docs: cleanup, add 2021.3 to sidebar
This commit is contained in:
Jens Langhammer
parent
21fd251edf
commit
d3f8d7120f
|
|
@ -12,8 +12,8 @@ These functions/objects are available wherever expressions are used. For more sp
|
||||||
|
|
||||||
## Global objects
|
## Global objects
|
||||||
|
|
||||||
- `ak_logger`: structlog BoundLogger. ([ref](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger))
|
- `ak_logger`: structlog BoundLogger. ([ref](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger))
|
||||||
- `requests`: requests Session object. ([ref](https://requests.readthedocs.io/en/master/user/advanced/))
|
- `requests`: requests Session object. ([ref](https://requests.readthedocs.io/en/master/user/advanced/))
|
||||||
|
|
||||||
## Generally available functions
|
## Generally available functions
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -4,16 +4,16 @@ title: User Object
|
||||||
|
|
||||||
The User object has the following attributes:
|
The User object has the following attributes:
|
||||||
|
|
||||||
- `username`: User's username.
|
- `username`: User's username.
|
||||||
- `email` User's email.
|
- `email` User's email.
|
||||||
- `name` User's display name.
|
- `name` User's display name.
|
||||||
- `is_staff` Boolean field if user is staff.
|
- `is_staff` Boolean field if user is staff.
|
||||||
- `is_active` Boolean field if user is active.
|
- `is_active` Boolean field if user is active.
|
||||||
- `date_joined` Date user joined/was created.
|
- `date_joined` Date user joined/was created.
|
||||||
- `password_change_date` Date password was last changed.
|
- `password_change_date` Date password was last changed.
|
||||||
- `attributes` Dynamic attributes.
|
- `attributes` Dynamic attributes.
|
||||||
- `group_attributes` Merged attributes of all groups the user is member of and the user's own attributes.
|
- `group_attributes` Merged attributes of all groups the user is member of and the user's own attributes.
|
||||||
- `ak_groups` This is a queryset of all the user's groups.
|
- `ak_groups` This is a queryset of all the user's groups.
|
||||||
|
|
||||||
You can do additional filtering like `user.ak_groups.filter(name__startswith='test')`, see [here](https://docs.djangoproject.com/en/3.1/ref/models/querysets/#id4)
|
You can do additional filtering like `user.ak_groups.filter(name__startswith='test')`, see [here](https://docs.djangoproject.com/en/3.1/ref/models/querysets/#id4)
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -11,8 +11,8 @@ This stage provides a ready-to-go form for users to identify themselves.
|
||||||
Select which fields the user can use to identify themselves. Multiple fields can be specified and separated with a comma.
|
Select which fields the user can use to identify themselves. Multiple fields can be specified and separated with a comma.
|
||||||
Valid choices:
|
Valid choices:
|
||||||
|
|
||||||
- email
|
- email
|
||||||
- username
|
- username
|
||||||
|
|
||||||
### Template
|
### Template
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -12,14 +12,14 @@ Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopte
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
||||||
|
|
||||||
- ACS URL: `https://signin.aws.amazon.com/saml`
|
- ACS URL: `https://signin.aws.amazon.com/saml`
|
||||||
- Audience: `urn:amazon:webservices`
|
- Audience: `urn:amazon:webservices`
|
||||||
- Issuer: `authentik`
|
- Issuer: `authentik`
|
||||||
- Binding: `Post`
|
- Binding: `Post`
|
||||||
|
|
||||||
You can of course use a custom signing certificate, and adjust durations.
|
You can of course use a custom signing certificate, and adjust durations.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -20,15 +20,15 @@ AWX is the open-source version of Tower. The term "AWX" will be used interchange
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `awx.company` is the FQDN of the AWX/Tower install.
|
- `awx.company` is the FQDN of the AWX/Tower install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
||||||
|
|
||||||
- ACS URL: `https://awx.company/sso/complete/saml/`
|
- ACS URL: `https://awx.company/sso/complete/saml/`
|
||||||
- Audience: `awx`
|
- Audience: `awx`
|
||||||
- Service Provider Binding: Post
|
- Service Provider Binding: Post
|
||||||
- Issuer: `https://awx.company/sso/metadata/saml/`
|
- Issuer: `https://awx.company/sso/metadata/saml/`
|
||||||
|
|
||||||
You can of course use a custom signing certificate, and adjust durations.
|
You can of course use a custom signing certificate, and adjust durations.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -14,15 +14,15 @@ GitLab is a complete DevOps platform, delivered as a single application. This ma
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `gitlab.company` is the FQDN of the GitLab Install
|
- `gitlab.company` is the FQDN of the GitLab Install
|
||||||
- `authentik.company` is the FQDN of the authentik Install
|
- `authentik.company` is the FQDN of the authentik Install
|
||||||
|
|
||||||
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
||||||
|
|
||||||
- ACS URL: `https://gitlab.company/users/auth/saml/callback`
|
- ACS URL: `https://gitlab.company/users/auth/saml/callback`
|
||||||
- Audience: `https://gitlab.company`
|
- Audience: `https://gitlab.company`
|
||||||
- Issuer: `https://gitlab.company`
|
- Issuer: `https://gitlab.company`
|
||||||
- Binding: `Post`
|
- Binding: `Post`
|
||||||
|
|
||||||
You can of course use a custom signing certificate, and adjust durations. To get the value for `idp_cert_fingerprint`, you can use a tool like [this](https://www.samltool.com/fingerprint.php).
|
You can of course use a custom signing certificate, and adjust durations. To get the value for `idp_cert_fingerprint`, you can use a tool like [this](https://www.samltool.com/fingerprint.php).
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -14,21 +14,31 @@ Grafana is a multi-platform open source analytics and interactive visualization
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `grafana.company` is the FQDN of the Grafana install.
|
- `grafana.company` is the FQDN of the Grafana install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Create an application in authentik. Create an OAuth2/OpenID provider with the following parameters:
|
Create an application in authentik. Create an OAuth2/OpenID provider with the following parameters:
|
||||||
|
|
||||||
- Client Type: `Confidential`
|
- Client Type: `Confidential`
|
||||||
- JWT Algorithm: `RS256`
|
- JWT Algorithm: `RS256`
|
||||||
- Scopes: OpenID, Email and Profile
|
- Scopes: OpenID, Email and Profile
|
||||||
- RSA Key: Select any available key
|
- RSA Key: Select any available key
|
||||||
- Redirect URIs: `https://grafana.company/login/generic_oauth`
|
- Redirect URIs: `https://grafana.company/login/generic_oauth`
|
||||||
|
|
||||||
Note the Client ID and Client Secret values. Create an application, using the provider you've created above. Note the slug of the application you've created.
|
Note the Client ID and Client Secret values. Create an application, using the provider you've created above. Note the slug of the application you've created.
|
||||||
|
|
||||||
## Grafana
|
## Grafana
|
||||||
|
|
||||||
|
import Tabs from '@theme/Tabs';
|
||||||
|
import TabItem from '@theme/TabItem';
|
||||||
|
|
||||||
|
<Tabs
|
||||||
|
defaultValue="docker"
|
||||||
|
values={[
|
||||||
|
{label: 'Docker', value: 'docker'},
|
||||||
|
{label: 'Standalone', value: 'standalone'},
|
||||||
|
]}>
|
||||||
|
<TabItem value="docker">
|
||||||
If your Grafana is running in docker, set the following environment variables:
|
If your Grafana is running in docker, set the following environment variables:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
|
|
@ -45,7 +55,8 @@ environment:
|
||||||
# Optionally enable auto-login
|
# Optionally enable auto-login
|
||||||
GF_AUTH_OAUTH_AUTO_LOGIN: "true"
|
GF_AUTH_OAUTH_AUTO_LOGIN: "true"
|
||||||
```
|
```
|
||||||
|
</TabItem>
|
||||||
|
<TabItem value="standalone">
|
||||||
If you are using a config-file instead, you have to set these options:
|
If you are using a config-file instead, you have to set these options:
|
||||||
|
|
||||||
```ini
|
```ini
|
||||||
|
|
@ -64,3 +75,5 @@ auth_url = https://authentik.company/application/o/authorize/
|
||||||
token_url = https://authentik.company/application/o/token/
|
token_url = https://authentik.company/application/o/token/
|
||||||
api_url = https://authentik.company/application/o/userinfo/
|
api_url = https://authentik.company/application/o/userinfo/
|
||||||
```
|
```
|
||||||
|
</TabItem>
|
||||||
|
</Tabs>
|
||||||
|
|
@ -14,8 +14,8 @@ Open source home automation that puts local control and privacy first. Powered b
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `hass.company` is the FQDN of the Home-Assistant install.
|
- `hass.company` is the FQDN of the Home-Assistant install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
:::note
|
:::note
|
||||||
This setup uses https://github.com/BeryJu/hass-auth-header and the authentik proxy for authentication. When this [PR](https://github.com/home-assistant/core/pull/32926) is merged, this will no longer be necessary.
|
This setup uses https://github.com/BeryJu/hass-auth-header and the authentik proxy for authentication. When this [PR](https://github.com/home-assistant/core/pull/32926) is merged, this will no longer be necessary.
|
||||||
|
|
@ -42,13 +42,13 @@ additionalHeaders:
|
||||||
|
|
||||||
Create a Proxy Provider with the following values
|
Create a Proxy Provider with the following values
|
||||||
|
|
||||||
- Internal host
|
- Internal host
|
||||||
|
|
||||||
If Home-Assistant is running in docker, and you're deploying the authentik proxy on the same host, set the value to `http://homeassistant:8123`, where Home-Assistant is the name of your container.
|
If Home-Assistant is running in docker, and you're deploying the authentik proxy on the same host, set the value to `http://homeassistant:8123`, where Home-Assistant is the name of your container.
|
||||||
|
|
||||||
If Home-Assistant is running on a different server than where you are deploying the authentik proxy, set the value to `http://hass.company:8123`.
|
If Home-Assistant is running on a different server than where you are deploying the authentik proxy, set the value to `http://hass.company:8123`.
|
||||||
|
|
||||||
- External host
|
- External host
|
||||||
|
|
||||||
Set this to the external URL you will be accessing Home-Assistant from.
|
Set this to the external URL you will be accessing Home-Assistant from.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -22,17 +22,17 @@ In case something goes wrong with the configuration, you can use the URL `http:/
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `nextcloud.company` is the FQDN of the NextCloud install.
|
- `nextcloud.company` is the FQDN of the NextCloud install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
|
||||||
|
|
||||||
- ACS URL: `https://nextcloud.company/apps/user_saml/saml/acs`
|
- ACS URL: `https://nextcloud.company/apps/user_saml/saml/acs`
|
||||||
- Issuer: `https://authentik.company`
|
- Issuer: `https://authentik.company`
|
||||||
- Service Provider Binding: `Post`
|
- Service Provider Binding: `Post`
|
||||||
- Audience: `https://nextcloud.company/apps/user_saml/saml/metadata`
|
- Audience: `https://nextcloud.company/apps/user_saml/saml/metadata`
|
||||||
- Signing Keypair: Select any certificate you have.
|
- Signing Keypair: Select any certificate you have.
|
||||||
- Property mappings: Select all Managed mappings.
|
- Property mappings: Select all Managed mappings.
|
||||||
|
|
||||||
You can of course use a custom signing certificate, and adjust durations.
|
You can of course use a custom signing certificate, and adjust durations.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -18,16 +18,16 @@ better software faster with Sentry. Won’t you join them?
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `sentry.company` is the FQDN of the Sentry install.
|
- `sentry.company` is the FQDN of the Sentry install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Create an application in authentik. Create a SAML Provider with the following values
|
Create an application in authentik. Create a SAML Provider with the following values
|
||||||
|
|
||||||
- ACS URL: `https://sentry.company/saml/acs/<sentry organisation name>/`
|
- ACS URL: `https://sentry.company/saml/acs/<sentry organisation name>/`
|
||||||
- Audience: `https://sentry.company/saml/metadata/<sentry organisation name>/`
|
- Audience: `https://sentry.company/saml/metadata/<sentry organisation name>/`
|
||||||
- Issuer: `authentik`
|
- Issuer: `authentik`
|
||||||
- Service Provider Binding: `Post`
|
- Service Provider Binding: `Post`
|
||||||
- Property Mapping: Select all Managed Mappings
|
- Property Mapping: Select all Managed Mappings
|
||||||
|
|
||||||
## Sentry
|
## Sentry
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -20,18 +20,18 @@ Sonarr is a PVR for Usenet and BitTorrent users. It can monitor multiple RSS fee
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `sonarr.company` is the FQDN of the Sonarr install.
|
- `sonarr.company` is the FQDN of the Sonarr install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Create a Proxy Provider with the following values
|
Create a Proxy Provider with the following values
|
||||||
|
|
||||||
- Internal host
|
- Internal host
|
||||||
|
|
||||||
If Sonarr is running in docker, and you're deploying the authentik proxy on the same host, set the value to `http://sonarr:8989`, where sonarr is the name of your container.
|
If Sonarr is running in docker, and you're deploying the authentik proxy on the same host, set the value to `http://sonarr:8989`, where sonarr is the name of your container.
|
||||||
|
|
||||||
If Sonarr is running on a different server than where you are deploying the authentik proxy, set the value to `http://sonarr.company:8989`.
|
If Sonarr is running on a different server than where you are deploying the authentik proxy, set the value to `http://sonarr.company:8989`.
|
||||||
|
|
||||||
- External host
|
- External host
|
||||||
|
|
||||||
Set this to the external URL you will be accessing Sonarr from.
|
Set this to the external URL you will be accessing Sonarr from.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -14,8 +14,8 @@ Tautulli is a 3rd party application that you can run alongside your Plex Media S
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `tautulli.company` is the FQDN of the Tautulli install.
|
- `tautulli.company` is the FQDN of the Tautulli install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
## authentik Setup
|
## authentik Setup
|
||||||
|
|
||||||
|
|
@ -30,13 +30,13 @@ Add all Tautulli users to the Group. You should also create a Group Membership P
|
||||||
|
|
||||||
Create an application in authentik. Create a Proxy provider with the following parameters:
|
Create an application in authentik. Create a Proxy provider with the following parameters:
|
||||||
|
|
||||||
- Internal host
|
- Internal host
|
||||||
|
|
||||||
If Tautulli is running in docker, and you're deploying the authentik proxy on the same host, set the value to `http://tautulli:3579`, where tautulli is the name of your container.
|
If Tautulli is running in docker, and you're deploying the authentik proxy on the same host, set the value to `http://tautulli:3579`, where tautulli is the name of your container.
|
||||||
|
|
||||||
If Tautulli is running on a different server to where you are deploying the authentik proxy, set the value to `http://tautulli.company:3579`.
|
If Tautulli is running on a different server to where you are deploying the authentik proxy, set the value to `http://tautulli.company:3579`.
|
||||||
|
|
||||||
- External host
|
- External host
|
||||||
|
|
||||||
Set this to the external URL you will be accessing Tautulli from.
|
Set this to the external URL you will be accessing Tautulli from.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -18,8 +18,8 @@ This requires authentik 0.10.3 or newer.
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `landscape.company` is the FQDN of the Landscape server.
|
- `landscape.company` is the FQDN of the Landscape server.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Landscape uses the OpenID-Connect Protocol for single-sign on.
|
Landscape uses the OpenID-Connect Protocol for single-sign on.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -14,8 +14,8 @@ Veeam Backup Enterprise Manager (Enterprise Manager) is a management and reporti
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `veeam.company` is the FQDN of the Veeam Enterprise Manager install.
|
- `veeam.company` is the FQDN of the Veeam Enterprise Manager install.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
You will need an existing group or multiple in authentik to assign roles in Veeam Enterprise Manager to.
|
You will need an existing group or multiple in authentik to assign roles in Veeam Enterprise Manager to.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -26,8 +26,8 @@ It seems that the vCenter still needs to be joined to the Active Directory Domai
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `vcenter.company` is the FQDN of the vCenter server.
|
- `vcenter.company` is the FQDN of the vCenter server.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
Since vCenter only allows OpenID-Connect in combination with Active Directory, it is recommended to have authentik sync with the same Active Directory.
|
Since vCenter only allows OpenID-Connect in combination with Active Directory, it is recommended to have authentik sync with the same Active Directory.
|
||||||
|
|
||||||
|
|
@ -53,11 +53,11 @@ Under _Sources_, click _Edit_ and ensure that "authentik default Active Director
|
||||||
|
|
||||||
Under _Providers_, create an OAuth2/OpenID provider with these settings:
|
Under _Providers_, create an OAuth2/OpenID provider with these settings:
|
||||||
|
|
||||||
- Client Type: Confidential
|
- Client Type: Confidential
|
||||||
- JWT Algorithm: RS256
|
- JWT Algorithm: RS256
|
||||||
- Redirect URI: `https://vcenter.company/ui/login/oauth2/authcode`
|
- Redirect URI: `https://vcenter.company/ui/login/oauth2/authcode`
|
||||||
- Sub Mode: If your Email address Schema matches your UPN, select "Based on the User's Email...", otherwise select "Based on the User's UPN...".
|
- Sub Mode: If your Email address Schema matches your UPN, select "Based on the User's Email...", otherwise select "Based on the User's UPN...".
|
||||||
- Scopes: Select the Scope Mapping you've created in Step 1
|
- Scopes: Select the Scope Mapping you've created in Step 1
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -6,8 +6,8 @@ title: Active Directory
|
||||||
|
|
||||||
The following placeholders will be used:
|
The following placeholders will be used:
|
||||||
|
|
||||||
- `ad.company` is the Name of the Active Directory domain.
|
- `ad.company` is the Name of the Active Directory domain.
|
||||||
- `authentik.company` is the FQDN of the authentik install.
|
- `authentik.company` is the FQDN of the authentik install.
|
||||||
|
|
||||||
## Active Directory Setup
|
## Active Directory Setup
|
||||||
|
|
||||||
|
|
@ -33,25 +33,25 @@ In authentik, create a new LDAP Source in Administration -> Sources.
|
||||||
|
|
||||||
Use these settings:
|
Use these settings:
|
||||||
|
|
||||||
- Server URI: `ldap://ad.company`
|
- Server URI: `ldap://ad.company`
|
||||||
|
|
||||||
For authentik to be able to write passwords back to Active Directory, make sure to use `ldaps://`
|
For authentik to be able to write passwords back to Active Directory, make sure to use `ldaps://`
|
||||||
|
|
||||||
- Bind CN: `<name of your service user>@ad.company`
|
- Bind CN: `<name of your service user>@ad.company`
|
||||||
- Bind Password: The password you've given the user above
|
- Bind Password: The password you've given the user above
|
||||||
- Base DN: The base DN which you want authentik to sync
|
- Base DN: The base DN which you want authentik to sync
|
||||||
- Property mappings: Control/Command-select all Mappings which start with "authentik default LDAP" and "authentik default Active Directory"
|
- Property mappings: Control/Command-select all Mappings which start with "authentik default LDAP" and "authentik default Active Directory"
|
||||||
- Group property mappings: Select "authentik default LDAP Mapping: Name"
|
- Group property mappings: Select "authentik default LDAP Mapping: Name"
|
||||||
|
|
||||||
The other settings might need to be adjusted based on the setup of your domain.
|
The other settings might need to be adjusted based on the setup of your domain.
|
||||||
|
|
||||||
- Addition User/Group DN: Additional DN which is _prepended_ to your Base DN for user synchronization.
|
- Addition User/Group DN: Additional DN which is _prepended_ to your Base DN for user synchronization.
|
||||||
- Addition Group DN: Additional DN which is _prepended_ to your Base DN for group synchronization.
|
- Addition Group DN: Additional DN which is _prepended_ to your Base DN for group synchronization.
|
||||||
- User object filter: Which objects should be considered users.
|
- User object filter: Which objects should be considered users.
|
||||||
- Group object filter: Which objects should be considered groups.
|
- Group object filter: Which objects should be considered groups.
|
||||||
- Group membership field: Which user field saves the group membership
|
- Group membership field: Which user field saves the group membership
|
||||||
- Object uniqueness field: A user field which contains a unique Identifier
|
- Object uniqueness field: A user field which contains a unique Identifier
|
||||||
- Sync parent group: If enabled, all synchronized groups will be given this group as a parent.
|
- Sync parent group: If enabled, all synchronized groups will be given this group as a parent.
|
||||||
|
|
||||||
After you save the source, a synchronization will start in the background. When its done, you cen see the summary on the System Tasks page.
|
After you save the source, a synchronization will start in the background. When its done, you cen see the summary on the System Tasks page.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -10,12 +10,12 @@ Upon creation, a service account and a token is generated. The service account o
|
||||||
|
|
||||||
authentik can manage the deployment, updating and general lifecycle of an Outpost. To communicate with the underlying platforms on which the outpost is deployed, authentik has "Service Connections".
|
authentik can manage the deployment, updating and general lifecycle of an Outpost. To communicate with the underlying platforms on which the outpost is deployed, authentik has "Service Connections".
|
||||||
|
|
||||||
- If you've deployed authentik on docker-compose, authentik automatically create a Service Connection for the local docker socket.
|
- If you've deployed authentik on docker-compose, authentik automatically create a Service Connection for the local docker socket.
|
||||||
- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates a Service Connection for the local Kubernetes Cluster.
|
- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates a Service Connection for the local Kubernetes Cluster.
|
||||||
|
|
||||||
To deploy an outpost with these service connections, simply selected them during the creation of an Outpost. A background task is started, which creates the container/deployment. You can see that Status on the System Tasks page.
|
To deploy an outpost with these service connections, simply selected them during the creation of an Outpost. A background task is started, which creates the container/deployment. You can see that Status on the System Tasks page.
|
||||||
|
|
||||||
To deploy an outpost manually, see:
|
To deploy an outpost manually, see:
|
||||||
|
|
||||||
- [Kubernetes](./manual-deploy-kubernetes.md)
|
- [Kubernetes](./manual-deploy-kubernetes.md)
|
||||||
- [docker-compose](./manual-deploy-docker-compose.md)
|
- [docker-compose](./manual-deploy-docker-compose.md)
|
||||||
|
|
|
||||||
|
|
@ -23,14 +23,14 @@ return False
|
||||||
|
|
||||||
### Context variables
|
### Context variables
|
||||||
|
|
||||||
- `request`: A PolicyRequest object, which has the following properties:
|
- `request`: A PolicyRequest object, which has the following properties:
|
||||||
- `request.user`: The current user, against which the policy is applied. ([ref](../expressions/reference/user-object.md))
|
- `request.user`: The current user, against which the policy is applied. ([ref](../expressions/reference/user-object.md))
|
||||||
- `request.http_request`: The Django HTTP Request. ([ref](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
|
- `request.http_request`: The Django HTTP Request. ([ref](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
|
||||||
- `request.obj`: A Django Model instance. This is only set if the policy is ran against an object.
|
- `request.obj`: A Django Model instance. This is only set if the policy is ran against an object.
|
||||||
- `request.context`: A dictionary with dynamic data. This depends on the origin of the execution.
|
- `request.context`: A dictionary with dynamic data. This depends on the origin of the execution.
|
||||||
- `geoip`: `geoip2.models.City` object, which is added when GeoIP is enabled.
|
- `geoip`: `geoip2.models.City` object, which is added when GeoIP is enabled.
|
||||||
- `ak_is_sso_flow`: Boolean which is true if request was initiated by authenticating through an external provider.
|
- `ak_is_sso_flow`: Boolean which is true if request was initiated by authenticating through an external provider.
|
||||||
- `ak_client_ip`: Client's IP Address or 255.255.255.255 if no IP Address could be extracted. Can be [compared](../expressions/index.md#comparing-ip-addresses), for example
|
- `ak_client_ip`: Client's IP Address or 255.255.255.255 if no IP Address could be extracted. Can be [compared](../expressions/index.md#comparing-ip-addresses), for example
|
||||||
|
|
||||||
```python
|
```python
|
||||||
return ak_client_ip in ip_network('10.0.0.0/24')
|
return ak_client_ip in ip_network('10.0.0.0/24')
|
||||||
|
|
@ -40,6 +40,6 @@ Additionally, when the policy is executed from a flow, every variable from the f
|
||||||
|
|
||||||
This includes the following:
|
This includes the following:
|
||||||
|
|
||||||
- `prompt_data`: Data which has been saved from a prompt stage or an external source.
|
- `prompt_data`: Data which has been saved from a prompt stage or an external source.
|
||||||
- `application`: The application the user is in the process of authorizing.
|
- `application`: The application the user is in the process of authorizing.
|
||||||
- `pending_user`: The currently pending user
|
- `pending_user`: The currently pending user
|
||||||
|
|
|
||||||
|
|
@ -25,11 +25,11 @@ See [Expression Policy](expression.md).
|
||||||
This policy allows you to specify password rules, such as length and required characters.
|
This policy allows you to specify password rules, such as length and required characters.
|
||||||
The following rules can be set:
|
The following rules can be set:
|
||||||
|
|
||||||
- Minimum amount of uppercase characters.
|
- Minimum amount of uppercase characters.
|
||||||
- Minimum amount of lowercase characters.
|
- Minimum amount of lowercase characters.
|
||||||
- Minimum amount of symbols characters.
|
- Minimum amount of symbols characters.
|
||||||
- Minimum length.
|
- Minimum length.
|
||||||
- Symbol charset (define which characters are counted as symbols).
|
- Symbol charset (define which characters are counted as symbols).
|
||||||
|
|
||||||
### Have I Been Pwned Policy
|
### Have I Been Pwned Policy
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -10,6 +10,6 @@ These variables are available in addition to the common variables/functions defi
|
||||||
|
|
||||||
### Context Variables
|
### Context Variables
|
||||||
|
|
||||||
- `user`: The current user. This may be `None` if there is no contextual user. ([ref](../expressions/reference/user-object.md))
|
- `user`: The current user. This may be `None` if there is no contextual user. ([ref](../expressions/reference/user-object.md))
|
||||||
- `request`: The current request. This may be `None` if there is no contextual request. ([ref](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
|
- `request`: The current request. This may be `None` if there is no contextual request. ([ref](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects))
|
||||||
- Other arbitrary arguments given by the provider, this is documented on the Provider/Source.
|
- Other arbitrary arguments given by the provider, this is documented on the Provider/Source.
|
||||||
|
|
|
||||||
|
|
@ -12,7 +12,6 @@ Scopes can be configured using Scope Mappings, a type of [Property Mappings](../
|
||||||
| Token | `/application/o/token/` |
|
| Token | `/application/o/token/` |
|
||||||
| User Info | `/application/o/userinfo/` |
|
| User Info | `/application/o/userinfo/` |
|
||||||
| End Session | `/application/o/end-session/` |
|
| End Session | `/application/o/end-session/` |
|
||||||
| Introspect | `/application/o/end-session/` |
|
|
||||||
| JWKS | `/application/o/<application slug>/jwks/` |
|
| JWKS | `/application/o/<application slug>/jwks/` |
|
||||||
| OpenID Configuration | `/application/o/<application slug>/.well-known/openid-configuration` |
|
| OpenID Configuration | `/application/o/<application slug>/.well-known/openid-configuration` |
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -4,33 +4,33 @@ title: Release 0.10
|
||||||
|
|
||||||
This update brings a lot of big features, such as:
|
This update brings a lot of big features, such as:
|
||||||
|
|
||||||
- New OAuth2/OpenID Provider
|
- New OAuth2/OpenID Provider
|
||||||
|
|
||||||
This new provider merges both OAuth2 and OpenID. It is based on the codebase of the old provider, which has been simplified and cleaned from the ground up. Support for Property Mappings has also been added. Because of this change, OpenID and OAuth2 Providers will have to be re-created.
|
This new provider merges both OAuth2 and OpenID. It is based on the codebase of the old provider, which has been simplified and cleaned from the ground up. Support for Property Mappings has also been added. Because of this change, OpenID and OAuth2 Providers will have to be re-created.
|
||||||
|
|
||||||
- Proxy Provider
|
- Proxy Provider
|
||||||
|
|
||||||
Due to this new OAuth2 Provider, the Application Gateway Provider, now simply called "Proxy Provider" has been revamped as well. The new authentik Proxy integrates more tightly with authentik via the new Outposts system. The new proxy also supports multiple applications per proxy instance, can configure TLS based on authentik Keypairs, and more.
|
Due to this new OAuth2 Provider, the Application Gateway Provider, now simply called "Proxy Provider" has been revamped as well. The new authentik Proxy integrates more tightly with authentik via the new Outposts system. The new proxy also supports multiple applications per proxy instance, can configure TLS based on authentik Keypairs, and more.
|
||||||
|
|
||||||
See [Proxy](../providers/proxy.md)
|
See [Proxy](../providers/proxy.md)
|
||||||
|
|
||||||
- Outpost System
|
- Outpost System
|
||||||
|
|
||||||
This is a new Object type, currently used only by the Proxy Provider. It manages the creation and permissions of service accounts, which are used by the outposts to communicate with authentik.
|
This is a new Object type, currently used only by the Proxy Provider. It manages the creation and permissions of service accounts, which are used by the outposts to communicate with authentik.
|
||||||
|
|
||||||
See [Outposts](../outposts/outposts.md)
|
See [Outposts](../outposts/outposts.md)
|
||||||
|
|
||||||
- Flow Import/Export
|
- Flow Import/Export
|
||||||
|
|
||||||
Flows can now be imported and exported. This feature can be used as a backup system, or to share complex flows with other people. Example flows have also been added to the documentation to help you get going with authentik.
|
Flows can now be imported and exported. This feature can be used as a backup system, or to share complex flows with other people. Example flows have also been added to the documentation to help you get going with authentik.
|
||||||
|
|
||||||
## Under the hood
|
## Under the hood
|
||||||
|
|
||||||
- authentik now runs on Django 3.1 and Channels with complete ASGI enabled
|
- authentik now runs on Django 3.1 and Channels with complete ASGI enabled
|
||||||
- uwsgi has been replaced with Gunicorn and uvicorn
|
- uwsgi has been replaced with Gunicorn and uvicorn
|
||||||
- Elastic APM has been replaced with Sentry Performance metrics
|
- Elastic APM has been replaced with Sentry Performance metrics
|
||||||
- Flow title is now configurable separately from the name
|
- Flow title is now configurable separately from the name
|
||||||
- All logging output is now json
|
- All logging output is now json
|
||||||
|
|
||||||
## Upgrading
|
## Upgrading
|
||||||
|
|
||||||
|
|
@ -54,7 +54,7 @@ docker-compose up -d
|
||||||
|
|
||||||
A few options have changed:
|
A few options have changed:
|
||||||
|
|
||||||
- `error_reporting` was changed from a simple boolean to a dictionary:
|
- `error_reporting` was changed from a simple boolean to a dictionary:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
error_reporting:
|
error_reporting:
|
||||||
|
|
@ -63,8 +63,8 @@ error_reporting:
|
||||||
send_pii: false
|
send_pii: false
|
||||||
```
|
```
|
||||||
|
|
||||||
- The `apm` and `monitoring` blocks have been removed.
|
- The `apm` and `monitoring` blocks have been removed.
|
||||||
- `serverReplicas` and `workerReplicas` have been added
|
- `serverReplicas` and `workerReplicas` have been added
|
||||||
|
|
||||||
### Upgrading
|
### Upgrading
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -4,18 +4,18 @@ title: Release 0.11
|
||||||
|
|
||||||
This update brings these headline features:
|
This update brings these headline features:
|
||||||
|
|
||||||
- Add Backup and Restore, currently only externally schedulable, documented [here](../maintenance/backups/index.md)
|
- Add Backup and Restore, currently only externally schedulable, documented [here](../maintenance/backups/index.md)
|
||||||
- New Admin Dashboard with more metrics and Charts
|
- New Admin Dashboard with more metrics and Charts
|
||||||
|
|
||||||
Shows successful and failed logins from the last 24 hours, as well as the most used applications
|
Shows successful and failed logins from the last 24 hours, as well as the most used applications
|
||||||
|
|
||||||
- Add search to all table views
|
- Add search to all table views
|
||||||
- Outpost now supports a Docker Controller, which installs the Outpost on the same host as authentik, updates and manages it
|
- Outpost now supports a Docker Controller, which installs the Outpost on the same host as authentik, updates and manages it
|
||||||
- Add Token Identifier
|
- Add Token Identifier
|
||||||
|
|
||||||
Tokens now have an identifier which is used to reference to them, so the Primary key is not shown in URLs
|
Tokens now have an identifier which is used to reference to them, so the Primary key is not shown in URLs
|
||||||
|
|
||||||
- `core/applications/list` API now shows applications the user has access to via policies
|
- `core/applications/list` API now shows applications the user has access to via policies
|
||||||
|
|
||||||
## Upgrading
|
## Upgrading
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -6,14 +6,14 @@ Due to some database changes that had to be rather sooner than later, there is n
|
||||||
|
|
||||||
To export data from your old instance, run this command:
|
To export data from your old instance, run this command:
|
||||||
|
|
||||||
- docker-compose
|
- docker-compose
|
||||||
|
|
||||||
```
|
```
|
||||||
docker-compose exec server ./manage.py dumpdata -o /tmp/authentik_dump.json authentik_core.User authentik_core.Group authentik_crypto.CertificateKeyPair authentik_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
|
docker-compose exec server ./manage.py dumpdata -o /tmp/authentik_dump.json authentik_core.User authentik_core.Group authentik_crypto.CertificateKeyPair authentik_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
|
||||||
docker cp authentik_server_1:/tmp/authentik_dump.json authentik_dump.json
|
docker cp authentik_server_1:/tmp/authentik_dump.json authentik_dump.json
|
||||||
```
|
```
|
||||||
|
|
||||||
- kubernetes
|
- kubernetes
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl exec -it authentik-web-... -- ./manage.py dumpdata -o /tmp/authentik_dump.json authentik_core.User authentik_core.Group authentik_crypto.CertificateKeyPair authentik_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
|
kubectl exec -it authentik-web-... -- ./manage.py dumpdata -o /tmp/authentik_dump.json authentik_core.User authentik_core.Group authentik_crypto.CertificateKeyPair authentik_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
|
||||||
|
|
@ -22,14 +22,14 @@ kubectl cp authentik-web-...:/tmp/authentik_dump.json authentik_dump.json
|
||||||
|
|
||||||
After that, create a new authentik instance in a different namespace (kubernetes) or in a different folder (docker-compose). Once this instance is running, you can use the following commands to restore the data. On docker-compose, you still have to run the `migrate` command, to create all database structures.
|
After that, create a new authentik instance in a different namespace (kubernetes) or in a different folder (docker-compose). Once this instance is running, you can use the following commands to restore the data. On docker-compose, you still have to run the `migrate` command, to create all database structures.
|
||||||
|
|
||||||
- docker-compose
|
- docker-compose
|
||||||
|
|
||||||
```
|
```
|
||||||
docker cp authentik_dump.json new_authentik_server_1:/tmp/authentik_dump.json
|
docker cp authentik_dump.json new_authentik_server_1:/tmp/authentik_dump.json
|
||||||
docker-compose exec server ./manage.py loaddata /tmp/authentik_dump.json
|
docker-compose exec server ./manage.py loaddata /tmp/authentik_dump.json
|
||||||
```
|
```
|
||||||
|
|
||||||
- kubernetes
|
- kubernetes
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl cp authentik_dump.json authentik-web-...:/tmp/authentik_dump.json
|
kubectl cp authentik_dump.json authentik-web-...:/tmp/authentik_dump.json
|
||||||
|
|
|
||||||
|
|
@ -10,12 +10,12 @@ Sources allow you to connect authentik to an existing user directory. They can a
|
||||||
|
|
||||||
This source allows users to enroll themselves with an external OAuth-based Identity Provider. The generic provider expects the endpoint to return OpenID-Connect compatible information. Vendor-specific implementations have their own OAuth Source.
|
This source allows users to enroll themselves with an external OAuth-based Identity Provider. The generic provider expects the endpoint to return OpenID-Connect compatible information. Vendor-specific implementations have their own OAuth Source.
|
||||||
|
|
||||||
- Policies: Allow/Forbid users from linking their accounts with this provider.
|
- Policies: Allow/Forbid users from linking their accounts with this provider.
|
||||||
- Request Token URL: This field is used for OAuth v1 implementations and will be provided by the provider.
|
- Request Token URL: This field is used for OAuth v1 implementations and will be provided by the provider.
|
||||||
- Authorization URL: This value will be provided by the provider.
|
- Authorization URL: This value will be provided by the provider.
|
||||||
- Access Token URL: This value will be provided by the provider.
|
- Access Token URL: This value will be provided by the provider.
|
||||||
- Profile URL: This URL is called by authentik to retrieve user information upon successful authentication.
|
- Profile URL: This URL is called by authentik to retrieve user information upon successful authentication.
|
||||||
- Consumer key/Consumer secret: These values will be provided by the provider.
|
- Consumer key/Consumer secret: These values will be provided by the provider.
|
||||||
|
|
||||||
## SAML Source
|
## SAML Source
|
||||||
|
|
||||||
|
|
@ -29,17 +29,17 @@ This source allows you to import users and groups from an LDAP Server.
|
||||||
For Active Directory, follow the [Active Directory Integration](https://goauthentik.io/docs/integrations/sources/active-directory/index)
|
For Active Directory, follow the [Active Directory Integration](https://goauthentik.io/docs/integrations/sources/active-directory/index)
|
||||||
:::
|
:::
|
||||||
|
|
||||||
- Server URI: URI to your LDAP server/Domain Controller.
|
- Server URI: URI to your LDAP server/Domain Controller.
|
||||||
- Bind CN: CN of the bind user. This can also be a UPN in the format of `user@domain.tld`.
|
- Bind CN: CN of the bind user. This can also be a UPN in the format of `user@domain.tld`.
|
||||||
- Bind password: Password used during the bind process.
|
- Bind password: Password used during the bind process.
|
||||||
- Enable StartTLS: Enables StartTLS functionality. To use LDAPS instead, use port `636`.
|
- Enable StartTLS: Enables StartTLS functionality. To use LDAPS instead, use port `636`.
|
||||||
- Base DN: Base DN used for all LDAP queries.
|
- Base DN: Base DN used for all LDAP queries.
|
||||||
- Addition User DN: Prepended to the base DN for user queries.
|
- Addition User DN: Prepended to the base DN for user queries.
|
||||||
- Addition Group DN: Prepended to the base DN for group queries.
|
- Addition Group DN: Prepended to the base DN for group queries.
|
||||||
- User object filter: Consider objects matching this filter to be users.
|
- User object filter: Consider objects matching this filter to be users.
|
||||||
- Group object filter: Consider objects matching this filter to be groups.
|
- Group object filter: Consider objects matching this filter to be groups.
|
||||||
- User group membership field: This field contains the user's group memberships.
|
- User group membership field: This field contains the user's group memberships.
|
||||||
- Object uniqueness field: This field contains a unique identifier.
|
- Object uniqueness field: This field contains a unique identifier.
|
||||||
- Sync groups: Enable/disable group synchronization. Groups are synced in the background every 5 minutes.
|
- Sync groups: Enable/disable group synchronization. Groups are synced in the background every 5 minutes.
|
||||||
- Sync parent group: Optionally set this group as the parent group for all synced groups. An example use case of this would be to import Active Directory groups under a root `imported-from-ad` group.
|
- Sync parent group: Optionally set this group as the parent group for all synced groups. An example use case of this would be to import Active Directory groups under a root `imported-from-ad` group.
|
||||||
- Property mappings: Define which LDAP properties map to which authentik properties. The default set of property mappings is generated for Active Directory. See also [LDAP Property Mappings](property-mappings/index.md#ldap-property-mapping)
|
- Property mappings: Define which LDAP properties map to which authentik properties. The default set of property mappings is generated for Active Directory. See also [LDAP Property Mappings](property-mappings/index.md#ldap-property-mapping)
|
||||||
|
|
|
||||||
|
|
@ -142,6 +142,7 @@ module.exports = {
|
||||||
"releases/0.14",
|
"releases/0.14",
|
||||||
"releases/2021.1",
|
"releases/2021.1",
|
||||||
"releases/2021.2",
|
"releases/2021.2",
|
||||||
|
"releases/2021.3",
|
||||||
],
|
],
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
|
||||||
Reference in a new issue