6b155621fe
* add password policy to default password change flow This change complies with the minimal compositional requirements by NIST SP 800-63 Digital Identity Guidelines. See https://pages.nist.gov/800-63-4/sp800-63b.html#password More work is needed to comply with other parts of the Guidelines, specifically > If the chosen password is found on the blocklist, the CSP or verifier > [...] SHALL provide the reason for rejection. and > Verifiers SHALL offer guidance to the subscriber to assist the user in > choosing a strong password. This is particularly important following > the rejection of a password on the blocklist as it discourages trivial > modification of listed weak passwords. * add docs for default Password policy * remove HIBP from default Password policy * add zxcvbn to default Password policy * add fallback password error message to password policy, fix validation policy Signed-off-by: Jens Langhammer <jens@goauthentik.io> * reword docs Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> * add HIBP caveat Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> * separate policy into separate blueprint Signed-off-by: Jens Langhammer <jens@goauthentik.io> * use password policy for oobe flow Signed-off-by: Jens Langhammer <jens@goauthentik.io> * kiss Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>
162 lines
4.7 KiB
YAML
162 lines
4.7 KiB
YAML
metadata:
|
|
name: Default - Out-of-box-experience flow
|
|
version: 1
|
|
entries:
|
|
- attrs:
|
|
denied_action: message_continue
|
|
designation: stage_configuration
|
|
name: default-oobe-setup
|
|
title: Welcome to authentik!
|
|
id: flow
|
|
identifiers:
|
|
slug: initial-setup
|
|
model: authentik_flows.flow
|
|
- attrs:
|
|
order: 100
|
|
initial_value:
|
|
Welcome to authentik! Please set a password and email address for the default admin
|
|
user, akadmin.
|
|
placeholder_expression: false
|
|
required: true
|
|
type: static
|
|
field_key: oobe-header-text
|
|
label: oobe-header-text
|
|
id: prompt-field-header
|
|
identifiers:
|
|
name: initial-setup-field-header
|
|
model: authentik_stages_prompt.prompt
|
|
- attrs:
|
|
order: 101
|
|
placeholder: Admin email
|
|
placeholder_expression: false
|
|
required: true
|
|
type: email
|
|
field_key: email
|
|
label: Email
|
|
id: prompt-field-email
|
|
identifiers:
|
|
name: initial-setup-field-email
|
|
model: authentik_stages_prompt.prompt
|
|
- attrs:
|
|
order: 300
|
|
placeholder: Password
|
|
placeholder_expression: false
|
|
required: true
|
|
type: password
|
|
field_key: password
|
|
label: Password
|
|
id: prompt-field-password
|
|
identifiers:
|
|
name: initial-setup-field-password
|
|
model: authentik_stages_prompt.prompt
|
|
- attrs:
|
|
order: 301
|
|
placeholder: Password (repeat)
|
|
placeholder_expression: false
|
|
required: true
|
|
type: password
|
|
field_key: password_repeat
|
|
label: Password (repeat)
|
|
id: prompt-field-password-repeat
|
|
identifiers:
|
|
name: initial-setup-field-password-repeat
|
|
model: authentik_stages_prompt.prompt
|
|
- attrs:
|
|
expression: |
|
|
# This policy sets the user for the currently running flow
|
|
# by injecting "pending_user"
|
|
akadmin = ak_user_by(username="akadmin")
|
|
context["flow_plan"].context["pending_user"] = akadmin
|
|
return True
|
|
id: policy-default-oobe-prefill-user
|
|
identifiers:
|
|
name: default-oobe-prefill-user
|
|
model: authentik_policies_expression.expressionpolicy
|
|
- attrs:
|
|
expression: |
|
|
# This policy ensures that the setup flow can only be
|
|
# executed when the admin user doesn''t have a password set
|
|
akadmin = ak_user_by(username="akadmin")
|
|
return not akadmin.has_usable_password()
|
|
id: policy-default-oobe-password-usable
|
|
identifiers:
|
|
name: default-oobe-password-usable
|
|
model: authentik_policies_expression.expressionpolicy
|
|
- attrs:
|
|
expression: |
|
|
# This policy ensures that the setup flow can only be
|
|
# used one time
|
|
from authentik.flows.models import Flow, FlowAuthenticationRequirement
|
|
Flow.objects.filter(slug="initial-setup").update(
|
|
authentication=FlowAuthenticationRequirement.REQUIRE_SUPERUSER,
|
|
)
|
|
return True
|
|
id: policy-default-oobe-flow-set-authentication
|
|
identifiers:
|
|
name: default-oobe-flow-set-authentication
|
|
model: authentik_policies_expression.expressionpolicy
|
|
- attrs:
|
|
fields:
|
|
- !KeyOf prompt-field-header
|
|
- !KeyOf prompt-field-email
|
|
- !KeyOf prompt-field-password
|
|
- !KeyOf prompt-field-password-repeat
|
|
id: stage-default-oobe-password
|
|
identifiers:
|
|
name: stage-default-oobe-password
|
|
model: authentik_stages_prompt.promptstage
|
|
- id: stage-default-authentication-login
|
|
identifiers:
|
|
name: default-authentication-login
|
|
model: authentik_stages_user_login.userloginstage
|
|
- id: stage-default-password-change-write
|
|
identifiers:
|
|
name: default-password-change-write
|
|
model: authentik_stages_user_write.userwritestage
|
|
attrs:
|
|
user_creation_mode: never_create
|
|
- attrs:
|
|
evaluate_on_plan: true
|
|
invalid_response_action: retry
|
|
re_evaluate_policies: false
|
|
identifiers:
|
|
order: 10
|
|
stage: !KeyOf stage-default-oobe-password
|
|
target: !KeyOf flow
|
|
model: authentik_flows.flowstagebinding
|
|
- attrs:
|
|
evaluate_on_plan: false
|
|
invalid_response_action: retry
|
|
re_evaluate_policies: true
|
|
id: binding-password-write
|
|
identifiers:
|
|
order: 20
|
|
stage: !KeyOf stage-default-password-change-write
|
|
target: !KeyOf flow
|
|
model: authentik_flows.flowstagebinding
|
|
- attrs:
|
|
evaluate_on_plan: true
|
|
invalid_response_action: retry
|
|
re_evaluate_policies: false
|
|
id: binding-login
|
|
identifiers:
|
|
order: 100
|
|
stage: !KeyOf stage-default-authentication-login
|
|
target: !KeyOf flow
|
|
model: authentik_flows.flowstagebinding
|
|
- identifiers:
|
|
order: 0
|
|
policy: !KeyOf policy-default-oobe-password-usable
|
|
target: !KeyOf flow
|
|
model: authentik_policies.policybinding
|
|
- identifiers:
|
|
order: 0
|
|
policy: !KeyOf policy-default-oobe-prefill-user
|
|
target: !KeyOf binding-password-write
|
|
model: authentik_policies.policybinding
|
|
- identifiers:
|
|
order: 0
|
|
policy: !KeyOf policy-default-oobe-flow-set-authentication
|
|
target: !KeyOf binding-login
|
|
model: authentik_policies.policybinding
|