Extraneous whitespace. Darnit.

Still trying to get the docs to line up.
And, having figured that out, make the documentation match.
2024-11-01 14:56:00 -07:00 · 2024-11-01 14:55:32 -07:00 · 2024-11-01 14:54:36 -07:00 · 2024-11-01 14:53:29 -07:00 · 2024-11-01 14:50:38 -07:00 · 2024-11-01 14:45:01 -07:00
91 changed files with 12319 additions and 547 deletions
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2024.8.3
+current_version = 2024.10.0
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?
--- a/SECURITY.md
+++ b/SECURITY.md
@ -18,10 +18,10 @@ Even if the issue is not a CVE, we still greatly appreciate your help in hardeni

 (.x being the latest patch release for each version)

-| Version  | Supported |
-| -------- | --------- |
-| 2024.6.x | ✅        |
-| 2024.8.x | ✅        |
+| Version   | Supported |
+| --------- | --------- |
+| 2024.8.x  | ✅        |
+| 2024.10.x | ✅        |

 ## Reporting a Vulnerability

--- a/authentik/init.py
+++ b/authentik/init.py
@ -2,7 +2,7 @@

 from os import environ

-__version__ = "2024.8.3"
+__version__ = "2024.10.0"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"


--- a/blueprints/schema.json
+++ b/blueprints/schema.json
@ -2,7 +2,7 @@
    "$schema": "http://json-schema.org/draft-07/schema",
    "$id": "https://goauthentik.io/blueprints/schema.json",
    "type": "object",
-    "title": "authentik 2024.8.3 Blueprint schema",
+    "title": "authentik 2024.10.0 Blueprint schema",
    "required": [
        "version",
        "entries"
--- a/blueprints/system/sources-kerberos.yaml
+++ b/blueprints/system/sources-kerberos.yaml
@ -38,7 +38,7 @@ entries:
      name: "authentik default Kerberos User Mapping: Ignore system principals"
      expression: |
        localpart, realm = principal.rsplit("@", 1)
-        denied_prefixes = ["kadmin/", "krbtgt/", "K/M", "WELLKNOWN/"]
+        denied_prefixes = ["kadmin/", "krbtgt/", "K/M", "WELLKNOWN/", "kiprop/", "changepw/"]
        for prefix in denied_prefixes:
            if localpart.lower().startswith(prefix.lower()):
                raise SkipObject
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -31,7 +31,7 @@ services:
    volumes:
      - redis:/data
  server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.8.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.10.0}
    restart: unless-stopped
    command: server
    environment:
@ -52,7 +52,7 @@ services:
      - postgresql
      - redis
  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.8.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.10.0}
    restart: unless-stopped
    command: worker
    environment:
--- a/go.mod
+++ b/go.mod
@ -29,7 +29,7 @@ require (
 	github.com/spf13/cobra v1.8.1
 	github.com/stretchr/testify v1.9.0
 	github.com/wwt/guac v1.3.2
-	goauthentik.io/api/v3 v3.2024083.13
+	goauthentik.io/api/v3 v3.2024100.1
 	golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab
 	golang.org/x/oauth2 v0.23.0
 	golang.org/x/sync v0.8.0
--- a/go.sum
+++ b/go.sum
@ -299,8 +299,8 @@ go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y
 go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-goauthentik.io/api/v3 v3.2024083.13 h1:xKh3feJYUeLw583zZ5ifgV0qjD37ZCOzgXPfbHQSbHM=
-goauthentik.io/api/v3 v3.2024083.13/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
+goauthentik.io/api/v3 v3.2024100.1 h1:ve8xiaKOyUD5oCkNAsu1o3nc7aolt9bKTTR2qMI1iU4=
+goauthentik.io/api/v3 v3.2024100.1/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
--- a/internal/constants/constants.go
+++ b/internal/constants/constants.go
@ -29,4 +29,4 @@ func UserAgent() string {
 	return fmt.Sprintf("authentik@%s", FullVersion())
 }

-const VERSION = "2024.8.3"
+const VERSION = "2024.10.0"
--- a/lifecycle/ak
+++ b/lifecycle/ak
@ -54,7 +54,9 @@ function cleanup {
 }

 function prepare_debug {
-    apt-get install -y --no-install-recommends krb5-kdc krb5-user krb5-admin-server
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get install -y --no-install-recommends krb5-kdc krb5-user krb5-admin-server libkrb5-dev gcc
    VIRTUAL_ENV=/ak-root/venv poetry install --no-ansi --no-interaction
    touch /unittest.xml
    chown authentik:authentik /unittest.xml
--- a/locale/en/LC_MESSAGES/django.po
+++ b/locale/en/LC_MESSAGES/django.po
@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-10-23 16:39+0000\n"
+"POT-Creation-Date: 2024-10-28 00:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@ -2614,12 +2614,7 @@ msgid "Captcha Stages"
 msgstr ""

 #: authentik/stages/captcha/stage.py
-msgid "Unknown error"
-msgstr ""
-
-#: authentik/stages/captcha/stage.py
-#, python-brace-format
-msgid "Failed to validate token: {error}"
+msgid "Invalid captcha response. Retrying may solve this issue."
 msgstr ""

 #: authentik/stages/captcha/stage.py
--- a/locale/it/LC_MESSAGES/django.po
+++ b/locale/it/LC_MESSAGES/django.po
@ -11,15 +11,17 @@
 # Marco Vitale, 2024
 # Kowalski Dragon (kowalski7cc) <kowalski.7cc@gmail.com>, 2024
 # albanobattistella <albanobattistella@gmail.com>, 2024
+# Nicola Mersi, 2024
+# tom max, 2024
 # 
 #, fuzzy
 msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-10-18 00:09+0000\n"
+"POT-Creation-Date: 2024-10-28 00:09+0000\n"
 "PO-Revision-Date: 2022-09-26 16:47+0000\n"
-"Last-Translator: albanobattistella <albanobattistella@gmail.com>, 2024\n"
+"Last-Translator: tom max, 2024\n"
 "Language-Team: Italian (https://app.transifex.com/authentik/teams/119923/it/)\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@ -583,6 +585,28 @@ msgstr "Limite massimo di connessioni raggiunto."
 msgid "(You are already connected in another tab/window)"
 msgstr "(Sei già connesso in un'altra scheda/finestra)"

+#: authentik/enterprise/stages/authenticator_endpoint_gdtc/models.py
+msgid "Endpoint Authenticator Google Device Trust Connector Stage"
+msgstr ""
+"Fase di autenticazione per la verifica dispositivo Google tramite endpoint"
+
+#: authentik/enterprise/stages/authenticator_endpoint_gdtc/models.py
+msgid "Endpoint Authenticator Google Device Trust Connector Stages"
+msgstr ""
+"Fasi di autenticazione per la verifica dispositivo Google tramite endpoint"
+
+#: authentik/enterprise/stages/authenticator_endpoint_gdtc/models.py
+msgid "Endpoint Device"
+msgstr "Dispositivo di Accesso"
+
+#: authentik/enterprise/stages/authenticator_endpoint_gdtc/models.py
+msgid "Endpoint Devices"
+msgstr "Dispositivi di Accesso"
+
+#: authentik/enterprise/stages/authenticator_endpoint_gdtc/stage.py
+msgid "Verifying your browser..."
+msgstr "Verifica del tuo browser..."
+
 #: authentik/enterprise/stages/source/models.py
 msgid ""
 "Amount of time a user can take to return from the source to continue the "
@ -2017,6 +2041,124 @@ msgstr ""
 msgid "Used recovery-link to authenticate."
 msgstr "Utilizzato il link di recupero per autenticarsi."

+#: authentik/sources/kerberos/models.py
+msgid "Kerberos realm"
+msgstr "Dominio Kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Custom krb5.conf to use. Uses the system one by default"
+msgstr ""
+"krb5.conf personalizzato da usare. Usa la configurazione di sistema per "
+"default"
+
+#: authentik/sources/kerberos/models.py
+msgid "Sync users from Kerberos into authentik"
+msgstr "Sincronizza utenti da Kerberos a authentik"
+
+#: authentik/sources/kerberos/models.py
+msgid "When a user changes their password, sync it back to Kerberos"
+msgstr "Quando un utente cambia la sua password, sincronizzala in Kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Principal to authenticate to kadmin for sync."
+msgstr "Entità da autenticare su kadmin per la sincronizzazione."
+
+#: authentik/sources/kerberos/models.py
+msgid "Password to authenticate to kadmin for sync"
+msgstr "Password per autenticarsi in kadmin per sincronizzare"
+
+#: authentik/sources/kerberos/models.py
+msgid ""
+"Keytab to authenticate to kadmin for sync. Must be base64-encoded or in the "
+"form TYPE:residual"
+msgstr ""
+"Keytab per autenticarsi su kadmin per la sincronizzazione. Deve essere con "
+"codifica base64 o nel formato TYPE:residual"
+
+#: authentik/sources/kerberos/models.py
+msgid ""
+"Credentials cache to authenticate to kadmin for sync. Must be in the form "
+"TYPE:residual"
+msgstr ""
+"Credenziali memorizzate nella cache per autenticarsi su kadmin per la "
+"sincronizzazione. Devono essere nel formato TYPE:residual"
+
+#: authentik/sources/kerberos/models.py
+msgid ""
+"Force the use of a specific server name for SPNEGO. Must be in the form "
+"HTTP@hostname"
+msgstr ""
+"Forza l'uso di un nome server specifico per SPNEGO. Deve essere nel formato "
+"HTTP@nomehost"
+
+#: authentik/sources/kerberos/models.py
+msgid "SPNEGO keytab base64-encoded or path to keytab in the form FILE:path"
+msgstr ""
+"keytab SPNEGO con codifica base64 o percorso del keytab nel formato "
+"FILE:percorso"
+
+#: authentik/sources/kerberos/models.py
+msgid "Credential cache to use for SPNEGO in form type:residual"
+msgstr ""
+"Cache delle credenziali da utilizzare per SPNEGO nella forma  type:residual"
+
+#: authentik/sources/kerberos/models.py
+msgid ""
+"If enabled, the authentik-stored password will be updated upon login with "
+"the Kerberos password backend"
+msgstr ""
+"Se abilitato, la password memorizzata in authentik verrà aggiornata al login"
+" nel backend Kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Kerberos Source"
+msgstr "Sorgente Kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Kerberos Sources"
+msgstr "Sorgenti Kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Kerberos Source Property Mapping"
+msgstr "Mappa delle proprietà della sorgente kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Kerberos Source Property Mappings"
+msgstr "Mappe delle proprietà della sorgente kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "User Kerberos Source Connection"
+msgstr "Connessione sorgente dell'utente kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "User Kerberos Source Connections"
+msgstr " Connessioni alle sorgente dell'utente kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Group Kerberos Source Connection"
+msgstr " Connessione sorgente del gruppo kerberos"
+
+#: authentik/sources/kerberos/models.py
+msgid "Group Kerberos Source Connections"
+msgstr "Connessioni alle sorgenti del gruppo kerberos"
+
+#: authentik/sources/kerberos/views.py
+msgid "SPNEGO authentication required"
+msgstr "autenticazione  SPNEGO necessaria"
+
+#: authentik/sources/kerberos/views.py
+msgid ""
+"\n"
+"                    Make sure you have valid tickets (obtainable via kinit)\n"
+"                    and configured the browser correctly.\n"
+"                    Please contact your administrator.\n"
+"                "
+msgstr ""
+"\n"
+"Assicurati di avere un ticket valido (ottenibile tramite kinit)\n"
+" e di aver configurato correttamente il browser. \n"
+"Contatta il tuo amministratore."
+
 #: authentik/sources/ldap/api.py
 msgid "Only a single LDAP Source with password synchronization is allowed"
 msgstr ""
@ -2735,13 +2877,10 @@ msgid "Captcha Stages"
 msgstr "Fasi Captcha"

 #: authentik/stages/captcha/stage.py
-msgid "Unknown error"
-msgstr "Errore sconosciuto"
-
-#: authentik/stages/captcha/stage.py
-#, python-brace-format
-msgid "Failed to validate token: {error}"
-msgstr "Impossibile convalidare il token: {error}"
+msgid "Invalid captcha response. Retrying may solve this issue."
+msgstr ""
+"Risposta captcha non valida. Un nuovo tentativo potrebbe risolvere il "
+"problema."

 #: authentik/stages/captcha/stage.py
 msgid "Invalid captcha response"
@ -3114,6 +3253,10 @@ msgstr "Database utente + password app"
 msgid "User database + LDAP password"
 msgstr "Database utenti + password LDAP"

+#: authentik/stages/password/models.py
+msgid "User database + Kerberos password"
+msgstr "Database utenti + password Kerberos"
+
 #: authentik/stages/password/models.py
 msgid "Selection of backends to test the password against."
 msgstr "Selezione di backend su cui testare la password."
--- a/locale/zh-Hans/LC_MESSAGES/django.mo
+++ b/locale/zh-Hans/LC_MESSAGES/django.mo
--- a/locale/zh-Hans/LC_MESSAGES/django.po
+++ b/locale/zh-Hans/LC_MESSAGES/django.po
@ -15,7 +15,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-10-23 16:39+0000\n"
+"POT-Creation-Date: 2024-10-28 00:09+0000\n"
 "PO-Revision-Date: 2022-09-26 16:47+0000\n"
 "Last-Translator: deluxghost, 2024\n"
 "Language-Team: Chinese Simplified (https://app.transifex.com/authentik/teams/119923/zh-Hans/)\n"
@ -2649,13 +2649,8 @@ msgid "Captcha Stages"
 msgstr "验证码阶段"

 #: authentik/stages/captcha/stage.py
-msgid "Unknown error"
-msgstr "未知错误"
-
-#: authentik/stages/captcha/stage.py
-#, python-brace-format
-msgid "Failed to validate token: {error}"
-msgstr "验证令牌失败：{error}"
+msgid "Invalid captcha response. Retrying may solve this issue."
+msgstr "无效的验证码响应。重试可能会解决此问题。"

 #: authentik/stages/captcha/stage.py
 msgid "Invalid captcha response"
--- a/locale/zh_CN/LC_MESSAGES/django.po
+++ b/locale/zh_CN/LC_MESSAGES/django.po
@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-10-23 16:39+0000\n"
+"POT-Creation-Date: 2024-10-28 00:09+0000\n"
 "PO-Revision-Date: 2022-09-26 16:47+0000\n"
 "Last-Translator: deluxghost, 2024\n"
 "Language-Team: Chinese (China) (https://app.transifex.com/authentik/teams/119923/zh_CN/)\n"
@ -2648,13 +2648,8 @@ msgid "Captcha Stages"
 msgstr "验证码阶段"

 #: authentik/stages/captcha/stage.py
-msgid "Unknown error"
-msgstr "未知错误"
-
-#: authentik/stages/captcha/stage.py
-#, python-brace-format
-msgid "Failed to validate token: {error}"
-msgstr "验证令牌失败：{error}"
+msgid "Invalid captcha response. Retrying may solve this issue."
+msgstr "无效的验证码响应。重试可能会解决此问题。"

 #: authentik/stages/captcha/stage.py
 msgid "Invalid captcha response"
--- a/package.json
+++ b/package.json
@ -1,5 +1,5 @@
 {
    "name": "@goauthentik/authentik",
-    "version": "2024.8.3",
+    "version": "2024.10.0",
    "private": true
 }
--- a/poetry.lock
+++ b/poetry.lock
@ -3896,13 +3896,13 @@ pytest = ">=4.0.0"

 [[package]]
 name = "pytest-randomly"
-version = "3.15.0"
+version = "3.16.0"
 description = "Pytest plugin to randomly order tests and control random.seed."
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
 files = [
-    {file = "pytest_randomly-3.15.0-py3-none-any.whl", hash = "sha256:0516f4344b29f4e9cdae8bce31c4aeebf59d0b9ef05927c33354ff3859eeeca6"},
-    {file = "pytest_randomly-3.15.0.tar.gz", hash = "sha256:b908529648667ba5e54723088edd6f82252f540cc340d748d1fa985539687047"},
+    {file = "pytest_randomly-3.16.0-py3-none-any.whl", hash = "sha256:8633d332635a1a0983d3bba19342196807f6afb17c3eef78e02c2f85dade45d6"},
+    {file = "pytest_randomly-3.16.0.tar.gz", hash = "sha256:11bf4d23a26484de7860d82f726c0629837cf4064b79157bd18ec9d41d7feb26"},
 ]

 [package.dependencies]
@ -4354,13 +4354,13 @@ django-query = ["django (>=3.2)"]

 [[package]]
 name = "selenium"
-version = "4.25.0"
+version = "4.26.0"
 description = "Official Python bindings for Selenium WebDriver"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "selenium-4.25.0-py3-none-any.whl", hash = "sha256:3798d2d12b4a570bc5790163ba57fef10b2afee958bf1d80f2a3cf07c4141f33"},
-    {file = "selenium-4.25.0.tar.gz", hash = "sha256:95d08d3b82fb353f3c474895154516604c7f0e6a9a565ae6498ef36c9bac6921"},
+    {file = "selenium-4.26.0-py3-none-any.whl", hash = "sha256:48013f36e812de5b3948ef53d04e73f77bc923ee3e1d7d99eaf0618179081b99"},
+    {file = "selenium-4.26.0.tar.gz", hash = "sha256:f0780f85f10310aa5d085b81e79d73d3c93b83d8de121d0400d543a50ee963e8"},
 ]

 [package.dependencies]
@ -4425,13 +4425,13 @@ tornado = ["tornado (>=6)"]

 [[package]]
 name = "service-identity"
-version = "24.1.0"
+version = "24.2.0"
 description = "Service identity verification for pyOpenSSL & cryptography."
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "service_identity-24.1.0-py3-none-any.whl", hash = "sha256:a28caf8130c8a5c1c7a6f5293faaf239bbfb7751e4862436920ee6f2616f568a"},
-    {file = "service_identity-24.1.0.tar.gz", hash = "sha256:6829c9d62fb832c2e1c435629b0a8c476e1929881f28bee4d20bc24161009221"},
+    {file = "service_identity-24.2.0-py3-none-any.whl", hash = "sha256:6b047fbd8a84fd0bb0d55ebce4031e400562b9196e1e0d3e0fe2b8a59f6d4a85"},
+    {file = "service_identity-24.2.0.tar.gz", hash = "sha256:b8683ba13f0d39c6cd5d625d2c5f65421d6d707b013b375c355751557cbe8e09"},
 ]

 [package.dependencies]
@ -4441,7 +4441,7 @@ pyasn1 = "*"
 pyasn1-modules = "*"

 [package.extras]
-dev = ["pyopenssl", "service-identity[idna,mypy,tests]"]
+dev = ["coverage[toml] (>=5.0.2)", "idna", "mypy", "pyopenssl", "pytest", "types-pyopenssl"]
 docs = ["furo", "myst-parser", "pyopenssl", "sphinx", "sphinx-notfound-page"]
 idna = ["idna"]
 mypy = ["idna", "mypy", "types-pyopenssl"]
@ -4751,13 +4751,13 @@ wsproto = ">=0.14"

 [[package]]
 name = "twilio"
-version = "9.3.5"
+version = "9.3.6"
 description = "Twilio API client and TwiML generator"
 optional = false
 python-versions = ">=3.7.0"
 files = [
-    {file = "twilio-9.3.5-py2.py3-none-any.whl", hash = "sha256:d6a97a77b98cc176a61c960f11894af385bc1c11b93e2e8b79fdfb9601788fb0"},
-    {file = "twilio-9.3.5.tar.gz", hash = "sha256:608d78a903d403465aac1840c58a6546a090b7e222d2bf539a93c3831072880c"},
+    {file = "twilio-9.3.6-py2.py3-none-any.whl", hash = "sha256:c5d7f4cfeb50a7928397b8f819c8f7fb2bb956a1a2cabbda1df1d7a40f9ce1d7"},
+    {file = "twilio-9.3.6.tar.gz", hash = "sha256:d42691f7fe1faaa5ba82942f169bfea4d7f01a0a542a456d82018fb49bd1f5b2"},
 ]

 [package.dependencies]
--- a/pyproject.toml
+++ b/pyproject.toml
@ -1,6 +1,6 @@
 [tool.poetry]
 name = "authentik"
-version = "2024.8.3"
+version = "2024.10.0"
 description = ""
 authors = ["authentik Team <hello@goauthentik.io>"]

--- a/schema.yml
+++ b/schema.yml
@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
  title: authentik
-  version: 2024.8.3
+  version: 2024.10.0
  description: Making authentication simple.
  contact:
    email: hello@goauthentik.io
--- a/web/.storybook/css-import-maps.ts
+++ b/web/.storybook/css-import-maps.ts
@ -66,6 +66,7 @@ const rawCssImportMaps = [
    'import PFSwitch from "@patternfly/patternfly/components/Switch/switch.css";',
    'import PFTable from "@patternfly/patternfly/components/Table/table.css";',
    'import PFTabs from "@patternfly/patternfly/components/Tabs/tabs.css";',
+    'import PFText from "@patternfly/patternfly/utilities/Text/text.css";',
    'import PFTitle from "@patternfly/patternfly/components/Title/title.css";',
    'import PFToggleGroup from "@patternfly/patternfly/components/ToggleGroup/toggle-group.css";',
    'import PFToolbar from "@patternfly/patternfly/components/Toolbar/toolbar.css";',
--- a/web/package-lock.json
+++ b/web/package-lock.json
@ -23,7 +23,7 @@
                "@floating-ui/dom": "^1.6.11",
                "@formatjs/intl-listformat": "^7.5.7",
                "@fortawesome/fontawesome-free": "^6.6.0",
-                "@goauthentik/api": "^2024.8.3-1729836831",
+                "@goauthentik/api": "^2024.10.0-1730331602",
                "@lit-labs/ssr": "^3.2.2",
                "@lit/context": "^1.1.2",
                "@lit/localize": "^0.12.2",
@ -1014,9 +1014,9 @@
            }
        },
        "node_modules/@codemirror/commands": {
-            "version": "6.6.2",
-            "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.6.2.tgz",
-            "integrity": "sha512-Fq7eWOl1Rcbrfn6jD8FPCj9Auaxdm5nIK5RYOeW7ughnd/rY5AmPg6b+CfsG39ZHdwiwe8lde3q8uR7CF5S0yQ==",
+            "version": "6.7.0",
+            "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.7.0.tgz",
+            "integrity": "sha512-+cduIZ2KbesDhbykV02K25A5xIVrquSPz4UxxYBemRlAT2aW8dhwUgLDwej7q/RJUHKk4nALYcR1puecDvbdqw==",
            "dependencies": {
                "@codemirror/language": "^6.0.0",
                "@codemirror/state": "^6.4.0",
@ -1775,9 +1775,9 @@
            }
        },
        "node_modules/@goauthentik/api": {
-            "version": "2024.8.3-1729836831",
-            "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2024.8.3-1729836831.tgz",
-            "integrity": "sha512-nOgvjYQiK+HhWuiZ635h/aSsq7Mfj5cDrIyBJt+IJRQuJFtnnHx8nscRXKK/8sBl9obH2zMCoZgeqytK8145bg=="
+            "version": "2024.10.0-1730331602",
+            "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2024.10.0-1730331602.tgz",
+            "integrity": "sha512-VaXywdDCFkIs9RgmHVYt8jGf5xnc+czsu5ILEThNQOuXvBjkGa0J8aPWVSdfP++GiHnkjddWVFzJ6R6LOoHbWQ=="
        },
        "node_modules/@goauthentik/web": {
            "resolved": "",
@ -1953,9 +1953,9 @@
            }
        },
        "node_modules/@inquirer/figures": {
-            "version": "1.0.6",
-            "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-1.0.6.tgz",
-            "integrity": "sha512-yfZzps3Cso2UbM7WlxKwZQh2Hs6plrbjs1QnzQDZhK2DgyCo6D8AaHps9olkNcUFlcYERMqU3uJSp1gmy3s/qQ==",
+            "version": "1.0.7",
+            "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-1.0.7.tgz",
+            "integrity": "sha512-m+Trk77mp54Zma6xLkLuY+mvanPxlE4A7yNKs2HBiyZ4UkVs28Mv5c/pgWrHeInx+USHeX/WEPzjrWrcJiQgjw==",
            "dev": true,
            "engines": {
                "node": ">=18"
@ -2425,9 +2425,9 @@
            }
        },
        "node_modules/@lezer/javascript": {
-            "version": "1.4.18",
-            "resolved": "https://registry.npmjs.org/@lezer/javascript/-/javascript-1.4.18.tgz",
-            "integrity": "sha512-Y8BeHOt4LtcxJgXwadtfSeWPrh0XzklcCHnCVT+vOsxqH4gWmunP2ykX+VVOlM/dusyVyiNfG3lv0f10UK+mgA==",
+            "version": "1.4.19",
+            "resolved": "https://registry.npmjs.org/@lezer/javascript/-/javascript-1.4.19.tgz",
+            "integrity": "sha512-j44kbR1QL26l6dMunZ1uhKBFteVGLVCBGNUD2sUaMnic+rbTviVuoK0CD1l9FTW31EueWvFFswCKMH7Z+M3JRA==",
            "dependencies": {
                "@lezer/common": "^1.2.0",
                "@lezer/highlight": "^1.1.3",
@ -2507,9 +2507,9 @@
            "license": "MIT"
        },
        "node_modules/@lit/context": {
-            "version": "1.1.2",
-            "resolved": "https://registry.npmjs.org/@lit/context/-/context-1.1.2.tgz",
-            "integrity": "sha512-S0nw2C6Tkm7fVX5TGYqeROGD+Z9Coa2iFpW+ysYBDH3YvCqOY3wVQvSgwbaliLJkjTnSEYCBe9qFqKV8WUFpVw==",
+            "version": "1.1.3",
+            "resolved": "https://registry.npmjs.org/@lit/context/-/context-1.1.3.tgz",
+            "integrity": "sha512-Auh37F4S0PZM93HTDfZWs97mmzaQ7M3vnTc9YvxAGyP3UItSK/8Fs0vTOGT+njuvOwbKio/l8Cx/zWL4vkutpQ==",
            "dependencies": {
                "@lit/reactive-element": "^1.6.2 || ^2.0.0"
            }
@ -3673,9 +3673,9 @@
            }
        },
        "node_modules/@spotlightjs/overlay": {
-            "version": "2.5.2",
-            "resolved": "https://registry.npmjs.org/@spotlightjs/overlay/-/overlay-2.5.2.tgz",
-            "integrity": "sha512-2YCxkTCRWn9Q4x6Aan0b43EvUJEgQBLvcws1c97LO7Cgnb0iKjiLIRW0Fa8f6PO8r9AcDvaFzhk5Z93YIkwlGQ=="
+            "version": "2.6.0",
+            "resolved": "https://registry.npmjs.org/@spotlightjs/overlay/-/overlay-2.6.0.tgz",
+            "integrity": "sha512-UnvWi6J8MTxhUHaBxd+k2mVyQh+0sJ5MImb/UfnEOA0WhNaFl2Foo/R7ByoOIDzDGT42+mZtfEyhJzNZ5naAaQ=="
        },
        "node_modules/@spotlightjs/sidecar": {
            "version": "1.8.0",
@ -3694,11 +3694,11 @@
            }
        },
        "node_modules/@spotlightjs/spotlight": {
-            "version": "2.4.2",
-            "resolved": "https://registry.npmjs.org/@spotlightjs/spotlight/-/spotlight-2.4.2.tgz",
-            "integrity": "sha512-d7wEvG6fyP9OsqgJ3fD2YZ2zjtD9MzIuOpqTg+LAT1FXl7yBK9LRrLW/LU6OvwRdDCzUsbnxUv0giJ5DjV+2Lw==",
+            "version": "2.5.0",
+            "resolved": "https://registry.npmjs.org/@spotlightjs/spotlight/-/spotlight-2.5.0.tgz",
+            "integrity": "sha512-tOlefTjOUuNGyHtt1+r1IdY5vq9Hq9Vi2HqPENZ9orS/12KMEK6rVFliWT0/IXJLH5LdunNGaw3kan08bsA+NQ==",
            "dependencies": {
-                "@spotlightjs/overlay": "2.5.2",
+                "@spotlightjs/overlay": "2.6.0",
                "@spotlightjs/sidecar": "1.8.0",
                "import-meta-resolve": "^4.1.0"
            },
@ -5879,9 +5879,9 @@
            "dev": true
        },
        "node_modules/@types/mocha": {
-            "version": "10.0.8",
-            "resolved": "https://registry.npmjs.org/@types/mocha/-/mocha-10.0.8.tgz",
-            "integrity": "sha512-HfMcUmy9hTMJh66VNcmeC9iVErIZJli2bszuXc6julh5YGuRb/W5OnkHjwLNYdFlMis0sY3If5SEAp+PktdJjw==",
+            "version": "10.0.9",
+            "resolved": "https://registry.npmjs.org/@types/mocha/-/mocha-10.0.9.tgz",
+            "integrity": "sha512-sicdRoWtYevwxjOHNMPTl3vSfJM6oyW8o1wXeI7uww6b6xHg8eBznQDNSGBCDJmsE8UMxP05JgZRtsKbTqt//Q==",
            "dev": true
        },
        "node_modules/@types/mute-stream": {
@ -5894,9 +5894,9 @@
            }
        },
        "node_modules/@types/node": {
-            "version": "22.7.4",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.7.4.tgz",
-            "integrity": "sha512-y+NPi1rFzDs1NdQHHToqeiX2TIS79SWEAw9GYhkkx8bD0ChpfqC+n2j5OXOCpzfojBEBt6DnEnnG9MY0zk1XLg==",
+            "version": "22.7.5",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.7.5.tgz",
+            "integrity": "sha512-jML7s2NAzMWc//QSJ1a3prpk78cOPchGvXJsC3C6R6PSMoooztvRVQEz89gmBTBY1SPMaqo5teB4uNHPdetShQ==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -6077,16 +6077,16 @@
            }
        },
        "node_modules/@typescript-eslint/eslint-plugin": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.8.0.tgz",
-            "integrity": "sha512-wORFWjU30B2WJ/aXBfOm1LX9v9nyt9D3jsSOxC3cCaTQGCW5k4jNpmjFv3U7p/7s4yvdjHzwtv2Sd2dOyhjS0A==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.8.1.tgz",
+            "integrity": "sha512-xfvdgA8AP/vxHgtgU310+WBnLB4uJQ9XdyP17RebG26rLtDrQJV3ZYrcopX91GrHmMoH8bdSwMRh2a//TiJ1jQ==",
            "dev": true,
            "dependencies": {
                "@eslint-community/regexpp": "^4.10.0",
-                "@typescript-eslint/scope-manager": "8.8.0",
-                "@typescript-eslint/type-utils": "8.8.0",
-                "@typescript-eslint/utils": "8.8.0",
-                "@typescript-eslint/visitor-keys": "8.8.0",
+                "@typescript-eslint/scope-manager": "8.8.1",
+                "@typescript-eslint/type-utils": "8.8.1",
+                "@typescript-eslint/utils": "8.8.1",
+                "@typescript-eslint/visitor-keys": "8.8.1",
                "graphemer": "^1.4.0",
                "ignore": "^5.3.1",
                "natural-compare": "^1.4.0",
@ -6110,15 +6110,15 @@
            }
        },
        "node_modules/@typescript-eslint/parser": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.8.0.tgz",
-            "integrity": "sha512-uEFUsgR+tl8GmzmLjRqz+VrDv4eoaMqMXW7ruXfgThaAShO9JTciKpEsB+TvnfFfbg5IpujgMXVV36gOJRLtZg==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.8.1.tgz",
+            "integrity": "sha512-hQUVn2Lij2NAxVFEdvIGxT9gP1tq2yM83m+by3whWFsWC+1y8pxxxHUFE1UqDu2VsGi2i6RLcv4QvouM84U+ow==",
            "dev": true,
            "dependencies": {
-                "@typescript-eslint/scope-manager": "8.8.0",
-                "@typescript-eslint/types": "8.8.0",
-                "@typescript-eslint/typescript-estree": "8.8.0",
-                "@typescript-eslint/visitor-keys": "8.8.0",
+                "@typescript-eslint/scope-manager": "8.8.1",
+                "@typescript-eslint/types": "8.8.1",
+                "@typescript-eslint/typescript-estree": "8.8.1",
+                "@typescript-eslint/visitor-keys": "8.8.1",
                "debug": "^4.3.4"
            },
            "engines": {
@ -6138,13 +6138,13 @@
            }
        },
        "node_modules/@typescript-eslint/scope-manager": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.8.0.tgz",
-            "integrity": "sha512-EL8eaGC6gx3jDd8GwEFEV091210U97J0jeEHrAYvIYosmEGet4wJ+g0SYmLu+oRiAwbSA5AVrt6DxLHfdd+bUg==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.8.1.tgz",
+            "integrity": "sha512-X4JdU+66Mazev/J0gfXlcC/dV6JI37h+93W9BRYXrSn0hrE64IoWgVkO9MSJgEzoWkxONgaQpICWg8vAN74wlA==",
            "dev": true,
            "dependencies": {
-                "@typescript-eslint/types": "8.8.0",
-                "@typescript-eslint/visitor-keys": "8.8.0"
+                "@typescript-eslint/types": "8.8.1",
+                "@typescript-eslint/visitor-keys": "8.8.1"
            },
            "engines": {
                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@ -6155,13 +6155,13 @@
            }
        },
        "node_modules/@typescript-eslint/type-utils": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.8.0.tgz",
-            "integrity": "sha512-IKwJSS7bCqyCeG4NVGxnOP6lLT9Okc3Zj8hLO96bpMkJab+10HIfJbMouLrlpyOr3yrQ1cA413YPFiGd1mW9/Q==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.8.1.tgz",
+            "integrity": "sha512-qSVnpcbLP8CALORf0za+vjLYj1Wp8HSoiI8zYU5tHxRVj30702Z1Yw4cLwfNKhTPWp5+P+k1pjmD5Zd1nhxiZA==",
            "dev": true,
            "dependencies": {
-                "@typescript-eslint/typescript-estree": "8.8.0",
-                "@typescript-eslint/utils": "8.8.0",
+                "@typescript-eslint/typescript-estree": "8.8.1",
+                "@typescript-eslint/utils": "8.8.1",
                "debug": "^4.3.4",
                "ts-api-utils": "^1.3.0"
            },
@ -6179,9 +6179,9 @@
            }
        },
        "node_modules/@typescript-eslint/types": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.8.0.tgz",
-            "integrity": "sha512-QJwc50hRCgBd/k12sTykOJbESe1RrzmX6COk8Y525C9l7oweZ+1lw9JiU56im7Amm8swlz00DRIlxMYLizr2Vw==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.8.1.tgz",
+            "integrity": "sha512-WCcTP4SDXzMd23N27u66zTKMuEevH4uzU8C9jf0RO4E04yVHgQgW+r+TeVTNnO1KIfrL8ebgVVYYMMO3+jC55Q==",
            "dev": true,
            "engines": {
                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@ -6192,13 +6192,13 @@
            }
        },
        "node_modules/@typescript-eslint/typescript-estree": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.8.0.tgz",
-            "integrity": "sha512-ZaMJwc/0ckLz5DaAZ+pNLmHv8AMVGtfWxZe/x2JVEkD5LnmhWiQMMcYT7IY7gkdJuzJ9P14fRy28lUrlDSWYdw==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.8.1.tgz",
+            "integrity": "sha512-A5d1R9p+X+1js4JogdNilDuuq+EHZdsH9MjTVxXOdVFfTJXunKJR/v+fNNyO4TnoOn5HqobzfRlc70NC6HTcdg==",
            "dev": true,
            "dependencies": {
-                "@typescript-eslint/types": "8.8.0",
-                "@typescript-eslint/visitor-keys": "8.8.0",
+                "@typescript-eslint/types": "8.8.1",
+                "@typescript-eslint/visitor-keys": "8.8.1",
                "debug": "^4.3.4",
                "fast-glob": "^3.3.2",
                "is-glob": "^4.0.3",
@ -6220,15 +6220,15 @@
            }
        },
        "node_modules/@typescript-eslint/utils": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.8.0.tgz",
-            "integrity": "sha512-QE2MgfOTem00qrlPgyByaCHay9yb1+9BjnMFnSFkUKQfu7adBXDTnCAivURnuPPAG/qiB+kzKkZKmKfaMT0zVg==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.8.1.tgz",
+            "integrity": "sha512-/QkNJDbV0bdL7H7d0/y0qBbV2HTtf0TIyjSDTvvmQEzeVx8jEImEbLuOA4EsvE8gIgqMitns0ifb5uQhMj8d9w==",
            "dev": true,
            "dependencies": {
                "@eslint-community/eslint-utils": "^4.4.0",
-                "@typescript-eslint/scope-manager": "8.8.0",
-                "@typescript-eslint/types": "8.8.0",
-                "@typescript-eslint/typescript-estree": "8.8.0"
+                "@typescript-eslint/scope-manager": "8.8.1",
+                "@typescript-eslint/types": "8.8.1",
+                "@typescript-eslint/typescript-estree": "8.8.1"
            },
            "engines": {
                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@ -6242,12 +6242,12 @@
            }
        },
        "node_modules/@typescript-eslint/visitor-keys": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.8.0.tgz",
-            "integrity": "sha512-8mq51Lx6Hpmd7HnA2fcHQo3YgfX1qbccxQOgZcb4tvasu//zXRaA1j5ZRFeCw/VRAdFi4mRM9DnZw0Nu0Q2d1g==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.8.1.tgz",
+            "integrity": "sha512-0/TdC3aeRAsW7MDvYRwEc1Uwm0TIBfzjPFgg60UU2Haj5qsCs9cc3zNgY71edqE3LbWfF/WoZQd3lJoDXFQpag==",
            "dev": true,
            "dependencies": {
-                "@typescript-eslint/types": "8.8.0",
+                "@typescript-eslint/types": "8.8.1",
                "eslint-visitor-keys": "^3.4.3"
            },
            "engines": {
@ -6843,9 +6843,9 @@
            }
        },
        "node_modules/@wdio/cli/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -6971,9 +6971,9 @@
            }
        },
        "node_modules/@wdio/local-runner/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -7024,9 +7024,9 @@
            }
        },
        "node_modules/@wdio/mocha-framework/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -7051,9 +7051,9 @@
            }
        },
        "node_modules/@wdio/repl/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -7076,9 +7076,9 @@
            }
        },
        "node_modules/@wdio/reporter/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -7107,9 +7107,9 @@
            }
        },
        "node_modules/@wdio/runner/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -7156,9 +7156,9 @@
            }
        },
        "node_modules/@wdio/types/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -9005,9 +9005,9 @@
            "dev": true
        },
        "node_modules/confbox": {
-            "version": "0.1.7",
-            "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.1.7.tgz",
-            "integrity": "sha512-uJcB/FKZtBMCJpK8MQji6bJHgu1tixKPxRLeGkNzBoOZzpnZUJm0jm2/sBDWcuBx1dYgxV4JU+g5hmNxCyAmdA=="
+            "version": "0.1.8",
+            "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.1.8.tgz",
+            "integrity": "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w=="
        },
        "node_modules/consola": {
            "version": "3.2.3",
@ -9055,6 +9055,7 @@
            "version": "0.6.0",
            "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
            "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
+            "dev": true,
            "engines": {
                "node": ">= 0.6"
            }
@ -9854,9 +9855,9 @@
            }
        },
        "node_modules/deepmerge-ts": {
-            "version": "7.1.1",
-            "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.1.tgz",
-            "integrity": "sha512-M27OAbyR/XgJujhAd6ZlYvZGzejbzvGPSZWwuzezPCdKLT9VMtK0kpRNDc5LeUDYqFN3e254gWG1yKpjidCtow==",
+            "version": "7.1.3",
+            "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.3.tgz",
+            "integrity": "sha512-qCSH6I0INPxd9Y1VtAiLpnYvz5O//6rCfJXKk0z66Up9/VOSr+1yS8XSKA5IWRxjocFGlzPyaZYe+jxq7OOLtQ==",
            "dev": true,
            "engines": {
                "node": ">=16.0.0"
@ -10271,9 +10272,9 @@
            }
        },
        "node_modules/electron-to-chromium": {
-            "version": "1.5.32",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.32.tgz",
-            "integrity": "sha512-M+7ph0VGBQqqpTT2YrabjNKSQ2fEl9PVx6AK3N558gDH9NO8O6XN9SXXFWRo9u9PbEg/bWq+tjXQr+eXmxubCw==",
+            "version": "1.5.33",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.33.tgz",
+            "integrity": "sha512-+cYTcFB1QqD4j4LegwLfpCNxifb6dDFUAwk6RsLusCwIaZI6or2f+q8rs5tTB2YC53HhOlIbEaqHMAAC8IOIwA==",
            "dev": true
        },
        "node_modules/emoji-regex": {
@ -11031,16 +11032,16 @@
            "dev": true
        },
        "node_modules/eslint-plugin-wc": {
-            "version": "2.1.1",
-            "resolved": "https://registry.npmjs.org/eslint-plugin-wc/-/eslint-plugin-wc-2.1.1.tgz",
-            "integrity": "sha512-GfJo05ZgWfwAFbW6Gkf+9CMOIU6fmbd3b4nm+PKESHgUdUTmi7vawlELCrzOhdiQjXUPZxDfFIVxYt9D/v/GdQ==",
+            "version": "2.2.0",
+            "resolved": "https://registry.npmjs.org/eslint-plugin-wc/-/eslint-plugin-wc-2.2.0.tgz",
+            "integrity": "sha512-kjPp+aXz23fOl0JZJOJS+6adwhEv98KjZ2FJqWpc4vtmk4Oenz/JJmmNZrGSARgtyR0BLIF/kVWC6GSlHA+5MA==",
            "dev": true,
            "dependencies": {
                "is-valid-element-name": "^1.0.0",
                "js-levenshtein-esm": "^1.2.0"
            },
            "peerDependencies": {
-                "eslint": ">=5"
+                "eslint": ">=8.40.0"
            }
        },
        "node_modules/eslint-scope": {
@ -14292,9 +14293,9 @@
            }
        },
        "node_modules/knip": {
-            "version": "5.31.0",
-            "resolved": "https://registry.npmjs.org/knip/-/knip-5.31.0.tgz",
-            "integrity": "sha512-4hR+qHx/id7mniCWWUqA4MXwGjYFN75xv3qLmEkl9Hm6eCKAhv0wGP0CyrXKUYxVyDplJQsqQaAlsjuRKYsdPA==",
+            "version": "5.33.1",
+            "resolved": "https://registry.npmjs.org/knip/-/knip-5.33.1.tgz",
+            "integrity": "sha512-SeuH+6IcDNNFRdVsi2uGnO6gsSDlx1V+TcQkKnzciF2Z7QHHasKseGUf9GMNVm3bSCKDeqaKPMp0F6BOiKuYRA==",
            "dev": true,
            "funding": [
                {
@ -14316,7 +14317,7 @@
                "easy-table": "1.2.0",
                "enhanced-resolve": "^5.17.1",
                "fast-glob": "^3.3.2",
-                "jiti": "^2.1.0",
+                "jiti": "^2.3.3",
                "js-yaml": "^4.1.0",
                "minimist": "^1.2.8",
                "picocolors": "^1.0.0",
@ -14341,9 +14342,9 @@
            }
        },
        "node_modules/knip/node_modules/jiti": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.2.1.tgz",
-            "integrity": "sha512-weIl/Bv3G0J3UKamLxEA2G+FfQ33Z1ZkQJGPjKFV21zQdKWu2Pi6o4elpj2uEl5XdFJZ9xzn1fsanWTFSt45zw==",
+            "version": "2.3.3",
+            "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.3.3.tgz",
+            "integrity": "sha512-EX4oNDwcXSivPrw2qKH2LB5PoFxEvgtv2JgwW0bU858HoLQ+kutSvjLMUqBd0PeJYEinLWhoI9Ol0eYMqj/wNQ==",
            "dev": true,
            "bin": {
                "jiti": "lib/jiti-cli.mjs"
@ -14488,9 +14489,9 @@
            "dev": true
        },
        "node_modules/lit": {
-            "version": "3.2.0",
-            "resolved": "https://registry.npmjs.org/lit/-/lit-3.2.0.tgz",
-            "integrity": "sha512-s6tI33Lf6VpDu7u4YqsSX78D28bYQulM+VAzsGch4fx2H0eLZnJsUBsPWmGYSGoKDNbjtRv02rio1o+UdPVwvw==",
+            "version": "3.2.1",
+            "resolved": "https://registry.npmjs.org/lit/-/lit-3.2.1.tgz",
+            "integrity": "sha512-1BBa1E/z0O9ye5fZprPtdqnc0BFzxIxTTOO/tQFmyC/hj1O3jL4TfmLBw0WEwjAokdLwpclkvGgDJwTIh0/22w==",
            "dependencies": {
                "@lit/reactive-element": "^2.0.4",
                "lit-element": "^4.1.0",
@ -14524,9 +14525,9 @@
            "dev": true
        },
        "node_modules/lit-element": {
-            "version": "4.1.0",
-            "resolved": "https://registry.npmjs.org/lit-element/-/lit-element-4.1.0.tgz",
-            "integrity": "sha512-gSejRUQJuMQjV2Z59KAS/D4iElUhwKpIyJvZ9w+DIagIQjfJnhR20h2Q5ddpzXGS+fF0tMZ/xEYGMnKmaI/iww==",
+            "version": "4.1.1",
+            "resolved": "https://registry.npmjs.org/lit-element/-/lit-element-4.1.1.tgz",
+            "integrity": "sha512-HO9Tkkh34QkTeUmEdNYhMT8hzLid7YlMlATSi1q4q17HE5d9mrrEHJ/o8O2D0cMi182zK1F3v7x0PWFjrhXFew==",
            "dependencies": {
                "@lit-labs/ssr-dom-shim": "^1.2.0",
                "@lit/reactive-element": "^2.0.4",
@ -14534,9 +14535,9 @@
            }
        },
        "node_modules/lit-html": {
-            "version": "3.2.0",
-            "resolved": "https://registry.npmjs.org/lit-html/-/lit-html-3.2.0.tgz",
-            "integrity": "sha512-pwT/HwoxqI9FggTrYVarkBKFN9MlTUpLrDHubTmW4SrkL3kkqW5gxwbxMMUnbbRHBC0WTZnYHcjDSCM559VyfA==",
+            "version": "3.2.1",
+            "resolved": "https://registry.npmjs.org/lit-html/-/lit-html-3.2.1.tgz",
+            "integrity": "sha512-qI/3lziaPMSKsrwlxH/xMgikhQ0EGOX2ICU73Bi/YHFvz2j/yMCIrw4+puF2IpQ4+upd3EWbvnHM9+PnJn48YA==",
            "dependencies": {
                "@types/trusted-types": "^2.0.2"
            }
@ -15200,14 +15201,14 @@
            "optional": true
        },
        "node_modules/mlly": {
-            "version": "1.7.1",
-            "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.7.1.tgz",
-            "integrity": "sha512-rrVRZRELyQzrIUAVMHxP97kv+G786pHmOKzuFII8zDYahFBS7qnHh2AlYSl1GAHhaMPCz6/oHjVMcfFYgFYHgA==",
+            "version": "1.7.2",
+            "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.7.2.tgz",
+            "integrity": "sha512-tN3dvVHYVz4DhSXinXIk7u9syPYaJvio118uomkovAtWBT+RdbP6Lfh/5Lvo519YMmwBafwlh20IPTXIStscpA==",
            "dependencies": {
-                "acorn": "^8.11.3",
+                "acorn": "^8.12.1",
                "pathe": "^1.1.2",
-                "pkg-types": "^1.1.1",
-                "ufo": "^1.5.3"
+                "pkg-types": "^1.2.0",
+                "ufo": "^1.5.4"
            }
        },
        "node_modules/mocha": {
@ -16585,9 +16586,9 @@
            "dev": true
        },
        "node_modules/package-manager-detector": {
-            "version": "0.2.0",
-            "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-0.2.0.tgz",
-            "integrity": "sha512-E385OSk9qDcXhcM9LNSe4sdhx8a9mAPrZ4sMLW+tmxl5ZuGtPUcdFu+MPP2jbgiWAZ6Pfe5soGFMd+0Db5Vrog=="
+            "version": "0.2.1",
+            "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-0.2.1.tgz",
+            "integrity": "sha512-/hVW2fZvAdEas+wyKh0SnlZ2mx0NIa1+j11YaQkogEJkcMErbwchHCuo8z7lEtajZJQZ6rgZNVTWMVVd71Bjng=="
        },
        "node_modules/pako": {
            "version": "1.0.11",
@ -16899,12 +16900,12 @@
            }
        },
        "node_modules/pkg-types": {
-            "version": "1.2.0",
-            "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-1.2.0.tgz",
-            "integrity": "sha512-+ifYuSSqOQ8CqP4MbZA5hDpb97n3E8SVWdJe+Wms9kj745lmd3b7EZJiqvmLwAlmRfjrI7Hi5z3kdBJ93lFNPA==",
+            "version": "1.2.1",
+            "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-1.2.1.tgz",
+            "integrity": "sha512-sQoqa8alT3nHjGuTjuKgOnvjo4cljkufdtLMnO2LBP/wRwuDlo1tkaEdMxCRhyGRPacv/ztlZgDPm2b7FAmEvw==",
            "dependencies": {
-                "confbox": "^0.1.7",
-                "mlly": "^1.7.1",
+                "confbox": "^0.1.8",
+                "mlly": "^1.7.2",
                "pathe": "^1.1.2"
            }
        },
@ -19537,9 +19538,9 @@
            }
        },
        "node_modules/swagger-client": {
-            "version": "3.29.3",
-            "resolved": "https://registry.npmjs.org/swagger-client/-/swagger-client-3.29.3.tgz",
-            "integrity": "sha512-OhhMAO2dwDEaxtUNDxwaqzw75uiZY5lX/2vx+U6eKCYZYhXWQ5mylU/0qfk/xMR20VyitsnzRc6KcFFjRoCS7A==",
+            "version": "3.29.4",
+            "resolved": "https://registry.npmjs.org/swagger-client/-/swagger-client-3.29.4.tgz",
+            "integrity": "sha512-Me8tdPyRAQbnwNBCZ0BpG0vyci9e+FW6YV3+c6/x8SwPmLpslpFNXoT4PtVApf1CVSvV7Sc7Bfb4DPgpEqBdHw==",
            "dependencies": {
                "@babel/runtime-corejs3": "^7.22.15",
                "@swagger-api/apidom-core": ">=1.0.0-alpha.9 <1.0.0-beta.0",
@ -19547,7 +19548,7 @@
                "@swagger-api/apidom-json-pointer": ">=1.0.0-alpha.9 <1.0.0-beta.0",
                "@swagger-api/apidom-ns-openapi-3-1": ">=1.0.0-alpha.9 <1.0.0-beta.0",
                "@swagger-api/apidom-reference": ">=1.0.0-alpha.9 <1.0.0-beta.0",
-                "cookie": "~0.6.0",
+                "cookie": "~0.7.2",
                "deepmerge": "~4.3.0",
                "fast-json-patch": "^3.0.0-1",
                "js-yaml": "^4.1.0",
@ -19560,6 +19561,14 @@
                "ramda-adjunct": "^5.0.0"
            }
        },
+        "node_modules/swagger-client/node_modules/cookie": {
+            "version": "0.7.2",
+            "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+            "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+            "engines": {
+                "node": ">= 0.6"
+            }
+        },
        "node_modules/syncpack": {
            "version": "13.0.0",
            "resolved": "https://registry.npmjs.org/syncpack/-/syncpack-13.0.0.tgz",
@ -20637,14 +20646,14 @@
            }
        },
        "node_modules/typescript-eslint": {
-            "version": "8.8.0",
-            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.8.0.tgz",
-            "integrity": "sha512-BjIT/VwJ8+0rVO01ZQ2ZVnjE1svFBiRczcpr1t1Yxt7sT25VSbPfrJtDsQ8uQTy2pilX5nI9gwxhUyLULNentw==",
+            "version": "8.8.1",
+            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.8.1.tgz",
+            "integrity": "sha512-R0dsXFt6t4SAFjUSKFjMh4pXDtq04SsFKCVGDP3ZOzNP7itF0jBcZYU4fMsZr4y7O7V7Nc751dDeESbe4PbQMQ==",
            "dev": true,
            "dependencies": {
-                "@typescript-eslint/eslint-plugin": "8.8.0",
-                "@typescript-eslint/parser": "8.8.0",
-                "@typescript-eslint/utils": "8.8.0"
+                "@typescript-eslint/eslint-plugin": "8.8.1",
+                "@typescript-eslint/parser": "8.8.1",
+                "@typescript-eslint/utils": "8.8.1"
            },
            "engines": {
                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@ -20902,17 +20911,17 @@
            "integrity": "sha512-08/DA66UF65OlpUDIQtbJyrqTR0jTAlJ+jsnkQ4jxR7+K5g5YG1APZKQSMCE1vqqmD+2pv6+IdEjmopFatacvg=="
        },
        "node_modules/untyped": {
-            "version": "1.5.0",
-            "resolved": "https://registry.npmjs.org/untyped/-/untyped-1.5.0.tgz",
-            "integrity": "sha512-o2Vjmn2dal08BzCcINxSmWuAteReUUiXseii5VRhmxyLF0b21K0iKZQ9fMYK7RWspVkY+0saqaVQNq4roe3Efg==",
+            "version": "1.5.1",
+            "resolved": "https://registry.npmjs.org/untyped/-/untyped-1.5.1.tgz",
+            "integrity": "sha512-reBOnkJBFfBZ8pCKaeHgfZLcehXtM6UTxc+vqs1JvCps0c4amLNp3fhdGBZwYp+VLyoY9n3X5KOP7lCyWBUX9A==",
            "dev": true,
            "optional": true,
            "dependencies": {
-                "@babel/core": "^7.25.2",
-                "@babel/standalone": "^7.25.6",
-                "@babel/types": "^7.25.6",
+                "@babel/core": "^7.25.7",
+                "@babel/standalone": "^7.25.7",
+                "@babel/types": "^7.25.7",
                "defu": "^6.1.4",
-                "jiti": "^2.0.0",
+                "jiti": "^2.3.1",
                "mri": "^1.2.0",
                "scule": "^1.3.0"
            },
@ -20936,9 +20945,9 @@
            }
        },
        "node_modules/untyped/node_modules/jiti": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.2.1.tgz",
-            "integrity": "sha512-weIl/Bv3G0J3UKamLxEA2G+FfQ33Z1ZkQJGPjKFV21zQdKWu2Pi6o4elpj2uEl5XdFJZ9xzn1fsanWTFSt45zw==",
+            "version": "2.3.3",
+            "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.3.3.tgz",
+            "integrity": "sha512-EX4oNDwcXSivPrw2qKH2LB5PoFxEvgtv2JgwW0bU858HoLQ+kutSvjLMUqBd0PeJYEinLWhoI9Ol0eYMqj/wNQ==",
            "dev": true,
            "optional": true,
            "bin": {
@ -21872,9 +21881,9 @@
            }
        },
        "node_modules/webdriver/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
@ -21927,9 +21936,9 @@
            }
        },
        "node_modules/webdriverio/node_modules/@types/node": {
-            "version": "20.16.10",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.10.tgz",
-            "integrity": "sha512-vQUKgWTjEIRFCvK6CyriPH3MZYiYlNy0fKiEYHWbcoWLEgs4opurGGKlebrTLqdSMIbXImH6XExNiIyNUv3WpA==",
+            "version": "20.16.11",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.11.tgz",
+            "integrity": "sha512-y+cTCACu92FyA5fgQSAI8A1H429g7aSK2HsO7K4XYUWc4dY5IUz55JSDIYT6/VsOLfGy8vmvQYC2hfb0iF16Uw==",
            "dev": true,
            "dependencies": {
                "undici-types": "~6.19.2"
--- a/web/package.json
+++ b/web/package.json
@ -11,7 +11,7 @@
        "@floating-ui/dom": "^1.6.11",
        "@formatjs/intl-listformat": "^7.5.7",
        "@fortawesome/fontawesome-free": "^6.6.0",
-        "@goauthentik/api": "^2024.8.3-1729836831",
+        "@goauthentik/api": "^2024.10.0-1730331602",
        "@lit-labs/ssr": "^3.2.2",
        "@lit/context": "^1.1.2",
        "@lit/localize": "^0.12.2",
--- a/web/src/admin/applications/wizard/methods/ldap/ak-application-wizard-authentication-by-ldap.ts
+++ b/web/src/admin/applications/wizard/methods/ldap/ak-application-wizard-authentication-by-ldap.ts
@ -71,6 +71,7 @@ export class ApplicationWizardApplicationDetails extends WithBrandConfig(BasePro
                        flowType=${FlowsInstancesListDesignationEnum.Invalidation}
                        .currentFlow=${provider?.invalidationFlow}
                        .brandFlow=${this.brand.flowInvalidation}
+                        defaultFlowSlug="default-invalidation-flow"
                        required
                    ></ak-branded-flow-search>
                    <p class="pf-c-form__helper-text">${msg("Flow used for unbinding users.")}</p>
@ -97,7 +98,7 @@ export class ApplicationWizardApplicationDetails extends WithBrandConfig(BasePro
                </ak-radio-input>

                <ak-switch-input
-                    name="openInNewTab"
+                    name="mfaSupport"
                    label=${msg("Code-based MFA Support")}
                    ?checked=${provider?.mfaSupport ?? true}
                    help=${mfaSupportHelp}
--- a/web/src/admin/applications/wizard/methods/radius/ak-application-wizard-authentication-by-radius.ts
+++ b/web/src/admin/applications/wizard/methods/radius/ak-application-wizard-authentication-by-radius.ts
@ -86,7 +86,7 @@ export class ApplicationWizardAuthenticationByRadius extends WithBrandConfig(Bas
                            <ak-flow-search
                                flowType=${FlowsInstancesListDesignationEnum.Invalidation}
                                .currentFlow=${provider?.invalidationFlow}
-                                defaultFlowSlug="default-provider-invalidation-flow"
+                                defaultFlowSlug="default-invalidation-flow"
                                required
                            ></ak-flow-search>
                            <p class="pf-c-form__helper-text">
--- a/web/src/admin/providers/ldap/LDAPProviderForm.ts
+++ b/web/src/admin/providers/ldap/LDAPProviderForm.ts
@ -157,6 +157,7 @@ export class LDAPProviderFormPage extends WithBrandConfig(BaseProviderForm<LDAPP
                            flowType=${FlowsInstancesListDesignationEnum.Invalidation}
                            .currentFlow=${this.instance?.invalidationFlow}
                            .brandFlow=${this.brand.flowInvalidation}
+                            defaultFlowSlug="default-invalidation-flow"
                            required
                        ></ak-branded-flow-search>
                        <p class="pf-c-form__helper-text">
--- a/web/src/admin/providers/rac/RACProviderViewPage.ts
+++ b/web/src/admin/providers/rac/RACProviderViewPage.ts
@ -129,11 +129,7 @@ export class RACProviderViewPage extends AKElement {
        if (!this.provider) {
            return html``;
        }
-        return html`<div slot="header" class="pf-c-banner pf-m-info">
-                ${msg("RAC is in preview.")}
-                <a href="mailto:hello+feature/rac@goauthentik.io">${msg("Send us feedback!")}</a>
-            </div>
-            ${this.provider?.assignedApplicationName
+        return html`${this.provider?.assignedApplicationName
                ? html``
                : html`<div slot="header" class="pf-c-banner pf-m-warning">
                      ${msg("Warning: Provider is not used by an Application.")}
--- a/web/src/admin/providers/radius/RadiusProviderForm.ts
+++ b/web/src/admin/providers/radius/RadiusProviderForm.ts
@ -176,7 +176,7 @@ export class RadiusProviderFormPage extends WithBrandConfig(BaseProviderForm<Rad
                        <ak-flow-search
                            flowType=${FlowsInstancesListDesignationEnum.Invalidation}
                            .currentFlow=${this.instance?.invalidationFlow}
-                            defaultFlowSlug="default-provider-invalidation-flow"
+                            defaultFlowSlug="default-invalidation-flow"
                            required
                        ></ak-flow-search>
                        <p class="pf-c-form__helper-text">
--- a/web/src/admin/rbac/ObjectPermissionModal.ts
+++ b/web/src/admin/rbac/ObjectPermissionModal.ts
@ -7,7 +7,6 @@ import { msg } from "@lit/localize";
 import { CSSResult, TemplateResult, html } from "lit";
 import { customElement, property } from "lit/decorators.js";

-import PFBanner from "@patternfly/patternfly/components/Banner/banner.css";
 import PFButton from "@patternfly/patternfly/components/Button/button.css";
 import PFBase from "@patternfly/patternfly/patternfly-base.css";

@ -53,17 +52,13 @@ export class ObjectPermissionModal extends AKElement {
    objectPk?: string | number;

    static get styles(): CSSResult[] {
-        return [PFBase, PFButton, PFBanner];
+        return [PFBase, PFButton];
    }

    render(): TemplateResult {
        return html`
            <ak-forms-modal .showSubmitButton=${false} cancelText=${msg("Close")}>
                <span slot="header"> ${msg("Update Permissions")} </span>
-                <div class="pf-c-banner pf-m-info" slot="above-form">
-                    ${msg("RBAC is in preview.")}
-                    <a href="mailto:hello@goauthentik.io">${msg("Send us feedback!")}</a>
-                </div>
                <ak-rbac-object-permission-modal-form
                    slot="form"
                    .model=${this.model}
--- a/web/src/admin/rbac/ObjectPermissionsPage.ts
+++ b/web/src/admin/rbac/ObjectPermissionsPage.ts
@ -11,7 +11,6 @@ import { msg } from "@lit/localize";
 import { html, nothing } from "lit";
 import { customElement, property } from "lit/decorators.js";

-import PFBanner from "@patternfly/patternfly/components/Banner/banner.css";
 import PFCard from "@patternfly/patternfly/components/Card/card.css";
 import PFPage from "@patternfly/patternfly/components/Page/page.css";
 import PFGrid from "@patternfly/patternfly/layouts/Grid/grid.css";
@ -31,66 +30,60 @@ export class ObjectPermissionPage extends AKElement {
    embedded = false;

    static get styles() {
-        return [PFBase, PFGrid, PFPage, PFCard, PFBanner];
+        return [PFBase, PFGrid, PFPage, PFCard];
    }

    render() {
-        return html`${!this.embedded
-                ? html`<div class="pf-c-banner pf-m-info">
-                      ${msg("RBAC is in preview.")}
-                      <a href="mailto:hello@goauthentik.io">${msg("Send us feedback!")}</a>
-                  </div>`
+        return html` <ak-tabs pageIdentifier="permissionPage" ?vertical=${!this.embedded}>
+            ${this.model === RbacPermissionsAssignedByUsersListModelEnum.CoreUser
+                ? this.renderCoreUser()
                : nothing}
-            <ak-tabs pageIdentifier="permissionPage" ?vertical=${!this.embedded}>
-                ${this.model === RbacPermissionsAssignedByUsersListModelEnum.CoreUser
-                    ? this.renderCoreUser()
-                    : nothing}
-                ${this.model === RbacPermissionsAssignedByUsersListModelEnum.RbacRole
-                    ? this.renderRbacRole()
-                    : nothing}
-                <section
-                    slot="page-object-user"
-                    data-tab-title="${msg("User Object Permissions")}"
-                    class="pf-c-page__main-section pf-m-no-padding-mobile"
-                >
-                    <div class="pf-l-grid pf-m-gutter">
-                        <div class="pf-c-card pf-l-grid__item pf-m-12-col">
-                            <div class="pf-c-card__title">${msg("User Object Permissions")}</div>
-                            <div class="pf-c-card__body">
-                                ${msg("Permissions set on users which affect this object.")}
-                            </div>
-                            <div class="pf-c-card__body">
-                                <ak-rbac-user-object-permission-table
-                                    .model=${this.model}
-                                    .objectPk=${this.objectPk}
-                                >
-                                </ak-rbac-user-object-permission-table>
-                            </div>
+            ${this.model === RbacPermissionsAssignedByUsersListModelEnum.RbacRole
+                ? this.renderRbacRole()
+                : nothing}
+            <section
+                slot="page-object-user"
+                data-tab-title="${msg("User Object Permissions")}"
+                class="pf-c-page__main-section pf-m-no-padding-mobile"
+            >
+                <div class="pf-l-grid pf-m-gutter">
+                    <div class="pf-c-card pf-l-grid__item pf-m-12-col">
+                        <div class="pf-c-card__title">${msg("User Object Permissions")}</div>
+                        <div class="pf-c-card__body">
+                            ${msg("Permissions set on users which affect this object.")}
+                        </div>
+                        <div class="pf-c-card__body">
+                            <ak-rbac-user-object-permission-table
+                                .model=${this.model}
+                                .objectPk=${this.objectPk}
+                            >
+                            </ak-rbac-user-object-permission-table>
                        </div>
                    </div>
-                </section>
-                <section
-                    slot="page-object-role"
-                    data-tab-title="${msg("Role Object Permissions")}"
-                    class="pf-c-page__main-section pf-m-no-padding-mobile"
-                >
-                    <div class="pf-l-grid pf-m-gutter">
-                        <div class="pf-c-card pf-l-grid__item pf-m-12-col">
-                            <div class="pf-c-card__title">${msg("Role Object Permissions")}</div>
-                            <div class="pf-c-card__body">
-                                ${msg("Permissions set on roles which affect this object.")}
-                            </div>
-                            <div class="pf-c-card__body">
-                                <ak-rbac-role-object-permission-table
-                                    .model=${this.model}
-                                    .objectPk=${this.objectPk}
-                                >
-                                </ak-rbac-role-object-permission-table>
-                            </div>
+                </div>
+            </section>
+            <section
+                slot="page-object-role"
+                data-tab-title="${msg("Role Object Permissions")}"
+                class="pf-c-page__main-section pf-m-no-padding-mobile"
+            >
+                <div class="pf-l-grid pf-m-gutter">
+                    <div class="pf-c-card pf-l-grid__item pf-m-12-col">
+                        <div class="pf-c-card__title">${msg("Role Object Permissions")}</div>
+                        <div class="pf-c-card__body">
+                            ${msg("Permissions set on roles which affect this object.")}
+                        </div>
+                        <div class="pf-c-card__body">
+                            <ak-rbac-role-object-permission-table
+                                .model=${this.model}
+                                .objectPk=${this.objectPk}
+                            >
+                            </ak-rbac-role-object-permission-table>
                        </div>
                    </div>
-                </section>
-            </ak-tabs>`;
+                </div>
+            </section>
+        </ak-tabs>`;
    }

    renderCoreUser() {
--- a/web/src/admin/roles/RoleListPage.ts
+++ b/web/src/admin/roles/RoleListPage.ts
@ -9,12 +9,10 @@ import { TablePage } from "@goauthentik/elements/table/TablePage";
 import "@patternfly/elements/pf-tooltip/pf-tooltip.js";

 import { msg } from "@lit/localize";
-import { CSSResult, TemplateResult, html } from "lit";
+import { TemplateResult, html } from "lit";
 import { customElement, property } from "lit/decorators.js";
 import { ifDefined } from "lit/directives/if-defined.js";

-import PFBanner from "@patternfly/patternfly/components/Banner/banner.css";
-
 import { RbacApi, Role } from "@goauthentik/api";

@customElement("ak-role-list")
@ -37,10 +35,6 @@ export class RoleListPage extends TablePage<Role> {
    @property()
    order = "name";

-    static get styles(): CSSResult[] {
-        return [...super.styles, PFBanner];
-    }
-
    async apiEndpoint(): Promise<PaginatedResponse<Role>> {
        return new RbacApi(DEFAULT_CONFIG).rbacRolesList(await this.defaultEndpointConfig());
    }
@ -78,10 +72,6 @@ export class RoleListPage extends TablePage<Role> {
                description=${ifDefined(this.pageDescription())}
            >
            </ak-page-header>
-            <div class="pf-c-banner pf-m-info">
-                ${msg("RBAC is in preview.")}
-                <a href="mailto:hello@goauthentik.io">${msg("Send us feedback!")}</a>
-            </div>
            <section class="pf-c-page__main-section pf-m-no-padding-mobile">
                <div class="pf-c-card">${this.renderTable()}</div>
            </section>`;
--- a/web/src/admin/sources/kerberos/KerberosSourceViewPage.ts
+++ b/web/src/admin/sources/kerberos/KerberosSourceViewPage.ts
@ -18,6 +18,7 @@ import { msg } from "@lit/localize";
 import { CSSResult, TemplateResult, html } from "lit";
 import { customElement, property, state } from "lit/decorators.js";

+import PFBanner from "@patternfly/patternfly/components/Banner/banner.css";
 import PFButton from "@patternfly/patternfly/components/Button/button.css";
 import PFCard from "@patternfly/patternfly/components/Card/card.css";
 import PFContent from "@patternfly/patternfly/components/Content/content.css";
@ -54,7 +55,17 @@ export class KerberosSourceViewPage extends AKElement {
    syncState?: SyncStatus;

    static get styles(): CSSResult[] {
-        return [PFBase, PFPage, PFButton, PFGrid, PFContent, PFCard, PFDescriptionList, PFList];
+        return [
+            PFBase,
+            PFPage,
+            PFButton,
+            PFGrid,
+            PFContent,
+            PFCard,
+            PFDescriptionList,
+            PFBanner,
+            PFList,
+        ];
    }

    constructor() {
@ -121,6 +132,12 @@ export class KerberosSourceViewPage extends AKElement {
                    this.load();
                }}
            >
+                <div slot="header" class="pf-c-banner pf-m-info">
+                    ${msg("Kerberos Source is in preview.")}
+                    <a href="mailto:hello+feature/kerberos-source@goauthentik.io"
+                        >${msg("Send us feedback!")}</a
+                    >
+                </div>
                <div class="pf-l-grid pf-m-gutter">
                    <div class="pf-c-card pf-l-grid__item pf-m-12-col">
                        <div class="pf-c-card__body">
--- a/web/src/admin/stages/authenticator_endpoint_gdtc/AuthenticatorEndpointGDTCStageForm.ts
+++ b/web/src/admin/stages/authenticator_endpoint_gdtc/AuthenticatorEndpointGDTCStageForm.ts
@ -10,6 +10,8 @@ import { msg } from "@lit/localize";
 import { TemplateResult, html } from "lit";
 import { customElement } from "lit/decorators.js";

+import PFBanner from "@patternfly/patternfly/components/Banner/banner.css";
+
 import { AuthenticatorEndpointGDTCStage, StagesApi } from "@goauthentik/api";

@customElement("ak-stage-authenticator-endpoint-gdtc-form")
@ -33,8 +35,16 @@ export class AuthenticatorEndpointGDTCStageForm extends BaseStageForm<Authentica
        }
    }

+    static get styles() {
+        return super.styles.concat(PFBanner);
+    }
+
    renderForm(): TemplateResult {
-        return html` <span>
+        return html`<div class="pf-c-banner pf-m-info">
+                ${msg("Endpoint Google Chrome Device Trust is in preview.")}
+                <a href="mailto:hello+feature/gdtc@goauthentik.io">${msg("Send us feedback!")}</a>
+            </div>
+            <span>
                ${msg(
                    "Stage used to verify users' browsers using Google Chrome Device Trust. This stage can be used in authentication/authorization flows.",
                )}
--- a/web/src/common/constants.ts
+++ b/web/src/common/constants.ts
@ -3,7 +3,7 @@ export const SUCCESS_CLASS = "pf-m-success";
 export const ERROR_CLASS = "pf-m-danger";
 export const PROGRESS_CLASS = "pf-m-in-progress";
 export const CURRENT_CLASS = "pf-m-current";
-export const VERSION = "2024.8.3";
+export const VERSION = "2024.10.0";
 export const TITLE_DEFAULT = "authentik";
 export const ROUTE_SEPARATOR = ";";

--- a/web/src/elements/Alert.ts
+++ b/web/src/elements/Alert.ts
@ -44,6 +44,12 @@ export class Alert extends AKElement implements IAlert {
    @property({ type: Boolean })
    inline = false;

+    /**
+     * When true, removes the background color and status line; the text and icon are retained and
+     * colored.
+     *
+     * @attr
+     */
    @property({ type: Boolean })
    plain = false;

--- a/web/src/elements/Divider.ts
+++ b/web/src/elements/Divider.ts
@ -6,6 +6,14 @@ import { customElement } from "lit/decorators.js";

 import PFBase from "@patternfly/patternfly/patternfly-base.css";

+/**
+ * @class Divider
+ * @element ak-divider
+ *
+ * Divider is a horizontal rule, an in-page element to separate displayed items.
+ *
+ * @slot - HTML to display in-line in the middle of the horizontal rule.
+ */
@customElement("ak-divider")
 export class Divider extends AKElement {
    static get styles() {
--- a/web/src/elements/Expand.ts
+++ b/web/src/elements/Expand.ts
@ -15,14 +15,38 @@ export interface IExpand {
    textClosed?: string;
 }

+/**
+ * @class Expand
+ * @element ak-expand
+ *
+ * An `ak-expand` is used to hide cluttering details that a user may wish to reveal, such as the raw
+ * details of an alert or event.
+ *
+ * slot - The contents to be hidden or displayed.
+ */
@customElement("ak-expand")
 export class Expand extends AKElement implements IExpand {
-    @property({ type: Boolean })
+    /**
+     * The state of the expanded content
+     *
+     * @attr
+     */
+    @property({ type: Boolean, reflect: true })
    expanded = false;

+    /**
+     * The text to display next to the open/close control when the accordion is open.
+     *
+     * @attr
+     */
    @property({ type: String, attribute: "text-open" })
    textOpen = msg("Show less");

+    /**
+     * The text to display next to the open/close control when the accordion is closed.
+     *
+     * @attr
+     */
    @property({ type: String, attribute: "text-closed" })
    textClosed = msg("Show more");

--- a/web/src/elements/LoadingOverlay.ts
+++ b/web/src/elements/LoadingOverlay.ts
@ -12,9 +12,23 @@ export interface ILoadingOverlay {
    topmost?: boolean;
 }

+/**
+ * @class LoadingOverlay
+ * @element ak-loading-overlay
+ *
+ * The LoadingOverlay is meant to cover the container element completely, hiding the content behind
+ * a dimming filter, while content loads.
+ *
+ * @slot - [Optional] message content to display while the overlay is visible.
+ */
@customElement("ak-loading-overlay")
 export class LoadingOverlay extends AKElement implements ILoadingOverlay {
-    // Do not camelize: https://www.merriam-webster.com/dictionary/topmost
+    /**
+     * When true, forces the overlay onto the top layer of the display stack.
+     * Do not camelize: https://www.merriam-webster.com/dictionary/topmost
+     *
+     * @attr
+     */
    @property({ type: Boolean, attribute: "topmost" })
    topmost = false;

--- a/web/src/elements/buttons/ActionButton/ak-action-button.stories.ts
+++ b/web/src/elements/buttons/ActionButton/ak-action-button.stories.ts
@ -4,9 +4,9 @@ import { Meta } from "@storybook/web-components";
 import { TemplateResult, html } from "lit";

 import "./ak-action-button";
-import AKActionButton from "./ak-action-button";
+import { ActionButton } from "./ak-action-button";

-const metadata: Meta<AKActionButton> = {
+const metadata: Meta<ActionButton> = {
    title: "Elements / <ak-action-button>",
    component: "ak-action-button",
    parameters: {
--- a/web/src/elements/buttons/ActionButton/ak-action-button.ts
+++ b/web/src/elements/buttons/ActionButton/ak-action-button.ts
@ -1,9 +1,14 @@
 import { MessageLevel } from "@goauthentik/common/messages";
-import { BaseTaskButton } from "@goauthentik/elements/buttons/SpinnerButton/BaseTaskButton";
+import {
+    BaseTaskButton,
+    type IBaseTaskButton,
+} from "@goauthentik/elements/buttons/SpinnerButton/BaseTaskButton";
 import { showMessage } from "@goauthentik/elements/messages/MessageContainer";

 import { customElement, property } from "lit/decorators.js";

+type IActionButton = IBaseTaskButton & { apiRequest: () => Promise<unknown> };
+
 /**
 * A button associated with an event handler for loading data. Takes an asynchronous function as its
 * only property.
@ -19,7 +24,7 @@ import { customElement, property } from "lit/decorators.js";
 */

@customElement("ak-action-button")
-export class ActionButton extends BaseTaskButton {
+export class ActionButton extends BaseTaskButton implements IActionButton {
    /**
     * The command to run when the button is pressed. Must return a promise. If the promise is a
     * reject or throw, we process the content of the promise and deliver it to the Notification
@ -27,7 +32,6 @@ export class ActionButton extends BaseTaskButton {
     *
     * @attr
     */
-
    @property({ attribute: false })
    apiRequest: () => Promise<unknown> = () => {
        throw new Error();
--- a/web/src/elements/buttons/SpinnerButton/BaseTaskButton.ts
+++ b/web/src/elements/buttons/SpinnerButton/BaseTaskButton.ts
@ -36,6 +36,10 @@ const StatusMap = new Map<TaskStatus, string>([

 const SPINNER_TIMEOUT = 1000 * 1.5; // milliseconds

+export interface IBaseTaskButton {
+    disabled?: boolean;
+}
+
 /**
 * BaseTaskButton
 *
@ -46,7 +50,6 @@ const SPINNER_TIMEOUT = 1000 * 1.5; // milliseconds
 * `onFailure` call their `super.` equivalents.
 *
 */
-
 export abstract class BaseTaskButton extends CustomEmitterElement(AKElement) {
    eventPrefix = "ak-button";

--- a/web/src/elements/buttons/SpinnerButton/ak-spinner-button.ts
+++ b/web/src/elements/buttons/SpinnerButton/ak-spinner-button.ts
@ -1,7 +1,7 @@
 import { customElement } from "lit/decorators.js";
 import { property } from "lit/decorators.js";

-import { BaseTaskButton } from "./BaseTaskButton";
+import { BaseTaskButton, type IBaseTaskButton } from "./BaseTaskButton";

 /**
 * A button associated with an event handler for loading data. Takes an asynchronous function as its
@ -17,8 +17,10 @@ import { BaseTaskButton } from "./BaseTaskButton";
 * @fires ak-button-reset - When the button is reset after the async process completes
 */

+type ISpinnerButton = IBaseTaskButton & { callAction: () => Promise<unknown> };
+
@customElement("ak-spinner-button")
-export class SpinnerButton extends BaseTaskButton {
+export class SpinnerButton extends BaseTaskButton implements ISpinnerButton {
    /**
     * The command to run when the button is pressed. Must return a promise. We don't do anything
     * with that promise other than check if it's a resolve or reject, and rethrow the event after.
--- a/web/xliff/de.xlf
+++ b/web/xliff/de.xlf
@ -5819,9 +5819,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sfc31264ef7ff86ef">
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
 </trans-unit>
@ -5966,9 +5963,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -7020,6 +7014,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/en.xlf
+++ b/web/xliff/en.xlf
@ -6084,9 +6084,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sfc31264ef7ff86ef">
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
 </trans-unit>
@ -6231,9 +6228,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -7285,6 +7279,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/es.xlf
+++ b/web/xliff/es.xlf
@ -5736,9 +5736,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sfc31264ef7ff86ef">
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
 </trans-unit>
@ -5883,9 +5880,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -6937,6 +6931,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/fr.xlf
+++ b/web/xliff/fr.xlf
@ -7646,10 +7646,6 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>Pour nginx auth_request ou traefik forwardAuth par domaine racine</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>RBAC est en aperçu.</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>Type d'utilisateur pour les utilisateurs nouvellement créés.</target>
@ -7842,10 +7838,6 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
  <source>Create Endpoint</source>
  <target>Créer un point de terminaison</target>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-  <target>RAC est en aperçu.</target>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
  <target>Mettre à jour le fournisseur RAC</target>
@ -9248,6 +9240,18 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/it.xlf
+++ b/web/xliff/it.xlf
--- a/web/xliff/ko.xlf
+++ b/web/xliff/ko.xlf
@ -7616,10 +7616,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>루트 도메인 당 Nginx의 auth_request 또는 Traefik의 forwardAuth 경우</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>RBAC 는 현재 프리뷰입니다.</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>새로 생성된 사용자에 사용되는 사용자 유형입니다.</target>
@ -7814,9 +7810,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -8853,6 +8846,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/nl.xlf
+++ b/web/xliff/nl.xlf
@ -7396,9 +7396,6 @@ Bindingen naar groepen/gebruikers worden gecontroleerd tegen de gebruiker van de
 <trans-unit id="sf79f8681e5ffaee2">
  <source>Assign to new user</source>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-</trans-unit>
 <trans-unit id="saabeb4cab074b0b9">
  <source>User Object Permissions</source>
 </trans-unit>
@ -7486,9 +7483,6 @@ Bindingen naar groepen/gebruikers worden gecontroleerd tegen de gebruiker van de
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -8699,6 +8693,18 @@ Bindingen naar groepen/gebruikers worden gecontroleerd tegen de gebruiker van de
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/pl.xlf
+++ b/web/xliff/pl.xlf
@ -7650,10 +7650,6 @@ Powiązania z grupami/użytkownikami są sprawdzane względem użytkownika zdarz
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>Dla nginx's auth_request lub traefik's forwardAuth dla domeny głównej</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>RBAC jest w fazie zapoznawczej.</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>Typ użytkownika używany dla nowo utworzonych użytkowników.</target>
@ -7846,10 +7842,6 @@ Powiązania z grupami/użytkownikami są sprawdzane względem użytkownika zdarz
  <source>Create Endpoint</source>
  <target>Utwórz punkt końcowy</target>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-  <target>RAC jest w fazie zapoznawczej.</target>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
  <target>Aktualizuj dostawcę RAC</target>
@ -9118,6 +9110,18 @@ Powiązania z grupami/użytkownikami są sprawdzane względem użytkownika zdarz
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/pseudo-LOCALE.xlf
+++ b/web/xliff/pseudo-LOCALE.xlf
@ -7594,10 +7594,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>Ƒōŕ ńĝĩńx'ś àũţĥ_ŕēǫũēśţ ōŕ ţŕàēƒĩķ'ś ƒōŕŵàŕďÀũţĥ ƥēŕ ŕōōţ ďōḿàĩń</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>ŔßÀĆ ĩś ĩń ƥŕēvĩēŵ.</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>Ũśēŕ ţŷƥē ũśēď ƒōŕ ńēŵĺŷ ćŕēàţēď ũśēŕś.</target>
@ -7790,10 +7786,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>Create Endpoint</source>
  <target>Ćŕēàţē Ēńďƥōĩńţ</target>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-  <target>ŔÀĆ ĩś ĩń ƥŕēvĩēŵ.</target>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
  <target>Ũƥďàţē ŔÀĆ Ƥŕōvĩďēŕ</target>
@ -9158,4 +9150,16 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
 </trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
+</trans-unit>
 </body></file></xliff>
--- a/web/xliff/ru.xlf
+++ b/web/xliff/ru.xlf
@ -7649,10 +7649,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>Для nginx's auth_request или traefik's forwardAuth для корневого домена</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>RBAC находится в предварительной версии.</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>Тип пользователя, используемый для вновь созданных пользователей.</target>
@ -7845,10 +7841,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>Create Endpoint</source>
  <target>Создать конечную точку</target>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-  <target>RAC находится в предварительной версии.</target>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
  <target>Обновить RAC провайдера</target>
@ -9181,6 +9173,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/tr.xlf
+++ b/web/xliff/tr.xlf
@ -5729,9 +5729,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sfc31264ef7ff86ef">
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
 </trans-unit>
@ -5876,9 +5873,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -6930,6 +6924,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/zh-CN.xlf
+++ b/web/xliff/zh-CN.xlf
@ -1375,9 +1375,6 @@
 <trans-unit id="s9fb28be12e2c6317">
  <source>Superuser</source>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-</trans-unit>
 <trans-unit id="sa1db89262360550b">
  <source>Send us feedback!</source>
 </trans-unit>
@ -1914,9 +1911,6 @@ doesn't pass when either or both of the selected options are equal or above the
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -5869,6 +5863,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
 </trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
+</trans-unit>
 </body>
 </file>
 </xliff>
--- a/web/xliff/zh-Hans.xlf
+++ b/web/xliff/zh-Hans.xlf
@ -7648,10 +7648,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>适用于按根域名配置的 nginx 的 auth_request 或 traefik 的 forwardAuth</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>RBAC 目前处于预览状态。</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>新创建用户使用的用户类型。</target>
@ -7844,10 +7840,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>Create Endpoint</source>
  <target>创建端点</target>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-  <target>RAC 目前处于预览状态。</target>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
  <target>更新 RAC 提供程序</target>
@ -9128,99 +9120,147 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="sbfee780fa0a2c83e">
  <source>Device type <x id="0" equiv-text="${device.verboseName}"/> cannot be deleted</source>
+  <target>设备类型 <x id="0" equiv-text="${device.verboseName}"/> 无法被删除</target>
 </trans-unit>
 <trans-unit id="s336936629cdeb3e5">
  <source>Stage used to verify users' browsers using Google Chrome Device Trust. This stage can be used in authentication/authorization flows.</source>
+  <target>通过 Google Chrome 设备信任来验证用户浏览器的阶段。此阶段可在身份验证/授权流程中使用。</target>
 </trans-unit>
 <trans-unit id="s85fe794c71b4ace8">
  <source>Google Verified Access API</source>
+  <target>Google Verified Access API</target>
 </trans-unit>
 <trans-unit id="s013620384af7c8b4">
  <source>Device type <x id="0" equiv-text="${device.verboseName}"/> cannot be edited</source>
+  <target>设备类型 <x id="0" equiv-text="${device.verboseName}"/> 无法被编辑</target>
 </trans-unit>
 <trans-unit id="s4347135696fc7cde">
  <source>Advanced flow settings</source>
+  <target>高级流程设置</target>
 </trans-unit>
 <trans-unit id="sf52ff57fd136cc2f">
  <source>Enable this option to write password changes made in authentik back to Kerberos. Ignored if sync is disabled.</source>
+  <target>启用此选项会将 authentik 作出的密码修改写入回 Kerberos。如果未启用同步则忽略。</target>
 </trans-unit>
 <trans-unit id="s14a16542f956e11d">
  <source>Realm settings</source>
+  <target>领域设置</target>
 </trans-unit>
 <trans-unit id="s9c2eae548d3c1c30">
  <source>Realm</source>
+  <target>领域</target>
 </trans-unit>
 <trans-unit id="s6b032212997e2491">
  <source>Kerberos 5 configuration</source>
+  <target>Kerberos 5 配置</target>
 </trans-unit>
 <trans-unit id="sbf50181022f47de3">
  <source>Kerberos 5 configuration. See man krb5.conf(5) for configuration format. If left empty, a default krb5.conf will be used.</source>
+  <target>Kerberos 5 配置。请阅读 man krb5.conf(5) 了解配置格式。如果留空，则使用默认的 krb5.conf。</target>
 </trans-unit>
 <trans-unit id="s2386539a0bd62fab">
  <source>Sync connection settings</source>
+  <target>同步连接设置</target>
 </trans-unit>
 <trans-unit id="s0d1a6f3fe81351f8">
  <source>Sync principal</source>
+  <target>同步主体</target>
 </trans-unit>
 <trans-unit id="sa691d6e1974295fa">
  <source>Principal used to authenticate to the KDC for syncing.</source>
+  <target>向 KDC 进行身份验证以进行同步的主体。</target>
 </trans-unit>
 <trans-unit id="s977b9c629eed3d33">
  <source>Sync password</source>
+  <target>同步密码</target>
 </trans-unit>
 <trans-unit id="s77772860385de948">
  <source>Password used to authenticate to the KDC for syncing. Optional if Sync keytab or Sync credentials cache is provided.</source>
+  <target>向 KDC 进行身份验证以进行同步的密码。如果提供了同步 Keytab 或同步凭据缓存，则此选项是可选的。</target>
 </trans-unit>
 <trans-unit id="sc59ec59c3d5e74dc">
  <source>Sync keytab</source>
+  <target>同步 Keytab</target>
 </trans-unit>
 <trans-unit id="scd42997958453f05">
  <source>Keytab used to authenticate to the KDC for syncing. Optional if Sync password or Sync credentials cache is provided. Must be base64 encoded or in the form TYPE:residual.</source>
+  <target>向 KDC 进行身份验证以进行同步的 Keytab。如果提供了同步密码或同步凭据缓存，则此选项是可选的。必须以 Base64 编码，或者形式为 TYPE:residual。</target>
 </trans-unit>
 <trans-unit id="s60eaf439ccdca1f2">
  <source>Sync credentials cache</source>
+  <target>同步凭据缓存</target>
 </trans-unit>
 <trans-unit id="s95722900b0c9026f">
  <source>Credentials cache used to authenticate to the KDC for syncing. Optional if Sync password or Sync keytab is provided. Must be in the form TYPE:residual.</source>
+  <target>向 KDC 进行身份验证以进行同步的凭据缓存。如果提供了同步密码或同步 Keytab，则此选项是可选的。形式必须为 TYPE:residual。</target>
 </trans-unit>
 <trans-unit id="sf9c055db98d7994a">
  <source>SPNEGO settings</source>
+  <target>SPNEGO 设置</target>
 </trans-unit>
 <trans-unit id="sab580a45dc46937f">
  <source>SPNEGO server name</source>
+  <target>SPNEGO 服务器名称</target>
 </trans-unit>
 <trans-unit id="s7a79d6174d17ab2d">
  <source>Force the use of a specific server name for SPNEGO. Must be in the form HTTP@domain</source>
+  <target>强制为 SPNEGO 使用特定服务器名称。形式必须为 HTTP@域名</target>
 </trans-unit>
 <trans-unit id="sa4ba2b2081472ccd">
  <source>SPNEGO keytab</source>
+  <target>SPNEGO Keytab</target>
 </trans-unit>
 <trans-unit id="s64adda975c1106c0">
  <source>Keytab used for SPNEGO. Optional if SPNEGO credentials cache is provided. Must be base64 encoded or in the form TYPE:residual.</source>
+  <target>SPNEGO 使用的 Keytab。如果提供了 SPNEGO 凭据缓存，则此选项是可选的。必须以 Base64 编码，或者形式为 TYPE:residual。</target>
 </trans-unit>
 <trans-unit id="s92247825b92587b5">
  <source>SPNEGO credentials cache</source>
+  <target>SPNEGO 凭据缓存</target>
 </trans-unit>
 <trans-unit id="sd9757c345e4062f8">
  <source>Credentials cache used for SPNEGO. Optional if SPNEGO keytab is provided. Must be in the form TYPE:residual.</source>
+  <target>SPNEGO 使用的凭据缓存。如果提供了 SPNEGO Keytab，则此选项是可选的。形式必须为 TYPE:residual。</target>
 </trans-unit>
 <trans-unit id="s734ab8fbcae0b69e">
  <source>Kerberos Attribute mapping</source>
+  <target>Kerberos 属性映射</target>
 </trans-unit>
 <trans-unit id="s2c378e86e025fdb2">
  <source>Update Kerberos Source</source>
+  <target>更新 Kerberos 源</target>
 </trans-unit>
 <trans-unit id="s03e4044abe0b556c">
  <source>User database + Kerberos password</source>
+  <target>用户数据库 + Kerberos 密码</target>
 </trans-unit>
 <trans-unit id="s98bb2ae796f1ceef">
  <source>Select another authentication method</source>
+  <target>选择另一种身份验证方法</target>
 </trans-unit>
 <trans-unit id="s21d95b4651ad7a1e">
  <source>Enter a one-time recovery code for this user.</source>
+  <target>为此用户输入一次性恢复代码。</target>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+  <target>请输入来自您身份验证设备的代码。</target>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+  <target>Kerberos 源目前处于预览状态。</target>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+  <target>验证码阶段</target>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+  <target>设置后，添加与验证码阶段完全相同的功能，但融入识别阶段。</target>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
+  <target>端点 Google Chrome 设备信任处于预览状态。</target>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/zh-Hant.xlf
+++ b/web/xliff/zh-Hant.xlf
@ -5777,9 +5777,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sfc31264ef7ff86ef">
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
 </trans-unit>
@ -5924,9 +5921,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -6978,6 +6972,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/zh_CN.xlf
+++ b/web/xliff/zh_CN.xlf
@ -6618,11 +6618,6 @@ Bindings to groups/users are checked against the user of the event.</source>
        <source>Please enter your code</source>
        <target>请输入您的代码</target>
        
-      </trans-unit>
-      <trans-unit id="s18b910437b73e8e8">
-        <source>Return to device picker</source>
-        <target>返回设备选择器</target>
-        
      </trans-unit>
      <trans-unit id="se409d01b52c4e12f">
        <source>Retry authentication</source>
@ -7653,10 +7648,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>适用于按根域名配置的 nginx 的 auth_request 或 traefik 的 forwardAuth</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>RBAC 目前处于预览状态。</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>新创建用户使用的用户类型。</target>
@ -7849,10 +7840,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>Create Endpoint</source>
  <target>创建端点</target>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-  <target>RAC 目前处于预览状态。</target>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
  <target>更新 RAC 提供程序</target>
@ -9130,6 +9117,150 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s8a598f7aef81c3bc">
  <source>Key used to encrypt the tokens.</source>
  <target>用于加密令牌的密钥。</target>
+</trans-unit>
+<trans-unit id="sbfee780fa0a2c83e">
+  <source>Device type <x id="0" equiv-text="${device.verboseName}"/> cannot be deleted</source>
+  <target>设备类型 <x id="0" equiv-text="${device.verboseName}"/> 无法被删除</target>
+</trans-unit>
+<trans-unit id="s336936629cdeb3e5">
+  <source>Stage used to verify users' browsers using Google Chrome Device Trust. This stage can be used in authentication/authorization flows.</source>
+  <target>通过 Google Chrome 设备信任来验证用户浏览器的阶段。此阶段可在身份验证/授权流程中使用。</target>
+</trans-unit>
+<trans-unit id="s85fe794c71b4ace8">
+  <source>Google Verified Access API</source>
+  <target>Google Verified Access API</target>
+</trans-unit>
+<trans-unit id="s013620384af7c8b4">
+  <source>Device type <x id="0" equiv-text="${device.verboseName}"/> cannot be edited</source>
+  <target>设备类型 <x id="0" equiv-text="${device.verboseName}"/> 无法被编辑</target>
+</trans-unit>
+<trans-unit id="s4347135696fc7cde">
+  <source>Advanced flow settings</source>
+  <target>高级流程设置</target>
+</trans-unit>
+<trans-unit id="sf52ff57fd136cc2f">
+  <source>Enable this option to write password changes made in authentik back to Kerberos. Ignored if sync is disabled.</source>
+  <target>启用此选项会将 authentik 作出的密码修改写入回 Kerberos。如果未启用同步则忽略。</target>
+</trans-unit>
+<trans-unit id="s14a16542f956e11d">
+  <source>Realm settings</source>
+  <target>领域设置</target>
+</trans-unit>
+<trans-unit id="s9c2eae548d3c1c30">
+  <source>Realm</source>
+  <target>领域</target>
+</trans-unit>
+<trans-unit id="s6b032212997e2491">
+  <source>Kerberos 5 configuration</source>
+  <target>Kerberos 5 配置</target>
+</trans-unit>
+<trans-unit id="sbf50181022f47de3">
+  <source>Kerberos 5 configuration. See man krb5.conf(5) for configuration format. If left empty, a default krb5.conf will be used.</source>
+  <target>Kerberos 5 配置。请阅读 man krb5.conf(5) 了解配置格式。如果留空，则使用默认的 krb5.conf。</target>
+</trans-unit>
+<trans-unit id="s2386539a0bd62fab">
+  <source>Sync connection settings</source>
+  <target>同步连接设置</target>
+</trans-unit>
+<trans-unit id="s0d1a6f3fe81351f8">
+  <source>Sync principal</source>
+  <target>同步主体</target>
+</trans-unit>
+<trans-unit id="sa691d6e1974295fa">
+  <source>Principal used to authenticate to the KDC for syncing.</source>
+  <target>向 KDC 进行身份验证以进行同步的主体。</target>
+</trans-unit>
+<trans-unit id="s977b9c629eed3d33">
+  <source>Sync password</source>
+  <target>同步密码</target>
+</trans-unit>
+<trans-unit id="s77772860385de948">
+  <source>Password used to authenticate to the KDC for syncing. Optional if Sync keytab or Sync credentials cache is provided.</source>
+  <target>向 KDC 进行身份验证以进行同步的密码。如果提供了同步 Keytab 或同步凭据缓存，则此选项是可选的。</target>
+</trans-unit>
+<trans-unit id="sc59ec59c3d5e74dc">
+  <source>Sync keytab</source>
+  <target>同步 Keytab</target>
+</trans-unit>
+<trans-unit id="scd42997958453f05">
+  <source>Keytab used to authenticate to the KDC for syncing. Optional if Sync password or Sync credentials cache is provided. Must be base64 encoded or in the form TYPE:residual.</source>
+  <target>向 KDC 进行身份验证以进行同步的 Keytab。如果提供了同步密码或同步凭据缓存，则此选项是可选的。必须以 Base64 编码，或者形式为 TYPE:residual。</target>
+</trans-unit>
+<trans-unit id="s60eaf439ccdca1f2">
+  <source>Sync credentials cache</source>
+  <target>同步凭据缓存</target>
+</trans-unit>
+<trans-unit id="s95722900b0c9026f">
+  <source>Credentials cache used to authenticate to the KDC for syncing. Optional if Sync password or Sync keytab is provided. Must be in the form TYPE:residual.</source>
+  <target>向 KDC 进行身份验证以进行同步的凭据缓存。如果提供了同步密码或同步 Keytab，则此选项是可选的。形式必须为 TYPE:residual。</target>
+</trans-unit>
+<trans-unit id="sf9c055db98d7994a">
+  <source>SPNEGO settings</source>
+  <target>SPNEGO 设置</target>
+</trans-unit>
+<trans-unit id="sab580a45dc46937f">
+  <source>SPNEGO server name</source>
+  <target>SPNEGO 服务器名称</target>
+</trans-unit>
+<trans-unit id="s7a79d6174d17ab2d">
+  <source>Force the use of a specific server name for SPNEGO. Must be in the form HTTP@domain</source>
+  <target>强制为 SPNEGO 使用特定服务器名称。形式必须为 HTTP@域名</target>
+</trans-unit>
+<trans-unit id="sa4ba2b2081472ccd">
+  <source>SPNEGO keytab</source>
+  <target>SPNEGO Keytab</target>
+</trans-unit>
+<trans-unit id="s64adda975c1106c0">
+  <source>Keytab used for SPNEGO. Optional if SPNEGO credentials cache is provided. Must be base64 encoded or in the form TYPE:residual.</source>
+  <target>SPNEGO 使用的 Keytab。如果提供了 SPNEGO 凭据缓存，则此选项是可选的。必须以 Base64 编码，或者形式为 TYPE:residual。</target>
+</trans-unit>
+<trans-unit id="s92247825b92587b5">
+  <source>SPNEGO credentials cache</source>
+  <target>SPNEGO 凭据缓存</target>
+</trans-unit>
+<trans-unit id="sd9757c345e4062f8">
+  <source>Credentials cache used for SPNEGO. Optional if SPNEGO keytab is provided. Must be in the form TYPE:residual.</source>
+  <target>SPNEGO 使用的凭据缓存。如果提供了 SPNEGO Keytab，则此选项是可选的。形式必须为 TYPE:residual。</target>
+</trans-unit>
+<trans-unit id="s734ab8fbcae0b69e">
+  <source>Kerberos Attribute mapping</source>
+  <target>Kerberos 属性映射</target>
+</trans-unit>
+<trans-unit id="s2c378e86e025fdb2">
+  <source>Update Kerberos Source</source>
+  <target>更新 Kerberos 源</target>
+</trans-unit>
+<trans-unit id="s03e4044abe0b556c">
+  <source>User database + Kerberos password</source>
+  <target>用户数据库 + Kerberos 密码</target>
+</trans-unit>
+<trans-unit id="s98bb2ae796f1ceef">
+  <source>Select another authentication method</source>
+  <target>选择另一种身份验证方法</target>
+</trans-unit>
+<trans-unit id="s21d95b4651ad7a1e">
+  <source>Enter a one-time recovery code for this user.</source>
+  <target>为此用户输入一次性恢复代码。</target>
+</trans-unit>
+<trans-unit id="s2e1d5a7d320c25ef">
+  <source>Enter the code from your authenticator device.</source>
+  <target>请输入来自您身份验证设备的代码。</target>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+  <target>Kerberos 源目前处于预览状态。</target>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+  <target>验证码阶段</target>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+  <target>设置后，添加与验证码阶段完全相同的功能，但融入识别阶段。</target>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
+  <target>端点 Google Chrome 设备信任处于预览状态。</target>
 </trans-unit>
    </body>
  </file>
--- a/web/xliff/zh_TW.xlf
+++ b/web/xliff/zh_TW.xlf
@ -7590,10 +7590,6 @@ Bindings to groups/users are checked against the user of the event.</source>
  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
  <target>適用於每個主網域的 nginx 的「auth_request」或 traefik 的「forwardAuth」</target>
 </trans-unit>
-<trans-unit id="sc615309d10a9228c">
-  <source>RBAC is in preview.</source>
-  <target>RBAC 正處於預覽版本。</target>
-</trans-unit>
 <trans-unit id="s32babfed740fd3c1">
  <source>User type used for newly created users.</source>
  <target>用於建立使用者的使用者類型。</target>
@ -7760,9 +7756,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s38e7cd1a24e70faa">
  <source>Create Endpoint</source>
 </trans-unit>
-<trans-unit id="s4770c10e5b1c028c">
-  <source>RAC is in preview.</source>
-</trans-unit>
 <trans-unit id="s168565f5ac74a89f">
  <source>Update RAC Provider</source>
 </trans-unit>
@ -8814,6 +8807,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 </trans-unit>
 <trans-unit id="s2e1d5a7d320c25ef">
  <source>Enter the code from your authenticator device.</source>
+</trans-unit>
+<trans-unit id="scc1a17d28912e974">
+  <source>Kerberos Source is in preview.</source>
+</trans-unit>
+<trans-unit id="s54154a8d64a3597b">
+  <source>Captcha stage</source>
+</trans-unit>
+<trans-unit id="s0c250af62ddbf801">
+  <source>When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.</source>
+</trans-unit>
+<trans-unit id="sabf8a430d504f8c8">
+  <source>Endpoint Google Chrome Device Trust is in preview.</source>
 </trans-unit>
    </body>
  </file>
--- a/website/docs/add-secure-apps/applications/manage_apps.md
+++ b/website/docs/add-secure-apps/applications/manage_apps.md
@ -26,7 +26,7 @@ To add an application to authentik and have it display on users' **My applicatio

 ## Authorization

-Application access can be configured using (Policy) Bindings. Click on an application in the applications list, and select the _Policy / Group / User Bindings_ tab. There you can bind users/groups/policies to grant them access. When nothing is bound, everyone has access. You can use this to grant access to one or multiple users/groups, or dynamically give access using policies.
+Application access can be configured using (Policy) bindings. Click on an application in the applications list, and select the _Policy / Group / User Bindings_ tab. There you can bind users/groups/policies to grant them access. When nothing is bound, everyone has access. You can use this to grant access to one or multiple users/groups, or dynamically give access using policies.

 By default, all users can access applications when no policies are bound.

--- a/website/docs/add-secure-apps/flows-stages/flow/context/index.md
+++ b/website/docs/add-secure-apps/flows-stages/flow/context/index.md
@ -112,7 +112,7 @@ An optional list of all permissions that will be given to the application by gra

 #### Deny stage

-##### `deny_message` (string) <span class="badge badge--version">authentik 2023.10+</span>
+##### `deny_message` (string) <span class="badge badge--version">authentik 2023.10+</span>

 Optionally overwrite the deny message shown, has a higher priority than the message configured in the stage.

@ -128,7 +128,7 @@ If set, this must be a list of group objects and not group names.

 Path the `pending_user` will be written to. If not set in the flow, falls back to the value set in the user_write stage, and otherwise to the `users` path.

-##### `user_type` (string) <span class="badge badge--version">authentik 2023.10+</span>
+##### `user_type` (string) <span class="badge badge--version">authentik 2023.10+</span>

 Type the `pending_user` will be created as. Must be one of `internal`, `external` or `service_account`.

--- a/website/docs/add-secure-apps/flows-stages/flow/examples/default_flows.md
+++ b/website/docs/add-secure-apps/flows-stages/flow/examples/default_flows.md
@ -0,0 +1,11 @@
+---
+title: Default flows
+---
+
+When you create a new provider, you can select certain default flows that will be used with the provider and its associated application. For example, you can [create a custom flow](../index.md#create-a-custom-flow) that override the defaults configured on the brand.
+
+If no default flow is selected when the provider is created, to determine which flow should be used authentik will first check if there is a default flow configured in the active [**Brand**](../../../../customize/brands.md). If no default is configured there, authentik will go through all flows with the matching designation, sorted by `slug` and evaluate policies bound directly to the flows, and the first flow whose policies allow access will be picked.
+
+import DefaultFlowList from "../../flow/flow_list/\_defaultflowlist.mdx";
+
+<DefaultFlowList />
--- a/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md
+++ b/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md
@ -1,5 +1,5 @@
 ---
-title: Example Flows
+title: Example flows
 ---

 :::info
--- a/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md
+++ b/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md
@ -7,3 +7,27 @@ This is the default, web-based environment that flows are executed in. All stage
 :::info
 All flow executors use the same [API](../../../../developer-docs/api/flow-executor.md), which allows for the implementation of custom flow executors.
 :::
+
+## Layouts
+
+Starting with authentik 2022.5, the layout of the default flow executor can be changed. Below are examples for the available options:
+
+### Stacked (default)
+
+![](../layouts/stacked.png)
+
+### Content besides logo (left)
+
+![](../layouts/content_left.png)
+
+### Content besides logo (right)
+
+![](../layouts/content_right.png)
+
+### Sidebar (left)
+
+![](../layouts/sidebar_left.png)
+
+### Sidebar (right)
+
+![](../layouts/sidebar_right.png)
--- a/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx
+++ b/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx
@ -0,0 +1,13 @@
+-   **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.md) stage, which attaches the staged user to the current session.
+
+-   **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required.
+
+-   **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one.
+
+-   **Invalidation**: designates a default flow to be used to invalidate a session. Use `default-invalidation-flow` for invalidation from authentik itself, or use `default-provider-invalidation-flow` to invalidate when the session of an application ends. When you use the `default-invalidation-flow` as a global invalidation flow, it should contain a [**User Logout**](../../stages/user_logout.md) stage. When you use the `default-provider-invalidation-flow` (supported with OIDC, SAML, Proxy, and RAC providers), you can configure this default flow to present users log-off options such as "log out of the app but remain logged in to authentik" or "return to the **My Applications** page", or "log out completely". (Alternatively, you can create a custom invalidation flow, with a branded background image.)
+
+-   **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.md). Afterwards, use the [**Prompt**](../../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../../stages/user_write.md) stage to update the password.
+
+-   **Stage configuration**: designates a flow for general setup. This designation doesn't have any constraints in what you can do. For example, by default this designation is used to configure authenticators, like change a password and set up TOTP.
+
+-   **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../../stages/user_delete.md) stage.
--- a/website/docs/add-secure-apps/flows-stages/flow/index.md
+++ b/website/docs/add-secure-apps/flows-stages/flow/index.md
@ -4,11 +4,11 @@ title: Flows

 Flows are a major component in authentik. In conjunction with stages and [policies](../../../customize/policies/index.md), flows are at the heart of our system of building blocks, used to define and execute the workflows of authentication, authorization, enrollment, and user settings.

-There are over a dozen default, out-of-the box flows available in authentik. Users can decide if they already have everything they need with the default flows or if they want to [create](#create-a-custom-flow) their own custom flow, using the Admin interface.
+There are over a dozen default, out-of-the box flows available in authentik. Users can decide if they already have everything they need with the [default flows](../flow/examples/default_flows.md) or if they want to [create](#create-a-custom-flow) their own custom flow, using the Admin interface, Terraform, or via the API.

 A flow is a method of describing a sequence of stages. A stage represents a single verification or logic step. By connecting a series of stages within a flow (and optionally attaching policies as needed) you can build a highly flexible process for authenticating users, enrolling them, and more.

-For example, a standard login flow would consist of the following stages:
+For example a standard login flow would consist of the following stages:

 -   **Identification stage**: user identifies themselves via a username or email address
 -   **Password stage**: the user's password is checked against the hash in the database
@ -22,8 +22,6 @@ By default, policies are evaluated dynamically, right before the stage (to which

 This default behaviour can be altered by enabling the **Evaluate when flow is planned** option on the stage binding. With this setting a _flow plan_ containing all stages is generated upon flow execution. This means that all attached policies are evaluated upon execution. For more information about flow plans, read our [flow context documentation](./context/index.md).

-To determine which flow should be used, authentik will first check which default authentication flow is configured in the active [**Brand**](../../../customize/brands.md). If no default is configured there, the policies in all flows with the matching designation are checked, and the first flow with matching policies sorted by `slug` will be used.
-
 ## Permissions

 Flows can have [policies](../stages/index.md) assigned to them. These policies determine if the current user is allowed to see and use this flow.
@ -64,19 +62,9 @@ When creating or editing a flow in the UI of the Admin interface, you can set th

 **Designation**: Flows are designated for a single purpose. This designation changes when a flow is used. The following designations are available:

-   **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../stages/user_login/index.md) stage, which attaches the staged user to the current session.
+import Defaultflowlist from "../flow/flow_list/\_defaultflowlist.mdx";

-   **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application.
-
-   **Invalidation**: designates a flow to be used to invalidate a session. Both used to invalidate a session from authentik and when the session of an application ends. When used as a global invalidation flow should contain a [**User Logout**](../stages/user_logout.md) stage.
-
-   **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../stages/email/index.mdx) or [**Captcha**](../stages/captcha/index.md). At the end, to create the user, you can use the [**User Write**](../stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one.
-
-   **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../stages/email/index.mdx) or [**Captcha**](../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../stages/user_delete.md) stage.
-
-   **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../stages/email/index.mdx) or [**captcha**](../stages/captcha/index.md). Afterwards, use the [**Prompt**](../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../stages/user_write.md) stage to update the password.
-
-   **Stage configuration**: designates a flow for general setup. This designation doesn't have any constraints in what you can do. For example, by default this designation is used to configure authenticators, like change a password and setup TOTP.
+<Defaultflowlist />

 **Authentication**: Using this option, you can configure whether the the flow requires initial authentication or not, whether the user must be a superuser, or if the flow requires an outpost.

--- a/website/docs/add-secure-apps/flows-stages/flow/layouts.md
+++ b/website/docs/add-secure-apps/flows-stages/flow/layouts.md
@ -1,25 +0,0 @@
---
-title: Layouts
---
-
-Starting with authentik 2022.5, the layout of the default flow executor can be changed. Below are examples for the available options:
-
-### Stacked (default)
-
-![](./layouts/stacked.png)
-
-### Content besides logo (left)
-
-![](./layouts/content_left.png)
-
-### Content besides logo (right)
-
-![](./layouts/content_right.png)
-
-### Sidebar (left)
-
-![](./layouts/sidebar_left.png)
-
-### Sidebar (right)
-
-![](./layouts/sidebar_right.png)
--- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md
+++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md
@ -10,7 +10,7 @@ Copy all of the integration key, secret key and API hostname, and paste them in

 Devices created reference the stage they were created with, since the API credentials are needed to authenticate. This also means when the stage is deleted, all devices are removed.

-## Importing users <span class="badge badge--version">authentik 2022.9+</span>
+## Importing users <span class="badge badge--version">authentik 2022.9+</span>

 :::info
 Due to the way the Duo API works, authentik can only automatically import existing Duo users when a Duo MFA or higher license is active.
@ -20,7 +20,7 @@ To import a device, open the Stages list in the authentik Admin interface. On th

 The Duo username can be found by navigating to your Duo Admin dashboard and selecting _Users_ in the sidebar. Optionally if you have multiple users with the same username, you can click on a User and copy their ID from the URL, and use that to import the device.

-### Older versions <span class="badge badge--version">authentik 2021.9.1+</span>
+### Older versions <span class="badge badge--version">authentik 2021.9.1+</span>

 You can call the `/api/v3/stages/authenticator/duo/{stage_uuid}/import_devices/` endpoint ([see here](https://goauthentik.io/api/#post-/stages/authenticator/duo/-stage_uuid-/import_devices/)) using the following parameters:

--- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.md
+++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.md
@ -3,6 +3,7 @@ title: Endpoint Authenticator Google Device Trust Connector Stage
 ---

 <span class="badge badge--primary">Enterprise</span>
+<span class="badge badge--preview">Preview</span>
 <span class="badge badge--version">authentik 2024.10+</span>

 ---
--- a/website/docs/add-secure-apps/providers/entra/add-entra-provider.md
+++ b/website/docs/add-secure-apps/providers/entra/add-entra-provider.md
@ -3,15 +3,12 @@ title: Add an Entra ID provider
 ---

 <span class="badge badge--primary">Enterprise</span>
+<span class="badge badge--preview">Preview</span>

 ---

 For more information about using an Entra ID provider, see the [Overview](./index.md) documentation.

-:::info
-This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
-:::
-
 ## Prerequisites

 To create an Entra ID provider provider in authentik, you must have already [configured Entra ID](./setup-entra.md) to integrate with authentik. You will need to obtain from Entra three values: the Application (client) ID, the Directory (tenant) ID, and the Client secret. When adding an Entra ID provider in authentik, you must provide these values.
--- a/website/docs/add-secure-apps/providers/entra/index.md
+++ b/website/docs/add-secure-apps/providers/entra/index.md
@ -3,13 +3,10 @@ title: Microsoft Entra ID provider
 ---

 <span class="badge badge--primary">Enterprise</span>
+<span class="badge badge--preview">Preview</span>

 ---

-:::info
-This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
-:::
-
 With the Microsoft Entra ID provider, authentik serves as the single source of truth for all users and groups. Configuring Entra ID as a provider allows for auto-discovery of user and group accounts, on-going synchronization of user data such as email address, name, and status, and integrated data mapping of field names and values.

 -   For instructions to configure your Entra ID tenant to integrate with authentik, refer to [Configure Entra ID](./setup-entra.md).
--- a/website/docs/add-secure-apps/providers/gws/add-gws-provider.md
+++ b/website/docs/add-secure-apps/providers/gws/add-gws-provider.md
@ -3,13 +3,10 @@ title: Create a Google Workspace provider
 ---

 <span class="badge badge--primary">Enterprise</span>
+<span class="badge badge--preview">Preview</span>

 ---

-:::info
-This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
-:::
-
 For more information about using a Google Workspace provider, see the [Overview](./index.md) documentation.

 ## Prerequisites
--- a/website/docs/add-secure-apps/providers/gws/index.md
+++ b/website/docs/add-secure-apps/providers/gws/index.md
@ -3,13 +3,10 @@ title: Google Workspace provider
 ---

 <span class="badge badge--primary">Enterprise</span>
+<span class="badge badge--preview">Preview</span>

 ---

-:::info
-This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
-:::
-
 With the Google Workspace provider, authentik serves as the single source of truth for all users and groups, when using Google products like Gmail.

 -   For instructions to configure your Google Workspace to integrate with authentik, refer to [Configure Google Workspace](./setup-gws.md).
--- a/website/docs/add-secure-apps/providers/index.mdx
+++ b/website/docs/add-secure-apps/providers/index.mdx
@ -13,7 +13,9 @@ Applications can use additional providers to augment the functionality of the ma

 You can create a new provider in the Admin interface, or you can use the [Application wizard](../applications/manage_apps.md#instructions) to create a new application and its provider at the same time.

-Refer to the documentation for each provider:
+When you create certain types of providers, you need to select specific [flows](../flows-stages/flow/index.md) to apply to users who access authentik via the provider. To learn more, refer to our [default flow documentation](../flows-stages/flow/examples/default_flows.md).
+
+To learn more about each provider type, refer to the documentation for each provider:

 <DocCardList />

--- a/website/docs/add-secure-apps/providers/proxy/server_caddy.mdx
+++ b/website/docs/add-secure-apps/providers/proxy/server_caddy.mdx
@ -1,7 +1,12 @@
+---
+title: Caddy
+hide_title: true
+---
+
 import Tabs from "@theme/Tabs";
 import TabItem from "@theme/TabItem";

-# Caddy <span class="badge badge--version">authentik 2022.8+</span>
+# Caddy <span class="badge badge--version">authentik 2022.8+</span>

 The configuration template shown below apply to both single-application and domain-level forward auth.

--- a/website/docs/add-secure-apps/providers/proxy/server_envoy.mdx
+++ b/website/docs/add-secure-apps/providers/proxy/server_envoy.mdx
@ -1,7 +1,12 @@
+---
+title: Envoy
+hide_title: true
+---
+
 import Tabs from "@theme/Tabs";
 import TabItem from "@theme/TabItem";

-# Envoy <span class="badge badge--version">authentik 2022.6+</span>
+# Envoy <span class="badge badge--version">authentik 2022.6+</span>

 The configuration template shown below apply to both single-application and domain-level forward auth.

--- a/website/docs/add-secure-apps/providers/rac/how-to-rac.md
+++ b/website/docs/add-secure-apps/providers/rac/how-to-rac.md
@ -2,17 +2,13 @@
 title: Create a Remote Access Control (RAC) provider
 ---

-:::info
-This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
-:::
-
 The RAC provider is a highly flexible feature for accessing remote machines. This document provides instructions for the basic creation and configuration of a RAC provider within a defined scenario.

 Fow more information about using a RAC provider, see the [Overview](./index.md) documentation. You can also view our video on YouTube for setting up RAC.

 <iframe width="560" height="315" src="https://www.youtube.com/embed/9wahIBRV6Ts;start=22" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>

-## Prereqisites
+## Prerequisites

 The RAC provider requires the deployment of the [RAC Outpost](../../outposts/index.mdx).

--- a/website/docs/add-secure-apps/providers/rac/index.md
+++ b/website/docs/add-secure-apps/providers/rac/index.md
@ -6,10 +6,6 @@ title: Remote Access Control (RAC) Provider

 ---

-:::info
-This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
-:::
-
 :::info
 This provider requires the deployment of the [RAC Outpost](../../outposts/index.mdx).
 :::
--- a/website/docs/customize/blueprints/index.md
+++ b/website/docs/customize/blueprints/index.md
@ -2,7 +2,7 @@
 title: Blueprints
 ---

-<span class="badge badge--version">authentik 2022.8+</span>
+<span class="badge badge--version">authentik 2022.8+</span>

 ---

--- a/website/docs/customize/blueprints/v1/models.md
+++ b/website/docs/customize/blueprints/v1/models.md
@ -26,7 +26,7 @@ For example:

 ## `authentik_core.user`

-### `password` <span class="badge badge--version">authentik 2023.6+</span>
+### `password` <span class="badge badge--version">authentik 2023.6+</span>

 Via the standard API, a user's password can only be set via the separate `/api/v3/core/users/<id>/set_password/` endpoint. In blueprints, the password of a user can be set using the `password` field.

@ -45,7 +45,7 @@ For example:
      password: this-should-be-a-long-value
 ```

-### `permissions` <span class="badge badge--version">authentik 2024.8+</span>
+### `permissions` <span class="badge badge--version">authentik 2024.8+</span>

 The `permissions` field can be used to set global permissions for a user. A full list of possible permissions is included in the JSON schema for blueprints.

@ -63,7 +63,7 @@ For example:

 ## `authentik_core.application`

-### `icon` <span class="badge badge--version">authentik 2023.5+</span>
+### `icon` <span class="badge badge--version">authentik 2023.5+</span>

 Application icons can be directly set to URLs with the `icon` field.

@ -81,7 +81,7 @@ For example:

 ## `authentik_sources_oauth.oauthsource`, `authentik_sources_saml.samlsource`, `authentik_sources_plex.plexsource`

-### `icon` <span class="badge badge--version">authentik 2023.5+</span>
+### `icon` <span class="badge badge--version">authentik 2023.5+</span>

 Source icons can be directly set to URLs with the `icon` field.

@ -99,7 +99,7 @@ For example:

 ## `authentik_flows.flow`

-### `icon` <span class="badge badge--version">authentik 2023.5+</span>
+### `icon` <span class="badge badge--version">authentik 2023.5+</span>

 Flow backgrounds can be directly set to URLs with the `background` field.

@ -119,7 +119,7 @@ For example:

 ## `authentik_rbac.role`

-### `permissions` <span class="badge badge--version">authentik 2024.8+</span>
+### `permissions` <span class="badge badge--version">authentik 2024.8+</span>

 The `permissions` field can be used to set global permissions for a role. A full list of possible permissions is included in the JSON schema for blueprints.

--- a/website/docs/customize/brands.md
+++ b/website/docs/customize/brands.md
@ -9,13 +9,22 @@ The main settings that brands influence are flows and branding.

 ## Flows

-authentik picks a default flow by selecting the flow that is configured in the current brand, otherwise any flow that:
+You can explicitly select, in your instance's Brand settings, the default flow to use for the following configurations:
+
+-   Authentication flow: the flow used to authenticate users. If left empty, the first applicable flow sorted by the slug is used.
+-   Invalidation flow: for typical use cases, select the `default-invalidation-flow` (Logout) flow. This flow logs the user out of authentik when the application session ends (user logs out of the app).
+-   Recovery flow: if set, the user can access an option to recover their login credentials.
+-   Unenrollment flow: if set, users are able to unenroll themselves using this flow. If no flow is set, option is not shown.
+-   User settings flow: if set, users are able to configure details of their profile.
+-   Device code flow: if set, the OAuth Device Code profile can be used, and the selected flow will be used to enter the code.
+
+If a default flow is _not_ set in the brand, then authentik selects any flow that:

    - matches the required designation
    - comes first sorted by slug
    - is allowed by policies

-This means that if you want to select a default flow based on policy, you can leave the brand default empty.
+This means that if you want to select a default flow based on policy, you can leave the brand default empty. To learn more about default flows, refer to our [documentation](../add-secure-apps/flows-stages/flow/examples/default_flows.md).

 ## Branding

--- a/website/docs/expressions/_functions.md
+++ b/website/docs/expressions/_functions.md
@ -29,7 +29,7 @@ user = list_flatten(["foo"])
 # user = "foo"
 ```

-### `ak_call_policy(name: str, **kwargs) -> PolicyResult` <span class="badge badge--version">authentik 2021.12+</span>
+### `ak_call_policy(name: str, **kwargs) -> PolicyResult` <span class="badge badge--version">authentik 2021.12+</span>

 Call another policy with the name _name_. Current request is passed to policy. Key-word arguments
 can be used to modify the request's context.
@ -70,7 +70,7 @@ Example:
 other_user = ak_user_by(username="other_user")
 ```

-### `ak_user_has_authenticator(user: User, device_type: Optional[str] = None) -> bool` <span class="badge badge--version">authentik 2022.9+</span>
+### `ak_user_has_authenticator(user: User, device_type: Optional[str] = None) -> bool` <span class="badge badge--version">authentik 2022.9+</span>

 Check if a user has any authenticator devices. Only fully validated devices are counted.

@ -87,7 +87,7 @@ Example:
 return ak_user_has_authenticator(request.user)
 ```

-### `ak_create_event(action: str, **kwargs) -> None` <span class="badge badge--version">authentik 2022.9+</span>
+### `ak_create_event(action: str, **kwargs) -> None` <span class="badge badge--version">authentik 2022.9+</span>

 Create a new event with the action set to `action`. Any additional key-word parameters will be saved in the event context. Additionally, `context` will be set to the context in which this function is called.

@ -112,7 +112,7 @@ ip_address('192.0.2.1') in ip_network('192.0.2.0/24')
 # evaluates to True
 ```

-## DNS resolution and reverse DNS lookups <span class="badge badge--version">authentik 2023.3+</span>
+## DNS resolution and reverse DNS lookups <span class="badge badge--version">authentik 2023.3+</span>

 To resolve a hostname to a list of IP addresses, use the functions `resolve_dns(hostname)` and `resolve_dns(hostname, ip_version)`.

--- a/website/docs/install-config/automated-install.md
+++ b/website/docs/install-config/automated-install.md
@ -8,11 +8,11 @@ To install authentik automatically (skipping the Out-of-box experience), you can

 Configure the default password for the `akadmin` user. Only read on the first startup. Can be used for any flow executor.

-### `AUTHENTIK_BOOTSTRAP_TOKEN` <span class="badge badge--version">authentik 2021.8+</span>
+### `AUTHENTIK_BOOTSTRAP_TOKEN` <span class="badge badge--version">authentik 2021.8+</span>

 Create a token for the default `akadmin` user. Only read on the first startup. The string you specify for this variable is the token key you can use to authenticate yourself to the API.

-### `AUTHENTIK_BOOTSTRAP_EMAIL` <span class="badge badge--version">authentik 2023.3+</span>
+### `AUTHENTIK_BOOTSTRAP_EMAIL` <span class="badge badge--version">authentik 2023.3+</span>

 Set the email address for the default `akadmin` user.

--- a/website/docs/install-config/configuration/configuration.mdx
+++ b/website/docs/install-config/configuration/configuration.mdx
@ -299,47 +299,47 @@ Disable the inbuilt update-checker. Defaults to `false`.
    -   Kubeconfig
    -   Existence of a docker socket

-### `AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS` <span class="badge badge--version">authentik 2023.1+</span>
+### `AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS` <span class="badge badge--version">authentik 2023.1+</span>

 Timeout in hours for LDAP synchronization tasks.

 Defaults to `2`.

-### `AUTHENTIK_LDAP__PAGE_SIZE` <span class="badge badge--version">authentik 2023.6.1+</span>
+### `AUTHENTIK_LDAP__PAGE_SIZE` <span class="badge badge--version">authentik 2023.6.1+</span>

 Page size for LDAP synchronization. Controls the number of objects created in a single task.

 Defaults to `50`.

-### `AUTHENTIK_LDAP__TLS__CIPHERS` <span class="badge badge--version">authentik 2022.7+</span>
+### `AUTHENTIK_LDAP__TLS__CIPHERS` <span class="badge badge--version">authentik 2022.7+</span>

 Allows configuration of TLS Cliphers for LDAP connections used by LDAP sources. Setting applies to all sources.

 Defaults to `null`.

-### `AUTHENTIK_REPUTATION__EXPIRY` <span class="badge badge--version">authentik 2023.8.2+</span>
+### `AUTHENTIK_REPUTATION__EXPIRY` <span class="badge badge--version">authentik 2023.8.2+</span>

 Configure how long reputation scores should be saved for in seconds. Note that this is different than [`AUTHENTIK_REDIS__CACHE_TIMEOUT_REPUTATION`](#redis-settings), as reputation is saved to the database every 5 minutes.

 Defaults to `86400`.

-### `AUTHENTIK_SESSION_STORAGE` <span class="badge badge--version">authentik 2024.4+</span>
+### `AUTHENTIK_SESSION_STORAGE` <span class="badge badge--version">authentik 2024.4+</span>

 Configure if the sessions are stored in the cache or the database. Defaults to `cache`. Allowed values are `cache` and `db`. Note that changing this value will invalidate all previous sessions.

-### `AUTHENTIK_WEB__WORKERS` <span class="badge badge--version">authentik 2022.9+</span>
+### `AUTHENTIK_WEB__WORKERS` <span class="badge badge--version">authentik 2022.9+</span>

 Configure how many gunicorn worker processes should be started (see https://docs.gunicorn.org/en/stable/design.html).

 Defaults to 2. A value below 2 workers is not recommended. In environments where scaling with multiple replicas of the authentik server is not possible, this number can be increased to handle higher loads.

-### `AUTHENTIK_WEB__THREADS` <span class="badge badge--version">authentik 2022.9+</span>
+### `AUTHENTIK_WEB__THREADS` <span class="badge badge--version">authentik 2022.9+</span>

 Configure how many gunicorn threads a worker processes should have (see https://docs.gunicorn.org/en/stable/design.html).

 Defaults to 4.

-### `AUTHENTIK_WORKER__CONCURRENCY` <span class="badge badge--version">authentik 2023.9+</span>
+### `AUTHENTIK_WORKER__CONCURRENCY` <span class="badge badge--version">authentik 2023.9+</span>

 Configure Celery worker concurrency for authentik worker (see https://docs.celeryq.dev/en/latest/userguide/configuration.html#worker-concurrency). This essentially defines the number of worker processes spawned for a single worker.

--- a/website/docs/releases/2024/v2024.10.md
+++ b/website/docs/releases/2024/v2024.10.md
--- a/website/docs/releases/2024/v2024.8.md
+++ b/website/docs/releases/2024/v2024.8.md
@ -286,6 +286,20 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.8
 -   web: Fix missing integrity fields in package-lock.json (#11509)
 -   web/admin: fix Authentication flow being required (cherry-pick #11496) (#11497)

+## Fixed in 2024.8.4
+
+-   blueprints: fix validation error when using internal storage (cherry-pick #11654) (#11656)
+-   core: fix permission check for scoped impersonation (cherry-pick #11603) (#11650)
+-   internal: restore /ping behaviour for embedded outpost (cherry-pick #11568) (#11570)
+-   policies/event_matcher: fix inconsistent behaviour (cherry-pick #11724) (#11726)
+-   providers/oauth2: don't overwrite attributes when updating service account (cherry-pick #11709) (#11723)
+-   providers/saml: fix incorrect ds:Reference URI (cherry-pick #11699) (#11701)
+-   providers/scim: add comparison with existing group on update and delta update users (cherry-pick #11414) (#11796)
+-   providers/scim: clamp batch size for patch requests (cherry-pick #11797) (#11802)
+-   providers/scim: handle no members in group in consistency check (cherry-pick #11801) (#11812)
+-   web/admin: fix invalid create date shown for MFA registered before date was saved (cherry-pick #11728) (#11729)
+-   web/admin: fix sync single button throwing error (cherry-pick #11727) (#11730)
+
 ## API Changes

 #### What's New
--- a/website/docs/users-sources/sources/protocols/kerberos/index.md
+++ b/website/docs/users-sources/sources/protocols/kerberos/index.md
@ -2,6 +2,11 @@
 title: Kerberos
 ---

+<span class="badge badge--preview">Preview</span>
+<span class="badge badge--version">authentik 2024.10+</span>
+
+---
+
 This source allows users to enroll themselves with an existing Kerberos identity.

 ## Preparation
--- a/website/docs/users-sources/sources/protocols/scim/index.md
+++ b/website/docs/users-sources/sources/protocols/scim/index.md
@ -2,9 +2,9 @@
 title: SCIM Source
 ---

-:::info
-This feature is in technical preview, so please report any bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
-:::
+<span class="badge badge--preview">Preview</span>
+
+---

 The SCIM source allows other applications to directly create users and groups within authentik. SCIM provides predefined schema for users and groups, with a RESTful API, to enable automatic user provisioning and deprovisioning, SCIM is supported by applications such as Microsoft Entra ID, Google Workspace, and Okta.

--- a/website/docs/users-sources/sources/social-logins/github/index.md
+++ b/website/docs/users-sources/sources/social-logins/github/index.md
@ -20,8 +20,8 @@ The following placeholders will be used:
 ![Register OAuth App](./githubdeveloper1.png)

 2. **Application Name:** Choose a name users will recognize ie: authentik
-3. **Homepage URL**:: www.my.company
-4. **Authorization callback URL**: https://authentik.company/source/oauth/callback/github
+3. **Homepage URL:** www.my.company
+4. **Authorization callback URL:**: https://authentik.company/source/oauth/callback/github
 5. Click **Register Application**

 Example screenshot
@ -35,8 +35,8 @@ Example screenshot

 8. Under _Directory -> Federation & Social login_ Click **Create Github OAuth Source**

-9. **Name**: Choose a name (For the example I use Github)
-10. **Slug**: github (If you choose a different slug the URLs will need to be updated to reflect the change)
+9. **Name:** Choose a name (For the example I use Github)
+10. **Slug:** github (If you choose a different slug the URLs will need to be updated to reflect the change)
 11. **Consumer Key:** Client ID from step 6
 12. **Consumer Secret:** Client Secret from step 7

--- a/website/netlify.toml
+++ b/website/netlify.toml
@ -62,7 +62,10 @@
  to = "/docs/providers/property-mappings/expression"
  status = 302

-
+[[redirects]]
+  from = "/docs/add-secure-apps/flows-stages/flow/layouts.md"
+  to = "/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md"
+  status = 302



@ -675,8 +678,8 @@
  force = true

 [[redirects]]
-  from = "/docs/providers/radius/x"
-  to = "/docs/add-secure-apps/providers/radius/x"
+  from = "/docs/providers/radius/"
+  to = "/docs/add-secure-apps/providers/radius/"
  status = 302
  force = true

--- a/website/package-lock.json
+++ b/website/package-lock.json
@ -8895,9 +8895,9 @@
            "integrity": "sha512-f/ZeWvW/BCXbhGEf1Ujp29EASo/lk1FDnETgNKwJrsVvGZhUWCZyg3xLJjAsxfOmt8KjswHmI5EwCQcPMpOYhQ=="
        },
        "node_modules/elliptic": {
-            "version": "6.5.7",
-            "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.5.7.tgz",
-            "integrity": "sha512-ESVCtTwiA+XhY3wyh24QqRGBoP3rEdDUl3EDUUo9tft074fi19IrdpH7hLCMMP3CIj7jb3W96rn8lt/BqIlt5Q==",
+            "version": "6.6.0",
+            "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.6.0.tgz",
+            "integrity": "sha512-dpwoQcLc/2WLQvJvLRHKZ+f9FgOdjnq11rurqwekGQygGPsYSK29OMMD2WalatiqQ+XGFDglTNixpPfI+lpaAA==",
            "dependencies": {
                "bn.js": "^4.11.9",
                "brorand": "^1.1.0",
--- a/website/sidebars.js
+++ b/website/sidebars.js
@ -2,13 +2,14 @@ import { generateVersionDropdown } from "./src/utils.js";
 import apiReference from "./docs/developer-docs/api/reference/sidebar";

 const releases = [
+    "releases/2024/v2024.10",
    "releases/2024/v2024.8",
    "releases/2024/v2024.6",
-    "releases/2024/v2024.4",
    {
        type: "category",
        label: "Previous versions",
        items: [
+            "releases/2024/v2024.4",
            "releases/2024/v2024.2",
            "releases/2023/v2023.10",
            "releases/2023/v2023.8",
@ -250,14 +251,14 @@ export default {
                                id: "add-secure-apps/flows-stages/flow/index",
                            },
                            items: [
-                                "add-secure-apps/flows-stages/flow/layouts",
                                "add-secure-apps/flows-stages/flow/inspector",
                                "add-secure-apps/flows-stages/flow/context/index",
                                {
                                    type: "category",
-                                    label: "Examples",
+                                    label: "Defaults and Examples",
                                    items: [
                                        "add-secure-apps/flows-stages/flow/examples/flows",
+                                        "add-secure-apps/flows-stages/flow/examples/default_flows",
                                        "add-secure-apps/flows-stages/flow/examples/snippets",
                                    ],
                                },
--- a/website/src/css/custom.css
+++ b/website/src/css/custom.css
@ -125,3 +125,11 @@ body {
    font-size: 0.75rem;
    vertical-align: middle;
 }
+
+.badge--preview {
+    --ifm-badge-background-color: rgb(115, 188, 247);
+    color: var(--ifm-color-primary-contrast-foreground);
+    --ifm-badge-border-color: var(--ifm-badge-background-color);
+    font-size: 0.75rem;
+    vertical-align: middle;
+}