release: 2023.8.7

security: fix CVE-2024-23647 (#8345)

* security: fix CVE-2024-23647



* add tests



* add website



---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Jens L <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.6.2
+current_version = 2023.8.7
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)

.dockerignore

@@ -7,3 +7,4 @@ build/**
 build_docs/**
 Dockerfile
 authentik/enterprise
+blueprints/local

.github/actions/setup/action.yml

@@ -14,7 +14,7 @@ runs:
       run: |
         pipx install poetry || true
         sudo apt update
-        sudo apt install -y libxmlsec1-dev pkg-config gettext
+        sudo apt install -y libpq-dev openssl libxmlsec1-dev pkg-config gettext
     - name: Setup python and restore poetry
       uses: actions/setup-python@v3
       with:
@@ -23,7 +23,7 @@ runs:
     - name: Setup node
       uses: actions/setup-node@v3
       with:
-        node-version: "20"
+        node-version: "20.5"
         cache: "npm"
         cache-dependency-path: web/package-lock.json
     - name: Setup dependencies

.github/cherry-pick-bot.yml

@@ -0,0 +1,2 @@
+enabled: true
+preservePullRequestTitle: true

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "ci:"
+    labels:
+      - dependencies
   - package-ecosystem: gomod
     directory: "/"
     schedule:
@@ -16,11 +18,15 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "core:"
+    labels:
+      - dependencies
   - package-ecosystem: npm
     directory: "/web"
     schedule:
       interval: daily
       time: "04:00"
+    labels:
+      - dependencies
     open-pull-requests-limit: 10
     commit-message:
       prefix: "web:"
@@ -32,10 +38,18 @@ updates:
         patterns:
           - "@babel/*"
           - "babel-*"
+      eslint:
+        patterns:
+          - "@typescript-eslint/eslint-*"
+          - "eslint"
+          - "eslint-*"
       storybook:
         patterns:
           - "@storybook/*"
           - "*storybook*"
+      esbuild:
+        patterns:
+          - "@esbuild/*"
   - package-ecosystem: npm
     directory: "/website"
     schedule:
@@ -44,6 +58,8 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "website:"
+    labels:
+      - dependencies
     groups:
       docusaurus:
         patterns:
@@ -56,6 +72,8 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "core:"
+    labels:
+      - dependencies
   - package-ecosystem: docker
     directory: "/"
     schedule:
@@ -64,3 +82,5 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "core:"
+    labels:
+      - dependencies

.github/pull_request_template.md

@@ -1,23 +1,19 @@
 <!--
-👋 Hello there! Welcome.
+👋 Hi there! Welcome.
 
-Please check the [Contributing guidelines](https://goauthentik.io/developer-docs/#how-can-i-contribute).
+Please check the Contributing guidelines: https://goauthentik.io/developer-docs/#how-can-i-contribute
 -->
 
 ## Details
 
--   **Does this resolve an issue?**
-    Resolves #
+<!--
+Explain what this PR changes, what the rationale behind the change is, if any new requirements are introduced or any breaking changes caused by this PR.
 
-## Changes
+Ideally also link an Issue for context that this PR will close using `closes #`
+-->
+REPLACE ME
 
-### New Features
-
--   Adds feature which does x, y, and z.
-
-### Breaking Changes
-
--   Adds breaking change which causes \<issue\>.
+---
 
 ## Checklist
 

.github/workflows/ci-main.yml

@@ -11,6 +11,7 @@ on:
   pull_request:
     branches:
       - main
+      - version-*
 
 env:
   POSTGRES_DB: authentik
@@ -88,8 +89,8 @@ jobs:
       fail-fast: false
       matrix:
         psql:
-          - 11-alpine
           - 12-alpine
+          - 15-alpine
     steps:
       - uses: actions/checkout@v3
       - name: Setup authentik env
@@ -112,7 +113,7 @@ jobs:
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.7.0
+        uses: helm/kind-action@v1.8.0
       - name: run integration
         run: |
           poetry run coverage run manage.py test tests/integration
@@ -184,6 +185,9 @@ jobs:
   build:
     needs: ci-core-mark
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload contianer images to ghcr.io
+      packages: write
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v3
@@ -229,6 +233,9 @@ jobs:
   build-arm64:
     needs: ci-core-mark
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload contianer images to ghcr.io
+      packages: write
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v3

.github/workflows/ci-outpost.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     branches:
       - main
+      - version-*
 
 jobs:
   lint-golint:
@@ -63,6 +64,9 @@ jobs:
           - ldap
           - radius
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload contianer images to ghcr.io
+      packages: write
     steps:
       - uses: actions/checkout@v3
         with:
@@ -120,9 +124,9 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - name: Generate API

.github/workflows/ci-web.yml

@@ -9,15 +9,16 @@ on:
   pull_request:
     branches:
       - main
+      - version-*
 
 jobs:
   lint-eslint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -30,10 +31,10 @@ jobs:
   lint-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -46,10 +47,10 @@ jobs:
   lint-prettier:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -62,10 +63,10 @@ jobs:
   lint-lit-analyse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -94,10 +95,10 @@ jobs:
       - ci-web-mark
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/

.github/workflows/ci-website.yml

@@ -9,15 +9,16 @@ on:
   pull_request:
     branches:
       - main
+      - version-*
 
 jobs:
   lint-prettier:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: website/package-lock.json
       - working-directory: website/
@@ -28,10 +29,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: website/package-lock.json
       - working-directory: website/
@@ -49,10 +50,10 @@ jobs:
           - build
           - build-docs-only
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: website/package-lock.json
       - working-directory: website/

.github/workflows/gha-cache-cleanup.yml

@@ -0,0 +1,34 @@
+---
+# See https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#force-deleting-cache-entries
+name: Cleanup cache after PR is closed
+on:
+  pull_request:
+    types:
+      - closed
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Cleanup
+        run: |
+          gh extension install actions/gh-actions-cache
+
+          REPO=${{ github.repository }}
+          BRANCH="refs/pull/${{ github.event.pull_request.number }}/merge"
+
+          echo "Fetching list of cache key"
+          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 | cut -f 1 )
+
+          # Setting this to not fail the workflow while deleting cache keys.
+          set +e
+          echo "Deleting caches..."
+          for cacheKey in $cacheKeysForPR; do
+              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
+          done
+          echo "Done"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/image-compress.yml

@@ -0,0 +1,61 @@
+---
+name: authentik-compress-images
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.jpg"
+      - "**.jpeg"
+      - "**.png"
+      - "**.webp"
+  pull_request:
+    paths:
+      - "**.jpg"
+      - "**.jpeg"
+      - "**.png"
+      - "**.webp"
+  workflow_dispatch:
+
+jobs:
+  compress:
+    name: compress
+    runs-on: ubuntu-latest
+    # Don't run on forks. Token will not be available. Will run on main and open a PR anyway
+    if: |
+      github.repository == 'goauthentik/authentik' &&
+      (github.event_name != 'pull_request' ||
+       github.event.pull_request.head.repo.full_name == github.repository)
+    steps:
+      - id: generate_token
+        uses: tibdex/github-app-token@v1
+        with:
+          app_id: ${{ secrets.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+      - uses: actions/checkout@v3
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+      - name: Compress images
+        id: compress
+        uses: calibreapp/image-actions@main
+        with:
+          githubToken: ${{ steps.generate_token.outputs.token }}
+          compressOnly: ${{ github.event_name != 'pull_request' }}
+      - uses: peter-evans/create-pull-request@v5
+        if: "${{ github.event_name != 'pull_request' && steps.compress.outputs.markdown != '' }}"
+        id: cpr
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          title: "*: Auto compress images"
+          branch-suffix: timestamp
+          commit-messsage: "*: compress images"
+          body: ${{ steps.compress.outputs.markdown }}
+          delete-branch: true
+          signoff: true
+      - uses: peter-evans/enable-pull-request-automerge@v3
+        if: "${{ github.event_name != 'pull_request' && steps.compress.outputs.markdown != '' }}"
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
+          merge-method: squash

.github/workflows/publish-source-docs.yml

@@ -0,0 +1,31 @@
+name: authentik-publish-source-docs
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  POSTGRES_DB: authentik
+  POSTGRES_USER: authentik
+  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
+
+jobs:
+  publish-source-docs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup authentik env
+        uses: ./.github/actions/setup
+      - name: generate docs
+        run: |
+          poetry run make migrate
+          poetry run ak build_source_docs
+      - name: Publish
+        uses: netlify/actions/cli@master
+        with:
+          args: deploy --dir=source_docs --prod
+        env:
+          NETLIFY_SITE_ID: eb246b7b-1d83-4f69-89f7-01a936b4ca59
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}

.github/workflows/release-next-branch.yml

@@ -6,6 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  # Needed to be able to push to the next branch
   contents: write
 
 jobs:

.github/workflows/release-publish.yml

@@ -7,6 +7,9 @@ on:
 jobs:
   build-server:
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload contianer images to ghcr.io
+      packages: write
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
@@ -47,6 +50,9 @@ jobs:
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost:
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload contianer images to ghcr.io
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -96,6 +102,9 @@ jobs:
   build-outpost-binary:
     timeout-minutes: 120
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload binaries to the release
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -110,9 +119,9 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - name: Build web

.github/workflows/repo-stale.yml

@@ -6,8 +6,8 @@ on:
   workflow_dispatch:
 
 permissions:
+  # Needed to update issues and PRs
   issues: write
-  pull-requests: write
 
 jobs:
   stale:

.github/workflows/translation-rename.yml

@@ -0,0 +1,45 @@
+# Rename transifex pull requests to have a correct naming
+# Also enables auto squash-merge
+name: authentik-translation-transifex-rename
+
+on:
+  pull_request:
+    types: [opened, reopened]
+
+jobs:
+  rename_pr:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.pull_request.user.login == 'transifex-integration[bot]'}}
+    steps:
+      - id: generate_token
+        uses: tibdex/github-app-token@v1
+        with:
+          app_id: ${{ secrets.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+      - name: Get current title
+        id: title
+        env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          title=$(curl -q -L \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${{ github.event.pull_request.number }} | jq -r .title)
+          echo "title=${title}" >> "$GITHUB_OUTPUT"
+      - name: Rename
+        env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          curl -L \
+            -X PATCH \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${{ github.event.pull_request.number }} \
+            -d "{\"title\":\"translate: ${{ steps.title.outputs.title }}\"}"
+      - uses: peter-evans/enable-pull-request-automerge@v3
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          pull-request-number: ${{ github.event.pull_request.number }}
+          merge-method: squash

.github/workflows/web-api-publish.yml

@@ -17,9 +17,9 @@ jobs:
       - uses: actions/checkout@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}
-      - uses: actions/setup-node@v3.7.0
+      - uses: actions/setup-node@v3
         with:
-          node-version: "20"
+          node-version: "20.5"
           registry-url: "https://registry.npmjs.org"
       - name: Generate API Client
         run: make gen-client-ts

.gitignore

@@ -204,3 +204,5 @@ data/
 
 # Local Netlify folder
 .netlify
+.ruff_cache
+source_docs/

.vscode/settings.json

@@ -31,7 +31,8 @@
         "!Format sequence",
         "!Condition sequence",
         "!Env sequence",
-        "!Env scalar"
+        "!Env scalar",
+        "!If sequence"
     ],
     "typescript.preferences.importModuleSpecifier": "non-relative",
     "typescript.preferences.importModuleSpecifierEnding": "index",

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: Build website
-FROM --platform=${BUILDPLATFORM} docker.io/node:20 as website-builder
+FROM --platform=${BUILDPLATFORM} docker.io/node:20.5 as website-builder
 
 COPY ./website /work/website/
 COPY ./blueprints /work/blueprints/
@@ -10,7 +10,7 @@ WORKDIR /work/website
 RUN npm ci --include=dev && npm run build-docs-only
 
 # Stage 2: Build webui
-FROM --platform=${BUILDPLATFORM} docker.io/node:20 as web-builder
+FROM --platform=${BUILDPLATFORM} docker.io/node:20.5 as web-builder
 
 COPY ./web /work/web/
 COPY ./website /work/website/
@@ -20,7 +20,7 @@ WORKDIR /work/web
 RUN npm ci --include=dev && npm run build
 
 # Stage 3: Poetry to requirements.txt export
-FROM docker.io/python:3.11.4-slim-bullseye AS poetry-locker
+FROM docker.io/python:3.11.5-slim-bookworm AS poetry-locker
 
 WORKDIR /work
 COPY ./pyproject.toml /work
@@ -31,7 +31,7 @@ RUN pip install --no-cache-dir poetry && \
     poetry export -f requirements.txt --dev --output requirements-dev.txt
 
 # Stage 4: Build go proxy
-FROM docker.io/golang:1.20.5-bullseye AS go-builder
+FROM docker.io/golang:1.21.0-bookworm AS go-builder
 
 WORKDIR /work
 
@@ -39,31 +39,30 @@ COPY --from=web-builder /work/web/robots.txt /work/web/robots.txt
 COPY --from=web-builder /work/web/security.txt /work/web/security.txt
 
 COPY ./cmd /work/cmd
+COPY ./authentik/lib /work/authentik/lib
 COPY ./web/static.go /work/web/static.go
 COPY ./internal /work/internal
 COPY ./go.mod /work/go.mod
 COPY ./go.sum /work/go.sum
 
-RUN go build -o /work/authentik ./cmd/server/
+RUN go build -o /work/bin/authentik ./cmd/server/
 
 # Stage 5: MaxMind GeoIP
-FROM ghcr.io/maxmind/geoipupdate:v5.1 as geoip
+FROM ghcr.io/maxmind/geoipupdate:v6.0 as geoip
 
 ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City"
 ENV GEOIPUPDATE_VERBOSE="true"
+ENV GEOIPUPDATE_ACCOUNT_ID_FILE="/run/secrets/GEOIPUPDATE_ACCOUNT_ID"
+ENV GEOIPUPDATE_LICENSE_KEY_FILE="/run/secrets/GEOIPUPDATE_LICENSE_KEY"
 
 USER root
 RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     --mount=type=secret,id=GEOIPUPDATE_LICENSE_KEY \
     mkdir -p /usr/share/GeoIP && \
-    /bin/sh -c "\
-        export GEOIPUPDATE_ACCOUNT_ID=$(cat /run/secrets/GEOIPUPDATE_ACCOUNT_ID); \
-        export GEOIPUPDATE_LICENSE_KEY=$(cat /run/secrets/GEOIPUPDATE_LICENSE_KEY); \
-        /usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0 \
-    "
+    /bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
 
 # Stage 6: Run
-FROM docker.io/python:3.11.4-slim-bullseye AS final-image
+FROM docker.io/python:3.11.5-slim-bookworm AS final-image
 
 ARG GIT_BUILD_HASH
 ARG VERSION
@@ -83,13 +82,13 @@ COPY --from=geoip /usr/share/GeoIP /geoip
 
 RUN apt-get update && \
     # Required for installing pip packages
-    apt-get install -y --no-install-recommends build-essential pkg-config libxmlsec1-dev zlib1g-dev && \
+    apt-get install -y --no-install-recommends build-essential pkg-config libxmlsec1-dev zlib1g-dev libpq-dev python3-dev && \
     # Required for runtime
-    apt-get install -y --no-install-recommends libxmlsec1-openssl libmaxminddb0 && \
+    apt-get install -y --no-install-recommends libpq5 openssl libxmlsec1-openssl libmaxminddb0 && \
     # Required for bootstrap & healtcheck
     apt-get install -y --no-install-recommends runit && \
     pip install --no-cache-dir -r /requirements.txt && \
-    apt-get remove --purge -y build-essential pkg-config libxmlsec1-dev && \
+    apt-get remove --purge -y build-essential pkg-config libxmlsec1-dev libpq-dev python3-dev && \
     apt-get autoremove --purge -y && \
     apt-get clean && \
     rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
@@ -106,7 +105,7 @@ COPY ./tests /tests
 COPY ./manage.py /
 COPY ./blueprints /blueprints
 COPY ./lifecycle/ /lifecycle
-COPY --from=go-builder /work/authentik /bin/authentik
+COPY --from=go-builder /work/bin/authentik /bin/authentik
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
 COPY --from=website-builder /work/website/help/ /website/help/

Makefile

@@ -140,6 +140,9 @@ web-watch:
 	touch web/dist/.gitkeep
 	cd web && npm run watch
 
+web-storybook-watch:
+	cd web && npm run storybook
+
 web-lint-fix:
 	cd web && npm run prettier
 

SECURITY.md

@@ -1,44 +1,50 @@
-authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
+authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
+
+## What authentik classifies as a CVE
+
+CVE (Common Vulnerability and Exposure) is a system designed to aggregate all vulnerabilities. As such, a CVE will be issued when there is a either vulnerability or exposure. Per NIST, A vulnerability is:
+
+“Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.”
+
+If it is determined that the issue does qualify as a CVE, a CVE number will be issued to the reporter from GitHub.
+
+Even if the issue is not a CVE, we still greatly appreciate your help in hardening authentik.
 
 ## Supported Versions
 
 (.x being the latest patch release for each version)
 
-| Version   | Supported          |
-| --------- | ------------------ |
-| 2023.4.x  | :white_check_mark: |
-| 2023.5.x  | :white_check_mark: |
+| Version | Supported |
+| --- | --- |
+| 2023.6.x | ✅ |
+| 2023.8.x | ✅ |
 
 ## Reporting a Vulnerability
 
-To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the bug.
+To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the issue.
 
-## Criticality levels
+## Severity levels
 
-### High
+authentik reserves the right to reclassify CVSS as necessary. To determine severity, we will use the CVSS calculator from NVD (https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator). The calculated CVSS score will then be translated into one of the following categories:
 
--   Authorization bypass
--   Circumvention of policies
-
-### Moderate
-
--   Denial-of-Service attacks
-
-### Low
-
--   Unvalidated redirects
--   Issues requiring uncommon setups
+| Score | Severity |
+| --- | --- |
+| 0.0 | None |
+| 0.1 – 3.9 | Low |
+| 4.0 – 6.9 | Medium |
+| 7.0 – 8.9 | High |
+| 9.0 – 10.0 | Critical |
 
 ## Disclosure process
 
-1. Issue is reported via Email as listed above.
+1. Report from Github or Issue is reported via Email as listed above.
 2. The authentik Security team will try to reproduce the issue and ask for more information if required.
-3. A criticality level is assigned.
+3. A severity level is assigned.
 4. A fix is created, and if possible tested by the issue reporter.
 5. The fix is backported to other supported versions, and if possible a workaround for other versions is created.
-6. An announcement is sent out with a fixed release date and criticality level of the issue. The announcement will be sent at least 24 hours before the release of the fix
+6. An announcement is sent out with a fixed release date and severity level of the issue. The announcement will be sent at least 24 hours before the release of the security fix.
 7. The fixed version is released for the supported versions.
 
 ## Getting security notifications
 
-To get security notifications, subscribe to the mailing list [here](https://groups.google.com/g/authentik-security-announcements) or join the [discord](https://goauthentik.io/discord) server.
+To get security notifications, subscribe to the mailing list [here](https://groups.google.com/g/authentik-security-announcements) or join the [discord](https://goauthentik.io/discord) server.

authentik/__init__.py

@@ -1,8 +1,8 @@
-"""authentik"""
+"""authentik root module"""
 from os import environ
 from typing import Optional
 
-__version__ = "2023.6.2"
+__version__ = "2023.8.7"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/tasks.py

@@ -58,7 +58,7 @@ def clear_update_notifications():
 @prefill_task
 def update_latest_version(self: MonitoredTask):
     """Update latest version info"""
-    if CONFIG.y_bool("disable_update_check"):
+    if CONFIG.get_bool("disable_update_check"):
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_status(TaskResult(TaskResultStatus.WARNING, messages=["Version check disabled."]))
         return

authentik/api/pagination.py

@@ -2,6 +2,43 @@
 from rest_framework import pagination
 from rest_framework.response import Response
 
+PAGINATION_COMPONENT_NAME = "Pagination"
+PAGINATION_SCHEMA = {
+    "type": "object",
+    "properties": {
+        "next": {
+            "type": "number",
+        },
+        "previous": {
+            "type": "number",
+        },
+        "count": {
+            "type": "number",
+        },
+        "current": {
+            "type": "number",
+        },
+        "total_pages": {
+            "type": "number",
+        },
+        "start_index": {
+            "type": "number",
+        },
+        "end_index": {
+            "type": "number",
+        },
+    },
+    "required": [
+        "next",
+        "previous",
+        "count",
+        "current",
+        "total_pages",
+        "start_index",
+        "end_index",
+    ],
+}
+
 
 class Pagination(pagination.PageNumberPagination):
     """Pagination which includes total pages and current page"""
@@ -35,41 +72,7 @@ class Pagination(pagination.PageNumberPagination):
         return {
             "type": "object",
             "properties": {
-                "pagination": {
-                    "type": "object",
-                    "properties": {
-                        "next": {
-                            "type": "number",
-                        },
-                        "previous": {
-                            "type": "number",
-                        },
-                        "count": {
-                            "type": "number",
-                        },
-                        "current": {
-                            "type": "number",
-                        },
-                        "total_pages": {
-                            "type": "number",
-                        },
-                        "start_index": {
-                            "type": "number",
-                        },
-                        "end_index": {
-                            "type": "number",
-                        },
-                    },
-                    "required": [
-                        "next",
-                        "previous",
-                        "count",
-                        "current",
-                        "total_pages",
-                        "start_index",
-                        "end_index",
-                    ],
-                },
+                "pagination": {"$ref": f"#/components/schemas/{PAGINATION_COMPONENT_NAME}"},
                 "results": schema,
             },
             "required": ["pagination", "results"],

authentik/api/schema.py

@@ -1,5 +1,6 @@
 """Error Response schema, from https://github.com/axnsan12/drf-yasg/issues/224"""
 from django.utils.translation import gettext_lazy as _
+from drf_spectacular.generators import SchemaGenerator
 from drf_spectacular.plumbing import (
     ResolvedComponent,
     build_array_type,
@@ -8,6 +9,9 @@ from drf_spectacular.plumbing import (
 )
 from drf_spectacular.settings import spectacular_settings
 from drf_spectacular.types import OpenApiTypes
+from rest_framework.settings import api_settings
+
+from authentik.api.pagination import PAGINATION_COMPONENT_NAME, PAGINATION_SCHEMA
 
 
 def build_standard_type(obj, **kwargs):
@@ -28,7 +32,7 @@ GENERIC_ERROR = build_object_type(
 VALIDATION_ERROR = build_object_type(
     description=_("Validation Error"),
     properties={
-        "non_field_errors": build_array_type(build_standard_type(OpenApiTypes.STR)),
+        api_settings.NON_FIELD_ERRORS_KEY: build_array_type(build_standard_type(OpenApiTypes.STR)),
         "code": build_standard_type(OpenApiTypes.STR),
     },
     required=[],
@@ -36,7 +40,19 @@ VALIDATION_ERROR = build_object_type(
 )
 
 
-def postprocess_schema_responses(result, generator, **kwargs):  # noqa: W0613
+def create_component(generator: SchemaGenerator, name, schema, type_=ResolvedComponent.SCHEMA):
+    """Register a component and return a reference to it."""
+    component = ResolvedComponent(
+        name=name,
+        type=type_,
+        schema=schema,
+        object=name,
+    )
+    generator.registry.register_on_missing(component)
+    return component
+
+
+def postprocess_schema_responses(result, generator: SchemaGenerator, **kwargs):  # noqa: W0613
     """Workaround to set a default response for endpoints.
     Workaround suggested at
     <https://github.com/tfranzel/drf-spectacular/issues/119#issuecomment-656970357>
@@ -44,19 +60,10 @@ def postprocess_schema_responses(result, generator, **kwargs):  # noqa: W0613
     <https://github.com/tfranzel/drf-spectacular/issues/101>.
     """
 
-    def create_component(name, schema, type_=ResolvedComponent.SCHEMA):
-        """Register a component and return a reference to it."""
-        component = ResolvedComponent(
-            name=name,
-            type=type_,
-            schema=schema,
-            object=name,
-        )
-        generator.registry.register_on_missing(component)
-        return component
+    create_component(generator, PAGINATION_COMPONENT_NAME, PAGINATION_SCHEMA)
 
-    generic_error = create_component("GenericError", GENERIC_ERROR)
-    validation_error = create_component("ValidationError", VALIDATION_ERROR)
+    generic_error = create_component(generator, "GenericError", GENERIC_ERROR)
+    validation_error = create_component(generator, "ValidationError", VALIDATION_ERROR)
 
     for path in result["paths"].values():
         for method in path.values():

authentik/api/tests/test_auth.py

@@ -9,7 +9,7 @@ from rest_framework.exceptions import AuthenticationFailed
 
 from authentik.api.authentication import bearer_auth
 from authentik.blueprints.tests import reconcile_app
-from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
+from authentik.core.models import Token, TokenIntents, User, UserTypes
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.lib.generators import generate_id
 from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
@@ -57,8 +57,8 @@ class TestAPIAuth(TestCase):
     @reconcile_app("authentik_outposts")
     def test_managed_outpost_success(self):
         """Test managed outpost"""
-        user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
-        self.assertEqual(user.attributes[USER_ATTRIBUTE_SA], True)
+        user: User = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
+        self.assertEqual(user.type, UserTypes.INTERNAL_SERVICE_ACCOUNT)
 
     def test_jwt_valid(self):
         """Test valid JWT"""

authentik/api/v3/config.py

@@ -3,6 +3,7 @@ from pathlib import Path
 
 from django.conf import settings
 from django.db import models
+from django.dispatch import Signal
 from drf_spectacular.utils import extend_schema
 from rest_framework.fields import (
     BooleanField,
@@ -21,6 +22,8 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.events.geo import GEOIP_READER
 from authentik.lib.config import CONFIG
 
+capabilities = Signal()
+
 
 class Capabilities(models.TextChoices):
     """Define capabilities which influence which APIs can/should be used"""
@@ -67,12 +70,15 @@ class ConfigView(APIView):
             caps.append(Capabilities.CAN_SAVE_MEDIA)
         if GEOIP_READER.enabled:
             caps.append(Capabilities.CAN_GEO_IP)
-        if CONFIG.y_bool("impersonation"):
+        if CONFIG.get_bool("impersonation"):
             caps.append(Capabilities.CAN_IMPERSONATE)
         if settings.DEBUG:  # pragma: no cover
             caps.append(Capabilities.CAN_DEBUG)
         if "authentik.enterprise" in settings.INSTALLED_APPS:
             caps.append(Capabilities.IS_ENTERPRISE)
+        for _, result in capabilities.send(sender=self):
+            if result:
+                caps.append(result)
         return caps
 
     def get_config(self) -> ConfigSerializer:
@@ -80,17 +86,17 @@ class ConfigView(APIView):
         return ConfigSerializer(
             {
                 "error_reporting": {
-                    "enabled": CONFIG.y("error_reporting.enabled"),
-                    "sentry_dsn": CONFIG.y("error_reporting.sentry_dsn"),
-                    "environment": CONFIG.y("error_reporting.environment"),
-                    "send_pii": CONFIG.y("error_reporting.send_pii"),
-                    "traces_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.4)),
+                    "enabled": CONFIG.get("error_reporting.enabled"),
+                    "sentry_dsn": CONFIG.get("error_reporting.sentry_dsn"),
+                    "environment": CONFIG.get("error_reporting.environment"),
+                    "send_pii": CONFIG.get("error_reporting.send_pii"),
+                    "traces_sample_rate": float(CONFIG.get("error_reporting.sample_rate", 0.4)),
                 },
                 "capabilities": self.get_capabilities(),
-                "cache_timeout": int(CONFIG.y("redis.cache_timeout")),
-                "cache_timeout_flows": int(CONFIG.y("redis.cache_timeout_flows")),
-                "cache_timeout_policies": int(CONFIG.y("redis.cache_timeout_policies")),
-                "cache_timeout_reputation": int(CONFIG.y("redis.cache_timeout_reputation")),
+                "cache_timeout": CONFIG.get_int("redis.cache_timeout"),
+                "cache_timeout_flows": CONFIG.get_int("redis.cache_timeout_flows"),
+                "cache_timeout_policies": CONFIG.get_int("redis.cache_timeout_policies"),
+                "cache_timeout_reputation": CONFIG.get_int("redis.cache_timeout_reputation"),
             }
         )
 

authentik/api/v3/urls.py

@@ -21,9 +21,14 @@ _other_urls = []
 for _authentik_app in get_apps():
     try:
         api_urls = import_module(f"{_authentik_app.name}.urls")
-    except (ModuleNotFoundError, ImportError):
+    except (ModuleNotFoundError, ImportError) as exc:
+        LOGGER.warning("Could not import app's URLs", app_name=_authentik_app.name, exc=exc)
         continue
     if not hasattr(api_urls, "api_urlpatterns"):
+        LOGGER.debug(
+            "App does not define API URLs",
+            app_name=_authentik_app.name,
+        )
         continue
     urls: list = getattr(api_urls, "api_urlpatterns")
     for url in urls:

authentik/blueprints/migrations/0001_initial.py

@@ -30,7 +30,7 @@ def check_blueprint_v1_file(BlueprintInstance: type, path: Path):
             return
         blueprint_file.seek(0)
     instance: BlueprintInstance = BlueprintInstance.objects.filter(path=path).first()
-    rel_path = path.relative_to(Path(CONFIG.y("blueprints_dir")))
+    rel_path = path.relative_to(Path(CONFIG.get("blueprints_dir")))
     meta = None
     if metadata:
         meta = from_dict(BlueprintMetadata, metadata)
@@ -55,7 +55,7 @@ def migration_blueprint_import(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
     Flow = apps.get_model("authentik_flows", "Flow")
 
     db_alias = schema_editor.connection.alias
-    for file in glob(f"{CONFIG.y('blueprints_dir')}/**/*.yaml", recursive=True):
+    for file in glob(f"{CONFIG.get('blueprints_dir')}/**/*.yaml", recursive=True):
         check_blueprint_v1_file(BlueprintInstance, Path(file))
 
     for blueprint in BlueprintInstance.objects.using(db_alias).all():

authentik/blueprints/models.py

@@ -82,7 +82,7 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     def retrieve_file(self) -> str:
         """Get blueprint from path"""
         try:
-            base = Path(CONFIG.y("blueprints_dir"))
+            base = Path(CONFIG.get("blueprints_dir"))
             full_path = base.joinpath(Path(self.path)).resolve()
             if not str(full_path).startswith(str(base.resolve())):
                 raise BlueprintRetrievalFailed("Invalid blueprint path")

authentik/blueprints/tests/fixtures/conditional_fields.yaml

@@ -45,3 +45,8 @@ entries:
     attrs:
       name: "%(uid)s"
       password: "%(uid)s"
+  - model: authentik_core.user
+    identifiers:
+      username: "%(uid)s-no-password"
+    attrs:
+      name: "%(uid)s"

authentik/blueprints/tests/fixtures/state_absent.yaml

@@ -7,7 +7,5 @@ entries:
       state: absent
     - identifiers:
           name: "%(id)s"
-          expression: |
-            return True
       model: authentik_policies_expression.expressionpolicy
       state: absent

authentik/blueprints/tests/fixtures/tags.yaml

@@ -9,6 +9,8 @@ context:
     mapping:
       key1: value
       key2: 2
+    context1: context-nested-value
+    context2: !Context context1
 entries:
     - model: !Format ["%s", authentik_sources_oauth.oauthsource]
       state: !Format ["%s", present]
@@ -34,6 +36,7 @@ entries:
       model: authentik_policies_expression.expressionpolicy
     - attrs:
           attributes:
+              env_null: !Env [bar-baz, null]
               policy_pk1:
                   !Format [
                       "%s-%s",
@@ -97,6 +100,7 @@ entries:
                       [list, with, items, !Format ["foo-%s", !Context foo]],
                   ]
               if_true_simple: !If [!Context foo, true, text]
+              if_short: !If [!Context foo]
               if_false_simple: !If [null, false, 2]
               enumerate_mapping_to_mapping: !Enumerate [
                   !Context mapping,
@@ -141,6 +145,7 @@ entries:
                       ]
                   ]
               ]
+              nested_context: !Context context2
       identifiers:
           name: test
       conditions:

authentik/blueprints/tests/test_v1.py

@@ -155,6 +155,7 @@ class TestBlueprintsV1(TransactionTestCase):
                     },
                     "if_false_complex": ["list", "with", "items", "foo-bar"],
                     "if_true_simple": True,
+                    "if_short": True,
                     "if_false_simple": 2,
                     "enumerate_mapping_to_mapping": {
                         "prefix-key1": "other-prefix-value",
@@ -211,8 +212,10 @@ class TestBlueprintsV1(TransactionTestCase):
                             ],
                         },
                     },
+                    "nested_context": "context-nested-value",
+                    "env_null": None,
                 }
-            )
+            ).exists()
         )
         self.assertTrue(
             OAuthSource.objects.filter(

authentik/blueprints/tests/test_v1_conditional_fields.py

@@ -51,3 +51,9 @@ class TestBlueprintsV1ConditionalFields(TransactionTestCase):
         user: User = User.objects.filter(username=self.uid).first()
         self.assertIsNotNone(user)
         self.assertTrue(user.check_password(self.uid))
+
+    def test_user_null(self):
+        """Test user"""
+        user: User = User.objects.filter(username=f"{self.uid}-no-password").first()
+        self.assertIsNotNone(user)
+        self.assertFalse(user.has_usable_password())

authentik/blueprints/v1/common.py

@@ -223,11 +223,11 @@ class Env(YAMLTag):
         if isinstance(node, ScalarNode):
             self.key = node.value
         if isinstance(node, SequenceNode):
-            self.key = node.value[0].value
-            self.default = node.value[1].value
+            self.key = loader.construct_object(node.value[0])
+            self.default = loader.construct_object(node.value[1])
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
-        return getenv(self.key, self.default)
+        return getenv(self.key) or self.default
 
 
 class Context(YAMLTag):
@@ -242,13 +242,15 @@ class Context(YAMLTag):
         if isinstance(node, ScalarNode):
             self.key = node.value
         if isinstance(node, SequenceNode):
-            self.key = node.value[0].value
-            self.default = node.value[1].value
+            self.key = loader.construct_object(node.value[0])
+            self.default = loader.construct_object(node.value[1])
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
         value = self.default
         if self.key in blueprint.context:
             value = blueprint.context[self.key]
+        if isinstance(value, YAMLTag):
+            return value.resolve(entry, blueprint)
         return value
 
 
@@ -260,7 +262,7 @@ class Format(YAMLTag):
 
     def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
         super().__init__()
-        self.format_string = node.value[0].value
+        self.format_string = loader.construct_object(node.value[0])
         self.args = []
         for raw_node in node.value[1:]:
             self.args.append(loader.construct_object(raw_node))
@@ -339,7 +341,7 @@ class Condition(YAMLTag):
 
     def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
         super().__init__()
-        self.mode = node.value[0].value
+        self.mode = loader.construct_object(node.value[0])
         self.args = []
         for raw_node in node.value[1:]:
             self.args.append(loader.construct_object(raw_node))
@@ -372,8 +374,12 @@ class If(YAMLTag):
     def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
         super().__init__()
         self.condition = loader.construct_object(node.value[0])
-        self.when_true = loader.construct_object(node.value[1])
-        self.when_false = loader.construct_object(node.value[2])
+        if len(node.value) == 1:
+            self.when_true = True
+            self.when_false = False
+        else:
+            self.when_true = loader.construct_object(node.value[1])
+            self.when_false = loader.construct_object(node.value[2])
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
         if isinstance(self.condition, YAMLTag):
@@ -410,7 +416,7 @@ class Enumerate(YAMLTag, YAMLTagContext):
     def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
         super().__init__()
         self.iterable = loader.construct_object(node.value[0])
-        self.output_body = node.value[1].value
+        self.output_body = loader.construct_object(node.value[1])
         self.item_body = loader.construct_object(node.value[2])
         self.__current_context: tuple[Any, Any] = tuple()
 

authentik/blueprints/v1/importer.py

@@ -35,6 +35,7 @@ from authentik.core.models import (
     Source,
     UserSourceConnection,
 )
+from authentik.events.utils import cleanse_dict
 from authentik.flows.models import FlowToken, Stage
 from authentik.lib.models import SerializerModel
 from authentik.outposts.models import OutpostServiceConnection
@@ -199,9 +200,6 @@ class Importer:
         serializer_kwargs = {}
         model_instance = existing_models.first()
         if not isinstance(model(), BaseMetaModel) and model_instance:
-            if entry.get_state(self.__import) == BlueprintEntryDesiredState.CREATED:
-                self.logger.debug("instance exists, skipping")
-                return None
             self.logger.debug(
                 "initialise serializer with instance",
                 model=model,
@@ -212,7 +210,9 @@ class Importer:
             serializer_kwargs["partial"] = True
         else:
             self.logger.debug(
-                "initialised new serializer instance", model=model, **updated_identifiers
+                "initialised new serializer instance",
+                model=model,
+                **cleanse_dict(updated_identifiers),
             )
             model_instance = model()
             # pk needs to be set on the model instance otherwise a new one will be generated
@@ -268,21 +268,34 @@ class Importer:
             try:
                 serializer = self._validate_single(entry)
             except EntryInvalidError as exc:
+                # For deleting objects we don't need the serializer to be valid
+                if entry.get_state(self.__import) == BlueprintEntryDesiredState.ABSENT:
+                    continue
                 self.logger.warning(f"entry invalid: {exc}", entry=entry, error=exc)
                 return False
             if not serializer:
                 continue
 
             state = entry.get_state(self.__import)
-            if state in [
-                BlueprintEntryDesiredState.PRESENT,
-                BlueprintEntryDesiredState.CREATED,
-            ]:
-                model = serializer.save()
+            if state in [BlueprintEntryDesiredState.PRESENT, BlueprintEntryDesiredState.CREATED]:
+                instance = serializer.instance
+                if (
+                    instance
+                    and not instance._state.adding
+                    and state == BlueprintEntryDesiredState.CREATED
+                ):
+                    self.logger.debug(
+                        "instance exists, skipping",
+                        model=model,
+                        instance=instance,
+                        pk=instance.pk,
+                    )
+                else:
+                    instance = serializer.save()
+                    self.logger.debug("updated model", model=instance)
                 if "pk" in entry.identifiers:
-                    self.__pk_map[entry.identifiers["pk"]] = model.pk
-                entry._state = BlueprintEntryState(model)
-                self.logger.debug("updated model", model=model)
+                    self.__pk_map[entry.identifiers["pk"]] = instance.pk
+                entry._state = BlueprintEntryState(instance)
             elif state == BlueprintEntryDesiredState.ABSENT:
                 instance: Optional[Model] = serializer.instance
                 if instance.pk:
@@ -309,5 +322,6 @@ class Importer:
                 self.logger.debug("Blueprint validation failed")
         for log in logs:
             getattr(self.logger, log.get("log_level"))(**log)
+        self.logger.debug("Finished blueprint import validation")
         self.__import = orig_import
         return successful, logs

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -31,7 +31,7 @@ class ApplyBlueprintMetaSerializer(PassiveSerializer):
         required = attrs["required"]
         instance = BlueprintInstance.objects.filter(**identifiers).first()
         if not instance and required:
-            raise ValidationError("Required blueprint does not exist")
+            raise ValidationError({"identifiers": "Required blueprint does not exist"})
         self.blueprint_instance = instance
         return super().validate(attrs)
 

authentik/blueprints/v1/tasks.py

@@ -62,7 +62,7 @@ def start_blueprint_watcher():
     if _file_watcher_started:
         return
     observer = Observer()
-    observer.schedule(BlueprintEventHandler(), CONFIG.y("blueprints_dir"), recursive=True)
+    observer.schedule(BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True)
     observer.start()
     _file_watcher_started = True
 
@@ -80,7 +80,7 @@ class BlueprintEventHandler(FileSystemEventHandler):
             blueprints_discovery.delay()
         if isinstance(event, FileModifiedEvent):
             path = Path(event.src_path)
-            root = Path(CONFIG.y("blueprints_dir")).absolute()
+            root = Path(CONFIG.get("blueprints_dir")).absolute()
             rel_path = str(path.relative_to(root))
             for instance in BlueprintInstance.objects.filter(path=rel_path):
                 LOGGER.debug("modified blueprint file, starting apply", instance=instance)
@@ -101,7 +101,7 @@ def blueprints_find_dict():
 def blueprints_find():
     """Find blueprints and return valid ones"""
     blueprints = []
-    root = Path(CONFIG.y("blueprints_dir"))
+    root = Path(CONFIG.get("blueprints_dir"))
     for path in root.rglob("**/*.yaml"):
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):

authentik/core/api/groups.py

@@ -49,7 +49,7 @@ class GroupSerializer(ModelSerializer):
     users_obj = ListSerializer(
         child=GroupMemberSerializer(), read_only=True, source="users", required=False
     )
-    parent_name = CharField(source="parent.name", read_only=True)
+    parent_name = CharField(source="parent.name", read_only=True, allow_null=True)
 
     num_pk = IntegerField(read_only=True)
 

authentik/core/api/tokens.py

@@ -47,7 +47,7 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
             attrs.setdefault("user", request.user)
         attrs.setdefault("intent", TokenIntents.INTENT_API)
         if attrs.get("intent") not in [TokenIntents.INTENT_API, TokenIntents.INTENT_APP_PASSWORD]:
-            raise ValidationError(f"Invalid intent {attrs.get('intent')}")
+            raise ValidationError({"intent": f"Invalid intent {attrs.get('intent')}"})
         return attrs
 
     class Meta:

authentik/core/api/users.py

@@ -15,7 +15,13 @@ from django.utils.http import urlencode
 from django.utils.text import slugify
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
-from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter, UUIDFilter
+from django_filters.filters import (
+    BooleanFilter,
+    CharFilter,
+    ModelMultipleChoiceFilter,
+    MultipleChoiceFilter,
+    UUIDFilter,
+)
 from django_filters.filterset import FilterSet
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import (
@@ -59,7 +65,6 @@ from authentik.core.middleware import (
     SESSION_KEY_IMPERSONATE_USER,
 )
 from authentik.core.models import (
-    USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
     USER_PATH_SERVICE_ACCOUNT,
     AuthenticatedSession,
@@ -67,6 +72,7 @@ from authentik.core.models import (
     Token,
     TokenIntents,
     User,
+    UserTypes,
 )
 from authentik.events.models import Event, EventAction
 from authentik.flows.exceptions import FlowNonApplicableException
@@ -117,27 +123,35 @@ class UserSerializer(ModelSerializer):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
-            self.fields["password"] = CharField(required=False)
+            self.fields["password"] = CharField(required=False, allow_null=True)
 
     def create(self, validated_data: dict) -> User:
         """If this serializer is used in the blueprint context, we allow for
         directly setting a password. However should be done via the `set_password`
         method instead of directly setting it like rest_framework."""
+        password = validated_data.pop("password", None)
         instance: User = super().create(validated_data)
-        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
-            instance.set_password(validated_data["password"])
-            instance.save()
+        self._set_password(instance, password)
         return instance
 
     def update(self, instance: User, validated_data: dict) -> User:
         """Same as `create` above, set the password directly if we're in a blueprint
         context"""
+        password = validated_data.pop("password", None)
         instance = super().update(instance, validated_data)
-        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and "password" in validated_data:
-            instance.set_password(validated_data["password"])
-            instance.save()
+        self._set_password(instance, password)
         return instance
 
+    def _set_password(self, instance: User, password: Optional[str]):
+        """Set password of user if we're in a blueprint context, and if it's an empty
+        string then use an unusable password"""
+        if SERIALIZER_CONTEXT_BLUEPRINT in self.context and password:
+            instance.set_password(password)
+            instance.save()
+        if len(instance.password) == 0:
+            instance.set_unusable_password()
+            instance.save()
+
     def validate_path(self, path: str) -> str:
         """Validate path"""
         if path[:1] == "/" or path[-1] == "/":
@@ -147,6 +161,18 @@ class UserSerializer(ModelSerializer):
                 raise ValidationError(_("No empty segments in user path allowed."))
         return path
 
+    def validate_type(self, user_type: str) -> str:
+        """Validate user type, internal_service_account is an internal value"""
+        if (
+            self.instance
+            and self.instance.type == UserTypes.INTERNAL_SERVICE_ACCOUNT
+            and user_type != UserTypes.INTERNAL_SERVICE_ACCOUNT.value
+        ):
+            raise ValidationError("Can't change internal service account to other user type.")
+        if not self.instance and user_type == UserTypes.INTERNAL_SERVICE_ACCOUNT.value:
+            raise ValidationError("Setting a user to internal service account is not allowed.")
+        return user_type
+
     class Meta:
         model = User
         fields = [
@@ -163,6 +189,7 @@ class UserSerializer(ModelSerializer):
             "attributes",
             "uid",
             "path",
+            "type",
         ]
         extra_kwargs = {
             "name": {"allow_blank": True},
@@ -188,7 +215,7 @@ class UserSelfSerializer(ModelSerializer):
     )
     def get_groups(self, _: User):
         """Return only the group names a user is member of"""
-        for group in self.instance.ak_groups.all():
+        for group in self.instance.all_groups().order_by("name"):
             yield {
                 "name": group.name,
                 "pk": group.pk,
@@ -211,6 +238,7 @@ class UserSelfSerializer(ModelSerializer):
             "avatar",
             "uid",
             "settings",
+            "type",
         ]
         extra_kwargs = {
             "is_active": {"read_only": True},
@@ -286,11 +314,11 @@ class UsersFilter(FilterSet):
     is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")
     uuid = UUIDFilter(field_name="uuid")
 
-    path = CharFilter(
-        field_name="path",
-    )
+    path = CharFilter(field_name="path")
     path_startswith = CharFilter(field_name="path", lookup_expr="startswith")
 
+    type = MultipleChoiceFilter(choices=UserTypes.choices, field_name="type")
+
     groups_by_name = ModelMultipleChoiceFilter(
         field_name="ak_groups__name",
         to_field_name="name",
@@ -329,6 +357,7 @@ class UsersFilter(FilterSet):
             "attributes",
             "groups_by_name",
             "groups_by_pk",
+            "type",
         ]
 
 
@@ -421,7 +450,8 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 user: User = User.objects.create(
                     username=username,
                     name=username,
-                    attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: expiring},
+                    type=UserTypes.SERVICE_ACCOUNT,
+                    attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: expiring},
                     path=USER_PATH_SERVICE_ACCOUNT,
                 )
                 user.set_unusable_password()
@@ -580,7 +610,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     @action(detail=True, methods=["POST"])
     def impersonate(self, request: Request, pk: int) -> Response:
         """Impersonate a user"""
-        if not CONFIG.y_bool("impersonation"):
+        if not CONFIG.get_bool("impersonation"):
             LOGGER.debug("User attempted to impersonate", user=request.user)
             return Response(status=401)
         if not request.user.has_perm("impersonate"):

authentik/core/management/commands/build_source_docs.py

@@ -0,0 +1,21 @@
+"""Build source docs"""
+from pathlib import Path
+
+from django.core.management.base import BaseCommand
+from pdoc import pdoc
+from pdoc.render import configure
+
+
+class Command(BaseCommand):
+    """Build source docs"""
+
+    def handle(self, **options):
+        configure(
+            docformat="markdown",
+            mermaid=True,
+            logo="https://goauthentik.io/img/icon_top_brand_colour.svg",
+        )
+        pdoc(
+            "authentik",
+            output_directory=Path("./source_docs"),
+        )

authentik/core/management/commands/worker.py

@@ -18,7 +18,7 @@ class Command(BaseCommand):
 
     def handle(self, **options):
         close_old_connections()
-        if CONFIG.y_bool("remote_debug"):
+        if CONFIG.get_bool("remote_debug"):
             import debugpy
 
             debugpy.listen(("0.0.0.0", 6900))  # nosec
@@ -26,7 +26,6 @@ class Command(BaseCommand):
             no_color=False,
             quiet=True,
             optimization="fair",
-            max_tasks_per_child=1,
             autoscale=(3, 1),
             task_events=True,
             beat=True,

authentik/core/migrations/0002_auto_20200523_1133_squashed_0011_provider_name_temp.py

@@ -1,55 +1,11 @@
 # Generated by Django 3.2.8 on 2021-10-10 16:16
 
-from os import environ
-
 import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
 from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
 
 import authentik.core.models
 
 
-def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from django.contrib.auth.hashers import make_password
-
-    User = apps.get_model("authentik_core", "User")
-    db_alias = schema_editor.connection.alias
-
-    akadmin, _ = User.objects.using(db_alias).get_or_create(
-        username="akadmin",
-        email=environ.get("AUTHENTIK_BOOTSTRAP_EMAIL", "root@localhost"),
-        name="authentik Default Admin",
-    )
-    password = None
-    if "TF_BUILD" in environ or settings.TEST:
-        password = "akadmin"  # noqa # nosec
-    if "AUTHENTIK_BOOTSTRAP_PASSWORD" in environ:
-        password = environ["AUTHENTIK_BOOTSTRAP_PASSWORD"]
-    if password:
-        akadmin.password = make_password(password)
-    else:
-        akadmin.password = make_password(None)
-    akadmin.save()
-
-
-def create_default_admin_group(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    User = apps.get_model("authentik_core", "User")
-
-    # Creates a default admin group
-    group, _ = Group.objects.using(db_alias).get_or_create(
-        is_superuser=True,
-        defaults={
-            "name": "authentik Admins",
-        },
-    )
-    group.users.set(User.objects.filter(username="akadmin"))
-    group.save()
-
-
 class Migration(migrations.Migration):
     replaces = [
         ("authentik_core", "0002_auto_20200523_1133"),
@@ -119,9 +75,6 @@ class Migration(migrations.Migration):
             model_name="user",
             name="is_staff",
         ),
-        migrations.RunPython(
-            code=create_default_user,
-        ),
         migrations.AddField(
             model_name="user",
             name="is_superuser",
@@ -201,9 +154,6 @@ class Migration(migrations.Migration):
                 default=False, help_text="Users added to this group will be superusers."
             ),
         ),
-        migrations.RunPython(
-            code=create_default_admin_group,
-        ),
         migrations.AlterModelManagers(
             name="user",
             managers=[

authentik/core/migrations/0018_auto_20210330_1345_squashed_0028_alter_token_intent.py

@@ -1,7 +1,6 @@
 # Generated by Django 3.2.8 on 2021-10-10 16:12
 
 import uuid
-from os import environ
 
 import django.db.models.deletion
 from django.apps.registry import Apps
@@ -35,29 +34,6 @@ def fix_duplicates(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
         Token.objects.using(db_alias).filter(identifier=ident["identifier"]).delete()
 
 
-def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from authentik.core.models import TokenIntents
-
-    User = apps.get_model("authentik_core", "User")
-    Token = apps.get_model("authentik_core", "Token")
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin = User.objects.using(db_alias).filter(username="akadmin")
-    if not akadmin.exists():
-        return
-    if "AUTHENTIK_BOOTSTRAP_TOKEN" not in environ:
-        return
-    key = environ["AUTHENTIK_BOOTSTRAP_TOKEN"]
-    Token.objects.using(db_alias).create(
-        identifier="authentik-bootstrap-token",
-        user=akadmin.first(),
-        intent=TokenIntents.INTENT_API,
-        expiring=False,
-        key=key,
-    )
-
-
 class Migration(migrations.Migration):
     replaces = [
         ("authentik_core", "0018_auto_20210330_1345"),
@@ -214,9 +190,6 @@ class Migration(migrations.Migration):
                 "verbose_name_plural": "Authenticated Sessions",
             },
         ),
-        migrations.RunPython(
-            code=create_default_user_token,
-        ),
         migrations.AlterField(
             model_name="token",
             name="intent",

authentik/core/migrations/0030_user_type.py

@@ -0,0 +1,43 @@
+# Generated by Django 4.1.7 on 2023-05-21 11:44
+
+from django.apps.registry import Apps
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def migrate_user_type(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    User = apps.get_model("authentik_core", "User")
+
+    from authentik.core.models import UserTypes
+
+    for user in User.objects.using(db_alias).all():
+        user.type = UserTypes.INTERNAL
+        if "goauthentik.io/user/service-account" in user.attributes:
+            user.type = UserTypes.SERVICE_ACCOUNT
+        if "goauthentik.io/user/override-ips" in user.attributes:
+            user.type = UserTypes.INTERNAL_SERVICE_ACCOUNT
+        user.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_core", "0029_provider_backchannel_applications_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="type",
+            field=models.TextField(
+                choices=[
+                    ("default", "Default"),
+                    ("external", "External"),
+                    ("service_account", "Service Account"),
+                    ("internal_service_account", "Internal Service Account"),
+                ],
+                default="default",
+            ),
+        ),
+        migrations.RunPython(migrate_user_type),
+    ]

authentik/core/migrations/0031_alter_user_type.py

@@ -0,0 +1,41 @@
+# Generated by Django 4.1.10 on 2023-07-21 12:54
+
+from django.apps.registry import Apps
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def migrate_user_type_v2(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    User = apps.get_model("authentik_core", "User")
+
+    from authentik.core.models import UserTypes
+
+    for user in User.objects.using(db_alias).all():
+        if user.type != "default":
+            continue
+        user.type = UserTypes.INTERNAL
+        user.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_core", "0030_user_type"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="user",
+            name="type",
+            field=models.TextField(
+                choices=[
+                    ("internal", "Internal"),
+                    ("external", "External"),
+                    ("service_account", "Service Account"),
+                    ("internal_service_account", "Internal Service Account"),
+                ],
+                default="internal",
+            ),
+        ),
+        migrations.RunPython(migrate_user_type_v2),
+    ]

authentik/core/models.py

@@ -36,7 +36,6 @@ from authentik.root.install_id import get_install_id
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
-USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
 USER_ATTRIBUTE_GENERATED = "goauthentik.io/user/generated"
 USER_ATTRIBUTE_EXPIRES = "goauthentik.io/user/expires"
 USER_ATTRIBUTE_DELETE_ON_LOGOUT = "goauthentik.io/user/delete-on-logout"
@@ -45,8 +44,6 @@ USER_ATTRIBUTE_TOKEN_EXPIRING = "goauthentik.io/user/token-expires"  # nosec
 USER_ATTRIBUTE_CHANGE_USERNAME = "goauthentik.io/user/can-change-username"
 USER_ATTRIBUTE_CHANGE_NAME = "goauthentik.io/user/can-change-name"
 USER_ATTRIBUTE_CHANGE_EMAIL = "goauthentik.io/user/can-change-email"
-USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
-
 USER_PATH_SYSTEM_PREFIX = "goauthentik.io"
 USER_PATH_SERVICE_ACCOUNT = USER_PATH_SYSTEM_PREFIX + "/service-accounts"
 
@@ -63,11 +60,26 @@ def default_token_key():
     """Default token key"""
     # We use generate_id since the chars in the key should be easy
     # to use in Emails (for verification) and URLs (for recovery)
-    return generate_id(int(CONFIG.y("default_token_length")))
+    return generate_id(CONFIG.get_int("default_token_length"))
+
+
+class UserTypes(models.TextChoices):
+    """User types, both for grouping, licensing and permissions in the case
+    of the internal_service_account"""
+
+    INTERNAL = "internal"
+    EXTERNAL = "external"
+
+    # User-created service accounts
+    SERVICE_ACCOUNT = "service_account"
+
+    # Special user type for internally managed and created service
+    # accounts, such as outpost users
+    INTERNAL_SERVICE_ACCOUNT = "internal_service_account"
 
 
 class Group(SerializerModel):
-    """Custom Group model which supports a basic hierarchy"""
+    """Group model which supports a basic hierarchy and has attributes"""
 
     group_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
 
@@ -101,27 +113,7 @@ class Group(SerializerModel):
 
     def is_member(self, user: "User") -> bool:
         """Recursively check if `user` is member of us, or any parent."""
-        query = """
-        WITH RECURSIVE parents AS (
-            SELECT authentik_core_group.*, 0 AS relative_depth
-            FROM authentik_core_group
-            WHERE authentik_core_group.group_uuid = %s
-
-            UNION ALL
-
-            SELECT authentik_core_group.*, parents.relative_depth - 1
-            FROM authentik_core_group,parents
-            WHERE (
-                authentik_core_group.parent_id = parents.group_uuid and
-                parents.relative_depth > -20
-            )
-        )
-        SELECT group_uuid
-        FROM parents
-        GROUP BY group_uuid;
-        """
-        groups = Group.objects.raw(query, [self.group_uuid])
-        return user.ak_groups.filter(pk__in=[group.pk for group in groups]).exists()
+        return user.all_groups().filter(group_uuid=self.group_uuid).exists()
 
     def __str__(self):
         return f"Group {self.name}"
@@ -136,19 +128,20 @@ class Group(SerializerModel):
 
 
 class UserManager(DjangoUserManager):
-    """Custom user manager that doesn't assign is_superuser and is_staff"""
+    """User manager that doesn't assign is_superuser and is_staff"""
 
     def create_user(self, username, email=None, password=None, **extra_fields):
-        """Custom user manager that doesn't assign is_superuser and is_staff"""
+        """User manager that doesn't assign is_superuser and is_staff"""
         return self._create_user(username, email, password, **extra_fields)
 
 
 class User(SerializerModel, GuardianUserMixin, AbstractUser):
-    """Custom User model to allow easier adding of user-based settings"""
+    """authentik User model, based on django's contrib auth user model."""
 
     uuid = models.UUIDField(default=uuid4, editable=False, unique=True)
     name = models.TextField(help_text=_("User's display name."))
     path = models.TextField(default="users")
+    type = models.TextField(choices=UserTypes.choices, default=UserTypes.INTERNAL)
 
     sources = models.ManyToManyField("Source", through="UserSourceConnection")
     ak_groups = models.ManyToManyField("Group", related_name="users")
@@ -163,13 +156,45 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
         """Get the default user path"""
         return User._meta.get_field("path").default
 
+    def all_groups(self) -> QuerySet[Group]:
+        """Recursively get all groups this user is a member of.
+        At least one query is done to get the direct groups of the user, with groups
+        there are at most 3 queries done"""
+        direct_groups = list(
+            x for x in self.ak_groups.all().values_list("pk", flat=True).iterator()
+        )
+        if len(direct_groups) < 1:
+            return Group.objects.none()
+        query = """
+        WITH RECURSIVE parents AS (
+            SELECT authentik_core_group.*, 0 AS relative_depth
+            FROM authentik_core_group
+            WHERE authentik_core_group.group_uuid = ANY(%s)
+
+            UNION ALL
+
+            SELECT authentik_core_group.*, parents.relative_depth + 1
+            FROM authentik_core_group, parents
+            WHERE (
+                authentik_core_group.group_uuid = parents.parent_id and
+                parents.relative_depth < 20
+            )
+        )
+        SELECT group_uuid
+        FROM parents
+        GROUP BY group_uuid, name
+        ORDER BY name;
+        """
+        group_pks = [group.pk for group in Group.objects.raw(query, [direct_groups]).iterator()]
+        return Group.objects.filter(pk__in=group_pks)
+
     def group_attributes(self, request: Optional[HttpRequest] = None) -> dict[str, Any]:
         """Get a dictionary containing the attributes from all groups the user belongs to,
         including the users attributes"""
         final_attributes = {}
         if request and hasattr(request, "tenant"):
             always_merger.merge(final_attributes, request.tenant.attributes)
-        for group in self.ak_groups.all().order_by("name"):
+        for group in self.all_groups().order_by("name"):
             always_merger.merge(final_attributes, group.attributes)
         always_merger.merge(final_attributes, self.attributes)
         return final_attributes
@@ -183,7 +208,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @cached_property
     def is_superuser(self) -> bool:
         """Get supseruser status based on membership in a group with superuser status"""
-        return self.ak_groups.filter(is_superuser=True).exists()
+        return self.all_groups().filter(is_superuser=True).exists()
 
     @property
     def is_staff(self) -> bool:

authentik/core/signals.py

@@ -1,6 +1,4 @@
 """authentik core signals"""
-from typing import TYPE_CHECKING
-
 from django.contrib.auth.signals import user_logged_in, user_logged_out
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
@@ -10,16 +8,13 @@ from django.db.models.signals import post_save, pre_delete, pre_save
 from django.dispatch import receiver
 from django.http.request import HttpRequest
 
-from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider
+from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider, User
 
 # Arguments: user: User, password: str
 password_changed = Signal()
 # Arguments: credentials: dict[str, any], request: HttpRequest, stage: Stage
 login_failed = Signal()
 
-if TYPE_CHECKING:
-    from authentik.core.models import User
-
 
 @receiver(post_save, sender=Application)
 def post_save_application(sender: type[Model], instance, created: bool, **_):
@@ -35,7 +30,7 @@ def post_save_application(sender: type[Model], instance, created: bool, **_):
 
 
 @receiver(user_logged_in)
-def user_logged_in_session(sender, request: HttpRequest, user: "User", **_):
+def user_logged_in_session(sender, request: HttpRequest, user: User, **_):
     """Create an AuthenticatedSession from request"""
 
     session = AuthenticatedSession.from_request(request, user)
@@ -44,7 +39,7 @@ def user_logged_in_session(sender, request: HttpRequest, user: "User", **_):
 
 
 @receiver(user_logged_out)
-def user_logged_out_session(sender, request: HttpRequest, user: "User", **_):
+def user_logged_out_session(sender, request: HttpRequest, user: User, **_):
     """Delete AuthenticatedSession if it exists"""
     AuthenticatedSession.objects.filter(session_key=request.session.session_key).delete()
 

authentik/core/templates/login/base_full.html

@@ -78,7 +78,6 @@
         </main>
         {% endblock %}
         <footer class="pf-c-login__footer">
-            <p></p>
             <ul class="pf-c-list pf-m-inline">
                 {% for link in footer_links %}
                 <li>

authentik/core/tests/test_groups.py

@@ -13,7 +13,9 @@ class TestGroups(TestCase):
         user = User.objects.create(username=generate_id())
         user2 = User.objects.create(username=generate_id())
         group = Group.objects.create(name=generate_id())
+        other_group = Group.objects.create(name=generate_id())
         group.users.add(user)
+        other_group.users.add(user)
         self.assertTrue(group.is_member(user))
         self.assertFalse(group.is_member(user2))
 
@@ -21,22 +23,26 @@ class TestGroups(TestCase):
         """Test parent membership"""
         user = User.objects.create(username=generate_id())
         user2 = User.objects.create(username=generate_id())
-        first = Group.objects.create(name=generate_id())
-        second = Group.objects.create(name=generate_id(), parent=first)
-        second.users.add(user)
-        self.assertTrue(first.is_member(user))
-        self.assertFalse(first.is_member(user2))
+        parent = Group.objects.create(name=generate_id())
+        child = Group.objects.create(name=generate_id(), parent=parent)
+        child.users.add(user)
+        self.assertTrue(child.is_member(user))
+        self.assertTrue(parent.is_member(user))
+        self.assertFalse(child.is_member(user2))
+        self.assertFalse(parent.is_member(user2))
 
     def test_group_membership_parent_extra(self):
         """Test parent membership"""
         user = User.objects.create(username=generate_id())
         user2 = User.objects.create(username=generate_id())
-        first = Group.objects.create(name=generate_id())
-        second = Group.objects.create(name=generate_id(), parent=first)
+        parent = Group.objects.create(name=generate_id())
+        second = Group.objects.create(name=generate_id(), parent=parent)
         third = Group.objects.create(name=generate_id(), parent=second)
         second.users.add(user)
-        self.assertTrue(first.is_member(user))
-        self.assertFalse(first.is_member(user2))
+        self.assertTrue(parent.is_member(user))
+        self.assertFalse(parent.is_member(user2))
+        self.assertTrue(second.is_member(user))
+        self.assertFalse(second.is_member(user2))
         self.assertFalse(third.is_member(user))
         self.assertFalse(third.is_member(user2))
 

authentik/core/tests/test_users_api.py

@@ -8,11 +8,11 @@ from django.urls.base import reverse
 from rest_framework.test import APITestCase
 
 from authentik.core.models import (
-    USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
     AuthenticatedSession,
     Token,
     User,
+    UserTypes,
 )
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow, create_test_tenant
 from authentik.flows.models import FlowDesignation
@@ -28,6 +28,19 @@ class TestUsersAPI(APITestCase):
         self.admin = create_test_admin_user()
         self.user = User.objects.create(username="test-user")
 
+    def test_filter_type(self):
+        """Test API filtering by type"""
+        self.client.force_login(self.admin)
+        user = create_test_admin_user(type=UserTypes.EXTERNAL)
+        response = self.client.get(
+            reverse("authentik_api:user-list"),
+            data={
+                "type": UserTypes.EXTERNAL,
+                "username": user.username,
+            },
+        )
+        self.assertEqual(response.status_code, 200)
+
     def test_metrics(self):
         """Test user's metrics"""
         self.client.force_login(self.admin)
@@ -141,7 +154,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -166,7 +180,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: False, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: False},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -192,7 +207,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()
@@ -218,7 +234,8 @@ class TestUsersAPI(APITestCase):
 
         user_filter = User.objects.filter(
             username="test-sa",
-            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True, USER_ATTRIBUTE_SA: True},
+            type=UserTypes.SERVICE_ACCOUNT,
+            attributes={USER_ATTRIBUTE_TOKEN_EXPIRING: True},
         )
         self.assertTrue(user_filter.exists())
         user: User = user_filter.first()

authentik/core/tests/utils.py

@@ -21,7 +21,7 @@ def create_test_flow(
     )
 
 
-def create_test_admin_user(name: Optional[str] = None) -> User:
+def create_test_admin_user(name: Optional[str] = None, **kwargs) -> User:
     """Generate a test-admin user"""
     uid = generate_id(20) if not name else name
     group = Group.objects.create(name=uid, is_superuser=True)
@@ -29,6 +29,7 @@ def create_test_admin_user(name: Optional[str] = None) -> User:
         username=uid,
         name=uid,
         email=f"{uid}@goauthentik.io",
+        **kwargs,
     )
     user.set_password(uid)
     user.save()
@@ -36,12 +37,12 @@ def create_test_admin_user(name: Optional[str] = None) -> User:
     return user
 
 
-def create_test_tenant() -> Tenant:
+def create_test_tenant(**kwargs) -> Tenant:
     """Generate a test tenant, removing all other tenants to make sure this one
     matches."""
     uid = generate_id(20)
     Tenant.objects.all().delete()
-    return Tenant.objects.create(domain=uid, default=True)
+    return Tenant.objects.create(domain=uid, default=True, **kwargs)
 
 
 def create_test_cert(use_ec_private_key=False) -> CertificateKeyPair:

authentik/crypto/api.py

@@ -189,6 +189,8 @@ class CertificateKeyPairFilter(FilterSet):
 
     def filter_has_key(self, queryset, name, value):  # pragma: no cover
         """Only return certificate-key pairs with keys"""
+        if not value:
+            return queryset
         return queryset.exclude(key_data__exact="")
 
     class Meta:

authentik/crypto/tasks.py

@@ -46,7 +46,7 @@ def certificate_discovery(self: MonitoredTask):
     certs = {}
     private_keys = {}
     discovered = 0
-    for file in glob(CONFIG.y("cert_discovery_dir") + "/**", recursive=True):
+    for file in glob(CONFIG.get("cert_discovery_dir") + "/**", recursive=True):
         path = Path(file)
         if not path.exists():
             continue

authentik/crypto/tests.py

@@ -128,8 +128,26 @@ class TestCrypto(APITestCase):
         response = self.client.get(
             reverse(
                 "authentik_api:certificatekeypair-list",
-            )
-            + f"?name={cert.name}"
+            ),
+            data={"name": cert.name},
+        )
+        self.assertEqual(200, response.status_code)
+        body = loads(response.content.decode())
+        api_cert = [x for x in body["results"] if x["name"] == cert.name][0]
+        self.assertEqual(api_cert["fingerprint_sha1"], cert.fingerprint_sha1)
+        self.assertEqual(api_cert["fingerprint_sha256"], cert.fingerprint_sha256)
+
+    def test_list_has_key_false(self):
+        """Test API List with has_key set to false"""
+        cert = create_test_cert()
+        cert.key_data = ""
+        cert.save()
+        self.client.force_login(create_test_admin_user())
+        response = self.client.get(
+            reverse(
+                "authentik_api:certificatekeypair-list",
+            ),
+            data={"name": cert.name, "has_key": False},
         )
         self.assertEqual(200, response.status_code)
         body = loads(response.content.decode())
@@ -144,8 +162,8 @@ class TestCrypto(APITestCase):
         response = self.client.get(
             reverse(
                 "authentik_api:certificatekeypair-list",
-            )
-            + f"?name={cert.name}&include_details=false"
+            ),
+            data={"name": cert.name, "include_details": False},
         )
         self.assertEqual(200, response.status_code)
         body = loads(response.content.decode())
@@ -168,8 +186,8 @@ class TestCrypto(APITestCase):
             reverse(
                 "authentik_api:certificatekeypair-view-certificate",
                 kwargs={"pk": keypair.pk},
-            )
-            + "?download",
+            ),
+            data={"download": True},
         )
         self.assertEqual(200, response.status_code)
         self.assertIn("Content-Disposition", response)
@@ -189,8 +207,8 @@ class TestCrypto(APITestCase):
             reverse(
                 "authentik_api:certificatekeypair-view-private-key",
                 kwargs={"pk": keypair.pk},
-            )
-            + "?download",
+            ),
+            data={"download": True},
         )
         self.assertEqual(200, response.status_code)
         self.assertIn("Content-Disposition", response)
@@ -200,7 +218,7 @@ class TestCrypto(APITestCase):
         self.client.force_login(create_test_admin_user())
         keypair = create_test_cert()
         provider = OAuth2Provider.objects.create(
-            name="test",
+            name=generate_id(),
             client_id="test",
             client_secret=generate_key(),
             authorization_flow=create_test_flow(),

authentik/enterprise/api.py

@@ -0,0 +1,154 @@
+"""Enterprise API Views"""
+from datetime import datetime, timedelta
+
+from django.utils.timezone import now
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import extend_schema, inline_serializer
+from rest_framework.decorators import action
+from rest_framework.fields import BooleanField, CharField, DateTimeField, IntegerField
+from rest_framework.permissions import IsAdminUser, IsAuthenticated
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from authentik.api.decorators import permission_required
+from authentik.core.api.used_by import UsedByMixin
+from authentik.core.api.utils import PassiveSerializer
+from authentik.core.models import User, UserTypes
+from authentik.enterprise.models import License, LicenseKey
+from authentik.root.install_id import get_install_id
+
+
+class LicenseSerializer(ModelSerializer):
+    """License Serializer"""
+
+    def validate_key(self, key: str) -> str:
+        """Validate the license key (install_id and signature)"""
+        LicenseKey.validate(key)
+        return key
+
+    class Meta:
+        model = License
+        fields = [
+            "license_uuid",
+            "name",
+            "key",
+            "expiry",
+            "internal_users",
+            "external_users",
+        ]
+        extra_kwargs = {
+            "name": {"read_only": True},
+            "expiry": {"read_only": True},
+            "internal_users": {"read_only": True},
+            "external_users": {"read_only": True},
+        }
+
+
+class LicenseSummary(PassiveSerializer):
+    """Serializer for license status"""
+
+    internal_users = IntegerField(required=True)
+    external_users = IntegerField(required=True)
+    valid = BooleanField()
+    show_admin_warning = BooleanField()
+    show_user_warning = BooleanField()
+    read_only = BooleanField()
+    latest_valid = DateTimeField()
+    has_license = BooleanField()
+
+
+class LicenseForecastSerializer(PassiveSerializer):
+    """Serializer for license forecast"""
+
+    internal_users = IntegerField(required=True)
+    external_users = IntegerField(required=True)
+    forecasted_internal_users = IntegerField(required=True)
+    forecasted_external_users = IntegerField(required=True)
+
+
+class LicenseViewSet(UsedByMixin, ModelViewSet):
+    """License Viewset"""
+
+    queryset = License.objects.all()
+    serializer_class = LicenseSerializer
+    search_fields = ["name"]
+    ordering = ["name"]
+    filterset_fields = ["name"]
+
+    @permission_required(None, ["authentik_enterprise.view_license"])
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            200: inline_serializer("InstallIDSerializer", {"install_id": CharField(required=True)}),
+        },
+    )
+    @action(detail=False, methods=["GET"], permission_classes=[IsAdminUser])
+    def get_install_id(self, request: Request) -> Response:
+        """Get install_id"""
+        return Response(
+            data={
+                "install_id": get_install_id(),
+            }
+        )
+
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            200: LicenseSummary(),
+        },
+    )
+    @action(detail=False, methods=["GET"], permission_classes=[IsAuthenticated])
+    def summary(self, request: Request) -> Response:
+        """Get the total license status"""
+        total = LicenseKey.get_total()
+        last_valid = LicenseKey.last_valid_date()
+        # TODO: move this to a different place?
+        show_admin_warning = last_valid < now() - timedelta(weeks=2)
+        show_user_warning = last_valid < now() - timedelta(weeks=4)
+        read_only = last_valid < now() - timedelta(weeks=6)
+        latest_valid = datetime.fromtimestamp(total.exp)
+        response = LicenseSummary(
+            data={
+                "internal_users": total.internal_users,
+                "external_users": total.external_users,
+                "valid": total.is_valid(),
+                "show_admin_warning": show_admin_warning,
+                "show_user_warning": show_user_warning,
+                "read_only": read_only,
+                "latest_valid": latest_valid,
+                "has_license": License.objects.all().count() > 0,
+            }
+        )
+        response.is_valid(raise_exception=True)
+        return Response(response.data)
+
+    @permission_required(None, ["authentik_enterprise.view_license"])
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            200: LicenseForecastSerializer(),
+        },
+    )
+    @action(detail=False, methods=["GET"])
+    def forecast(self, request: Request) -> Response:
+        """Forecast how many users will be required in a year"""
+        last_month = now() - timedelta(days=30)
+        # Forecast for internal users
+        internal_in_last_month = User.objects.filter(
+            type=UserTypes.INTERNAL, date_joined__gte=last_month
+        ).count()
+        # Forecast for external users
+        external_in_last_month = LicenseKey.get_external_user_count()
+        forecast_for_months = 12
+        response = LicenseForecastSerializer(
+            data={
+                "internal_users": LicenseKey.get_default_user_count(),
+                "external_users": LicenseKey.get_external_user_count(),
+                "forecasted_internal_users": (internal_in_last_month * forecast_for_months),
+                "forecasted_external_users": (external_in_last_month * forecast_for_months),
+            }
+        )
+        response.is_valid(raise_exception=True)
+        return Response(response.data)

authentik/enterprise/apps.py

@@ -9,3 +9,7 @@ class AuthentikEnterpriseConfig(ManagedAppConfig):
     label = "authentik_enterprise"
     verbose_name = "authentik Enterprise"
     default = True
+
+    def reconcile_load_enterprise_signals(self):
+        """Load enterprise signals"""
+        self.import_module("authentik.enterprise.signals")

authentik/enterprise/migrations/0001_initial.py

@@ -0,0 +1,52 @@
+# Generated by Django 4.1.10 on 2023-07-06 12:51
+
+import uuid
+
+from django.db import migrations, models
+
+import authentik.enterprise.models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = []
+
+    operations = [
+        migrations.CreateModel(
+            name="License",
+            fields=[
+                (
+                    "license_uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("key", models.TextField(unique=True)),
+                ("name", models.TextField()),
+                ("expiry", models.DateTimeField()),
+                ("users", models.BigIntegerField()),
+                ("external_users", models.BigIntegerField()),
+            ],
+        ),
+        migrations.CreateModel(
+            name="LicenseUsage",
+            fields=[
+                ("expiring", models.BooleanField(default=True)),
+                ("expires", models.DateTimeField(default=authentik.enterprise.models.usage_expiry)),
+                (
+                    "usage_uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("user_count", models.BigIntegerField()),
+                ("external_user_count", models.BigIntegerField()),
+                ("within_limits", models.BooleanField()),
+                ("record_date", models.DateTimeField(auto_now_add=True)),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+    ]

authentik/enterprise/migrations/0002_rename_users_license_internal_users_and_more.py

@@ -0,0 +1,36 @@
+# Generated by Django 4.2.4 on 2023-08-23 10:06
+
+import django.contrib.postgres.indexes
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_enterprise", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RenameField(
+            model_name="license",
+            old_name="users",
+            new_name="internal_users",
+        ),
+        migrations.AlterField(
+            model_name="license",
+            name="key",
+            field=models.TextField(),
+        ),
+        migrations.AddIndex(
+            model_name="license",
+            index=django.contrib.postgres.indexes.HashIndex(
+                fields=["key"], name="authentik_e_key_523e13_hash"
+            ),
+        ),
+        migrations.AlterModelOptions(
+            name="licenseusage",
+            options={
+                "verbose_name": "License Usage",
+                "verbose_name_plural": "License Usage Records",
+            },
+        ),
+    ]

authentik/enterprise/models.py

@@ -0,0 +1,194 @@
+"""Enterprise models"""
+from base64 import b64decode
+from binascii import Error
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+from enum import Enum
+from functools import lru_cache
+from time import mktime
+from uuid import uuid4
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.x509 import Certificate, load_der_x509_certificate, load_pem_x509_certificate
+from dacite import from_dict
+from django.contrib.postgres.indexes import HashIndex
+from django.db import models
+from django.db.models.query import QuerySet
+from django.utils.timezone import now
+from django.utils.translation import gettext as _
+from guardian.shortcuts import get_anonymous_user
+from jwt import PyJWTError, decode, get_unverified_header
+from rest_framework.exceptions import ValidationError
+
+from authentik.core.models import ExpiringModel, User, UserTypes
+from authentik.root.install_id import get_install_id
+
+
+@lru_cache()
+def get_licensing_key() -> Certificate:
+    """Get Root CA PEM"""
+    with open("authentik/enterprise/public.pem", "rb") as _key:
+        return load_pem_x509_certificate(_key.read())
+
+
+def get_license_aud() -> str:
+    """Get the JWT audience field"""
+    return f"enterprise.goauthentik.io/license/{get_install_id()}"
+
+
+class LicenseFlags(Enum):
+    """License flags"""
+
+
+@dataclass
+class LicenseKey:
+    """License JWT claims"""
+
+    aud: str
+    exp: int
+
+    name: str
+    internal_users: int = 0
+    external_users: int = 0
+    flags: list[LicenseFlags] = field(default_factory=list)
+
+    @staticmethod
+    def validate(jwt: str) -> "LicenseKey":
+        """Validate the license from a given JWT"""
+        try:
+            headers = get_unverified_header(jwt)
+        except PyJWTError:
+            raise ValidationError("Unable to verify license")
+        x5c: list[str] = headers.get("x5c", [])
+        if len(x5c) < 1:
+            raise ValidationError("Unable to verify license")
+        try:
+            our_cert = load_der_x509_certificate(b64decode(x5c[0]))
+            intermediate = load_der_x509_certificate(b64decode(x5c[1]))
+            our_cert.verify_directly_issued_by(intermediate)
+            intermediate.verify_directly_issued_by(get_licensing_key())
+        except (InvalidSignature, TypeError, ValueError, Error):
+            raise ValidationError("Unable to verify license")
+        try:
+            body = from_dict(
+                LicenseKey,
+                decode(
+                    jwt,
+                    our_cert.public_key(),
+                    algorithms=["ES512"],
+                    audience=get_license_aud(),
+                ),
+            )
+        except PyJWTError:
+            raise ValidationError("Unable to verify license")
+        return body
+
+    @staticmethod
+    def get_total() -> "LicenseKey":
+        """Get a summarized version of all (not expired) licenses"""
+        active_licenses = License.objects.filter(expiry__gte=now())
+        total = LicenseKey(get_license_aud(), 0, "Summarized license", 0, 0)
+        for lic in active_licenses:
+            total.internal_users += lic.internal_users
+            total.external_users += lic.external_users
+            exp_ts = int(mktime(lic.expiry.timetuple()))
+            if total.exp == 0:
+                total.exp = exp_ts
+            if exp_ts <= total.exp:
+                total.exp = exp_ts
+            total.flags.extend(lic.status.flags)
+        return total
+
+    @staticmethod
+    def base_user_qs() -> QuerySet:
+        """Base query set for all users"""
+        return User.objects.all().exclude(pk=get_anonymous_user().pk)
+
+    @staticmethod
+    def get_default_user_count():
+        """Get current default user count"""
+        return LicenseKey.base_user_qs().filter(type=UserTypes.INTERNAL).count()
+
+    @staticmethod
+    def get_external_user_count():
+        """Get current external user count"""
+        # Count since start of the month
+        last_month = now().replace(day=1)
+        return (
+            LicenseKey.base_user_qs()
+            .filter(type=UserTypes.EXTERNAL, last_login__gte=last_month)
+            .count()
+        )
+
+    def is_valid(self) -> bool:
+        """Check if the given license body covers all users
+
+        Only checks the current count, no historical data is checked"""
+        default_users = self.get_default_user_count()
+        if default_users > self.internal_users:
+            return False
+        active_users = self.get_external_user_count()
+        if active_users > self.external_users:
+            return False
+        return True
+
+    def record_usage(self):
+        """Capture the current validity status and metrics and save them"""
+        LicenseUsage.objects.create(
+            user_count=self.get_default_user_count(),
+            external_user_count=self.get_external_user_count(),
+            within_limits=self.is_valid(),
+        )
+
+    @staticmethod
+    def last_valid_date() -> datetime:
+        """Get the last date the license was valid"""
+        usage: LicenseUsage = (
+            LicenseUsage.filter_not_expired(within_limits=True).order_by("-record_date").first()
+        )
+        if not usage:
+            return now()
+        return usage.record_date
+
+
+class License(models.Model):
+    """An authentik enterprise license"""
+
+    license_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
+    key = models.TextField()
+
+    name = models.TextField()
+    expiry = models.DateTimeField()
+    internal_users = models.BigIntegerField()
+    external_users = models.BigIntegerField()
+
+    @property
+    def status(self) -> LicenseKey:
+        """Get parsed license status"""
+        return LicenseKey.validate(self.key)
+
+    class Meta:
+        indexes = (HashIndex(fields=("key",)),)
+
+
+def usage_expiry():
+    """Keep license usage records for 3 months"""
+    return now() + timedelta(days=30 * 3)
+
+
+class LicenseUsage(ExpiringModel):
+    """a single license usage record"""
+
+    expires = models.DateTimeField(default=usage_expiry)
+
+    usage_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
+
+    user_count = models.BigIntegerField()
+    external_user_count = models.BigIntegerField()
+    within_limits = models.BooleanField()
+
+    record_date = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        verbose_name = _("License Usage")
+        verbose_name_plural = _("License Usage Records")

authentik/enterprise/policy.py

@@ -0,0 +1,46 @@
+"""Enterprise license policies"""
+from typing import Optional
+
+from rest_framework.serializers import BaseSerializer
+
+from authentik.core.models import User, UserTypes
+from authentik.enterprise.models import LicenseKey
+from authentik.policies.models import Policy
+from authentik.policies.types import PolicyRequest, PolicyResult
+from authentik.policies.views import PolicyAccessView
+
+
+class EnterprisePolicy(Policy):
+    """Check that a user is correctly licensed for the request"""
+
+    @property
+    def component(self) -> str:
+        return ""
+
+    @property
+    def serializer(self) -> type[BaseSerializer]:
+        raise NotImplementedError
+
+    def passes(self, request: PolicyRequest) -> PolicyResult:
+        if not LicenseKey.get_total().is_valid():
+            return PolicyResult(False)
+        if request.user.type != UserTypes.INTERNAL:
+            return PolicyResult(False)
+        return PolicyResult(True)
+
+
+class EnterprisePolicyAccessView(PolicyAccessView):
+    """PolicyAccessView which also checks enterprise licensing"""
+
+    def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
+        user = user or self.request.user
+        request = PolicyRequest(user)
+        request.http_request = self.request
+        result = super().user_has_access(user)
+        enterprise_result = EnterprisePolicy().passes(request)
+        if not enterprise_result.passing:
+            return enterprise_result
+        return result
+
+    def resolve_provider_application(self):
+        raise NotImplementedError

authentik/enterprise/public.pem

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEdzCCA/6gAwIBAgIUQrj1jxn4q/BB38B2SwTrvGyrZLMwCgYIKoZIzj0EAwMw
+ge8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
+YW4gRnJhbmNpc2NvMSQwIgYDVQQJExs1NDggTWFya2V0IFN0cmVldCBQbWIgNzAx
+NDgxDjAMBgNVBBETBTk0MTA0MSAwHgYDVQQKExdBdXRoZW50aWsgU2VjdXJpdHkg
+SW5jLjEcMBoGA1UECxMTRW50ZXJwcmlzZSBMaWNlbnNlczE9MDsGA1UEAxM0QXV0
+aGVudGlrIFNlY3VyaXR5IEluYy4gRW50ZXJwcmlzZSBMaWNlbnNpbmcgUm9vdCBY
+MTAgFw0yMzA3MDQxNzQ3NDBaGA8yMTIzMDYxMDE3NDgxMFowge8xCzAJBgNVBAYT
+AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
+MSQwIgYDVQQJExs1NDggTWFya2V0IFN0cmVldCBQbWIgNzAxNDgxDjAMBgNVBBET
+BTk0MTA0MSAwHgYDVQQKExdBdXRoZW50aWsgU2VjdXJpdHkgSW5jLjEcMBoGA1UE
+CxMTRW50ZXJwcmlzZSBMaWNlbnNlczE9MDsGA1UEAxM0QXV0aGVudGlrIFNlY3Vy
+aXR5IEluYy4gRW50ZXJwcmlzZSBMaWNlbnNpbmcgUm9vdCBYMTB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABNbPJH6nDbSshpDsDHBRL0UcZVXWCK30txqcMKU+YFmLB6iR
+PJiHjHA8Z+5aP4eNH6onA5xqykQf65tvbFBA1LB/6HqMArU/tYVVQx4+o9hRBxF5
+RrzXucUg2br+RX8aa6OCAVUwggFRMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBRHpR3/ptPgN0yHVfUjyJOEmsPZqTAfBgNVHSMEGDAW
+gBRHpR3/ptPgN0yHVfUjyJOEmsPZqTCBoAYIKwYBBQUHAQEEgZMwgZAwRwYIKwYB
+BQUHMAGGO2h0dHBzOi8vdmF1bHQuY3VzdG9tZXJzLmdvYXV0aGVudGlrLmlvL3Yx
+L2xpY2Vuc2luZy1jYS9vY3NwMEUGCCsGAQUFBzAChjlodHRwczovL3ZhdWx0LmN1
+c3RvbWVycy5nb2F1dGhlbnRpay5pby92MS9saWNlbnNpbmctY2EvY2EwSwYDVR0f
+BEQwQjBAoD6gPIY6aHR0cHM6Ly92YXVsdC5jdXN0b21lcnMuZ29hdXRoZW50aWsu
+aW8vdjEvbGljZW5zaW5nLWNhL2NybDAKBggqhkjOPQQDAwNnADBkAjB0+YA1yjEO
+g43CCYUJXz9m9CNIkjOPUI0jO4UtvSj8j067TKRbX6IL/29HxPtQoYACME8eZHBJ
+Ljcog0oeBgjr4wK8bobgknr5wrm70rrNNpbSAjDvTvXMQeAShGgsftEquQ==
+-----END CERTIFICATE-----

authentik/enterprise/settings.py

@@ -1 +1,12 @@
 """Enterprise additional settings"""
+from celery.schedules import crontab
+
+from authentik.lib.utils.time import fqdn_rand
+
+CELERY_BEAT_SCHEDULE = {
+    "enterprise_calculate_license": {
+        "task": "authentik.enterprise.tasks.calculate_license",
+        "schedule": crontab(minute=fqdn_rand("calculate_license"), hour="*/8"),
+        "options": {"queue": "authentik_scheduled"},
+    }
+}

authentik/enterprise/signals.py

@@ -0,0 +1,18 @@
+"""Enterprise signals"""
+from datetime import datetime
+
+from django.db.models.signals import pre_save
+from django.dispatch import receiver
+from django.utils.timezone import get_current_timezone
+
+from authentik.enterprise.models import License
+
+
+@receiver(pre_save, sender=License)
+def pre_save_license(sender: type[License], instance: License, **_):
+    """Extract data from license jwt and save it into model"""
+    status = instance.status
+    instance.name = status.name
+    instance.internal_users = status.internal_users
+    instance.external_users = status.external_users
+    instance.expiry = datetime.fromtimestamp(status.exp, tz=get_current_timezone())

authentik/enterprise/tasks.py

@@ -0,0 +1,10 @@
+"""Enterprise tasks"""
+from authentik.enterprise.models import LicenseKey
+from authentik.root.celery import CELERY_APP
+
+
+@CELERY_APP.task()
+def calculate_license():
+    """Calculate licensing status"""
+    total = LicenseKey.get_total()
+    total.record_usage()

authentik/enterprise/tests/test_license.py

@@ -0,0 +1,64 @@
+"""Enterprise license tests"""
+from datetime import timedelta
+from time import mktime
+from unittest.mock import MagicMock, patch
+
+from django.test import TestCase
+from django.utils.timezone import now
+from rest_framework.exceptions import ValidationError
+
+from authentik.enterprise.models import License, LicenseKey
+from authentik.lib.generators import generate_id
+
+_exp = int(mktime((now() + timedelta(days=3000)).timetuple()))
+
+
+class TestEnterpriseLicense(TestCase):
+    """Enterprise license tests"""
+
+    @patch(
+        "authentik.enterprise.models.LicenseKey.validate",
+        MagicMock(
+            return_value=LicenseKey(
+                aud="",
+                exp=_exp,
+                name=generate_id(),
+                internal_users=100,
+                external_users=100,
+            )
+        ),
+    )
+    def test_valid(self):
+        """Check license verification"""
+        lic = License.objects.create(key=generate_id())
+        self.assertTrue(lic.status.is_valid())
+        self.assertEqual(lic.internal_users, 100)
+
+    def test_invalid(self):
+        """Test invalid license"""
+        with self.assertRaises(ValidationError):
+            License.objects.create(key=generate_id())
+
+    @patch(
+        "authentik.enterprise.models.LicenseKey.validate",
+        MagicMock(
+            return_value=LicenseKey(
+                aud="",
+                exp=_exp,
+                name=generate_id(),
+                internal_users=100,
+                external_users=100,
+            )
+        ),
+    )
+    def test_valid_multiple(self):
+        """Check license verification"""
+        lic = License.objects.create(key=generate_id())
+        self.assertTrue(lic.status.is_valid())
+        lic2 = License.objects.create(key=generate_id())
+        self.assertTrue(lic2.status.is_valid())
+        total = LicenseKey.get_total()
+        self.assertEqual(total.internal_users, 200)
+        self.assertEqual(total.external_users, 200)
+        self.assertEqual(total.exp, _exp)
+        self.assertTrue(total.is_valid())

authentik/enterprise/urls.py

@@ -0,0 +1,7 @@
+"""API URLs"""
+
+from authentik.enterprise.api import LicenseViewSet
+
+api_urlpatterns = [
+    ("enterprise/license", LicenseViewSet),
+]

authentik/events/api/events.py

@@ -4,7 +4,7 @@ from json import loads
 
 import django_filters
 from django.db.models.aggregates import Count
-from django.db.models.fields.json import KeyTextTransform
+from django.db.models.fields.json import KeyTextTransform, KeyTransform
 from django.db.models.functions import ExtractDay
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, extend_schema
@@ -134,11 +134,11 @@ class EventViewSet(ModelViewSet):
         """Get the top_n events grouped by user count"""
         filtered_action = request.query_params.get("action", EventAction.LOGIN)
         top_n = int(request.query_params.get("top_n", "15"))
-        return Response(
+        events = (
             get_objects_for_user(request.user, "authentik_events.view_event")
             .filter(action=filtered_action)
             .exclude(context__authorized_application=None)
-            .annotate(application=KeyTextTransform("authorized_application", "context"))
+            .annotate(application=KeyTransform("authorized_application", "context"))
             .annotate(user_pk=KeyTextTransform("pk", "user"))
             .values("application")
             .annotate(counted_events=Count("application"))
@@ -146,6 +146,7 @@ class EventViewSet(ModelViewSet):
             .values("unique_users", "application", "counted_events")
             .order_by("-counted_events")[:top_n]
         )
+        return Response(EventTopPerUserSerializer(instance=events, many=True).data)
 
     @extend_schema(
         methods=["GET"],

authentik/events/api/notification_transports.py

@@ -39,7 +39,7 @@ class NotificationTransportSerializer(ModelSerializer):
         mode = attrs.get("mode")
         if mode in [TransportMode.WEBHOOK, TransportMode.WEBHOOK_SLACK]:
             if "webhook_url" not in attrs or attrs.get("webhook_url", "") == "":
-                raise ValidationError("Webhook URL may not be empty.")
+                raise ValidationError({"webhook_url": "Webhook URL may not be empty."})
         return attrs
 
     class Meta:

authentik/events/geo.py

@@ -33,7 +33,7 @@ class GeoIPReader:
 
     def __open(self):
         """Get GeoIP Reader, if configured, otherwise none"""
-        path = CONFIG.y("geoip")
+        path = CONFIG.get("geoip")
         if path == "" or not path:
             return
         try:
@@ -46,7 +46,7 @@ class GeoIPReader:
     def __check_expired(self):
         """Check if the modification date of the GeoIP database has
         changed, and reload it if so"""
-        path = CONFIG.y("geoip")
+        path = CONFIG.get("geoip")
         try:
             mtime = stat(path).st_mtime
             diff = self.__last_mtime < mtime

authentik/events/monitored_tasks.py

@@ -76,9 +76,20 @@ class TaskInfo:
             return cache.get_many(cache.keys(CACHE_KEY_PREFIX + name)).values()
         return cache.get(CACHE_KEY_PREFIX + name, None)
 
+    @property
+    def full_name(self) -> str:
+        """Get the full cache key with task name and UID"""
+        key = CACHE_KEY_PREFIX + self.task_name
+        if self.result.uid:
+            uid_suffix = f":{self.result.uid}"
+            key += uid_suffix
+            if not self.task_name.endswith(uid_suffix):
+                self.task_name += uid_suffix
+        return key
+
     def delete(self):
         """Delete task info from cache"""
-        return cache.delete(CACHE_KEY_PREFIX + self.task_name)
+        return cache.delete(self.full_name)
 
     def update_metrics(self):
         """Update prometheus metrics"""
@@ -92,17 +103,13 @@ class TaskInfo:
         GAUGE_TASKS.labels(
             task_name=self.task_name.split(":")[0],
             task_uid=self.result.uid or "",
-            status=self.result.status.value,
+            status=self.result.status.name.lower(),
         ).set(duration)
 
     def save(self, timeout_hours=6):
         """Save task into cache"""
-        key = CACHE_KEY_PREFIX + self.task_name
-        if self.result.uid:
-            key += f":{self.result.uid}"
-            self.task_name += f":{self.result.uid}"
         self.update_metrics()
-        cache.set(key, self, timeout=timeout_hours * 60 * 60)
+        cache.set(self.full_name, self, timeout=timeout_hours * 60 * 60)
 
 
 class MonitoredTask(Task):

authentik/events/tests/test_tasks.py

@@ -0,0 +1,43 @@
+"""Test Monitored tasks"""
+from django.test import TestCase
+
+from authentik.events.monitored_tasks import MonitoredTask, TaskInfo, TaskResult, TaskResultStatus
+from authentik.lib.generators import generate_id
+from authentik.root.celery import CELERY_APP
+
+
+class TestMonitoredTasks(TestCase):
+    """Test Monitored tasks"""
+
+    def test_failed_successful_remove_state(self):
+        """Test that a task with `save_on_success` set to `False` that failed saves
+        a state, and upon successful completion will delete the state"""
+        should_fail = True
+        uid = generate_id()
+
+        @CELERY_APP.task(
+            bind=True,
+            base=MonitoredTask,
+        )
+        def test_task(self: MonitoredTask):
+            self.save_on_success = False
+            self.set_uid(uid)
+            self.set_status(
+                TaskResult(TaskResultStatus.ERROR if should_fail else TaskResultStatus.SUCCESSFUL)
+            )
+
+        # First test successful run
+        should_fail = False
+        test_task.delay().get()
+        self.assertIsNone(TaskInfo.by_name(f"test_task:{uid}"))
+
+        # Then test failed
+        should_fail = True
+        test_task.delay().get()
+        info = TaskInfo.by_name(f"test_task:{uid}")
+        self.assertEqual(info.result.status, TaskResultStatus.ERROR)
+
+        # Then after that, the state should be removed
+        should_fail = False
+        test_task.delay().get()
+        self.assertIsNone(TaskInfo.by_name(f"test_task:{uid}"))

authentik/flows/migrations/0026_alter_flow_options.py

@@ -0,0 +1,25 @@
+# Generated by Django 4.2.6 on 2023-10-10 17:18
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_flows", "0025_alter_flowstagebinding_evaluate_on_plan_and_more"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="flow",
+            options={
+                "permissions": [
+                    ("export_flow", "Can export a Flow"),
+                    ("inspect_flow", "Can inspect a Flow's execution"),
+                    ("view_flow_cache", "View Flow's cache metrics"),
+                    ("clear_flow_cache", "Clear Flow's cache metrics"),
+                ],
+                "verbose_name": "Flow",
+                "verbose_name_plural": "Flows",
+            },
+        ),
+    ]

authentik/flows/migrations/0027_auto_20231028_1424.py

@@ -0,0 +1,34 @@
+# Generated by Django 4.2.6 on 2023-10-28 14:24
+
+from django.apps.registry import Apps
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def set_oobe_flow_authentication(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    from guardian.shortcuts import get_anonymous_user
+
+    Flow = apps.get_model("authentik_flows", "Flow")
+    User = apps.get_model("authentik_core", "User")
+
+    db_alias = schema_editor.connection.alias
+
+    users = User.objects.using(db_alias).exclude(username="akadmin")
+    try:
+        users = users.exclude(pk=get_anonymous_user().pk)
+    # pylint: disable=broad-except
+    except Exception:  # nosec
+        pass
+
+    if users.exists():
+        Flow.objects.filter(slug="initial-setup").update(authentication="require_superuser")
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_flows", "0026_alter_flow_options"),
+    ]
+
+    operations = [
+        migrations.RunPython(set_oobe_flow_authentication),
+    ]

authentik/flows/planner.py

@@ -33,7 +33,7 @@ PLAN_CONTEXT_SOURCE = "source"
 # Is set by the Flow Planner when a FlowToken was used, and the currently active flow plan
 # was restored.
 PLAN_CONTEXT_IS_RESTORED = "is_restored"
-CACHE_TIMEOUT = int(CONFIG.y("redis.cache_timeout_flows"))
+CACHE_TIMEOUT = CONFIG.get_int("redis.cache_timeout_flows")
 CACHE_PREFIX = "goauthentik.io/flows/planner/"
 
 

authentik/flows/tests/test_executor.py

@@ -18,7 +18,6 @@ from authentik.flows.planner import FlowPlan, FlowPlanner
 from authentik.flows.stage import PLAN_CONTEXT_PENDING_USER_IDENTIFIER, StageView
 from authentik.flows.tests import FlowTestCase
 from authentik.flows.views.executor import NEXT_ARG_NAME, SESSION_KEY_PLAN, FlowExecutorView
-from authentik.lib.config import CONFIG
 from authentik.lib.generators import generate_id
 from authentik.policies.dummy.models import DummyPolicy
 from authentik.policies.models import PolicyBinding
@@ -85,7 +84,6 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )
@@ -111,7 +109,6 @@ class TestFlowExecutor(FlowTestCase):
             denied_action=FlowDeniedAction.CONTINUE,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )
@@ -128,7 +125,6 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         dest = "/unique-string"
         url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
         response = self.client.get(url + f"?{NEXT_ARG_NAME}={dest}")
@@ -145,7 +141,6 @@ class TestFlowExecutor(FlowTestCase):
             FlowDesignation.AUTHENTICATION,
         )
 
-        CONFIG.update_from_dict({"domain": "testserver"})
         response = self.client.get(
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )

authentik/lib/apps.py

@@ -1,10 +0,0 @@
-"""authentik lib app config"""
-from django.apps import AppConfig
-
-
-class AuthentikLibConfig(AppConfig):
-    """authentik lib app config"""
-
-    name = "authentik.lib"
-    label = "authentik_lib"
-    verbose_name = "authentik lib"

authentik/lib/avatars.py

@@ -175,7 +175,7 @@ def get_avatar(user: "User") -> str:
         "initials": avatar_mode_generated,
         "gravatar": avatar_mode_gravatar,
     }
-    modes: str = CONFIG.y("avatars", "none")
+    modes: str = CONFIG.get("avatars", "none")
     for mode in modes.split(","):
         avatar = None
         if mode in mode_map:

authentik/lib/config.go

@@ -0,0 +1,10 @@
+package lib
+
+import _ "embed"
+
+//go:embed default.yml
+var defaultConfig []byte
+
+func DefaultConfig() []byte {
+	return defaultConfig
+}

authentik/lib/config.py

@@ -2,13 +2,15 @@
 import os
 from collections.abc import Mapping
 from contextlib import contextmanager
+from dataclasses import dataclass, field
+from enum import Enum
 from glob import glob
-from json import dumps, loads
+from json import JSONEncoder, dumps, loads
 from json.decoder import JSONDecodeError
 from pathlib import Path
 from sys import argv, stderr
 from time import time
-from typing import Any
+from typing import Any, Optional
 from urllib.parse import urlparse
 
 import yaml
@@ -32,15 +34,44 @@ def get_path_from_dict(root: dict, path: str, sep=".", default=None) -> Any:
     return root
 
 
+@dataclass
+class Attr:
+    """Single configuration attribute"""
+
+    class Source(Enum):
+        """Sources a configuration attribute can come from, determines what should be done with
+        Attr.source (and if it's set at all)"""
+
+        UNSPECIFIED = "unspecified"
+        ENV = "env"
+        CONFIG_FILE = "config_file"
+        URI = "uri"
+
+    value: Any
+
+    source_type: Source = field(default=Source.UNSPECIFIED)
+
+    # depending on source_type, might contain the environment variable or the path
+    # to the config file containing this change or the file containing this value
+    source: Optional[str] = field(default=None)
+
+
+class AttrEncoder(JSONEncoder):
+    """JSON encoder that can deal with `Attr` classes"""
+
+    def default(self, o: Any) -> Any:
+        if isinstance(o, Attr):
+            return o.value
+        return super().default(o)
+
+
 class ConfigLoader:
     """Search through SEARCH_PATHS and load configuration. Environment variables starting with
     `ENV_PREFIX` are also applied.
 
     A variable like AUTHENTIK_POSTGRESQL__HOST would translate to postgresql.host"""
 
-    loaded_file = []
-
-    def __init__(self):
+    def __init__(self, **kwargs):
         super().__init__()
         self.__config = {}
         base_dir = Path(__file__).parent.joinpath(Path("../..")).resolve()
@@ -65,6 +96,7 @@ class ConfigLoader:
                         # Update config with env file
                         self.update_from_file(env_file)
         self.update_from_env()
+        self.update(self.__config, kwargs)
 
     def log(self, level: str, message: str, **kwargs):
         """Custom Log method, we want to ensure ConfigLoader always logs JSON even when
@@ -86,22 +118,34 @@ class ConfigLoader:
             else:
                 if isinstance(value, str):
                     value = self.parse_uri(value)
+                elif isinstance(value, Attr) and isinstance(value.value, str):
+                    value = self.parse_uri(value.value)
+                elif not isinstance(value, Attr):
+                    value = Attr(value)
                 root[key] = value
         return root
 
-    def parse_uri(self, value: str) -> str:
+    def refresh(self, key: str):
+        """Update a single value"""
+        attr: Attr = get_path_from_dict(self.raw, key)
+        if attr.source_type != Attr.Source.URI:
+            return
+        attr.value = self.parse_uri(attr.source).value
+
+    def parse_uri(self, value: str) -> Attr:
         """Parse string values which start with a URI"""
         url = urlparse(value)
+        parsed_value = value
         if url.scheme == "env":
-            value = os.getenv(url.netloc, url.query)
+            parsed_value = os.getenv(url.netloc, url.query)
         if url.scheme == "file":
             try:
                 with open(url.path, "r", encoding="utf8") as _file:
-                    value = _file.read().strip()
+                    parsed_value = _file.read().strip()
             except OSError as exc:
                 self.log("error", f"Failed to read config value from {url.path}: {exc}")
-                value = url.query
-        return value
+                parsed_value = url.query
+        return Attr(parsed_value, Attr.Source.URI, value)
 
     def update_from_file(self, path: Path):
         """Update config from file contents"""
@@ -110,7 +154,6 @@ class ConfigLoader:
                 try:
                     self.update(self.__config, yaml.safe_load(file))
                     self.log("debug", "Loaded config", file=str(path))
-                    self.loaded_file.append(path)
                 except yaml.YAMLError as exc:
                     raise ImproperlyConfigured from exc
         except PermissionError as exc:
@@ -121,10 +164,6 @@ class ConfigLoader:
                 error=str(exc),
             )
 
-    def update_from_dict(self, update: dict):
-        """Update config from dict"""
-        self.__config.update(update)
-
     def update_from_env(self):
         """Check environment variables"""
         outer = {}
@@ -145,7 +184,7 @@ class ConfigLoader:
                 value = loads(value)
             except JSONDecodeError:
                 pass
-            current_obj[dot_parts[-1]] = value
+            current_obj[dot_parts[-1]] = Attr(value, Attr.Source.ENV, key)
             idx += 1
         if idx > 0:
             self.log("debug", "Loaded environment variables", count=idx)
@@ -154,28 +193,40 @@ class ConfigLoader:
     @contextmanager
     def patch(self, path: str, value: Any):
         """Context manager for unittests to patch a value"""
-        original_value = self.y(path)
-        self.y_set(path, value)
+        original_value = self.get(path)
+        self.set(path, value)
         try:
             yield
         finally:
-            self.y_set(path, original_value)
+            self.set(path, original_value)
 
     @property
     def raw(self) -> dict:
         """Get raw config dictionary"""
         return self.__config
 
-    # pylint: disable=invalid-name
-    def y(self, path: str, default=None, sep=".") -> Any:
+    def get(self, path: str, default=None, sep=".") -> Any:
         """Access attribute by using yaml path"""
         # Walk sub_dicts before parsing path
         root = self.raw
         # Walk each component of the path
-        return get_path_from_dict(root, path, sep=sep, default=default)
+        attr: Attr = get_path_from_dict(root, path, sep=sep, default=Attr(default))
+        return attr.value
 
-    def y_set(self, path: str, value: Any, sep="."):
-        """Set value using same syntax as y()"""
+    def get_int(self, path: str, default=0) -> int:
+        """Wrapper for get that converts value into int"""
+        try:
+            return int(self.get(path, default))
+        except ValueError as exc:
+            self.log("warning", "Failed to parse config as int", path=path, exc=str(exc))
+            return default
+
+    def get_bool(self, path: str, default=False) -> bool:
+        """Wrapper for get that converts value into boolean"""
+        return str(self.get(path, default)).lower() == "true"
+
+    def set(self, path: str, value: Any, sep="."):
+        """Set value using same syntax as get()"""
         # Walk sub_dicts before parsing path
         root = self.raw
         # Walk each component of the path
@@ -184,17 +235,14 @@ class ConfigLoader:
             if comp not in root:
                 root[comp] = {}
             root = root.get(comp, {})
-        root[path_parts[-1]] = value
-
-    def y_bool(self, path: str, default=False) -> bool:
-        """Wrapper for y that converts value into boolean"""
-        return str(self.y(path, default)).lower() == "true"
+        root[path_parts[-1]] = Attr(value)
 
 
 CONFIG = ConfigLoader()
 
+
 if __name__ == "__main__":
     if len(argv) < 2:
-        print(dumps(CONFIG.raw, indent=4))
+        print(dumps(CONFIG.raw, indent=4, cls=AttrEncoder))
     else:
-        print(CONFIG.y(argv[1]))
+        print(CONFIG.get(argv[1]))

authentik/lib/default.yml

@@ -11,7 +11,11 @@ postgresql:
 listen:
   listen_http: 0.0.0.0:9000
   listen_https: 0.0.0.0:9443
+  listen_ldap: 0.0.0.0:3389
+  listen_ldaps: 0.0.0.0:6636
+  listen_radius: 0.0.0.0:1812
   listen_metrics: 0.0.0.0:9300
+  listen_debug: 0.0.0.0:9900
   trusted_proxy_cidrs:
     - 127.0.0.0/8
     - 10.0.0.0/8
@@ -32,6 +36,9 @@ redis:
   cache_timeout_policies: 300
   cache_timeout_reputation: 300
 
+paths:
+  media: ./media
+
 debug: false
 remote_debug: false
 
@@ -77,6 +84,9 @@ ldap:
   tls:
     ciphers: null
 
+reputation:
+  expiry: 86400
+
 cookie_domain: null
 disable_update_check: false
 disable_startup_analytics: false

authentik/lib/expression/evaluator.py

@@ -112,7 +112,7 @@ class BaseEvaluator:
     @staticmethod
     def expr_is_group_member(user: User, **group_filters) -> bool:
         """Check if `user` is member of group with name `group_name`"""
-        return user.ak_groups.filter(**group_filters).exists()
+        return user.all_groups().filter(**group_filters).exists()
 
     @staticmethod
     def expr_user_by(**filters) -> Optional[User]:

authentik/lib/sentry.py

@@ -51,18 +51,18 @@ class SentryTransport(HttpTransport):
 
 def sentry_init(**sentry_init_kwargs):
     """Configure sentry SDK"""
-    sentry_env = CONFIG.y("error_reporting.environment", "customer")
+    sentry_env = CONFIG.get("error_reporting.environment", "customer")
     kwargs = {
         "environment": sentry_env,
-        "send_default_pii": CONFIG.y_bool("error_reporting.send_pii", False),
+        "send_default_pii": CONFIG.get_bool("error_reporting.send_pii", False),
         "_experiments": {
-            "profiles_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.1)),
+            "profiles_sample_rate": float(CONFIG.get("error_reporting.sample_rate", 0.1)),
         },
     }
     kwargs.update(**sentry_init_kwargs)
     # pylint: disable=abstract-class-instantiated
     sentry_sdk_init(
-        dsn=CONFIG.y("error_reporting.sentry_dsn"),
+        dsn=CONFIG.get("error_reporting.sentry_dsn"),
         integrations=[
             ArgvIntegration(),
             StdlibIntegration(),
@@ -92,13 +92,13 @@ def traces_sampler(sampling_context: dict) -> float:
         return 0
     if _type == "websocket":
         return 0
-    return float(CONFIG.y("error_reporting.sample_rate", 0.1))
+    return float(CONFIG.get("error_reporting.sample_rate", 0.1))
 
 
 def before_send(event: dict, hint: dict) -> Optional[dict]:
     """Check if error is database error, and ignore if so"""
     # pylint: disable=no-name-in-module
-    from psycopg2.errors import Error
+    from psycopg.errors import Error
 
     ignored_classes = (
         # Inbuilt types

authentik/lib/tests/test_config.py

@@ -16,23 +16,23 @@ class TestConfig(TestCase):
         config = ConfigLoader()
         environ[ENV_PREFIX + "_test__test"] = "bar"
         config.update_from_env()
-        self.assertEqual(config.y("test.test"), "bar")
+        self.assertEqual(config.get("test.test"), "bar")
 
     def test_patch(self):
         """Test patch decorator"""
         config = ConfigLoader()
-        config.y_set("foo.bar", "bar")
-        self.assertEqual(config.y("foo.bar"), "bar")
+        config.set("foo.bar", "bar")
+        self.assertEqual(config.get("foo.bar"), "bar")
         with config.patch("foo.bar", "baz"):
-            self.assertEqual(config.y("foo.bar"), "baz")
-        self.assertEqual(config.y("foo.bar"), "bar")
+            self.assertEqual(config.get("foo.bar"), "baz")
+        self.assertEqual(config.get("foo.bar"), "bar")
 
     def test_uri_env(self):
         """Test URI parsing (environment)"""
         config = ConfigLoader()
         environ["foo"] = "bar"
-        self.assertEqual(config.parse_uri("env://foo"), "bar")
-        self.assertEqual(config.parse_uri("env://foo?bar"), "bar")
+        self.assertEqual(config.parse_uri("env://foo").value, "bar")
+        self.assertEqual(config.parse_uri("env://foo?bar").value, "bar")
 
     def test_uri_file(self):
         """Test URI parsing (file load)"""
@@ -41,11 +41,31 @@ class TestConfig(TestCase):
         write(file, "foo".encode())
         _, file2_name = mkstemp()
         chmod(file2_name, 0o000)  # Remove all permissions so we can't read the file
-        self.assertEqual(config.parse_uri(f"file://{file_name}"), "foo")
-        self.assertEqual(config.parse_uri(f"file://{file2_name}?def"), "def")
+        self.assertEqual(config.parse_uri(f"file://{file_name}").value, "foo")
+        self.assertEqual(config.parse_uri(f"file://{file2_name}?def").value, "def")
         unlink(file_name)
         unlink(file2_name)
 
+    def test_uri_file_update(self):
+        """Test URI parsing (file load and update)"""
+        file, file_name = mkstemp()
+        write(file, "foo".encode())
+        config = ConfigLoader(file_test=f"file://{file_name}")
+        self.assertEqual(config.get("file_test"), "foo")
+
+        # Update config file
+        write(file, "bar".encode())
+        config.refresh("file_test")
+        self.assertEqual(config.get("file_test"), "foobar")
+
+        unlink(file_name)
+
+    def test_uri_env_full(self):
+        """Test URI set as env variable"""
+        environ["AUTHENTIK_TEST_VAR"] = "file:///foo?bar"
+        config = ConfigLoader()
+        self.assertEqual(config.get("test_var"), "bar")
+
     def test_file_update(self):
         """Test update_from_file"""
         config = ConfigLoader()
@@ -59,3 +79,15 @@ class TestConfig(TestCase):
         config.update_from_file(file2_name)
         unlink(file_name)
         unlink(file2_name)
+
+    def test_get_int(self):
+        """Test get_int"""
+        config = ConfigLoader()
+        config.set("foo", 1234)
+        self.assertEqual(config.get_int("foo"), 1234)
+
+    def test_get_int_invalid(self):
+        """Test get_int"""
+        config = ConfigLoader()
+        config.set("foo", "bar")
+        self.assertEqual(config.get_int("foo", 1234), 1234)

authentik/lib/tests/test_http.py

@@ -1,7 +1,7 @@
 """Test HTTP Helpers"""
 from django.test import RequestFactory, TestCase
 
-from authentik.core.models import USER_ATTRIBUTE_CAN_OVERRIDE_IP, Token, TokenIntents
+from authentik.core.models import Token, TokenIntents, UserTypes
 from authentik.core.tests.utils import create_test_admin_user
 from authentik.lib.utils.http import OUTPOST_REMOTE_IP_HEADER, OUTPOST_TOKEN_HEADER, get_client_ip
 from authentik.lib.views import bad_request_message
@@ -53,7 +53,7 @@ class TestHTTP(TestCase):
         )
         self.assertEqual(get_client_ip(request), "127.0.0.1")
         # Valid
-        self.user.attributes[USER_ATTRIBUTE_CAN_OVERRIDE_IP] = True
+        self.user.type = UserTypes.INTERNAL_SERVICE_ACCOUNT
         self.user.save()
         request = self.factory.get(
             "/",

authentik/lib/utils/http.py

@@ -33,9 +33,8 @@ def _get_client_ip_from_meta(meta: dict[str, Any]) -> str:
 
 def _get_outpost_override_ip(request: HttpRequest) -> Optional[str]:
     """Get the actual remote IP when set by an outpost. Only
-    allowed when the request is authenticated, by a user with USER_ATTRIBUTE_CAN_OVERRIDE_IP set
-    to outpost"""
-    from authentik.core.models import USER_ATTRIBUTE_CAN_OVERRIDE_IP, Token, TokenIntents
+    allowed when the request is authenticated, by an outpost internal service account"""
+    from authentik.core.models import Token, TokenIntents, UserTypes
 
     if OUTPOST_REMOTE_IP_HEADER not in request.META or OUTPOST_TOKEN_HEADER not in request.META:
         return None
@@ -51,7 +50,7 @@ def _get_outpost_override_ip(request: HttpRequest) -> Optional[str]:
         LOGGER.warning("Attempted remote-ip override without token", fake_ip=fake_ip)
         return None
     user = token.user
-    if not user.group_attributes(request).get(USER_ATTRIBUTE_CAN_OVERRIDE_IP, False):
+    if user.type != UserTypes.INTERNAL_SERVICE_ACCOUNT:
         LOGGER.warning(
             "Remote-IP override: user doesn't have permission",
             user=user,

authentik/lib/utils/reflection.py

@@ -50,7 +50,7 @@ def get_env() -> str:
     """Get environment in which authentik is currently running"""
     if "CI" in os.environ:
         return "ci"
-    if CONFIG.y_bool("debug"):
+    if CONFIG.get_bool("debug"):
         return "dev"
     if SERVICE_HOST_ENV_NAME in os.environ:
         return "kubernetes"

authentik/outposts/controllers/base.py

@@ -97,7 +97,7 @@ class BaseController:
         if self.outpost.config.container_image is not None:
             return self.outpost.config.container_image
 
-        image_name_template: str = CONFIG.y("outposts.container_image_base")
+        image_name_template: str = CONFIG.get("outposts.container_image_base")
         return image_name_template % {
             "type": self.outpost.type,
             "version": __version__,

authentik/outposts/controllers/k8s/base.py

@@ -1,16 +1,22 @@
 """Base Kubernetes Reconciler"""
+from dataclasses import asdict
+from json import dumps
 from typing import TYPE_CHECKING, Generic, Optional, TypeVar
 
+from dacite.core import from_dict
 from django.utils.text import slugify
-from kubernetes.client import V1ObjectMeta
+from jsonpatch import JsonPatchConflict, JsonPatchException, JsonPatchTestFailed, apply_patch
+from kubernetes.client import ApiClient, V1ObjectMeta
 from kubernetes.client.exceptions import ApiException, OpenApiException
 from kubernetes.client.models.v1_deployment import V1Deployment
 from kubernetes.client.models.v1_pod import V1Pod
+from requests import Response
 from structlog.stdlib import get_logger
 from urllib3.exceptions import HTTPError
 
 from authentik import __version__
 from authentik.outposts.apps import MANAGED_OUTPOST
+from authentik.outposts.controllers.base import ControllerException
 from authentik.outposts.controllers.k8s.triggers import NeedsRecreate, NeedsUpdate
 
 if TYPE_CHECKING:
@@ -34,11 +40,23 @@ class KubernetesObjectReconciler(Generic[T]):
         self.namespace = controller.outpost.config.kubernetes_namespace
         self.logger = get_logger().bind(type=self.__class__.__name__)
 
+    def get_patch(self):
+        """Get any patches that apply to this CRD"""
+        patches = self.controller.outpost.config.kubernetes_json_patches
+        if not patches:
+            return None
+        return patches.get(self.reconciler_name(), None)
+
     @property
     def is_embedded(self) -> bool:
         """Return true if the current outpost is embedded"""
         return self.controller.outpost.managed == MANAGED_OUTPOST
 
+    @staticmethod
+    def reconciler_name() -> str:
+        """A name this reconciler is identified by in the configuration"""
+        raise NotImplementedError
+
     @property
     def noop(self) -> bool:
         """Return true if this object should not be created/updated/deleted in this cluster"""
@@ -55,6 +73,32 @@ class KubernetesObjectReconciler(Generic[T]):
             }
         ).lower()
 
+    def get_patched_reference_object(self) -> T:
+        """Get patched reference object"""
+        reference = self.get_reference_object()
+        patch = self.get_patch()
+        try:
+            json = ApiClient().sanitize_for_serialization(reference)
+        # Custom objects will not be known to the clients openapi types
+        except AttributeError:
+            json = asdict(reference)
+        try:
+            ref = json
+            if patch is not None:
+                ref = apply_patch(json, patch)
+        except (JsonPatchException, JsonPatchConflict, JsonPatchTestFailed) as exc:
+            raise ControllerException(f"JSON Patch failed: {exc}") from exc
+        mock_response = Response()
+        mock_response.data = dumps(ref)
+
+        try:
+            result = ApiClient().deserialize(mock_response, reference.__class__.__name__)
+        # Custom objects will not be known to the clients openapi types
+        except AttributeError:
+            result = from_dict(reference.__class__, data=ref)
+
+        return result
+
     # pylint: disable=invalid-name
     def up(self):
         """Create object if it doesn't exist, update if needed or recreate if needed."""
@@ -62,7 +106,7 @@ class KubernetesObjectReconciler(Generic[T]):
         if self.noop:
             self.logger.debug("Object is noop")
             return
-        reference = self.get_reference_object()
+        reference = self.get_patched_reference_object()
         try:
             try:
                 current = self.retrieve()
@@ -129,6 +173,16 @@ class KubernetesObjectReconciler(Generic[T]):
         if current.metadata.labels != reference.metadata.labels:
             raise NeedsUpdate()
 
+        patch = self.get_patch()
+        if patch is not None:
+            current_json = ApiClient().sanitize_for_serialization(current)
+
+            try:
+                if apply_patch(current_json, patch) != current_json:
+                    raise NeedsUpdate()
+            except (JsonPatchException, JsonPatchConflict, JsonPatchTestFailed) as exc:
+                raise ControllerException(f"JSON Patch failed: {exc}") from exc
+
     def create(self, reference: T):
         """API Wrapper to create object"""
         raise NotImplementedError

authentik/outposts/controllers/k8s/deployment.py

@@ -43,6 +43,10 @@ class DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):
         self.api = AppsV1Api(controller.client)
         self.outpost = self.controller.outpost
 
+    @staticmethod
+    def reconciler_name() -> str:
+        return "deployment"
+
     def reconcile(self, current: V1Deployment, reference: V1Deployment):
         compare_ports(
             current.spec.template.spec.containers[0].ports,

authentik/outposts/controllers/k8s/secret.py

@@ -24,6 +24,10 @@ class SecretReconciler(KubernetesObjectReconciler[V1Secret]):
         super().__init__(controller)
         self.api = CoreV1Api(controller.client)
 
+    @staticmethod
+    def reconciler_name() -> str:
+        return "secret"
+
     def reconcile(self, current: V1Secret, reference: V1Secret):
         super().reconcile(current, reference)
         for key in reference.data.keys():

authentik/outposts/controllers/k8s/service.py

@@ -20,6 +20,10 @@ class ServiceReconciler(KubernetesObjectReconciler[V1Service]):
         super().__init__(controller)
         self.api = CoreV1Api(controller.client)
 
+    @staticmethod
+    def reconciler_name() -> str:
+        return "service"
+
     def reconcile(self, current: V1Service, reference: V1Service):
         compare_ports(current.spec.ports, reference.spec.ports)
         # run the base reconcile last, as that will probably raise NeedsUpdate

authentik/outposts/controllers/k8s/service_monitor.py

@@ -71,6 +71,10 @@ class PrometheusServiceMonitorReconciler(KubernetesObjectReconciler[PrometheusSe
         self.api_ex = ApiextensionsV1Api(controller.client)
         self.api = CustomObjectsApi(controller.client)
 
+    @staticmethod
+    def reconciler_name() -> str:
+        return "prometheus servicemonitor"
+
     @property
     def noop(self) -> bool:
         return (not self._crd_exists()) or (self.is_embedded)