3996bdac33
* website: Bump prettier from 3.3.3 to 3.4.1 in /website Bumps [prettier](https://github.com/prettier/prettier) from 3.3.3 to 3.4.1. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.3.3...3.4.1) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * update formatting Signed-off-by: Jens Langhammer <jens@goauthentik.io> * sigh Signed-off-by: Jens Langhammer <jens@goauthentik.io> * disable flaky test Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io>
332 lines
12 KiB
Markdown
332 lines
12 KiB
Markdown
---
|
|
title: Release 2022.12
|
|
slug: "/releases/2022.12"
|
|
---
|
|
|
|
## Breaking changes
|
|
|
|
- Blueprints fetched via OCI require oci:// schema
|
|
|
|
To better detect if a blueprint should be fetched locally or via OCI, all OCI sourced blueprints require an `oci://` protocol.
|
|
|
|
## New features
|
|
|
|
- Bundled GeoIP City database
|
|
|
|
authentik now comes with a bundled MaxMind GeoLite2 City database. This allows everyone to take advantage of the extra data provided by GeoIP. The default docker-compose file removes the GeoIP update container as it is no longer needed. See more [here](../../sys-mgmt/ops/geoip.mdx).
|
|
|
|
- Improved UX for user & group management and stage/policy binding
|
|
|
|
Users can now more easily be added to and removed from groups, both when viewing a single user and viewing a group.
|
|
|
|
When creating new stages or policies, authentik will now automatically offer an option to bind them to the object in whose context they were created in.
|
|
|
|
Select inputs were previously limited to showing a single page of items (default size of 100 items). These inputs have been replaced by dynamically loading inputs which support searching and better show the properties of the item.
|
|
|
|
- Preview for OAuth2 and SAML providers
|
|
|
|
OAuth2 and SAML providers can now preview what the currently selected property/scope mappings's outcome will look like. This helps with seeing what data is sent to the client and implementing and testing custom mappings.
|
|
|
|
- Customisable Captcha stage
|
|
|
|
The captcha stage now supports alternate compatible providers, like [hCaptcha](https://docs.hcaptcha.com/switch/) and [Turnstile](https://developers.cloudflare.com/turnstile/get-started/migrating-from-recaptcha/).
|
|
|
|
## Upgrading
|
|
|
|
This release does not introduce any new requirements.
|
|
|
|
### docker-compose
|
|
|
|
Download the docker-compose file for 2022.12 from [here](https://goauthentik.io/version/2022.12/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.
|
|
|
|
### Kubernetes
|
|
|
|
Update your values to use the new images:
|
|
|
|
```yaml
|
|
image:
|
|
repository: ghcr.io/goauthentik/server
|
|
tag: 2022.12.0
|
|
```
|
|
|
|
## Minor changes/fixes
|
|
|
|
- blueprints: add !Env tag
|
|
- blueprints: add `!If` tag (#4264)
|
|
- blueprints: add conditions to blueprint schema
|
|
- blueprints: Added conditional entry application (#4167)
|
|
- blueprints: better OCI support in UI (#4263)
|
|
- blueprints: fixed bug causing filtering with an empty query (#4106)
|
|
- blueprints: Support nested custom tags in `!Find` and `!Format` tags (#4127)
|
|
- core: add endpoints to add/remove users from group atomically
|
|
- core: bundle geoip (#4250)
|
|
- events: fix incorrect EventAction being used
|
|
- events: improve handling creation of events with non-pickleable objects
|
|
- events: remove legacy logger declaration
|
|
- events: save login event in session after login
|
|
- flows: fix redirect from plan context "redirect" not being wrapped in flow response
|
|
- flows: set stage name and verbose_name for in_memory stages
|
|
- internal: dont error if environment config isn't found
|
|
- internal: remove sentry proxy
|
|
- internal: reuse http transport to prevent leaking connections (#3996)
|
|
- lib: enable sentry profiles_sample_rate
|
|
- lib: fix uploaded files not being saved correctly, add tests
|
|
- lifecycle: don't set user/group in gunicorn
|
|
- lifecycle: improve explanation for user: root and docket socket mount
|
|
- policies: don't log context when policy returns None
|
|
- policies: log correct cache state
|
|
- policies: make name required
|
|
- policies/password: Always add generic message to failing zxcvbn check (#4100)
|
|
- providers: add preview for mappings (#4254)
|
|
- providers/ldap: improve mapping of LDAP filters to authentik queries
|
|
- providers/oauth2: optimise and cache signing key, prevent key being loaded multiple times
|
|
- providers/oauth2: set amr values based on login event
|
|
- providers/proxy: correctly set id_token_hint if possible
|
|
- providers/saml: set AuthnContextClassRef based on login event
|
|
- root: allow custom settings via python module
|
|
- root: migrate to hosted sentry with rate-limited DSN
|
|
- security: fix CVE 2022 23555 (#4274)
|
|
- security: fix CVE 2022 46145 (#4140)
|
|
- security: fix CVE 2022 46172 (#4275)
|
|
- stages/authenticator_duo: fix imported duo devices not being confirmed
|
|
- stages/authenticator_validate: fix validation to ensure configuration stage is set
|
|
- stages/authenticator_validate: improve validation for not_configured_action
|
|
- stages/authenticator_validate: log duo error
|
|
- stages/authenticator_validate: save used mfa devices in login event
|
|
- stages/captcha: customisable URLs (#3832)
|
|
- stages/invitation: fix incorrect pk check for invitation's flow
|
|
- stages/user_login: prevent double success message when logging in via source
|
|
- stages/user_write: always ignore `component` field and prevent warning
|
|
- web: fix authentication with Plex on iOS (#4095)
|
|
- web: ignore d3 circular deps warning, treat unresolved import as error
|
|
- web: use version family subdomain for in-app doc links
|
|
- web/admin: better show metadata download for saml provider
|
|
- web/admin: break all in code blocks in event info
|
|
- web/admin: clarify phrasing that user ID is required
|
|
- web/admin: fix action button order for blueprints
|
|
- web/admin: fix alignment in tables with multiple elements in cell
|
|
- web/admin: fix empty request being sent due to multiple forms in duo import modal
|
|
- web/admin: improve i18n for documentation link in outpost form
|
|
- web/admin: improve UI for removing users from groups and groups from users
|
|
- web/admin: improve user/group UX for adding/removing users to and from groups
|
|
- web/admin: more consistent label usage, use compact labels
|
|
- web/admin: rework markdown, correctly render Admonitions, fix links
|
|
- web/admin: show bound policies order first to match stages
|
|
- web/admin: show policy binding form when creating policy in bound list
|
|
- web/admin: show stage binding form when creating stage in bound list
|
|
- web/elements: fix alignment for checkboxes in table
|
|
- web/elements: fix alignment with checkbox in table
|
|
- web/elements: fix log level for diagram
|
|
- web/elements: fix table select-all checkbox being checked with no elements
|
|
- web/elements: fix wizard form page changing state before being active
|
|
- web/elements: unselect top checkbox in table when not all elements are selected
|
|
- web/flows: fix display for long redirect URLs
|
|
- web/flows: improve error messages for failed duo push
|
|
- web/flows: update flow background
|
|
- web/user: fix styling for clear all button in notification drawer
|
|
|
|
## Fixed in 2022.12.1
|
|
|
|
- api: add filter backend for secret key to allow access to tenants and certificates
|
|
- blueprints: fix error when entry with state absent doesn't exist
|
|
- blueprints: Resolve yamltags in state and model attributes (#4299)
|
|
- outposts: include hostname in outpost heartbeat
|
|
- outposts/ldap: only use common cert if cert is configured
|
|
- outposts/ldap: use configured certificate for LDAPS when all providers' certificates are identical
|
|
- web/admin: migrate selection to ak-search-select
|
|
- web/admin: rework outpost health
|
|
- web/elements: add grouping and descriptions to search select
|
|
- web/elements: make ak-search-select limited in height and scroll
|
|
- web/elements: render ak-seach-select dropdown correctly in modals
|
|
- web/user: fix user settings stuck loading
|
|
|
|
## Fixed in 2022.12.2
|
|
|
|
- admin: use matching environment for system API
|
|
- crypto: fix type for has_key
|
|
- providers/oauth2: fix null amr value not being removed from id_token
|
|
- providers/saml: don't error if no request in API serializer context
|
|
- stages/captcha: fix captcha not loading correctly, add tests
|
|
- stages/dummy: add toggle to throw error for debugging
|
|
- stages/email: make template tests less flaky
|
|
- stages/email: use pending user correctly
|
|
- stages/prompt: use stage.get_pending_user() to fallback to the correct user
|
|
- web: add check compile test to prevent compile errors/warnings
|
|
- web: ensure locales are built for tsc check
|
|
- web: update tsconfig strictness
|
|
- web/admin: add Radio control, search-select fixes (#4333)
|
|
- web/admin: fix error in outpost form dropdown
|
|
- web/admin: fix error when creating SAML Provider from metadata
|
|
- web/elements: correctly display selected empty option when blankable is enabled
|
|
- web/elements: fix dropdown menu closing before selecting item sometimes
|
|
- web/elements: fix selection of blank elements in search-select, fix issue when re-opening dropdown
|
|
- web/elements: tabs: only find pages for directly related slots
|
|
- web/elements: trigger search select data update on connected callback
|
|
- web/flows: add close button to flow inspector
|
|
- web/flows: fix alternate captchas not loading
|
|
- web/flows: rework error display, always use ak-stage-flow-error instead of shell
|
|
|
|
## Fixed in 2022.12.3
|
|
|
|
- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9)
|
|
|
|
## API Changes
|
|
|
|
#### What's Changed
|
|
|
|
---
|
|
|
|
##### `GET` /stages/captcha/{stage_uuid}/
|
|
|
|
###### Return Type:
|
|
|
|
Changed response : **200 OK**
|
|
|
|
- Changed content type : `application/json`
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
> Public key, acquired your captcha Provider.
|
|
|
|
##### `PUT` /stages/captcha/{stage_uuid}/
|
|
|
|
###### Request:
|
|
|
|
Changed content type : `application/json`
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
|
|
> Public key, acquired your captcha Provider.
|
|
|
|
- Changed property `private_key` (string)
|
|
> Private key, acquired your captcha Provider.
|
|
|
|
###### Return Type:
|
|
|
|
Changed response : **200 OK**
|
|
|
|
- Changed content type : `application/json`
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
> Public key, acquired your captcha Provider.
|
|
|
|
##### `PATCH` /stages/captcha/{stage_uuid}/
|
|
|
|
###### Request:
|
|
|
|
Changed content type : `application/json`
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
|
|
> Public key, acquired your captcha Provider.
|
|
|
|
- Changed property `private_key` (string)
|
|
> Private key, acquired your captcha Provider.
|
|
|
|
###### Return Type:
|
|
|
|
Changed response : **200 OK**
|
|
|
|
- Changed content type : `application/json`
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
> Public key, acquired your captcha Provider.
|
|
|
|
##### `GET` /flows/executor/{flow_slug}/
|
|
|
|
###### Return Type:
|
|
|
|
Changed response : **200 OK**
|
|
|
|
- Changed content type : `application/json`
|
|
|
|
Updated `ak-stage-captcha` component:
|
|
New required properties:
|
|
|
|
- `js_url`
|
|
|
|
* Added property `js_url` (string)
|
|
|
|
##### `POST` /flows/executor/{flow_slug}/
|
|
|
|
###### Return Type:
|
|
|
|
Changed response : **200 OK**
|
|
|
|
- Changed content type : `application/json`
|
|
|
|
Updated `ak-stage-captcha` component:
|
|
New required properties:
|
|
|
|
- `js_url`
|
|
|
|
* Added property `js_url` (string)
|
|
|
|
##### `POST` /stages/captcha/
|
|
|
|
###### Request:
|
|
|
|
Changed content type : `application/json`
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
|
|
> Public key, acquired your captcha Provider.
|
|
|
|
- Changed property `private_key` (string)
|
|
> Private key, acquired your captcha Provider.
|
|
|
|
###### Return Type:
|
|
|
|
Changed response : **201 Created**
|
|
|
|
- Changed content type : `application/json`
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
> Public key, acquired your captcha Provider.
|
|
|
|
##### `GET` /stages/captcha/
|
|
|
|
###### Return Type:
|
|
|
|
Changed response : **200 OK**
|
|
|
|
- Changed content type : `application/json`
|
|
|
|
- Changed property `results` (array)
|
|
|
|
Changed items (object): > CaptchaStage Serializer
|
|
|
|
- Added property `js_url` (string)
|
|
|
|
- Added property `api_url` (string)
|
|
|
|
- Changed property `public_key` (string)
|
|
> Public key, acquired your captcha Provider.
|