release: 2021.3.3

# Conflicts:
#	web/src/elements/stages/identification/IdentificationStage.ts

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2021.3.2
+current_version = 2021.3.3
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)

.github/workflows/release.yml

@@ -18,11 +18,11 @@ jobs:
       - name: Building Docker Image
         run: docker build
           --no-cache
-          -t beryju/authentik:2021.3.2
+          -t beryju/authentik:2021.3.3
           -t beryju/authentik:latest
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik:2021.3.2
+        run: docker push beryju/authentik:2021.3.3
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik:latest
   build-proxy:
@@ -48,11 +48,11 @@ jobs:
           cd outpost/
           docker build \
           --no-cache \
-          -t beryju/authentik-proxy:2021.3.2 \
+          -t beryju/authentik-proxy:2021.3.3 \
           -t beryju/authentik-proxy:latest \
           -f proxy.Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-proxy:2021.3.2
+        run: docker push beryju/authentik-proxy:2021.3.3
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik-proxy:latest
   build-static:
@@ -69,11 +69,11 @@ jobs:
           cd web/
           docker build \
           --no-cache \
-          -t beryju/authentik-static:2021.3.2 \
+          -t beryju/authentik-static:2021.3.3 \
           -t beryju/authentik-static:latest \
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-static:2021.3.2
+        run: docker push beryju/authentik-static:2021.3.3
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik-static:latest
   test-release:
@@ -107,5 +107,5 @@ jobs:
           SENTRY_PROJECT: authentik
           SENTRY_URL: https://sentry.beryju.org
         with:
-          tagName: 2021.3.2
+          tagName: 2021.3.3
           environment: beryjuorg-prod

authentik/__init__.py

@@ -1,2 +1,2 @@
 """authentik"""
-__version__ = "2021.3.2"
+__version__ = "2021.3.3"

authentik/core/templates/login/base_full.html

@@ -16,17 +16,6 @@
 
 {% block body %}
 <div class="pf-c-background-image">
-    <svg xmlns="http://www.w3.org/2000/svg" class="pf-c-background-image__filter" width="0" height="0">
-        <filter id="image_overlay">
-            <feColorMatrix type="matrix" values="1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0"></feColorMatrix>
-            <feComponentTransfer color-interpolation-filters="sRGB" result="duotone">
-                <feFuncR type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncR>
-                <feFuncG type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncG>
-                <feFuncB type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncB>
-                <feFuncA type="table" tableValues="0 1"></feFuncA>
-            </feComponentTransfer>
-        </filter>
-    </svg>
 </div>
 <ak-message-container></ak-message-container>
 <div class="pf-c-login">
@@ -48,7 +37,7 @@
                     {% endfor %}
                     {% if config.authentik.branding.title != "authentik" %}
                     <li>
-                        <a href="https://github.com/beryju/authentik">
+                        <a href="https://goauthentik.io">
                             {% trans 'Powered by authentik' %}
                         </a>
                     </li>

authentik/core/templates/user/settings.html

@@ -13,7 +13,7 @@
                 <p>{% trans "Configure settings relevant to your user profile." %}</p>
             </div>
         </section>
-        <ak-tabs vertical="true">
+        <ak-tabs vertical="true" style="height: 100%;">
             <section slot="page-1" data-tab-title="{% trans 'User details' %}" class="pf-c-page__main-section pf-m-no-padding-mobile">
                 <div class="pf-u-display-flex pf-u-justify-content-center">
                     <div class="pf-u-w-75">

authentik/providers/oauth2/utils.py

@@ -101,7 +101,9 @@ def protected_resource_view(scopes: list[str]):
     This decorator also injects the token into `kwargs`"""
 
     def wrapper(view):
-        def view_wrapper(request, *args, **kwargs):
+        def view_wrapper(request: HttpRequest, *args, **kwargs):
+            if request.method == "OPTIONS":
+                return view(request, *args, **kwargs)
             try:
                 access_token = extract_access_token(request)
                 if not access_token:

authentik/providers/oauth2/views/provider.py

@@ -19,6 +19,7 @@ from authentik.providers.oauth2.models import (
     ResponseTypes,
     ScopeMapping,
 )
+from authentik.providers.oauth2.utils import cors_allow_any
 
 LOGGER = get_logger()
 
@@ -103,9 +104,10 @@ class ProviderInfoView(View):
         provider: OAuth2Provider = get_object_or_404(
             OAuth2Provider, pk=application.provider_id
         )
-        response = JsonResponse(
-            self.get_info(provider), json_dumps_params={"indent": 2}
-        )
-        response["Access-Control-Allow-Origin"] = "*"
+        return JsonResponse(self.get_info(provider), json_dumps_params={"indent": 2})
 
+    def dispatch(self, request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
+        # Since this view only supports get, we can statically set the CORS headers
+        response = super().dispatch(request, *args, **kwargs)
+        cors_allow_any(request, response)
         return response

authentik/stages/authenticator_static/views.py

@@ -34,7 +34,8 @@ class UserSettingsView(LoginRequiredMixin, TemplateView):
 class DisableView(LoginRequiredMixin, View):
     """Disable Static Tokens for user"""
 
-    def get(self, request: HttpRequest) -> HttpResponse:
+    # pylint: disable=unused-argument
+    def get(self, request: HttpRequest, **kwargs) -> HttpResponse:
         """Delete all the devices for user"""
         devices = StaticDevice.objects.filter(user=request.user, confirmed=True)
         devices.delete()

authentik/stages/authenticator_webauthn/migrations/0004_auto_20210304_1850.py

@@ -0,0 +1,20 @@
+# Generated by Django 3.1.7 on 2021-03-04 18:50
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_stages_authenticator_webauthn", "0003_webauthndevice_confirmed"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="webauthndevice",
+            options={
+                "verbose_name": "WebAuthn Device",
+                "verbose_name_plural": "WebAuthn Devices",
+            },
+        ),
+    ]

docker-compose.yml

@@ -19,7 +19,7 @@ services:
     networks:
       - internal
   server:
-    image: beryju/authentik:${AUTHENTIK_TAG:-2021.3.2}
+    image: beryju/authentik:${AUTHENTIK_TAG:-2021.3.3}
     command: server
     environment:
       AUTHENTIK_REDIS__HOST: redis
@@ -45,7 +45,7 @@ services:
     env_file:
       - .env
   worker:
-    image: beryju/authentik:${AUTHENTIK_TAG:-2021.3.2}
+    image: beryju/authentik:${AUTHENTIK_TAG:-2021.3.3}
     command: worker
     networks:
       - internal
@@ -62,7 +62,7 @@ services:
     env_file:
       - .env
   static:
-    image: beryju/authentik-static:${AUTHENTIK_TAG:-2021.3.2}
+    image: beryju/authentik-static:${AUTHENTIK_TAG:-2021.3.3}
     networks:
       - internal
     labels:

helm/Chart.yaml

@@ -4,7 +4,7 @@ name: authentik
 home: https://goauthentik.io
 sources:
   - https://github.com/BeryJu/authentik
-version: "2021.3.2"
+version: "2021.3.3"
 icon: https://raw.githubusercontent.com/BeryJu/authentik/master/web/icons/icon.svg
 dependencies:
   - name: postgresql

helm/README.md

@@ -4,7 +4,7 @@
 |-----------------------------------|-------------------------|-------------|
 | image.name                        | beryju/authentik        | Image used to run the authentik server and worker |
 | image.name_static                 | beryju/authentik-static | Image used to run the authentik static server (CSS and JS Files) |
-| image.tag                         | 2021.3.2           | Image tag |
+| image.tag                         | 2021.3.3           | Image tag |
 | image.pullPolicy                  | IfNotPresent            | Image Pull Policy used for all deployments |
 | serverReplicas                    | 1                       | Replicas for the Server deployment |
 | workerReplicas                    | 1                       | Replicas for the Worker deployment |

helm/values.yaml

@@ -5,7 +5,7 @@ image:
   name: beryju/authentik
   name_static: beryju/authentik-static
   name_outposts: beryju/authentik # Prefix used for Outpost deployments, Outpost type and version is appended
-  tag: 2021.3.2
+  tag: 2021.3.3
   pullPolicy: IfNotPresent
 
 serverReplicas: 1

outpost/pkg/version.go

@@ -1,3 +1,3 @@
 package pkg
 
-const VERSION = "2021.3.2"
+const VERSION = "2021.3.3"

web/src/authentik.css

@@ -55,6 +55,7 @@ select[multiple] {
     -webkit-columns: 2;
     -moz-columns: 2;
     margin-left: var(--pf-global--spacer--xs);
+    width: 100%;
 }
 .ak-otp-tokens li {
     font-size: var(--pf-global--FontSize--2xl);
@@ -155,6 +156,10 @@ ak-message {
     .pf-c-table__sort-indicator i {
         color: var(--ak-dark-foreground) !important;
     }
+    /* tabs, vertical */
+    .pf-c-tabs__link {
+        background-color: var(--ak-dark-background-light);
+    }
     /* table, on mobile */
     @media screen and (max-width: 1200px) {
         .pf-m-grid-xl.pf-c-table tbody:first-of-type {

web/src/constants.ts

@@ -3,5 +3,5 @@ export const SUCCESS_CLASS = "pf-m-success";
 export const ERROR_CLASS = "pf-m-danger";
 export const PROGRESS_CLASS = "pf-m-in-progress";
 export const CURRENT_CLASS = "pf-m-current";
-export const VERSION = "2021.3.2";
+export const VERSION = "2021.3.3";
 export const PAGE_SIZE = 20;

web/src/elements/Tabs.ts

@@ -4,6 +4,8 @@ import { ifDefined } from "lit-html/directives/if-defined";
 import TabsStyle from "@patternfly/patternfly/components/Tabs/tabs.css";
 // @ts-ignore
 import GlobalsStyle from "@patternfly/patternfly/base/patternfly-globals.css";
+// @ts-ignore
+import AKGlobal from "../authentik.css";
 import { CURRENT_CLASS } from "../constants";
 import { gettext } from "django";
 
@@ -16,7 +18,7 @@ export class Tabs extends LitElement {
     vertical = false;
 
     static get styles(): CSSResult[] {
-        return [GlobalsStyle, TabsStyle, css`
+        return [GlobalsStyle, TabsStyle, AKGlobal, css`
             ::slotted(*) {
                 height: 100%;
                 flex-grow: 2;
@@ -24,6 +26,9 @@ export class Tabs extends LitElement {
             :host([vertical]) {
                 display: flex;
             }
+            :host([vertical]) .pf-c-tabs__list {
+                height: 100%;
+            }
         `];
     }
 

web/src/elements/stages/identification/IdentificationStage.ts

@@ -1,5 +1,5 @@
 import { gettext } from "django";
-import { CSSResult, customElement, html, property, TemplateResult } from "lit-element";
+import { css, CSSResult, customElement, html, property, TemplateResult } from "lit-element";
 import { Challenge } from "../../../api/Flows";
 import { COMMON_STYLES } from "../../../common/styles";
 import { BaseStage } from "../base";
@@ -31,7 +31,13 @@ export class IdentificationStage extends BaseStage {
     challenge?: IdentificationChallenge;
 
     static get styles(): CSSResult[] {
-        return COMMON_STYLES;
+        return COMMON_STYLES.concat(
+            css`
+                .pf-c-login__main-footer-links-item-link img {
+                    width: 100px;
+                }
+            `
+        );
     }
 
     renderSource(source: UILoginButton): TemplateResult {

web/src/pages/generic/FlowExecutor.ts

@@ -136,13 +136,13 @@ export class FlowExecutor extends LitElement implements StageHost {
 
     renderChallenge(): TemplateResult {
         if (!this.challenge) {
-            return html``;
+            return this.renderLoading();
         }
         switch (this.challenge.type) {
             case ChallengeTypes.redirect:
                 console.debug(`authentik/flows: redirecting to ${(this.challenge as RedirectChallenge).to}`);
                 window.location.assign((this.challenge as RedirectChallenge).to);
-                break;
+                return this.renderLoading();
             case ChallengeTypes.shell:
                 return html`${unsafeHTML((this.challenge as ShellChallenge).body)}`;
             case ChallengeTypes.native:

website/docs/installation/docker-compose.md

@@ -16,7 +16,7 @@ Download the latest `docker-compose.yml` from [here](https://raw.githubuserconte
 
 To optionally enable error-reporting, run `echo AUTHENTIK_ERROR_REPORTING__ENABLED=true >> .env`
 
-To optionally deploy a different version run `echo AUTHENTIK_TAG=2021.3.2 >> .env`
+To optionally deploy a different version run `echo AUTHENTIK_TAG=2021.3.3 >> .env`
 
 If this is a fresh authentik install run the following commands to generate a password:
 

website/docs/installation/kubernetes.md

@@ -24,7 +24,7 @@ image:
     name: beryju/authentik
     name_static: beryju/authentik-static
     name_outposts: beryju/authentik # Prefix used for Outpost deployments, Outpost type and version is appended
-    tag: 2021.3.2
+    tag: 2021.3.3
 
 serverReplicas: 1
 workerReplicas: 1

website/docs/releases/2021.3.md

@@ -39,6 +39,12 @@ title: Release 2021.3
     If you conditionally include this stage in a flow, make sure to disable "Evaluate on plan", as that will always include the stage in the flow, irregardless of the inputs.
 
 
+## Fixed in 2021.3.2
+
+- sources/ldap: fix sync for Users without pwdLastSet
+- web: fix date display issue
+- web: fix submit in Modal reloading page in firefox
+
 ## Upgrading
 
 This release does not introduce any new requirements.