release: 2022.12.3

security: fix CVE-2023-26481 (#4832 )
fix CVE-2023-26481 Signed-off-by: Jens Langhammer <jens@goauthentik.io>
2023-03-02 20:18:21 +01:00 · 2023-03-02 20:16:01 +01:00 · 2023-02-16 14:40:07 +01:00 · 2023-01-05 10:01:30 +01:00 · 2023-01-04 22:40:18 +01:00 · 2023-01-04 22:40:15 +01:00
376 changed files with 13649 additions and 6068 deletions
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2022.11.1
+current_version = 2022.12.3
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)
--- a/.dockerignore
+++ b/.dockerignore
@ -1,8 +1,8 @@
 env
-static
 htmlcov
 *.env.yml
 **/node_modules
 dist/**
 build/**
 build_docs/**
+Dockerfile
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@ -99,7 +99,7 @@ jobs:
      - name: Setup authentik env
        uses: ./.github/actions/setup
      - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.4.0
+        uses: helm/kind-action@v1.5.0
      - name: run integration
        run: |
          poetry run make test-integration
@ -208,6 +208,9 @@ jobs:
      - name: Building Docker Image
        uses: docker/build-push-action@v3
        with:
+          secrets: |
+            GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
+            GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
          tags: |
            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@ -27,6 +27,22 @@ jobs:
      - name: Eslint
        working-directory: web/
        run: npm run lint
+  lint-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3.5.1
+        with:
+          node-version: '16'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+      - working-directory: web/
+        run: npm ci
+      - name: Generate API
+        run: make gen-client-ts
+      - name: TSC
+        working-directory: web/
+        run: npm run tsc
  lint-prettier:
    runs-on: ubuntu-latest
    steps:
@ -69,6 +85,7 @@ jobs:
      - lint-eslint
      - lint-prettier
      - lint-lit-analyse
+      - lint-build
    runs-on: ubuntu-latest
    steps:
      - run: echo mark
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@ -31,6 +31,9 @@ jobs:
        uses: docker/build-push-action@v3
        with:
          push: ${{ github.event_name == 'release' }}
+          secrets:
+            GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
+            GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
          tags: |
            beryju/authentik:${{ steps.ev.outputs.version }},
            beryju/authentik:${{ steps.ev.outputs.versionFamily }},
@ -39,7 +42,8 @@ jobs:
            ghcr.io/goauthentik/server:${{ steps.ev.outputs.versionFamily }},
            ghcr.io/goauthentik/server:latest
          platforms: linux/amd64,linux/arm64
-          context: .
+          build-args: |
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
  build-outpost:
    runs-on: ubuntu-latest
    strategy:
@ -84,6 +88,11 @@ jobs:
            ghcr.io/goauthentik/${{ matrix.type }}:latest
          file: ${{ matrix.type }}.Dockerfile
          platforms: linux/amd64,linux/arm64
+          secrets: |
+            GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
+            GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
+          build-args: |
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
  build-outpost-binary:
    timeout-minutes: 120
    runs-on: ubuntu-latest
@ -161,11 +170,9 @@ jobs:
        if: ${{ github.event_name == 'release' }}
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_ORG: beryjuorg
+          SENTRY_ORG: authentik-security-inc
          SENTRY_PROJECT: authentik
-          SENTRY_URL: https://sentry.beryju.org
        with:
          version: authentik@${{ steps.ev.outputs.version }}
-          environment: beryjuorg-prod
          sourcemaps: './web/dist'
          url_prefix: '~/static/dist'
--- a/.gitignore
+++ b/.gitignore
@ -194,11 +194,9 @@ pip-selfcheck.json
 /static/
 local.env.yml

-# Selenium Screenshots
-selenium_screenshots/
-backups/
 media/
 *mmdb

 .idea/
 /gen-*/
+data/
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@ -24,7 +24,11 @@
        "!Find sequence",
        "!KeyOf scalar",
        "!Context scalar",
-        "!Format sequence"
+        "!Context sequence",
+        "!Format sequence",
+        "!Condition sequence",
+        "!Env sequence",
+        "!Env scalar"
    ],
    "typescript.preferences.importModuleSpecifier": "non-relative",
    "typescript.preferences.importModuleSpecifierEnding": "index",
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@ -17,24 +17,24 @@ diverse, inclusive, and healthy community.
 Examples of behavior that contributes to a positive environment for our
 community include:

-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
+-   Demonstrating empathy and kindness toward other people
+-   Being respectful of differing opinions, viewpoints, and experiences
+-   Giving and gracefully accepting constructive feedback
+-   Accepting responsibility and apologizing to those affected by our mistakes,
+    and learning from the experience
+-   Focusing on what is best not just for us as individuals, but for the
+    overall community

 Examples of unacceptable behavior include:

-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
+-   The use of sexualized language or imagery, and sexual attention or
+    advances of any kind
+-   Trolling, insulting or derogatory comments, and personal or political attacks
+-   Public or private harassment
+-   Publishing others' private information, such as a physical or email
+    address, without their explicit permission
+-   Other conduct which could reasonably be considered inappropriate in a
+    professional setting

 ## Enforcement Responsibilities

@ -106,7 +106,7 @@ Violating these terms may lead to a permanent ban.
 ### 4. Permanent Ban

 **Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
+standards, including sustained inappropriate behavior, harassment of an
 individual, or aggression toward or disparagement of classes of individuals.

 **Consequence**: A permanent ban from any sort of public interaction within
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -11,19 +11,22 @@ The following is a set of guidelines for contributing to authentik and its compo
 [I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)

 [What should I know before I get started?](#what-should-i-know-before-i-get-started)
-  * [The components](#the-components)
-  * [authentik's structure](#authentiks-structure)
+
+-   [The components](#the-components)
+-   [authentik's structure](#authentiks-structure)

 [How Can I Contribute?](#how-can-i-contribute)
-  * [Reporting Bugs](#reporting-bugs)
-  * [Suggesting Enhancements](#suggesting-enhancements)
-  * [Your First Code Contribution](#your-first-code-contribution)
-  * [Pull Requests](#pull-requests)
+
+-   [Reporting Bugs](#reporting-bugs)
+-   [Suggesting Enhancements](#suggesting-enhancements)
+-   [Your First Code Contribution](#your-first-code-contribution)
+-   [Pull Requests](#pull-requests)

 [Styleguides](#styleguides)
-  * [Git Commit Messages](#git-commit-messages)
-  * [Python Styleguide](#python-styleguide)
-  * [Documentation Styleguide](#documentation-styleguide)
+
+-   [Git Commit Messages](#git-commit-messages)
+-   [Python Styleguide](#python-styleguide)
+-   [Documentation Styleguide](#documentation-styleguide)

 ## Code of Conduct

@ -39,11 +42,11 @@ Either [create a question on GitHub](https://github.com/goauthentik/authentik/is

 authentik consists of a few larger components:

- *authentik* the actual application server, is described below.
- *outpost-proxy* is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
- *outpost-ldap* is a Go LDAP server that uses the *authentik* application server as its backend
- *web* is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
- *website* is the Website/documentation, which uses docusaurus.
+-   _authentik_ the actual application server, is described below.
+-   _outpost-proxy_ is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
+-   _outpost-ldap_ is a Go LDAP server that uses the _authentik_ application server as its backend
+-   _web_ is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
+-   _website_ is the Website/documentation, which uses docusaurus.

 ### authentik's structure

@ -137,10 +140,10 @@ This is documented in the [developer docs](https://goauthentik.io/developer-docs

 The process described here has several goals:

- Maintain authentik's quality
- Fix problems that are important to users
- Engage the community in working toward the best possible authentik
- Enable a sustainable system for authentik's maintainers to review contributions
+-   Maintain authentik's quality
+-   Fix problems that are important to users
+-   Engage the community in working toward the best possible authentik
+-   Enable a sustainable system for authentik's maintainers to review contributions

 Please follow these steps to have your contribution considered by the maintainers:

@ -154,10 +157,10 @@ While the prerequisites above must be satisfied prior to having your pull reques

 ### Git Commit Messages

-* Use the format of `<package>: <verb> <description>`
-  - See [here](#authentik-packages) for `package`
-  - Example: `providers/saml2: fix parsing of requests`
-* Reference issues and pull requests liberally after the first line
+-   Use the format of `<package>: <verb> <description>`
+    -   See [here](#authentik-packages) for `package`
+    -   Example: `providers/saml2: fix parsing of requests`
+-   Reference issues and pull requests liberally after the first line

 ### Python Styleguide

@ -165,11 +168,11 @@ All Python code is linted with [black](https://black.readthedocs.io/en/stable/),

 authentik runs on Python 3.9 at the time of writing this.

-* Use native type-annotations wherever possible.
-* Add meaningful docstrings when possible.
-* Ensure any database migrations work properly from the last stable version (this is checked via CI)
-* If your code changes central functions, make sure nothing else is broken.
+-   Use native type-annotations wherever possible.
+-   Add meaningful docstrings when possible.
+-   Ensure any database migrations work properly from the last stable version (this is checked via CI)
+-   If your code changes central functions, make sure nothing else is broken.

 ### Documentation Styleguide

-* Use [MDX](https://mdxjs.com/) whenever appropriate.
+-   Use [MDX](https://mdxjs.com/) whenever appropriate.
--- a/24
+++ b/24
@ -3,6 +3,7 @@ FROM --platform=${BUILDPLATFORM} docker.io/node:18 as website-builder

 COPY ./website /work/website/
 COPY ./blueprints /work/blueprints/
+COPY ./SECURITY.md /work/

 ENV NODE_ENV=production
 WORKDIR /work/website
@ -19,7 +20,7 @@ WORKDIR /work/web
 RUN npm ci && npm run build

 # Stage 3: Poetry to requirements.txt export
-FROM docker.io/python:3.11.0-slim-bullseye AS poetry-locker
+FROM docker.io/python:3.11.1-slim-bullseye AS poetry-locker

 WORKDIR /work
 COPY ./pyproject.toml /work
@ -30,7 +31,7 @@ RUN pip install --no-cache-dir poetry && \
    poetry export -f requirements.txt --dev --output requirements-dev.txt

 # Stage 4: Build go proxy
-FROM docker.io/golang:1.19.3-bullseye AS go-builder
+FROM docker.io/golang:1.19.4-bullseye AS go-builder

 WORKDIR /work

@ -45,8 +46,22 @@ COPY ./go.sum /work/go.sum

 RUN go build -o /work/authentik ./cmd/server/

-# Stage 5: Run
-FROM docker.io/python:3.11.0-slim-bullseye AS final-image
+# Stage 5: MaxMind GeoIP
+FROM docker.io/maxmindinc/geoipupdate:v4.10 as geoip
+
+ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City"
+
+RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
+    --mount=type=secret,id=GEOIPUPDATE_LICENSE_KEY \
+    mkdir -p /usr/share/GeoIP && \
+    /bin/sh -c "\
+        export GEOIPUPDATE_ACCOUNT_ID=$(cat /run/secrets/GEOIPUPDATE_ACCOUNT_ID); \
+        export GEOIPUPDATE_LICENSE_KEY=$(cat /run/secrets/GEOIPUPDATE_LICENSE_KEY); \
+        /usr/bin/entry.sh || exit 0 \
+    "
+
+# Stage 6: Run
+FROM docker.io/python:3.11.1-slim-bullseye AS final-image

 LABEL org.opencontainers.image.url https://goauthentik.io
 LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.
@ -59,6 +74,7 @@ ENV GIT_BUILD_HASH=$GIT_BUILD_HASH

 COPY --from=poetry-locker /work/requirements.txt /
 COPY --from=poetry-locker /work/requirements-dev.txt /
+COPY --from=geoip /usr/share/GeoIP /geoip

 RUN apt-get update && \
    # Required for installing pip packages
--- a/5
+++ b/5
@ -126,7 +126,7 @@ gen: gen-build gen-clean gen-client-ts
 web-build: web-install
 	cd web && npm run build

-web: web-lint-fix web-lint
+web: web-lint-fix web-lint web-check-compile

 web-install:
 	cd web && npm ci
@ -144,6 +144,9 @@ web-lint:
 	cd web && npm run lint
 	cd web && npm run lit-analyse

+web-check-compile:
+	cd web && npm run tsc
+
 web-extract:
 	cd web && npm run extract

--- a/README.md
+++ b/README.md
@ -5,13 +5,13 @@
 ---

 [![Join Discord](https://img.shields.io/discord/809154715984199690?label=Discord&style=for-the-badge)](https://goauthentik.io/discord)
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-main?label=core%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-main.yml)
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-outpost?label=outpost%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-outpost.yml)
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-web?label=web%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-web.yml)
+[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/goauthentik/authentik/ci-main.yml?branch=main&label=core%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-main.yml)
+[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/goauthentik/authentik/ci-outpost.yml?branch=main&label=outpost%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-outpost.yml)
+[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/goauthentik/authentik/ci-web.yml?branch=main&label=web%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-web.yml)
 [![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=for-the-badge)](https://codecov.io/gh/goauthentik/authentik)
 ![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=for-the-badge)
 ![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=for-the-badge)
-[![](https://img.shields.io/badge/Help%20translate-transifex-blue?style=for-the-badge)](https://www.transifex.com/beryjuorg/authentik/)
+[![](https://img.shields.io/badge/Help%20translate-transifex-blue?style=for-the-badge)](https://www.transifex.com/authentik/authentik/)

 ## What is authentik?

@ -25,10 +25,10 @@ For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/h

 ## Screenshots

-Light | Dark
--- | ---
-![](https://goauthentik.io/img/screen_apps_light.jpg) | ![](https://goauthentik.io/img/screen_apps_dark.jpg)
-![](https://goauthentik.io/img/screen_admin_light.jpg) | ![](https://goauthentik.io/img/screen_admin_dark.jpg)
+| Light                                                  | Dark                                                  |
+| ------------------------------------------------------ | ----------------------------------------------------- |
+| ![](https://goauthentik.io/img/screen_apps_light.jpg)  | ![](https://goauthentik.io/img/screen_apps_dark.jpg)  |
+| ![](https://goauthentik.io/img/screen_admin_light.jpg) | ![](https://goauthentik.io/img/screen_admin_dark.jpg) |

 ## Development

--- a/SECURITY.md
+++ b/SECURITY.md
@ -1,18 +1,44 @@
-# Security Policy
+Authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.

 ## Supported Versions

 (.x being the latest patch release for each version)

-| Version    | Supported          |
-| ---------- | ------------------ |
-| 2022.10.x  | :white_check_mark: |
-| 2022.11.x  | :white_check_mark: |
+| Version   | Supported          |
+| --------- | ------------------ |
+| 2022.11.x | :white_check_mark: |
+| 2022.12.x | :white_check_mark: |

 ## Reporting a Vulnerability

-To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io)
+To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the bug.
+
+## Criticality levels
+
+### High
+
+-   Authorization bypass
+-   Circumvention of policies
+
+### Moderate
+
+-   Denial-of-Service attacks
+
+### Low
+
+-   Unvalidated redirects
+-   Issues requiring uncommon setups
+
+## Disclosure process
+
+1. Issue is reported via Email as listed above.
+2. The authentik Security team will try to reproduce the issue and ask for more information if required.
+3. A criticality level is assigned.
+4. A fix is created, and if possible tested by the issue reporter.
+5. The fix is backported to other supported versions, and if possible a workaround for other versions is created.
+6. An announcement is sent out with a fixed release date and criticality level of the issue. The announcement will be sent at least 24 hours before the release of the fix
+7. The fixed version is released for the supported versions.

 ## Getting security notifications

-To get security notifications, join the [discord](https://goauthentik.io/discord) server. In the future there will be a mailing list too.
+To get security notifications, subscribe to the mailing list [here](https://groups.google.com/g/authentik-security-announcements) or join the [discord](https://goauthentik.io/discord) server.
--- a/authentik/init.py
+++ b/authentik/init.py
@ -2,16 +2,14 @@
 from os import environ
 from typing import Optional

-__version__ = "2022.11.1"
+__version__ = "2022.12.3"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"


 def get_build_hash(fallback: Optional[str] = None) -> str:
    """Get build hash"""
    build_hash = environ.get(ENV_GIT_HASH_KEY, fallback if fallback else "")
-    if build_hash == "" and fallback:
-        return fallback
-    return build_hash
+    return fallback if build_hash == "" and fallback else build_hash


 def get_full_version() -> str:
--- a/authentik/admin/api/system.py
+++ b/authentik/admin/api/system.py
@ -8,7 +8,6 @@ from typing import TypedDict
 from django.utils.timezone import now
 from drf_spectacular.utils import extend_schema
 from gunicorn import version_info as gunicorn_version
-from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
 from rest_framework.fields import SerializerMethodField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
@ -16,6 +15,7 @@ from rest_framework.response import Response
 from rest_framework.views import APIView

 from authentik.core.api.utils import PassiveSerializer
+from authentik.lib.utils.reflection import get_env
 from authentik.outposts.apps import MANAGED_OUTPOST
 from authentik.outposts.models import Outpost

@ -69,7 +69,7 @@ class SystemSerializer(PassiveSerializer):
        return {
            "python_version": python_version,
            "gunicorn_version": ".".join(str(x) for x in gunicorn_version),
-            "environment": "kubernetes" if SERVICE_HOST_ENV_NAME in os.environ else "compose",
+            "environment": get_env(),
            "architecture": platform.machine(),
            "platform": platform.platform(),
            "uname": " ".join(platform.uname()),
--- a/authentik/api/authentication.py
+++ b/authentik/api/authentication.py
@ -11,7 +11,6 @@ from authentik.core.middleware import CTX_AUTH_VIA
 from authentik.core.models import Token, TokenIntents, User
 from authentik.outposts.models import Outpost
 from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
-from authentik.providers.oauth2.models import RefreshToken

 LOGGER = get_logger()

@ -33,6 +32,8 @@ def validate_auth(header: bytes) -> Optional[str]:

 def bearer_auth(raw_header: bytes) -> Optional[User]:
    """raw_header in the Format of `Bearer ....`"""
+    from authentik.providers.oauth2.models import RefreshToken
+
    auth_credentials = validate_auth(raw_header)
    if not auth_credentials:
        return None
--- a/authentik/api/authorization.py
+++ b/authentik/api/authorization.py
@ -1,9 +1,15 @@
 """API Authorization"""
+from django.conf import settings
 from django.db.models import Model
 from django.db.models.query import QuerySet
+from django_filters.rest_framework import DjangoFilterBackend
+from rest_framework.authentication import get_authorization_header
 from rest_framework.filters import BaseFilterBackend
 from rest_framework.permissions import BasePermission
 from rest_framework.request import Request
+from rest_framework_guardian.filters import ObjectPermissionsFilter
+
+from authentik.api.authentication import validate_auth


 class OwnerFilter(BaseFilterBackend):
@ -17,6 +23,20 @@ class OwnerFilter(BaseFilterBackend):
        return queryset.filter(**{self.owner_key: request.user})


+class SecretKeyFilter(DjangoFilterBackend):
+    """Allow access to all objects when authenticated with secret key as token.
+
+    Replaces both DjangoFilterBackend and ObjectPermissionsFilter"""
+
+    def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet:
+        auth_header = get_authorization_header(request)
+        token = validate_auth(auth_header)
+        if token and token == settings.SECRET_KEY:
+            return queryset
+        queryset = ObjectPermissionsFilter().filter_queryset(request, queryset, view)
+        return super().filter_queryset(request, queryset, view)
+
+
 class OwnerPermissions(BasePermission):
    """Authorize requests by an object's owner matching the requesting user"""

--- a/authentik/api/v3/config.py
+++ b/authentik/api/v3/config.py
@ -68,7 +68,7 @@ class ConfigView(APIView):
            caps.append(Capabilities.CAN_GEO_IP)
        if CONFIG.y_bool("impersonation"):
            caps.append(Capabilities.CAN_IMPERSONATE)
-        if settings.DEBUG:
+        if settings.DEBUG:  # pragma: no cover
            caps.append(Capabilities.CAN_DEBUG)
        return caps

--- a/authentik/api/v3/urls.py
+++ b/authentik/api/v3/urls.py
@ -49,11 +49,12 @@ from authentik.policies.hibp.api import HaveIBeenPwendPolicyViewSet
 from authentik.policies.password.api import PasswordPolicyViewSet
 from authentik.policies.reputation.api import ReputationPolicyViewSet, ReputationViewSet
 from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
-from authentik.providers.oauth2.api.provider import OAuth2ProviderViewSet
-from authentik.providers.oauth2.api.scope import ScopeMappingViewSet
+from authentik.providers.oauth2.api.providers import OAuth2ProviderViewSet
+from authentik.providers.oauth2.api.scopes import ScopeMappingViewSet
 from authentik.providers.oauth2.api.tokens import AuthorizationCodeViewSet, RefreshTokenViewSet
 from authentik.providers.proxy.api import ProxyOutpostConfigViewSet, ProxyProviderViewSet
-from authentik.providers.saml.api import SAMLPropertyMappingViewSet, SAMLProviderViewSet
+from authentik.providers.saml.api.property_mapping import SAMLPropertyMappingViewSet
+from authentik.providers.saml.api.providers import SAMLProviderViewSet
 from authentik.sources.ldap.api import LDAPPropertyMappingViewSet, LDAPSourceViewSet
 from authentik.sources.oauth.api.source import OAuthSourceViewSet
 from authentik.sources.oauth.api.source_connection import UserOAuthSourceConnectionViewSet
--- a/authentik/blueprints/management/commands/schema_template.json
+++ b/authentik/blueprints/management/commands/schema_template.json
@ -62,6 +62,12 @@
                        ],
                        "default": "present"
                    },
+                    "conditions": {
+                        "type": "array",
+                        "items": {
+                            "type": "boolean"
+                        }
+                    },
                    "attrs": {
                        "type": "object",
                        "properties": {
--- a/authentik/blueprints/models.py
+++ b/authentik/blueprints/models.py
@ -92,7 +92,7 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
        if ":" in url.path:
            path, _, ref = path.partition(":")
        client = NewClient(
-            f"{url.scheme}://{url.hostname}",
+            f"https://{url.hostname}",
            WithUserAgent(authentik_user_agent()),
            WithUsernamePassword(url.username, url.password),
            WithDefaultName(path),
@ -135,12 +135,11 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):

    def retrieve(self) -> str:
        """Retrieve blueprint contents"""
+        if self.path.startswith("oci://"):
+            return self.retrieve_oci()
        full_path = Path(CONFIG.y("blueprints_dir")).joinpath(Path(self.path))
-        if full_path.exists():
-            LOGGER.debug("Blueprint path exists locally", instance=self)
-            with full_path.open("r", encoding="utf-8") as _file:
-                return _file.read()
-        return self.retrieve_oci()
+        with full_path.open("r", encoding="utf-8") as _file:
+            return _file.read()

    @property
    def serializer(self) -> Serializer:
--- a/authentik/blueprints/tests/fixtures/conditions_fulfilled.yaml
+++ b/authentik/blueprints/tests/fixtures/conditions_fulfilled.yaml
@ -0,0 +1,21 @@
+version: 1
+entries:
+    - identifiers:
+          name: "%(id1)s"
+          slug: "%(id1)s"
+      model: authentik_flows.flow
+      conditions:
+          - true
+      attrs:
+          designation: stage_configuration
+          title: foo
+    - identifiers:
+          name: "%(id2)s"
+          slug: "%(id2)s"
+      model: authentik_flows.flow
+      conditions:
+          - true
+          - true
+      attrs:
+          designation: stage_configuration
+          title: foo
--- a/authentik/blueprints/tests/fixtures/conditions_not_fulfilled.yaml
+++ b/authentik/blueprints/tests/fixtures/conditions_not_fulfilled.yaml
@ -0,0 +1,21 @@
+version: 1
+entries:
+    - identifiers:
+          name: "%(id1)s"
+          slug: "%(id1)s"
+      model: authentik_flows.flow
+      conditions:
+          - false
+      attrs:
+          designation: stage_configuration
+          title: foo
+    - identifiers:
+          name: "%(id2)s"
+          slug: "%(id2)s"
+      model: authentik_flows.flow
+      conditions:
+          - true
+          - false
+      attrs:
+          designation: stage_configuration
+          title: foo
--- a/authentik/blueprints/tests/fixtures/state_absent.yaml
+++ b/authentik/blueprints/tests/fixtures/state_absent.yaml
@ -1,7 +1,13 @@
 version: 1
 entries:
- identifiers:
-    name: "%(id)s"
-    slug: "%(id)s"
-  model: authentik_flows.flow
-  state: absent
+    - identifiers:
+          name: "%(id)s"
+          slug: "%(id)s"
+      model: authentik_flows.flow
+      state: absent
+    - identifiers:
+          name: "%(id)s"
+          expression: |
+            return True
+      model: authentik_policies_expression.expressionpolicy
+      state: absent
--- a/authentik/blueprints/tests/fixtures/state_created.yaml
+++ b/authentik/blueprints/tests/fixtures/state_created.yaml
@ -1,10 +1,10 @@
 version: 1
 entries:
- identifiers:
-    name: "%(id)s"
-    slug: "%(id)s"
-  model: authentik_flows.flow
-  state: created
-  attrs:
-    designation: stage_configuration
-    title: foo
+    - identifiers:
+          name: "%(id)s"
+          slug: "%(id)s"
+      model: authentik_flows.flow
+      state: created
+      attrs:
+          designation: stage_configuration
+          title: foo
--- a/authentik/blueprints/tests/fixtures/state_present.yaml
+++ b/authentik/blueprints/tests/fixtures/state_present.yaml
@ -1,10 +1,10 @@
 version: 1
 entries:
- identifiers:
-    name: "%(id)s"
-    slug: "%(id)s"
-  model: authentik_flows.flow
-  state: present
-  attrs:
-    designation: stage_configuration
-    title: foo
+    - identifiers:
+          name: "%(id)s"
+          slug: "%(id)s"
+      model: authentik_flows.flow
+      state: present
+      attrs:
+          designation: stage_configuration
+          title: foo
--- a/authentik/blueprints/tests/fixtures/static_prompt_export.yaml
+++ b/authentik/blueprints/tests/fixtures/static_prompt_export.yaml
@ -1,12 +1,12 @@
 version: 1
 entries:
- identifiers:
-    pk: cb954fd4-65a5-4ad9-b1ee-180ee9559cf4
-  model: authentik_stages_prompt.prompt
-  attrs:
-    field_key: username
-    label: Username
-    type: username
-    required: true
-    placeholder: Username
-    order: 0
+    - identifiers:
+          pk: cb954fd4-65a5-4ad9-b1ee-180ee9559cf4
+      model: authentik_stages_prompt.prompt
+      attrs:
+          field_key: username
+          label: Username
+          type: username
+          required: true
+          placeholder: Username
+          order: 0
--- a/authentik/blueprints/tests/fixtures/tags.yaml
+++ b/authentik/blueprints/tests/fixtures/tags.yaml
@ -1,10 +1,101 @@
 version: 1
 context:
    foo: bar
+    policy_property: name
+    policy_property_value: foo-bar-baz-qux
 entries:
- attrs:
-    expression: return True
-  identifiers:
-    name: !Format [foo-%s-%s, !Context foo, !Context bar]
-  id: default-source-enrollment-if-username
-  model: authentik_policies_expression.expressionpolicy
+    - model: !Format ["%s", authentik_sources_oauth.oauthsource]
+      state: !Format ["%s", present]
+      identifiers:
+          slug: test
+      attrs:
+          name: test
+          provider_type: github
+          consumer_key: !Env foo
+          consumer_secret: !Env [bar, baz]
+          authentication_flow:
+              !Find [
+                  authentik_flows.Flow,
+                  [slug, default-source-authentication],
+              ]
+          enrollment_flow:
+              !Find [authentik_flows.Flow, [slug, default-source-enrollment]]
+    - attrs:
+          expression: return True
+      identifiers:
+          name: !Format [foo-%s-%s-%s, !Context foo, !Context bar, qux]
+      id: policy
+      model: authentik_policies_expression.expressionpolicy
+    - attrs:
+          attributes:
+              policy_pk1:
+                  !Format [
+                      "%s-%s",
+                      !Find [
+                          authentik_policies_expression.expressionpolicy,
+                          [
+                              !Context policy_property,
+                              !Context policy_property_value,
+                          ],
+                          [expression, return True],
+                      ],
+                      suffix,
+                  ]
+              policy_pk2: !Format ["%s-%s", !KeyOf policy, suffix]
+              boolAnd:
+                  !Condition [AND, !Context foo, !Format ["%s", "a_string"], 1]
+              boolNand:
+                  !Condition [NAND, !Context foo, !Format ["%s", "a_string"], 1]
+              boolOr:
+                  !Condition [
+                      OR,
+                      !Context foo,
+                      !Format ["%s", "a_string"],
+                      null,
+                  ]
+              boolNor:
+                  !Condition [
+                      NOR,
+                      !Context foo,
+                      !Format ["%s", "a_string"],
+                      null,
+                  ]
+              boolXor:
+                  !Condition [XOR, !Context foo, !Format ["%s", "a_string"], 1]
+              boolXnor:
+                  !Condition [XNOR, !Context foo, !Format ["%s", "a_string"], 1]
+              boolComplex:
+                  !Condition [
+                      XNOR,
+                      !Condition [AND, !Context non_existing],
+                      !Condition [NOR, a string],
+                      !Condition [XOR, null],
+                  ]
+              if_true_complex:
+                  !If [
+                      true,
+                      {
+                          dictionary:
+                              {
+                                  with: { keys: "and_values" },
+                                  and_nested_custom_tags:
+                                      !Format ["foo-%s", !Context foo],
+                              },
+                      },
+                      null,
+                  ]
+              if_false_complex:
+                  !If [
+                      !Condition [AND, false],
+                      null,
+                      [list, with, items, !Format ["foo-%s", !Context foo]],
+                  ]
+              if_true_simple: !If [!Context foo, true, text]
+              if_false_simple: !If [null, false, 2]
+      identifiers:
+          name: test
+      conditions:
+          - !Condition [AND, true, true, text]
+          - true
+          - text
+      model: authentik_core.group
--- a/authentik/blueprints/tests/test_models.py
+++ b/authentik/blueprints/tests/test_models.py
@ -16,7 +16,7 @@ def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
    """Test serializer"""

    def tester(self: TestModels):
-        if test_model._meta.abstract:
+        if test_model._meta.abstract:  # pragma: no cover
            return
        model_class = test_model()
        self.assertTrue(isinstance(model_class, SerializerModel))
--- a/authentik/blueprints/tests/test_oci.py
+++ b/authentik/blueprints/tests/test_oci.py
@ -26,8 +26,8 @@ class TestBlueprintOCI(TransactionTestCase):

            self.assertEqual(
                BlueprintInstance(
-                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
-                ).retrieve_oci(),
+                    path="oci://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve(),
                "foo",
            )

@ -40,7 +40,7 @@ class TestBlueprintOCI(TransactionTestCase):

            with self.assertRaises(BlueprintRetrievalFailed):
                BlueprintInstance(
-                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                    path="oci://ghcr.io/goauthentik/blueprints/test:latest"
                ).retrieve_oci()

    def test_manifests_error_response(self):
@ -53,7 +53,7 @@ class TestBlueprintOCI(TransactionTestCase):

            with self.assertRaises(BlueprintRetrievalFailed):
                BlueprintInstance(
-                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                    path="oci://ghcr.io/goauthentik/blueprints/test:latest"
                ).retrieve_oci()

    def test_no_matching_blob(self):
@ -72,7 +72,7 @@ class TestBlueprintOCI(TransactionTestCase):
            )
            with self.assertRaises(BlueprintRetrievalFailed):
                BlueprintInstance(
-                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                    path="oci://ghcr.io/goauthentik/blueprints/test:latest"
                ).retrieve_oci()

    def test_blob_error(self):
@ -93,5 +93,5 @@ class TestBlueprintOCI(TransactionTestCase):

            with self.assertRaises(BlueprintRetrievalFailed):
                BlueprintInstance(
-                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                    path="oci://ghcr.io/goauthentik/blueprints/test:latest"
                ).retrieve_oci()
--- a/authentik/blueprints/tests/test_v1.py
+++ b/authentik/blueprints/tests/test_v1.py
@ -1,13 +1,17 @@
 """Test blueprints v1"""
+from os import environ
+
 from django.test import TransactionTestCase

 from authentik.blueprints.tests import load_yaml_fixture
 from authentik.blueprints.v1.exporter import FlowExporter
 from authentik.blueprints.v1.importer import Importer, transaction_rollback
+from authentik.core.models import Group
 from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
 from authentik.lib.generators import generate_id
 from authentik.policies.expression.models import ExpressionPolicy
 from authentik.policies.models import PolicyBinding
+from authentik.sources.oauth.models import OAuthSource
 from authentik.stages.prompt.models import FieldTypes, Prompt, PromptStage
 from authentik.stages.user_login.models import UserLoginStage

@ -26,6 +30,61 @@ class TestBlueprintsV1(TransactionTestCase):
            )
        )
        self.assertFalse(importer.validate()[0])
+        importer = Importer(
+            (
+                '{"version": 1, "entries": [{"attrs": {"name": "test"}, '
+                '"identifiers": {}, '
+                '"model": "authentik_core.Group"}]}'
+            )
+        )
+        self.assertFalse(importer.validate()[0])
+
+    def test_validated_import_dict_identifiers(self):
+        """Test importing blueprints with dict identifiers."""
+        Group.objects.filter(name__istartswith="test").delete()
+
+        Group.objects.create(
+            name="test1",
+            attributes={
+                "key": ["value"],
+                "other_key": ["a_value", "other_value"],
+            },
+        )
+        Group.objects.create(
+            name="test2",
+            attributes={
+                "key": ["value"],
+                "other_key": ["diff_value", "other_diff_value"],
+            },
+        )
+
+        importer = Importer(
+            (
+                '{"version": 1, "entries": [{"attrs": {"name": "test999", "attributes": '
+                '{"key": ["updated_value"]}}, "identifiers": {"attributes": {"other_key": '
+                '["other_value"]}}, "model": "authentik_core.Group"}]}'
+            )
+        )
+        self.assertTrue(importer.validate()[0])
+        self.assertTrue(importer.apply())
+        self.assertTrue(
+            Group.objects.filter(
+                name="test2",
+                attributes={
+                    "key": ["value"],
+                    "other_key": ["diff_value", "other_diff_value"],
+                },
+            )
+        )
+        self.assertTrue(
+            Group.objects.filter(
+                name="test999",
+                # All attributes used as identifiers are kept and merged with the
+                # new attributes declared in the blueprint
+                attributes={"key": ["updated_value"], "other_key": ["other_value"]},
+            )
+        )
+        self.assertFalse(Group.objects.filter(name="test1"))

    def test_export_validate_import(self):
        """Test export and validate it"""
@ -74,11 +133,44 @@ class TestBlueprintsV1(TransactionTestCase):

    def test_import_yaml_tags(self):
        """Test some yaml tags"""
-        ExpressionPolicy.objects.filter(name="foo-foo-bar").delete()
+        ExpressionPolicy.objects.filter(name="foo-bar-baz-qux").delete()
+        Group.objects.filter(name="test").delete()
+        environ["foo"] = generate_id()
        importer = Importer(load_yaml_fixture("fixtures/tags.yaml"), {"bar": "baz"})
        self.assertTrue(importer.validate()[0])
        self.assertTrue(importer.apply())
-        self.assertTrue(ExpressionPolicy.objects.filter(name="foo-foo-bar"))
+        policy = ExpressionPolicy.objects.filter(name="foo-bar-baz-qux").first()
+        self.assertTrue(policy)
+        self.assertTrue(
+            Group.objects.filter(
+                attributes={
+                    "policy_pk1": str(policy.pk) + "-suffix",
+                    "policy_pk2": str(policy.pk) + "-suffix",
+                    "boolAnd": True,
+                    "boolNand": False,
+                    "boolOr": True,
+                    "boolNor": False,
+                    "boolXor": True,
+                    "boolXnor": False,
+                    "boolComplex": True,
+                    "if_true_complex": {
+                        "dictionary": {
+                            "with": {"keys": "and_values"},
+                            "and_nested_custom_tags": "foo-bar",
+                        }
+                    },
+                    "if_false_complex": ["list", "with", "items", "foo-bar"],
+                    "if_true_simple": True,
+                    "if_false_simple": 2,
+                }
+            )
+        )
+        self.assertTrue(
+            OAuthSource.objects.filter(
+                slug="test",
+                consumer_key=environ["foo"],
+            )
+        )

    def test_export_validate_import_policies(self):
        """Test export and validate it"""
--- a/authentik/blueprints/tests/test_v1_conditions.py
+++ b/authentik/blueprints/tests/test_v1_conditions.py
@ -0,0 +1,43 @@
+"""Test blueprints v1"""
+from django.test import TransactionTestCase
+
+from authentik.blueprints.tests import load_yaml_fixture
+from authentik.blueprints.v1.importer import Importer
+from authentik.flows.models import Flow
+from authentik.lib.generators import generate_id
+
+
+class TestBlueprintsV1Conditions(TransactionTestCase):
+    """Test Blueprints conditions attribute"""
+
+    def test_conditions_fulfilled(self):
+        """Test conditions fulfilled"""
+        flow_slug1 = generate_id()
+        flow_slug2 = generate_id()
+        import_yaml = load_yaml_fixture(
+            "fixtures/conditions_fulfilled.yaml", id1=flow_slug1, id2=flow_slug2
+        )
+
+        importer = Importer(import_yaml)
+        self.assertTrue(importer.validate()[0])
+        self.assertTrue(importer.apply())
+        # Ensure objects exist
+        flow: Flow = Flow.objects.filter(slug=flow_slug1).first()
+        self.assertEqual(flow.slug, flow_slug1)
+        flow: Flow = Flow.objects.filter(slug=flow_slug2).first()
+        self.assertEqual(flow.slug, flow_slug2)
+
+    def test_conditions_not_fulfilled(self):
+        """Test conditions not fulfilled"""
+        flow_slug1 = generate_id()
+        flow_slug2 = generate_id()
+        import_yaml = load_yaml_fixture(
+            "fixtures/conditions_not_fulfilled.yaml", id1=flow_slug1, id2=flow_slug2
+        )
+
+        importer = Importer(import_yaml)
+        self.assertTrue(importer.validate()[0])
+        self.assertTrue(importer.apply())
+        # Ensure objects do not exist
+        self.assertFalse(Flow.objects.filter(slug=flow_slug1))
+        self.assertFalse(Flow.objects.filter(slug=flow_slug2))
--- a/authentik/blueprints/tests/test_v1_tasks.py
+++ b/authentik/blueprints/tests/test_v1_tasks.py
@ -67,25 +67,8 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
    @CONFIG.patch("blueprints_dir", TMP)
    def test_valid_updated(self):
        """Test valid file"""
+        BlueprintInstance.objects.filter(name="foo").delete()
        with NamedTemporaryFile(mode="w+", suffix=".yaml", dir=TMP) as file:
-            file.write(
-                dump(
-                    {
-                        "version": 1,
-                        "entries": [],
-                    }
-                )
-            )
-            file.flush()
-            blueprints_discover()  # pylint: disable=no-value-for-parameter
-            self.assertEqual(
-                BlueprintInstance.objects.first().last_applied_hash,
-                (
-                    "e52bb445b03cd36057258dc9f0ce0fbed8278498ee1470e45315293e5f026d1b"
-                    "d1f9b3526871c0003f5c07be5c3316d9d4a08444bd8fed1b3f03294e51e44522"
-                ),
-            )
-            self.assertEqual(BlueprintInstance.objects.first().metadata, {})
            file.write(
                dump(
                    {
@ -99,18 +82,44 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
            )
            file.flush()
            blueprints_discover()  # pylint: disable=no-value-for-parameter
+            blueprint = BlueprintInstance.objects.filter(name="foo").first()
            self.assertEqual(
-                BlueprintInstance.objects.first().last_applied_hash,
+                blueprint.last_applied_hash,
                (
-                    "fc62fea96067da8592bdf90927246d0ca150b045447df93b0652a0e20a8bc327"
-                    "681510b5db37ea98759c61f9a98dd2381f46a3b5a2da69dfb45158897f14e824"
+                    "b86ec439b3857350714f070d2833490e736d9155d3d97b2cac13f3b352223e5a"
+                    "1adbf8ec56fa616d46090cc4773ff9e46c4e509fde96b97de87dd21fa329ca1a"
+                ),
+            )
+            self.assertEqual(blueprint.metadata, {"labels": {}, "name": "foo"})
+            file.write(
+                dump(
+                    {
+                        "version": 1,
+                        "entries": [],
+                        "metadata": {
+                            "name": "foo",
+                            "labels": {
+                                "foo": "bar",
+                            },
+                        },
+                    }
+                )
+            )
+            file.flush()
+            blueprints_discover()  # pylint: disable=no-value-for-parameter
+            blueprint.refresh_from_db()
+            self.assertEqual(
+                blueprint.last_applied_hash,
+                (
+                    "87b68b10131d2c9751ed308bba38f04734b9e2cdf8532ed617bc52979b063c49"
+                    "2564f33f3d20ab9d5f0fd9e6eb77a13942e060199f147789cb7afab9690e72b5"
                ),
            )
            self.assertEqual(
-                BlueprintInstance.objects.first().metadata,
+                blueprint.metadata,
                {
                    "name": "foo",
-                    "labels": {},
+                    "labels": {"foo": "bar"},
                },
            )

--- a/authentik/blueprints/v1/common.py
+++ b/authentik/blueprints/v1/common.py
@ -2,7 +2,10 @@
 from collections import OrderedDict
 from dataclasses import asdict, dataclass, field, is_dataclass
 from enum import Enum
-from typing import Any, Optional
+from functools import reduce
+from operator import ixor
+from os import getenv
+from typing import Any, Literal, Optional, Union
 from uuid import UUID

 from django.apps import apps
@ -53,8 +56,11 @@ class BlueprintEntryDesiredState(Enum):
 class BlueprintEntry:
    """Single entry of a blueprint"""

-    model: str
-    state: BlueprintEntryDesiredState = field(default=BlueprintEntryDesiredState.PRESENT)
+    model: Union[str, "YAMLTag"]
+    state: Union[BlueprintEntryDesiredState, "YAMLTag"] = field(
+        default=BlueprintEntryDesiredState.PRESENT
+    )
+    conditions: list[Any] = field(default_factory=list)
    identifiers: dict[str, Any] = field(default_factory=dict)
    attrs: Optional[dict[str, Any]] = field(default_factory=dict)

@ -99,6 +105,18 @@ class BlueprintEntry:
        """Get attributes of this entry, with all yaml tags resolved"""
        return self.tag_resolver(self.identifiers, blueprint)

+    def get_state(self, blueprint: "Blueprint") -> BlueprintEntryDesiredState:
+        """Get the blueprint state, with yaml tags resolved if present"""
+        return BlueprintEntryDesiredState(self.tag_resolver(self.state, blueprint))
+
+    def get_model(self, blueprint: "Blueprint") -> str:
+        """Get the blueprint model, with yaml tags resolved if present"""
+        return str(self.tag_resolver(self.model, blueprint))
+
+    def check_all_conditions_match(self, blueprint: "Blueprint") -> bool:
+        """Check all conditions of this entry match (evaluate to True)"""
+        return all(self.tag_resolver(self.conditions, blueprint))
+

@dataclass
 class BlueprintMetadata:
@ -153,6 +171,26 @@ class KeyOf(YAMLTag):
        )


+class Env(YAMLTag):
+    """Lookup environment variable with optional default"""
+
+    key: str
+    default: Optional[Any]
+
+    # pylint: disable=unused-argument
+    def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
+        super().__init__()
+        self.default = None
+        if isinstance(node, ScalarNode):
+            self.key = node.value
+        if isinstance(node, SequenceNode):
+            self.key = node.value[0].value
+            self.default = node.value[1].value
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        return getenv(self.key, self.default)
+
+
 class Context(YAMLTag):
    """Lookup key from instance context"""

@ -188,11 +226,18 @@ class Format(YAMLTag):
        self.format_string = node.value[0].value
        self.args = []
        for raw_node in node.value[1:]:
-            self.args.append(raw_node.value)
+            self.args.append(loader.construct_object(raw_node))

    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        args = []
+        for arg in self.args:
+            if isinstance(arg, YAMLTag):
+                args.append(arg.resolve(entry, blueprint))
+            else:
+                args.append(arg)
+
        try:
-            return self.format_string % tuple(self.args)
+            return self.format_string % tuple(args)
        except TypeError as exc:
            raise EntryInvalidError(exc)

@ -219,13 +264,93 @@ class Find(YAMLTag):
    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
        query = Q()
        for cond in self.conditions:
-            query &= Q(**{cond[0]: cond[1]})
+            if isinstance(cond[0], YAMLTag):
+                query_key = cond[0].resolve(entry, blueprint)
+            else:
+                query_key = cond[0]
+            if isinstance(cond[1], YAMLTag):
+                query_value = cond[1].resolve(entry, blueprint)
+            else:
+                query_value = cond[1]
+            query &= Q(**{query_key: query_value})
        instance = self.model_class.objects.filter(query).first()
        if instance:
            return instance.pk
        return None


+class Condition(YAMLTag):
+    """Convert all values to a single boolean"""
+
+    mode: Literal["AND", "NAND", "OR", "NOR", "XOR", "XNOR"]
+    args: list[Any]
+
+    _COMPARATORS = {
+        # Using all and any here instead of from operator import iand, ior
+        # to improve performance
+        "AND": all,
+        "NAND": lambda args: not all(args),
+        "OR": any,
+        "NOR": lambda args: not any(args),
+        "XOR": lambda args: reduce(ixor, args) if len(args) > 1 else args[0],
+        "XNOR": lambda args: not (reduce(ixor, args) if len(args) > 1 else args[0]),
+    }
+
+    # pylint: disable=unused-argument
+    def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
+        super().__init__()
+        self.mode = node.value[0].value
+        self.args = []
+        for raw_node in node.value[1:]:
+            self.args.append(loader.construct_object(raw_node))
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        args = []
+        for arg in self.args:
+            if isinstance(arg, YAMLTag):
+                args.append(arg.resolve(entry, blueprint))
+            else:
+                args.append(arg)
+
+        if not args:
+            raise EntryInvalidError("At least one value is required after mode selection.")
+
+        try:
+            comparator = self._COMPARATORS[self.mode.upper()]
+            return comparator(tuple(bool(x) for x in args))
+        except (TypeError, KeyError) as exc:
+            raise EntryInvalidError(exc)
+
+
+class If(YAMLTag):
+    """Select YAML to use based on condition"""
+
+    condition: Any
+    when_true: Any
+    when_false: Any
+
+    # pylint: disable=unused-argument
+    def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
+        super().__init__()
+        self.condition = loader.construct_object(node.value[0])
+        self.when_true = loader.construct_object(node.value[1])
+        self.when_false = loader.construct_object(node.value[2])
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        if isinstance(self.condition, YAMLTag):
+            condition = self.condition.resolve(entry, blueprint)
+        else:
+            condition = self.condition
+
+        try:
+            return entry.tag_resolver(
+                self.when_true if condition else self.when_false,
+                blueprint,
+            )
+        except TypeError as exc:
+            raise EntryInvalidError(exc)
+
+
 class BlueprintDumper(SafeDumper):
    """Dump dataclasses to yaml"""

@ -266,6 +391,9 @@ class BlueprintLoader(SafeLoader):
        self.add_constructor("!Find", Find)
        self.add_constructor("!Context", Context)
        self.add_constructor("!Format", Format)
+        self.add_constructor("!Condition", Condition)
+        self.add_constructor("!If", If)
+        self.add_constructor("!Env", Env)


 class EntryInvalidError(SentryIgnoredException):
--- a/authentik/blueprints/v1/importer.py
+++ b/authentik/blueprints/v1/importer.py
@ -34,7 +34,7 @@ from authentik.core.models import (
    Source,
    UserSourceConnection,
 )
-from authentik.flows.models import Stage
+from authentik.flows.models import FlowToken, Stage
 from authentik.lib.models import SerializerModel
 from authentik.outposts.models import OutpostServiceConnection
 from authentik.policies.models import Policy, PolicyBindingModel
@ -60,6 +60,8 @@ def is_model_allowed(model: type[Model]) -> bool:
        PolicyBindingModel,
        # Classes that have other dependencies
        AuthenticatedSession,
+        # Classes which are only internally managed
+        FlowToken,
    )
    return model not in excluded_models and issubclass(model, (SerializerModel, BaseMetaModel))

@ -132,16 +134,23 @@ class Importer:
            main_query = Q(pk=attrs["pk"])
        sub_query = Q()
        for identifier, value in attrs.items():
-            if isinstance(value, dict):
-                continue
            if identifier == "pk":
                continue
-            sub_query &= Q(**{identifier: value})
+            if isinstance(value, dict):
+                sub_query &= Q(**{f"{identifier}__contains": value})
+            else:
+                sub_query &= Q(**{identifier: value})
+
        return main_query | sub_query

+    # pylint: disable-msg=too-many-locals
    def _validate_single(self, entry: BlueprintEntry) -> Optional[BaseSerializer]:
        """Validate a single entry"""
-        model_app_label, model_name = entry.model.split(".")
+        if not entry.check_all_conditions_match(self.__import):
+            self.logger.debug("One or more conditions of this entry are not fulfilled, skipping")
+            return None
+
+        model_app_label, model_name = entry.get_model(self.__import).split(".")
        model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
        # Don't use isinstance since we don't want to check for inheritance
        if not is_model_allowed(model):
@ -156,8 +165,6 @@ class Importer:
                    f"Serializer errors {serializer.errors}", serializer_errors=serializer.errors
                ) from exc
            return serializer
-        if entry.identifiers == {}:
-            raise EntryInvalidError("No identifiers")

        # If we try to validate without referencing a possible instance
        # we'll get a duplicate error, hence we load the model here and return
@ -169,12 +176,17 @@ class Importer:
            if isinstance(value, dict) and "pk" in value:
                del updated_identifiers[key]
                updated_identifiers[f"{key}"] = value["pk"]
-        existing_models = model.objects.filter(self.__query_from_identifier(updated_identifiers))
+
+        query = self.__query_from_identifier(updated_identifiers)
+        if not query:
+            raise EntryInvalidError("No or invalid identifiers")
+
+        existing_models = model.objects.filter(query)

        serializer_kwargs = {}
        model_instance = existing_models.first()
        if not isinstance(model(), BaseMetaModel) and model_instance:
-            if entry.state == BlueprintEntryDesiredState.CREATED:
+            if entry.get_state(self.__import) == BlueprintEntryDesiredState.CREATED:
                self.logger.debug("instance exists, skipping")
                return None
            self.logger.debug(
@ -198,7 +210,7 @@ class Importer:
            full_data = self.__update_pks_for_attrs(entry.get_attrs(self.__import))
        except ValueError as exc:
            raise EntryInvalidError(exc) from exc
-        full_data.update(updated_identifiers)
+        always_merger.merge(full_data, updated_identifiers)
        serializer_kwargs["data"] = full_data

        serializer: Serializer = model().serializer(**serializer_kwargs)
@ -227,7 +239,7 @@ class Importer:
        """Apply (create/update) models yaml"""
        self.__pk_map = {}
        for entry in self.__import.entries:
-            model_app_label, model_name = entry.model.split(".")
+            model_app_label, model_name = entry.get_model(self.__import).split(".")
            try:
                model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
            except LookupError:
@ -244,7 +256,8 @@ class Importer:
            if not serializer:
                continue

-            if entry.state in [
+            state = entry.get_state(self.__import)
+            if state in [
                BlueprintEntryDesiredState.PRESENT,
                BlueprintEntryDesiredState.CREATED,
            ]:
@ -253,9 +266,9 @@ class Importer:
                    self.__pk_map[entry.identifiers["pk"]] = model.pk
                entry._state = BlueprintEntryState(model)
                self.logger.debug("updated model", model=model)
-            elif entry.state == BlueprintEntryDesiredState.ABSENT:
+            elif state == BlueprintEntryDesiredState.ABSENT:
                instance: Optional[Model] = serializer.instance
-                if instance:
+                if instance.pk:
                    instance.delete()
                    self.logger.debug("deleted model", mode=instance)
                    continue
--- a/authentik/blueprints/v1/tasks.py
+++ b/authentik/blueprints/v1/tasks.py
@ -10,6 +10,13 @@ from django.utils.text import slugify
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from structlog.stdlib import get_logger
+from watchdog.events import (
+    FileCreatedEvent,
+    FileModifiedEvent,
+    FileSystemEvent,
+    FileSystemEventHandler,
+)
+from watchdog.observers import Observer
 from yaml import load
 from yaml.error import YAMLError

@ -32,6 +39,7 @@ from authentik.lib.config import CONFIG
 from authentik.root.celery import CELERY_APP

 LOGGER = get_logger()
+_file_watcher_started = False


@dataclass
@ -45,6 +53,39 @@ class BlueprintFile:
    meta: Optional[BlueprintMetadata] = field(default=None)


+def start_blueprint_watcher():
+    """Start blueprint watcher, if it's not running already."""
+    # This function might be called twice since it's called on celery startup
+    # pylint: disable=global-statement
+    global _file_watcher_started
+    if _file_watcher_started:
+        return
+    observer = Observer()
+    observer.schedule(BlueprintEventHandler(), CONFIG.y("blueprints_dir"), recursive=True)
+    observer.start()
+    _file_watcher_started = True
+
+
+class BlueprintEventHandler(FileSystemEventHandler):
+    """Event handler for blueprint events"""
+
+    def on_any_event(self, event: FileSystemEvent):
+        if not isinstance(event, (FileCreatedEvent, FileModifiedEvent)):
+            return
+        if event.is_directory:
+            return
+        if isinstance(event, FileCreatedEvent):
+            LOGGER.debug("new blueprint file created, starting discovery")
+            blueprints_discover.delay()
+        if isinstance(event, FileModifiedEvent):
+            path = Path(event.src_path)
+            root = Path(CONFIG.y("blueprints_dir")).absolute()
+            rel_path = str(path.relative_to(root))
+            for instance in BlueprintInstance.objects.filter(path=rel_path):
+                LOGGER.debug("modified blueprint file, starting apply", instance=instance)
+                apply_blueprint.delay(instance.pk.hex)
+
+
@CELERY_APP.task(
    throws=(DatabaseError, ProgrammingError, InternalError),
 )
@ -60,8 +101,7 @@ def blueprints_find():
    """Find blueprints and return valid ones"""
    blueprints = []
    root = Path(CONFIG.y("blueprints_dir"))
-    for file in root.glob("**/*.yaml"):
-        path = Path(file)
+    for path in root.glob("**/*.yaml"):
        LOGGER.debug("found blueprint", path=str(path))
        with open(path, "r", encoding="utf-8") as blueprint_file:
            try:
--- a/authentik/core/api/applications.py
+++ b/authentik/core/api/applications.py
@ -196,9 +196,9 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
        if not should_cache:
            allowed_applications = self._get_allowed_applications(queryset)
        if should_cache:
-            LOGGER.debug("Caching allowed application list")
            allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
            if not allowed_applications:
+                LOGGER.debug("Caching allowed application list")
                allowed_applications = self._get_allowed_applications(queryset)
                cache.set(
                    user_app_cache_key(self.request.user.pk),
--- a/authentik/core/api/groups.py
+++ b/authentik/core/api/groups.py
@ -2,15 +2,22 @@
 from json import loads

 from django.db.models.query import QuerySet
+from django.http import Http404
 from django_filters.filters import CharFilter, ModelMultipleChoiceFilter
 from django_filters.filterset import FilterSet
+from drf_spectacular.utils import OpenApiResponse, extend_schema
+from guardian.shortcuts import get_objects_for_user
+from rest_framework.decorators import action
 from rest_framework.fields import CharField, IntegerField, JSONField
+from rest_framework.request import Request
+from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer, ValidationError
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter

+from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import is_dict
+from authentik.core.api.utils import PassiveSerializer, is_dict
 from authentik.core.models import Group, User


@ -113,6 +120,12 @@ class GroupFilter(FilterSet):
        fields = ["name", "is_superuser", "members_by_pk", "attributes", "members_by_username"]


+class UserAccountSerializer(PassiveSerializer):
+    """Account adding/removing operations"""
+
+    pk = IntegerField(required=True)
+
+
 class GroupViewSet(UsedByMixin, ModelViewSet):
    """Group Viewset"""

@ -134,3 +147,53 @@ class GroupViewSet(UsedByMixin, ModelViewSet):
        if self.request.user.has_perm("authentik_core.view_group"):
            return self._filter_queryset_for_list(queryset)
        return super().filter_queryset(queryset)
+
+    @permission_required(None, ["authentik_core.add_user"])
+    @extend_schema(
+        request=UserAccountSerializer,
+        responses={
+            204: OpenApiResponse(description="User added"),
+            404: OpenApiResponse(description="User not found"),
+        },
+    )
+    @action(detail=True, methods=["POST"], pagination_class=None, filter_backends=[])
+    # pylint: disable=unused-argument, invalid-name
+    def add_user(self, request: Request, pk: str) -> Response:
+        """Add user to group"""
+        group: Group = self.get_object()
+        user: User = (
+            get_objects_for_user(request.user, "authentik_core.view_user")
+            .filter(
+                pk=request.data.get("pk"),
+            )
+            .first()
+        )
+        if not user:
+            raise Http404
+        group.users.add(user)
+        return Response(status=204)
+
+    @permission_required(None, ["authentik_core.add_user"])
+    @extend_schema(
+        request=UserAccountSerializer,
+        responses={
+            204: OpenApiResponse(description="User added"),
+            404: OpenApiResponse(description="User not found"),
+        },
+    )
+    @action(detail=True, methods=["POST"], pagination_class=None, filter_backends=[])
+    # pylint: disable=unused-argument, invalid-name
+    def remove_user(self, request: Request, pk: str) -> Response:
+        """Add user to group"""
+        group: Group = self.get_object()
+        user: User = (
+            get_objects_for_user(request.user, "authentik_core.view_user")
+            .filter(
+                pk=request.data.get("pk"),
+            )
+            .first()
+        )
+        if not user:
+            raise Http404
+        group.users.remove(user)
+        return Response(status=204)
--- a/authentik/core/api/utils.py
+++ b/authentik/core/api/utils.py
@ -2,7 +2,7 @@
 from typing import Any

 from django.db.models import Model
-from rest_framework.fields import CharField, IntegerField
+from rest_framework.fields import CharField, IntegerField, JSONField
 from rest_framework.serializers import Serializer, SerializerMethodField, ValidationError


@ -23,6 +23,12 @@ class PassiveSerializer(Serializer):
        return Model()


+class PropertyMappingPreviewSerializer(PassiveSerializer):
+    """Preview how the current user is mapped via the property mappings selected in a provider"""
+
+    preview = JSONField(read_only=True)
+
+
 class MetaNameSerializer(PassiveSerializer):
    """Add verbose names to response"""

--- a/authentik/core/expression/evaluator.py
+++ b/authentik/core/expression/evaluator.py
@ -1,5 +1,4 @@
 """Property Mapping Evaluator"""
-from traceback import format_tb
 from typing import Optional

 from django.db.models import Model
@ -8,6 +7,7 @@ from django.http import HttpRequest
 from authentik.core.models import User
 from authentik.events.models import Event, EventAction
 from authentik.lib.expression.evaluator import BaseEvaluator
+from authentik.lib.utils.errors import exception_to_string
 from authentik.policies.types import PolicyRequest


@ -38,7 +38,7 @@ class PropertyMappingEvaluator(BaseEvaluator):

    def handle_error(self, exc: Exception, expression_source: str):
        """Exception Handler"""
-        error_string = "\n".join(format_tb(exc.__traceback__) + [str(exc)])
+        error_string = exception_to_string(exc)
        event = Event.new(
            EventAction.PROPERTY_MAPPING_EXCEPTION,
            expression=expression_source,
--- a/authentik/core/templates/base/header_js.html
+++ b/authentik/core/templates/base/header_js.html
@ -2,10 +2,14 @@
 {% get_current_language as LANGUAGE_CODE %}

 <script>
-    window.authentik = {};
-    window.authentik.locale = "{{ LANGUAGE_CODE }}";
-    window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
-    window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
+    window.authentik = {
+        locale: "{{ LANGUAGE_CODE }}",
+        config: JSON.parse('{{ config_json|escapejs }}'),
+        tenant: JSON.parse('{{ tenant_json|escapejs }}'),
+        versionFamily: "{{ version_family }}",
+        versionSubdomain: "{{ version_subdomain }}",
+        build: "{{ build }}",
+    };
    window.addEventListener("DOMContentLoaded", () => {
        {% for message in messages %}
        window.dispatchEvent(
--- a/authentik/core/templates/base/skeleton.html
+++ b/authentik/core/templates/base/skeleton.html
@ -13,6 +13,7 @@
        <link rel="stylesheet" type="text/css" href="{% static 'dist/page.css' %}">
        <link rel="stylesheet" type="text/css" href="{% static 'dist/empty-state.css' %}">
        <link rel="stylesheet" type="text/css" href="{% static 'dist/spinner.css' %}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/dropdown.css' %}">
        {% block head_before %}
        {% endblock %}
        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">
--- a/authentik/core/tests/test_applications_api.py
+++ b/authentik/core/tests/test_applications_api.py
@ -1,6 +1,8 @@
 """Test Applications API"""
 from json import loads

+from django.core.files.base import ContentFile
+from django.test.client import BOUNDARY, MULTIPART_CONTENT, encode_multipart
 from django.urls import reverse
 from rest_framework.test import APITestCase

@ -21,7 +23,7 @@ class TestApplicationsAPI(APITestCase):
            redirect_uris="http://some-other-domain",
            authorization_flow=create_test_flow(),
        )
-        self.allowed = Application.objects.create(
+        self.allowed: Application = Application.objects.create(
            name="allowed",
            slug="allowed",
            meta_launch_url="https://goauthentik.io/%(username)s",
@ -35,6 +37,31 @@ class TestApplicationsAPI(APITestCase):
            order=0,
        )

+    def test_set_icon(self):
+        """Test set_icon"""
+        file = ContentFile(b"text", "name")
+        self.client.force_login(self.user)
+        response = self.client.post(
+            reverse(
+                "authentik_api:application-set-icon",
+                kwargs={"slug": self.allowed.slug},
+            ),
+            data=encode_multipart(data={"file": file}, boundary=BOUNDARY),
+            content_type=MULTIPART_CONTENT,
+        )
+        self.assertEqual(response.status_code, 200)
+
+        app_raw = self.client.get(
+            reverse(
+                "authentik_api:application-detail",
+                kwargs={"slug": self.allowed.slug},
+            ),
+        )
+        app = loads(app_raw.content)
+        self.allowed.refresh_from_db()
+        self.assertEqual(self.allowed.get_meta_icon, app["meta_icon"])
+        self.assertEqual(self.allowed.meta_icon.read(), b"text")
+
    def test_check_access(self):
        """Test check_access operation"""
        self.client.force_login(self.user)
--- a/authentik/core/tests/test_groups_api.py
+++ b/authentik/core/tests/test_groups_api.py
@ -0,0 +1,69 @@
+"""Test Groups API"""
+from django.urls.base import reverse
+from rest_framework.test import APITestCase
+
+from authentik.core.models import Group, User
+from authentik.core.tests.utils import create_test_admin_user
+from authentik.lib.generators import generate_id
+
+
+class TestGroupsAPI(APITestCase):
+    """Test Groups API"""
+
+    def setUp(self) -> None:
+        self.admin = create_test_admin_user()
+        self.user = User.objects.create(username="test-user")
+
+    def test_add_user(self):
+        """Test add_user"""
+        group = Group.objects.create(name=generate_id())
+        self.client.force_login(self.admin)
+        res = self.client.post(
+            reverse("authentik_api:group-add-user", kwargs={"pk": group.pk}),
+            data={
+                "pk": self.user.pk,
+            },
+        )
+        self.assertEqual(res.status_code, 204)
+        group.refresh_from_db()
+        self.assertEqual(list(group.users.all()), [self.user])
+
+    def test_add_user_404(self):
+        """Test add_user"""
+        group = Group.objects.create(name=generate_id())
+        self.client.force_login(self.admin)
+        res = self.client.post(
+            reverse("authentik_api:group-add-user", kwargs={"pk": group.pk}),
+            data={
+                "pk": self.user.pk + 3,
+            },
+        )
+        self.assertEqual(res.status_code, 404)
+
+    def test_remove_user(self):
+        """Test remove_user"""
+        group = Group.objects.create(name=generate_id())
+        group.users.add(self.user)
+        self.client.force_login(self.admin)
+        res = self.client.post(
+            reverse("authentik_api:group-remove-user", kwargs={"pk": group.pk}),
+            data={
+                "pk": self.user.pk,
+            },
+        )
+        self.assertEqual(res.status_code, 204)
+        group.refresh_from_db()
+        self.assertEqual(list(group.users.all()), [])
+
+    def test_remove_user_404(self):
+        """Test remove_user"""
+        group = Group.objects.create(name=generate_id())
+        group.users.add(self.user)
+        self.client.force_login(self.admin)
+        res = self.client.post(
+            reverse("authentik_api:group-remove-user", kwargs={"pk": group.pk}),
+            data={
+                "pk": self.user.pk + 3,
+            },
+        )
+        self.assertEqual(res.status_code, 404)
--- a/authentik/core/tests/test_models.py
+++ b/authentik/core/tests/test_models.py
@ -35,7 +35,7 @@ def source_tester_factory(test_model: type[Stage]) -> Callable:

    def tester(self: TestModels):
        model_class = None
-        if test_model._meta.abstract:
+        if test_model._meta.abstract:  # pragma: no cover
            model_class = test_model.__bases__[0]()
        else:
            model_class = test_model()
--- a/authentik/core/views/interface.py
+++ b/authentik/core/views/interface.py
@ -6,6 +6,8 @@ from django.shortcuts import get_object_or_404
 from django.views.generic.base import TemplateView
 from rest_framework.request import Request

+from authentik import get_build_hash
+from authentik.admin.tasks import LOCAL_VERSION
 from authentik.api.v3.config import ConfigView
 from authentik.flows.models import Flow
 from authentik.tenants.api import CurrentTenantSerializer
@ -17,6 +19,9 @@ class InterfaceView(TemplateView):
    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
        kwargs["config_json"] = dumps(ConfigView(request=Request(self.request)).get_config().data)
        kwargs["tenant_json"] = dumps(CurrentTenantSerializer(self.request.tenant).data)
+        kwargs["version_family"] = f"{LOCAL_VERSION.major}.{LOCAL_VERSION.minor}"
+        kwargs["version_subdomain"] = f"version-{LOCAL_VERSION.major}-{LOCAL_VERSION.minor}"
+        kwargs["build"] = get_build_hash()
        return super().get_context_data(**kwargs)


--- a/authentik/crypto/api.py
+++ b/authentik/crypto/api.py
@ -15,12 +15,14 @@ from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_sche
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField, DateTimeField, IntegerField, SerializerMethodField
+from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger

+from authentik.api.authorization import SecretKeyFilter
 from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer
@ -203,9 +205,17 @@ class CertificateKeyPairViewSet(UsedByMixin, ModelViewSet):
    filterset_class = CertificateKeyPairFilter
    ordering = ["name"]
    search_fields = ["name"]
+    filter_backends = [SecretKeyFilter, OrderingFilter, SearchFilter]

    @extend_schema(
        parameters=[
+            # Override the type for `has_key` above
+            OpenApiParameter(
+                "has_key",
+                bool,
+                required=False,
+                description="Only return certificate-key pairs with keys",
+            ),
            OpenApiParameter("include_details", bool, default=True),
        ]
    )
--- a/authentik/events/middleware.py
+++ b/authentik/events/middleware.py
@ -1,6 +1,7 @@
 """Events middleware"""
 from functools import partial
-from typing import Callable
+from threading import Thread
+from typing import Any, Callable, Optional

 from django.conf import settings
 from django.contrib.sessions.models import Session
@ -13,7 +14,6 @@ from guardian.models import UserObjectPermission

 from authentik.core.models import AuthenticatedSession, User
 from authentik.events.models import Event, EventAction, Notification
-from authentik.events.signals import EventNewThread
 from authentik.events.utils import model_to_dict
 from authentik.flows.models import FlowToken
 from authentik.lib.sentry import before_send
@ -37,6 +37,25 @@ def should_log_model(model: Model) -> bool:
    return not isinstance(model, IGNORED_MODELS)


+class EventNewThread(Thread):
+    """Create Event in background thread"""
+
+    action: str
+    request: HttpRequest
+    kwargs: dict[str, Any]
+    user: Optional[User] = None
+
+    def __init__(self, action: str, request: HttpRequest, user: Optional[User] = None, **kwargs):
+        super().__init__()
+        self.action = action
+        self.request = request
+        self.user = user
+        self.kwargs = kwargs
+
+    def run(self):
+        Event.new(self.action, **self.kwargs).from_http(self.request, user=self.user)
+
+
 class AuditMiddleware:
    """Register handlers for duration of request-response that log creation/update/deletion
    of models"""
--- a/authentik/events/models.py
+++ b/authentik/events/models.py
@ -1,7 +1,6 @@
 """authentik events models"""
 import time
 from collections import Counter
-from copy import deepcopy
 from datetime import timedelta
 from inspect import currentframe
 from smtplib import SMTPException
@ -46,7 +45,7 @@ from authentik.stages.email.utils import TemplateEmailMessage
 from authentik.tenants.models import Tenant
 from authentik.tenants.utils import DEFAULT_TENANT

-LOGGER = get_logger("authentik.events")
+LOGGER = get_logger()
 if TYPE_CHECKING:
    from rest_framework.serializers import Serializer

@ -211,7 +210,7 @@ class Event(SerializerModel, ExpiringModel):
            current = currentframe()
            parent = current.f_back
            app = parent.f_globals["__name__"]
-        cleaned_kwargs = cleanse_dict(sanitize_dict(deepcopy(kwargs)))
+        cleaned_kwargs = cleanse_dict(sanitize_dict(kwargs))
        event = Event(action=action, app=app, context=cleaned_kwargs)
        return event

--- a/authentik/events/signals.py
+++ b/authentik/events/signals.py
@ -1,5 +1,4 @@
 """authentik events signal listener"""
-from threading import Thread
 from typing import Any, Optional

 from django.contrib.auth.signals import user_logged_in, user_logged_out
@ -19,63 +18,45 @@ from authentik.stages.invitation.signals import invitation_used
 from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS
 from authentik.stages.user_write.signals import user_write

-
-class EventNewThread(Thread):
-    """Create Event in background thread"""
-
-    action: str
-    request: HttpRequest
-    kwargs: dict[str, Any]
-    user: Optional[User] = None
-
-    def __init__(self, action: str, request: HttpRequest, user: Optional[User] = None, **kwargs):
-        super().__init__()
-        self.action = action
-        self.request = request
-        self.user = user
-        self.kwargs = kwargs
-
-    def run(self):
-        Event.new(self.action, **self.kwargs).from_http(self.request, user=self.user)
+SESSION_LOGIN_EVENT = "login_event"


@receiver(user_logged_in)
 # pylint: disable=unused-argument
 def on_user_logged_in(sender, request: HttpRequest, user: User, **_):
    """Log successful login"""
-    thread = EventNewThread(EventAction.LOGIN, request)
+    kwargs = {}
    if SESSION_KEY_PLAN in request.session:
        flow_plan: FlowPlan = request.session[SESSION_KEY_PLAN]
        if PLAN_CONTEXT_SOURCE in flow_plan.context:
            # Login request came from an external source, save it in the context
-            thread.kwargs[PLAN_CONTEXT_SOURCE] = flow_plan.context[PLAN_CONTEXT_SOURCE]
+            kwargs[PLAN_CONTEXT_SOURCE] = flow_plan.context[PLAN_CONTEXT_SOURCE]
        if PLAN_CONTEXT_METHOD in flow_plan.context:
-            thread.kwargs[PLAN_CONTEXT_METHOD] = flow_plan.context[PLAN_CONTEXT_METHOD]
            # Save the login method used
-            thread.kwargs[PLAN_CONTEXT_METHOD_ARGS] = flow_plan.context.get(
-                PLAN_CONTEXT_METHOD_ARGS, {}
-            )
-    thread.user = user
-    thread.run()
+            kwargs[PLAN_CONTEXT_METHOD] = flow_plan.context[PLAN_CONTEXT_METHOD]
+            kwargs[PLAN_CONTEXT_METHOD_ARGS] = flow_plan.context.get(PLAN_CONTEXT_METHOD_ARGS, {})
+    event = Event.new(EventAction.LOGIN, **kwargs).from_http(request, user=user)
+    request.session[SESSION_LOGIN_EVENT] = event
+
+
+def get_login_event(request: HttpRequest) -> Optional[Event]:
+    """Wrapper to get login event that can be mocked in tests"""
+    return request.session.get(SESSION_LOGIN_EVENT, None)


@receiver(user_logged_out)
 # pylint: disable=unused-argument
 def on_user_logged_out(sender, request: HttpRequest, user: User, **_):
    """Log successfully logout"""
-    thread = EventNewThread(EventAction.LOGOUT, request)
-    thread.user = user
-    thread.run()
+    Event.new(EventAction.LOGOUT).from_http(request, user=user)


@receiver(user_write)
 # pylint: disable=unused-argument
 def on_user_write(sender, request: HttpRequest, user: User, data: dict[str, Any], **kwargs):
    """Log User write"""
-    thread = EventNewThread(EventAction.USER_WRITE, request, **data)
-    thread.kwargs["created"] = kwargs.get("created", False)
-    thread.user = user
-    thread.run()
+    data["created"] = kwargs.get("created", False)
+    Event.new(EventAction.USER_WRITE, **data).from_http(request, user=user)


@receiver(login_failed)
@ -89,26 +70,23 @@ def on_login_failed(
    **kwargs,
 ):
    """Failed Login, authentik custom event"""
-    thread = EventNewThread(EventAction.LOGIN_FAILED, request, **credentials, stage=stage, **kwargs)
-    thread.run()
+    Event.new(EventAction.LOGIN_FAILED, **credentials, stage=stage, **kwargs).from_http(request)


@receiver(invitation_used)
 # pylint: disable=unused-argument
 def on_invitation_used(sender, request: HttpRequest, invitation: Invitation, **_):
    """Log Invitation usage"""
-    thread = EventNewThread(
-        EventAction.INVITE_USED, request, invitation_uuid=invitation.invite_uuid.hex
+    Event.new(EventAction.INVITE_USED, invitation_uuid=invitation.invite_uuid.hex).from_http(
+        request
    )
-    thread.run()


@receiver(password_changed)
 # pylint: disable=unused-argument
 def on_password_changed(sender, user: User, password: str, **_):
    """Log password change"""
-    thread = EventNewThread(EventAction.PASSWORD_SET, None, user=user)
-    thread.run()
+    Event.new(EventAction.PASSWORD_SET).from_http(None, user=user)


@receiver(post_save, sender=Event)
--- a/authentik/events/utils.py
+++ b/authentik/events/utils.py
@ -1,5 +1,6 @@
 """event utilities"""
 import re
+from copy import copy
 from dataclasses import asdict, is_dataclass
 from pathlib import Path
 from types import GeneratorType
@ -87,9 +88,15 @@ def sanitize_item(value: Any) -> Any:
    """Sanitize a single item, ensure it is JSON parsable"""
    if is_dataclass(value):
        # Because asdict calls `copy.deepcopy(obj)` on everything that's not tuple/dict,
-        # and deepcopy doesn't work with HttpRequests (neither django nor rest_framework).
+        # and deepcopy doesn't work with HttpRequest (neither django nor rest_framework).
+        # (more specifically doesn't work with ResolverMatch)
+        # rest_framework's custom Request class makes this more complicated as it also holds a
+        # thread lock.
+        # Since this class is mainly used for Events which already hold the http request context
+        # we just remove the http_request from the shallow policy request
        # Currently, the only dataclass that actually holds an http request is a PolicyRequest
-        if isinstance(value, PolicyRequest):
+        if isinstance(value, PolicyRequest) and value.http_request is not None:
+            value: PolicyRequest = copy(value)
            value.http_request = None
        value = asdict(value)
    if isinstance(value, dict):
--- a/authentik/flows/api/flows.py
+++ b/authentik/flows/api/flows.py
@ -71,6 +71,7 @@ class FlowSerializer(ModelSerializer):
            "export_url",
            "layout",
            "denied_action",
+            "authentication",
        ]
        extra_kwargs = {
            "background": {"read_only": True},
--- a/authentik/flows/challenge.py
+++ b/authentik/flows/challenge.py
@ -1,7 +1,6 @@
 """Challenge helpers"""
 from dataclasses import asdict, is_dataclass
 from enum import Enum
-from traceback import format_tb
 from typing import TYPE_CHECKING, Optional, TypedDict
 from uuid import UUID

@ -9,8 +8,10 @@ from django.core.serializers.json import DjangoJSONEncoder
 from django.db import models
 from django.http import JsonResponse
 from rest_framework.fields import CharField, ChoiceField, DictField
+from rest_framework.request import Request

 from authentik.core.api.utils import PassiveSerializer
+from authentik.lib.utils.errors import exception_to_string

 if TYPE_CHECKING:
    from authentik.flows.stage import StageView
@ -90,32 +91,31 @@ class WithUserInfoChallenge(Challenge):
    pending_user_avatar = CharField()


-class FlowErrorChallenge(WithUserInfoChallenge):
+class FlowErrorChallenge(Challenge):
    """Challenge class when an unhandled error occurs during a stage. Normal users
    are shown an error message, superusers are shown a full stacktrace."""

-    component = CharField(default="xak-flow-error")
+    type = CharField(default=ChallengeTypes.NATIVE.value)
+    component = CharField(default="ak-stage-flow-error")

    request_id = CharField()

    error = CharField(required=False)
    traceback = CharField(required=False)

-    def __init__(self, *args, **kwargs):
-        request = kwargs.pop("request", None)
-        error = kwargs.pop("error", None)
-        super().__init__(*args, **kwargs)
+    def __init__(self, request: Optional[Request] = None, error: Optional[Exception] = None):
+        super().__init__(data={})
        if not request or not error:
            return
-        self.request_id = request.request_id
+        self.initial_data["request_id"] = request.request_id
        from authentik.core.models import USER_ATTRIBUTE_DEBUG

        if request.user and request.user.is_authenticated:
            if request.user.is_superuser or request.user.group_attributes(request).get(
                USER_ATTRIBUTE_DEBUG, False
            ):
-                self.error = error
-                self.traceback = "".join(format_tb(self.error.__traceback__))
+                self.initial_data["error"] = str(error)
+                self.initial_data["traceback"] = exception_to_string(error)


 class AccessDeniedChallenge(WithUserInfoChallenge):
--- a/authentik/flows/exceptions.py
+++ b/authentik/flows/exceptions.py
@ -1,4 +1,6 @@
 """flow exceptions"""
+from typing import Optional
+
 from django.utils.translation import gettext_lazy as _

 from authentik.lib.sentry import SentryIgnoredException
@ -6,15 +8,15 @@ from authentik.policies.types import PolicyResult


 class FlowNonApplicableException(SentryIgnoredException):
-    """Flow does not apply to current user (denied by policy)."""
+    """Flow does not apply to current user (denied by policy, or otherwise)."""

-    policy_result: PolicyResult
+    policy_result: Optional[PolicyResult] = None

    @property
    def messages(self) -> str:
        """Get messages from policy result, fallback to generic reason"""
-        if len(self.policy_result.messages) < 1:
-            return _("Flow does not apply to current user (denied by policy).")
+        if not self.policy_result or len(self.policy_result.messages) < 1:
+            return _("Flow does not apply to current user.")
        return "\n".join(self.policy_result.messages)


--- a/authentik/flows/migrations/0024_flow_authentication.py
+++ b/authentik/flows/migrations/0024_flow_authentication.py
@ -0,0 +1,27 @@
+# Generated by Django 4.1.3 on 2022-11-30 09:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_flows", "0023_flow_denied_action"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="flow",
+            name="authentication",
+            field=models.TextField(
+                choices=[
+                    ("none", "None"),
+                    ("require_authenticated", "Require Authenticated"),
+                    ("require_unauthenticated", "Require Unauthenticated"),
+                    ("require_superuser", "Require Superuser"),
+                ],
+                default="none",
+                help_text="Required level of authentication and authorization to access a flow.",
+            ),
+        ),
+    ]
--- a/authentik/flows/models.py
+++ b/authentik/flows/models.py
@ -14,6 +14,7 @@ from authentik.core.models import Token
 from authentik.core.types import UserSettingSerializer
 from authentik.flows.challenge import FlowLayout
 from authentik.lib.models import InheritanceForeignKey, SerializerModel
+from authentik.lib.utils.reflection import class_to_path
 from authentik.policies.models import PolicyBindingModel

 if TYPE_CHECKING:
@ -23,6 +24,15 @@ if TYPE_CHECKING:
 LOGGER = get_logger()


+class FlowAuthenticationRequirement(models.TextChoices):
+    """Required level of authentication and authorization to access a flow"""
+
+    NONE = "none"
+    REQUIRE_AUTHENTICATED = "require_authenticated"
+    REQUIRE_UNAUTHENTICATED = "require_unauthenticated"
+    REQUIRE_SUPERUSER = "require_superuser"
+
+
 class NotConfiguredAction(models.TextChoices):
    """Decides how the FlowExecutor should proceed when a stage isn't configured"""

@ -101,6 +111,8 @@ def in_memory_stage(view: type["StageView"], **kwargs) -> Stage:
    # we set the view as a separate property and reference a generic function
    # that returns that member
    setattr(stage, "__in_memory_type", view)
+    setattr(stage, "name", _("Dynamic In-memory stage: %(doc)s" % {"doc": view.__doc__}))
+    setattr(stage._meta, "verbose_name", class_to_path(view))
    for key, value in kwargs.items():
        setattr(stage, key, value)
    return stage
@ -152,6 +164,12 @@ class Flow(SerializerModel, PolicyBindingModel):
        help_text=_("Configure what should happen when a flow denies access to a user."),
    )

+    authentication = models.TextField(
+        choices=FlowAuthenticationRequirement.choices,
+        default=FlowAuthenticationRequirement.NONE,
+        help_text=_("Required level of authentication and authorization to access a flow."),
+    )
+
    @property
    def background_url(self) -> str:
        """Get the URL to the background image. If the name is /static or starts with http
--- a/authentik/flows/planner.py
+++ b/authentik/flows/planner.py
@ -13,7 +13,14 @@ from authentik.events.models import cleanse_dict
 from authentik.flows.apps import HIST_FLOWS_PLAN_TIME
 from authentik.flows.exceptions import EmptyFlowException, FlowNonApplicableException
 from authentik.flows.markers import ReevaluateMarker, StageMarker
-from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding, Stage, in_memory_stage
+from authentik.flows.models import (
+    Flow,
+    FlowAuthenticationRequirement,
+    FlowDesignation,
+    FlowStageBinding,
+    Stage,
+    in_memory_stage,
+)
 from authentik.lib.config import CONFIG
 from authentik.policies.engine import PolicyEngine

@ -117,11 +124,30 @@ class FlowPlanner:
        self.flow = flow
        self._logger = get_logger().bind(flow_slug=flow.slug)

+    def _check_authentication(self, request: HttpRequest):
+        """Check the flow's authentication level is matched by `request`"""
+        if (
+            self.flow.authentication == FlowAuthenticationRequirement.REQUIRE_AUTHENTICATED
+            and not request.user.is_authenticated
+        ):
+            raise FlowNonApplicableException()
+        if (
+            self.flow.authentication == FlowAuthenticationRequirement.REQUIRE_UNAUTHENTICATED
+            and request.user.is_authenticated
+        ):
+            raise FlowNonApplicableException()
+        if (
+            self.flow.authentication == FlowAuthenticationRequirement.REQUIRE_SUPERUSER
+            and not request.user.is_superuser
+        ):
+            raise FlowNonApplicableException()
+
    def plan(
        self, request: HttpRequest, default_context: Optional[dict[str, Any]] = None
    ) -> FlowPlan:
        """Check each of the flows' policies, check policies for each stage with PolicyBinding
        and return ordered list"""
+        self._check_authentication(request)
        with Hub.current.start_span(
            op="authentik.flow.planner.plan", description=self.flow.slug
        ) as span:
--- a/authentik/flows/tests/test_planner.py
+++ b/authentik/flows/tests/test_planner.py
@ -1,6 +1,7 @@
 """flow planner tests"""
 from unittest.mock import MagicMock, Mock, PropertyMock, patch

+from django.contrib.auth.models import AnonymousUser
 from django.contrib.sessions.middleware import SessionMiddleware
 from django.core.cache import cache
 from django.test import RequestFactory, TestCase
@ -8,10 +9,10 @@ from django.urls import reverse
 from guardian.shortcuts import get_anonymous_user

 from authentik.core.models import User
-from authentik.core.tests.utils import create_test_flow
+from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.flows.exceptions import EmptyFlowException, FlowNonApplicableException
 from authentik.flows.markers import ReevaluateMarker, StageMarker
-from authentik.flows.models import FlowDesignation, FlowStageBinding
+from authentik.flows.models import FlowAuthenticationRequirement, FlowDesignation, FlowStageBinding
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner, cache_key
 from authentik.lib.tests.utils import dummy_get_response
 from authentik.policies.dummy.models import DummyPolicy
@ -43,6 +44,30 @@ class TestFlowPlanner(TestCase):
            planner = FlowPlanner(flow)
            planner.plan(request)

+    def test_authentication(self):
+        """Test flow authentication"""
+        flow = create_test_flow()
+        flow.authentication = FlowAuthenticationRequirement.NONE
+        request = self.request_factory.get(
+            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
+        )
+        request.user = AnonymousUser()
+        planner = FlowPlanner(flow)
+        planner.allow_empty_flows = True
+        planner.plan(request)
+
+        with self.assertRaises(FlowNonApplicableException):
+            flow.authentication = FlowAuthenticationRequirement.REQUIRE_AUTHENTICATED
+            FlowPlanner(flow).plan(request)
+        with self.assertRaises(FlowNonApplicableException):
+            flow.authentication = FlowAuthenticationRequirement.REQUIRE_SUPERUSER
+            FlowPlanner(flow).plan(request)
+
+        request.user = create_test_admin_user()
+        planner = FlowPlanner(flow)
+        planner.allow_empty_flows = True
+        planner.plan(request)
+
    @patch(
        "authentik.policies.engine.PolicyEngine.result",
        POLICY_RETURN_FALSE,
--- a/authentik/flows/views/executor.py
+++ b/authentik/flows/views/executor.py
@ -162,7 +162,7 @@ class FlowExecutorView(APIView):
            token.delete()
        if not isinstance(plan, FlowPlan):
            return None
-        plan.context[PLAN_CONTEXT_IS_RESTORED] = True
+        plan.context[PLAN_CONTEXT_IS_RESTORED] = token
        self._logger.debug("f(exec): restored flow plan from token", plan=plan)
        return plan

@ -255,7 +255,7 @@ class FlowExecutorView(APIView):
            message=exception_to_string(exc),
        ).from_http(self.request)
        challenge = FlowErrorChallenge(self.request, exc)
-        challenge.is_valid()
+        challenge.is_valid(raise_exception=True)
        return to_stage_response(self.request, HttpChallengeResponse(challenge))

    @extend_schema(
@ -378,7 +378,9 @@ class FlowExecutorView(APIView):
            # an expression policy or authentik itself, so we don't
            # check if its an absolute URL or a relative one
            self.cancel()
-            return redirect(self.plan.context.get(PLAN_CONTEXT_REDIRECT))
+            return to_stage_response(
+                self.request, redirect(self.plan.context.get(PLAN_CONTEXT_REDIRECT))
+            )
        next_param = self.request.session.get(SESSION_KEY_GET, {}).get(
            NEXT_ARG_NAME, "authentik_core:root-redirect"
        )
--- a/authentik/lib/default.yml
+++ b/authentik/lib/default.yml
@ -29,10 +29,9 @@ debug: false

 log_level: info

-# Error reporting, sends stacktrace to sentry.beryju.org
 error_reporting:
  enabled: false
-  sentry_dsn: https://a579bb09306d4f8b8d8847c052d3a1d3@sentry.beryju.org/8
+  sentry_dsn: https://151ba72610234c4c97c5bcff4e1cffd8@o4504163616882688.ingest.sentry.io/4504163677503489
  environment: customer
  send_pii: false
  sample_rate: 0.1
--- a/authentik/lib/expression/evaluator.py
+++ b/authentik/lib/expression/evaluator.py
@ -42,7 +42,7 @@ class BaseEvaluator:
            "ak_user_by": BaseEvaluator.expr_user_by,
            "ak_user_has_authenticator": BaseEvaluator.expr_func_user_has_authenticator,
            "ak_create_event": self.expr_event_create,
-            "ak_logger": get_logger(self._filename),
+            "ak_logger": get_logger(self._filename).bind(),
            "requests": get_http_session(),
            "ip_address": ip_address,
            "ip_network": ip_network,
--- a/authentik/lib/sentry.py
+++ b/authentik/lib/sentry.py
@ -66,6 +66,9 @@ def sentry_init(**sentry_init_kwargs):
    kwargs = {
        "environment": sentry_env,
        "send_default_pii": CONFIG.y_bool("error_reporting.send_pii", False),
+        "_experiments": {
+            "profiles_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.1)),
+        },
    }
    kwargs.update(**sentry_init_kwargs)
    # pylint: disable=abstract-class-instantiated
--- a/authentik/lib/tests/test_serializer_model.py
+++ b/authentik/lib/tests/test_serializer_model.py
@ -19,7 +19,7 @@ def model_tester_factory(test_model: type[Stage]) -> Callable:
    def tester(self: TestModels):
        try:
            model_class = None
-            if test_model._meta.abstract:
+            if test_model._meta.abstract:  # pragma: no cover
                return
            model_class = test_model()
            self.assertTrue(issubclass(model_class.serializer, BaseSerializer))
--- a/authentik/lib/utils/file.py
+++ b/authentik/lib/utils/file.py
@ -24,17 +24,17 @@ class FilePathSerializer(PassiveSerializer):
    url = CharField()


-def set_file(request: Request, obj: Model, field: str):
+def set_file(request: Request, obj: Model, field_name: str):
    """Upload file"""
-    field = getattr(obj, field)
-    icon = request.FILES.get("file", None)
+    field = getattr(obj, field_name)
+    file = request.FILES.get("file", None)
    clear = request.data.get("clear", "false").lower() == "true"
    if clear:
        # .delete() saves the model by default
        field.delete()
        return Response({})
-    if icon:
-        field = icon
+    if file:
+        setattr(obj, field_name, file)
        try:
            obj.save()
        except PermissionError as exc:
--- a/authentik/lib/utils/reflection.py
+++ b/authentik/lib/utils/reflection.py
@ -48,14 +48,14 @@ def get_apps():

 def get_env() -> str:
    """Get environment in which authentik is currently running"""
-    if SERVICE_HOST_ENV_NAME in os.environ:
-        return "kubernetes"
    if "CI" in os.environ:
        return "ci"
-    if Path("/tmp/authentik-mode").exists():  # nosec
-        return "compose"
    if CONFIG.y_bool("debug"):
        return "dev"
+    if SERVICE_HOST_ENV_NAME in os.environ:
+        return "kubernetes"
+    if Path("/tmp/authentik-mode").exists():  # nosec
+        return "compose"
    if "AK_APPLIANCE" in os.environ:
        return os.environ["AK_APPLIANCE"]
    return "custom"
--- a/authentik/outposts/api/outposts.py
+++ b/authentik/outposts/api/outposts.py
@ -19,7 +19,13 @@ from authentik.core.api.utils import PassiveSerializer, is_dict
 from authentik.core.models import Provider
 from authentik.outposts.api.service_connections import ServiceConnectionSerializer
 from authentik.outposts.apps import MANAGED_OUTPOST
-from authentik.outposts.models import Outpost, OutpostConfig, OutpostType, default_outpost_config
+from authentik.outposts.models import (
+    Outpost,
+    OutpostConfig,
+    OutpostState,
+    OutpostType,
+    default_outpost_config,
+)
 from authentik.providers.ldap.models import LDAPProvider
 from authentik.providers.proxy.models import ProxyProvider

@ -96,6 +102,7 @@ class OutpostDefaultConfigSerializer(PassiveSerializer):
 class OutpostHealthSerializer(PassiveSerializer):
    """Outpost health status"""

+    uid = CharField(read_only=True)
    last_seen = DateTimeField(read_only=True)
    version = CharField(read_only=True)
    version_should = CharField(read_only=True)
@ -105,6 +112,8 @@ class OutpostHealthSerializer(PassiveSerializer):
    build_hash = CharField(read_only=True, required=False)
    build_hash_should = CharField(read_only=True, required=False)

+    hostname = CharField(read_only=True, required=False)
+

 class OutpostFilter(FilterSet):
    """Filter for Outposts"""
@ -145,13 +154,16 @@ class OutpostViewSet(UsedByMixin, ModelViewSet):
        outpost: Outpost = self.get_object()
        states = []
        for state in outpost.state:
+            state: OutpostState
            states.append(
                {
+                    "uid": state.uid,
                    "last_seen": state.last_seen,
                    "version": state.version,
                    "version_should": state.version_should,
                    "version_outdated": state.version_outdated,
                    "build_hash": state.build_hash,
+                    "hostname": state.hostname,
                    "build_hash_should": get_build_hash(),
                }
            )
--- a/authentik/outposts/channels.py
+++ b/authentik/outposts/channels.py
@ -98,6 +98,7 @@ class OutpostConsumer(AuthJsonConsumer):
        if self.channel_name not in state.channel_ids:
            state.channel_ids.append(self.channel_name)
        state.last_seen = datetime.now()
+        state.hostname = msg.args.get("hostname", "")

        if not self.first_msg:
            GAUGE_OUTPOSTS_CONNECTED.labels(
--- a/authentik/outposts/models.py
+++ b/authentik/outposts/models.py
@ -13,7 +13,7 @@ from django.utils.translation import gettext_lazy as _
 from guardian.models import UserObjectPermission
 from guardian.shortcuts import assign_perm
 from model_utils.managers import InheritanceManager
-from packaging.version import LegacyVersion, Version, parse
+from packaging.version import Version, parse
 from rest_framework.serializers import Serializer
 from structlog.stdlib import get_logger

@ -429,8 +429,9 @@ class OutpostState:
    channel_ids: list[str] = field(default_factory=list)
    last_seen: Optional[datetime] = field(default=None)
    version: Optional[str] = field(default=None)
-    version_should: Version | LegacyVersion = field(default=OUR_VERSION)
+    version_should: Version = field(default=OUR_VERSION)
    build_hash: str = field(default="")
+    hostname: str = field(default="")

    _outpost: Optional[Outpost] = field(default=None)

--- a/authentik/policies/expression/evaluator.py
+++ b/authentik/policies/expression/evaluator.py
@ -87,7 +87,7 @@ class PolicyEvaluator(BaseEvaluator):
                LOGGER.warning(
                    "Expression policy returned None",
                    src=expression_source,
-                    req=self._context,
+                    policy=self._filename,
                )
                policy_result.passing = False
            if result:
--- a/authentik/policies/migrations/0009_alter_policy_name.py
+++ b/authentik/policies/migrations/0009_alter_policy_name.py
@ -0,0 +1,19 @@
+# Generated by Django 4.1.4 on 2022-12-25 13:46
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_policies", "0008_policybinding_authentik_p_policy__534e15_idx_and_more"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="policy",
+            name="name",
+            field=models.TextField(default="unnamed-policy"),
+            preserve_default=False,
+        ),
+    ]
--- a/authentik/policies/models.py
+++ b/authentik/policies/models.py
@ -159,7 +159,7 @@ class Policy(SerializerModel, CreatedUpdatedModel):

    policy_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)

-    name = models.TextField(blank=True, null=True)
+    name = models.TextField()

    execution_logging = models.BooleanField(
        default=False,
--- a/authentik/policies/password/models.py
+++ b/authentik/policies/password/models.py
@ -150,6 +150,8 @@ class PasswordPolicy(Policy):
        results = zxcvbn(password[:100], user_inputs)
        LOGGER.debug("password failed", check="zxcvbn", score=results["score"])
        result = PolicyResult(results["score"] > self.zxcvbn_score_threshold)
+        if not result.passing:
+            result.messages += tuple((_("Password is too weak."),))
        if isinstance(results["feedback"]["warning"], list):
            result.messages += tuple(results["feedback"]["warning"])
        if isinstance(results["feedback"]["suggestions"], list):
--- a/authentik/policies/password/tests/test_zxcvbn.py
+++ b/authentik/policies/password/tests/test_zxcvbn.py
@ -28,13 +28,21 @@ class TestPasswordPolicyZxcvbn(TestCase):
        policy = PasswordPolicy.objects.create(
            check_zxcvbn=True,
            check_static_rules=False,
+            zxcvbn_score_threshold=3,
            name="test_false",
        )
        request = PolicyRequest(get_anonymous_user())
        request.context[PLAN_CONTEXT_PROMPT] = {"password": "password"}  # nosec
        result: PolicyResult = policy.passes(request)
        self.assertFalse(result.passing, result.messages)
-        self.assertEqual(result.messages[0], "Add another word or two. Uncommon words are better.")
+        self.assertEqual(result.messages[0], "Password is too weak.")
+        self.assertEqual(result.messages[1], "Add another word or two. Uncommon words are better.")
+
+        request.context[PLAN_CONTEXT_PROMPT] = {"password": "Awdccdw1234"}  # nosec
+        result: PolicyResult = policy.passes(request)
+        self.assertFalse(result.passing, result.messages)
+        self.assertEqual(result.messages[0], "Password is too weak.")
+        self.assertEqual(len(result.messages), 1)

    def test_true(self):
        """Positive password case"""
--- a/authentik/policies/process.py
+++ b/authentik/policies/process.py
@ -101,12 +101,14 @@ class PolicyProcess(PROCESS_CLASS):
            LOGGER.debug("P_ENG(proc): error", exc=src_exc)
            policy_result = PolicyResult(False, str(src_exc))
        policy_result.source_binding = self.binding
-        if self.request.should_cache:
+        should_cache = self.request.should_cache
+        if should_cache:
            key = cache_key(self.binding, self.request)
            cache.set(key, policy_result, CACHE_TIMEOUT)
        LOGGER.debug(
-            "P_ENG(proc): finished and cached ",
+            "P_ENG(proc): finished",
            policy=self.binding.policy,
+            cached=should_cache,
            result=policy_result,
            # this is used for filtering in access checking where logs are sent to the admin
            process="PolicyProcess",
--- a/authentik/policies/tests/test_process.py
+++ b/authentik/policies/tests/test_process.py
@ -2,6 +2,7 @@
 from django.contrib.auth.models import AnonymousUser
 from django.core.cache import cache
 from django.test import RequestFactory, TestCase
+from django.urls import resolve, reverse
 from guardian.shortcuts import get_anonymous_user

 from authentik.core.models import Application, Group, User
@ -129,8 +130,9 @@ class TestPolicyProcess(TestCase):
        )
        binding = PolicyBinding(policy=policy, target=Application.objects.create(name="test"))

-        http_request = self.factory.get("/")
+        http_request = self.factory.get(reverse("authentik_core:impersonate-end"))
        http_request.user = self.user
+        http_request.resolver_match = resolve(reverse("authentik_core:impersonate-end"))

        request = PolicyRequest(self.user)
        request.set_http_request(http_request)
--- a/authentik/providers/oauth2/api/providers.py
+++ b/authentik/providers/oauth2/api/providers.py
@ -8,11 +8,12 @@ from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet

+from authentik.api.decorators import permission_required
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import PassiveSerializer
+from authentik.core.api.utils import PassiveSerializer, PropertyMappingPreviewSerializer
 from authentik.core.models import Provider
-from authentik.providers.oauth2.models import OAuth2Provider
+from authentik.providers.oauth2.models import OAuth2Provider, RefreshToken, ScopeMapping


 class OAuth2ProviderSerializer(ProviderSerializer):
@ -115,7 +116,7 @@ class OAuth2ProviderViewSet(UsedByMixin, ModelViewSet):
            )
            data["logout"] = request.build_absolute_uri(
                reverse(
-                    "authentik_core:if-session-end",
+                    "authentik_providers_oauth2:end-session",
                    kwargs={"application_slug": provider.application.slug},
                )
            )
@ -128,3 +129,28 @@ class OAuth2ProviderViewSet(UsedByMixin, ModelViewSet):
        except Provider.application.RelatedObjectDoesNotExist:  # pylint: disable=no-member
            pass
        return Response(data)
+
+    @permission_required(
+        "authentik_providers_oauth2.view_oauth2provider",
+    )
+    @extend_schema(
+        responses={
+            200: PropertyMappingPreviewSerializer(),
+            400: OpenApiResponse(description="Bad request"),
+        },
+    )
+    @action(detail=True, methods=["GET"])
+    # pylint: disable=invalid-name, unused-argument
+    def preview_user(self, request: Request, pk: int) -> Response:
+        """Preview user data for provider"""
+        provider: OAuth2Provider = self.get_object()
+        temp_token = RefreshToken()
+        temp_token.scope = ScopeMapping.objects.filter(provider=provider).values_list(
+            "scope_name", flat=True
+        )
+        temp_token.provider = provider
+        temp_token.user = request.user
+        serializer = PropertyMappingPreviewSerializer(
+            instance={"preview": temp_token.create_id_token(request.user, request).to_dict()}
+        )
+        return Response(serializer.data)
--- a/authentik/providers/oauth2/api/scopes.py
+++ b/authentik/providers/oauth2/api/scopes.py
--- a/authentik/providers/oauth2/api/tokens.py
+++ b/authentik/providers/oauth2/api/tokens.py
@ -12,7 +12,7 @@ from rest_framework.viewsets import GenericViewSet
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import MetaNameSerializer
-from authentik.providers.oauth2.api.provider import OAuth2ProviderSerializer
+from authentik.providers.oauth2.api.providers import OAuth2ProviderSerializer
 from authentik.providers.oauth2.models import AuthorizationCode, RefreshToken


--- a/authentik/providers/oauth2/constants.py
+++ b/authentik/providers/oauth2/constants.py
@ -31,3 +31,9 @@ SCOPE_GITHUB_USER_EMAIL = "user:email"
 SCOPE_GITHUB_ORG_READ = "read:org"

 ACR_AUTHENTIK_DEFAULT = "goauthentik.io/providers/oauth2/default"
+
+# https://datatracker.ietf.org/doc/html/draft-ietf-oauth-amr-values-06#section-2
+AMR_PASSWORD = "pwd"  # nosec
+AMR_MFA = "mfa"
+AMR_OTP = "otp"
+AMR_WEBAUTHN = "user"
--- a/authentik/providers/oauth2/models.py
+++ b/authentik/providers/oauth2/models.py
@ -4,12 +4,14 @@ import binascii
 import json
 from dataclasses import asdict, dataclass, field
 from datetime import datetime, timedelta
+from functools import cached_property
 from hashlib import sha256
 from typing import Any, Optional
 from urllib.parse import urlparse, urlunparse

 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES
 from dacite.core import from_dict
 from django.db import models
 from django.http import HttpRequest
@ -20,14 +22,19 @@ from rest_framework.serializers import Serializer

 from authentik.core.models import ExpiringModel, PropertyMapping, Provider, User
 from authentik.crypto.models import CertificateKeyPair
-from authentik.events.models import Event, EventAction
-from authentik.events.utils import get_user
+from authentik.events.signals import get_login_event
 from authentik.lib.generators import generate_code_fixed_length, generate_id, generate_key
 from authentik.lib.models import SerializerModel
 from authentik.lib.utils.time import timedelta_string_validator
 from authentik.providers.oauth2.apps import AuthentikProviderOAuth2Config
-from authentik.providers.oauth2.constants import ACR_AUTHENTIK_DEFAULT
+from authentik.providers.oauth2.constants import (
+    ACR_AUTHENTIK_DEFAULT,
+    AMR_MFA,
+    AMR_PASSWORD,
+    AMR_WEBAUTHN,
+)
 from authentik.sources.oauth.models import OAuthSource
+from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS


 class ClientTypes(models.TextChoices):
@ -122,7 +129,7 @@ class ScopeMapping(PropertyMapping):

    @property
    def serializer(self) -> type[Serializer]:
-        from authentik.providers.oauth2.api.scope import ScopeMappingSerializer
+        from authentik.providers.oauth2.api.scopes import ScopeMappingSerializer

        return ScopeMappingSerializer

@ -253,7 +260,8 @@ class OAuth2Provider(Provider):
        token.access_token = token.create_access_token(user, request)
        return token

-    def get_jwt_key(self) -> tuple[str, str]:
+    @cached_property
+    def jwt_key(self) -> tuple[str | PRIVATE_KEY_TYPES, str]:
        """Get either the configured certificate or the client secret"""
        if not self.signing_key:
            # No Certificate at all, assume HS256
@ -261,9 +269,9 @@ class OAuth2Provider(Provider):
        key: CertificateKeyPair = self.signing_key
        private_key = key.private_key
        if isinstance(private_key, RSAPrivateKey):
-            return key.key_data, JWTAlgorithms.RS256
+            return private_key, JWTAlgorithms.RS256
        if isinstance(private_key, EllipticCurvePrivateKey):
-            return key.key_data, JWTAlgorithms.ES256
+            return private_key, JWTAlgorithms.ES256
        raise Exception(f"Invalid private key type: {type(private_key)}")

    def get_issuer(self, request: HttpRequest) -> Optional[str]:
@ -294,7 +302,7 @@ class OAuth2Provider(Provider):

    @property
    def serializer(self) -> type[Serializer]:
-        from authentik.providers.oauth2.api.provider import OAuth2ProviderSerializer
+        from authentik.providers.oauth2.api.providers import OAuth2ProviderSerializer

        return OAuth2ProviderSerializer

@ -306,10 +314,9 @@ class OAuth2Provider(Provider):
        headers = {}
        if self.signing_key:
            headers["kid"] = self.signing_key.kid
-        key, alg = self.get_jwt_key()
+        key, alg = self.jwt_key
        # If the provider does not have an RSA Key assigned, it was switched to Symmetric
        self.refresh_from_db()
-        # pyright: reportGeneralTypeIssues=false
        return encode(payload, key, algorithm=alg, headers=headers)

    class Meta:
@ -392,6 +399,7 @@ class IDToken:
    iat: Optional[int] = None
    auth_time: Optional[int] = None
    acr: Optional[str] = ACR_AUTHENTIK_DEFAULT
+    amr: Optional[list[str]] = None

    c_hash: Optional[str] = None
    nonce: Optional[str] = None
@ -410,6 +418,8 @@ class IDToken:
            id_dict.pop("nonce")
        if not self.c_hash:
            id_dict.pop("c_hash")
+        if not self.amr:
+            id_dict.pop("amr")
        id_dict.pop("claims")
        id_dict.update(self.claims)
        return id_dict
@ -466,6 +476,7 @@ class RefreshToken(SerializerModel, ExpiringModel, BaseGrantModel):
        token["uid"] = generate_key()
        return self.provider.encode(token)

+    # pylint: disable=too-many-locals
    def create_id_token(self, user: User, request: HttpRequest) -> IDToken:
        """Creates the id_token.
        See: http://openid.net/specs/openid-connect-core-1_0.html#IDToken"""
@ -485,21 +496,27 @@ class RefreshToken(SerializerModel, ExpiringModel, BaseGrantModel):
                    f"selected: {self.provider.sub_mode}"
                )
            )
-
+        amr = []
        # Convert datetimes into timestamps.
        now = datetime.now()
        iat_time = int(now.timestamp())
        exp_time = int(self.expires.timestamp())
        # We use the timestamp of the user's last successful login (EventAction.LOGIN) for auth_time
-        auth_event = (
-            Event.objects.filter(action=EventAction.LOGIN, user=get_user(user))
-            .order_by("-created")
-            .first()
-        )
        # Fallback in case we can't find any login events
        auth_time = now
+        auth_event = get_login_event(request)
        if auth_event:
            auth_time = auth_event.created
+            # Also check which method was used for authentication
+            method = auth_event.context.get(PLAN_CONTEXT_METHOD, "")
+            method_args = auth_event.context.get(PLAN_CONTEXT_METHOD_ARGS, {})
+            if method == "password":
+                amr.append(AMR_PASSWORD)
+            if method == "auth_webauthn_pwl":
+                amr.append(AMR_WEBAUTHN)
+            if "mfa_devices" in method_args:
+                if len(amr) > 0:
+                    amr.append(AMR_MFA)

        auth_timestamp = int(auth_time.timestamp())

@ -510,6 +527,7 @@ class RefreshToken(SerializerModel, ExpiringModel, BaseGrantModel):
            exp=exp_time,
            iat=iat_time,
            auth_time=auth_timestamp,
+            amr=amr if amr else None,
        )

        # Include (or not) user standard claims in the id_token.
--- a/authentik/providers/oauth2/tests/test_api.py
+++ b/authentik/providers/oauth2/tests/test_api.py
@ -0,0 +1,47 @@
+"""Test OAuth2 API"""
+from json import loads
+
+from django.urls import reverse
+from rest_framework.test import APITestCase
+
+from authentik.blueprints.tests import apply_blueprint
+from authentik.core.models import Application
+from authentik.core.tests.utils import create_test_admin_user, create_test_flow
+from authentik.lib.generators import generate_id, generate_key
+from authentik.providers.oauth2.models import OAuth2Provider, ScopeMapping
+
+
+class TestAPI(APITestCase):
+    """Test api view"""
+
+    @apply_blueprint("system/providers-oauth2.yaml")
+    def setUp(self) -> None:
+        self.provider: OAuth2Provider = OAuth2Provider.objects.create(
+            name="test",
+            client_id=generate_id(),
+            client_secret=generate_key(),
+            authorization_flow=create_test_flow(),
+            redirect_uris="http://testserver",
+        )
+        self.provider.property_mappings.set(ScopeMapping.objects.all())
+        self.app = Application.objects.create(name="test", slug="test", provider=self.provider)
+        self.user = create_test_admin_user()
+        self.client.force_login(self.user)
+
+    def test_preview(self):
+        """Test Preview API Endpoint"""
+        response = self.client.get(
+            reverse("authentik_api:oauth2provider-preview-user", kwargs={"pk": self.provider.pk})
+        )
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())["preview"]
+        self.assertEqual(body["iss"], "http://testserver/application/o/test/")
+
+    def test_setup_urls(self):
+        """Test Setup URLs API Endpoint"""
+        response = self.client.get(
+            reverse("authentik_api:oauth2provider-setup-urls", kwargs={"pk": self.provider.pk})
+        )
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())
+        self.assertEqual(body["issuer"], "http://testserver/application/o/test/")
--- a/authentik/providers/oauth2/tests/test_authorize.py
+++ b/authentik/providers/oauth2/tests/test_authorize.py
@ -1,10 +1,13 @@
 """Test authorize view"""
+from unittest.mock import MagicMock, patch
+
 from django.test import RequestFactory
 from django.urls import reverse
 from django.utils.timezone import now

 from authentik.core.models import Application
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
+from authentik.events.models import Event, EventAction
 from authentik.flows.challenge import ChallengeTypes
 from authentik.lib.generators import generate_id, generate_key
 from authentik.lib.utils.time import timedelta_from_string
@ -17,6 +20,7 @@ from authentik.providers.oauth2.models import (
 )
 from authentik.providers.oauth2.tests.utils import OAuthTestCase
 from authentik.providers.oauth2.views.authorize import OAuthAuthorizationParams
+from authentik.stages.password.stage import PLAN_CONTEXT_METHOD


 class TestAuthorize(OAuthTestCase):
@ -302,40 +306,51 @@ class TestAuthorize(OAuthTestCase):
        state = generate_id()
        user = create_test_admin_user()
        self.client.force_login(user)
-        # Step 1, initiate params and get redirect to flow
-        self.client.get(
-            reverse("authentik_providers_oauth2:authorize"),
-            data={
-                "response_type": "id_token",
-                "client_id": "test",
-                "state": state,
-                "scope": "openid",
-                "redirect_uri": "http://localhost",
-            },
-        )
-        response = self.client.get(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
-        )
-        token: RefreshToken = RefreshToken.objects.filter(user=user).first()
-        expires = timedelta_from_string(provider.access_code_validity).total_seconds()
-        self.assertJSONEqual(
-            response.content.decode(),
-            {
-                "component": "xak-flow-redirect",
-                "type": ChallengeTypes.REDIRECT.value,
-                "to": (
-                    f"http://localhost#access_token={token.access_token}"
-                    f"&id_token={provider.encode(token.id_token.to_dict())}&token_type=bearer"
-                    f"&expires_in={int(expires)}&state={state}"
-                ),
-            },
-        )
-        jwt = self.validate_jwt(token, provider)
-        self.assertAlmostEqual(
-            jwt["exp"] - now().timestamp(),
-            expires,
-            delta=5,
-        )
+        with patch(
+            "authentik.providers.oauth2.models.get_login_event",
+            MagicMock(
+                return_value=Event(
+                    action=EventAction.LOGIN,
+                    context={PLAN_CONTEXT_METHOD: "password"},
+                    created=now(),
+                )
+            ),
+        ):
+            # Step 1, initiate params and get redirect to flow
+            self.client.get(
+                reverse("authentik_providers_oauth2:authorize"),
+                data={
+                    "response_type": "id_token",
+                    "client_id": "test",
+                    "state": state,
+                    "scope": "openid",
+                    "redirect_uri": "http://localhost",
+                },
+            )
+            response = self.client.get(
+                reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
+            )
+            token: RefreshToken = RefreshToken.objects.filter(user=user).first()
+            expires = timedelta_from_string(provider.access_code_validity).total_seconds()
+            self.assertJSONEqual(
+                response.content.decode(),
+                {
+                    "component": "xak-flow-redirect",
+                    "type": ChallengeTypes.REDIRECT.value,
+                    "to": (
+                        f"http://localhost#access_token={token.access_token}"
+                        f"&id_token={provider.encode(token.id_token.to_dict())}&token_type=bearer"
+                        f"&expires_in={int(expires)}&state={state}"
+                    ),
+                },
+            )
+            jwt = self.validate_jwt(token, provider)
+            self.assertEqual(jwt["amr"], ["pwd"])
+            self.assertAlmostEqual(
+                jwt["exp"] - now().timestamp(),
+                expires,
+                delta=5,
+            )

    def test_full_form_post_id_token(self):
        """Test full authorization (form_post response)"""
--- a/authentik/providers/oauth2/tests/test_token_cc.py
+++ b/authentik/providers/oauth2/tests/test_token_cc.py
@ -143,7 +143,7 @@ class TestTokenClientCredentials(OAuthTestCase):
        self.assertEqual(response.status_code, 200)
        body = loads(response.content.decode())
        self.assertEqual(body["token_type"], "bearer")
-        _, alg = self.provider.get_jwt_key()
+        _, alg = self.provider.jwt_key
        jwt = decode(
            body["access_token"],
            key=self.provider.signing_key.public_key,
--- a/authentik/providers/oauth2/tests/test_token_cc_jwt_source.py
+++ b/authentik/providers/oauth2/tests/test_token_cc_jwt_source.py
@ -210,7 +210,7 @@ class TestTokenClientCredentialsJWTSource(OAuthTestCase):
        self.assertEqual(response.status_code, 200)
        body = loads(response.content.decode())
        self.assertEqual(body["token_type"], "bearer")
-        _, alg = self.provider.get_jwt_key()
+        _, alg = self.provider.jwt_key
        jwt = decode(
            body["access_token"],
            key=self.provider.signing_key.public_key,
--- a/authentik/providers/oauth2/tests/utils.py
+++ b/authentik/providers/oauth2/tests/utils.py
@ -27,9 +27,14 @@ class OAuthTestCase(TestCase):
        cls.keypair = create_test_cert()
        super().setUpClass()

+    def assert_non_none_or_unset(self, container: dict, key: str):
+        """Check that a key, if set, is not none"""
+        if key in container:
+            self.assertIsNotNone(container[key])
+
    def validate_jwt(self, token: RefreshToken, provider: OAuth2Provider) -> dict[str, Any]:
        """Validate that all required fields are set"""
-        key, alg = provider.get_jwt_key()
+        key, alg = provider.jwt_key
        if alg != JWTAlgorithms.HS256:
            key = provider.signing_key.public_key
        jwt = decode(
@ -39,6 +44,10 @@ class OAuthTestCase(TestCase):
            audience=provider.client_id,
        )
        id_token = token.id_token.to_dict()
+        self.assert_non_none_or_unset(id_token, "at_hash")
+        self.assert_non_none_or_unset(id_token, "nonce")
+        self.assert_non_none_or_unset(id_token, "c_hash")
+        self.assert_non_none_or_unset(id_token, "amr")
        for key in self.required_jwt_keys:
            self.assertIsNotNone(jwt[key], f"Key {key} is missing in access_token")
            self.assertIsNotNone(id_token[key], f"Key {key} is missing in id_token")
--- a/authentik/providers/oauth2/views/provider.py
+++ b/authentik/providers/oauth2/views/provider.py
@ -17,7 +17,12 @@ from authentik.providers.oauth2.constants import (
    GRANT_TYPE_REFRESH_TOKEN,
    SCOPE_OPENID,
 )
-from authentik.providers.oauth2.models import OAuth2Provider, ResponseTypes, ScopeMapping
+from authentik.providers.oauth2.models import (
+    OAuth2Provider,
+    ResponseMode,
+    ResponseTypes,
+    ScopeMapping,
+)
 from authentik.providers.oauth2.utils import cors_allow

 LOGGER = get_logger()
@ -38,7 +43,7 @@ class ProviderInfoView(View):
        )
        if SCOPE_OPENID not in scopes:
            scopes.append(SCOPE_OPENID)
-        _, supported_alg = provider.get_jwt_key()
+        _, supported_alg = provider.jwt_key
        return {
            "issuer": provider.get_issuer(self.request),
            "authorization_endpoint": self.request.build_absolute_uri(
@ -52,7 +57,7 @@ class ProviderInfoView(View):
            ),
            "end_session_endpoint": self.request.build_absolute_uri(
                reverse(
-                    "authentik_core:if-session-end",
+                    "authentik_providers_oauth2:end-session",
                    kwargs={"application_slug": provider.application.slug},
                )
            ),
@ -73,6 +78,11 @@ class ProviderInfoView(View):
                ResponseTypes.CODE_ID_TOKEN,
                ResponseTypes.CODE_ID_TOKEN_TOKEN,
            ],
+            "response_modes_supported": [
+                ResponseMode.QUERY,
+                ResponseMode.FRAGMENT,
+                ResponseMode.FORM_POST,
+            ],
            "jwks_uri": self.request.build_absolute_uri(
                reverse(
                    "authentik_providers_oauth2:jwks",
--- a/authentik/providers/proxy/api.py
+++ b/authentik/providers/proxy/api.py
@ -1,6 +1,7 @@
 """ProxyProvider API Views"""
 from typing import Any, Optional

+from django.utils.translation import gettext_lazy as _
 from drf_spectacular.utils import extend_schema_field
 from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField, ListField, ReadOnlyField, SerializerMethodField
@ -39,22 +40,34 @@ class ProxyProviderSerializer(ProviderSerializer):
    redirect_uris = CharField(read_only=True)
    outpost_set = ListField(child=CharField(), read_only=True, source="outpost_set.all")

+    def validate_basic_auth_enabled(self, value: bool) -> bool:
+        """Ensure user and password attributes are set"""
+        if value:
+            if (
+                self.initial_data.get("basic_auth_password_attribute", "") == ""
+                or self.initial_data.get("basic_auth_user_attribute", "") == ""
+            ):
+                raise ValidationError(
+                    _("User and password attributes must be set when basic auth is enabled.")
+                )
+        return value
+
    def validate(self, attrs) -> dict[Any, str]:
        """Check that internal_host is set when mode is Proxy"""
        if (
            attrs.get("mode", ProxyMode.PROXY) == ProxyMode.PROXY
            and attrs.get("internal_host", "") == ""
        ):
-            raise ValidationError("Internal host cannot be empty when forward auth is disabled.")
+            raise ValidationError(_("Internal host cannot be empty when forward auth is disabled."))
        return attrs

-    def create(self, validated_data):
+    def create(self, validated_data: dict):
        instance: ProxyProvider = super().create(validated_data)
        instance.set_oauth_defaults()
        instance.save()
        return instance

-    def update(self, instance: ProxyProvider, validated_data):
+    def update(self, instance: ProxyProvider, validated_data: dict):
        instance = super().update(instance, validated_data)
        instance.set_oauth_defaults()
        instance.save()
--- a/authentik/providers/proxy/tests.py
+++ b/authentik/providers/proxy/tests.py
@ -0,0 +1,122 @@
+"""proxy provider tests"""
+from django.urls import reverse
+from rest_framework.test import APITestCase
+
+from authentik.core.tests.utils import create_test_admin_user, create_test_flow
+from authentik.lib.generators import generate_id
+from authentik.providers.oauth2.models import ClientTypes
+from authentik.providers.proxy.models import ProxyMode, ProxyProvider
+
+
+class ProxyProviderTests(APITestCase):
+    """proxy provider tests"""
+
+    def setUp(self) -> None:
+        self.user = create_test_admin_user()
+        self.client.force_login(self.user)
+
+    def test_basic_auth(self):
+        """Test basic_auth_enabled"""
+        response = self.client.post(
+            reverse("authentik_api:proxyprovider-list"),
+            {
+                "name": generate_id(),
+                "mode": ProxyMode.PROXY,
+                "authorization_flow": create_test_flow().pk.hex,
+                "external_host": "http://localhost",
+                "internal_host": "http://localhost",
+                "basic_auth_enabled": True,
+                "basic_auth_user_attribute": generate_id(),
+                "basic_auth_password_attribute": generate_id(),
+            },
+        )
+        self.assertEqual(response.status_code, 201)
+
+    def test_basic_auth_invalid(self):
+        """Test basic_auth_enabled"""
+        response = self.client.post(
+            reverse("authentik_api:proxyprovider-list"),
+            {
+                "name": generate_id(),
+                "mode": ProxyMode.PROXY,
+                "authorization_flow": create_test_flow().pk.hex,
+                "external_host": "http://localhost",
+                "internal_host": "http://localhost",
+                "basic_auth_enabled": True,
+            },
+        )
+        self.assertEqual(response.status_code, 400)
+        self.assertJSONEqual(
+            response.content.decode(),
+            {
+                "basic_auth_enabled": [
+                    "User and password attributes must be set when basic auth is enabled."
+                ]
+            },
+        )
+
+    def test_validate(self):
+        """Test validate"""
+        response = self.client.post(
+            reverse("authentik_api:proxyprovider-list"),
+            {
+                "name": generate_id(),
+                "mode": ProxyMode.PROXY,
+                "authorization_flow": create_test_flow().pk.hex,
+                "external_host": "http://localhost",
+            },
+        )
+        self.assertEqual(response.status_code, 400)
+        self.assertJSONEqual(
+            response.content.decode(),
+            {"non_field_errors": ["Internal host cannot be empty when forward auth is disabled."]},
+        )
+
+    def test_create_defaults(self):
+        """Test create"""
+        name = generate_id()
+        response = self.client.post(
+            reverse("authentik_api:proxyprovider-list"),
+            {
+                "name": name,
+                "mode": ProxyMode.PROXY,
+                "authorization_flow": create_test_flow().pk.hex,
+                "external_host": "http://localhost",
+                "internal_host": "http://localhost",
+            },
+        )
+        self.assertEqual(response.status_code, 201)
+        provider: ProxyProvider = ProxyProvider.objects.get(name=name)
+        self.assertEqual(provider.client_type, ClientTypes.CONFIDENTIAL)
+
+    def test_update_defaults(self):
+        """Test create"""
+        name = generate_id()
+        response = self.client.post(
+            reverse("authentik_api:proxyprovider-list"),
+            {
+                "name": name,
+                "mode": ProxyMode.PROXY,
+                "authorization_flow": create_test_flow().pk.hex,
+                "external_host": "http://localhost",
+                "internal_host": "http://localhost",
+            },
+        )
+        self.assertEqual(response.status_code, 201)
+        provider: ProxyProvider = ProxyProvider.objects.get(name=name)
+        self.assertEqual(provider.client_type, ClientTypes.CONFIDENTIAL)
+        provider.client_type = ClientTypes.PUBLIC
+        provider.save()
+        response = self.client.put(
+            reverse("authentik_api:proxyprovider-detail", kwargs={"pk": provider.pk}),
+            {
+                "name": name,
+                "mode": ProxyMode.PROXY,
+                "authorization_flow": create_test_flow().pk.hex,
+                "external_host": "http://localhost",
+                "internal_host": "http://localhost",
+            },
+        )
+        self.assertEqual(response.status_code, 200)
+        provider: ProxyProvider = ProxyProvider.objects.get(name=name)
+        self.assertEqual(provider.client_type, ClientTypes.CONFIDENTIAL)
--- a/authentik/providers/saml/api/init.py
+++ b/authentik/providers/saml/api/init.py
--- a/authentik/providers/saml/api/property_mapping.py
+++ b/authentik/providers/saml/api/property_mapping.py
@ -0,0 +1,42 @@
+"""SAML Property mappings API Views"""
+from django_filters.filters import AllValuesMultipleFilter
+from django_filters.filterset import FilterSet
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import extend_schema_field
+from rest_framework.viewsets import ModelViewSet
+
+from authentik.core.api.propertymappings import PropertyMappingSerializer
+from authentik.core.api.used_by import UsedByMixin
+from authentik.providers.saml.models import SAMLPropertyMapping
+
+
+class SAMLPropertyMappingSerializer(PropertyMappingSerializer):
+    """SAMLPropertyMapping Serializer"""
+
+    class Meta:
+
+        model = SAMLPropertyMapping
+        fields = PropertyMappingSerializer.Meta.fields + [
+            "saml_name",
+            "friendly_name",
+        ]
+
+
+class SAMLPropertyMappingFilter(FilterSet):
+    """Filter for SAMLPropertyMapping"""
+
+    managed = extend_schema_field(OpenApiTypes.STR)(AllValuesMultipleFilter(field_name="managed"))
+
+    class Meta:
+        model = SAMLPropertyMapping
+        fields = "__all__"
+
+
+class SAMLPropertyMappingViewSet(UsedByMixin, ModelViewSet):
+    """SAMLPropertyMapping Viewset"""
+
+    queryset = SAMLPropertyMapping.objects.all()
+    serializer_class = SAMLPropertyMappingSerializer
+    filterset_class = SAMLPropertyMappingFilter
+    search_fields = ["name"]
+    ordering = ["name"]
--- a/authentik/providers/saml/api/providers.py
+++ b/authentik/providers/saml/api/providers.py
@ -7,15 +7,8 @@ from django.http.response import Http404, HttpResponse
 from django.shortcuts import get_object_or_404
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
-from django_filters.filters import AllValuesMultipleFilter
-from django_filters.filterset import FilterSet
 from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import (
-    OpenApiParameter,
-    OpenApiResponse,
-    extend_schema,
-    extend_schema_field,
-)
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, FileField, SerializerMethodField
 from rest_framework.parsers import MultiPartParser
@ -28,15 +21,16 @@ from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger

 from authentik.api.decorators import permission_required
-from authentik.core.api.propertymappings import PropertyMappingSerializer
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import PassiveSerializer
+from authentik.core.api.utils import PassiveSerializer, PropertyMappingPreviewSerializer
 from authentik.core.models import Provider
 from authentik.flows.models import Flow, FlowDesignation
-from authentik.providers.saml.models import SAMLPropertyMapping, SAMLProvider
+from authentik.providers.saml.models import SAMLProvider
+from authentik.providers.saml.processors.assertion import AssertionProcessor
 from authentik.providers.saml.processors.metadata import MetadataProcessor
 from authentik.providers.saml.processors.metadata_parser import ServiceProviderMetadataParser
+from authentik.providers.saml.processors.request_parser import AuthNRequest
 from authentik.sources.saml.processors.constants import SAML_BINDING_POST, SAML_BINDING_REDIRECT

 LOGGER = get_logger()
@ -53,6 +47,8 @@ class SAMLProviderSerializer(ProviderSerializer):

    def get_url_download_metadata(self, instance: SAMLProvider) -> str:
        """Get metadata download URL"""
+        if "request" not in self._context:
+            return ""
        request: HttpRequest = self._context["request"]._request
        return request.build_absolute_uri(
            reverse("authentik_api:samlprovider-metadata", kwargs={"pk": instance.pk}) + "?download"
@ -60,6 +56,8 @@ class SAMLProviderSerializer(ProviderSerializer):

    def get_url_sso_post(self, instance: SAMLProvider) -> str:
        """Get SSO Post URL"""
+        if "request" not in self._context:
+            return ""
        request: HttpRequest = self._context["request"]._request
        try:
            return request.build_absolute_uri(
@ -73,6 +71,8 @@ class SAMLProviderSerializer(ProviderSerializer):

    def get_url_sso_redirect(self, instance: SAMLProvider) -> str:
        """Get SSO Redirect URL"""
+        if "request" not in self._context:
+            return ""
        request: HttpRequest = self._context["request"]._request
        try:
            return request.build_absolute_uri(
@ -86,6 +86,8 @@ class SAMLProviderSerializer(ProviderSerializer):

    def get_url_sso_init(self, instance: SAMLProvider) -> str:
        """Get SSO IDP-Initiated URL"""
+        if "request" not in self._context:
+            return ""
        request: HttpRequest = self._context["request"]._request
        try:
            return request.build_absolute_uri(
@ -236,34 +238,31 @@ class SAMLProviderViewSet(UsedByMixin, ModelViewSet):
            )
        return Response(status=204)

-
-class SAMLPropertyMappingSerializer(PropertyMappingSerializer):
-    """SAMLPropertyMapping Serializer"""
-
-    class Meta:
-
-        model = SAMLPropertyMapping
-        fields = PropertyMappingSerializer.Meta.fields + [
-            "saml_name",
-            "friendly_name",
-        ]
-
-
-class SAMLPropertyMappingFilter(FilterSet):
-    """Filter for SAMLPropertyMapping"""
-
-    managed = extend_schema_field(OpenApiTypes.STR)(AllValuesMultipleFilter(field_name="managed"))
-
-    class Meta:
-        model = SAMLPropertyMapping
-        fields = "__all__"
-
-
-class SAMLPropertyMappingViewSet(UsedByMixin, ModelViewSet):
-    """SAMLPropertyMapping Viewset"""
-
-    queryset = SAMLPropertyMapping.objects.all()
-    serializer_class = SAMLPropertyMappingSerializer
-    filterset_class = SAMLPropertyMappingFilter
-    search_fields = ["name"]
-    ordering = ["name"]
+    @permission_required(
+        "authentik_providers_saml.view_samlprovider",
+    )
+    @extend_schema(
+        responses={
+            200: PropertyMappingPreviewSerializer(),
+            400: OpenApiResponse(description="Bad request"),
+        },
+    )
+    @action(detail=True, methods=["GET"])
+    # pylint: disable=invalid-name, unused-argument
+    def preview_user(self, request: Request, pk: int) -> Response:
+        """Preview user data for provider"""
+        provider: SAMLProvider = self.get_object()
+        processor = AssertionProcessor(provider, request._request, AuthNRequest())
+        attributes = processor.get_attributes()
+        name_id = processor.get_name_id()
+        data = []
+        for attribute in attributes:
+            item = {"Value": []}
+            item.update(attribute.attrib)
+            for value in attribute:
+                item["Value"].append(value.text)
+            data.append(item)
+        serializer = PropertyMappingPreviewSerializer(
+            instance={"preview": {"attributes": data, "nameID": name_id.text}}
+        )
+        return Response(serializer.data)
--- a/authentik/providers/saml/models.py
+++ b/authentik/providers/saml/models.py
@ -164,7 +164,7 @@ class SAMLProvider(Provider):

    @property
    def serializer(self) -> type[Serializer]:
-        from authentik.providers.saml.api import SAMLProviderSerializer
+        from authentik.providers.saml.api.providers import SAMLProviderSerializer

        return SAMLProviderSerializer

@ -193,7 +193,7 @@ class SAMLPropertyMapping(PropertyMapping):

    @property
    def serializer(self) -> type[Serializer]:
-        from authentik.providers.saml.api import SAMLPropertyMappingSerializer
+        from authentik.providers.saml.api.property_mapping import SAMLPropertyMappingSerializer

        return SAMLPropertyMappingSerializer

--- a/authentik/providers/saml/processors/assertion.py
+++ b/authentik/providers/saml/processors/assertion.py
@ -10,6 +10,7 @@ from structlog.stdlib import get_logger

 from authentik.core.exceptions import PropertyMappingExpressionException
 from authentik.events.models import Event, EventAction
+from authentik.events.signals import get_login_event
 from authentik.lib.utils.time import timedelta_from_string
 from authentik.providers.saml.models import SAMLPropertyMapping, SAMLProvider
 from authentik.providers.saml.processors.request_parser import AuthNRequest
@ -30,6 +31,7 @@ from authentik.sources.saml.processors.constants import (
    SAML_NAME_ID_FORMAT_X509,
    SIGN_ALGORITHM_TRANSFORM_MAP,
 )
+from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS

 LOGGER = get_logger()

@ -129,9 +131,23 @@ class AssertionProcessor:
        auth_n_context_class_ref = SubElement(
            auth_n_context, f"{{{NS_SAML_ASSERTION}}}AuthnContextClassRef"
        )
-        auth_n_context_class_ref.text = (
-            "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
-        )
+        auth_n_context_class_ref.text = "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
+        event = get_login_event(self.http_request)
+        if event:
+            method = event.context.get(PLAN_CONTEXT_METHOD, "")
+            method_args = event.context.get(PLAN_CONTEXT_METHOD_ARGS, {})
+            if method == "password":
+                auth_n_context_class_ref.text = (
+                    "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+                )
+            if "mfa_devices" in method_args:
+                auth_n_context_class_ref.text = (
+                    "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract"
+                )
+            if method in ["auth_mfa", "auth_webauthn_pwl"]:
+                auth_n_context_class_ref.text = (
+                    "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract"
+                )
        return auth_n_statement

    def get_assertion_conditions(self) -> Element:
--- a/authentik/providers/saml/processors/metadata.py
+++ b/authentik/providers/saml/processors/metadata.py
@ -13,6 +13,7 @@ from authentik.sources.saml.processors.constants import (
    DIGEST_ALGORITHM_TRANSLATION_MAP,
    NS_MAP,
    NS_SAML_METADATA,
+    NS_SAML_PROTOCOL,
    NS_SIGNATURE,
    SAML_BINDING_POST,
    SAML_BINDING_REDIRECT,
@ -35,7 +36,7 @@ class MetadataProcessor:
        self.provider = provider
        self.http_request = request
        self.force_binding = None
-        self.xml_id = sha256(f"{provider.name}-{provider.pk}".encode("ascii")).hexdigest()
+        self.xml_id = "_" + sha256(f"{provider.name}-{provider.pk}".encode("ascii")).hexdigest()

    def get_signing_key_descriptor(self) -> Optional[Element]:
        """Get Signing KeyDescriptor, if enabled for the provider"""
@ -143,9 +144,7 @@ class MetadataProcessor:
        idp_sso_descriptor = SubElement(
            entity_descriptor, f"{{{NS_SAML_METADATA}}}IDPSSODescriptor"
        )
-        idp_sso_descriptor.attrib[
-            "protocolSupportEnumeration"
-        ] = "urn:oasis:names:tc:SAML:2.0:protocol"
+        idp_sso_descriptor.attrib["protocolSupportEnumeration"] = NS_SAML_PROTOCOL

        signing_descriptor = self.get_signing_key_descriptor()
        if signing_descriptor is not None:
--- a/authentik/providers/saml/tests/test_api.py
+++ b/authentik/providers/saml/tests/test_api.py
@ -1,13 +1,15 @@
 """SAML Provider API Tests"""
+from json import loads
 from tempfile import TemporaryFile

 from django.urls import reverse
 from rest_framework.test import APITestCase

+from authentik.blueprints.tests import apply_blueprint
 from authentik.core.models import Application
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.flows.models import FlowDesignation
-from authentik.providers.saml.models import SAMLProvider
+from authentik.providers.saml.models import SAMLPropertyMapping, SAMLProvider
 from authentik.providers.saml.tests.test_metadata import METADATA_SIMPLE


@ -107,3 +109,24 @@ class TestSAMLProviderAPI(APITestCase):
            format="multipart",
        )
        self.assertEqual(400, response.status_code)
+
+    @apply_blueprint("system/providers-saml.yaml")
+    def test_preview(self):
+        """Test Preview API Endpoint"""
+        provider: SAMLProvider = SAMLProvider.objects.create(
+            name="test",
+            authorization_flow=create_test_flow(),
+        )
+        provider.property_mappings.set(SAMLPropertyMapping.objects.all())
+        Application.objects.create(name="test", provider=provider, slug="test")
+        response = self.client.get(
+            reverse("authentik_api:samlprovider-preview-user", kwargs={"pk": provider.pk})
+        )
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())["preview"]["attributes"]
+        self.assertEqual(
+            [x for x in body if x["Name"] == "http://schemas.goauthentik.io/2021/02/saml/username"][
+                0
+            ]["Value"],
+            [self.user.username],
+        )
--- a/authentik/root/celery.py
+++ b/authentik/root/celery.py
@ -99,6 +99,9 @@ def worker_ready_hook(*args, **kwargs):
            task.delay()
        except ProgrammingError as exc:
            LOGGER.warning("Startup task failed", task=task, exc=exc)
+    from authentik.blueprints.v1.tasks import start_blueprint_watcher
+
+    start_blueprint_watcher()


 # Using a string here means the worker doesn't have to serialize
--- a/authentik/root/settings.py
+++ b/authentik/root/settings.py
@ -436,6 +436,7 @@ _LOGGING_HANDLER_MAP = {
    "asyncio": "WARNING",
    "redis": "WARNING",
    "silk": "INFO",
+    "fsevents": "WARNING",
 }
 for handler_name, level in _LOGGING_HANDLER_MAP.items():
    # pyright: reportGeneralTypeIssues=false
@ -452,22 +453,29 @@ _DISALLOWED_ITEMS = [
    "AUTHENTICATION_BACKENDS",
    "CELERY_BEAT_SCHEDULE",
 ]
-# Load subapps's INSTALLED_APPS
+
+
+def _update_settings(app_path: str):
+    try:
+        settings_module = importlib.import_module(app_path)
+        CONFIG.log("debug", "Loaded app settings", path=app_path)
+        INSTALLED_APPS.extend(getattr(settings_module, "INSTALLED_APPS", []))
+        MIDDLEWARE.extend(getattr(settings_module, "MIDDLEWARE", []))
+        AUTHENTICATION_BACKENDS.extend(getattr(settings_module, "AUTHENTICATION_BACKENDS", []))
+        CELERY_BEAT_SCHEDULE.update(getattr(settings_module, "CELERY_BEAT_SCHEDULE", {}))
+        for _attr in dir(settings_module):
+            if not _attr.startswith("__") and _attr not in _DISALLOWED_ITEMS:
+                globals()[_attr] = getattr(settings_module, _attr)
+    except ImportError:
+        pass
+
+
+# Load subapps's settings
 for _app in INSTALLED_APPS:
-    if _app.startswith("authentik"):
-        if "apps" in _app:
-            _app = ".".join(_app.split(".")[:-2])
-        try:
-            app_settings = importlib.import_module(f"{_app}.settings")
-            INSTALLED_APPS.extend(getattr(app_settings, "INSTALLED_APPS", []))
-            MIDDLEWARE.extend(getattr(app_settings, "MIDDLEWARE", []))
-            AUTHENTICATION_BACKENDS.extend(getattr(app_settings, "AUTHENTICATION_BACKENDS", []))
-            CELERY_BEAT_SCHEDULE.update(getattr(app_settings, "CELERY_BEAT_SCHEDULE", {}))
-            for _attr in dir(app_settings):
-                if not _attr.startswith("__") and _attr not in _DISALLOWED_ITEMS:
-                    globals()[_attr] = getattr(app_settings, _attr)
-        except ImportError:
-            pass
+    if not _app.startswith("authentik"):
+        continue
+    _update_settings(f"{_app}.settings")
+_update_settings("data.user_settings")

 if DEBUG:
    CELERY_TASK_ALWAYS_EAGER = True
--- a/authentik/root/test_runner.py
+++ b/authentik/root/test_runner.py
@ -34,7 +34,7 @@ class PytestTestRunner:  # pragma: no cover
            "outposts.container_image_base",
            f"ghcr.io/goauthentik/dev-%(type)s:{get_docker_tag()}",
        )
-        CONFIG.y_set("error_reporting.sample_rate", 1.0)
+        CONFIG.y_set("error_reporting.sample_rate", 0)
        sentry_init(
            environment="testing",
            send_default_pii=True,
--- a/authentik/sources/saml/api/source.py
+++ b/authentik/sources/saml/api/source.py
@ -8,7 +8,7 @@ from rest_framework.viewsets import ModelViewSet

 from authentik.core.api.sources import SourceSerializer
 from authentik.core.api.used_by import UsedByMixin
-from authentik.providers.saml.api import SAMLMetadataSerializer
+from authentik.providers.saml.api.providers import SAMLMetadataSerializer
 from authentik.sources.saml.models import SAMLSource
 from authentik.sources.saml.processors.metadata import MetadataProcessor

--- a/authentik/stages/authenticator_duo/api.py
+++ b/authentik/stages/authenticator_duo/api.py
@ -128,6 +128,7 @@ class AuthenticatorDuoStageViewSet(UsedByMixin, ModelViewSet):
            duo_user_id=request.data.get("duo_user_id"),
            user=user,
            stage=stage,
+            confirmed=True,
            name="Imported Duo Authenticator",
        )
        return Response(status=204)
--- a/Show More
+++ b/Show More