habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
bc2113a935363e3ed43f346af7b41eaa65027dc6
authentik/website/docs/policies/expression.md
Jens L 7be680cbe5 Migrate to Docusaurus (#329) 
* docs: initial migration to docusaurus

* website: add custom font, update blurbs and icons

* website: update splash

* root: update links to docs

* flows: use .pbflow extension so docusaurus doesn't mangle the files

* e2e: workaround prospector

* Squashed commit of the following:

commit 1248585dca
Author: Jens Langhammer <jens.langhammer@beryju.org>
Date:   Sun Nov 15 20:46:53 2020 +0100

    e2e: attempt to fix prospector error again

commit 1319c480c4
Author: Jens Langhammer <jens.langhammer@beryju.org>
Date:   Sun Nov 15 20:41:35 2020 +0100

    ci: install previous python version for upgrade testing

* web: update accent colours and format

* website: format markdown files

* website: fix colours for text

* website: switch to temporary accent colour to improve readability

* flows: fix path for TestTransferDocs

* flows: fix formatting of tests
2020-11-15 22:42:02 +01:00

1.8 KiB
Raw Blame History

title
title
Expression Policies

:::note These variables are available in addition to the common variables/functions defined in Expressions :::

The passing of the policy is determined by the return value of the code. Use return True to pass a policy and return False to fail it.

Available Functions

pb_message(message: str)

Add a message, visible by the end user. This can be used to show the reason why they were denied.

Example:

pb_message("Access denied")
return False

Context variables

  • request: A PolicyRequest object, which has the following properties:

    • request.user: The current user, against which the policy is applied. (ref)
    • request.http_request: The Django HTTP Request. (ref)
    • request.obj: A Django Model instance. This is only set if the policy is ran against an object.
    • request.context: A dictionary with dynamic data. This depends on the origin of the execution.

  • pb_is_sso_flow: Boolean which is true if request was initiated by authenticating through an external provider.

  • pb_client_ip: Client's IP Address or 255.255.255.255 if no IP Address could be extracted. Can be compared, for example

    return pb_client_ip in ip_network('10.0.0.0/24')

Additionally, when the policy is executed from a flow, every variable from the flow's current context is accessible under the context object.

This includes the following:

  • prompt_data: Data which has been saved from a prompt stage or an external source.
  • application: The application the user is in the process of authorizing.
  • pending_user: The currently pending user