3.8 KiB
| title | slug |
|---|---|
| Release 2021.5 | 2021.5 |
Headline Changes
- LDAP Provider
:::info This feature is still in technical preview, so please report any Bugs you run into on GitHub :::
You can now configure an LDAP Provider for applications that don't support any newer protocols or require LDAP.
All users and groups in authentik's database are searchable. Currently, there is a limited support for filters (you can only search for objectClass), but this will be expanded in further releases.
Binding against the LDAP Server uses a flow in the background. This allows you to use the same policies and flows as you do for web-based logins. The only limitation is that currently only identification and password stages are supported, due to how LDAP works.
-
Compatibility with forwardAuth/auth_request
The authentik proxy is now compatible with forwardAuth (traefik) / auth_request (nginx). All that is required is the latest version of the outpost, and the correct config from here.
-
Docker images for ARM
Docker images are now built for amd64, arm64, arm v7 and arm v8.
-
Reduced setup complexity
The authentik server now requires less containers. The static container (as well as the traefik when using docker-compose) are no longer required. As the first stage of a migration to Golang instead of Python, authentik now runs behind an in-container reverse proxy, which hosts the static files.
-
New Plex authentication source
The plex source (previously a provider for the OAuth Source) has been rewritten to a dedicated Source.
You can now limit access to authentik based on which servers a Plex user is member of.
-
Configurable source behaviour
You can now configure how a source behaves after the user has authenticated themselves to the source. Previously, authentik always checked the unique identifier from the source, enrolled the user when the identifier didn't exist and authenticated the user otherwise.
Now you can configure how the matching should be done:
- Identifier: Keeps the old behaviour, can lead to duplicate user accounts
- Email (link): If a user with the same Email address exists, they are linked. Can have security implications when a source doesn't validate email addresses.
- Email (deny): Deny the flow if the Email address is already used.
- Username (link): If a user with the same username address exists, they are linked. Can have security implications when a username is used with another source.
- Username (deny): Deny the flow if the username address is already used.
Minor changes
- Improved compatibility of the flow interface with password managers.
- Improved compatibility when using SAML Sources with a redirect binding.
- Improved configurability of outpost docker image name for managed Outposts.
- Add customization of access code validity for OAuth2 Providers.
- Add ability to configure no login fields on identification stage to only allow logins with Sources.
- Add single-use flag for invitations to delete token after use.
- Fix sidebar not collapsible on mobile.
Upgrading
This release does not introduce any new requirements.
docker-compose
Download the latest docker-compose file from here. Afterwards, simply run docker-compose up -d.
:::warning The public port of the compose stack has been changed from 443 to 9000 and 9443 to prevent port contention. :::
Kubernetes
The helm chart has been rewritten by @dirtycajunrice and now lives on https://charts.goauthentik.io.
Please upgrade to the new chart using values from ArtifactHub.
The old repository will stil exist for backwards-compatibility.