14d3eca0e6dd9199cd627518cb5ec06add0de9d32baeee6fe645d",
-                "sha256:cc8955cfbfc7a115fa81d85284ee61147059a753344bc51098f3ccd69b0d7e0c",
-                "sha256:d13155f591e6fcc1ec3b30685d50bf0711574e2c0dfffd7644babf8b5102ca1a"
+                "sha256:08682f6b72c722394747bddaf0aa62277e02557c0fd1c42cb853016a38f8dedf",
+                "sha256:0f5f5786c0e09baddcd8b4b45f20a7b5d61a7e7e99846e3c799b05c7c53fa696",
+                "sha256:129def1b7c1bf22faffd67b8f3724645203b79d8f4cc81f674654d9902cb4393",
+                "sha256:294db365efa064d00b8d1ef65d8ea2c3426ac366c0c4368d930bf1c5fb497f77",
+                "sha256:3b2b1824fe7112845700f815ff6a489360226a5609b96ec2190a45e62a9fc922",
+                "sha256:3bd0e463264cf257d1ffd2e40223b197271046d09dadf73a0fe82b9c1fc385a5",
+                "sha256:4465124ef1b18d9ace298060f4eccc64b0850899ac4ac53294547536533800c8",
+                "sha256:49d4cdd9065b9b6e206d0595fee27a96b5dd22618e7520c33204a4a3239d5b10",
+                "sha256:4e0583d24c881e14342eaf4ec5fbc97f934b999a6828693a99157fde912540cc",
+                "sha256:5accb17103e43963b80e6f837831f38d314a0495500067cb25afab2e8d7a4018",
+                "sha256:607774cbba28732bfa802b54baa7484215f530991055bb562efbed5b2f20a45e",
+                "sha256:6c78645d400265a062508ae399b60b8c167bf003db364ecb26dcab2bda048253",
+                "sha256:74c1485f7707cf707a7aef42ef6322b8f97921bd89be2ab6317fd782c2d53183",
+                "sha256:8c1be557ee92a20f184922c7b6424e8ab6691788e6d86137c5d93c1a6ec1b8fb",
+                "sha256:bb4191dfc9306777bc594117aee052446b3fa88737cd13b7188d0e7aa8162185",
+                "sha256:c20cfa2d49991c8b4147af39859b167664f2ad4561704ee74c1de03318e898db",
+                "sha256:d2d9808ea7b4af864f35ea216be506ecec180628aced0704e34aca0b040ffe46",
+                "sha256:dd5de0646207f053eb0d6c74ae45ba98c3395a571a2891858e87df7c9b9bd51b",
+                "sha256:e1d4970ea66be07ae37a3c2e48b5ec63f7ba6804bdddfdbd3cfd954d25a82e63",
+                "sha256:e4fac90784481d221a8e4b1162afa7c47ed953be40d31ab4629ae917510051df",
+                "sha256:fa5ae20527d8e831e8230cbffd9f8fe952815b2b7dae6ffec25318803a7528fc"
            ],
            "index": "pypi",
-            "version": "==5.3.1"
+            "version": "==5.4.1"
        },
        "regex": {
            "hashes": [
@ -1707,17 +1723,17 @@
        },
        "smmap": {
            "hashes": [
-                "sha256:54c44c197c819d5ef1991799a7e30b662d1e520f2ac75c9efbeb54a742214cf4",
-                "sha256:9c98bbd1f9786d22f14b3d4126894d56befb835ec90cef151af566c7e19b5d24"
+                "sha256:7bfcf367828031dc893530a29cb35eb8c8f2d7c8f2d0989354d75d24c8573714",
+                "sha256:84c2751ef3072d4f6b2785ec7ee40244c6f45eb934d9e543e2c51f1bd3d54c50"
            ],
-            "version": "==3.0.4"
+            "version": "==3.0.5"
        },
        "snowballstemmer": {
            "hashes": [
-                "sha256:209f257d7533fdb3cb73bdbd24f436239ca3b2fa67d56f6ff88e86be08cc5ef0",
-                "sha256:df3bac3df4c2c01363f3dd2cfa78cce2840a79b9f1c2d2de9ce8d31683992f52"
+                "sha256:b51b447bea85f9968c13b650126a888aabd4cb4463fca868ec596826325dedc2",
+                "sha256:e997baa4f2e9139951b6f4c631bad912dfd3c792467e2f03d7239464af90e914"
            ],
-            "version": "==2.0.0"
+            "version": "==2.1.0"
        },
        "sqlparse": {
            "hashes": [
@ -1788,12 +1804,12 @@
                "secure"
            ],
            "hashes": [
-                "sha256:19188f96923873c92ccb987120ec4acaa12f0461fa9ce5d3d0772bc965a39e08",
-                "sha256:d8ff90d979214d7b4f8ce956e80f4028fc6860e4431f731ea4a8c08f23f99473"
+                "sha256:1b465e494e3e0d8939b50680403e3aedaa2bc434b7d5af64dfd3c958d7f5ae80",
+                "sha256:de3eedaad74a2683334e282005cd8d7f22f4d55fa690a2a1020a416cb0a47e73"
            ],
            "index": "pypi",
            "markers": null,
-            "version": "==1.26.2"
+            "version": "==1.26.3"
        },
        "wrapt": {
            "hashes": [
--- a/authentik/init.py
+++ b/authentik/init.py
@ -1,2 +1,2 @@
 """authentik"""
-__version__ = "2021.1.1-rc2"
+__version__ = "2021.1.4-stable"
--- a/authentik/admin/api/tasks.py
+++ b/authentik/admin/api/tasks.py
@ -14,7 +14,7 @@ from rest_framework.response import Response
 from rest_framework.serializers import Serializer
 from rest_framework.viewsets import ViewSet

-from authentik.lib.tasks import TaskInfo
+from authentik.events.monitored_tasks import TaskInfo


 class TaskSerializer(Serializer):
--- a/authentik/admin/tasks.py
+++ b/authentik/admin/tasks.py
@ -6,7 +6,7 @@ from structlog.stdlib import get_logger

 from authentik import __version__
 from authentik.events.models import Event, EventAction
-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP

 LOGGER = get_logger()
--- a/authentik/admin/templates/administration/provider/list.html
+++ b/authentik/admin/templates/administration/provider/list.html
@ -160,6 +160,17 @@
                            </ak-modal-button>
                        </li>
                        {% endfor %}
+                        <li>
+                            <ak-modal-button href="{% url 'authentik_admin:provider-saml-from-metadata' %}">
+                                <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                    {% trans 'SAML Provider from Metadata' %}<br>
+                                    <small>
+                                        {% trans "Create a SAML Provider by importing its Metadata." %}
+                                    </small>
+                                </button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </li>
                    </ul>
                </ak-dropdown>
            </div>
--- a/authentik/admin/views/flows.py
+++ b/authentik/admin/views/flows.py
@ -17,6 +17,7 @@ from authentik.admin.views.utils import (
    SearchListMixin,
    UserPaginateListMixin,
 )
+from authentik.flows.exceptions import FlowNonApplicableException
 from authentik.flows.forms import FlowForm, FlowImportForm
 from authentik.flows.models import Flow
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
@ -25,7 +26,7 @@ from authentik.flows.transfer.exporter import FlowExporter
 from authentik.flows.transfer.importer import FlowImporter
 from authentik.flows.views import SESSION_KEY_PLAN, FlowPlanner
 from authentik.lib.utils.urls import redirect_with_qs
-from authentik.lib.views import CreateAssignPermView
+from authentik.lib.views import CreateAssignPermView, bad_request_message


 class FlowListView(
@ -103,8 +104,17 @@ class FlowDebugExecuteView(LoginRequiredMixin, PermissionRequiredMixin, DetailVi
        flow: Flow = self.get_object()
        planner = FlowPlanner(flow)
        planner.use_cache = False
-        plan = planner.plan(self.request, {PLAN_CONTEXT_PENDING_USER: request.user})
-        self.request.session[SESSION_KEY_PLAN] = plan
+        try:
+            plan = planner.plan(self.request, {PLAN_CONTEXT_PENDING_USER: request.user})
+            self.request.session[SESSION_KEY_PLAN] = plan
+        except FlowNonApplicableException as exc:
+            return bad_request_message(
+                request,
+                _(
+                    "Flow not applicable to current user/request: %(messages)s"
+                    % {"messages": str(exc)}
+                ),
+            )
        return redirect_with_qs(
            "authentik_flows:flow-executor-shell",
            self.request.GET,
--- a/authentik/admin/views/tasks.py
+++ b/authentik/admin/views/tasks.py
@ -4,7 +4,7 @@ from typing import Any, Dict
 from django.views.generic.base import TemplateView

 from authentik.admin.mixins import AdminRequiredMixin
-from authentik.lib.tasks import TaskInfo, TaskResultStatus
+from authentik.events.monitored_tasks import TaskInfo, TaskResultStatus


 class TaskListView(AdminRequiredMixin, TemplateView):
--- a/authentik/core/api/applications.py
+++ b/authentik/core/api/applications.py
@ -11,6 +11,7 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
+from structlog.stdlib import get_logger

 from authentik.admin.api.metrics import get_events_per_1h
 from authentik.core.api.providers import ProviderSerializer
@ -18,6 +19,8 @@ from authentik.core.models import Application
 from authentik.events.models import EventAction
 from authentik.policies.engine import PolicyEngine

+LOGGER = get_logger()
+

 def user_app_cache_key(user_pk: str) -> str:
    """Cache key where application list for user is saved"""
@ -74,19 +77,35 @@ class ApplicationViewSet(ModelViewSet):
            queryset = backend().filter_queryset(self.request, queryset, self)
        return queryset

+    def _get_allowed_applications(self, queryset: QuerySet) -> list[Application]:
+        applications = []
+        for application in queryset:
+            engine = PolicyEngine(application, self.request.user, self.request)
+            engine.build()
+            if engine.passing:
+                applications.append(application)
+        return applications
+
    def list(self, request: Request) -> Response:
        """Custom list method that checks Policy based access instead of guardian"""
        queryset = self._filter_queryset_for_list(self.get_queryset())
        self.paginate_queryset(queryset)
-        allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
-        if not allowed_applications:
-            allowed_applications = []
-            for application in queryset:
-                engine = PolicyEngine(application, self.request.user, self.request)
-                engine.build()
-                if engine.passing:
-                    allowed_applications.append(application)
-            cache.set(user_app_cache_key(self.request.user.pk), allowed_applications)
+
+        should_cache = "search" not in request.GET
+
+        allowed_applications = []
+        if not should_cache:
+            allowed_applications = self._get_allowed_applications(queryset)
+        if should_cache:
+            LOGGER.debug("Caching allowed application list")
+            allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
+            if not allowed_applications:
+                allowed_applications = self._get_allowed_applications(queryset)
+                cache.set(
+                    user_app_cache_key(self.request.user.pk),
+                    allowed_applications,
+                    timeout=86400,
+                )
        serializer = self.get_serializer(allowed_applications, many=True)
        return self.get_paginated_response(serializer.data)

--- a/authentik/core/tasks.py
+++ b/authentik/core/tasks.py
@ -11,7 +11,7 @@ from django.utils.timezone import now
 from structlog.stdlib import get_logger

 from authentik.core.models import ExpiringModel
-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP

 LOGGER = get_logger()
--- a/authentik/events/models.py
+++ b/authentik/events/models.py
@ -22,7 +22,6 @@ from authentik.events.utils import cleanse_dict, get_user, sanitize_dict
 from authentik.lib.sentry import SentryIgnoredException
 from authentik.lib.utils.http import get_client_ip
 from authentik.policies.models import PolicyBindingModel
-from authentik.stages.email.tasks import send_mail
 from authentik.stages.email.utils import TemplateEmailMessage

 LOGGER = get_logger("authentik.events")
@ -57,6 +56,9 @@ class EventAction(models.TextChoices):
    POLICY_EXCEPTION = "policy_exception"
    PROPERTY_MAPPING_EXCEPTION = "property_mapping_exception"

+    SYSTEM_TASK_EXECUTION = "system_task_execution"
+    SYSTEM_TASK_EXCEPTION = "system_task_exception"
+
    CONFIGURATION_ERROR = "configuration_error"

    MODEL_CREATED = "model_created"
@ -272,7 +274,7 @@ class NotificationTransport(models.Model):
        )
        mail = TemplateEmailMessage(
            subject=f"authentik Notification: {body_trunc}",
-            template_name="email/setup.html",
+            template_name="email/generic.html",
            to=[notification.user.email],
            template_context={
                "body": notification.body,
@ -280,9 +282,11 @@ class NotificationTransport(models.Model):
        )
        # Email is sent directly here, as the call to send() should have been from a task.
        try:
+            from authentik.stages.email.tasks import send_mail
+
            # pyright: reportGeneralTypeIssues=false
            return send_mail(mail.__dict__)  # pylint: disable=no-value-for-parameter
-        except (SMTPException, ConnectionError) as exc:
+        except (SMTPException, ConnectionError, OSError) as exc:
            raise NotificationTransportError from exc

    def __str__(self) -> str:
--- a/authentik/events/monitored_tasks.py
+++ b/authentik/events/monitored_tasks.py
@ -8,6 +8,8 @@ from typing import Any, Dict, List, Optional
 from celery import Task
 from django.core.cache import cache

+from authentik.events.models import Event, EventAction
+

 class TaskResultStatus(Enum):
    """Possible states of tasks"""
@ -122,6 +124,13 @@ class MonitoredTask(Task):
                task_call_args=args,
                task_call_kwargs=kwargs,
            ).save(self.result_timeout_hours)
+            Event.new(
+                EventAction.SYSTEM_TASK_EXECUTION,
+                message=(
+                    f"Task {self.__name__} finished successfully: "
+                    "\n".join(self._result.messages)
+                ),
+            ).save()
        return super().after_return(status, retval, task_id, args, kwargs, einfo=einfo)

    # pylint: disable=too-many-arguments
@ -138,6 +147,13 @@ class MonitoredTask(Task):
            task_call_args=args,
            task_call_kwargs=kwargs,
        ).save(self.result_timeout_hours)
+        Event.new(
+            EventAction.SYSTEM_TASK_EXCEPTION,
+            message=(
+                f"Task {self.__name__} encountered an error: "
+                "\n".join(self._result.messages)
+            ),
+        ).save()
        return super().on_failure(exc, task_id, args, kwargs, einfo=einfo)

    def run(self, *args, **kwargs):
--- a/authentik/events/tasks.py
+++ b/authentik/events/tasks.py
@ -9,7 +9,7 @@ from authentik.events.models import (
    NotificationTransport,
    NotificationTransportError,
 )
-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.policies.engine import PolicyEngine, PolicyEngineMode
 from authentik.policies.models import PolicyBinding
 from authentik.root.celery import CELERY_APP
--- a/authentik/events/tests/test_notifications.py
+++ b/authentik/events/tests/test_notifications.py
@ -87,4 +87,4 @@ class TestEventsNotifications(TestCase):
                "authentik.events.models.NotificationTransport.send", execute_mock
            ):
                Event.new(EventAction.CUSTOM_PREFIX).save()
-        self.assertEqual(passes.call_count, 0)
+        self.assertEqual(passes.call_count, 1)
--- a/authentik/flows/exceptions.py
+++ b/authentik/flows/exceptions.py
@ -1,9 +1,11 @@
 """flow exceptions"""

+from authentik.lib.sentry import SentryIgnoredException

-class FlowNonApplicableException(BaseException):
+
+class FlowNonApplicableException(SentryIgnoredException):
    """Flow does not apply to current user (denied by policy)."""


-class EmptyFlowException(BaseException):
+class EmptyFlowException(SentryIgnoredException):
    """Flow has no stages."""
--- a/authentik/flows/planner.py
+++ b/authentik/flows/planner.py
@ -120,7 +120,7 @@ class FlowPlanner:
            engine.build()
            result = engine.result
            if not result.passing:
-                raise FlowNonApplicableException(result.messages)
+                raise FlowNonApplicableException(",".join(result.messages))
            # User is passing so far, check if we have a cached plan
            cached_plan_key = cache_key(self.flow, user)
            cached_plan = cache.get(cached_plan_key, None)
--- a/authentik/lib/expression/evaluator.py
+++ b/authentik/lib/expression/evaluator.py
@ -60,7 +60,7 @@ class BaseEvaluator:
    @staticmethod
    def expr_func_is_group_member(user: User, **group_filters) -> bool:
        """Check if `user` is member of group with name `group_name`"""
-        return user.groups.filter(**group_filters).exists()
+        return user.ak_groups.filter(**group_filters).exists()

    def wrap_expression(self, expression: str, params: Iterable[str]) -> str:
        """Wrap expression in a function, call it, and save the result as `result`"""
--- a/authentik/outposts/tasks.py
+++ b/authentik/outposts/tasks.py
@ -8,7 +8,7 @@ from django.db.models.base import Model
 from django.utils.text import slugify
 from structlog.stdlib import get_logger

-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.lib.utils.reflection import path_to_class
 from authentik.outposts.controllers.base import ControllerException
 from authentik.outposts.models import (
@ -49,9 +49,15 @@ def outpost_service_connection_state(connection_pk: Any):
@CELERY_APP.task(bind=True, base=MonitoredTask)
 def outpost_service_connection_monitor(self: MonitoredTask):
    """Regularly check the state of Outpost Service Connections"""
-    for connection in OutpostServiceConnection.objects.all():
+    connections = OutpostServiceConnection.objects.all()
+    for connection in connections.iterator():
        outpost_service_connection_state.delay(connection.pk)
-    self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL))
+    self.set_status(
+        TaskResult(
+            TaskResultStatus.SUCCESSFUL,
+            [f"Successfully updated {len(connections)} connections."],
+        )
+    )


@CELERY_APP.task(bind=True, base=MonitoredTask)
--- a/authentik/policies/engine.py
+++ b/authentik/policies/engine.py
@ -1,6 +1,6 @@
 """authentik policy engine"""
 from enum import Enum
-from multiprocessing import Pipe, set_start_method
+from multiprocessing import Pipe, current_process
 from multiprocessing.connection import Connection
 from typing import Iterator, List, Optional

@ -16,9 +16,7 @@ from authentik.policies.process import PolicyProcess, cache_key
 from authentik.policies.types import PolicyRequest, PolicyResult

 LOGGER = get_logger()
-# This is only really needed for macOS, because Python 3.8 changed the default to spawn
-# spawn causes issues with objects that aren't picklable, and also the django setup
-set_start_method("fork")
+CURRENT_PROCESS = current_process()


 class PolicyProcessInfo:
@ -117,14 +115,19 @@ class PolicyEngine:
                LOGGER.debug("P_ENG: Evaluating policy", policy=binding.policy)
                our_end, task_end = Pipe(False)
                task = PolicyProcess(binding, self.request, task_end)
+                task.daemon = False
                LOGGER.debug("P_ENG: Starting Process", policy=binding.policy)
-                task.start()
+                if not CURRENT_PROCESS._config.get("daemon"):
+                    task.run()
+                else:
+                    task.start()
                self.__processes.append(
                    PolicyProcessInfo(process=task, connection=our_end, binding=binding)
                )
            # If all policies are cached, we have an empty list here.
            for proc_info in self.__processes:
-                proc_info.process.join(proc_info.binding.timeout)
+                if proc_info.process.is_alive():
+                    proc_info.process.join(proc_info.binding.timeout)
                # Only call .recv() if no result is saved, otherwise we just deadlock here
                if not proc_info.result:
                    proc_info.result = proc_info.connection.recv()
--- a/authentik/policies/process.py
+++ b/authentik/policies/process.py
@ -1,5 +1,5 @@
 """authentik policy task"""
-from multiprocessing import Process
+from multiprocessing import get_context
 from multiprocessing.connection import Connection
 from traceback import format_tb
 from typing import Optional
@ -28,7 +28,11 @@ def cache_key(binding: PolicyBinding, request: PolicyRequest) -> str:
    return prefix


-class PolicyProcess(Process):
+FORK_CTX = get_context("fork")
+PROCESS_CLASS = FORK_CTX.Process
+
+
+class PolicyProcess(PROCESS_CLASS):
    """Evaluate a single policy within a seprate process"""

    connection: Connection
--- a/authentik/policies/reputation/tasks.py
+++ b/authentik/policies/reputation/tasks.py
@ -3,7 +3,7 @@ from django.core.cache import cache
 from structlog.stdlib import get_logger

 from authentik.core.models import User
-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.policies.reputation.models import IPReputation, UserReputation
 from authentik.policies.reputation.signals import (
    CACHE_KEY_IP_PREFIX,
--- a/authentik/providers/saml/api.py
+++ b/authentik/providers/saml/api.py
@ -22,6 +22,7 @@ class SAMLProviderSerializer(ModelSerializer, MetaNameSerializer):
            "assertion_valid_not_on_or_after",
            "session_valid_not_on_or_after",
            "property_mappings",
+            "name_id_mapping",
            "digest_algorithm",
            "signature_algorithm",
            "signing_kp",
--- a/authentik/providers/saml/forms.py
+++ b/authentik/providers/saml/forms.py
@ -42,6 +42,7 @@ class SAMLProviderForm(forms.ModelForm):
            "signing_kp",
            "verification_kp",
            "property_mappings",
+            "name_id_mapping",
            "assertion_valid_not_before",
            "assertion_valid_not_on_or_after",
            "session_valid_not_on_or_after",
@ -84,7 +85,9 @@ class SAMLPropertyMappingForm(forms.ModelForm):
            "saml_name": mark_safe(
                _(
                    "URN OID used by SAML. This is optional. "
-                    '<a href="https://www.rfc-editor.org/rfc/rfc2798.html#section-2">Reference</a>'
+                    '<a href="https://www.rfc-editor.org/rfc/rfc2798.html#section-2">Reference</a>.'
+                    " If this property mapping is used for NameID Property, "
+                    "this field is discarded."
                )
            ),
        }
--- a/authentik/providers/saml/migrations/0002_default_saml_property_mappings.py
+++ b/authentik/providers/saml/migrations/0002_default_saml_property_mappings.py
@ -17,17 +17,17 @@ def create_default_property_mappings(apps, schema_editor):
        },
        {
            "FriendlyName": "cn",
-            "Name": "urn:oid:2.5.4.3",
+            "Name": "http://schemas.xmlsoap.org/claims/CommonName",
            "Expression": "return user.name",
        },
        {
            "FriendlyName": "mail",
-            "Name": "urn:oid:0.9.2342.19200300.100.1.3",
+            "Name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
            "Expression": "return user.email",
        },
        {
            "FriendlyName": "displayName",
-            "Name": "urn:oid:2.16.840.1.113730.3.1.241",
+            "Name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
            "Expression": "return user.username",
        },
        {
@ -37,8 +37,8 @@ def create_default_property_mappings(apps, schema_editor):
        },
        {
            "FriendlyName": "member-of",
-            "Name": "member-of",
-            "Expression": "for group in user.groups.all():\n    yield group.name",
+            "Name": "http://schemas.xmlsoap.org/claims/Group",
+            "Expression": "for group in user.ak_groups.all():\n    yield group.name",
        },
    ]
    for default in defaults:
--- a/authentik/providers/saml/migrations/0011_samlprovider_name_id_mapping.py
+++ b/authentik/providers/saml/migrations/0011_samlprovider_name_id_mapping.py
@ -0,0 +1,27 @@
+# Generated by Django 3.1.4 on 2021-01-28 21:01
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_providers_saml", "0010_auto_20201230_2112"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="samlprovider",
+            name="name_id_mapping",
+            field=models.ForeignKey(
+                blank=True,
+                default=None,
+                help_text="Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered",
+                null=True,
+                verbose_name="NameID Property Mapping",
+                on_delete=django.db.models.deletion.SET_DEFAULT,
+                to="authentik_providers_saml.samlpropertymapping",
+            ),
+        ),
+    ]
--- a/authentik/providers/saml/models.py
+++ b/authentik/providers/saml/models.py
@ -65,6 +65,21 @@ class SAMLProvider(Provider):
        ),
    )

+    name_id_mapping = models.ForeignKey(
+        "SAMLPropertyMapping",
+        default=None,
+        blank=True,
+        null=True,
+        on_delete=models.SET_DEFAULT,
+        verbose_name=_("NameID Property Mapping"),
+        help_text=_(
+            (
+                "Configure how the NameID value will be created. When left empty, "
+                "the NameIDPolicy of the incoming request will be considered"
+            )
+        ),
+    )
+
    assertion_valid_not_before = models.TextField(
        default="minutes=-5",
        validators=[timedelta_string_validator],
--- a/authentik/providers/saml/processors/assertion.py
+++ b/authentik/providers/saml/processors/assertion.py
@ -3,6 +3,7 @@ from hashlib import sha256
 from types import GeneratorType

 import xmlsec
+from django.conf import settings
 from django.http import HttpRequest
 from lxml import etree  # nosec
 from lxml.etree import Element, SubElement  # nosec
@ -23,6 +24,7 @@ from authentik.sources.saml.processors.constants import (
    SAML_NAME_ID_FORMAT_EMAIL,
    SAML_NAME_ID_FORMAT_PERSISTENT,
    SAML_NAME_ID_FORMAT_TRANSIENT,
+    SAML_NAME_ID_FORMAT_WINDOWS,
    SAML_NAME_ID_FORMAT_X509,
    SIGN_ALGORITHM_TRANSFORM_MAP,
 )
@ -137,24 +139,48 @@ class AssertionProcessor:
            audience.text = self.provider.audience
        return conditions

+    # pylint: disable=too-many-return-statements
    def get_name_id(self) -> Element:
        """Get NameID Element"""
        name_id = Element(f"{{{NS_SAML_ASSERTION}}}NameID")
        name_id.attrib["Format"] = self.auth_n_request.name_id_policy
+        # persistent is used as a fallback, so always generate it
+        persistent = sha256(
+            f"{self.http_request.user.id}-{settings.SECRET_KEY}".encode("ascii")
+        ).hexdigest()
+        name_id.text = persistent
+        # If name_id_mapping is set, we override the value, regardless of what the SP asks for
+        if self.provider.name_id_mapping:
+            try:
+                value = self.provider.name_id_mapping.evaluate(
+                    user=self.http_request.user,
+                    request=self.http_request,
+                    provider=self.provider,
+                )
+                if value is not None:
+                    name_id.text = value
+                return name_id
+            except PropertyMappingExpressionException as exc:
+                LOGGER.warning(str(exc))
+                return name_id
        if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_EMAIL:
            name_id.text = self.http_request.user.email
            return name_id
        if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_PERSISTENT:
-            name_id.text = self.http_request.user.username
+            name_id.text = persistent
            return name_id
        if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_X509:
            # This attribute is statically set by the LDAP source
            name_id.text = self.http_request.user.attributes.get(
-                "distinguishedName", ""
+                "distinguishedName", persistent
            )
            return name_id
-        if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_TRANSIENT:
+        if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_WINDOWS:
            # This attribute is statically set by the LDAP source
+            name_id.text = self.http_request.user.attributes.get("upn", persistent)
+            return name_id
+        if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_TRANSIENT:
+            # Use the hash of the user's session, which changes every session
            session_key: str = self.http_request.user.session.session_key
            name_id.text = sha256(session_key.encode()).hexdigest()
            return name_id
--- a/authentik/providers/saml/processors/metadata_parser.py
+++ b/authentik/providers/saml/processors/metadata_parser.py
@ -10,7 +10,12 @@ from lxml import etree  # nosec
 from structlog.stdlib import get_logger

 from authentik.crypto.models import CertificateKeyPair
-from authentik.providers.saml.models import SAMLBindings, SAMLProvider
+from authentik.flows.models import Flow
+from authentik.providers.saml.models import (
+    SAMLBindings,
+    SAMLPropertyMapping,
+    SAMLProvider,
+)
 from authentik.providers.saml.utils.encoding import PEM_FOOTER, PEM_HEADER
 from authentik.sources.saml.processors.constants import (
    NS_MAP,
@ -48,10 +53,13 @@ class ServiceProviderMetadata:

    signing_keypair: Optional[CertificateKeyPair] = None

-    def to_provider(self, name: str) -> SAMLProvider:
+    def to_provider(self, name: str, authorization_flow: Flow) -> SAMLProvider:
        """Create a SAMLProvider instance from the details. `name` is required,
        as depending on the metadata CertificateKeypairs might have to be created."""
-        provider = SAMLProvider(name=name)
+        provider = SAMLProvider.objects.create(
+            name=name,
+            authorization_flow=authorization_flow,
+        )
        provider.issuer = self.entity_id
        provider.sp_binding = self.acs_binding
        provider.acs_url = self.acs_location
@ -63,6 +71,11 @@ class ServiceProviderMetadata:
            provider.signing_kp = CertificateKeyPair.objects.exclude(
                key_data__iexact=""
            ).first()
+        # Set all auto-generated Property-mappings as defaults
+        # They should provide a sane default for most applications:
+        provider.property_mappings.set(
+            SAMLPropertyMapping.objects.filter(name__startswith="Autogenerated")
+        )
        return provider


--- a/authentik/providers/saml/tests/test_metadata.py
+++ b/authentik/providers/saml/tests/test_metadata.py
@ -3,7 +3,8 @@

 from django.test import TestCase

-from authentik.providers.saml.models import SAMLBindings
+from authentik.flows.models import Flow
+from authentik.providers.saml.models import SAMLBindings, SAMLPropertyMapping
 from authentik.providers.saml.processors.metadata_parser import (
    ServiceProviderMetadataParser,
 )
@ -65,18 +66,25 @@ bHlUY7ytSUTowXA=
 class TestServiceProviderMetadataParser(TestCase):
    """Test ServiceProviderMetadataParser parsing and creation of SAML Provider"""

+    def setUp(self) -> None:
+        self.flow = Flow.objects.first()
+
    def test_simple(self):
        """Test simple metadata without Singing"""
        metadata = ServiceProviderMetadataParser().parse(METADATA_SIMPLE)
-        provider = metadata.to_provider("test")
+        provider = metadata.to_provider("test", self.flow)
        self.assertEqual(provider.acs_url, "http://localhost:8080/saml/acs")
        self.assertEqual(provider.issuer, "http://localhost:8080/saml/metadata")
        self.assertEqual(provider.sp_binding, SAMLBindings.POST)
+        self.assertEqual(
+            len(provider.property_mappings.all()),
+            len(SAMLPropertyMapping.objects.filter(name__startswith="Autogenerated")),
+        )

    def test_with_signing_cert(self):
        """Test Metadata with signing cert"""
        metadata = ServiceProviderMetadataParser().parse(METADATA_CERT)
-        provider = metadata.to_provider("test")
+        provider = metadata.to_provider("test", self.flow)
        self.assertEqual(
            provider.acs_url, "http://localhost:8080/apps/user_saml/saml/acs"
        )
--- a/authentik/providers/saml/views.py
+++ b/authentik/providers/saml/views.py
@ -269,9 +269,10 @@ class MetadataImportView(LoginRequiredMixin, FormView):
            metadata = ServiceProviderMetadataParser().parse(
                form.cleaned_data["metadata"].read().decode()
            )
-            provider = metadata.to_provider(form.cleaned_data["provider_name"])
-            provider.authorization_flow = form.cleaned_data["authorization_flow"]
-            provider.save()
+            metadata.to_provider(
+                form.cleaned_data["provider_name"],
+                form.cleaned_data["authorization_flow"],
+            )
            messages.success(self.request, _("Successfully created Provider"))
        except ValueError as exc:
            LOGGER.warning(str(exc))
--- a/authentik/sources/ldap/tasks.py
+++ b/authentik/sources/ldap/tasks.py
@ -5,7 +5,7 @@ from django.core.cache import cache
 from django.utils.text import slugify
 from ldap3.core.exceptions import LDAPException

-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP
 from authentik.sources.ldap.models import LDAPSource
 from authentik.sources.ldap.sync import LDAPSynchronizer
--- a/authentik/sources/saml/tasks.py
+++ b/authentik/sources/saml/tasks.py
@ -3,7 +3,7 @@ from django.utils.timezone import now
 from structlog.stdlib import get_logger

 from authentik.core.models import User
-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.lib.utils.time import timedelta_from_string
 from authentik.root.celery import CELERY_APP
 from authentik.sources.saml.models import SAMLSource
--- a/authentik/stages/email/tasks.py
+++ b/authentik/stages/email/tasks.py
@ -9,7 +9,7 @@ from django.core.mail.utils import DNS_NAME
 from django.utils.text import slugify
 from structlog.stdlib import get_logger

-from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP
 from authentik.stages.email.models import EmailStage

@ -31,6 +31,7 @@ def send_mails(stage: EmailStage, *messages: list[EmailMultiAlternatives]):
    autoretry_for=(
        SMTPException,
        ConnectionError,
+        OSError,
    ),
    retry_backoff=True,
    base=MonitoredTask,
@ -44,7 +45,7 @@ def send_mail(
    self.set_uid(slugify(message_id.replace(".", "_").replace("@", "_")))
    try:
        if not email_stage_pk:
-            stage: EmailStage = EmailStage()
+            stage: EmailStage = EmailStage(use_global_settings=True)
        else:
            stage: EmailStage = EmailStage.objects.get(pk=email_stage_pk)
        backend = stage.backend
--- a/authentik/stages/email/tests/test_templates.py
+++ b/authentik/stages/email/tests/test_templates.py
@ -1,8 +1,10 @@
 """email tests"""
 from os import unlink
 from pathlib import Path
+from sys import platform
 from tempfile import gettempdir, mkstemp
 from typing import Any
+from unittest.case import skipUnless

 from django.conf import settings
 from django.test import TestCase
@ -17,6 +19,7 @@ def get_templates_setting(temp_dir: str) -> dict[str, Any]:
    return templates_setting


+@skipUnless(platform.startswith("linux"), "requires local docker")
 class TestEmailStageTemplates(TestCase):
    """Email tests"""

--- a/authentik/stages/password/stage.py
+++ b/authentik/stages/password/stage.py
@ -31,7 +31,11 @@ def authenticate(

    Customized version of django's authenticate, which accepts a list of backends"""
    for backend_path in backends:
-        backend: BaseBackend = path_to_class(backend_path)()
+        try:
+            backend: BaseBackend = path_to_class(backend_path)()
+        except ImportError:
+            LOGGER.warning("Failed to import backend", path=backend_path)
+            continue
        LOGGER.debug("Attempting authentication...", backend=backend)
        user = backend.authenticate(request, **credentials)
        if user is None:
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@ -8,10 +8,10 @@ variables:
  POSTGRES_DB: authentik
  POSTGRES_USER: authentik
  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
+  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/pull/') }}:
+    branchName: ${{ replace(variables['System.PullRequest.SourceBranch'], '/', '-') }}
  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/') }}:
    branchName: ${{ replace(variables['Build.SourceBranchName'], 'refs/heads/', '') }}
-  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/pull/') }}:
-    branchName: $(System.PullRequest.SourceBranch)

 stages:
  - stage: Lint
@ -374,11 +374,12 @@ stages:
            targetType: 'inline'
            script: |
              set -x
-              echo '##vso[task.setvariable variable=branchName]$(echo "$(System.PullRequest.SourceBranch)" | sed "s/\//-/g")'
+              branchName=$(echo "$(System.PullRequest.SourceBranch)" | sed "s/\//-/g")'
+              echo '##vso[task.setvariable variable=branchName]$branchName
        - task: Docker@2
          inputs:
            containerRegistry: 'dockerhub'
            repository: 'beryju/authentik'
            command: 'buildAndPush'
            Dockerfile: 'Dockerfile'
-            tags: "gh-${{ variables.branchName }}"
+            tags: "gh-$(branchName)"
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -19,7 +19,7 @@ services:
    networks:
      - internal
  server:
-    image: beryju/authentik:${AUTHENTIK_TAG:-2021.1.1-rc2}
+    image: beryju/authentik:${AUTHENTIK_TAG:-2021.1.4-stable}
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: redis
@ -45,7 +45,7 @@ services:
    env_file:
      - .env
  worker:
-    image: beryju/authentik:${AUTHENTIK_TAG:-2021.1.1-rc2}
+    image: beryju/authentik:${AUTHENTIK_TAG:-2021.1.4-stable}
    command: worker
    networks:
      - internal
@ -62,7 +62,7 @@ services:
    env_file:
      - .env
  static:
-    image: beryju/authentik-static:${AUTHENTIK_TAG:-2021.1.1-rc2}
+    image: beryju/authentik-static:${AUTHENTIK_TAG:-2021.1.4-stable}
    networks:
      - internal
    labels:
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@ -4,7 +4,7 @@ name: authentik
 home: https://goauthentik.io
 sources:
  - https://github.com/BeryJu/authentik
-version: "2021.1.1-rc2"
+version: "2021.1.4-stable"
 icon: https://raw.githubusercontent.com/BeryJu/authentik/master/web/icons/icon.svg
 dependencies:
  - name: postgresql
--- a/helm/README.md
+++ b/helm/README.md
@ -4,7 +4,7 @@
 |-----------------------------------|-------------------------|-------------|
 | image.name                        | beryju/authentik        | Image used to run the authentik server and worker |
 | image.name_static                 | beryju/authentik-static | Image used to run the authentik static server (CSS and JS Files) |
-| image.tag                         | 2021.1.1-rc2           | Image tag |
+| image.tag                         | 2021.1.4-stable           | Image tag |
 | image.pullPolicy                  | IfNotPresent            | Image Pull Policy used for all deployments |
 | serverReplicas                    | 1                       | Replicas for the Server deployment |
 | workerReplicas                    | 1                       | Replicas for the Worker deployment |
--- a/helm/templates/configmap.yaml
+++ b/helm/templates/configmap.yaml
@ -20,7 +20,7 @@ data:
  OUTPOSTS__DOCKER_IMAGE_BASE: "{{ .Values.image.name_outposts }}"
  EMAIL__HOST: "{{ .Values.config.email.host }}"
  EMAIL__PORT: "{{ .Values.config.email.port }}"
-  EMAIL__USERNAM: "{{ .Values.config.email.username }}"
+  EMAIL__USERNAME: "{{ .Values.config.email.username }}"
  EMAIL__USE_TLS: "{{ .Values.config.email.use_tls }}"
  EMAIL__USE_SSL: "{{ .Values.config.email.use_ssl }}"
  EMAIL__TIMEOUT: "{{ .Values.config.email.timeout }}"
--- a/helm/templates/secret.yaml
+++ b/helm/templates/secret.yaml
@ -11,6 +11,6 @@ data:
  SECRET_KEY: {{ randAlphaNum 50 | b64enc | quote}}
  {{- end }}
  {{- if .Values.backup }}
-  POSTGRESQL__S3_BACKUP__SECRET_KEY: "{{ .Values.backup.secretKey }}"
+  POSTGRESQL__S3_BACKUP__SECRET_KEY: "{{ .Values.backup.secretKey | b64enc }}"
  {{- end}}
-  EMAIL__PASSWOR: "{{ .Values.config.email.password }}"
+  EMAIL__PASSWORD: "{{ .Values.config.email.password | b64enc }}"
--- a/helm/templates/web-deployment.yaml
+++ b/helm/templates/web-deployment.yaml
@ -74,12 +74,10 @@ spec:
            - configMapRef:
                name: {{ include "authentik.fullname" . }}-config
              prefix: AUTHENTIK_
+            - secretRef:
+                name: {{ include "authentik.fullname" . }}-secret-key
+              prefix: AUTHENTIK_
          env:
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: "{{ include "authentik.fullname" . }}-secret-key"
-                  key: "secret_key"
            - name: AUTHENTIK_REDIS__PASSWORD
              valueFrom:
                secretKeyRef:
@ -117,7 +115,7 @@ spec:
              memory: 300M
            limits:
              cpu: 300m
-              memory: 600MiB
+              memory: 600M
      volumes:
        - name: authentik-uploads
          persistentVolumeClaim:
--- a/helm/values.yaml
+++ b/helm/values.yaml
@ -5,7 +5,7 @@ image:
  name: beryju/authentik
  name_static: beryju/authentik-static
  name_outposts: beryju/authentik # Prefix used for Outpost deployments, Outpost type and version is appended
-  tag: 2021.1.1-rc2
+  tag: 2021.1.4-stable
  pullPolicy: IfNotPresent

 serverReplicas: 1
--- a/lifecycle/gunicorn.conf.py
+++ b/lifecycle/gunicorn.conf.py
@ -51,7 +51,7 @@ logconfig_dict = {
 if Path("/var/run/secrets/kubernetes.io").exists():
    workers = 2
 else:
-    worker = cpu_count() * 2 + 1
+    workers = cpu_count() * 2 + 1
 threads = 4

 warnings.simplefilter("once")
--- a/outpost/azure-pipelines.yml
+++ b/outpost/azure-pipelines.yml
@ -2,10 +2,10 @@ trigger:
  - master

 variables:
+  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/pull/') }}:
+    branchName: ${{ replace(variables['System.PullRequest.SourceBranch'], '/', '-') }}
  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/') }}:
    branchName: ${{ replace(variables['Build.SourceBranchName'], 'refs/heads/', '') }}
-  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/pull/') }}:
-    branchName: $(System.PullRequest.SourceBranch)

 stages:
  - stage: generate
@ -94,7 +94,8 @@ stages:
              targetType: 'inline'
              script: |
                set -x
-                echo '##vso[task.setvariable variable=branchName]$(echo "$(System.PullRequest.SourceBranch)" | sed "s/\//-/g")'
+                branchName=$(echo "$(System.PullRequest.SourceBranch)" | sed "s/\//-/g")'
+                echo '##vso[task.setvariable variable=branchName]$branchName
          - task: Docker@2
            inputs:
              containerRegistry: 'dockerhub'
@ -102,4 +103,4 @@ stages:
              command: 'buildAndPush'
              Dockerfile: 'outpost/proxy.Dockerfile'
              buildContext: 'outpost/'
-              tags: "gh-${{ variables.branchName }}"
+              tags: "gh-$(branchName)"
--- a/outpost/pkg/version.go
+++ b/outpost/pkg/version.go
@ -1,3 +1,3 @@
 package pkg

-const VERSION = "2021.1.1-rc2"
+const VERSION = "2021.1.4-stable"
--- a/swagger.yaml
+++ b/swagger.yaml
@ -7584,6 +7584,8 @@ definitions:
          - policy_execution
          - policy_exception
          - property_mapping_exception
+          - system_task_execution
+          - system_task_exception
          - configuration_error
          - model_created
          - model_updated
@ -8300,6 +8302,8 @@ definitions:
          - policy_execution
          - policy_exception
          - property_mapping_exception
+          - system_task_execution
+          - system_task_exception
          - configuration_error
          - model_created
          - model_updated
@ -8835,6 +8839,12 @@ definitions:
          type: string
          format: uuid
        uniqueItems: true
+      name_id_mapping:
+        title: NameID Property Mapping
+        description: Configure how the NameID value will be created. When left empty,
+          the NameIDPolicy of the incoming request will be considered
+        type: string
+        x-nullable: true
      digest_algorithm:
        title: Digest algorithm
        type: string
--- a/web/azure-pipelines.yml
+++ b/web/azure-pipelines.yml
@ -2,10 +2,10 @@ trigger:
  - master

 variables:
+  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/pull/') }}:
+    branchName: ${{ replace(variables['System.PullRequest.SourceBranch'], '/', '-') }}
  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/') }}:
    branchName: ${{ replace(variables['Build.SourceBranchName'], 'refs/heads/', '') }}
-  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/pull/') }}:
-    branchName: $(System.PullRequest.SourceBranch)

 stages:
  - stage: lint
@ -74,12 +74,13 @@ stages:
            targetType: 'inline'
            script: |
              set -x
-              echo '##vso[task.setvariable variable=branchName]$(echo "$(System.PullRequest.SourceBranch)" | sed "s/\//-/g")'
+              branchName=$(echo "$(System.PullRequest.SourceBranch)" | sed "s/\//-/g")'
+              echo '##vso[task.setvariable variable=branchName]$branchName
        - task: Docker@2
          inputs:
            containerRegistry: 'dockerhub'
            repository: 'beryju/authentik-static'
            command: 'buildAndPush'
            Dockerfile: 'web/Dockerfile'
-            tags: "gh-${{ variables.branchName }}"
+            tags: "gh-$(branchName)"
            buildContext: 'web/'
--- a/web/package-lock.json
+++ b/web/package-lock.json
@ -38,9 +38,9 @@
            }
        },
        "@eslint/eslintrc": {
-            "version": "0.2.2",
-            "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-0.2.2.tgz",
-            "integrity": "sha512-EfB5OHNYp1F4px/LI/FEnGylop7nOqkQ1LRzCM0KccA2U8tvV8w01KBv37LbO7nW4H+YhKyo2LcJhRwjjV17QQ==",
+            "version": "0.3.0",
+            "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-0.3.0.tgz",
+            "integrity": "sha512-1JTKgrOKAHVivSvOYw+sJOunkBjUOvjqWk1DPja7ZFhIS2mX/4EgTT8M7eTK9jrKhL/FvXXEbQwIs3pg1xp3dg==",
            "dev": true,
            "requires": {
                "ajv": "^6.12.4",
@ -50,7 +50,7 @@
                "ignore": "^4.0.6",
                "import-fresh": "^3.2.1",
                "js-yaml": "^3.13.1",
-                "lodash": "^4.17.19",
+                "lodash": "^4.17.20",
                "minimatch": "^3.0.4",
                "strip-json-comments": "^3.1.1"
            },
@ -102,9 +102,9 @@
            }
        },
        "@patternfly/patternfly": {
-            "version": "4.70.2",
-            "resolved": "https://registry.npmjs.org/@patternfly/patternfly/-/patternfly-4.70.2.tgz",
-            "integrity": "sha512-XKCHnOjx1JThY3s98AJhsApSsGHPvEdlY7r+b18OecqUnmThVGw3nslzYYrwfCGlJ/xQtV5so29SduH2/uhHzA=="
+            "version": "4.80.3",
+            "resolved": "https://registry.npmjs.org/@patternfly/patternfly/-/patternfly-4.80.3.tgz",
+            "integrity": "sha512-YLUk4L6iCBXql92YP6zHg0FdlnEkd5/3V+uz/A3UoBuuDdEoyDpx4M/Tf56R7IXmYiRaHE1mToJHPDYypIlnmw=="
        },
        "@rollup/plugin-typescript": {
            "version": "8.1.0",
@ -142,13 +142,13 @@
            }
        },
        "@sentry/browser": {
-            "version": "5.30.0",
-            "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-5.30.0.tgz",
-            "integrity": "sha512-rOb58ZNVJWh1VuMuBG1mL9r54nZqKeaIlwSlvzJfc89vyfd7n6tQ1UXMN383QBz/MS5H5z44Hy5eE+7pCrYAfw==",
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-6.0.2.tgz",
+            "integrity": "sha512-Vkww+P7qYhhYp4+elYQ2UjbDNFzOLC0tWaegjA6ohXHewiCWio5byySLxPAwj2gfLIXwIuf5Ud21njZHg7FSIQ==",
            "requires": {
-                "@sentry/core": "5.30.0",
-                "@sentry/types": "5.30.0",
-                "@sentry/utils": "5.30.0",
+                "@sentry/core": "6.0.2",
+                "@sentry/types": "6.0.2",
+                "@sentry/utils": "6.0.2",
                "tslib": "^1.9.3"
            },
            "dependencies": {
@ -160,14 +160,14 @@
            }
        },
        "@sentry/core": {
-            "version": "5.30.0",
-            "resolved": "https://registry.npmjs.org/@sentry/core/-/core-5.30.0.tgz",
-            "integrity": "sha512-TmfrII8w1PQZSZgPpUESqjB+jC6MvZJZdLtE/0hZ+SrnKhW3x5WlYLvTXZpcWePYBku7rl2wn1RZu6uT0qCTeg==",
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/@sentry/core/-/core-6.0.2.tgz",
+            "integrity": "sha512-7v9tiHRYxDT1WxVNQJc+K4s9T2m++0I+ERrTx4fx5vRzTZrtS9nDjpbiLGonGZaV6Lv2houZUp4uLVNU3vtOQw==",
            "requires": {
-                "@sentry/hub": "5.30.0",
-                "@sentry/minimal": "5.30.0",
-                "@sentry/types": "5.30.0",
-                "@sentry/utils": "5.30.0",
+                "@sentry/hub": "6.0.2",
+                "@sentry/minimal": "6.0.2",
+                "@sentry/types": "6.0.2",
+                "@sentry/utils": "6.0.2",
                "tslib": "^1.9.3"
            },
            "dependencies": {
@ -179,12 +179,12 @@
            }
        },
        "@sentry/hub": {
-            "version": "5.30.0",
-            "resolved": "https://registry.npmjs.org/@sentry/hub/-/hub-5.30.0.tgz",
-            "integrity": "sha512-2tYrGnzb1gKz2EkMDQcfLrDTvmGcQPuWxLnJKXJvYTQDGLlEvi2tWz1VIHjunmOvJrB5aIQLhm+dcMRwFZDCqQ==",
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/@sentry/hub/-/hub-6.0.2.tgz",
+            "integrity": "sha512-/rByl+ak5Ni6xTSfzIcJqKaaErJbDw0kXgNlHGPRQ4bM5hjDDuKbdykMk4J6BfPWt2dfwe13P25bIjz9M3a7kw==",
            "requires": {
-                "@sentry/types": "5.30.0",
-                "@sentry/utils": "5.30.0",
+                "@sentry/types": "6.0.2",
+                "@sentry/utils": "6.0.2",
                "tslib": "^1.9.3"
            },
            "dependencies": {
@ -196,12 +196,12 @@
            }
        },
        "@sentry/minimal": {
-            "version": "5.30.0",
-            "resolved": "https://registry.npmjs.org/@sentry/minimal/-/minimal-5.30.0.tgz",
-            "integrity": "sha512-BwWb/owZKtkDX+Sc4zCSTNcvZUq7YcH3uAVlmh/gtR9rmUvbzAA3ewLuB3myi4wWRAMEtny6+J/FN/x+2wn9Xw==",
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/@sentry/minimal/-/minimal-6.0.2.tgz",
+            "integrity": "sha512-wrSTTIvDsRCXbNcfha/fjkP7Mj1xzNHzGeBRMRlNg3T+nYZSrs5SihVTXT/gcABhO5PpWu8EXbMpv0bAahaEGw==",
            "requires": {
-                "@sentry/hub": "5.30.0",
-                "@sentry/types": "5.30.0",
+                "@sentry/hub": "6.0.2",
+                "@sentry/types": "6.0.2",
                "tslib": "^1.9.3"
            },
            "dependencies": {
@ -213,17 +213,51 @@
            }
        },
        "@sentry/tracing": {
-            "version": "5.30.0",
-            "resolved": "https://registry.npmjs.org/@sentry/tracing/-/tracing-5.30.0.tgz",
-            "integrity": "sha512-dUFowCr0AIMwiLD7Fs314Mdzcug+gBVo/+NCMyDw8tFxJkwWAKl7Qa2OZxLQ0ZHjakcj1hNKfCQJ9rhyfOl4Aw==",
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/@sentry/tracing/-/tracing-6.0.2.tgz",
+            "integrity": "sha512-e8u1pRcpJIoQY8mO9J1Yk0RPi/eEejQqagP888PHbmx2E9Tk7eiTW7TfHha2ECagOfMiCmKbcUUULmVeF1C58Q==",
            "requires": {
-                "@sentry/hub": "5.30.0",
-                "@sentry/minimal": "5.30.0",
-                "@sentry/types": "5.30.0",
-                "@sentry/utils": "5.30.0",
+                "@sentry/hub": "6.0.2",
+                "@sentry/minimal": "6.0.2",
+                "@sentry/types": "6.0.2",
+                "@sentry/utils": "6.0.2",
                "tslib": "^1.9.3"
            },
            "dependencies": {
+                "@sentry/hub": {
+                    "version": "6.0.2",
+                    "resolved": "https://registry.npmjs.org/@sentry/hub/-/hub-6.0.2.tgz",
+                    "integrity": "sha512-/rByl+ak5Ni6xTSfzIcJqKaaErJbDw0kXgNlHGPRQ4bM5hjDDuKbdykMk4J6BfPWt2dfwe13P25bIjz9M3a7kw==",
+                    "requires": {
+                        "@sentry/types": "6.0.2",
+                        "@sentry/utils": "6.0.2",
+                        "tslib": "^1.9.3"
+                    }
+                },
+                "@sentry/minimal": {
+                    "version": "6.0.2",
+                    "resolved": "https://registry.npmjs.org/@sentry/minimal/-/minimal-6.0.2.tgz",
+                    "integrity": "sha512-wrSTTIvDsRCXbNcfha/fjkP7Mj1xzNHzGeBRMRlNg3T+nYZSrs5SihVTXT/gcABhO5PpWu8EXbMpv0bAahaEGw==",
+                    "requires": {
+                        "@sentry/hub": "6.0.2",
+                        "@sentry/types": "6.0.2",
+                        "tslib": "^1.9.3"
+                    }
+                },
+                "@sentry/types": {
+                    "version": "6.0.2",
+                    "resolved": "https://registry.npmjs.org/@sentry/types/-/types-6.0.2.tgz",
+                    "integrity": "sha512-aDUJuOe0MsqjDzx6dUTS6xXe+gNjYuZTHUuUB7EpihzoHGre7gUN3/WCCghiR4OJ703fxyl24cex6vDboZJLvg=="
+                },
+                "@sentry/utils": {
+                    "version": "6.0.2",
+                    "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-6.0.2.tgz",
+                    "integrity": "sha512-X2hAFMkfht4GzdtqrjuVJfK07af5r6h2BfYJGSS/XYa8KBVlDGAtvffP9uYuNWUoLxr+Vrc+ePrPoi4xCREcDQ==",
+                    "requires": {
+                        "@sentry/types": "6.0.2",
+                        "tslib": "^1.9.3"
+                    }
+                },
                "tslib": {
                    "version": "1.14.1",
                    "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
@ -232,16 +266,16 @@
            }
        },
        "@sentry/types": {
-            "version": "5.30.0",
-            "resolved": "https://registry.npmjs.org/@sentry/types/-/types-5.30.0.tgz",
-            "integrity": "sha512-R8xOqlSTZ+htqrfteCWU5Nk0CDN5ApUTvrlvBuiH1DyP6czDZ4ktbZB0hAgBlVcK0U+qpD3ag3Tqqpa5Q67rPw=="
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/@sentry/types/-/types-6.0.2.tgz",
+            "integrity": "sha512-aDUJuOe0MsqjDzx6dUTS6xXe+gNjYuZTHUuUB7EpihzoHGre7gUN3/WCCghiR4OJ703fxyl24cex6vDboZJLvg=="
        },
        "@sentry/utils": {
-            "version": "5.30.0",
-            "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-5.30.0.tgz",
-            "integrity": "sha512-zaYmoH0NWWtvnJjC9/CBseXMtKHm/tm40sz3YfJRxeQjyzRqNQPgivpd9R/oDJCYj999mzdW382p/qi2ypjLww==",
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-6.0.2.tgz",
+            "integrity": "sha512-X2hAFMkfht4GzdtqrjuVJfK07af5r6h2BfYJGSS/XYa8KBVlDGAtvffP9uYuNWUoLxr+Vrc+ePrPoi4xCREcDQ==",
            "requires": {
-                "@sentry/types": "5.30.0",
+                "@sentry/types": "6.0.2",
                "tslib": "^1.9.3"
            },
            "dependencies": {
@ -253,9 +287,9 @@
            }
        },
        "@types/chart.js": {
-            "version": "2.9.29",
-            "resolved": "https://registry.npmjs.org/@types/chart.js/-/chart.js-2.9.29.tgz",
-            "integrity": "sha512-WOZMitUU3gHDM0oQsCsVivX+oDsIki93szcTmmUPBm39cCvAELBjokjSDVOoA3xiIEbb+jp17z/3S2tIqruwOQ==",
+            "version": "2.9.30",
+            "resolved": "https://registry.npmjs.org/@types/chart.js/-/chart.js-2.9.30.tgz",
+            "integrity": "sha512-EgjxUUZFvf6ls3kW2CwyrnSJhgyKxgwrlp/W5G9wqyPEO9iFatO63zAA7L24YqgMxiDjQ+tG7ODU+2yWH91lPg==",
            "requires": {
                "moment": "^2.10.2"
            }
@ -270,9 +304,9 @@
            }
        },
        "@types/codemirror": {
-            "version": "0.0.106",
-            "resolved": "https://registry.npmjs.org/@types/codemirror/-/codemirror-0.0.106.tgz",
-            "integrity": "sha512-o2bJWaI56+J1IuzUyb1KKNLs0Tm1sqdosGeSneicQZpg9s59++8Nz70KOD6IACiZWI6b+H0H+UE+JRkgTUO3Ww==",
+            "version": "0.0.107",
+            "resolved": "https://registry.npmjs.org/@types/codemirror/-/codemirror-0.0.107.tgz",
+            "integrity": "sha512-F3Uh8xBmZWeMckWPVrcG5TBQIr/rZM7dQfx8D0pHCb372MIWFBwc5mjLBpYPcxGpmgNM/p6bl619XwyzBUQTrQ==",
            "requires": {
                "@types/tern": "*"
            }
@ -311,9 +345,9 @@
            }
        },
        "@types/json-schema": {
-            "version": "7.0.6",
-            "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.6.tgz",
-            "integrity": "sha512-3c+yGKvVP5Y9TYBEibGNR+kLtijnj7mYrXRg+WpFb2X9xm04g/DXYkfg4hmzJQosc9snFNUPkbYIhu+KAm6jJw==",
+            "version": "7.0.7",
+            "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.7.tgz",
+            "integrity": "sha512-cxWFQVseBm6O9Gbw1IWb8r6OS4OhSt3hPZLkFApLjM8TEXROBuQGLAH2i2gZpcXdLBIrpXuTDhH7Vbm1iXmNGA==",
            "dev": true
        },
        "@types/minimatch": {
@ -359,13 +393,13 @@
            }
        },
        "@typescript-eslint/eslint-plugin": {
-            "version": "4.13.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.13.0.tgz",
-            "integrity": "sha512-ygqDUm+BUPvrr0jrXqoteMqmIaZ/bixYOc3A4BRwzEPTZPi6E+n44rzNZWaB0YvtukgP+aoj0i/fyx7FkM2p1w==",
+            "version": "4.14.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.14.1.tgz",
+            "integrity": "sha512-5JriGbYhtqMS1kRcZTQxndz1lKMwwEXKbwZbkUZNnp6MJX0+OVXnG0kOlBZP4LUAxEyzu3cs+EXd/97MJXsGfw==",
            "dev": true,
            "requires": {
-                "@typescript-eslint/experimental-utils": "4.13.0",
-                "@typescript-eslint/scope-manager": "4.13.0",
+                "@typescript-eslint/experimental-utils": "4.14.1",
+                "@typescript-eslint/scope-manager": "4.14.1",
                "debug": "^4.1.1",
                "functional-red-black-tree": "^1.0.1",
                "lodash": "^4.17.15",
@ -375,71 +409,71 @@
            },
            "dependencies": {
                "@typescript-eslint/scope-manager": {
-                    "version": "4.13.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.13.0.tgz",
-                    "integrity": "sha512-UpK7YLG2JlTp/9G4CHe7GxOwd93RBf3aHO5L+pfjIrhtBvZjHKbMhBXTIQNkbz7HZ9XOe++yKrXutYm5KmjWgQ==",
+                    "version": "4.14.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.14.1.tgz",
+                    "integrity": "sha512-F4bjJcSqXqHnC9JGUlnqSa3fC2YH5zTtmACS1Hk+WX/nFB0guuynVK5ev35D4XZbdKjulXBAQMyRr216kmxghw==",
                    "dev": true,
                    "requires": {
-                        "@typescript-eslint/types": "4.13.0",
-                        "@typescript-eslint/visitor-keys": "4.13.0"
+                        "@typescript-eslint/types": "4.14.1",
+                        "@typescript-eslint/visitor-keys": "4.14.1"
                    }
                },
                "@typescript-eslint/types": {
-                    "version": "4.13.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.13.0.tgz",
-                    "integrity": "sha512-/+aPaq163oX+ObOG00M0t9tKkOgdv9lq0IQv/y4SqGkAXmhFmCfgsELV7kOCTb2vVU5VOmVwXBXJTDr353C1rQ==",
+                    "version": "4.14.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.14.1.tgz",
+                    "integrity": "sha512-SkhzHdI/AllAgQSxXM89XwS1Tkic7csPdndUuTKabEwRcEfR8uQ/iPA3Dgio1rqsV3jtqZhY0QQni8rLswJM2w==",
                    "dev": true
                },
                "@typescript-eslint/visitor-keys": {
-                    "version": "4.13.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.13.0.tgz",
-                    "integrity": "sha512-6RoxWK05PAibukE7jElqAtNMq+RWZyqJ6Q/GdIxaiUj2Ept8jh8+FUVlbq9WxMYxkmEOPvCE5cRSyupMpwW31g==",
+                    "version": "4.14.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.14.1.tgz",
+                    "integrity": "sha512-TAblbDXOI7bd0C/9PE1G+AFo7R5uc+ty1ArDoxmrC1ah61Hn6shURKy7gLdRb1qKJmjHkqu5Oq+e4Kt0jwf1IA==",
                    "dev": true,
                    "requires": {
-                        "@typescript-eslint/types": "4.13.0",
+                        "@typescript-eslint/types": "4.14.1",
                        "eslint-visitor-keys": "^2.0.0"
                    }
                }
            }
        },
        "@typescript-eslint/experimental-utils": {
-            "version": "4.13.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.13.0.tgz",
-            "integrity": "sha512-/ZsuWmqagOzNkx30VWYV3MNB/Re/CGv/7EzlqZo5RegBN8tMuPaBgNK6vPBCQA8tcYrbsrTdbx3ixMRRKEEGVw==",
+            "version": "4.14.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-4.14.1.tgz",
+            "integrity": "sha512-2CuHWOJwvpw0LofbyG5gvYjEyoJeSvVH2PnfUQSn0KQr4v8Dql2pr43ohmx4fdPQ/eVoTSFjTi/bsGEXl/zUUQ==",
            "dev": true,
            "requires": {
                "@types/json-schema": "^7.0.3",
-                "@typescript-eslint/scope-manager": "4.13.0",
-                "@typescript-eslint/types": "4.13.0",
-                "@typescript-eslint/typescript-estree": "4.13.0",
+                "@typescript-eslint/scope-manager": "4.14.1",
+                "@typescript-eslint/types": "4.14.1",
+                "@typescript-eslint/typescript-estree": "4.14.1",
                "eslint-scope": "^5.0.0",
                "eslint-utils": "^2.0.0"
            },
            "dependencies": {
                "@typescript-eslint/scope-manager": {
-                    "version": "4.13.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.13.0.tgz",
-                    "integrity": "sha512-UpK7YLG2JlTp/9G4CHe7GxOwd93RBf3aHO5L+pfjIrhtBvZjHKbMhBXTIQNkbz7HZ9XOe++yKrXutYm5KmjWgQ==",
+                    "version": "4.14.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.14.1.tgz",
+                    "integrity": "sha512-F4bjJcSqXqHnC9JGUlnqSa3fC2YH5zTtmACS1Hk+WX/nFB0guuynVK5ev35D4XZbdKjulXBAQMyRr216kmxghw==",
                    "dev": true,
                    "requires": {
-                        "@typescript-eslint/types": "4.13.0",
-                        "@typescript-eslint/visitor-keys": "4.13.0"
+                        "@typescript-eslint/types": "4.14.1",
+                        "@typescript-eslint/visitor-keys": "4.14.1"
                    }
                },
                "@typescript-eslint/types": {
-                    "version": "4.13.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.13.0.tgz",
-                    "integrity": "sha512-/+aPaq163oX+ObOG00M0t9tKkOgdv9lq0IQv/y4SqGkAXmhFmCfgsELV7kOCTb2vVU5VOmVwXBXJTDr353C1rQ==",
+                    "version": "4.14.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.14.1.tgz",
+                    "integrity": "sha512-SkhzHdI/AllAgQSxXM89XwS1Tkic7csPdndUuTKabEwRcEfR8uQ/iPA3Dgio1rqsV3jtqZhY0QQni8rLswJM2w==",
                    "dev": true
                },
                "@typescript-eslint/typescript-estree": {
-                    "version": "4.13.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.13.0.tgz",
-                    "integrity": "sha512-9A0/DFZZLlGXn5XA349dWQFwPZxcyYyCFX5X88nWs2uachRDwGeyPz46oTsm9ZJE66EALvEns1lvBwa4d9QxMg==",
+                    "version": "4.14.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.14.1.tgz",
+                    "integrity": "sha512-M8+7MbzKC1PvJIA8kR2sSBnex8bsR5auatLCnVlNTJczmJgqRn8M+sAlQfkEq7M4IY3WmaNJ+LJjPVRrREVSHQ==",
                    "dev": true,
                    "requires": {
-                        "@typescript-eslint/types": "4.13.0",
-                        "@typescript-eslint/visitor-keys": "4.13.0",
+                        "@typescript-eslint/types": "4.14.1",
+                        "@typescript-eslint/visitor-keys": "4.14.1",
                        "debug": "^4.1.1",
                        "globby": "^11.0.1",
                        "is-glob": "^4.0.1",
@ -449,12 +483,12 @@
                    }
                },
                "@typescript-eslint/visitor-keys": {
-                    "version": "4.13.0",
-                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.13.0.tgz",
-                    "integrity": "sha512-6RoxWK05PAibukE7jElqAtNMq+RWZyqJ6Q/GdIxaiUj2Ept8jh8+FUVlbq9WxMYxkmEOPvCE5cRSyupMpwW31g==",
+                    "version": "4.14.1",
+                    "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.14.1.tgz",
+                    "integrity": "sha512-TAblbDXOI7bd0C/9PE1G+AFo7R5uc+ty1ArDoxmrC1ah61Hn6shURKy7gLdRb1qKJmjHkqu5Oq+e4Kt0jwf1IA==",
                    "dev": true,
                    "requires": {
-                        "@typescript-eslint/types": "4.13.0",
+                        "@typescript-eslint/types": "4.14.1",
                        "eslint-visitor-keys": "^2.0.0"
                    }
                },
@ -475,41 +509,41 @@
            }
        },
        "@typescript-eslint/parser": {
-            "version": "4.13.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.13.0.tgz",
-            "integrity": "sha512-KO0J5SRF08pMXzq9+abyHnaGQgUJZ3Z3ax+pmqz9vl81JxmTTOUfQmq7/4awVfq09b6C4owNlOgOwp61pYRBSg==",
+            "version": "4.14.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-4.14.1.tgz",
+            "integrity": "sha512-mL3+gU18g9JPsHZuKMZ8Z0Ss9YP1S5xYZ7n68Z98GnPq02pYNQuRXL85b9GYhl6jpdvUc45Km7hAl71vybjUmw==",
            "dev": true,
            "requires": {
-                "@typescript-eslint/scope-manager": "4.13.0",
-                "@typescript-eslint/types": "4.13.0",
-                "@typescript-eslint/typescript-estree": "4.13.0",
+                "@typescript-eslint/scope-manager": "4.14.1",
+                "@typescript-eslint/types": "4.14.1",
+                "@typescript-eslint/typescript-estree": "4.14.1",
                "debug": "^4.1.1"
            }
        },
        "@typescript-eslint/scope-manager": {
-            "version": "4.13.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.13.0.tgz",
-            "integrity": "sha512-UpK7YLG2JlTp/9G4CHe7GxOwd93RBf3aHO5L+pfjIrhtBvZjHKbMhBXTIQNkbz7HZ9XOe++yKrXutYm5KmjWgQ==",
+            "version": "4.14.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-4.14.1.tgz",
+            "integrity": "sha512-F4bjJcSqXqHnC9JGUlnqSa3fC2YH5zTtmACS1Hk+WX/nFB0guuynVK5ev35D4XZbdKjulXBAQMyRr216kmxghw==",
            "dev": true,
            "requires": {
-                "@typescript-eslint/types": "4.13.0",
-                "@typescript-eslint/visitor-keys": "4.13.0"
+                "@typescript-eslint/types": "4.14.1",
+                "@typescript-eslint/visitor-keys": "4.14.1"
            }
        },
        "@typescript-eslint/types": {
-            "version": "4.13.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.13.0.tgz",
-            "integrity": "sha512-/+aPaq163oX+ObOG00M0t9tKkOgdv9lq0IQv/y4SqGkAXmhFmCfgsELV7kOCTb2vVU5VOmVwXBXJTDr353C1rQ==",
+            "version": "4.14.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-4.14.1.tgz",
+            "integrity": "sha512-SkhzHdI/AllAgQSxXM89XwS1Tkic7csPdndUuTKabEwRcEfR8uQ/iPA3Dgio1rqsV3jtqZhY0QQni8rLswJM2w==",
            "dev": true
        },
        "@typescript-eslint/typescript-estree": {
-            "version": "4.13.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.13.0.tgz",
-            "integrity": "sha512-9A0/DFZZLlGXn5XA349dWQFwPZxcyYyCFX5X88nWs2uachRDwGeyPz46oTsm9ZJE66EALvEns1lvBwa4d9QxMg==",
+            "version": "4.14.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-4.14.1.tgz",
+            "integrity": "sha512-M8+7MbzKC1PvJIA8kR2sSBnex8bsR5auatLCnVlNTJczmJgqRn8M+sAlQfkEq7M4IY3WmaNJ+LJjPVRrREVSHQ==",
            "dev": true,
            "requires": {
-                "@typescript-eslint/types": "4.13.0",
-                "@typescript-eslint/visitor-keys": "4.13.0",
+                "@typescript-eslint/types": "4.14.1",
+                "@typescript-eslint/visitor-keys": "4.14.1",
                "debug": "^4.1.1",
                "globby": "^11.0.1",
                "is-glob": "^4.0.1",
@ -535,12 +569,12 @@
            }
        },
        "@typescript-eslint/visitor-keys": {
-            "version": "4.13.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.13.0.tgz",
-            "integrity": "sha512-6RoxWK05PAibukE7jElqAtNMq+RWZyqJ6Q/GdIxaiUj2Ept8jh8+FUVlbq9WxMYxkmEOPvCE5cRSyupMpwW31g==",
+            "version": "4.14.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-4.14.1.tgz",
+            "integrity": "sha512-TAblbDXOI7bd0C/9PE1G+AFo7R5uc+ty1ArDoxmrC1ah61Hn6shURKy7gLdRb1qKJmjHkqu5Oq+e4Kt0jwf1IA==",
            "dev": true,
            "requires": {
-                "@typescript-eslint/types": "4.13.0",
+                "@typescript-eslint/types": "4.14.1",
                "eslint-visitor-keys": "^2.0.0"
            }
        },
@ -885,9 +919,9 @@
            }
        },
        "codemirror": {
-            "version": "5.59.1",
-            "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-5.59.1.tgz",
-            "integrity": "sha512-d0SSW/PCCD4LoSCBPdnP0BzmZB1v3emomCUtVlIWgZHJ06yVeBOvBtOH7vYz707pfAvEeWbO9aP6akh8vl1V3w=="
+            "version": "5.59.2",
+            "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-5.59.2.tgz",
+            "integrity": "sha512-/D5PcsKyzthtSy2NNKCyJi3b+htRkoKv3idswR/tR6UAvMNKA7SrmyZy6fOONJxSRs1JlUWEDAbxqfdArbK8iA=="
        },
        "collection-visit": {
            "version": "1.0.0",
@ -1074,13 +1108,13 @@
            "dev": true
        },
        "eslint": {
-            "version": "7.17.0",
-            "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.17.0.tgz",
-            "integrity": "sha512-zJk08MiBgwuGoxes5sSQhOtibZ75pz0J35XTRlZOk9xMffhpA9BTbQZxoXZzOl5zMbleShbGwtw+1kGferfFwQ==",
+            "version": "7.18.0",
+            "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.18.0.tgz",
+            "integrity": "sha512-fbgTiE8BfUJZuBeq2Yi7J3RB3WGUQ9PNuNbmgi6jt9Iv8qrkxfy19Ds3OpL1Pm7zg3BtTVhvcUZbIRQ0wmSjAQ==",
            "dev": true,
            "requires": {
                "@babel/code-frame": "^7.0.0",
-                "@eslint/eslintrc": "^0.2.2",
+                "@eslint/eslintrc": "^0.3.0",
                "ajv": "^6.10.0",
                "chalk": "^4.0.0",
                "cross-spawn": "^7.0.2",
@ -1104,7 +1138,7 @@
                "js-yaml": "^3.13.1",
                "json-stable-stringify-without-jsonify": "^1.0.1",
                "levn": "^0.4.1",
-                "lodash": "^4.17.19",
+                "lodash": "^4.17.20",
                "minimatch": "^3.0.4",
                "natural-compare": "^1.4.0",
                "optionator": "^0.9.1",
@ -2674,9 +2708,9 @@
            }
        },
        "rollup": {
-            "version": "2.36.1",
-            "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.36.1.tgz",
-            "integrity": "sha512-eAfqho8dyzuVvrGqpR0ITgEdq0zG2QJeWYh+HeuTbpcaXk8vNFc48B7bJa1xYosTCKx0CuW+447oQOW8HgBIZQ==",
+            "version": "2.38.1",
+            "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.38.1.tgz",
+            "integrity": "sha512-q07T6vU/V1kqM8rGRRyCgEvIQcIAXoKIE5CpkYAlHhfiWM1Iuh4dIPWpIbqFngCK6lwAB2aYHiUVhIbSWHQWhw==",
            "requires": {
                "fsevents": "~2.1.2"
            }
@ -3191,9 +3225,9 @@
            }
        },
        "table": {
-            "version": "6.0.6",
-            "resolved": "https://registry.npmjs.org/table/-/table-6.0.6.tgz",
-            "integrity": "sha512-OInCtPmDNieVBkVFi6C8RwU2S2H0h8mF3e3TQK4nreaUNCpooQUkI+A/KuEkm5FawfhWIfNqG+qfelVVR+V00g==",
+            "version": "6.0.7",
+            "resolved": "https://registry.npmjs.org/table/-/table-6.0.7.tgz",
+            "integrity": "sha512-rxZevLGTUzWna/qBLObOe16kB2RTnnbhciwgPbMMlazz1yZGVEgnZK762xyVdVznhqxrfCeBMmMkgOOaPwjH7g==",
            "dev": true,
            "requires": {
                "ajv": "^7.0.2",
@ -3415,9 +3449,9 @@
            "dev": true
        },
        "uri-js": {
-            "version": "4.4.0",
-            "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.0.tgz",
-            "integrity": "sha512-B0yRTzYdUCCn9n+F4+Gh4yIDtMQcaJsmYBDsTSG8g/OejKBodLQ2IHfN3bM7jUsRXndopT7OIXWdYqc1fjmV6g==",
+            "version": "4.4.1",
+            "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+            "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
            "dev": true,
            "requires": {
                "punycode": "^2.1.0"
--- a/web/package.json
+++ b/web/package.json
@ -8,18 +8,18 @@
    },
    "dependencies": {
        "@fortawesome/fontawesome-free": "^5.15.2",
-        "@patternfly/patternfly": "^4.70.2",
-        "@sentry/browser": "^5.30.0",
-        "@sentry/tracing": "^5.30.0",
-        "@types/chart.js": "^2.9.29",
-        "@types/codemirror": "0.0.106",
+        "@patternfly/patternfly": "^4.80.3",
+        "@sentry/browser": "^6.0.2",
+        "@sentry/tracing": "^6.0.2",
+        "@types/chart.js": "^2.9.30",
+        "@types/codemirror": "0.0.107",
        "chart.js": "^2.9.4",
-        "codemirror": "^5.59.1",
+        "codemirror": "^5.59.2",
        "construct-style-sheets-polyfill": "^2.4.6",
        "flowchart.js": "^1.15.0",
        "lit-element": "^2.4.0",
        "lit-html": "^1.3.0",
-        "rollup": "^2.36.1",
+        "rollup": "^2.38.1",
        "rollup-plugin-copy": "^3.3.0",
        "rollup-plugin-cssimport": "^1.0.2",
        "rollup-plugin-external-globals": "^0.6.1",
@ -27,9 +27,9 @@
    },
    "devDependencies": {
        "@rollup/plugin-typescript": "^8.1.0",
-        "@typescript-eslint/eslint-plugin": "^4.13.0",
-        "@typescript-eslint/parser": "^4.13.0",
-        "eslint": "^7.17.0",
+        "@typescript-eslint/eslint-plugin": "^4.14.1",
+        "@typescript-eslint/parser": "^4.14.1",
+        "eslint": "^7.18.0",
        "eslint-config-google": "^0.14.0",
        "eslint-plugin-lit": "^1.3.0",
        "rollup-plugin-commonjs": "^10.1.0",
--- a/web/src/authentik.css
+++ b/web/src/authentik.css
@ -81,10 +81,14 @@ select[multiple] {
    font-size: var(--pf-global--FontSize--sm);
 }

-.pf-c-page__main {
+.pf-c-page__main, .pf-c-drawer__content, .pf-c-page__drawer {
    z-index: auto !important;
 }

+.pf-c-page__main {
+    display: block;
+}
+
@media (prefers-color-scheme: dark) {
    :root {
        --ak-dark-foreground: #fafafa;
--- a/web/src/constants.ts
+++ b/web/src/constants.ts
@ -28,4 +28,4 @@ export const ColorStyles = css`
        background-color: var(--pf-global--danger-color--100);
    }
 `;
-export const VERSION = "2021.1.1-rc2";
+export const VERSION = "2021.1.4-stable";
--- a/website/docs/installation/docker-compose.md
+++ b/website/docs/installation/docker-compose.md
@ -15,7 +15,7 @@ Download the latest `docker-compose.yml` from [here](https://raw.githubuserconte

 To optionally enable error-reporting, run `echo AUTHENTIK_ERROR_REPORTING__ENABLED=true >> .env`

-To optionally deploy a different version run `echo AUTHENTIK_TAG=2021.1.1-rc2 >> .env`
+To optionally deploy a different version run `echo AUTHENTIK_TAG=2021.1.4-stable >> .env`

 If this is a fresh authentik install run the following commands to generate a password:

--- a/website/docs/installation/kubernetes.md
+++ b/website/docs/installation/kubernetes.md
@ -24,7 +24,7 @@ image:
    name: beryju/authentik
    name_static: beryju/authentik-static
    name_outposts: beryju/authentik # Prefix used for Outpost deployments, Outpost type and version is appended
-    tag: 2021.1.1-rc2
+    tag: 2021.1.4-stable

 serverReplicas: 1
 workerReplicas: 1
--- a/website/docs/integrations/services/nextcloud/index.md
+++ b/website/docs/integrations/services/nextcloud/index.md
@ -27,10 +27,11 @@ The following placeholders will be used:

 Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:

-   ACS URL: `https://nextcloud.company/apps/user_saml/saml/metadata`
-   Audience: `https://nextcloud.company/apps/user_saml/saml/acs`
+-   ACS URL: `https://nextcloud.company/apps/user_saml/saml/acs`
 -   Issuer: `https://authentik.company`
 -   Service Provider Binding: `Post`
+-   Audience: `https://nextcloud.company/apps/user_saml/saml/metadata`
+-   Signing Keypair: Select any certificate you have.
 -   Property mappings: Select all Autogenerated mappings.

 You can of course use a custom signing certificate, and adjust durations.
@ -41,14 +42,15 @@ In NextCloud, navigate to `Settings`, then `SSO & SAML Authentication`.

 Set the following values:

- Attribute to map the UID to.: `urn:oid:0.9.2342.19200300.100.1.1`
+- Attribute to map the UID to.: `urn:oid:2.16.840.1.113730.3.1.241`
 - Optional display name of the identity provider (default: "SSO & SAML log in"): `authentik`
 - Identifier of the IdP entity (must be a URI): `https://authentik.company`
 - URL Target of the IdP where the SP will send the Authentication Request Message: `https://authentik.company/application/saml/<application-slug>/sso/binding/redirect/`
+- Public X.509 certificate of the IdP: Copy the PEM of the Selected Signing Certificate

 Under Attribute mapping, set these values:

- Attribute to map the displayname to.: `urn:oid:2.16.840.1.113730.3.1.241`
+- Attribute to map the displayname to.: `urn:oid:2.5.4.3`
 - Attribute to map the email address to.: `urn:oid:0.9.2342.19200300.100.1.3`
 - Attribute to map the users groups to.: `member-of`

--- a/website/docs/integrations/services/veeam-enterprise-manager/index.md
+++ b/website/docs/integrations/services/veeam-enterprise-manager/index.md
@ -0,0 +1,44 @@
+---
+title: Veeam Enterprise Manager
+---
+
+## What is Veeam Enterprise Manager
+
+From https://helpcenter.veeam.com/docs/backup/em/introduction.html?ver=100
+
+:::note
+Veeam Backup Enterprise Manager (Enterprise Manager) is a management and reporting component that allows you to manage multiple Veeam Backup & Replication installations from a single web console. Veeam Backup Enterprise Manager helps you optimize performance in remote office/branch office (ROBO) and large-scale deployments and maintain a view of your entire virtual environment.
+:::
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `veeam.company` is the FQDN of the Veeam Enterprise Manager install.
+-   `authentik.company` is the FQDN of the authentik install.
+
+You will need an existing group or multiple in authentik to assign roles in Veeam Enterprise Manager to.
+
+## In Veeam Enterprise Manager
+
+Login to your Veeam Enterprise Manager. Navigate to the Configuration in the top-right. On the left sidebar, select Settings. Select the SAML Authentication tab.
+
+Check the checkbox called "Enable SAML 2.0". Further down the site, click the "Download" button, to download the metadata.
+
+## In authentik
+
+Navigate to Providers in the sidebar. Click on the create dropdown, and select "SAML Provider from Metadata".
+
+Give the provider a new, and selection an authorization flow. Select the XML file you just downloaded and confirm.
+
+Now that you've created the provider, create an Application. Select the provider that has just been created. Set the launch URL to "https://veeam.company:9443/Saml2/SignIn" and confirm.
+
+Click on the application to assign access policies.
+
+Go back to the Provider sidebar and locate the Veeam Enterprise Manager. Click the Download Metadata button.
+
+## Finish in Veeam Enterprise Manager
+
+Back on Veeam Enterprise Manager, click on "Import from File", and select the XML file that you've downloaded from authentik. Make sure the "Enable SAML 2.0" checkbox is still enabled, and click save.
+
+To map Veeam Enterprise Manager permissions to an authentik user, you have to create an External Group. In Veeam Enterprise Manager, under Configuration, navigate to Roles. Click the "Add..." button and select "External Group". Type in the name of a group you're member of.
--- a/website/docs/providers/saml.md
+++ b/website/docs/providers/saml.md
@ -11,3 +11,13 @@ Default fields are exposed through auto-generated Property Mappings, which are p
 | SSO (POST binding)     | `/application/saml/<application slug>/sso/binding/post/`     |
 | IdP-initiated login    | `/application/saml/<application slug>/sso/binding/init/`     |
 | Metadata Download      | `/application/saml/<application slug>/metadata/`             |
+
+## Name ID
+
+You can select a custom SAML Property Mapping after which the NameID field will be generated. If left default, the following checks are done:
+
+- When the request asks for `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`, the NameID will be set to the user's email address.
+- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`, the NameID will be set to the hashed user ID.
+- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`, the NameID will be set to the user's `distinguishedName` attribute. This attribute is set by the LDAP source by default. If the attribute does not exist, it will fall back the persistent identifier.
+- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName`, the NameID will be set to the user's UPN. This is also set by the LDAP source, and also falls back to the persistent identifier.
+- When the request asks for `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`, the NameID will be set based on the user's session ID.
--- a/website/docs/releases/2021.1.1.md
+++ b/website/docs/releases/2021.1.1.md
@ -33,7 +33,7 @@ This release does not introduce any new requirements.

 ### docker-compose

-Download the latest docker-compose file from [here](https://raw.githubusercontent.com/BeryJu/authentik/version-2021.1.1/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.
+Download the latest docker-compose file from [here](https://raw.githubusercontent.com/BeryJu/authentik/version-2021.1/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.

 ### Kubernetes

--- a/website/sidebars.js
+++ b/website/sidebars.js
@ -119,6 +119,7 @@ module.exports = {
                        "integrations/services/sonarr/index",
                        "integrations/services/tautulli/index",
                        "integrations/services/ubuntu-landscape/index",
+                        "integrations/services/veeam-enterprise-manager/index",
                        "integrations/services/vmware-vcenter/index",
                    ],
                },
@ -139,7 +140,7 @@ module.exports = {
                "releases/0.12",
                "releases/0.13",
                "releases/0.14",
-                "releases/2021.1.1",
+                "releases/2021.1",
            ],
        },
        {