diff --git a/.github/actions/cherry-pick/action.yml b/.github/actions/cherry-pick/action.yml index 5c6318677b..0511da8eaf 100644 --- a/.github/actions/cherry-pick/action.yml +++ b/.github/actions/cherry-pick/action.yml @@ -134,12 +134,7 @@ runs: # Determine which labels to process if [ "${REASON}" = "label_added_to_merged_pr" ]; then - # Only process the specific label that was just added - if [ "$EVENT_NAME" = "issues" ]; then - LABEL_NAME="$LABEL_NAME_CTX" - else - LABEL_NAME="$LABEL_NAME_CTX" - fi + LABEL_NAME="$LABEL_NAME_CTX" if [[ "$LABEL_NAME" =~ ^backport/(.+)$ ]]; then echo "labels=$LABEL_NAME" >> $GITHUB_OUTPUT diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 074d6e1031..e14f69ac27 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -37,7 +37,7 @@ runs: sudo rsync -a --delete /tmp/empty/ /usr/local/lib/android/ - name: Install uv if: ${{ contains(inputs.dependencies, 'python') }} - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v5 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v5 with: enable-cache: true - name: Setup python @@ -64,7 +64,7 @@ runs: rustflags: "" - name: Setup rust dependencies if: ${{ contains(inputs.dependencies, 'rust') }} - uses: taiki-e/install-action@6887963ccf37a9ddcd8c5fa4baeb3e1e5fd61fa1 # v2 + uses: taiki-e/install-action@0631aa6515c7d545823c67cfae7ef4fc7f490154 # v2 with: tool: cargo-deny cargo-machete cargo-llvm-cov nextest - name: Setup node (root, web) diff --git a/.github/actions/test-results/action.yml b/.github/actions/test-results/action.yml index 017453bbee..7d5b037b95 100644 --- a/.github/actions/test-results/action.yml +++ b/.github/actions/test-results/action.yml @@ -10,12 +10,12 @@ inputs: runs: using: "composite" steps: - - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v5 + - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v5 with: files: ${{ inputs.files }} flags: ${{ inputs.flags }} use_oidc: true - - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v5 + - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v5 with: files: ${{ inputs.files }} flags: ${{ inputs.flags }} diff --git a/.github/workflows/_reusable-docker-build-single.yml b/.github/workflows/_reusable-docker-build-single.yml index 959c76f298..8b216961e7 100644 --- a/.github/workflows/_reusable-docker-build-single.yml +++ b/.github/workflows/_reusable-docker-build-single.yml @@ -42,7 +42,7 @@ jobs: # Needed for checkout contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: prepare variables diff --git a/.github/workflows/_reusable-docker-build.yml b/.github/workflows/_reusable-docker-build.yml index f95c684289..43ef25fae4 100644 --- a/.github/workflows/_reusable-docker-build.yml +++ b/.github/workflows/_reusable-docker-build.yml @@ -49,7 +49,7 @@ jobs: tags: ${{ steps.ev.outputs.imageTagsJSON }} shouldPush: ${{ steps.ev.outputs.shouldPush }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: prepare variables uses: ./.github/actions/docker-push-variables id: ev @@ -69,7 +69,7 @@ jobs: matrix: tag: ${{ fromJson(needs.get-tags.outputs.tags) }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: prepare variables uses: ./.github/actions/docker-push-variables id: ev @@ -90,7 +90,7 @@ jobs: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: int128/docker-manifest-create-action@b9d644eaa3312dd895ffdafb19333a7b266e6ba9 # v2 + - uses: int128/docker-manifest-create-action@126c2b2195800ebc112cffe9ad6c2e2cce16eff2 # v2 id: build with: tags: ${{ matrix.tag }} diff --git a/.github/workflows/ci-api-docs.yml b/.github/workflows/ci-api-docs.yml index 949ef023e5..e3aa493cef 100644 --- a/.github/workflows/ci-api-docs.yml +++ b/.github/workflows/ci-api-docs.yml @@ -21,7 +21,7 @@ jobs: command: - prettier-check steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -31,7 +31,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -60,7 +60,7 @@ jobs: - lint - build steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v5 with: name: api-docs diff --git a/.github/workflows/ci-aws-cfn.yml b/.github/workflows/ci-aws-cfn.yml index 8696655d73..263fea8700 100644 --- a/.github/workflows/ci-aws-cfn.yml +++ b/.github/workflows/ci-aws-cfn.yml @@ -21,7 +21,7 @@ jobs: check-changes-applied: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - uses: ./.github/actions/setup-node diff --git a/.github/workflows/ci-docs-source.yml b/.github/workflows/ci-docs-source.yml index 42fb0fb46d..c3bc20374b 100644 --- a/.github/workflows/ci-docs-source.yml +++ b/.github/workflows/ci-docs-source.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 120 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: generate docs diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml index e057e6a719..f690e6484b 100644 --- a/.github/workflows/ci-docs.yml +++ b/.github/workflows/ci-docs.yml @@ -23,7 +23,7 @@ jobs: command: - prettier-check steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -34,7 +34,7 @@ jobs: env: NODE_ENV: production steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node name: Setup Node.js with: @@ -46,7 +46,7 @@ jobs: env: NODE_ENV: production steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: website @@ -61,7 +61,7 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: Set up QEMU diff --git a/.github/workflows/ci-main-daily.yml b/.github/workflows/ci-main-daily.yml index 025c82afe3..7958dd6c14 100644 --- a/.github/workflows/ci-main-daily.yml +++ b/.github/workflows/ci-main-daily.yml @@ -22,7 +22,7 @@ jobs: - version-2026-2 - version-2026-5 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - run: | set -euo pipefail current="$(pwd)" diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml index 60ea365cc8..9a3977f1a8 100644 --- a/.github/workflows/ci-main.yml +++ b/.github/workflows/ci-main.yml @@ -51,7 +51,7 @@ jobs: deps: rust-nightly runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup with: @@ -61,7 +61,7 @@ jobs: test-gen: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: Setup authentik env @@ -77,7 +77,7 @@ jobs: test-migrations: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: run migrations @@ -103,7 +103,7 @@ jobs: - 18-alpine run_id: [1, 2, 3, 4, 5] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: fetch-depth: 0 - name: checkout stable @@ -179,7 +179,7 @@ jobs: - 18-alpine run_id: [1, 2, 3, 4, 5] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup with: @@ -199,7 +199,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Create k8s Kind Cluster @@ -252,7 +252,7 @@ jobs: glob: tests/e2e/test_endpoints_* profiles: selenium steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Setup e2e env @@ -306,7 +306,7 @@ jobs: - name: ssf_transmitter glob: tests/openid_conformance/test_ssf_transmitter.py steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Setup e2e env (chrome, etc) @@ -348,7 +348,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup with: @@ -407,7 +407,7 @@ jobs: pull-requests: write timeout-minutes: 120 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: prepare variables diff --git a/.github/workflows/ci-outpost.yml b/.github/workflows/ci-outpost.yml index 5a22f214f8..563099e71a 100644 --- a/.github/workflows/ci-outpost.yml +++ b/.github/workflows/ci-outpost.yml @@ -21,7 +21,7 @@ jobs: lint-golint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -40,7 +40,7 @@ jobs: test-unittest: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -82,7 +82,7 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - name: Set up QEMU @@ -139,7 +139,7 @@ jobs: goos: [linux] goarch: [amd64, arm64] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: ${{ github.event.pull_request.head.sha }} - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml index 6d111fce63..64d1f658e3 100644 --- a/.github/workflows/ci-web.yml +++ b/.github/workflows/ci-web.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: web @@ -34,7 +34,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: web @@ -59,7 +59,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: ./.github/actions/setup-node with: working-directory: web diff --git a/.github/workflows/gen-image-compress.yml b/.github/workflows/gen-image-compress.yml index 1edaeb7705..2b9c288b70 100644 --- a/.github/workflows/gen-image-compress.yml +++ b/.github/workflows/gen-image-compress.yml @@ -33,7 +33,7 @@ jobs: with: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: token: ${{ steps.generate_token.outputs.token }} - name: Compress images diff --git a/.github/workflows/gen-update-webauthn-mds.yml b/.github/workflows/gen-update-webauthn-mds.yml index dac6e9e3ab..1702e404d0 100644 --- a/.github/workflows/gen-update-webauthn-mds.yml +++ b/.github/workflows/gen-update-webauthn-mds.yml @@ -20,7 +20,7 @@ jobs: with: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: token: ${{ steps.generate_token.outputs.token }} - name: Setup authentik env diff --git a/.github/workflows/gh-cherry-pick.yml b/.github/workflows/gh-cherry-pick.yml index bc068081b7..75b31c56ea 100644 --- a/.github/workflows/gh-cherry-pick.yml +++ b/.github/workflows/gh-cherry-pick.yml @@ -17,7 +17,7 @@ jobs: private-key: ${{ secrets.GH_APP_PRIV_KEY }} env: GH_APP_ID: ${{ secrets.GH_APP_ID }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 if: ${{ steps.app-token.outcome != 'skipped' }} with: fetch-depth: 0 diff --git a/.github/workflows/gh-gha-cache-cleanup.yml b/.github/workflows/gh-gha-cache-cleanup.yml index c32944572d..d80bf1a72c 100644 --- a/.github/workflows/gh-gha-cache-cleanup.yml +++ b/.github/workflows/gh-gha-cache-cleanup.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Cleanup run: | diff --git a/.github/workflows/packages-npm-publish.yml b/.github/workflows/packages-npm-publish.yml index 5f97c5b465..8489b0d504 100644 --- a/.github/workflows/packages-npm-publish.yml +++ b/.github/workflows/packages-npm-publish.yml @@ -32,7 +32,7 @@ jobs: - packages/logger-js - packages/esbuild-plugin-live-reload steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: fetch-depth: 2 - uses: ./.github/actions/setup-node diff --git a/.github/workflows/qa-codeql.yml b/.github/workflows/qa-codeql.yml index 726c696413..b5a8d3b45e 100644 --- a/.github/workflows/qa-codeql.yml +++ b/.github/workflows/qa-codeql.yml @@ -24,14 +24,14 @@ jobs: language: ["go", "javascript", "python"] steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Setup authentik env uses: ./.github/actions/setup - name: Initialize CodeQL - uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 + uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 diff --git a/.github/workflows/qa-dependency-review.yml b/.github/workflows/qa-dependency-review.yml index c02653bd08..5a7669e25d 100644 --- a/.github/workflows/qa-dependency-review.yml +++ b/.github/workflows/qa-dependency-review.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: # Block PRs that introduce a *new* dependency with a known diff --git a/.github/workflows/qa-semgrep.yml b/.github/workflows/qa-semgrep.yml index 39c89e8c2f..fdb170e4d5 100644 --- a/.github/workflows/qa-semgrep.yml +++ b/.github/workflows/qa-semgrep.yml @@ -26,5 +26,5 @@ jobs: image: semgrep/semgrep if: (github.actor != 'dependabot[bot]') steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - run: semgrep ci diff --git a/.github/workflows/release-branch-off.yml b/.github/workflows/release-branch-off.yml index 4063d41460..54927527bd 100644 --- a/.github/workflows/release-branch-off.yml +++ b/.github/workflows/release-branch-off.yml @@ -34,7 +34,7 @@ jobs: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - name: Checkout main - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: main token: "${{ steps.app-token.outputs.token }}" @@ -62,7 +62,7 @@ jobs: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - name: Checkout main - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: main token: ${{ steps.generate_token.outputs.token }} diff --git a/.github/workflows/release-next-branch.yml b/.github/workflows/release-next-branch.yml index aae7862faa..ae9ac84636 100644 --- a/.github/workflows/release-next-branch.yml +++ b/.github/workflows/release-next-branch.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest environment: internal-production steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: main - run: | diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 736b9bd149..ea8ab0ee0c 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -31,7 +31,7 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Set up QEMU uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - name: Set up Docker Buildx @@ -83,7 +83,7 @@ jobs: - radius - rac steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -145,7 +145,7 @@ jobs: goos: [linux, darwin] goarch: [amd64, arm64] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 with: go-version-file: "go.mod" @@ -182,7 +182,7 @@ jobs: AWS_REGION: eu-central-1 runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 with: role-to-assume: "arn:aws:iam::016170277896:role/github_goauthentik_authentik" @@ -198,7 +198,7 @@ jobs: - build-outpost-binary runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: Run test suite in final docker images run: | echo "PG_PASS=$(openssl rand 32 | base64 -w 0)" >> lifecycle/container/.env @@ -214,7 +214,7 @@ jobs: - build-outpost-binary runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 - name: prepare variables uses: ./.github/actions/docker-push-variables id: ev @@ -228,7 +228,7 @@ jobs: container=$(docker container create ${{ steps.ev.outputs.imageMainName }}) docker cp ${container}:web/ . - name: Create a Sentry.io release - uses: getsentry/action-release@f71adb49d4b2aeeda98052d3de234bbb0f3e03ab # v3 + uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3 continue-on-error: true env: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml index ef1e583bdc..6c004ab589 100644 --- a/.github/workflows/release-tag.yml +++ b/.github/workflows/release-tag.yml @@ -52,7 +52,7 @@ jobs: needs: - check-inputs steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: "version-${{ needs.check-inputs.outputs.major_version }}" - name: Setup authentik env @@ -76,7 +76,7 @@ jobs: run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: GH_TOKEN: "${{ steps.app-token.outputs.token }}" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: ref: "version-${{ needs.check-inputs.outputs.major_version }}" token: "${{ steps.app-token.outputs.token }}" @@ -129,7 +129,7 @@ jobs: run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: GH_TOKEN: "${{ steps.app-token.outputs.token }}" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: repository: "${{ github.repository_owner }}/helm" token: "${{ steps.app-token.outputs.token }}" @@ -171,7 +171,7 @@ jobs: run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: GH_TOKEN: "${{ steps.app-token.outputs.token }}" - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 with: repository: "${{ github.repository_owner }}/version" token: "${{ steps.app-token.outputs.token }}" diff --git a/.github/workflows/translation-extract-compile.yml b/.github/workflows/translation-extract-compile.yml index 4791ff674e..e290d81719 100644 --- a/.github/workflows/translation-extract-compile.yml +++ b/.github/workflows/translation-extract-compile.yml @@ -25,11 +25,11 @@ jobs: with: client-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIV_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 if: ${{ github.event_name != 'pull_request' }} with: token: ${{ steps.generate_token.outputs.token }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5 if: ${{ github.event_name == 'pull_request' }} - name: Setup authentik env uses: ./.github/actions/setup diff --git a/Cargo.lock b/Cargo.lock index b475976d63..08179d8e4c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2642,9 +2642,9 @@ dependencies = [ [[package]] name = "pyo3" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12" +checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c" dependencies = [ "libc", "once_cell", @@ -2656,18 +2656,18 @@ dependencies = [ [[package]] name = "pyo3-build-config" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e" +checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078" dependencies = [ "target-lexicon", ] [[package]] name = "pyo3-ffi" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e" +checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b" dependencies = [ "libc", "pyo3-build-config", @@ -2675,9 +2675,9 @@ dependencies = [ [[package]] name = "pyo3-macros" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813" +checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771" dependencies = [ "proc-macro2", "pyo3-macros-backend", @@ -2687,13 +2687,12 @@ dependencies = [ [[package]] name = "pyo3-macros-backend" -version = "0.28.3" +version = "0.29.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb" +checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362" dependencies = [ "heck", "proc-macro2", - "pyo3-build-config", "quote", "syn", ] @@ -4578,9 +4577,9 @@ dependencies = [ [[package]] name = "which" -version = "8.0.2" +version = "8.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "81995fafaaaf6ae47a7d0cc83c67caf92aeb7e5331650ae6ff856f7c0c60c459" +checksum = "c789537cf2f7f55be8e6192f92e464174ee55f91af622777f7f1ceb0dbccd03e" dependencies = [ "libc", ] diff --git a/Cargo.toml b/Cargo.toml index 02f085538f..802f80573d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -48,8 +48,8 @@ metrics-exporter-prometheus = { version = "= 0.18.3", default-features = false } nix = { version = "= 0.31.3", features = ["hostname", "signal"] } notify = "= 8.2.0" pin-project-lite = "= 0.2.17" -pyo3 = "= 0.28.3" -pyo3-build-config = "= 0.28.3" +pyo3 = "= 0.29.0" +pyo3-build-config = "= 0.29.0" regex = "= 1.12.3" reqwest = { version = "= 0.13.4", features = [ "form", @@ -113,7 +113,7 @@ tracing-subscriber = { version = "= 0.3.23", features = [ ] } url = "= 2.5.8" uuid = { version = "= 1.23.2", features = ["serde", "v4"] } -which = "= 8.0.2" +which = "= 8.0.3" ak-axum = { package = "authentik-axum", version = "2026.8.0-rc1", path = "./packages/ak-axum" } ak-client = { package = "authentik-client", version = "2026.8.0-rc1", path = "./packages/client-rust" } diff --git a/authentik/blueprints/tests/fixtures/conditional_fields.yaml b/authentik/blueprints/tests/fixtures/conditional_fields.yaml index 4e87f5f155..481454f4b4 100644 --- a/authentik/blueprints/tests/fixtures/conditional_fields.yaml +++ b/authentik/blueprints/tests/fixtures/conditional_fields.yaml @@ -31,7 +31,7 @@ entries: slug: "%(uid)s-source" attrs: name: "%(uid)s-source" - provider_type: azuread + provider_type: entraid consumer_key: "%(uid)s" consumer_secret: "%(uid)s" icon: https://goauthentik.io/img/icon.png diff --git a/authentik/blueprints/v1/importer.py b/authentik/blueprints/v1/importer.py index 4e66d7d293..26e46d0791 100644 --- a/authentik/blueprints/v1/importer.py +++ b/authentik/blueprints/v1/importer.py @@ -323,6 +323,42 @@ class Importer: serializer.instance = model_instance return serializer + def _save_with_retry( + self, serializer: BaseSerializer, entry: BlueprintEntry, raise_errors: bool + ) -> Model | None: + """Save a serializer, retrying once on IntegrityError by re-fetching the existing instance. + + Returns the saved instance, or None when recovery failed and raise_errors is False. + Raises EntryInvalidError / IntegrityError when raise_errors is True and recovery + is not possible. + """ + try: + with atomic(): + return serializer.save() + except IntegrityError: + self.logger.debug( + "Integrity error during save, retrying after re-fetching instance", + entry=entry, + ) + # Race condition: another process committed the same object between our + # SELECT and INSERT. Re-validate so we pick up the now-existing instance. + try: + retry_serializer = self._validate_single(entry) + except EntryInvalidError as exc: + self.logger.warning(f"Entry invalid on retry: {exc}", entry=entry, error=exc) + if raise_errors: + raise exc + return None + if not retry_serializer: + return None + try: + return retry_serializer.save() + except IntegrityError: + self.logger.warning("Integrity error persists on retry", entry=entry) + if raise_errors: + raise + return None + def _apply_permissions(self, instance: Model, entry: BlueprintEntry): """Apply object-level permissions for an entry""" for perm in entry.get_permissions(self._import): @@ -393,7 +429,9 @@ class Importer: pk=instance.pk, ) else: - instance = serializer.save() + instance = self._save_with_retry(serializer, entry, raise_errors) + if instance is None: + return False self.logger.debug("Updated model", model=instance) if "pk" in entry.identifiers: self.__pk_map[entry.identifiers["pk"]] = instance.pk diff --git a/authentik/core/templates/base/skeleton.html b/authentik/core/templates/base/skeleton.html index 89cc7a4c9e..f6bbec300b 100644 --- a/authentik/core/templates/base/skeleton.html +++ b/authentik/core/templates/base/skeleton.html @@ -12,7 +12,7 @@ - {# Darkreader breaks the site regardless of theme as its not compatible with webcomponents, and we default to a dark theme based on preferred colour-scheme #} + {# Darkreader breaks the site regardless of theme as its not compatible with webcomponents, and we default to a dark theme based on preferred color-scheme #} {% block title %}{% trans title|default:brand.branding_title %}{% endblock %} diff --git a/authentik/endpoints/connectors/agent/api/connectors.py b/authentik/endpoints/connectors/agent/api/connectors.py index 9c62448cad..e787ae271b 100644 --- a/authentik/endpoints/connectors/agent/api/connectors.py +++ b/authentik/endpoints/connectors/agent/api/connectors.py @@ -7,7 +7,7 @@ from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_sche from rest_framework.decorators import action from rest_framework.exceptions import PermissionDenied, ValidationError from rest_framework.fields import ChoiceField -from rest_framework.permissions import AllowAny, IsAuthenticated +from rest_framework.permissions import IsAuthenticated from rest_framework.relations import PrimaryKeyRelatedField from rest_framework.request import Request from rest_framework.response import Response @@ -118,8 +118,7 @@ class AgentConnectorViewSet( methods=["POST"], detail=False, authentication_classes=[AgentEnrollmentAuth], - # Permissions are handled via AgentEnrollmentAuth - permission_classes=[AllowAny], + permission_classes=[IsAuthenticated], ) def enroll(self, request: Request): token: EnrollmentToken = request.auth @@ -154,8 +153,7 @@ class AgentConnectorViewSet( methods=["GET"], detail=False, authentication_classes=[AgentAuth], - # Permissions are handled via AgentAuth - permission_classes=[AllowAny], + permission_classes=[IsAuthenticated], ) def agent_config(self, request: Request): token: DeviceToken = request.auth @@ -174,8 +172,7 @@ class AgentConnectorViewSet( methods=["POST"], detail=False, authentication_classes=[AgentAuth], - # Permissions are handled via AgentAuth - permission_classes=[AllowAny], + permission_classes=[IsAuthenticated], ) def check_in(self, request: Request): token: DeviceToken = request.auth diff --git a/authentik/endpoints/connectors/agent/tests/test_agent_api.py b/authentik/endpoints/connectors/agent/tests/test_agent_api.py index 17758729b8..d107283a1f 100644 --- a/authentik/endpoints/connectors/agent/tests/test_agent_api.py +++ b/authentik/endpoints/connectors/agent/tests/test_agent_api.py @@ -124,6 +124,14 @@ class TestAgentAPI(APITestCase): ) self.assertEqual(response.status_code, 403) + @reconcile_app("authentik_crypto") + def test_config_none(self): + response = self.client.get( + reverse("authentik_api:agentconnector-agent-config"), + HTTP_AUTHORIZATION="Bearer foo", + ) + self.assertEqual(response.status_code, 403) + def test_check_in(self): response = self.client.post( reverse("authentik_api:agentconnector-check-in"), diff --git a/authentik/events/apps.py b/authentik/events/apps.py index ccca6df76b..df77288763 100644 --- a/authentik/events/apps.py +++ b/authentik/events/apps.py @@ -7,13 +7,6 @@ from authentik.lib.config import CONFIG, ENV_PREFIX from authentik.lib.utils.time import fqdn_rand from authentik.tasks.schedules.common import ScheduleSpec -# TODO: Deprecated metric - remove in 2024.2 or later -GAUGE_TASKS = Gauge( - "authentik_system_tasks", - "System tasks and their status", - ["tenant", "task_name", "task_uid", "status"], -) - SYSTEM_TASK_TIME = Histogram( "authentik_system_tasks_time_seconds", "Runtime of system tasks", diff --git a/authentik/events/logs.py b/authentik/events/logs.py index 09b8148283..bcf665fc44 100644 --- a/authentik/events/logs.py +++ b/authentik/events/logs.py @@ -49,15 +49,6 @@ class LogEventSerializer(PassiveSerializer): event = CharField() attributes = DictField() - # TODO(2024.6?): This is a migration helper to return a correct API response for logs that - # have been saved in an older format (mostly just list[str] with just the messages) - def to_representation(self, instance): - if isinstance(instance, str): - instance = LogEvent(instance, "", "") - elif isinstance(instance, list): - instance = [LogEvent(x, "", "") for x in instance] - return super().to_representation(instance) - @contextmanager def capture_logs(log_default_output=True) -> Generator[list[LogEvent]]: diff --git a/authentik/flows/views/executor.py b/authentik/flows/views/executor.py index 0b2ebdefdb..2aa4779b1f 100644 --- a/authentik/flows/views/executor.py +++ b/authentik/flows/views/executor.py @@ -196,7 +196,7 @@ class FlowExecutorView(APIView): return self.handle_invalid_flow(exc) except EmptyFlowException as exc: self._logger.warning("f(exec): Flow is empty", exc=exc) - # To match behaviour with loading an empty flow plan from cache, + # To match behavior with loading an empty flow plan from cache, # we don't show an error message here, but rather call _flow_done() return self._flow_done() # We don't save the Plan after getting the next stage diff --git a/authentik/lib/avatars.py b/authentik/lib/avatars.py index 735ef99626..74851d6eaf 100644 --- a/authentik/lib/avatars.py +++ b/authentik/lib/avatars.py @@ -59,7 +59,7 @@ def avatar_mode_gravatar(user: User, mode: str) -> str | None: def generate_colors(text: str) -> tuple[str, str]: - """Generate colours based on `text`""" + """Generate colors based on `text`""" color = ( int(md5(text.lower().encode("utf-8"), usedforsecurity=False).hexdigest(), 16) % 0xFFFFFF ) # nosec diff --git a/authentik/providers/ldap/api.py b/authentik/providers/ldap/api.py index 228a2b729e..5bcff04bc4 100644 --- a/authentik/providers/ldap/api.py +++ b/authentik/providers/ldap/api.py @@ -91,7 +91,7 @@ class LDAPOutpostConfigSerializer(ModelSerializer): unbind_flow_slug = SerializerMethodField() def get_application_slug(self, instance: LDAPProvider) -> str: - """Prioritise backchannel slug over direct application slug""" + """Prioritize backchannel slug over direct application slug""" if instance.backchannel_application: return instance.backchannel_application.slug return instance.application.slug diff --git a/authentik/providers/oauth2/views/end_session.py b/authentik/providers/oauth2/views/end_session.py index 8eb55a44dd..a0f8d23ca2 100644 --- a/authentik/providers/oauth2/views/end_session.py +++ b/authentik/providers/oauth2/views/end_session.py @@ -84,8 +84,7 @@ class EndSessionView(PolicyAccessView): "id_token_hint_decode_failed" ) from None - # Validate post_logout_redirect_uri against registered URIs - if request_redirect_uri: + if request_redirect_uri and self.provider.post_logout_redirect_uris: # OIDC Certification: id_token_hint required with post_logout_redirect_uri if not id_token_hint: raise TokenError("invalid_request").with_cause("id_token_hint_missing") diff --git a/authentik/rbac/permissions.py b/authentik/rbac/permissions.py index e86f9897a2..2e1cb905e2 100644 --- a/authentik/rbac/permissions.py +++ b/authentik/rbac/permissions.py @@ -22,7 +22,7 @@ class ObjectPermissions(DjangoObjectPermissions): lookup = getattr(view, "lookup_url_kwarg", None) or getattr(view, "lookup_field", None) if lookup and lookup in view.kwargs: return True - # Legacy behaviour: + # Legacy behavior: # Allow creation of objects even without explicit permission queryset = self._queryset(view) required_perms = self.get_required_permissions(request.method, queryset.model) diff --git a/authentik/sources/oauth/apps.py b/authentik/sources/oauth/apps.py index 032154c48f..dedd69246a 100644 --- a/authentik/sources/oauth/apps.py +++ b/authentik/sources/oauth/apps.py @@ -10,7 +10,6 @@ LOGGER = get_logger() AUTHENTIK_SOURCES_OAUTH_TYPES = [ "authentik.sources.oauth.types.apple", - "authentik.sources.oauth.types.azure_ad", "authentik.sources.oauth.types.discord", "authentik.sources.oauth.types.entra_id", "authentik.sources.oauth.types.facebook", diff --git a/authentik/sources/oauth/migrations/0014_migrate_azuread_to_entraid.py b/authentik/sources/oauth/migrations/0014_migrate_azuread_to_entraid.py new file mode 100644 index 0000000000..944d1c6bf2 --- /dev/null +++ b/authentik/sources/oauth/migrations/0014_migrate_azuread_to_entraid.py @@ -0,0 +1,23 @@ +# Generated by Django 5.2.14 on 2026-05-09 19:01 + +from django.db import migrations + + +def migrate_azuread_to_entraid(apps, schema_editor): + OAuthSource = apps.get_model("authentik_sources_oauth", "OAuthSource") + + db_alias = schema_editor.connection.alias + OAuthSource.objects.using(db_alias).filter(provider_type="azuread").update( + provider_type="entraid" + ) + + +class Migration(migrations.Migration): + + dependencies = [ + ("authentik_sources_oauth", "0013_useroauthsourceconnection_refresh_token"), + ] + + operations = [ + migrations.RunPython(migrate_azuread_to_entraid, migrations.RunPython.noop), + ] diff --git a/authentik/sources/oauth/models.py b/authentik/sources/oauth/models.py index 3e57e0e4d8..ec35e96f6a 100644 --- a/authentik/sources/oauth/models.py +++ b/authentik/sources/oauth/models.py @@ -251,17 +251,6 @@ class GoogleOAuthSource(CreatableType, OAuthSource): verbose_name_plural = _("Google OAuth Sources") -class AzureADOAuthSource(CreatableType, OAuthSource): - """(Deprecated) Social Login using Azure AD.""" - - class Meta: - abstract = True - verbose_name = _("Azure AD OAuth Source") - verbose_name_plural = _("Azure AD OAuth Sources") - - -# TODO: When removing this, add a migration for OAuthSource that sets -# provider_type to `entraid` if it is currently `azuread` class EntraIDOAuthSource(CreatableType, OAuthSource): """Social Login using Entra ID.""" diff --git a/authentik/sources/oauth/types/azure_ad.py b/authentik/sources/oauth/types/azure_ad.py deleted file mode 100644 index 34680b3569..0000000000 --- a/authentik/sources/oauth/types/azure_ad.py +++ /dev/null @@ -1,17 +0,0 @@ -"""AzureAD OAuth2 Views""" - -from authentik.sources.oauth.types.entra_id import EntraIDType -from authentik.sources.oauth.types.registry import registry - -# TODO: When removing this, add a migration for OAuthSource that sets -# provider_type to `entraid` if it is currently `azuread` - - -@registry.register() -class AzureADType(EntraIDType): - """Azure AD Type definition""" - - verbose_name = "Azure AD" - name = "azuread" - - urls_customizable = True diff --git a/authentik/sources/oauth/types/github.py b/authentik/sources/oauth/types/github.py index 92b32fdb12..3c951f7925 100644 --- a/authentik/sources/oauth/types/github.py +++ b/authentik/sources/oauth/types/github.py @@ -76,7 +76,7 @@ class GitHubType(SourceType): chosen_email = info.get("email") if not chosen_email: # The GitHub Userprofile API only returns an email address if the profile - # has a public email address set (despite us asking for user:email, this behaviour + # has a public email address set (despite us asking for user:email, this behavior # doesn't change.). So we fetch all the user's email addresses emails = client.get_github_emails(token) for email in emails: diff --git a/authentik/stages/authenticator/models.py b/authentik/stages/authenticator/models.py index 428623f4f0..ef4f4b34b0 100644 --- a/authentik/stages/authenticator/models.py +++ b/authentik/stages/authenticator/models.py @@ -291,7 +291,7 @@ class VerifyNotAllowed: class ThrottlingMixin(models.Model): """ - Mixin class for models that want throttling behaviour. + Mixin class for models that want throttling behavior. This implements exponential back-off for verifying tokens. Subclasses must implement :meth:`get_throttle_factor`, and must use the diff --git a/authentik/stages/authenticator_sms/tests.py b/authentik/stages/authenticator_sms/tests.py index b7c944e31f..15d2c7e4a6 100644 --- a/authentik/stages/authenticator_sms/tests.py +++ b/authentik/stages/authenticator_sms/tests.py @@ -362,7 +362,7 @@ class AuthenticatorSMSStageTests(FlowTestCase): class TestSMSDeviceThrottling(ThrottlingTestMixin, TestCase): - """Test ThrottlingMixin behaviour on SMSDevice.verify_token""" + """Test ThrottlingMixin behavior on SMSDevice.verify_token""" def setUp(self): super().setUp() diff --git a/authentik/stages/captcha/api.py b/authentik/stages/captcha/api.py index cb33ff4d2c..959d30df00 100644 --- a/authentik/stages/captcha/api.py +++ b/authentik/stages/captcha/api.py @@ -17,6 +17,7 @@ class CaptchaStageSerializer(StageSerializer): "private_key", "js_url", "api_url", + "request_content_type", "interactive", "score_min_threshold", "score_max_threshold", diff --git a/authentik/stages/captcha/migrations/0005_captchastage_request_content_type.py b/authentik/stages/captcha/migrations/0005_captchastage_request_content_type.py new file mode 100644 index 0000000000..6c7d24dbe7 --- /dev/null +++ b/authentik/stages/captcha/migrations/0005_captchastage_request_content_type.py @@ -0,0 +1,24 @@ +# Generated by Django 5.2.14 on 2026-05-14 23:58 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ("authentik_stages_captcha", "0004_captchastage_interactive"), + ] + + operations = [ + migrations.AddField( + model_name="captchastage", + name="request_content_type", + field=models.TextField( + choices=[ + ("application/x-www-form-urlencoded", "Form encoded"), + ("application/json", "JSON"), + ], + default="application/x-www-form-urlencoded", + ), + ), + ] diff --git a/authentik/stages/captcha/models.py b/authentik/stages/captcha/models.py index fb5a6dac28..776911b91e 100644 --- a/authentik/stages/captcha/models.py +++ b/authentik/stages/captcha/models.py @@ -8,6 +8,13 @@ from rest_framework.serializers import BaseSerializer from authentik.flows.models import Stage +class CaptchaRequestContentType(models.TextChoices): + """Supported request content types for CAPTCHA verification.""" + + FORM = "application/x-www-form-urlencoded", _("Form encoded") + JSON = "application/json", _("JSON") + + class CaptchaStage(Stage): """Verify the user is human using Google's reCaptcha/other compatible CAPTCHA solutions.""" @@ -30,6 +37,10 @@ class CaptchaStage(Stage): js_url = models.TextField(default="https://www.recaptcha.net/recaptcha/api.js") api_url = models.TextField(default="https://www.recaptcha.net/recaptcha/api/siteverify") + request_content_type = models.TextField( + choices=CaptchaRequestContentType.choices, + default=CaptchaRequestContentType.FORM, + ) @property def serializer(self) -> type[BaseSerializer]: diff --git a/authentik/stages/captcha/stage.py b/authentik/stages/captcha/stage.py index 9e582e5614..66b823e7a7 100644 --- a/authentik/stages/captcha/stage.py +++ b/authentik/stages/captcha/stage.py @@ -15,7 +15,7 @@ from authentik.flows.challenge import ( from authentik.flows.stage import ChallengeStageView from authentik.lib.utils.http import get_http_session from authentik.root.middleware import ClientIPMiddleware -from authentik.stages.captcha.models import CaptchaStage +from authentik.stages.captcha.models import CaptchaRequestContentType, CaptchaStage LOGGER = get_logger() PLAN_CONTEXT_CAPTCHA = "captcha" @@ -35,17 +35,23 @@ class CaptchaChallenge(WithUserInfoChallenge): def verify_captcha_token(stage: CaptchaStage, token: str, remote_ip: str, key: str | None = None): """Validate captcha token""" + payload = { + "secret": key or stage.private_key, + "response": token, + "remoteip": remote_ip, + } + body_kwargs = ( + {"json": payload} + if stage.request_content_type == CaptchaRequestContentType.JSON + else {"data": payload} + ) try: response = get_http_session().post( stage.api_url, headers={ - "Content-type": "application/x-www-form-urlencoded", - }, - data={ - "secret": key or stage.private_key, - "response": token, - "remoteip": remote_ip, + "Content-Type": stage.request_content_type, }, + **body_kwargs, ) response.raise_for_status() data = response.json() diff --git a/authentik/stages/captcha/tests.py b/authentik/stages/captcha/tests.py index 41bceb9f43..39a7b4a32e 100644 --- a/authentik/stages/captcha/tests.py +++ b/authentik/stages/captcha/tests.py @@ -10,7 +10,7 @@ from authentik.flows.planner import FlowPlan from authentik.flows.tests import FlowTestCase from authentik.flows.views.executor import SESSION_KEY_PLAN from authentik.lib.generators import generate_id -from authentik.stages.captcha.models import CaptchaStage +from authentik.stages.captcha.models import CaptchaRequestContentType, CaptchaStage from authentik.stages.captcha.stage import ( PLAN_CONTEXT_CAPTCHA_PRIVATE_KEY, PLAN_CONTEXT_CAPTCHA_SITE_KEY, @@ -56,6 +56,39 @@ class TestCaptchaStage(FlowTestCase): ) self.assertEqual(response.status_code, 200) self.assertStageRedirects(response, reverse("authentik_core:root-redirect")) + self.assertEqual( + mock.request_history[0].headers["Content-Type"], + CaptchaRequestContentType.FORM, + ) + self.assertIn("response=PASSED", mock.request_history[0].text) + + @Mocker() + def test_valid_json_content_type(self, mock: Mocker): + """Test valid captcha with JSON verification request""" + self.stage.request_content_type = CaptchaRequestContentType.JSON + self.stage.save() + mock.post( + "https://www.recaptcha.net/recaptcha/api/siteverify", + json={ + "success": True, + "score": 0.5, + }, + ) + plan = FlowPlan(flow_pk=self.flow.pk.hex, bindings=[self.binding], markers=[StageMarker()]) + session = self.client.session + session[SESSION_KEY_PLAN] = plan + session.save() + response = self.client.post( + reverse("authentik_api:flow-executor", kwargs={"flow_slug": self.flow.slug}), + {"token": "PASSED"}, + ) + self.assertEqual(response.status_code, 200) + self.assertStageRedirects(response, reverse("authentik_core:root-redirect")) + self.assertEqual( + mock.request_history[0].headers["Content-Type"], + CaptchaRequestContentType.JSON, + ) + self.assertEqual(mock.request_history[0].json()["response"], "PASSED") @Mocker() def test_valid_override(self, mock: Mocker): diff --git a/authentik/stages/invitation/stage.py b/authentik/stages/invitation/stage.py index 451840bd3a..fc1bf082ef 100644 --- a/authentik/stages/invitation/stage.py +++ b/authentik/stages/invitation/stage.py @@ -18,7 +18,7 @@ PLAN_CONTEXT_INVITATION = "invitation" class InvitationStageView(StageView): - """Finalise Authentication flow by logging the user in""" + """Finalize Authentication flow by logging the user in""" def get_token(self) -> str | None: """Get token from saved get-arguments or prompt_data""" diff --git a/authentik/stages/user_delete/stage.py b/authentik/stages/user_delete/stage.py index 3ea73f1268..5feb96c422 100644 --- a/authentik/stages/user_delete/stage.py +++ b/authentik/stages/user_delete/stage.py @@ -10,7 +10,7 @@ from authentik.flows.stage import StageView class UserDeleteStageView(StageView): - """Finalise unenrollment flow by deleting the user object.""" + """Finalize unenrollment flow by deleting the user object.""" def dispatch(self, request: HttpRequest) -> HttpResponse: """Delete currently pending user""" diff --git a/authentik/stages/user_login/stage.py b/authentik/stages/user_login/stage.py index f379bbc594..4fa7b6dc72 100644 --- a/authentik/stages/user_login/stage.py +++ b/authentik/stages/user_login/stage.py @@ -50,7 +50,7 @@ class UserLoginChallengeResponse(ChallengeResponse): class UserLoginStageView(ChallengeStageView): - """Finalise Authentication flow by logging the user in""" + """Finalize Authentication flow by logging the user in""" response_class = UserLoginChallengeResponse diff --git a/authentik/stages/user_write/stage.py b/authentik/stages/user_write/stage.py index c21a85cf5f..04d718a6b0 100644 --- a/authentik/stages/user_write/stage.py +++ b/authentik/stages/user_write/stage.py @@ -30,7 +30,7 @@ PLAN_CONTEXT_USER_PATH = "user_path" class UserWriteStageView(StageView): - """Finalise Enrollment flow by creating a user object.""" + """Finalize Enrollment flow by creating a user object.""" def __init__(self, executor: FlowExecutorView, **kwargs): super().__init__(executor, **kwargs) diff --git a/blueprints/schema.json b/blueprints/schema.json index 418f243020..602e676233 100644 --- a/blueprints/schema.json +++ b/blueprints/schema.json @@ -12945,10 +12945,9 @@ "type": "string", "enum": [ "apple", + "discord", "openidconnect", "entraid", - "azuread", - "discord", "facebook", "github", "gitlab", @@ -15106,6 +15105,14 @@ "minLength": 1, "title": "Api url" }, + "request_content_type": { + "type": "string", + "enum": [ + "application/x-www-form-urlencoded", + "application/json" + ], + "title": "Request content type" + }, "interactive": { "type": "boolean", "title": "Interactive" diff --git a/go.mod b/go.mod index 23232b6286..1cfb5ba50a 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/getsentry/sentry-go v0.46.2 github.com/go-http-utils/etag v0.0.0-20161124023236-513ea8f21eb1 github.com/go-ldap/ldap/v3 v3.4.13 - github.com/go-openapi/runtime v0.32.2 + github.com/go-openapi/runtime v0.32.3 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/uuid v1.6.0 github.com/gorilla/handlers v1.5.2 @@ -19,7 +19,7 @@ require ( github.com/gorilla/sessions v1.4.0 github.com/gorilla/websocket v1.5.3 github.com/grafana/pyroscope-go v1.3.1 - github.com/jackc/pgx/v5 v5.9.2 + github.com/jackc/pgx/v5 v5.10.0 github.com/jellydator/ttlcache/v3 v3.4.0 github.com/mitchellh/mapstructure v1.5.0 github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 @@ -51,14 +51,14 @@ require ( github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-openapi/analysis v0.25.0 // indirect + github.com/go-openapi/analysis v0.25.2 // indirect github.com/go-openapi/errors v0.22.7 // indirect github.com/go-openapi/jsonpointer v0.23.1 // indirect - github.com/go-openapi/jsonreference v0.21.5 // indirect + github.com/go-openapi/jsonreference v0.21.6 // indirect github.com/go-openapi/loads v0.23.3 // indirect github.com/go-openapi/runtime/server-middleware v0.30.0 // indirect - github.com/go-openapi/spec v0.22.4 // indirect - github.com/go-openapi/strfmt v0.26.2 // indirect + github.com/go-openapi/spec v0.22.5 // indirect + github.com/go-openapi/strfmt v0.26.3 // indirect github.com/go-openapi/swag/conv v0.26.0 // indirect github.com/go-openapi/swag/fileutils v0.26.0 // indirect github.com/go-openapi/swag/jsonname v0.26.0 // indirect @@ -68,7 +68,7 @@ require ( github.com/go-openapi/swag/stringutils v0.26.0 // indirect github.com/go-openapi/swag/typeutils v0.26.0 // indirect github.com/go-openapi/swag/yamlutils v0.26.0 // indirect - github.com/go-openapi/validate v0.25.2 // indirect + github.com/go-openapi/validate v0.25.3 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/grafana/pyroscope-go/godeltaprof v0.1.11 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect @@ -86,14 +86,14 @@ require ( github.com/prometheus/procfs v0.16.1 // indirect github.com/spf13/pflag v1.0.9 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/metric v1.43.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/crypto v0.51.0 // indirect - golang.org/x/net v0.54.0 // indirect - golang.org/x/sys v0.44.0 // indirect + golang.org/x/net v0.55.0 // indirect + golang.org/x/sys v0.45.0 // indirect golang.org/x/text v0.37.0 // indirect google.golang.org/protobuf v1.36.8 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index 18f422fc63..c184cdecb7 100644 --- a/go.sum +++ b/go.sum @@ -41,24 +41,24 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-openapi/analysis v0.25.0 h1:EnjAq1yO8wEO9HbPmY8vLPEIkdZuuFhCAKBPvCB7bCs= -github.com/go-openapi/analysis v0.25.0/go.mod h1:5WFTRE43WLkPG9r9OtlMfqkkvUTYLVVCIxLlEpyF8kE= +github.com/go-openapi/analysis v0.25.2 h1:I0vy4n3alz+DHTiN1PRhCb7QZxkK6g5YmswZKv2TKuw= +github.com/go-openapi/analysis v0.25.2/go.mod h1:Uhs1t/2XR10EnwONYILGEzw8gcfGIG5Xk5K2AxnhqDo= github.com/go-openapi/errors v0.22.7 h1:JLFBGC0Apwdzw3484MmBqspjPbwa2SHvpDm0u5aGhUA= github.com/go-openapi/errors v0.22.7/go.mod h1://QW6SD9OsWtH6gHllUCddOXDL0tk0ZGNYHwsw4sW3w= github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4= github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY= -github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE= -github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw= +github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y= +github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY= github.com/go-openapi/loads v0.23.3 h1:g5Xap1JfwKkUnZdn+S0L3SzBDpcTIYzZ5Qaag0YDkKQ= github.com/go-openapi/loads v0.23.3/go.mod h1:NOH07zLajXo8y55hom0omlHWDVVvCwBM/S+csCK8LqA= -github.com/go-openapi/runtime v0.32.2 h1:X9mZz716lFwYZ6bFV1BBnthNdHTy46zKM5Em4D1UISI= -github.com/go-openapi/runtime v0.32.2/go.mod h1:IfM3cpgencPuwBp5Uo16i2IQaE74odL7Q4DCGovIQac= +github.com/go-openapi/runtime v0.32.3 h1:J7Ycy5DJmhhP1By3NifhRUjnkXTrk21qbeqSULjwX8U= +github.com/go-openapi/runtime v0.32.3/go.mod h1:/WTQi0fa5DiGnnCXQKsTkSm15OzJp8Uz3H2t+67TBr4= github.com/go-openapi/runtime/server-middleware v0.30.0 h1:8rPoJ/xv7JL8BsovaqboKETlpWBArVh8n+0L/GyePog= github.com/go-openapi/runtime/server-middleware v0.30.0/go.mod h1:OYNT/TxNvB/VK5oe4htM2jDTwlEXuejVJmu0DVZfAMs= -github.com/go-openapi/spec v0.22.4 h1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ= -github.com/go-openapi/spec v0.22.4/go.mod h1:WQ6Ai0VPWMZgMT4XySjlRIE6GP1bGQOtEThn3gcWLtQ= -github.com/go-openapi/strfmt v0.26.2 h1:ysjheCh4i1rmFEo2LanhELDNucNzfWTZhUDKgWWPaFM= -github.com/go-openapi/strfmt v0.26.2/go.mod h1:fXh1e449cyUn2NYuz+wb3wARBUdMl7qPEZwX00nqivY= +github.com/go-openapi/spec v0.22.5 h1:KhO7RBlKQfonUWX2WzQCoLIXVA6AcNqDGZ3a1Dutdlo= +github.com/go-openapi/spec v0.22.5/go.mod h1:vxpOtMya5TXtENXKE5bKqv5NjocVhyhxHrlZfvKnZ74= +github.com/go-openapi/strfmt v0.26.3 h1:rzmslHarJgBbf2qfGge+X3htclQfmXqBZMm0Too0HhU= +github.com/go-openapi/strfmt v0.26.3/go.mod h1:a5nsUw0oRpQzZeOwx8bi6cKbzFZslpbCKt1LEot+KnQ= github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I= github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE= github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU= @@ -83,8 +83,8 @@ github.com/go-openapi/testify/enable/yaml/v2 v2.5.1 h1:q9NtHwK4qHF7yZziBPvZyv7zW github.com/go-openapi/testify/enable/yaml/v2 v2.5.1/go.mod h1:JW0MXIotCYps/XsgJnG3a8Q7rE5xAiBwoOD5OfaIQBk= github.com/go-openapi/testify/v2 v2.5.1 h1:TMdhCaw8fUNraVSf3Omoob1dO/AzBfhtFAPW0an6sBo= github.com/go-openapi/testify/v2 v2.5.1/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= -github.com/go-openapi/validate v0.25.2 h1:12NsfLAwGegqbGWr2CnvT65X/Q2USJipmJ9b7xDJZz0= -github.com/go-openapi/validate v0.25.2/go.mod h1:Pgl1LpPPGFnZ+ys4/hTlDiRYQdI1ocKypgE+8Q8BLfY= +github.com/go-openapi/validate v0.25.3 h1:4nzAIavcJ7WveHK2+V1UAkZK3kWcjzxZCzjfZAfavKs= +github.com/go-openapi/validate v0.25.3/go.mod h1:GemfuGMyYpIaBoKpX3z8sLywrmxpzWVOoJ7R0VeAVuk= github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= @@ -119,8 +119,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= -github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw= -github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= +github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0= +github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8= @@ -201,14 +201,14 @@ github.com/wwt/guac v1.3.2/go.mod h1:eKm+NrnK7A88l4UBEcYNpZQGMpZRryYKoz4D/0/n1C0 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= @@ -229,8 +229,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w= -golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ= +golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= +golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -247,8 +247,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= -golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= diff --git a/internal/outpost/ak/api.go b/internal/outpost/ak/api.go index 083fd66c9c..fd3aed15a2 100644 --- a/internal/outpost/ak/api.go +++ b/internal/outpost/ak/api.go @@ -55,7 +55,7 @@ type APIController struct { instanceUUID uuid.UUID } -// NewAPIController initialise new API Controller instance from URL and API token +// NewAPIController initialize new API Controller instance from URL and API token func NewAPIController(akURL url.URL, token string) *APIController { rsp := sentry.StartSpan(context.Background(), "authentik.outposts.init") log := log.WithField("logger", "authentik.outpost.ak-api-controller") diff --git a/internal/outpost/ak/global.go b/internal/outpost/ak/global.go index 0e211c412d..e3d7dcfae7 100644 --- a/internal/outpost/ak/global.go +++ b/internal/outpost/ak/global.go @@ -60,7 +60,7 @@ func doGlobalSetup(outpost api.Outpost, globalConfig *api.Config) { }, }) if err != nil { - l.WithField("env", globalConfig.ErrorReporting.Environment).WithError(err).Warning("Failed to initialise sentry") + l.WithField("env", globalConfig.ErrorReporting.Environment).WithError(err).Warning("Failed to initialize sentry") } } } diff --git a/internal/outpost/ldap/bind/direct/direct.go b/internal/outpost/ldap/bind/direct/direct.go index e678df4bba..1e2022c649 100644 --- a/internal/outpost/ldap/bind/direct/direct.go +++ b/internal/outpost/ldap/bind/direct/direct.go @@ -24,7 +24,7 @@ func NewDirectBinder(si server.LDAPServerInstance) *DirectBinder { si: si, log: log.WithField("logger", "authentik.outpost.ldap.binder.direct"), } - db.log.Info("initialised direct binder") + db.log.Info("initialized direct binder") return db } diff --git a/internal/outpost/ldap/bind/memory/memory.go b/internal/outpost/ldap/bind/memory/memory.go index ef8b691d2b..8a8208d3ed 100644 --- a/internal/outpost/ldap/bind/memory/memory.go +++ b/internal/outpost/ldap/bind/memory/memory.go @@ -32,14 +32,14 @@ func NewSessionBinder(si server.LDAPServerInstance, oldBinder bind.Binder) *Sess if oldSb, ok := oldBinder.(*SessionBinder); ok { sb.DirectBinder = oldSb.DirectBinder sb.sessions = oldSb.sessions - sb.log.Debug("re-initialised session binder") + sb.log.Debug("re-initialized session binder") return sb } } sb.sessions = ttlcache.New(ttlcache.WithDisableTouchOnHit[Credentials, ldap.LDAPResultCode]()) sb.DirectBinder = *direct.NewDirectBinder(si) go sb.sessions.Start() - sb.log.Debug("initialised session binder") + sb.log.Debug("initialized session binder") return sb } diff --git a/internal/outpost/ldap/search/memory/memory.go b/internal/outpost/ldap/search/memory/memory.go index 7d46a66d9f..ee57fd9c7f 100644 --- a/internal/outpost/ldap/search/memory/memory.go +++ b/internal/outpost/ldap/search/memory/memory.go @@ -42,12 +42,12 @@ func NewMemorySearcher(si server.LDAPServerInstance, existing search.Searcher) * if ems, ok := existing.(*MemorySearcher); ok { ems.si = si ems.fetch() - ems.log.Debug("re-initialised memory searcher") + ems.log.Debug("re-initialized memory searcher") return ems } } ms.fetch() - ms.log.Debug("initialised memory searcher") + ms.log.Debug("initialized memory searcher") return ms } diff --git a/internal/outpost/radius/handler_eap_log.go b/internal/outpost/radius/handler_eap_log.go index 4d40592d45..12e542db4a 100644 --- a/internal/outpost/radius/handler_eap_log.go +++ b/internal/outpost/radius/handler_eap_log.go @@ -1,6 +1,9 @@ package radius import ( + "fmt" + "strconv" + "beryju.io/radius-eap/protocol" "github.com/sirupsen/logrus" ) @@ -38,9 +41,28 @@ func (i *iter) At() (k string, v any) { if i.i+1 == len(i.f) { // Non even number of elements, add empty string. - return i.f[i.i].(string), "" + return toString(i.f[i.i]), "" + } + return toString(i.f[i.i]), i.f[i.i+1] +} + +func toString(v any) string { + switch t := v.(type) { + case string: + return t + case *string: + return *t + case bool: + return strconv.FormatBool(t) + case float32: + return strconv.FormatFloat(float64(t), 'f', -1, 64) + case float64: + return strconv.FormatFloat(t, 'f', -1, 64) + case int: + return strconv.FormatInt(int64(t), 10) + default: + return fmt.Sprintf("%s", t) } - return i.f[i.i].(string), i.f[i.i+1] } type logrusAdapter struct { diff --git a/lifecycle/aws/package-lock.json b/lifecycle/aws/package-lock.json index 6dc3577f04..26d15bcf21 100644 --- a/lifecycle/aws/package-lock.json +++ b/lifecycle/aws/package-lock.json @@ -9,7 +9,7 @@ "version": "0.0.0", "license": "MIT", "devDependencies": { - "aws-cdk": "^2.1125.0", + "aws-cdk": "^2.1126.0", "cross-env": "^10.1.0" }, "engines": { @@ -25,9 +25,9 @@ "license": "MIT" }, "node_modules/aws-cdk": { - "version": "2.1125.0", - "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1125.0.tgz", - "integrity": "sha512-QAvsE2XQMcyNOjMMqAS7eDADR9t6vcFcMQvhOmtLfDqgfJXSyTkHvzM5zgwZCdJ4FNqWr5Y/zXvL1Cv5ECKXwQ==", + "version": "2.1126.0", + "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1126.0.tgz", + "integrity": "sha512-uNoocb3vCPiAT3j9+SwL6pn/VVggHWBsgC2XpxyhNvYQYt6cE9BM/149GWwtdcwnLrPjnwW1+CV/5nSSh5dV+w==", "dev": true, "license": "Apache-2.0", "bin": { diff --git a/lifecycle/aws/package.json b/lifecycle/aws/package.json index 51ec72589c..bc7a5ec52b 100644 --- a/lifecycle/aws/package.json +++ b/lifecycle/aws/package.json @@ -7,7 +7,7 @@ "aws-cfn": "cross-env CI=false cdk synth --version-reporting=false > template.yaml" }, "devDependencies": { - "aws-cdk": "^2.1125.0", + "aws-cdk": "^2.1126.0", "cross-env": "^10.1.0" }, "engines": { diff --git a/lifecycle/container/Dockerfile b/lifecycle/container/Dockerfile index b57a11b3ba..aaee9343f7 100644 --- a/lifecycle/container/Dockerfile +++ b/lifecycle/container/Dockerfile @@ -116,9 +116,9 @@ RUN --mount=type=bind,target=rust-toolchain.toml,src=rust-toolchain.toml \ RUN cat /root/.rustup/settings.toml # Stage: Download uv -FROM ghcr.io/astral-sh/uv:0.11.19@sha256:b46b03ddfcfbf8f547af7e9eaefdf8a39c8cebcba7c98858d3162bd28cf536f6 AS uv +FROM ghcr.io/astral-sh/uv:0.11.20@sha256:eaa5f1a3305307aaf9e67fe2bbba1d85ebbb2d8a63bce23af21797bfafbe0f8b AS uv # Stage: Base python image -FROM ghcr.io/goauthentik/fips-python:3.14.5-slim-trixie-fips@sha256:b332680f098882472bc13d5452b7b348bf8e7ef4400588d85aca41acde77c1f4 AS python-base +FROM ghcr.io/goauthentik/fips-python:3.14.5-slim-trixie-fips@sha256:94d880542ff5e74bd50b874680fd68a04fe6bb34b7f25e8a081b62b7e1ae6dc3 AS python-base ENV VENV_PATH="/ak-root/.venv" \ PATH="/lifecycle:/ak-root/.venv/bin:$PATH" \ diff --git a/locale/en/LC_MESSAGES/django.po b/locale/en/LC_MESSAGES/django.po index ec23cf2ce9..6f636c5735 100644 --- a/locale/en/LC_MESSAGES/django.po +++ b/locale/en/LC_MESSAGES/django.po @@ -8,7 +8,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2026-05-22 00:36+0000\n" +"POT-Creation-Date: 2026-06-11 00:42+0000\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -3399,14 +3399,6 @@ msgstr "" msgid "Google OAuth Sources" msgstr "" -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Source" -msgstr "" - -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Sources" -msgstr "" - #: authentik/sources/oauth/models.py msgid "Entra ID OAuth Source" msgstr "" diff --git a/locale/en/dictionaries/integrations.txt b/locale/en/dictionaries/integrations.txt index 43e40ac016..07dc651786 100644 --- a/locale/en/dictionaries/integrations.txt +++ b/locale/en/dictionaries/integrations.txt @@ -9,6 +9,7 @@ Budibase Doki Doku dokuwiki +Dozzle Engomo Espo espocrm diff --git a/locale/fr_FR/LC_MESSAGES/django.mo b/locale/fr_FR/LC_MESSAGES/django.mo index 3ecd53392f..a5c785db04 100644 Binary files a/locale/fr_FR/LC_MESSAGES/django.mo and b/locale/fr_FR/LC_MESSAGES/django.mo differ diff --git a/locale/fr_FR/LC_MESSAGES/django.po b/locale/fr_FR/LC_MESSAGES/django.po index feb36304fe..55ecc2eab2 100644 --- a/locale/fr_FR/LC_MESSAGES/django.po +++ b/locale/fr_FR/LC_MESSAGES/django.po @@ -15,7 +15,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2026-05-22 00:36+0000\n" +"POT-Creation-Date: 2026-06-11 00:42+0000\n" "PO-Revision-Date: 2025-12-01 19:09+0000\n" "Last-Translator: Sp P, 2026\n" "Language-Team: French (France) (https://app.transifex.com/authentik/teams/119923/fr_FR/)\n" @@ -3790,14 +3790,6 @@ msgstr "Source d'OAuth Google" msgid "Google OAuth Sources" msgstr "Source d'OAuth Google" -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Source" -msgstr "Source d'OAuth Azure AD" - -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Sources" -msgstr "Source d'OAuth Azure AD" - #: authentik/sources/oauth/models.py msgid "Entra ID OAuth Source" msgstr "Source d'OAuth Entra ID" diff --git a/locale/hu_HU/LC_MESSAGES/django.mo b/locale/hu_HU/LC_MESSAGES/django.mo new file mode 100644 index 0000000000..f5fc6a7d07 Binary files /dev/null and b/locale/hu_HU/LC_MESSAGES/django.mo differ diff --git a/locale/hu_HU/LC_MESSAGES/django.po b/locale/hu_HU/LC_MESSAGES/django.po index 601b01c818..384418a924 100644 --- a/locale/hu_HU/LC_MESSAGES/django.po +++ b/locale/hu_HU/LC_MESSAGES/django.po @@ -12,7 +12,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2026-05-22 00:36+0000\n" +"POT-Creation-Date: 2026-06-11 00:42+0000\n" "PO-Revision-Date: 2025-12-01 19:09+0000\n" "Last-Translator: Gyula Kiss , 2026\n" "Language-Team: Hungarian (Hungary) (https://app.transifex.com/authentik/teams/119923/hu_HU/)\n" @@ -3780,14 +3780,6 @@ msgstr "Google OAuth forrás" msgid "Google OAuth Sources" msgstr "Google OAuth források" -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Source" -msgstr "Azure AD OAuth forrás" - -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Sources" -msgstr "Azure AD OAuth források" - #: authentik/sources/oauth/models.py msgid "Entra ID OAuth Source" msgstr "Entra ID OAuth forrás" diff --git a/locale/no_NO/LC_MESSAGES/django.po b/locale/no_NO/LC_MESSAGES/django.po index b329c081a9..3b01fb6a0f 100644 --- a/locale/no_NO/LC_MESSAGES/django.po +++ b/locale/no_NO/LC_MESSAGES/django.po @@ -12,7 +12,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2026-05-22 00:36+0000\n" +"POT-Creation-Date: 2026-06-11 00:42+0000\n" "PO-Revision-Date: 2025-12-01 19:09+0000\n" "Last-Translator: Raphael Cancelliere, 2026\n" "Language-Team: Norwegian (Norway) (https://app.transifex.com/authentik/teams/119923/no_NO/)\n" @@ -3692,14 +3692,6 @@ msgstr "Google OAuth-kilde" msgid "Google OAuth Sources" msgstr "Google OAuth-kilder" -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Source" -msgstr "Azure AD OAuth-kilde" - -#: authentik/sources/oauth/models.py -msgid "Azure AD OAuth Sources" -msgstr "Azure AD OAuth-kilder" - #: authentik/sources/oauth/models.py msgid "Entra ID OAuth Source" msgstr "Entra ID OAuth-kilde" diff --git a/package-lock.json b/package-lock.json index 8bec035241..3dbf893e38 100644 --- a/package-lock.json +++ b/package-lock.json @@ -21492,9 +21492,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.3", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz", - "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==", + "version": "1.8.4", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", + "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", "license": "MIT", "engines": { "node": ">= 0.4" diff --git a/packages/ak-common/src/arbiter.rs b/packages/ak-common/src/arbiter.rs index 1e92e20dcf..9f4c0a4d6c 100644 --- a/packages/ak-common/src/arbiter.rs +++ b/packages/ak-common/src/arbiter.rs @@ -210,7 +210,7 @@ impl Arbiter { /// Consumers listening on this must also listen on [`Arbiter::graceful_shutdown`], as only one /// of those is set upon shutdown. /// - /// It is also possible to use [`Arbiter::shutdown`] when the behaviour is the same between a + /// It is also possible to use [`Arbiter::shutdown`] when the behavior is the same between a /// fast and a graceful shutdown. pub fn fast_shutdown(&self) -> WaitForCancellationFuture<'_> { self.fast_shutdown.cancelled() @@ -221,7 +221,7 @@ impl Arbiter { /// Consumers listening on this must also listen on [`Arbiter::fast_shutdown`], as only one /// of those is set upon shutdown. /// - /// It is also possible to use [`Arbiter::shutdown`] when the behaviour is the same between a + /// It is also possible to use [`Arbiter::shutdown`] when the behavior is the same between a /// fast and a graceful shutdown. pub fn graceful_shutdown(&self) -> WaitForCancellationFuture<'_> { self.graceful_shutdown.cancelled() diff --git a/packages/client-go/model_ldap_outpost_config.go b/packages/client-go/model_ldap_outpost_config.go index 5999a1d89c..73eee24804 100644 --- a/packages/client-go/model_ldap_outpost_config.go +++ b/packages/client-go/model_ldap_outpost_config.go @@ -28,7 +28,7 @@ type LDAPOutpostConfig struct { BindFlowSlug string `json:"bind_flow_slug"` // Get slug for unbind flow, defaulting to brand's default flow. UnbindFlowSlug NullableString `json:"unbind_flow_slug"` - // Prioritise backchannel slug over direct application slug + // Prioritize backchannel slug over direct application slug ApplicationSlug string `json:"application_slug"` Certificate NullableString `json:"certificate,omitempty"` TlsServerName *string `json:"tls_server_name,omitempty"` diff --git a/packages/client-rust/src/models/ldap_outpost_config.rs b/packages/client-rust/src/models/ldap_outpost_config.rs index cae97c78c7..b97e9f96ca 100644 --- a/packages/client-rust/src/models/ldap_outpost_config.rs +++ b/packages/client-rust/src/models/ldap_outpost_config.rs @@ -25,7 +25,7 @@ pub struct LdapOutpostConfig { /// Get slug for unbind flow, defaulting to brand's default flow. #[serde(rename = "unbind_flow_slug", deserialize_with = "Option::deserialize")] pub unbind_flow_slug: Option, - /// Prioritise backchannel slug over direct application slug + /// Prioritize backchannel slug over direct application slug #[serde(rename = "application_slug")] pub application_slug: String, #[serde( diff --git a/packages/client-ts/src/models/CaptchaStage.ts b/packages/client-ts/src/models/CaptchaStage.ts index 2c6b18c9dc..13430ab177 100644 --- a/packages/client-ts/src/models/CaptchaStage.ts +++ b/packages/client-ts/src/models/CaptchaStage.ts @@ -14,6 +14,11 @@ import type { FlowSet } from "./FlowSet"; import { FlowSetFromJSON } from "./FlowSet"; +import type { RequestContentTypeEnum } from "./RequestContentTypeEnum"; +import { + RequestContentTypeEnumFromJSON, + RequestContentTypeEnumToJSON, +} from "./RequestContentTypeEnum"; /** * CaptchaStage Serializer @@ -81,6 +86,12 @@ export interface CaptchaStage { * @memberof CaptchaStage */ apiUrl?: string; + /** + * + * @type {RequestContentTypeEnum} + * @memberof CaptchaStage + */ + requestContentType?: RequestContentTypeEnum; /** * * @type {boolean} @@ -141,6 +152,10 @@ export function CaptchaStageFromJSONTyped(json: any, ignoreDiscriminator: boolea publicKey: json["public_key"], jsUrl: json["js_url"] == null ? undefined : json["js_url"], apiUrl: json["api_url"] == null ? undefined : json["api_url"], + requestContentType: + json["request_content_type"] == null + ? undefined + : RequestContentTypeEnumFromJSON(json["request_content_type"]), interactive: json["interactive"] == null ? undefined : json["interactive"], scoreMinThreshold: json["score_min_threshold"] == null ? undefined : json["score_min_threshold"], @@ -171,6 +186,7 @@ export function CaptchaStageToJSONTyped( public_key: value["publicKey"], js_url: value["jsUrl"], api_url: value["apiUrl"], + request_content_type: RequestContentTypeEnumToJSON(value["requestContentType"]), interactive: value["interactive"], score_min_threshold: value["scoreMinThreshold"], score_max_threshold: value["scoreMaxThreshold"], diff --git a/packages/client-ts/src/models/CaptchaStageRequest.ts b/packages/client-ts/src/models/CaptchaStageRequest.ts index 1c68022168..37792dc7ef 100644 --- a/packages/client-ts/src/models/CaptchaStageRequest.ts +++ b/packages/client-ts/src/models/CaptchaStageRequest.ts @@ -12,6 +12,12 @@ * Do not edit the class manually. */ +import type { RequestContentTypeEnum } from "./RequestContentTypeEnum"; +import { + RequestContentTypeEnumFromJSON, + RequestContentTypeEnumToJSON, +} from "./RequestContentTypeEnum"; + /** * CaptchaStage Serializer * @export @@ -48,6 +54,12 @@ export interface CaptchaStageRequest { * @memberof CaptchaStageRequest */ apiUrl?: string; + /** + * + * @type {RequestContentTypeEnum} + * @memberof CaptchaStageRequest + */ + requestContentType?: RequestContentTypeEnum; /** * * @type {boolean} @@ -101,6 +113,10 @@ export function CaptchaStageRequestFromJSONTyped( privateKey: json["private_key"], jsUrl: json["js_url"] == null ? undefined : json["js_url"], apiUrl: json["api_url"] == null ? undefined : json["api_url"], + requestContentType: + json["request_content_type"] == null + ? undefined + : RequestContentTypeEnumFromJSON(json["request_content_type"]), interactive: json["interactive"] == null ? undefined : json["interactive"], scoreMinThreshold: json["score_min_threshold"] == null ? undefined : json["score_min_threshold"], @@ -129,6 +145,7 @@ export function CaptchaStageRequestToJSONTyped( private_key: value["privateKey"], js_url: value["jsUrl"], api_url: value["apiUrl"], + request_content_type: RequestContentTypeEnumToJSON(value["requestContentType"]), interactive: value["interactive"], score_min_threshold: value["scoreMinThreshold"], score_max_threshold: value["scoreMaxThreshold"], diff --git a/packages/client-ts/src/models/LDAPOutpostConfig.ts b/packages/client-ts/src/models/LDAPOutpostConfig.ts index 0ca156ee92..3cb967deeb 100644 --- a/packages/client-ts/src/models/LDAPOutpostConfig.ts +++ b/packages/client-ts/src/models/LDAPOutpostConfig.ts @@ -52,7 +52,7 @@ export interface LDAPOutpostConfig { */ readonly unbindFlowSlug: string | null; /** - * Prioritise backchannel slug over direct application slug + * Prioritize backchannel slug over direct application slug * @type {string} * @memberof LDAPOutpostConfig */ diff --git a/packages/client-ts/src/models/PatchedCaptchaStageRequest.ts b/packages/client-ts/src/models/PatchedCaptchaStageRequest.ts index b616986c41..b2522615bb 100644 --- a/packages/client-ts/src/models/PatchedCaptchaStageRequest.ts +++ b/packages/client-ts/src/models/PatchedCaptchaStageRequest.ts @@ -12,6 +12,12 @@ * Do not edit the class manually. */ +import type { RequestContentTypeEnum } from "./RequestContentTypeEnum"; +import { + RequestContentTypeEnumFromJSON, + RequestContentTypeEnumToJSON, +} from "./RequestContentTypeEnum"; + /** * CaptchaStage Serializer * @export @@ -48,6 +54,12 @@ export interface PatchedCaptchaStageRequest { * @memberof PatchedCaptchaStageRequest */ apiUrl?: string; + /** + * + * @type {RequestContentTypeEnum} + * @memberof PatchedCaptchaStageRequest + */ + requestContentType?: RequestContentTypeEnum; /** * * @type {boolean} @@ -100,6 +112,10 @@ export function PatchedCaptchaStageRequestFromJSONTyped( privateKey: json["private_key"] == null ? undefined : json["private_key"], jsUrl: json["js_url"] == null ? undefined : json["js_url"], apiUrl: json["api_url"] == null ? undefined : json["api_url"], + requestContentType: + json["request_content_type"] == null + ? undefined + : RequestContentTypeEnumFromJSON(json["request_content_type"]), interactive: json["interactive"] == null ? undefined : json["interactive"], scoreMinThreshold: json["score_min_threshold"] == null ? undefined : json["score_min_threshold"], @@ -128,6 +144,7 @@ export function PatchedCaptchaStageRequestToJSONTyped( private_key: value["privateKey"], js_url: value["jsUrl"], api_url: value["apiUrl"], + request_content_type: RequestContentTypeEnumToJSON(value["requestContentType"]), interactive: value["interactive"], score_min_threshold: value["scoreMinThreshold"], score_max_threshold: value["scoreMaxThreshold"], diff --git a/packages/client-ts/src/models/ProviderTypeEnum.ts b/packages/client-ts/src/models/ProviderTypeEnum.ts index 8332d3668c..d5c0c5f8b4 100644 --- a/packages/client-ts/src/models/ProviderTypeEnum.ts +++ b/packages/client-ts/src/models/ProviderTypeEnum.ts @@ -18,10 +18,9 @@ */ export const ProviderTypeEnum = { Apple: "apple", + Discord: "discord", Openidconnect: "openidconnect", Entraid: "entraid", - Azuread: "azuread", - Discord: "discord", Facebook: "facebook", Github: "github", Gitlab: "gitlab", diff --git a/packages/client-ts/src/models/RequestContentTypeEnum.ts b/packages/client-ts/src/models/RequestContentTypeEnum.ts new file mode 100644 index 0000000000..e287dc0fa2 --- /dev/null +++ b/packages/client-ts/src/models/RequestContentTypeEnum.ts @@ -0,0 +1,58 @@ +/* tslint:disable */ +/* eslint-disable */ +/** + * authentik + * Making authentication simple. + * + * The version of the OpenAPI document: 2026.8.0-rc1 + * Contact: hello@goauthentik.io + * + * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech). + * https://openapi-generator.tech + * Do not edit the class manually. + */ + +/** + * + * @export + */ +export const RequestContentTypeEnum = { + ApplicationXWwwFormUrlencoded: "application/x-www-form-urlencoded", + ApplicationJson: "application/json", + UnknownDefaultOpenApi: "11184809", +} as const; +export type RequestContentTypeEnum = + (typeof RequestContentTypeEnum)[keyof typeof RequestContentTypeEnum]; + +export function instanceOfRequestContentTypeEnum(value: any): boolean { + for (const key in RequestContentTypeEnum) { + if (Object.prototype.hasOwnProperty.call(RequestContentTypeEnum, key)) { + if (RequestContentTypeEnum[key as keyof typeof RequestContentTypeEnum] === value) { + return true; + } + } + } + return false; +} + +export function RequestContentTypeEnumFromJSON(json: any): RequestContentTypeEnum { + return RequestContentTypeEnumFromJSONTyped(json, false); +} + +export function RequestContentTypeEnumFromJSONTyped( + json: any, + ignoreDiscriminator: boolean, +): RequestContentTypeEnum { + return json as RequestContentTypeEnum; +} + +export function RequestContentTypeEnumToJSON(value?: RequestContentTypeEnum | null): any { + return value as any; +} + +export function RequestContentTypeEnumToJSONTyped( + value: any, + ignoreDiscriminator: boolean, +): RequestContentTypeEnum { + return value as RequestContentTypeEnum; +} diff --git a/packages/client-ts/src/models/index.ts b/packages/client-ts/src/models/index.ts index da4090a4cf..3f9fc870ef 100644 --- a/packages/client-ts/src/models/index.ts +++ b/packages/client-ts/src/models/index.ts @@ -713,6 +713,7 @@ export * from "./RelatedRule"; export * from "./Reputation"; export * from "./ReputationPolicy"; export * from "./ReputationPolicyRequest"; +export * from "./RequestContentTypeEnum"; export * from "./Review"; export * from "./ReviewRequest"; export * from "./ReviewerGroup"; diff --git a/pyproject.toml b/pyproject.toml index 90502505af..11d4b94bf3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -9,7 +9,7 @@ dependencies = [ "argon2-cffi==25.1.0", "cachetools==7.1.4", "channels==4.3.2", - "cryptography==48.0.0", + "cryptography==48.0.1", "dacite==1.9.2", "deepmerge==2.0", "defusedxml==0.7.1", @@ -25,7 +25,7 @@ dependencies = [ "django-prometheus==2.5.0", "django-storages[s3]==1.14.6", "django-tenants==3.10.1", - "django==5.2.14", + "django==5.2.15", "djangoql==0.19.1", "djangorestframework==3.17.1", "docker==7.1.0", @@ -57,7 +57,7 @@ dependencies = [ "pyyaml==6.0.3", "requests-oauthlib==2.0.0", "scim2-filter-parser==0.7.0", - "sentry-sdk==2.61.0", + "sentry-sdk==2.61.1", "service-identity==24.2.0", "setproctitle==1.3.7", "structlog==25.5.0", @@ -66,7 +66,7 @@ dependencies = [ "ua-parser==1.0.2", "unidecode==1.4.0", "urllib3<3", - "uvicorn[standard]==0.48.0", + "uvicorn[standard]==0.49.0", "watchdog==6.0.0", "webauthn==2.7.1", "wsproto==1.3.2", @@ -83,7 +83,7 @@ dev = [ "colorama==0.4.6", "constructs==10.6.0", "coverage[toml]==7.14.1", - "daphne==4.2.1", + "daphne==4.2.2", "debugpy==1.8.21", "django-stubs[compatible-mypy]==6.0.5", "djangorestframework-stubs[compatible-mypy]==3.17.0", @@ -101,7 +101,7 @@ dev = [ "pytest-timeout==2.4.0", "pytest==9.0.3", "requests-mock==1.12.1", - "ruff==0.15.15", + "ruff==0.15.16", "selenium==4.44.0", "types-channels==4.3.0.20260518", "types-docker==7.1.0.20260518", diff --git a/schema.yml b/schema.yml index e024c64ea8..f21afc33db 100644 --- a/schema.yml +++ b/schema.yml @@ -5386,8 +5386,6 @@ paths: using this object tags: - endpoints - security: - - {} responses: '200': content: @@ -5457,8 +5455,6 @@ paths: application/json: schema: $ref: '#/components/schemas/DeviceFactsRequest' - security: - - {} responses: '204': description: Successfully checked in @@ -5479,8 +5475,6 @@ paths: schema: $ref: '#/components/schemas/EnrollRequest' required: true - security: - - {} responses: '200': content: @@ -36339,6 +36333,8 @@ components: type: string api_url: type: string + request_content_type: + $ref: '#/components/schemas/RequestContentTypeEnum' interactive: type: boolean score_min_threshold: @@ -36384,6 +36380,8 @@ components: api_url: type: string minLength: 1 + request_content_type: + $ref: '#/components/schemas/RequestContentTypeEnum' interactive: type: boolean score_min_threshold: @@ -41922,7 +41920,7 @@ components: readOnly: true application_slug: type: string - description: Prioritise backchannel slug over direct application slug + description: Prioritize backchannel slug over direct application slug readOnly: true certificate: type: string @@ -48266,6 +48264,8 @@ components: api_url: type: string minLength: 1 + request_content_type: + $ref: '#/components/schemas/RequestContentTypeEnum' interactive: type: boolean score_min_threshold: @@ -52670,10 +52670,9 @@ components: ProviderTypeEnum: enum: - apple + - discord - openidconnect - entraid - - azuread - - discord - facebook - github - gitlab @@ -53812,6 +53811,11 @@ components: minimum: -2147483648 required: - name + RequestContentTypeEnum: + enum: + - application/x-www-form-urlencoded + - application/json + type: string Review: type: object description: |- diff --git a/tests/e2e/compose.yml b/tests/e2e/compose.yml index 73c8677c5b..c48809c500 100644 --- a/tests/e2e/compose.yml +++ b/tests/e2e/compose.yml @@ -1,6 +1,6 @@ services: chromium: - image: ghcr.io/goauthentik/selenium:148.0-ak-0.43.2 + image: ghcr.io/goauthentik/selenium:148.0-ak-0.44.3 shm_size: 2g network_mode: host restart: always diff --git a/uv.lock b/uv.lock index 48bbddddcf..c114a48104 100644 --- a/uv.lock +++ b/uv.lock @@ -365,11 +365,11 @@ requires-dist = [ { name = "argon2-cffi", specifier = "==25.1.0" }, { name = "cachetools", specifier = "==7.1.4" }, { name = "channels", specifier = "==4.3.2" }, - { name = "cryptography", specifier = "==48.0.0" }, + { name = "cryptography", specifier = "==48.0.1" }, { name = "dacite", specifier = "==1.9.2" }, { name = "deepmerge", specifier = "==2.0" }, { name = "defusedxml", specifier = "==0.7.1" }, - { name = "django", specifier = "==5.2.14" }, + { name = "django", specifier = "==5.2.15" }, { name = "django-channels-postgres", editable = "packages/django-channels-postgres" }, { name = "django-countries", specifier = "==8.2.0" }, { name = "django-dramatiq-postgres", editable = "packages/django-dramatiq-postgres" }, @@ -413,7 +413,7 @@ requires-dist = [ { name = "pyyaml", specifier = "==6.0.3" }, { name = "requests-oauthlib", specifier = "==2.0.0" }, { name = "scim2-filter-parser", specifier = "==0.7.0" }, - { name = "sentry-sdk", specifier = "==2.61.0" }, + { name = "sentry-sdk", specifier = "==2.61.1" }, { name = "service-identity", specifier = "==24.2.0" }, { name = "setproctitle", specifier = "==1.3.7" }, { name = "structlog", specifier = "==25.5.0" }, @@ -422,7 +422,7 @@ requires-dist = [ { name = "ua-parser", specifier = "==1.0.2" }, { name = "unidecode", specifier = "==1.4.0" }, { name = "urllib3", specifier = "<3" }, - { name = "uvicorn", extras = ["standard"], specifier = "==0.48.0" }, + { name = "uvicorn", extras = ["standard"], specifier = "==0.49.0" }, { name = "watchdog", specifier = "==6.0.0" }, { name = "webauthn", specifier = "==2.7.1" }, { name = "wsproto", specifier = "==1.3.2" }, @@ -439,7 +439,7 @@ dev = [ { name = "colorama", specifier = "==0.4.6" }, { name = "constructs", specifier = "==10.6.0" }, { name = "coverage", extras = ["toml"], specifier = "==7.14.1" }, - { name = "daphne", specifier = "==4.2.1" }, + { name = "daphne", specifier = "==4.2.2" }, { name = "debugpy", specifier = "==1.8.21" }, { name = "django-stubs", extras = ["compatible-mypy"], specifier = "==6.0.5" }, { name = "djangorestframework-stubs", extras = ["compatible-mypy"], specifier = "==3.17.0" }, @@ -457,7 +457,7 @@ dev = [ { name = "pytest-randomly", specifier = "==4.1.0" }, { name = "pytest-timeout", specifier = "==2.4.0" }, { name = "requests-mock", specifier = "==1.12.1" }, - { name = "ruff", specifier = "==0.15.15" }, + { name = "ruff", specifier = "==0.15.16" }, { name = "selenium", specifier = "==4.44.0" }, { name = "types-channels", specifier = "==4.3.0.20260518" }, { name = "types-docker", specifier = "==7.1.0.20260518" }, @@ -964,55 +964,55 @@ wheels = [ [[package]] name = "cryptography" -version = "48.0.0" +version = "48.0.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cffi", marker = "platform_python_implementation != 'PyPy'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/9f/a9/db8f313fdcd85d767d4973515e1db101f9c71f95fced83233de224673757/cryptography-48.0.0.tar.gz", hash = "sha256:5c3932f4436d1cccb036cb0eaef46e6e2db91035166f1ad6505c3c9d5a635920", size = 832984, upload-time = "2026-05-04T22:59:38.133Z" } +sdist = { url = "https://files.pythonhosted.org/packages/12/45/870e7f4bef50e5f53b9f51d4428aee5290eedf58ba443f16b1ebb7ab8e66/cryptography-48.0.1.tar.gz", hash = "sha256:266f4ee051abb2f725b74ef8072b521ce1feacf685a3364fa6a6b45548db791a", size = 832989, upload-time = "2026-06-09T22:32:31.8Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/df/3d/01f6dd9190170a5a241e0e98c2d04be3664a9e6f5b9b872cde63aff1c3dd/cryptography-48.0.0-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:0c558d2cdffd8f4bbb30fc7134c74d2ca9a476f830bb053074498fbc86f41ed6", size = 8001587, upload-time = "2026-05-04T22:57:36.803Z" }, - { url = "https://files.pythonhosted.org/packages/b2/6e/e90527eef33f309beb811cf7c982c3aeffcce8e3edb178baa4ca3ae4a6fa/cryptography-48.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f5333311663ea94f75dd408665686aaf426563556bb5283554a3539177e03b8c", size = 4690433, upload-time = "2026-05-04T22:57:40.373Z" }, - { url = "https://files.pythonhosted.org/packages/90/04/673510ed51ddff56575f306cf1617d80411ee76831ccd3097599140efdfe/cryptography-48.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7995ef305d7165c3f11ae07f2517e5a4f1d5c18da1376a0a9ed496336b69e5f3", size = 4710620, upload-time = "2026-05-04T22:57:42.935Z" }, - { url = "https://files.pythonhosted.org/packages/14/d5/e9c4ef932c8d800490c34d8bd589d64a31d5890e27ec9e9ad532be893294/cryptography-48.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:40ba1f85eaa6959837b1d51c9767e230e14612eea4ef110ee8854ada22da1bf5", size = 4696283, upload-time = "2026-05-04T22:57:45.294Z" }, - { url = "https://files.pythonhosted.org/packages/0c/29/174b9dfb60b12d59ecfc6cfa04bc88c21b42a54f01b8aae09bb6e51e4c7f/cryptography-48.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:369a6348999f94bbd53435c894377b20ab95f25a9065c283570e70150d8abc3c", size = 5296573, upload-time = "2026-05-04T22:57:47.933Z" }, - { url = "https://files.pythonhosted.org/packages/95/38/0d29a6fd7d0d1373f0c0c88a04ba20e359b257753ac497564cd660fc1d55/cryptography-48.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:a0e692c683f4df67815a2d258b324e66f4738bd7a96a218c826dce4f4bd05d8f", size = 4743677, upload-time = "2026-05-04T22:57:50.067Z" }, - { url = "https://files.pythonhosted.org/packages/30/be/eef653013d5c63b6a490529e0316f9ac14a37602965d4903efed1399f32b/cryptography-48.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:18349bbc56f4743c8b12dc32e2bccb2cf83ee8b69a3bba74ef8ae857e26b3d25", size = 4330808, upload-time = "2026-05-04T22:57:52.301Z" }, - { url = "https://files.pythonhosted.org/packages/84/9e/500463e87abb7a0a0f9f256ec21123ecde0a7b5541a15e840ea54551fd81/cryptography-48.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:7e8eac43dfca5c4cccc6dad9a80504436fca53bb9bc3100a2386d730fbe6b602", size = 4695941, upload-time = "2026-05-04T22:57:54.603Z" }, - { url = "https://files.pythonhosted.org/packages/e3/dc/7303087450c2ec9e7fbb750e17c2abfbc658f23cbd0e54009509b7cc4091/cryptography-48.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9ccdac7d40688ecb5a3b4a604b8a88c8002e3442d6c60aead1db2a89a041560c", size = 5252579, upload-time = "2026-05-04T22:57:57.207Z" }, - { url = "https://files.pythonhosted.org/packages/d0/c0/7101d3b7215edcdc90c45da544961fd8ed2d6448f77577460fa75a8443f7/cryptography-48.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:bd72e68b06bb1e96913f97dd4901119bc17f39d4586a5adf2d3e47bc2b9d58b5", size = 4743326, upload-time = "2026-05-04T22:57:59.535Z" }, - { url = "https://files.pythonhosted.org/packages/ac/d8/5b833bad13016f562ab9d063d68199a4bd121d18458e439515601d3357ec/cryptography-48.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:59baa2cb386c4f0b9905bd6eb4c2a79a69a128408fd31d32ca4d7102d4156321", size = 4826672, upload-time = "2026-05-04T22:58:01.996Z" }, - { url = "https://files.pythonhosted.org/packages/98/e1/7074eb8bf3c135558c73fc2bcf0f5633f912e6fb87e868a55c454080ef09/cryptography-48.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9249e3cd978541d665967ac2cb2787fd6a62bddf1e75b3e347a594d7dacf4f74", size = 4972574, upload-time = "2026-05-04T22:58:03.968Z" }, - { url = "https://files.pythonhosted.org/packages/04/70/e5a1b41d325f797f39427aa44ef8baf0be500065ab6d8e10369d850d4a4f/cryptography-48.0.0-cp311-abi3-win32.whl", hash = "sha256:9c459db21422be75e2809370b829a87eb37f74cd785fc4aa9ea1e5f43b47cda4", size = 3294868, upload-time = "2026-05-04T22:58:06.467Z" }, - { url = "https://files.pythonhosted.org/packages/f4/ac/8ac51b4a5fc5932eb7ee5c517ba7dc8cd834f0048962b6b352f00f41ebf9/cryptography-48.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:5b012212e08b8dd5edc78ef54da83dd9892fd9105323b3993eff6bea65dc21d7", size = 3817107, upload-time = "2026-05-04T22:58:08.845Z" }, - { url = "https://files.pythonhosted.org/packages/6b/84/70e3feea9feea87fd7cbe77efb2712ae1e3e6edf10749dc6e95f4e60e455/cryptography-48.0.0-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:3cb07a3ed6431663cd321ea8a000a1314c74211f823e4177fefa2255e057d1ec", size = 7986556, upload-time = "2026-05-04T22:58:11.172Z" }, - { url = "https://files.pythonhosted.org/packages/89/6e/18e07a618bb5442ba10cf4df16e99c071365528aa570dfcb8c02e25a303b/cryptography-48.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8c7378637d7d88016fa6791c159f698b3d3eed28ebf844ac36b9dc04a14dae18", size = 4684776, upload-time = "2026-05-04T22:58:13.712Z" }, - { url = "https://files.pythonhosted.org/packages/be/6a/4ea3b4c6c6759794d5ee2103c304a5076dc4b19ae1f9fe47dba439e159e9/cryptography-48.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cc90c0b39b2e3c65ef52c804b72e3c58f8a04ab2a1871272798e5f9572c17d20", size = 4698121, upload-time = "2026-05-04T22:58:16.448Z" }, - { url = "https://files.pythonhosted.org/packages/2f/59/6ff6ad6cae03bb887da2a5860b2c9805f8dac969ef01ce563336c49bd1d1/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:76341972e1eff8b4bea859f09c0d3e64b96ce931b084f9b9b7db8ef364c30eff", size = 4690042, upload-time = "2026-05-04T22:58:18.544Z" }, - { url = "https://files.pythonhosted.org/packages/ca/b4/fc334ed8cfd705aca282fe4d8f5ae64a8e0f74932e9feecb344610cf6e4d/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:55b7718303bf06a5753dcdccf2f3945cf18ad7bffde41b61226e4db31ab89a9c", size = 5282526, upload-time = "2026-05-04T22:58:20.75Z" }, - { url = "https://files.pythonhosted.org/packages/11/08/9f8c5386cc4cd90d8255c7cdd0f5baf459a08502a09de30dc51f553d38dc/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:a64697c641c7b1b2178e573cbc31c7c6684cd56883a478d75143dbb7118036db", size = 4733116, upload-time = "2026-05-04T22:58:23.627Z" }, - { url = "https://files.pythonhosted.org/packages/b8/77/99307d7574045699f8805aa500fa0fb83422d115b5400a064ddd306d7750/cryptography-48.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:561215ea3879cb1cbbf272867e2efda62476f240fb58c64de6b393ae19246741", size = 4316030, upload-time = "2026-05-04T22:58:25.581Z" }, - { url = "https://files.pythonhosted.org/packages/fd/36/a608b98337af3cb2aff4818e406649d30572b7031918b04c87d979495348/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:ad64688338ed4bc1a6618076ba75fd7194a5f1797ac60b47afe926285adb3166", size = 4689640, upload-time = "2026-05-04T22:58:27.747Z" }, - { url = "https://files.pythonhosted.org/packages/dd/a6/825010a291b4438aecc1f568bc428189fc1175515223632477c07dc0a6df/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:906cbf0670286c6e0044156bc7d4af9cbb0ef6db9f73e52c3ec56ba6bdde5336", size = 5237657, upload-time = "2026-05-04T22:58:29.848Z" }, - { url = "https://files.pythonhosted.org/packages/b9/09/4e76a09b4caa29aad535ddc806f5d4c5d01885bd978bd984fbc6ca032cae/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:ea8990436d914540a40ab24b6a77c0969695ed52f4a4874c5137ccf7045a7057", size = 4732362, upload-time = "2026-05-04T22:58:32.009Z" }, - { url = "https://files.pythonhosted.org/packages/18/78/444fa04a77d0cb95f417dda20d450e13c56ba8e5220fc892a1658f44f882/cryptography-48.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c18684a7f0cc9a3cb60328f496b8e3372def7c5d2df39ac267878b05565aaaae", size = 4819580, upload-time = "2026-05-04T22:58:34.254Z" }, - { url = "https://files.pythonhosted.org/packages/38/85/ea67067c70a1fd4be2c63d35eeed82658023021affccc7b17705f8527dd2/cryptography-48.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:9be5aafa5736574f8f15f262adc81b2a9869e2cfe9014d52a44633905b40d52c", size = 4963283, upload-time = "2026-05-04T22:58:36.376Z" }, - { url = "https://files.pythonhosted.org/packages/75/54/cc6d0f3deac3e81c7f847e8a189a12b6cdd65059b43dad25d4316abd849a/cryptography-48.0.0-cp314-cp314t-win32.whl", hash = "sha256:c17dfe85494deaeddc5ce251aebd1d60bbe6afc8b62071bb0b469431a000124f", size = 3270954, upload-time = "2026-05-04T22:58:38.791Z" }, - { url = "https://files.pythonhosted.org/packages/49/67/cc947e288c0758a4e5473d1dcb743037ab7785541265a969240b8885441a/cryptography-48.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:27241b1dc9962e056062a8eef1991d02c3a24569c95975bd2322a8a52c6e5e12", size = 3797313, upload-time = "2026-05-04T22:58:40.746Z" }, - { url = "https://files.pythonhosted.org/packages/f2/63/61d4a4e1c6b6bab6ce1e213cd36a24c415d90e76d78c5eb8577c5541d2e8/cryptography-48.0.0-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:58d00498e8933e4a194f3076aee1b4a97dfec1a6da444535755822fe5d8b0b86", size = 7983482, upload-time = "2026-05-04T22:58:43.769Z" }, - { url = "https://files.pythonhosted.org/packages/d5/ac/f5b5995b87770c693e2596559ffafe195b4033a57f14a82268a2842953f3/cryptography-48.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:614d0949f4790582d2cc25553abd09dd723025f0c0e7c67376a1d77196743d6e", size = 4683266, upload-time = "2026-05-04T22:58:46.064Z" }, - { url = "https://files.pythonhosted.org/packages/ec/c6/8b14f67e18338fbc4adb76f66c001f5c3610b3e2d1837f268f47a347dbbb/cryptography-48.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7ce4bfae76319a532a2dc68f82cc32f5676ee792a983187dac07183690e5c66f", size = 4696228, upload-time = "2026-05-04T22:58:48.22Z" }, - { url = "https://files.pythonhosted.org/packages/ea/73/f808fbae9514bd91b47875b003f13e284c8c6bdfd904b7944e803937eec1/cryptography-48.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:2eb992bbd4661238c5a397594c83f5b4dc2bc5b848c365c8f991b6780efcc5c7", size = 4689097, upload-time = "2026-05-04T22:58:50.9Z" }, - { url = "https://files.pythonhosted.org/packages/93/01/d86632d7d28db8ae83221995752eeb6639ffb374c2d22955648cf8d52797/cryptography-48.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:22a5cb272895dce158b2cacdfdc3debd299019659f42947dbdac6f32d68fe832", size = 5283582, upload-time = "2026-05-04T22:58:53.017Z" }, - { url = "https://files.pythonhosted.org/packages/02/e1/50edc7a50334807cc4791fc4a0ce7468b4a1416d9138eab358bfc9a3d70b/cryptography-48.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2b4d59804e8408e2fea7d1fbaf218e5ec984325221db76e6a241a9abd6cdd95c", size = 4730479, upload-time = "2026-05-04T22:58:55.611Z" }, - { url = "https://files.pythonhosted.org/packages/6f/af/99a582b1b1641ff5911ac559beb45097cf79efd4ead4657f578ef1af2d47/cryptography-48.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:984a20b0f62a26f48a3396c72e4bc34c66e356d356bf370053066b3b6d54634a", size = 4326481, upload-time = "2026-05-04T22:58:57.607Z" }, - { url = "https://files.pythonhosted.org/packages/90/ee/89aa26a06ef0a7d7611788ffd571a7c50e368cc6a4d5eef8b4884e866edb/cryptography-48.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5a5ed8fde7a1d09376ca0b40e68cd59c69fe23b1f9768bd5824f54681626032a", size = 4688713, upload-time = "2026-05-04T22:59:00.077Z" }, - { url = "https://files.pythonhosted.org/packages/70/ba/bcb1b0bb7a33d4c7c0c4d4c7874b4a62ae4f56113a5f4baefa362dfb1f0f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:8cd666227ef7af430aa5914a9910e0ddd703e75f039cef0825cd0da71b6b711a", size = 5238165, upload-time = "2026-05-04T22:59:02.317Z" }, - { url = "https://files.pythonhosted.org/packages/c9/70/ca4003b1ce5ca3dc3186ada51908c8a9b9ff7d5cab83cc0d43ee14ec144f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:9071196d81abc88b3516ac8cdfad32e2b66dd4a5393a8e68a961e9161ddc6239", size = 4729947, upload-time = "2026-05-04T22:59:05.255Z" }, - { url = "https://files.pythonhosted.org/packages/44/a0/4ec7cf774207905aef1a8d11c3750d5a1db805eb380ee4e16df317870128/cryptography-48.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1e2d54c8be6152856a36f0882ab231e70f8ec7f14e93cf87db8a2ed056bf160c", size = 4822059, upload-time = "2026-05-04T22:59:07.802Z" }, - { url = "https://files.pythonhosted.org/packages/1e/75/a2e55f99c16fcac7b5d6c1eb19ad8e00799854d6be5ca845f9259eae1681/cryptography-48.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a5da777e32ffed6f85a7b2b3f7c5cbc88c146bfcd0a1d7baf5fcc6c52ee35dd4", size = 4960575, upload-time = "2026-05-04T22:59:09.851Z" }, - { url = "https://files.pythonhosted.org/packages/b8/23/6e6f32143ab5d8b36ca848a502c4bcd477ae75b9e1677e3530d669062578/cryptography-48.0.0-cp39-abi3-win32.whl", hash = "sha256:77a2ccbbe917f6710e05ba9adaa25fb5075620bf3ea6fb751997875aff4ae4bd", size = 3279117, upload-time = "2026-05-04T22:59:12.019Z" }, - { url = "https://files.pythonhosted.org/packages/9d/9a/0fea98a70cf1749d41d738836f6349d97945f7c89433a259a6c2642eefeb/cryptography-48.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:16cd65b9330583e4619939b3a3843eec1e6e789744bb01e7c7e2e62e33c239c8", size = 3792100, upload-time = "2026-05-04T22:59:14.884Z" }, + { url = "https://files.pythonhosted.org/packages/1b/bc/ee4137cbbe105652c0ee4252792b78fc8e7afa4b8e61d9d5dc05a7f45731/cryptography-48.0.1-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:3e4a1a3232eef2e6c732827d5722db29a0cc8b27af2a4d865b094cf954be9ca1", size = 8008324, upload-time = "2026-06-09T22:31:00.702Z" }, + { url = "https://files.pythonhosted.org/packages/d5/85/6379d42181bfc713094f081360fc5784d6c816b599d45e7f082502d173ce/cryptography-48.0.1-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:32143b24adb918f078134e1e230f1eb8cc04886b92c28b5f0041aaf3e5699225", size = 4696243, upload-time = "2026-06-09T22:32:33.446Z" }, + { url = "https://files.pythonhosted.org/packages/9c/87/c85d147b53323c7eb4d850920c8901377323c2a0ff8d79c262d4fee89aa2/cryptography-48.0.1-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0d27a5696721ef7a672b8c810f6aded391058e0b9486e63e6d93baf765da691", size = 4713235, upload-time = "2026-06-09T22:31:40.141Z" }, + { url = "https://files.pythonhosted.org/packages/79/58/67cbf8cf1ee7c54b439ca07bbecf8362c07afc11a3724fea70f745784add/cryptography-48.0.1-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:eb86ce1af36fe65041b6db9a8bb064ee621a7e5fded0f80d475ec243477cd242", size = 4702323, upload-time = "2026-06-09T22:31:42.191Z" }, + { url = "https://files.pythonhosted.org/packages/89/c6/24266ac10c47f6cd2a865f4446062b466da1d1f10b27189eac00e61bf0c9/cryptography-48.0.1-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:b024e784ad6c077ee0147b35ea9cbfc1e34e1fd4c1dcca214c2794d73a12df08", size = 5300085, upload-time = "2026-06-09T22:31:58.703Z" }, + { url = "https://files.pythonhosted.org/packages/d2/bb/cc4b78784f97efc8c5874c2a9743708d172be6663024b34a0467885ae0c8/cryptography-48.0.1-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3752f2dbc8f07a30aad2932c986cea495b03bb554887828225da104f732852b6", size = 4746137, upload-time = "2026-06-09T22:31:31.01Z" }, + { url = "https://files.pythonhosted.org/packages/1f/52/0c44de3f5267f8fbe8e835138017522a333436166e406f0db9b9e6e3033f/cryptography-48.0.1-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:bd81490cd5801d755cf97bb68ac191f14b708470b1c7cf4580f669b9c9264cd8", size = 4333867, upload-time = "2026-06-09T22:32:28.096Z" }, + { url = "https://files.pythonhosted.org/packages/9a/2e/772d7adbfa931537bc401640b7cac9976bff689bda187833e5d63b428e49/cryptography-48.0.1-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:66fd0771e7b9c6dcd44cf1120690d2338d16d72795cf40cae2786a39eba65429", size = 4701805, upload-time = "2026-06-09T22:31:38.284Z" }, + { url = "https://files.pythonhosted.org/packages/f8/a3/b06844f303873493c963caf581c04df31c7035e0c1b0f02c4814d319ec80/cryptography-48.0.1-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:3fd2ca57062b241c856670b073487d2e86c4637937ca5601e48f97bf8e11fc8f", size = 5258461, upload-time = "2026-06-09T22:31:04.187Z" }, + { url = "https://files.pythonhosted.org/packages/9f/13/8b765e2e12b07c74941caadb9d1c8fdc006c4dfbf2b8f2d610519758954d/cryptography-48.0.1-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:0ee6ea481db1ab889cba043ec1eda17bb9c1ea79db6722f779c3667f9f70322f", size = 4745488, upload-time = "2026-06-09T22:32:30.07Z" }, + { url = "https://files.pythonhosted.org/packages/2e/aa/48972bce55049b32a94f4907eda4d75fa385aad8a39506cc2fc72196ecf0/cryptography-48.0.1-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f2ceef93cb096aa3c4cc4b5c94ca6131f9196d28c64d6111533402a9b2054d41", size = 4830256, upload-time = "2026-06-09T22:31:43.868Z" }, + { url = "https://files.pythonhosted.org/packages/47/a2/e5079a032fb85cf6005046ca92bbd78b0c82dad2b5751ab8c311659da06f/cryptography-48.0.1-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9bd3f92d76217892b15df84ca256c2c113d386fdda7a7d8691aeeced976507c6", size = 4979117, upload-time = "2026-06-09T22:31:05.845Z" }, + { url = "https://files.pythonhosted.org/packages/b7/a0/8f50cae9c74e718ed769d63ed5c74bd0ea830c9550a74629cebd1b9c7bc7/cryptography-48.0.1-cp311-abi3-win32.whl", hash = "sha256:b9a32b876490d66c8bcc9963ef220199569748434ab01a9d6aaeabf88e7f5158", size = 3304154, upload-time = "2026-06-09T22:32:16.845Z" }, + { url = "https://files.pythonhosted.org/packages/c5/69/0572c77dbace6fef72f33755bd52ea399c71367250d366237f8691826b9e/cryptography-48.0.1-cp311-abi3-win_amd64.whl", hash = "sha256:39489bfca54c7a1f6b297efcd8bc608ab92d16c4ca631b0cad4da46724588b24", size = 3817138, upload-time = "2026-06-09T22:32:00.388Z" }, + { url = "https://files.pythonhosted.org/packages/42/06/3e768b4c3bc78201583fa35a0e18f640dd782ff41afba88f8545481a8874/cryptography-48.0.1-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:f817adc181390bd54f2f700107a7419040fb7c1bdf2fc26f36551a06a68c3345", size = 7989830, upload-time = "2026-06-09T22:31:07.8Z" }, + { url = "https://files.pythonhosted.org/packages/8a/13/6476736484b94041110c8340a3eb63962fea4975baea8cb4a512adb44d4d/cryptography-48.0.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d5d30989c6917b478b5817902e85fddaea2261efa8648383d965381ccb9e1ac4", size = 4689201, upload-time = "2026-06-09T22:31:09.745Z" }, + { url = "https://files.pythonhosted.org/packages/79/62/65a87f34d2a431546e2509b85d55e8c90df86d668f6731da64d538512ac2/cryptography-48.0.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:df637c05205ea7c1d7fbcbe54bbfea648a52951155f997af13d895d0ecc96991", size = 4702822, upload-time = "2026-06-09T22:32:24.409Z" }, + { url = "https://files.pythonhosted.org/packages/7f/59/810b5204b0a9b10f4b6bc06bd551a8b609803cd931806bc3b71884b225e5/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:869c3b8a53bfe27147832df48b32adadf558249d50e76cb3769d40e986b13265", size = 4694875, upload-time = "2026-06-09T22:32:08.737Z" }, + { url = "https://files.pythonhosted.org/packages/24/dc/d8ca05ffea724eec6d232ea6f18e74c269eb6bdfdcc9bfba689790d1325f/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:e361afba8918070d376df76f408a4f67fec0ee9cff81a99e48fe9a233ef59e17", size = 5290385, upload-time = "2026-06-09T22:31:15.212Z" }, + { url = "https://files.pythonhosted.org/packages/03/8c/3be6cb4da181f5bb6c19cf560c2359d60644a6b5fc5b57854e528f47b296/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:d069066deead00ac7f090be101be875a06855908f7ec004c27b8fefb4acfb411", size = 4737082, upload-time = "2026-06-09T22:32:22.66Z" }, + { url = "https://files.pythonhosted.org/packages/aa/f6/d5f60a5a1434dbfd949e227fd0065d194c7e6b6ac526b17f5c06152b8231/cryptography-48.0.1-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:09f73a725d582cef64b91281a322cd798d14a33b2b6f2b7ad9531dc336d84c02", size = 4325328, upload-time = "2026-06-09T22:32:10.777Z" }, + { url = "https://files.pythonhosted.org/packages/17/b7/ba75dd947a14b6ad907b01ae8f6b5b348cdd1b48142f0063dee9e20c1d9d/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:15254441469dd6bf027039453288e2072124f8b6603563f5d759e1c9b69273fa", size = 4694530, upload-time = "2026-06-09T22:31:53.105Z" }, + { url = "https://files.pythonhosted.org/packages/62/29/50d6b9e8aff12d8b67afaeb3569335e32dc83a5723e3bbded24fdac9f809/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:8ace4507d1e6533c125f4fac754f8bb8b6a74c08e92179dabd7e16571a3efbf3", size = 5245046, upload-time = "2026-06-09T22:31:25.774Z" }, + { url = "https://files.pythonhosted.org/packages/9f/04/618f4115cfc0add0838c82507aa18a346089428da8653ad38b3ff36f5cb3/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:b4e391975f038e66432328639620a4aff2d307513b004f1ca06d6225bced815c", size = 4736660, upload-time = "2026-06-09T22:32:12.676Z" }, + { url = "https://files.pythonhosted.org/packages/24/9c/06e062462a0de28a3b3911322eded4c16deb9f441b1b7575d3dc59488ab5/cryptography-48.0.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:42fcd8e26fe555d9b3577a135f5091fefa0aa4e99129c23fb56787a1bd4ada72", size = 4822229, upload-time = "2026-06-09T22:31:17.062Z" }, + { url = "https://files.pythonhosted.org/packages/f4/be/0561971eaaee4b8a0e7d5113c536921063ab91aaf23278ac374eaf881e11/cryptography-48.0.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:c1400da5e32a43253392277eac7490a60e497d810a63dd5608d71bbd7af507c9", size = 4966364, upload-time = "2026-06-09T22:31:32.842Z" }, + { url = "https://files.pythonhosted.org/packages/a4/27/728c77876f12b000820b69ae490f3c4083775e79e07827e9e60be07ad209/cryptography-48.0.1-cp314-cp314t-win32.whl", hash = "sha256:0df56b056bc17c1b7d6821dfa65216e62bd232d8ab05eb3db44e71d235651471", size = 3278498, upload-time = "2026-06-09T22:31:29.154Z" }, + { url = "https://files.pythonhosted.org/packages/06/e3/79a612c6d7b1e6ee0edd43633d53035bec2cfb78c82b76f7864f39e36f34/cryptography-48.0.1-cp314-cp314t-win_amd64.whl", hash = "sha256:9de21387aa95e2a895823d0745b430bed4f33503ba9ab5e0b5311f33e37d66d2", size = 3798790, upload-time = "2026-06-09T22:31:56.697Z" }, + { url = "https://files.pythonhosted.org/packages/ca/6c/00fa2a95997164c8b2072ce327c23d4ab20809ccc323ea5fab91e53a4bba/cryptography-48.0.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:4fdc69f8e4316bcf0c8c8ec1f26f285d12e8142d88d96c876a59a03be3f6ae67", size = 7987408, upload-time = "2026-06-09T22:32:20.777Z" }, + { url = "https://files.pythonhosted.org/packages/b0/d9/45f309a7e4e5f3f8f121d6d3be9e94024a7726ec598d6e08ae04edb2f04d/cryptography-48.0.1-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48fe40804d4caa2288f24e70ca8c64c42dd826da0ad7e4f1b41b2128d679e6c8", size = 4690196, upload-time = "2026-06-09T22:31:54.74Z" }, + { url = "https://files.pythonhosted.org/packages/5f/9f/a1bc8bcc798811b8527eb374bbccf30a3f3e806829d967118222bf1125eb/cryptography-48.0.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:86be3b1b0b6bf09482fb50a979c508d2950ed95f5621ec77f4e385962006b83a", size = 4696782, upload-time = "2026-06-09T22:31:45.615Z" }, + { url = "https://files.pythonhosted.org/packages/66/c2/81a4fb4e4373c500bb526bc337ac5719dd31dd15b970b84a238168c6aa08/cryptography-48.0.1-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:4ab0a343c807bbcd90c971cd1ecf072937cd01847a9e002bef88fb47ac6be577", size = 4696618, upload-time = "2026-06-09T22:31:11.564Z" }, + { url = "https://files.pythonhosted.org/packages/e5/0b/aa68b221dde92d09cb29a024ede17550ee21e77a404e59fc093c82bb51e1/cryptography-48.0.1-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9621de99d2da096006b629979efd8ae7eb2d8b822488d0c89ee4000c306c59b1", size = 5289970, upload-time = "2026-06-09T22:31:20.368Z" }, + { url = "https://files.pythonhosted.org/packages/78/13/fba657f958d2af66ea959a4ba01212632089249d34af1ae48054136344d7/cryptography-48.0.1-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:88c852a0ae366e262e5a1744b685e6a433dc8788dd2a277e418bf4904203609d", size = 4731873, upload-time = "2026-06-09T22:31:22.253Z" }, + { url = "https://files.pythonhosted.org/packages/4c/4c/9a964756d24a26b3e34dfcb16f961b89838786e6700b635b0d1e3adff4b6/cryptography-48.0.1-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:43c5835e2cb98c8733d86f57d6fc879b613f5c3478607281c3e36daffc6dd8a6", size = 4330804, upload-time = "2026-06-09T22:31:36.56Z" }, + { url = "https://files.pythonhosted.org/packages/4b/0f/a10f3a6eb12950a10e3a874070283aa2dd5875b2bfd15fad8a3e17b3f13e/cryptography-48.0.1-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:fe0180af5bf9236518a087e35bf2d9a347d5f5f51e63c579d683ddff424e3d46", size = 4696217, upload-time = "2026-06-09T22:31:13.351Z" }, + { url = "https://files.pythonhosted.org/packages/f3/6f/5cd12f951165ea73ef85266775d97e4c763b2474ccfd816dd69d3a18d6f8/cryptography-48.0.1-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:b7a2d1a937a738a881737cec135a38bb61470589b17515b9f73f571d0ae10401", size = 5245252, upload-time = "2026-06-09T22:32:02.193Z" }, + { url = "https://files.pythonhosted.org/packages/68/ab/8aaa12e4516ec4464033ab79b6f3b592bd5a92102467c4ace8a0d970203f/cryptography-48.0.1-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:b74ca3b8e5ecdd833bf6a002ca41b4793bb27fb8f1c06ffaf2643c9e9140e31b", size = 4731388, upload-time = "2026-06-09T22:32:04.019Z" }, + { url = "https://files.pythonhosted.org/packages/1b/24/50027ea4dca85ec1f40688f3c24fb32ccacd520583c9592c3cc95628e6fb/cryptography-48.0.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2c37f2461406063b417837f5f3daab668652acd82423efcd7f0a9f04be972de1", size = 4824186, upload-time = "2026-06-09T22:32:18.707Z" }, + { url = "https://files.pythonhosted.org/packages/52/41/04cb5eb17085ade6f50cc611fb657df6a0f5885350de8764ece89c050197/cryptography-48.0.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:86fe77abb1bd87afb251d4d02ada7ecf53a32cee9b67d976abb2e45a13297475", size = 4964539, upload-time = "2026-06-09T22:31:18.793Z" }, + { url = "https://files.pythonhosted.org/packages/36/bf/ed70785c496e89d7e73b7cda2d21f2447fd6d4e821714b8d04ff217fed92/cryptography-48.0.1-cp39-abi3-win32.whl", hash = "sha256:6b2c0c3e6ccf3ade7750f836ef3ee36eea250cc467d45c256895573ac08cc6f1", size = 3282307, upload-time = "2026-06-09T22:30:53.162Z" }, + { url = "https://files.pythonhosted.org/packages/b3/ff/371ea7d252656ee1eb6d83eeeef3d1d0c6baf1d6497687d081ea03814670/cryptography-48.0.1-cp39-abi3-win_amd64.whl", hash = "sha256:9a49ca6c81417f6a5edb50375a60cccdd70fa0a91a5211829dbea74eba94d2ac", size = 3793408, upload-time = "2026-06-09T22:32:15.191Z" }, ] [[package]] @@ -1068,16 +1068,16 @@ wheels = [ [[package]] name = "daphne" -version = "4.2.1" +version = "4.2.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "asgiref" }, { name = "autobahn" }, { name = "twisted", extra = ["tls"] }, ] -sdist = { url = "https://files.pythonhosted.org/packages/cd/9d/322b605fdc03b963cf2d33943321c8f4405e8d82e698bf49d1eed1ca40c4/daphne-4.2.1.tar.gz", hash = "sha256:5f898e700a1fda7addf1541d7c328606415e96a7bd768405f0463c312fcb31b3", size = 45600, upload-time = "2025-07-02T12:57:04.935Z" } +sdist = { url = "https://files.pythonhosted.org/packages/64/d3/65ff32c01cc64d44441b038dbb7cfb0c6a5507a1c937b3d41bd99af7bdc4/daphne-4.2.2.tar.gz", hash = "sha256:6c3527d4ce32630ae054dfb0ef5578e9a35d2f39f0ebcd02ef4f9129a121ce8d", size = 47601, upload-time = "2026-06-03T10:53:13.31Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/01/34/6171ab34715ed210bcd6c2b38839cc792993cff4fe2493f50bc92b0086a0/daphne-4.2.1-py3-none-any.whl", hash = "sha256:881e96b387b95b35ad85acd855f229d7f5b79073d6649089c8a33f661885e055", size = 29015, upload-time = "2025-07-02T12:57:03.793Z" }, + { url = "https://files.pythonhosted.org/packages/78/ab/85534d9cbca09f3c10f58fc2093659062280ed5703707c0b41dbca8ec297/daphne-4.2.2-py3-none-any.whl", hash = "sha256:466ba8a7c31c5b758953095b451dbad9dc23e5783c68a3716e5fc7aa5f26d168", size = 29466, upload-time = "2026-06-03T10:53:11.841Z" }, ] [[package]] @@ -1122,16 +1122,16 @@ wheels = [ [[package]] name = "django" -version = "5.2.14" +version = "5.2.15" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "asgiref" }, { name = "sqlparse" }, { name = "tzdata", marker = "sys_platform == 'win32'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/65/95/95f7faa0950867afaa0bef2460c6263afd6a2c78cc9434046ed28160b015/django-5.2.14.tar.gz", hash = "sha256:58a63ba841662e5c686b57ba1fec52ddd68c0b93bd96ac3029d55728f00bf8a2", size = 10895118, upload-time = "2026-05-05T13:57:31.104Z" } +sdist = { url = "https://files.pythonhosted.org/packages/2b/e3/31722f7284c9f43333daff9aee9184678e4487adcb5506af0db8cea09ce1/django-5.2.15.tar.gz", hash = "sha256:5154a9bf84ac01dde011e367f355c07dbb329532e06810dcf3ef2af269e236e7", size = 10873669, upload-time = "2026-06-03T13:03:35.892Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/14/44/f172870cf87aa25afef48fb72adba89ee8b77fcab6f3b23d240b923f1528/django-5.2.14-py3-none-any.whl", hash = "sha256:6f712143bd3064310d1f50fac859c3e9a274bdcfc9595339853be7779297fc76", size = 8311320, upload-time = "2026-05-05T13:57:25.795Z" }, + { url = "https://files.pythonhosted.org/packages/92/b5/38140b1643c00d5c46ce69c78e6980fd285aee223100319631bedee4f5e7/django-5.2.15-py3-none-any.whl", hash = "sha256:0eb4a9bb1853a35b0286dbc6d916bd352c8c2687195a7f2d6f80cefd840e4970", size = 8311957, upload-time = "2026-06-03T13:03:31.329Z" }, ] [[package]] @@ -1812,17 +1812,24 @@ wheels = [ [[package]] name = "httptools" -version = "0.7.1" +version = "0.8.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/b5/46/120a669232c7bdedb9d52d4aeae7e6c7dfe151e99dc70802e2fc7a5e1993/httptools-0.7.1.tar.gz", hash = "sha256:abd72556974f8e7c74a259655924a717a2365b236c882c3f6f8a45fe94703ac9", size = 258961, upload-time = "2025-10-10T03:55:08.559Z" } +sdist = { url = "https://files.pythonhosted.org/packages/43/e5/d471fcb0e14523fe1c3f4ba58ca52480e7bd70ad7109a3846bc75892f7fb/httptools-0.8.0.tar.gz", hash = "sha256:6b2a32f18d97e16e90827d7a819ffa8dbd8cc245fc4e1fa9d1095b54ef4bd999", size = 271342, upload-time = "2026-05-25T22:17:48.841Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/34/50/9d095fcbb6de2d523e027a2f304d4551855c2f46e0b82befd718b8b20056/httptools-0.7.1-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:c08fe65728b8d70b6923ce31e3956f859d5e1e8548e6f22ec520a962c6757270", size = 203619, upload-time = "2025-10-10T03:54:54.321Z" }, - { url = "https://files.pythonhosted.org/packages/07/f0/89720dc5139ae54b03f861b5e2c55a37dba9a5da7d51e1e824a1f343627f/httptools-0.7.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:7aea2e3c3953521c3c51106ee11487a910d45586e351202474d45472db7d72d3", size = 108714, upload-time = "2025-10-10T03:54:55.163Z" }, - { url = "https://files.pythonhosted.org/packages/b3/cb/eea88506f191fb552c11787c23f9a405f4c7b0c5799bf73f2249cd4f5228/httptools-0.7.1-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:0e68b8582f4ea9166be62926077a3334064d422cf08ab87d8b74664f8e9058e1", size = 472909, upload-time = "2025-10-10T03:54:56.056Z" }, - { url = "https://files.pythonhosted.org/packages/e0/4a/a548bdfae6369c0d078bab5769f7b66f17f1bfaa6fa28f81d6be6959066b/httptools-0.7.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:df091cf961a3be783d6aebae963cc9b71e00d57fa6f149025075217bc6a55a7b", size = 470831, upload-time = "2025-10-10T03:54:57.219Z" }, - { url = "https://files.pythonhosted.org/packages/4d/31/14df99e1c43bd132eec921c2e7e11cda7852f65619bc0fc5bdc2d0cb126c/httptools-0.7.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:f084813239e1eb403ddacd06a30de3d3e09a9b76e7894dcda2b22f8a726e9c60", size = 452631, upload-time = "2025-10-10T03:54:58.219Z" }, - { url = "https://files.pythonhosted.org/packages/22/d2/b7e131f7be8d854d48cb6d048113c30f9a46dca0c9a8b08fcb3fcd588cdc/httptools-0.7.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:7347714368fb2b335e9063bc2b96f2f87a9ceffcd9758ac295f8bbcd3ffbc0ca", size = 452910, upload-time = "2025-10-10T03:54:59.366Z" }, - { url = "https://files.pythonhosted.org/packages/53/cf/878f3b91e4e6e011eff6d1fa9ca39f7eb17d19c9d7971b04873734112f30/httptools-0.7.1-cp314-cp314-win_amd64.whl", hash = "sha256:cfabda2a5bb85aa2a904ce06d974a3f30fb36cc63d7feaddec05d2050acede96", size = 88205, upload-time = "2025-10-10T03:55:00.389Z" }, + { url = "https://files.pythonhosted.org/packages/1a/12/fa3fbf5f9517b273edea2dc982aa82a8c634091e67c590792b729017bc6f/httptools-0.8.0-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:de242a49b5d18e0a8776e654e9f6bf6d89f3875a5c35b425a0e7ce940feb3fd6", size = 206183, upload-time = "2026-05-25T22:17:24.004Z" }, + { url = "https://files.pythonhosted.org/packages/30/fc/5e7c4cb443370f2090a3aba0453a07384d29ff66b7435bb90e77e1037599/httptools-0.8.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:159e9ab5f701ccd42e555a12f1ad8ff69702910fc1c996cf2bb66e5fcb7a231b", size = 112079, upload-time = "2026-05-25T22:17:25.216Z" }, + { url = "https://files.pythonhosted.org/packages/ba/53/771bd891eb0f236f32145d6a1775777ec85745f3cc983a1f23d1a3b8ddfe/httptools-0.8.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:c4a9f1707e4823d54dfec6c33fa3697d302aed536ed352a7ebb5a061ddb869d0", size = 481596, upload-time = "2026-05-25T22:17:26.186Z" }, + { url = "https://files.pythonhosted.org/packages/62/42/94e15bc68ce3d423243c45d7f1b0c7561f13844f97dc52ae23182fb65628/httptools-0.8.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d76ad7b951387e3632c8716a9bb03ac5b45c5f16119aa409db0459520887944e", size = 480865, upload-time = "2026-05-25T22:17:27.542Z" }, + { url = "https://files.pythonhosted.org/packages/1c/7c/fe2980fc03723272e30f135b62360b075f513dfe7cc73aef36c7f04012bd/httptools-0.8.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:a3b7387147361c3fd47a0bde763c5c91b5b4cd4dc9989b8ece84ff436c99843b", size = 463189, upload-time = "2026-05-25T22:17:28.546Z" }, + { url = "https://files.pythonhosted.org/packages/15/1b/47fc5fff68acd1bfa20b4734059c9a06cadb88119dcd5258b5b0d21d91c8/httptools-0.8.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f256d6ce930c52ca1cb2a960b7da03548c454e7d28b06059ad41bfe789036ce0", size = 466610, upload-time = "2026-05-25T22:17:29.816Z" }, + { url = "https://files.pythonhosted.org/packages/60/bd/07b13c93ffd9bec9546e0d43f8e19378dd696dbd278511406bc07371ef1f/httptools-0.8.0-cp314-cp314-win_amd64.whl", hash = "sha256:19d1ee275bb59ba2643ba9a3a1e51cc0c788caf2b8df506368e03f56fdd08527", size = 92705, upload-time = "2026-05-25T22:17:31.133Z" }, + { url = "https://files.pythonhosted.org/packages/fd/c4/121648f68ce066d7bd762d6b6d97e620847642d38d54f3d90ff11d947629/httptools-0.8.0-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:de1ed58a974e75d56560acc7e7fed01a454994429456f65209789992e41f2568", size = 215023, upload-time = "2026-05-25T22:17:32.401Z" }, + { url = "https://files.pythonhosted.org/packages/b9/b0/312a062ae741ae3e8baa8c8bf20be81b2e67337b259ab4349bebc7b6142e/httptools-0.8.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:e93c227b595c6926c1acee96891dd9da4be338cfbe82e5cd3bb9d8dd7dc4ac0b", size = 117405, upload-time = "2026-05-25T22:17:33.742Z" }, + { url = "https://files.pythonhosted.org/packages/fc/37/fccd705f795386bb05bf413012fecff2a33e5aa8c2f069096de3e9fd8702/httptools-0.8.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2a021c3a8e65cc125390d72f59b968afca3bdcaff25bd67965e0a055a14946ca", size = 558497, upload-time = "2026-05-25T22:17:34.732Z" }, + { url = "https://files.pythonhosted.org/packages/bd/39/f172e8003576de35f5ba77ff417cf0e34429d35dc014deef15afa337a72c/httptools-0.8.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:48774d39cbb70e2b1f71f88852a3087ae1d3a1eb80482bb48c13067ab080c14f", size = 571585, upload-time = "2026-05-25T22:17:35.813Z" }, + { url = "https://files.pythonhosted.org/packages/3e/b9/f5564760af99f3dbbf3f9104dc00e5da27e96cf433c6bdcf77617f70bf3f/httptools-0.8.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:88eead8ec8680a9f146c655bc88445a325bd7921cfd8194c7337e9467282427d", size = 543297, upload-time = "2026-05-25T22:17:37.08Z" }, + { url = "https://files.pythonhosted.org/packages/99/67/8d9f2c313618e161b82f3873188e7196126da1d6e29688df40eb3997c77a/httptools-0.8.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:2c032fa028f46871ec7e1fc59fc15e8023eab3e6bbe6ece786a1611719a5d081", size = 539535, upload-time = "2026-05-25T22:17:38.032Z" }, + { url = "https://files.pythonhosted.org/packages/48/63/b906c01e53f50d432c0defe43ce52764a111dc1bdd028bafbeb54dcfd008/httptools-0.8.0-cp314-cp314t-win_amd64.whl", hash = "sha256:384c17174464c8e873398b7af24f0b1f44d992c820328413951a625323155d77", size = 108209, upload-time = "2026-05-25T22:17:39.473Z" }, ] [[package]] @@ -3314,27 +3321,27 @@ wheels = [ [[package]] name = "ruff" -version = "0.15.15" +version = "0.15.16" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/84/6f/a76f7d96e5c962f5b69cee865e49c15c1116897c01990faa8a57edb62e7f/ruff-0.15.15.tar.gz", hash = "sha256:b8dff018130b46d8e5bf0f926ef6b60cf871d6d5ae45fc9334e09632daa741d6", size = 4706985, upload-time = "2026-05-28T14:16:57.784Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/5f7ec371001337d8fa61701c186ff8b613ecac1651848c5950f4c4d5f2e9/ruff-0.15.16.tar.gz", hash = "sha256:d05e78d38c78caf020b03789e25106c93017db5a0cb6e2819885018c61343b78", size = 4714267, upload-time = "2026-06-04T16:33:09.974Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/fa/9d/3a45c05b8ab04b4705989de70a79008e27c8003296a0feaee9edc18dd7e9/ruff-0.15.15-py3-none-linux_armv6l.whl", hash = "sha256:cf93e5388f412e1b108b1f8b34a6e036b70fe8aff89393befad96fe48670311b", size = 10710652, upload-time = "2026-05-28T14:16:06.701Z" }, - { url = "https://files.pythonhosted.org/packages/05/66/da974431624bf3b49f6ee1f9543c02d929ff1cba78b0d5a79c38cf21f744/ruff-0.15.15-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:ac5a646d1f6a7dadd5d50842dae2c1f9862ac887ef5d1b1375e02def791fde6e", size = 11096615, upload-time = "2026-05-28T14:16:23.313Z" }, - { url = "https://files.pythonhosted.org/packages/8c/09/7443452e5d290230a712103f2fdceeef7184f3ec99a2bd01c8be78aaceb5/ruff-0.15.15-py3-none-macosx_11_0_arm64.whl", hash = "sha256:77d955a431430c66f72dd94e379ad38a16daea3d25094872ac4edf9e797be530", size = 10436683, upload-time = "2026-05-28T14:16:40.974Z" }, - { url = "https://files.pythonhosted.org/packages/53/01/d330c26a57fa4f3943a14424904027428315b700fe4d14a84bb123a649e5/ruff-0.15.15-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7614ee79c69788cf6cedd568069ade9cecc22a1ad20494efe8d0c9ebb4b622d4", size = 10769064, upload-time = "2026-05-28T14:16:28.905Z" }, - { url = "https://files.pythonhosted.org/packages/1d/85/cc8770f8bdff541b1da8392d1634141fe4a0e3f4ee596605959b7906c27f/ruff-0.15.15-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3cdb1679e06a1f6b47bc384714ae96f6e2fb65ca441eb78c43d2ca554176ce1f", size = 10511987, upload-time = "2026-05-28T14:16:43.732Z" }, - { url = "https://files.pythonhosted.org/packages/7c/29/8c190c1472b63013583ba391f3342036e02010544c1270455ed8e519bdf3/ruff-0.15.15-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2728b93d7b23a603ea2c0ac6eb73d760bd38ec9de35f35fb41e18f7a3fee7622", size = 11275100, upload-time = "2026-05-28T14:16:55.244Z" }, - { url = "https://files.pythonhosted.org/packages/9f/6b/7e145ce2cc8e63d6834eca03d83a0e18d121def5c69f91b4cf4011ed4879/ruff-0.15.15-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:be582fcc0db438902c7792b08d6ddf6c9b9e21addaa10092c2c741cfb09e5a45", size = 12176903, upload-time = "2026-05-28T14:16:14.368Z" }, - { url = "https://files.pythonhosted.org/packages/80/a3/d5974637f68e451f7fadf015cf3101d1cd7d8ba5027cffe0b9e3826ebe6b/ruff-0.15.15-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7aa77465b8ecaf1a27bea098d696f7fed5e1eccbd10b321b682d6de586ae5627", size = 11404550, upload-time = "2026-05-28T14:16:20.138Z" }, - { url = "https://files.pythonhosted.org/packages/fe/1c/e6e5e568f22be4fb05d6244234aba384c06b451252453b821e1a529263cf/ruff-0.15.15-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:48decfa11d740de4889de623be1463308346312f2409a56e24aa280c86162dc4", size = 11382027, upload-time = "2026-05-28T14:16:46.615Z" }, - { url = "https://files.pythonhosted.org/packages/1d/01/170921b49fcd2e8858825593f91cf7146c3e40a5c3e6df763e4bb0484dde/ruff-0.15.15-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:a5015088452ca0081387063649ec67f06d3d1d6b8b936a1f836b5e9657ecd48c", size = 11366041, upload-time = "2026-05-28T14:16:26.247Z" }, - { url = "https://files.pythonhosted.org/packages/87/54/a7bad711d7de93254e15e06a4c375b89a03d18de45d3e5dcc86a4472fb1a/ruff-0.15.15-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:f5294aab6356c81600fcdea3a62bb1b924dfd5e91767c12318d3f68f86af57cd", size = 10741795, upload-time = "2026-05-28T14:16:17.11Z" }, - { url = "https://files.pythonhosted.org/packages/c9/31/38c075963668f8b41c6914ee0f6f318727fbe30ab9145cb29e6df464c5fa/ruff-0.15.15-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:db5bd4d802415cca656dc1616070b725952d6ae95eb5d4831e49fbd94a38f75f", size = 10511117, upload-time = "2026-05-28T14:16:31.767Z" }, - { url = "https://files.pythonhosted.org/packages/9d/96/6ff689e1f7e375d1d97075eca022f74c2bab59554a432fe4d2e6f091986a/ruff-0.15.15-py3-none-musllinux_1_2_i686.whl", hash = "sha256:587a6278ed42059191c1a466e490bd7930fb50bd2e255398bc29616c895a61cb", size = 10994867, upload-time = "2026-05-28T14:16:35.149Z" }, - { url = "https://files.pythonhosted.org/packages/c3/c2/5dce0ab9f92a8d534fa62b9bf9caca3eddb8c1a81b616f5e195ada4f0d6e/ruff-0.15.15-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:df0c1c084f5f4be9812f61518a45c440d3c30d69ce4bf6c5270e66d38338f02a", size = 11482101, upload-time = "2026-05-28T14:16:49.598Z" }, - { url = "https://files.pythonhosted.org/packages/b1/c0/1003b60edd697c649faf61f1a34094b1abb38fb3d1181e3f895781250a08/ruff-0.15.15-py3-none-win32.whl", hash = "sha256:29428ea79694afbe756d45fd59b36f22b6b020dc0443cf7de0173046236964b9", size = 10716774, upload-time = "2026-05-28T14:16:52.337Z" }, - { url = "https://files.pythonhosted.org/packages/02/a8/1269eddd6945a06c23f055ef7848886e37cf9d6a8bebb386a3115f01470c/ruff-0.15.15-py3-none-win_amd64.whl", hash = "sha256:8df0323902e15e24bc4bf246da830573d3cf3352bd0b9a164eab335d111ff4a4", size = 11868463, upload-time = "2026-05-28T14:16:11.333Z" }, - { url = "https://files.pythonhosted.org/packages/4e/b2/920464c907b191e37469d477a1aa8bc048b8f36c4c1610dfa4ab87b39e18/ruff-0.15.15-py3-none-win_arm64.whl", hash = "sha256:3c8ceca6792f38196b8f589bc92eccd03eef286602da92e5dc05cc42ef6441b7", size = 11138498, upload-time = "2026-05-28T14:16:38.425Z" }, + { url = "https://files.pythonhosted.org/packages/0c/42/53ef1c3953f157956db9bf7861e3bc50b9b887ce93300aa48cdba8336fe6/ruff-0.15.16-py3-none-linux_armv6l.whl", hash = "sha256:6ac3c0b3969cc6cf6b158c4e2f8f682acb58e7d700d8a44b65ecdc72d66ab0b2", size = 10709025, upload-time = "2026-06-04T16:32:51.935Z" }, + { url = "https://files.pythonhosted.org/packages/93/9a/a79159346f19134a956607754e57d8d128f7a4c00f4ad2f7514d224c172c/ruff-0.15.16-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:197c207ed75ffba54a0dec23db4aa939a27a3053073e085e0042433cbdc58e4a", size = 11063550, upload-time = "2026-06-04T16:32:42.24Z" }, + { url = "https://files.pythonhosted.org/packages/bc/72/3ce2ac000a5299ec238e01f51397b3b653c93b077d9b1bfe8715bb895f20/ruff-0.15.16-py3-none-macosx_11_0_arm64.whl", hash = "sha256:3a39fec45ab316cc23e7558f23fea4a70403ddb5648ea9a4a3854a16973d0071", size = 10421345, upload-time = "2026-06-04T16:32:37.251Z" }, + { url = "https://files.pythonhosted.org/packages/b0/c2/cc7fad3ec9169373f5b6a18f1917b91080feec40c3f9658334a1d28e2f03/ruff-0.15.16-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ba93191d79003116b95128c9d306e045200fdbd0bccb782b110f3cd1d4abc5cf", size = 10757217, upload-time = "2026-06-04T16:32:54.722Z" }, + { url = "https://files.pythonhosted.org/packages/69/d2/3474009eaa0a65b31fa7152a2fad5e2f050c640ceb1e6b02ee6922e94c82/ruff-0.15.16-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:c6ee4b90520630120ef032aa5cc10db483852dff950e78b1d717e2993a61ac8d", size = 10507035, upload-time = "2026-06-04T16:33:05.343Z" }, + { url = "https://files.pythonhosted.org/packages/ca/81/b7ae6ccbd11f0c8dc3d5d67fc4be9b57ff57ca86ba56152021378e1277f2/ruff-0.15.16-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4e4215bc938bc3c8215c1472c1aa437e310fee20cd427335fec9d7e609563628", size = 11255291, upload-time = "2026-06-04T16:32:49.49Z" }, + { url = "https://files.pythonhosted.org/packages/d9/e1/46e526f1a7cc90857ce6ddf25fbb77eb6568651ac38d71b033af07076dd5/ruff-0.15.16-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7c8d26be963b090f10e29abc8b3e74a2a321f6fa34e02424e30b5af89350ecbb", size = 12124922, upload-time = "2026-06-04T16:33:07.821Z" }, + { url = "https://files.pythonhosted.org/packages/1a/da/5c791b088b596b24d0deb967fa28ae02ad751a140c0b9ea81c5ab915d6c0/ruff-0.15.16-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f198cf4123602a2280ed46c307bcbafe41758d6fee5b456b6b6058ca1514b3b4", size = 11332186, upload-time = "2026-06-04T16:33:02.971Z" }, + { url = "https://files.pythonhosted.org/packages/72/11/5da87abe20047c8962361473923ebb2f62b595250126aadfad8c20649c1e/ruff-0.15.16-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bb27515fa6240fb586ae82b901a59e67d24acff86f2190b433dc542fe0435aeb", size = 11373541, upload-time = "2026-06-04T16:32:47.007Z" }, + { url = "https://files.pythonhosted.org/packages/fe/2a/8554754c23a854ae3fd6b507e36ad61ddb121e298c6d5d617dec94ed0f14/ruff-0.15.16-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:a267c46ba1593fc26b8eecbea050b39d40c0b6bb7781ee11c90a02cd10032951", size = 11353014, upload-time = "2026-06-04T16:32:34.795Z" }, + { url = "https://files.pythonhosted.org/packages/62/25/62ea41529ec89f742ea3fed9cb1059c72877ec7cf9b9e99ac9cf3294d1d9/ruff-0.15.16-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:528c68f39a91498a8d50e91ff5985df3d105782bab49cc378e73ac26bff083e8", size = 10737467, upload-time = "2026-06-04T16:32:26.348Z" }, + { url = "https://files.pythonhosted.org/packages/90/17/334d3ad9de4d40f9dd58fdd09e35ce64553bb501e2f19a839e2fb6be14fc/ruff-0.15.16-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:7ed55c58950df60589a9a7a5d2f8fa5f54ebd287163be805adfe6ee95a9de123", size = 10521910, upload-time = "2026-06-04T16:32:32.54Z" }, + { url = "https://files.pythonhosted.org/packages/4d/bd/3ac7c6ae77a885c1004b3dda2446ea401768d24f851c14b4ad4b24f6639c/ruff-0.15.16-py3-none-musllinux_1_2_i686.whl", hash = "sha256:d482feaf51512b50f9790ceb417a56a61dd1e9d9bf967662b9ed27c01b34f53a", size = 10979190, upload-time = "2026-06-04T16:32:57.492Z" }, + { url = "https://files.pythonhosted.org/packages/33/d7/609546e6a413c3f216fbf2a50c928f97c80939154f6a0503114094a86191/ruff-0.15.16-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:1e15bc8c94513dae2a40cc9ef07c94fdd4ecc9e29dabebeebe170f952322c9e3", size = 11477014, upload-time = "2026-06-04T16:32:44.687Z" }, + { url = "https://files.pythonhosted.org/packages/74/0d/f2cd247ad32633a5c36e97141a2c21b11c6279f7957bc2ff360b1e08fddd/ruff-0.15.16-py3-none-win32.whl", hash = "sha256:580378f7bd4aa25f72e74aa54948a9622f142b1e509521dd10902e886681cc1e", size = 10735541, upload-time = "2026-06-04T16:32:30.145Z" }, + { url = "https://files.pythonhosted.org/packages/8b/9e/02e845ef151b1dee585e55c4739f8e1734ae1d9f1221dff65761c162208b/ruff-0.15.16-py3-none-win_amd64.whl", hash = "sha256:408256017284eddf98fff77b29aa4fb30f586042d535b2d9befc6512f400aaec", size = 11843403, upload-time = "2026-06-04T16:32:39.76Z" }, + { url = "https://files.pythonhosted.org/packages/15/19/016553f86f207450aebebc2b2b5088d086b901cc8186c02ac4284db3bd88/ruff-0.15.16-py3-none-win_arm64.whl", hash = "sha256:8cd61783afb39638a7133ef0d2dfb1e91277593962f81b5a8423eb0b888a6121", size = 11134555, upload-time = "2026-06-04T16:33:00.136Z" }, ] [[package]] @@ -3380,15 +3387,15 @@ wheels = [ [[package]] name = "sentry-sdk" -version = "2.61.0" +version = "2.61.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/52/4d/3c66e6045bd2071256b6b6fdcb0cc02b86ce54b2acc2ceac79af8e0efbb5/sentry_sdk-2.61.0.tar.gz", hash = "sha256:1ca9b4bb777eb5be67004edab7eb894f21c6301f1d05ed64966719ad5d1764ce", size = 458510, upload-time = "2026-05-28T09:40:28.917Z" } +sdist = { url = "https://files.pythonhosted.org/packages/63/3b/4bc6b348bbd331daa14d4babe9f2b99bc854f4da41560eefb9488d78481d/sentry_sdk-2.61.1.tar.gz", hash = "sha256:9c6adccb3feefa9ba032c8d295ca477575c2f11896046a2b0ad686c47c4af555", size = 459429, upload-time = "2026-06-01T07:24:18.875Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/21/5a/9794736d5802689c1a48862e6afe6b7f3e86cc37c15d4a84bc0143877dc1/sentry_sdk-2.61.0-py3-none-any.whl", hash = "sha256:ec4d30273909cb1d198e03208b16ee70e2bc5d90a16fd9f1fb2fc6a72e1f03dc", size = 483111, upload-time = "2026-05-28T09:40:27.027Z" }, + { url = "https://files.pythonhosted.org/packages/df/54/c9218db183846e08efaf68534889ef42e499dde432778881104a42f7071b/sentry_sdk-2.61.1-py3-none-any.whl", hash = "sha256:fa36eaf4b8ad708f718500d4bdcc1532637526a22beb874d88cbc0a46458b5ae", size = 483735, upload-time = "2026-06-01T07:24:17.027Z" }, ] [[package]] @@ -3853,15 +3860,15 @@ socks = [ [[package]] name = "uvicorn" -version = "0.48.0" +version = "0.49.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "click" }, { name = "h11" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/e6/bf/f6544ba992ddb9a6077343a576f9844f7f8f06ab819aefd00206e9255f18/uvicorn-0.48.0.tar.gz", hash = "sha256:a5504207195d08c2511bf9125ede5ac4a4b71725d519e758d01dcf0bc2d31c37", size = 91074, upload-time = "2026-05-24T12:08:41.925Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c4/1f/fa18009dea8469069cca78a4e877a008ab78f08b064bfc9ab891579077ff/uvicorn-0.49.0.tar.gz", hash = "sha256:ebf4271aa580d9de97f93192d4595176df6e91f9aae919ca73e4fc07df1e66a3", size = 91284, upload-time = "2026-06-03T22:01:30.448Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/01/be/72532be3da7acc5fdfbccdb95215cd04f995a0886532a5b423f929cda4cc/uvicorn-0.48.0-py3-none-any.whl", hash = "sha256:48097851328b87ec36117d3d575234519eb58c2b22d79666e9bbc6c49a761dad", size = 71410, upload-time = "2026-05-24T12:08:40.258Z" }, + { url = "https://files.pythonhosted.org/packages/88/fa/e1388bbcf24ef3274f45c0c1c7b501fd14971037c1b6ee23610553307497/uvicorn-0.49.0-py3-none-any.whl", hash = "sha256:ba3d14c3ee7e41c6c654c46c9eb489d33213cdd30aa1696eab1374337c13f68f", size = 71376, upload-time = "2026-06-03T22:01:29.037Z" }, ] [package.optional-dependencies] diff --git a/web/package-lock.json b/web/package-lock.json index 6ef9240c53..a599d9befe 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -37,6 +37,7 @@ "@lit/reactive-element": "^2.1.2", "@lit/task": "^1.0.3", "@mdx-js/mdx": "^3.1.1", + "@mermaid-js/layout-elk": "^0.2.1", "@mrmarble/djangoql-completion": "^0.8.3", "@open-wc/lit-helpers": "^0.7.0", "@openlayers-elements/core": "^0.4.0", @@ -44,18 +45,18 @@ "@patternfly/elements": "^4.4.0", "@patternfly/patternfly": "^4.224.2", "@playwright/test": "^1.60.0", - "@sentry/browser": "^10.55.0", - "@storybook/addon-docs": "^10.4.1", - "@storybook/addon-links": "^10.4.1", - "@storybook/web-components": "^10.4.1", - "@storybook/web-components-vite": "^10.4.1", + "@sentry/browser": "^10.56.0", + "@storybook/addon-docs": "^10.4.2", + "@storybook/addon-links": "^10.4.2", + "@storybook/web-components": "^10.4.2", + "@storybook/web-components-vite": "^10.4.2", "@types/codemirror": "^5.60.17", "@types/grecaptcha": "^3.0.9", "@types/guacamole-common-js": "^1.5.5", "@types/node": "^25.7.0", "@types/react": "^19.2.14", "@types/react-dom": "^19.2.3", - "@typescript-eslint/eslint-plugin": "^8.60.0", + "@typescript-eslint/eslint-plugin": "^8.60.1", "@typescript-eslint/parser": "^8.60.0", "@typescript-eslint/utils": "^8.60.0", "@typescript/native-preview": "^7.0.0-dev.20260510.1", @@ -2037,6 +2038,19 @@ "react": ">=16" } }, + "node_modules/@mermaid-js/layout-elk": { + "version": "0.2.1", + "resolved": "https://registry.npmjs.org/@mermaid-js/layout-elk/-/layout-elk-0.2.1.tgz", + "integrity": "sha512-MX9jwhMyd5zDcFsYcl3duDUkKhjVRUCGEQrdCeNV5hCIR6+3FuDDbRbFmvVbAu15K1+juzsYGG+K8MDvCY1Amg==", + "license": "MIT", + "dependencies": { + "d3": "^7.9.0", + "elkjs": "^0.9.3" + }, + "peerDependencies": { + "mermaid": "^11.0.2" + } + }, "node_modules/@mermaid-js/parser": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz", @@ -3838,75 +3852,75 @@ "license": "MIT" }, "node_modules/@sentry-internal/browser-utils": { - "version": "10.55.0", - "resolved": "https://registry.npmjs.org/@sentry-internal/browser-utils/-/browser-utils-10.55.0.tgz", - "integrity": "sha512-zUvyBr13EK0evKsSTzwSimRzZ3P9kugS32dLCj3ea5gNN+/DFtU/GsMTdcIQDhusEDraIlH17AGgqJH5gUAv5w==", + "version": "10.56.0", + "resolved": "https://registry.npmjs.org/@sentry-internal/browser-utils/-/browser-utils-10.56.0.tgz", + "integrity": "sha512-I8tZWAFg8SZpD8BFUpglEtSTzhZjacmcThB5/Mlq/iFiiT8mBPG4ZWDWssSfmIBKvZywJZJ83uDA0+uiJU73Tw==", "license": "MIT", "dependencies": { - "@sentry/core": "10.55.0" + "@sentry/core": "10.56.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry-internal/feedback": { - "version": "10.55.0", - "resolved": "https://registry.npmjs.org/@sentry-internal/feedback/-/feedback-10.55.0.tgz", - "integrity": "sha512-32X9WW1xs5DjCRlp89QJ/PLw4kbTIX6MsBDXN2RBN1nWBjm/2WcwXqO/v/WoIS4W2kTWXcZnQwalLSI22Fp33A==", + "version": "10.56.0", + "resolved": "https://registry.npmjs.org/@sentry-internal/feedback/-/feedback-10.56.0.tgz", + "integrity": "sha512-fkRR9JroESTIlErkht3OrH4DXKd/DbPozr2KLdX7boMo31hPu4cL9fuqzwOrwyDPRq9B4j+qEgIWB8JrTbgvmg==", "license": "MIT", "dependencies": { - "@sentry/core": "10.55.0" + "@sentry/core": "10.56.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry-internal/replay": { - "version": "10.55.0", - "resolved": "https://registry.npmjs.org/@sentry-internal/replay/-/replay-10.55.0.tgz", - "integrity": "sha512-OkQpANGwYU5UKfwLk6Y+NpESRC8nrLBjawRDLwF6cJ8HpNScOuNNJDEJEGwXHVkJPH0pcIixsH8y0Qfcltq6Xw==", + "version": "10.56.0", + "resolved": "https://registry.npmjs.org/@sentry-internal/replay/-/replay-10.56.0.tgz", + "integrity": "sha512-DjF09hpy3TF7Km/kOZc73YJmBqcbPCxuZ5rtRs+KtVHu3Vq48xeW83qKUcFEZv20ur9UD99OAJ/gaEt//1Qbwg==", "license": "MIT", "dependencies": { - "@sentry-internal/browser-utils": "10.55.0", - "@sentry/core": "10.55.0" + "@sentry-internal/browser-utils": "10.56.0", + "@sentry/core": "10.56.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry-internal/replay-canvas": { - "version": "10.55.0", - "resolved": "https://registry.npmjs.org/@sentry-internal/replay-canvas/-/replay-canvas-10.55.0.tgz", - "integrity": "sha512-lu/y7k9cK7FZ/qJpL0fBX4WqK6IFa/+bTPhedEaC5UpzjUNP7BfXt0H+R7q9CHWmp20Ffh/wGfO3j7O+Tv2MAA==", + "version": "10.56.0", + "resolved": "https://registry.npmjs.org/@sentry-internal/replay-canvas/-/replay-canvas-10.56.0.tgz", + "integrity": "sha512-SDg2K0CAZT/TnhrixQGwXoi6ZsWUB+DQy3UUk0bSQm6c/5k5zFBpGOiughQN+DYsDilKREfPKmUEEnqvUjm1HQ==", "license": "MIT", "dependencies": { - "@sentry-internal/replay": "10.55.0", - "@sentry/core": "10.55.0" + "@sentry-internal/replay": "10.56.0", + "@sentry/core": "10.56.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry/browser": { - "version": "10.55.0", - "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-10.55.0.tgz", - "integrity": "sha512-5n1kxmW1m4j16ZDV9kt+Zo5uafFnKTy7s5YyEcGnC45KnOiO1Gy+QFd3woXns1K5GNxpjF7oOOc6tXgZLuXnQQ==", + "version": "10.56.0", + "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-10.56.0.tgz", + "integrity": "sha512-80X3NmsGB6tLmfzXYdjzWWdVAdL5CRukGKLcRWIcNhgGjtskOmnzaGb93egEZGI5bUTbtONJ0oyscQ3Z9yoAtQ==", "license": "MIT", "dependencies": { - "@sentry-internal/browser-utils": "10.55.0", - "@sentry-internal/feedback": "10.55.0", - "@sentry-internal/replay": "10.55.0", - "@sentry-internal/replay-canvas": "10.55.0", - "@sentry/core": "10.55.0" + "@sentry-internal/browser-utils": "10.56.0", + "@sentry-internal/feedback": "10.56.0", + "@sentry-internal/replay": "10.56.0", + "@sentry-internal/replay-canvas": "10.56.0", + "@sentry/core": "10.56.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry/core": { - "version": "10.55.0", - "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.55.0.tgz", - "integrity": "sha512-XUyoNtDSYCvgJnoNzlh+YeAXfIPhCRIXbhWqqM3GQ3AFtZICi85lkyfsrwXEl9wzlPGYnU+Eg8F4tOfScx+FcQ==", + "version": "10.56.0", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.56.0.tgz", + "integrity": "sha512-L+u1dIz5SANrmST5jhIwETtt4apILgKrylv12X4hKJU0PvZl+NorjeV/ty3MwzpKQPg6b6q6qMOSLc1rLpy3iQ==", "license": "MIT", "engines": { "node": ">=18" @@ -3943,15 +3957,15 @@ "license": "MIT" }, "node_modules/@storybook/addon-docs": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.4.1.tgz", - "integrity": "sha512-IYqUdjoZe4VO2LFZlKL/gwy7DsQSWCq6hX+zc1MBmZo04yycDASk1tte57n9pdlW3ajw9yYMF/+lVBi+xQjyvw==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.4.2.tgz", + "integrity": "sha512-CtW1O4xSKZPNtpWgpfp4yB/x4pj/of+3MvlEDfErSlr3Hp3QmEa2pCLaecR08H5LJqJFlt1PtG0UrIynTvgW9w==", "license": "MIT", "dependencies": { "@mdx-js/react": "^3.0.0", - "@storybook/csf-plugin": "10.4.1", + "@storybook/csf-plugin": "10.4.2", "@storybook/icons": "^2.0.2", - "@storybook/react-dom-shim": "10.4.1", + "@storybook/react-dom-shim": "10.4.2", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "ts-dedent": "^2.0.0" @@ -3962,7 +3976,7 @@ }, "peerDependencies": { "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" }, "peerDependenciesMeta": { "@types/react": { @@ -3971,9 +3985,9 @@ } }, "node_modules/@storybook/addon-links": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.4.1.tgz", - "integrity": "sha512-h/5D23GwMuHA55sB7XDyhByF9psF7UFmaQOn72pjNAarew5eOpue5A+jXk3AKEYokHbvgQaoz+FrvWo9GEfSKQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/addon-links/-/addon-links-10.4.2.tgz", + "integrity": "sha512-cU8h4/m+oAr8UUwF4teZG2N1ilV+vU+98Ii/Ma+IIx9M/V7i5544UxfAz84dV5Rx2Oho6x8XH3gIvmevSyPi/Q==", "license": "MIT", "dependencies": { "@storybook/global": "^5.0.0" @@ -3985,7 +3999,7 @@ "peerDependencies": { "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" }, "peerDependenciesMeta": { "@types/react": { @@ -3997,12 +4011,12 @@ } }, "node_modules/@storybook/builder-vite": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.4.1.tgz", - "integrity": "sha512-/oyQrXoNOqN8SW5hNnYP+I1uvgFxKxWXj/EP6NXYzc5SQwImofgru+D2+6gDhL0+Q//+Hx05DJoQO2omvUJ8bQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.4.2.tgz", + "integrity": "sha512-d3+i9vbbUfV6hvT90qabmy1WmC4bEJ7iAYDm0217doeA+S6awF25GF0qOy9gN9waU4NMntHoVpdB1YQO2wUj/w==", "license": "MIT", "dependencies": { - "@storybook/csf-plugin": "10.4.1", + "@storybook/csf-plugin": "10.4.2", "ts-dedent": "^2.0.0" }, "funding": { @@ -4010,14 +4024,14 @@ "url": "https://opencollective.com/storybook" }, "peerDependencies": { - "storybook": "^10.4.1", + "storybook": "^10.4.2", "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, "node_modules/@storybook/csf-plugin": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.4.1.tgz", - "integrity": "sha512-WdPepGBxDGOUDjYd8KxMtcf+us/2PAcnBczl77XtrnxxHNs0jWesxKkiJ9yiuGrge4BPhDeAj6rxjbBoaHxLBA==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.4.2.tgz", + "integrity": "sha512-GqX/2DeF3/jKs5D7gpDiuT9gd0c/f2TKcnQ5av4/s3YqeN+0nhm7btkCrDfgF16uzE1Zj3OrkxvB3AOkfxWgDg==", "license": "MIT", "dependencies": { "unplugin": "^2.3.5" @@ -4029,7 +4043,7 @@ "peerDependencies": { "esbuild": "*", "rollup": "*", - "storybook": "^10.4.1", + "storybook": "^10.4.2", "vite": "*", "webpack": "*" }, @@ -4065,9 +4079,9 @@ } }, "node_modules/@storybook/react-dom-shim": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.4.1.tgz", - "integrity": "sha512-6QFqfDNH4DMrt7yHKRfpqRopsVUc/Az+sXIdJ39IetYnHUxL3nW4NVaPc6uy/8Qi8urzUyEXL/nn7cpSIP2aPQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.4.2.tgz", + "integrity": "sha512-Eng3Yt2NCjPX94QcfyLeUFhrMj0hec2yU9J/qafBVbfj9XrFI8o+0ZwYJ7uXb9ECbvPN4y06dgt/2W/LiR417w==", "license": "MIT", "funding": { "type": "opencollective", @@ -4078,7 +4092,7 @@ "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" }, "peerDependenciesMeta": { "@types/react": { @@ -4090,9 +4104,9 @@ } }, "node_modules/@storybook/web-components": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/web-components/-/web-components-10.4.1.tgz", - "integrity": "sha512-bvvIQZK7vdxoVrBmQtbvtNU5ugFF8dETc0l2j58nPUerDHUook8dFNXUiKfK1KmnLsBZ/7KEjPPmk7sEHygvlQ==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/web-components/-/web-components-10.4.2.tgz", + "integrity": "sha512-dzZhJ1G/kQ3+19ureRsV1s3Sy5krcyf5mGdUa3vdt9SFP1KiAbzUnD8ur/jiUmOKcdn6lrEKMs4NY4rSzU4mPA==", "license": "MIT", "dependencies": { "@storybook/global": "^5.0.0", @@ -4105,24 +4119,24 @@ }, "peerDependencies": { "lit": "^2.0.0 || ^3.0.0", - "storybook": "^10.4.1" + "storybook": "^10.4.2" } }, "node_modules/@storybook/web-components-vite": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/@storybook/web-components-vite/-/web-components-vite-10.4.1.tgz", - "integrity": "sha512-i66ublYmQNK9zvSgiT7w9zSHCcXh+g7lHWFoxO+QX7riRLMmtk5uOlWna9P7Ny41fkoQ7POKWJAuZ9PLBPl/Ug==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/@storybook/web-components-vite/-/web-components-vite-10.4.2.tgz", + "integrity": "sha512-XD0vUnfJVu0aeUlwhiU3mzhdAnWSLPuljcxvWJOk/AvYQ3kKIeiM1OFFbCMUBjs6DTyomyW+t4HrSe20QoHNJg==", "license": "MIT", "dependencies": { - "@storybook/builder-vite": "10.4.1", - "@storybook/web-components": "10.4.1" + "@storybook/builder-vite": "10.4.2", + "@storybook/web-components": "10.4.2" }, "funding": { "type": "opencollective", "url": "https://opencollective.com/storybook" }, "peerDependencies": { - "storybook": "^10.4.1", + "storybook": "^10.4.2", "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, @@ -5604,16 +5618,16 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.60.0.tgz", - "integrity": "sha512-QYb/sa74/s7OKMbACMjrYnGspj9Hs5YI5aaffSL65UfeBUzVzBJfVo3oWSpbzPurvm7yaCCo2Lk7lVj610HqKw==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.60.1.tgz", + "integrity": "sha512-JQ4S5GB0tfjO8BuJ4fcX+HodkzJjYBV+7OJ+wLygaX7OGQ7FudyHL4NSCA6ob+w3Yn+5MkKIozOwQhXeM7opVg==", "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.60.0", - "@typescript-eslint/type-utils": "8.60.0", - "@typescript-eslint/utils": "^8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/scope-manager": "8.60.1", + "@typescript-eslint/type-utils": "8.60.1", + "@typescript-eslint/utils": "8.60.1", + "@typescript-eslint/visitor-keys": "8.60.1", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -5626,19 +5640,19 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.60.0", + "@typescript-eslint/parser": "^8.60.1", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.0.tgz", - "integrity": "sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.1.tgz", + "integrity": "sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0" + "@typescript-eslint/types": "8.60.1", + "@typescript-eslint/visitor-keys": "8.60.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -5649,9 +5663,9 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.0.tgz", - "integrity": "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.1.tgz", + "integrity": "sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -5662,12 +5676,12 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.0.tgz", - "integrity": "sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.1.tgz", + "integrity": "sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", + "@typescript-eslint/types": "8.60.1", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -5700,15 +5714,15 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.60.0.tgz", - "integrity": "sha512-fcqpj/MyK4sxDPcbe7STNPbpQL4RLZOPWuaTmwZYuc+hJKzRf58yRxfhqGpc6PIq9ZyfSBpfHgmUHmHs0KwHwg==", + "version": "8.61.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.61.0.tgz", + "integrity": "sha512-5B7PfA2e1NQGCnDHd/0lW7W3gvp3d59Ryw54FYO8Uswxo9f6ikw3AZV+Xj/TvpImmpsiYyUqAfhC6kJID1jF6w==", "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/scope-manager": "8.61.0", + "@typescript-eslint/types": "8.61.0", + "@typescript-eslint/typescript-estree": "8.61.0", + "@typescript-eslint/visitor-keys": "8.61.0", "debug": "^4.4.3" }, "engines": { @@ -5724,13 +5738,13 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/project-service": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.0.tgz", - "integrity": "sha512-aZu74NNKJeUWqCjDddzdiKaS82dgYgV/vmf+Ui3ZdZejmgfXR/q+pRumgobnQ2cCJTgGTWp4ypiwsuofFubavg==", + "version": "8.61.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.0.tgz", + "integrity": "sha512-DV42F7MLJO6Rax7SK1yg43tcnEfGUrurSpSxKuVX+a3RCTzBlH3fuxprrOJXKCJGAaw82xXocikJ0uQaqwXgGA==", "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.60.0", - "@typescript-eslint/types": "^8.60.0", + "@typescript-eslint/tsconfig-utils": "^8.61.0", + "@typescript-eslint/types": "^8.61.0", "debug": "^4.4.3" }, "engines": { @@ -5745,13 +5759,13 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.0.tgz", - "integrity": "sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw==", + "version": "8.61.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.0.tgz", + "integrity": "sha512-IWdXFHFSb6mlC3HPc7QsLDm5zYEbUla6trDEHf32D3/dnuUyXd87plScSNXSbm0/RxMvObpI17sv/EDTGrGZkA==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0" + "@typescript-eslint/types": "8.61.0", + "@typescript-eslint/visitor-keys": "8.61.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -5762,9 +5776,9 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.0.tgz", - "integrity": "sha512-BZPR3RGYlAXnly6ymAxfkVn5rCbZzQNou0rxv3GfWZ8cTQp+hhVd73khbGLAd8k1TlAPLISH337M+tAgAnaJDQ==", + "version": "8.61.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.0.tgz", + "integrity": "sha512-O5Amvdv9ztMpxpf+vmFULGG78IE6Qwdr3bCGvqwG4nwc9H2qXkOYJJnRbRHyMkQTjv1d03olqwwwzHLMqpFePQ==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -5778,9 +5792,9 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.0.tgz", - "integrity": "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==", + "version": "8.61.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.0.tgz", + "integrity": "sha512-9QTQpZ5Iin4CdIodfbDQFSeiSJKidgYJYug1P9CC2xWgUTvlmixViqDZNciMjwLBZyJnG4tGmPl97rVAFb1AJg==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -5791,15 +5805,15 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.0.tgz", - "integrity": "sha512-3AcZNBGMClm6CXDyo8kYvVGT/sx29sS0oBsIb9oZI2gunA4Vm2M3YHzRLPvsUBBsl+yB5FPtltq7gGH0iTlp9g==", + "version": "8.61.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.0.tgz", + "integrity": "sha512-42zatd5qSvvcV1JdDBCLxYRznvP4eIHpPoZXdkPFnAmanA4FuZ5dibSnCBggY8hQnqajPpoGjXFdZ7fIJKQnlA==", "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.60.0", - "@typescript-eslint/tsconfig-utils": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/project-service": "8.61.0", + "@typescript-eslint/tsconfig-utils": "8.61.0", + "@typescript-eslint/types": "8.61.0", + "@typescript-eslint/visitor-keys": "8.61.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -5818,12 +5832,12 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.0.tgz", - "integrity": "sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg==", + "version": "8.61.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.0.tgz", + "integrity": "sha512-QVLZu3ZPQEE+HICQyAMZ2yLQhxf0meY/wx6Hx14YcTNj13JB3qHlX3lJ02L3fLGHgERRH71kvYDwiXIguT3AjQ==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", + "@typescript-eslint/types": "8.61.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -5883,9 +5897,9 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/semver": { - "version": "7.8.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz", - "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==", + "version": "7.8.3", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.3.tgz", + "integrity": "sha512-wnilbGyMxzbY7dNOl7jpKbLSjcfeweJWU5j4+u5qW+6/wuGD9KzIGOyZnQVSBM9E7DtWaaH3CyHkppYrKYoxwg==", "license": "ISC", "bin": { "semver": "bin/semver.js" @@ -5949,14 +5963,14 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.60.0.tgz", - "integrity": "sha512-SX46wEUtitCpq7AN38HkUU/+zvUpdKf7ephtWAFgckH8O7PQIyL5gvrhQgBLuEYgLfuKWOVvWVskMbuFHAz5xg==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.60.1.tgz", + "integrity": "sha512-sdwTrpjosW7ANQYJ39ZBF1ZyEMEGVB2UsikrserVM/30a/F1dTLnu9bGxEdosugyu5caigjLrR2qiD11asjI1A==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0", - "@typescript-eslint/utils": "^8.60.0", + "@typescript-eslint/types": "8.60.1", + "@typescript-eslint/typescript-estree": "8.60.1", + "@typescript-eslint/utils": "8.60.1", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -5973,13 +5987,13 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/project-service": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.0.tgz", - "integrity": "sha512-aZu74NNKJeUWqCjDddzdiKaS82dgYgV/vmf+Ui3ZdZejmgfXR/q+pRumgobnQ2cCJTgGTWp4ypiwsuofFubavg==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.1.tgz", + "integrity": "sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==", "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.60.0", - "@typescript-eslint/types": "^8.60.0", + "@typescript-eslint/tsconfig-utils": "^8.60.1", + "@typescript-eslint/types": "^8.60.1", "debug": "^4.4.3" }, "engines": { @@ -5994,9 +6008,9 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.0.tgz", - "integrity": "sha512-BZPR3RGYlAXnly6ymAxfkVn5rCbZzQNou0rxv3GfWZ8cTQp+hhVd73khbGLAd8k1TlAPLISH337M+tAgAnaJDQ==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.1.tgz", + "integrity": "sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -6010,9 +6024,9 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.0.tgz", - "integrity": "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.1.tgz", + "integrity": "sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -6023,15 +6037,15 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.0.tgz", - "integrity": "sha512-3AcZNBGMClm6CXDyo8kYvVGT/sx29sS0oBsIb9oZI2gunA4Vm2M3YHzRLPvsUBBsl+yB5FPtltq7gGH0iTlp9g==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.1.tgz", + "integrity": "sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==", "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.60.0", - "@typescript-eslint/tsconfig-utils": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/project-service": "8.60.1", + "@typescript-eslint/tsconfig-utils": "8.60.1", + "@typescript-eslint/types": "8.60.1", + "@typescript-eslint/visitor-keys": "8.60.1", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -6050,12 +6064,12 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.0.tgz", - "integrity": "sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.1.tgz", + "integrity": "sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", + "@typescript-eslint/types": "8.60.1", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -6115,9 +6129,9 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/semver": { - "version": "7.8.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz", - "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==", + "version": "7.8.3", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.3.tgz", + "integrity": "sha512-wnilbGyMxzbY7dNOl7jpKbLSjcfeweJWU5j4+u5qW+6/wuGD9KzIGOyZnQVSBM9E7DtWaaH3CyHkppYrKYoxwg==", "license": "ISC", "bin": { "semver": "bin/semver.js" @@ -6215,15 +6229,15 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.60.0.tgz", - "integrity": "sha512-HtXuPfrHTyBDkameWpl+vJb1Uevu2tznAyahM1Oc4AENidCLTPiZDWIo4GfcxNdC/RcfGcadzzkqbRG87dUrQA==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.60.1.tgz", + "integrity": "sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==", "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/typescript-estree": "8.60.0" + "@typescript-eslint/scope-manager": "8.60.1", + "@typescript-eslint/types": "8.60.1", + "@typescript-eslint/typescript-estree": "8.60.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -6238,13 +6252,13 @@ } }, "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/project-service": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.0.tgz", - "integrity": "sha512-aZu74NNKJeUWqCjDddzdiKaS82dgYgV/vmf+Ui3ZdZejmgfXR/q+pRumgobnQ2cCJTgGTWp4ypiwsuofFubavg==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.1.tgz", + "integrity": "sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==", "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.60.0", - "@typescript-eslint/types": "^8.60.0", + "@typescript-eslint/tsconfig-utils": "^8.60.1", + "@typescript-eslint/types": "^8.60.1", "debug": "^4.4.3" }, "engines": { @@ -6259,13 +6273,13 @@ } }, "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/scope-manager": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.0.tgz", - "integrity": "sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.1.tgz", + "integrity": "sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0" + "@typescript-eslint/types": "8.60.1", + "@typescript-eslint/visitor-keys": "8.60.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -6276,9 +6290,9 @@ } }, "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.0.tgz", - "integrity": "sha512-BZPR3RGYlAXnly6ymAxfkVn5rCbZzQNou0rxv3GfWZ8cTQp+hhVd73khbGLAd8k1TlAPLISH337M+tAgAnaJDQ==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.1.tgz", + "integrity": "sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -6292,9 +6306,9 @@ } }, "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/types": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.0.tgz", - "integrity": "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.1.tgz", + "integrity": "sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -6305,15 +6319,15 @@ } }, "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.0.tgz", - "integrity": "sha512-3AcZNBGMClm6CXDyo8kYvVGT/sx29sS0oBsIb9oZI2gunA4Vm2M3YHzRLPvsUBBsl+yB5FPtltq7gGH0iTlp9g==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.1.tgz", + "integrity": "sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==", "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.60.0", - "@typescript-eslint/tsconfig-utils": "8.60.0", - "@typescript-eslint/types": "8.60.0", - "@typescript-eslint/visitor-keys": "8.60.0", + "@typescript-eslint/project-service": "8.60.1", + "@typescript-eslint/tsconfig-utils": "8.60.1", + "@typescript-eslint/types": "8.60.1", + "@typescript-eslint/visitor-keys": "8.60.1", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -6332,12 +6346,12 @@ } }, "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/visitor-keys": { - "version": "8.60.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.0.tgz", - "integrity": "sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg==", + "version": "8.60.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.1.tgz", + "integrity": "sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==", "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.60.0", + "@typescript-eslint/types": "8.60.1", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -6397,9 +6411,9 @@ } }, "node_modules/@typescript-eslint/utils/node_modules/semver": { - "version": "7.8.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz", - "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==", + "version": "7.8.3", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.3.tgz", + "integrity": "sha512-wnilbGyMxzbY7dNOl7jpKbLSjcfeweJWU5j4+u5qW+6/wuGD9KzIGOyZnQVSBM9E7DtWaaH3CyHkppYrKYoxwg==", "license": "ISC", "bin": { "semver": "bin/semver.js" @@ -9387,6 +9401,12 @@ "integrity": "sha512-PwfIw7WQSt3xX7yOf5OE/unLzsK9CaN2f/FvV3WjPR1Knoc1T9vePRVV4W1EM301JzzysK51K7FNKcusCr0zYA==", "license": "ISC" }, + "node_modules/elkjs": { + "version": "0.9.3", + "resolved": "https://registry.npmjs.org/elkjs/-/elkjs-0.9.3.tgz", + "integrity": "sha512-f/ZeWvW/BCXbhGEf1Ujp29EASo/lk1FDnETgNKwJrsVvGZhUWCZyg3xLJjAsxfOmt8KjswHmI5EwCQcPMpOYhQ==", + "license": "EPL-2.0" + }, "node_modules/emoji-regex": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", @@ -17184,9 +17204,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.3", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz", - "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==", + "version": "1.8.4", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", + "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", "license": "MIT", "engines": { "node": ">= 0.4" @@ -17576,9 +17596,9 @@ } }, "node_modules/storybook": { - "version": "10.4.1", - "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.4.1.tgz", - "integrity": "sha512-V1Zd2e+gBFufqAQVZ1JR8KLqALsEZ3JYSBnWwQbKa6zCfWWanR6AFMyuOkLt2gZOgGp3h2Riuz88pGNVTQSG0A==", + "version": "10.4.2", + "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.4.2.tgz", + "integrity": "sha512-5Ax5vbHxFgMBGGhQDm75Rrumm/HZC4ICFhMcJaM0UlqnC/4FKj/IaZtImZFupknyiiyUEcWHPQFA2kX3/VSv1A==", "license": "MIT", "dependencies": { "@storybook/global": "^5.0.0", @@ -20916,7 +20936,7 @@ "version": "1.0.0", "license": "MIT", "dependencies": { - "@goauthentik/tsconfig": "^1.0.9", + "@goauthentik/tsconfig": "^2.0.0", "@types/node": "^25.7.0", "@types/semver": "^7.7.1", "semver": "^7.7.4", @@ -20927,6 +20947,16 @@ "npm": ">=11.14.1" } }, + "packages/core/node_modules/@goauthentik/tsconfig": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@goauthentik/tsconfig/-/tsconfig-2.0.0.tgz", + "integrity": "sha512-HiU/U9cO4Aaik3VjUHu/3PjD0m2nhIJXlENW1kbfVRFBaqAw//9UuHIel2E3vgwyua93fht36cBb8itZVsG1Vg==", + "license": "MIT", + "engines": { + "node": ">=24", + "npm": ">=11.14.1" + } + }, "packages/core/node_modules/semver": { "version": "7.7.4", "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz", diff --git a/web/package.json b/web/package.json index 2159a0b8f0..b873955a52 100644 --- a/web/package.json +++ b/web/package.json @@ -112,6 +112,7 @@ "@lit/reactive-element": "^2.1.2", "@lit/task": "^1.0.3", "@mdx-js/mdx": "^3.1.1", + "@mermaid-js/layout-elk": "^0.2.1", "@mrmarble/djangoql-completion": "^0.8.3", "@open-wc/lit-helpers": "^0.7.0", "@openlayers-elements/core": "^0.4.0", @@ -119,18 +120,18 @@ "@patternfly/elements": "^4.4.0", "@patternfly/patternfly": "^4.224.2", "@playwright/test": "^1.60.0", - "@sentry/browser": "^10.55.0", - "@storybook/addon-docs": "^10.4.1", - "@storybook/addon-links": "^10.4.1", - "@storybook/web-components": "^10.4.1", - "@storybook/web-components-vite": "^10.4.1", + "@sentry/browser": "^10.56.0", + "@storybook/addon-docs": "^10.4.2", + "@storybook/addon-links": "^10.4.2", + "@storybook/web-components": "^10.4.2", + "@storybook/web-components-vite": "^10.4.2", "@types/codemirror": "^5.60.17", "@types/grecaptcha": "^3.0.9", "@types/guacamole-common-js": "^1.5.5", "@types/node": "^25.7.0", "@types/react": "^19.2.14", "@types/react-dom": "^19.2.3", - "@typescript-eslint/eslint-plugin": "^8.60.0", + "@typescript-eslint/eslint-plugin": "^8.60.1", "@typescript-eslint/parser": "^8.60.0", "@typescript-eslint/utils": "^8.60.0", "@typescript/native-preview": "^7.0.0-dev.20260510.1", @@ -212,14 +213,10 @@ ], "wireit": { "build": { - "#comment": [ - "`npm run build` and `npm run watch` are the most common ", - "commands you should be using when working on the front end", - "The files and output spec here expect you to use `npm run build --watch` ", - "instead of `npm run watch`. The former is more comprehensive, but ", - "the latter is faster." - ], "command": "${NODE_RUNNER} scripts/build-web.mjs", + "dependencies": [ + "build-locales" + ], "files": [ "src/**/*.{css,jpg,png,ts,js,json}", "!src/**/*.stories.ts", @@ -239,8 +236,12 @@ "./dist/poly-*.js.map", "./dist/styles/**" ], - "dependencies": [ - "build-locales" + "#comment": [ + "`npm run build` and `npm run watch` are the most common ", + "commands you should be using when working on the front end", + "The files and output spec here expect you to use `npm run build --watch` ", + "instead of `npm run watch`. The former is more comprehensive, but ", + "the latter is faster." ], "env": { "NODE_RUNNER": { @@ -255,9 +256,6 @@ "build-locales" ] }, - "locales:repair": { - "command": "prettier --write ./src/locale-codes.ts" - }, "lint:components": { "command": "lit-analyzer src" }, @@ -270,6 +268,9 @@ "lit-analyse": { "command": "lit-analyzer src" }, + "locales:repair": { + "command": "prettier --write ./src/locale-codes.ts" + }, "precommit": { "command": "prettier --write .", "dependencies": [ diff --git a/web/packages/core/package.json b/web/packages/core/package.json index df396010c1..5b734d756a 100644 --- a/web/packages/core/package.json +++ b/web/packages/core/package.json @@ -44,7 +44,7 @@ } }, "dependencies": { - "@goauthentik/tsconfig": "^1.0.9", + "@goauthentik/tsconfig": "^2.0.0", "@types/node": "^25.7.0", "@types/semver": "^7.7.1", "semver": "^7.7.4", diff --git a/web/src/admin/flows/FlowDiagram.ts b/web/src/admin/flows/FlowDiagram.ts index f2e93d7650..dcd08329a7 100644 --- a/web/src/admin/flows/FlowDiagram.ts +++ b/web/src/admin/flows/FlowDiagram.ts @@ -2,28 +2,29 @@ import "#elements/EmptyState"; import { aki } from "#common/api/client"; -import { Diagram } from "#elements/Diagram"; +import { Diagram } from "#elements/Diagram/ak-diagram"; import { FlowsApi } from "@goauthentik/api"; +import { observes } from "@patternfly/pfe-core/decorators/observes.js"; + import { customElement, property } from "lit/decorators.js"; @customElement("ak-flow-diagram") export class FlowDiagram extends Diagram { - @property() - flowSlug?: string; + @property({ type: String, useDefault: true }) + public flowSlug: string | null = null; - refreshHandler = (): void => { - this.diagram = undefined; + @observes("flowSlug") + protected refresh(): void { aki(FlowsApi) .flowsInstancesDiagramRetrieve({ slug: this.flowSlug || "", }) .then((data) => { this.diagram = data.diagram; - this.requestUpdate(); }); - }; + } } declare global { diff --git a/web/src/admin/sources/oauth/OAuthSourceDiagram.ts b/web/src/admin/sources/oauth/OAuthSourceDiagram.ts index a1151ffa61..efbfb2710d 100644 --- a/web/src/admin/sources/oauth/OAuthSourceDiagram.ts +++ b/web/src/admin/sources/oauth/OAuthSourceDiagram.ts @@ -1,4 +1,4 @@ -import { Diagram } from "#elements/Diagram"; +import { Diagram } from "#elements/Diagram/ak-diagram"; import { UserMatchingModeToLabel } from "#admin/sources/oauth/utils"; @@ -9,22 +9,26 @@ import { customElement, property } from "lit/decorators.js"; @customElement("ak-source-oauth-diagram") export class OAuthSourceDiagram extends Diagram { - @property({ attribute: false }) - source?: OAuthSource; + @property({ attribute: false, useDefault: true }) + public source: OAuthSource | null = null; - refreshHandler = (): void => { + protected override syncDiagramContent = (): void => { if (!this.source) return; - const graph = ["graph LR"]; - graph.push(`source[${msg(str`OAuth Source ${this.source.name}`)}]`); - graph.push( + + const graph = [ + "graph LR", + `source[${msg(str`OAuth Source ${this.source.name}`)}]`, `source --> flow_manager["${UserMatchingModeToLabel(this.source.userMatchingMode || UserMatchingModeEnum.Identifier)}"]`, - ); + ]; + if (this.source.enrollmentFlow) { graph.push("flow_manager --> flow_enroll[Enrollment flow]"); } + if (this.source.authenticationFlow) { graph.push("flow_manager --> flow_auth[Authentication flow]"); } + this.diagram = graph.join("\n"); }; } diff --git a/web/src/admin/sources/oauth/OAuthSourceViewPage.ts b/web/src/admin/sources/oauth/OAuthSourceViewPage.ts index a3d130a41e..317d50bea6 100644 --- a/web/src/admin/sources/oauth/OAuthSourceViewPage.ts +++ b/web/src/admin/sources/oauth/OAuthSourceViewPage.ts @@ -37,8 +37,6 @@ export function ProviderToLabel(provider?: ProviderTypeEnum): string { return ""; case ProviderTypeEnum.Apple: return "Apple"; - case ProviderTypeEnum.Azuread: - return "Azure Active Directory (Deprecated)"; case ProviderTypeEnum.Discord: return "Discord"; case ProviderTypeEnum.Facebook: diff --git a/web/src/admin/stages/authenticator_validate/AuthenticatorValidateStageForm.ts b/web/src/admin/stages/authenticator_validate/AuthenticatorValidateStageForm.ts index 1989210307..bf1cb5db7d 100644 --- a/web/src/admin/stages/authenticator_validate/AuthenticatorValidateStageForm.ts +++ b/web/src/admin/stages/authenticator_validate/AuthenticatorValidateStageForm.ts @@ -1,5 +1,4 @@ import "#elements/ak-checkbox-group/ak-checkbox-group"; -import "#elements/Alert"; import "#elements/ak-dual-select/ak-dual-select-dynamic-selected-provider"; import "#elements/ak-dual-select/ak-dual-select-provider"; import "#elements/forms/FormGroup"; @@ -362,14 +361,6 @@ export class AuthenticatorValidateStageForm extends BaseStageForm - - ${ - /* TODO: Remove this after 2024.6..or maybe later? */ - msg( - "This restriction only applies to devices created in authentik 2024.4 or later.", - ) - } - diff --git a/web/src/admin/stages/captcha/CaptchaStageForm.ts b/web/src/admin/stages/captcha/CaptchaStageForm.ts index 6c962e3ac2..387f71815c 100644 --- a/web/src/admin/stages/captcha/CaptchaStageForm.ts +++ b/web/src/admin/stages/captcha/CaptchaStageForm.ts @@ -14,9 +14,11 @@ import { SlottedTemplateResult } from "#elements/types"; import { BaseStageForm } from "#admin/stages/BaseStageForm"; import { CAPTCHA_PROVIDERS, + CAPTCHA_REQUEST_CONTENT_TYPES, CaptchaProviderKey, CaptchaProviderKeys, CaptchaProviderPreset, + deriveCapSiteVerifyURL, detectProviderFromInstance, pluckFormValues, } from "#admin/stages/captcha/shared"; @@ -35,6 +37,10 @@ import { customElement, state } from "lit/decorators.js"; import { guard } from "lit/directives/guard.js"; import { ifDefined } from "lit/directives/if-defined.js"; +type CaptchaStageFormRequest = (CaptchaStageRequest | PatchedCaptchaStageRequest) & { + capEndpoint?: string; +}; + @customElement("ak-stage-captcha-form") export class CaptchaStageForm extends BaseStageForm { public static override readonly styles = [...super.styles, Styles]; @@ -83,6 +89,26 @@ export class CaptchaStageForm extends BaseStageForm { public async send( data: CaptchaStageRequest | PatchedCaptchaStageRequest, ): Promise { + const formData = data as CaptchaStageFormRequest; + + if (this.selectedProvider === "cap" && (formData.capEndpoint || formData.publicKey)) { + const capEndpoint = formData.capEndpoint || formData.publicKey || ""; + + formData.publicKey = capEndpoint; + delete formData.capEndpoint; + + const presetURL = CAPTCHA_PROVIDERS.cap.apiUrl; + // The Cap verification URL includes the site key, so derive it from the + // widget endpoint unless the advanced field was explicitly customized. + if (!data.apiUrl || data.apiUrl === presetURL) { + const siteVerifyURL = deriveCapSiteVerifyURL(capEndpoint); + + if (siteVerifyURL) { + data.apiUrl = siteVerifyURL; + } + } + } + if (this.instance) { return this.#api.stagesCaptchaPartialUpdate({ stageUuid: this.instance.pk || "", @@ -117,43 +143,77 @@ export class CaptchaStageForm extends BaseStageForm {

${guard([this.#currentPreset], () => { - const { formatAPISource, keyURL } = this.#currentPreset; + const { formatAPISource, formatDescription, keyURL } = this.#currentPreset; - if (!formatAPISource || !keyURL) { - return null; - } + const description = formatDescription + ? html`

${formatDescription()}

` + : null; + const providerLink = + formatAPISource && keyURL + ? html` + ${this.selectedProvider === "cap" + ? msg( + html`Use the + ${html`${formatAPISource()}`} + to self-host Cap and configure the endpoint.`, + { + id: "captcha.provider-link.cap", + desc: "Supplementary help text with link to Cap documentation.", + }, + ) + : msg( + html`API keys can be obtained from the + ${html`${formatAPISource()}.`}`, + { + id: "captcha.provider-link", + desc: "Supplementary help text with link to provider dashboard.", + }, + )} + ` + : null; - return html` - ${msg( - html`API keys can be obtained from the - ${html`${formatAPISource()}.`}`, - { - id: "captcha.provider-link", - desc: "Supplementary help text with link to provider dashboard.", - }, - )} - `; + return html`${description} ${providerLink}`; })} `; } protected renderKeyFields(): SlottedTemplateResult { + const isCapProvider = this.selectedProvider === "cap"; + const publicKeyLabel = isCapProvider ? msg("Cap Endpoint") : msg("Public Key"); + const publicKeyPlaceholder = isCapProvider + ? msg("https://cap.example.com/site-key/") + : msg("Paste your CAPTCHA public key..."); + const publicKeyHelp = isCapProvider + ? msg("The public site-key endpoint of your Cap server.", { + id: "captcha.cap-endpoint.description", + desc: "Description for Cap endpoint field.", + }) + : msg("The public key is used by authentik to render the CAPTCHA widget.", { + id: "captcha.public-key.description", + desc: "Description for CAPTCHA public key field.", + }); + return html` @@ -236,9 +296,13 @@ export class CaptchaStageForm extends BaseStageForm { type="url" value="${ifDefined(formValues.jsUrl)}" required - help=${msg( - "URL to fetch the CAPTCHA JavaScript library from. Automatically set based on provider selection but can be customized.", - )} + help=${this.selectedProvider === "cap" + ? msg( + "For Cap, prefer the self-hosted widget asset, for example https://cap.example.com/assets/widget.js. If using a CDN, pin a reviewed release.", + ) + : msg( + "URL to fetch the CAPTCHA JavaScript library from. Automatically set based on provider selection but can be customized.", + )} > { type="url" value="${ifDefined(formValues.apiUrl)}" required - help=${msg( - "URL used to validate CAPTCHA response on the backend. Automatically set based on provider selection but can be customized.", - )} + help=${this.selectedProvider === "cap" + ? msg( + "Cap's server-side verification endpoint, for example https://cap.example.com/site-key/siteverify.", + ) + : msg( + "URL used to validate CAPTCHA response on the backend. Automatically set based on provider selection but can be customized.", + )} > + + +

+ ${msg( + "Content-Type used for server-side verification. Cap requires JSON; most other providers use form-encoded requests.", + )} +

+
`; } diff --git a/web/src/admin/stages/captcha/shared.ts b/web/src/admin/stages/captcha/shared.ts index ce10318569..f7eb92d518 100644 --- a/web/src/admin/stages/captcha/shared.ts +++ b/web/src/admin/stages/captcha/shared.ts @@ -2,12 +2,35 @@ import { CaptchaStage, CaptchaStageRequest } from "@goauthentik/api"; import { msg } from "@lit/localize"; +export type CaptchaRequestContentType = "application/x-www-form-urlencoded" | "application/json"; + +export const CAPTCHA_REQUEST_CONTENT_TYPES = [ + { + value: "application/x-www-form-urlencoded", + formatDisplayName: () => + msg("Form encoded", { + id: "captcha.request-content-type.form", + }), + }, + { + value: "application/json", + formatDisplayName: () => + msg("JSON", { + id: "captcha.request-content-type.json", + }), + }, +] as const satisfies { + value: CaptchaRequestContentType; + formatDisplayName: () => string; +}[]; + export const CaptchaProviderKeys = [ "recaptcha_v2", "recaptcha_v3", "recaptcha_enterprise", "hcaptcha", "turnstile", + "cap", "custom", ] as const satisfies string[]; @@ -15,8 +38,10 @@ export type CaptchaProviderKey = (typeof CaptchaProviderKeys)[number]; export interface CaptchaProviderPreset { formatDisplayName: () => string; + formatDescription?: () => string; jsUrl: string; apiUrl: string; + requestContentType: CaptchaRequestContentType; interactive: boolean; supportsScore: boolean; score?: { min: number; max: number }; @@ -37,6 +62,7 @@ export const CAPTCHA_PROVIDERS = { }), jsUrl: "https://www.recaptcha.net/recaptcha/api.js", apiUrl: "https://www.recaptcha.net/recaptcha/api/siteverify", + requestContentType: "application/x-www-form-urlencoded", interactive: true, supportsScore: false, formatAPISource: () => @@ -52,6 +78,7 @@ export const CAPTCHA_PROVIDERS = { }), jsUrl: "https://www.recaptcha.net/recaptcha/api.js", apiUrl: "https://www.recaptcha.net/recaptcha/api/siteverify", + requestContentType: "application/x-www-form-urlencoded", interactive: false, supportsScore: true, score: { min: 0.5, max: 1.0 }, @@ -68,6 +95,7 @@ export const CAPTCHA_PROVIDERS = { }), jsUrl: "https://www.recaptcha.net/recaptcha/enterprise.js", apiUrl: "https://www.recaptcha.net/recaptcha/api/siteverify", + requestContentType: "application/x-www-form-urlencoded", interactive: false, supportsScore: true, score: { min: 0.5, max: 1.0 }, @@ -84,6 +112,7 @@ export const CAPTCHA_PROVIDERS = { }), jsUrl: "https://js.hcaptcha.com/1/api.js", apiUrl: "https://api.hcaptcha.com/siteverify", + requestContentType: "application/x-www-form-urlencoded", interactive: true, supportsScore: true, score: { min: 0.0, max: 0.5 }, @@ -100,6 +129,7 @@ export const CAPTCHA_PROVIDERS = { }), jsUrl: "https://challenges.cloudflare.com/turnstile/v0/api.js", apiUrl: "https://challenges.cloudflare.com/turnstile/v0/siteverify", + requestContentType: "application/x-www-form-urlencoded", interactive: true, supportsScore: false, formatAPISource: () => @@ -108,6 +138,26 @@ export const CAPTCHA_PROVIDERS = { }), keyURL: "https://dash.cloudflare.com", }, + cap: { + formatDisplayName: () => + msg("Cap", { + id: "captcha.providers.cap", + }), + formatDescription: () => + msg("Cap is a self-hostable CAPTCHA server that uses proof-of-work challenges.", { + id: "captcha.providers.cap.description", + }), + jsUrl: "https://cap.example.com/assets/widget.js", + apiUrl: "https://cap.example.com/site-key/siteverify", + requestContentType: "application/json", + interactive: true, + supportsScore: false, + formatAPISource: () => + msg("Cap documentation", { + id: "captcha.providers.cap.setup-guide", + }), + keyURL: "https://trycap.dev/guide/", + }, custom: { formatDisplayName: () => msg("Custom", { @@ -115,23 +165,56 @@ export const CAPTCHA_PROVIDERS = { }), jsUrl: "https://www.recaptcha.net/recaptcha/api.js", apiUrl: "https://www.recaptcha.net/recaptcha/api/siteverify", + requestContentType: "application/x-www-form-urlencoded", interactive: false, supportsScore: true, score: { min: 0.5, max: 1.0 }, }, } as const satisfies Record; +export function deriveCapSiteVerifyURL(endpoint: string): string | null { + const trimmedEndpoint = endpoint.trim(); + + if (!URL.canParse(trimmedEndpoint)) { + return null; + } + + const endpointURL = new URL(trimmedEndpoint); + const normalizedEndpoint = endpointURL.href.endsWith("/") + ? endpointURL.href + : `${endpointURL.href}/`; + + return new URL("siteverify", normalizedEndpoint).toString(); +} + /** * Detect which provider preset matches the given {@linkcode CaptchaStage} instance. * This allows the form to show the correct provider in the dropdown when editing * an existing CAPTCHA stage. Falls back to "custom" if no match is found. */ +function isCapWidgetURL(jsUrl?: string | null): boolean { + if (!jsUrl || !URL.canParse(jsUrl)) { + return false; + } + + const { pathname } = new URL(jsUrl); + return pathname.includes("cap-widget") || pathname.endsWith("/assets/widget.js"); +} + export function detectProviderFromInstance(stage?: CaptchaStage | null): CaptchaProviderKey { if (!stage) return "custom"; for (const key of CaptchaProviderKeys) { const preset = CAPTCHA_PROVIDERS[key]; + if ( + key === "cap" && + isCapWidgetURL(stage.jsUrl) && + stage.requestContentType === preset.requestContentType + ) { + return key; + } + if (stage.jsUrl === preset.jsUrl && stage.apiUrl === preset.apiUrl) { return key; } @@ -153,6 +236,7 @@ export function pluckFormValues( return { jsUrl: instance.jsUrl, apiUrl: instance.apiUrl, + requestContentType: instance.requestContentType, interactive: instance.interactive, scoreMinThreshold: instance.scoreMinThreshold, scoreMaxThreshold: instance.scoreMaxThreshold, @@ -163,6 +247,7 @@ export function pluckFormValues( return { jsUrl: preset.jsUrl, apiUrl: preset.apiUrl, + requestContentType: preset.requestContentType, interactive: preset.interactive, scoreMinThreshold: preset.score?.min ?? 0.5, scoreMaxThreshold: preset.score?.max ?? 1.0, diff --git a/web/src/common/theme.ts b/web/src/common/theme.ts index 6bc5717d79..6966c50111 100644 --- a/web/src/common/theme.ts +++ b/web/src/common/theme.ts @@ -261,26 +261,29 @@ declare global { * @param hint The color scheme hint to use. * @param doc The document to apply the theme to. */ -export const applyDocumentTheme = ((currentUITheme = resolveUITheme(), doc = document): void => { +export const applyDocumentTheme = (( + currentUITheme = resolveUITheme(), + ownerDocument = document, +): void => { console.debug(`authentik/theme (document): want to switch to ${currentUITheme} theme`); - const { themeChoice } = doc.documentElement.dataset; + const { themeChoice } = ownerDocument.documentElement.dataset; if (themeChoice && themeChoice !== "auto") { console.debug( `authentik/theme (document): skipping theme application due to explicit choice (${themeChoice})`, ); - doc.dispatchEvent(new ThemeChangeEvent(themeChoice)); + ownerDocument.dispatchEvent(new ThemeChangeEvent(themeChoice)); return; } - doc.documentElement.dataset.theme = currentUITheme; + ownerDocument.documentElement.dataset.theme = currentUITheme; console.debug(`authentik/theme (document): switching to ${currentUITheme} theme`); - doc.dispatchEvent(new ThemeChangeEvent(currentUITheme)); + ownerDocument.dispatchEvent(new ThemeChangeEvent(currentUITheme)); }) satisfies UIThemeListener; /** diff --git a/web/src/elements/Diagram.ts b/web/src/elements/Diagram.ts deleted file mode 100644 index 12b4fa686e..0000000000 --- a/web/src/elements/Diagram.ts +++ /dev/null @@ -1,103 +0,0 @@ -import "#elements/EmptyState"; - -import { EVENT_REFRESH } from "#common/constants"; -import { DOM_PURIFY_STRICT } from "#common/purify"; -import { ThemeChangeEvent } from "#common/theme"; - -import { AKElement } from "#elements/Base"; - -import { UiThemeEnum } from "@goauthentik/api"; - -import mermaid, { MermaidConfig } from "mermaid"; - -import { css, CSSResult, html, TemplateResult } from "lit"; -import { customElement, property } from "lit/decorators.js"; -import { unsafeHTML } from "lit/directives/unsafe-html.js"; -import { until } from "lit/directives/until.js"; - -@customElement("ak-diagram") -export class Diagram extends AKElement { - @property({ attribute: false }) - diagram?: string; - - refreshHandler = (): void => { - if (!this.textContent) return; - this.diagram = this.textContent; - }; - - handlerBound = false; - - static styles: CSSResult[] = [ - css` - :host { - display: flex; - justify-content: center; - } - `, - ]; - - config: MermaidConfig; - - constructor() { - super(); - this.config = { - // The type definition for this says number - // but the example use strings - // and numbers don't work - logLevel: "fatal", - startOnLoad: false, - flowchart: { - curve: "linear", - }, - htmlLabels: false, - securityLevel: "strict", - dompurifyConfig: DOM_PURIFY_STRICT, - }; - mermaid.initialize(this.config); - } - - firstUpdated(): void { - if (this.handlerBound) return; - window.addEventListener(EVENT_REFRESH, this.refreshHandler); - this.addEventListener(ThemeChangeEvent.eventName, ((ev: CustomEvent) => { - if (ev.detail === UiThemeEnum.Dark) { - this.config.theme = "dark"; - } else { - this.config.theme = "default"; - } - mermaid.initialize(this.config); - }) as EventListener); - this.handlerBound = true; - this.refreshHandler(); - } - - disconnectedCallback(): void { - super.disconnectedCallback(); - window.removeEventListener(EVENT_REFRESH, this.refreshHandler); - } - - render(): TemplateResult { - this.querySelectorAll("*").forEach((el) => { - try { - el.remove(); - } catch { - console.debug(`authentik/diagram: failed to remove element ${el}`); - } - }); - if (!this.diagram) { - return html``; - } - return html`${until( - mermaid.render("graph", this.diagram).then((r) => { - r.bindFunctions?.(this.shadowRoot as unknown as Element); - return unsafeHTML(r.svg); - }), - )}`; - } -} - -declare global { - interface HTMLElementTagNameMap { - "ak-diagram": Diagram; - } -} diff --git a/web/src/elements/Diagram/ak-diagram.css b/web/src/elements/Diagram/ak-diagram.css new file mode 100644 index 0000000000..f21bc9f9bb --- /dev/null +++ b/web/src/elements/Diagram/ak-diagram.css @@ -0,0 +1,4 @@ +:host { + display: flex; + justify-content: center; +} diff --git a/web/src/elements/Diagram/ak-diagram.ts b/web/src/elements/Diagram/ak-diagram.ts new file mode 100644 index 0000000000..a0ab870a79 --- /dev/null +++ b/web/src/elements/Diagram/ak-diagram.ts @@ -0,0 +1,88 @@ +import "#elements/EmptyState"; + +import { AKRefreshEvent } from "#common/events"; + +import { AKElement } from "#elements/Base"; +import { listen } from "#elements/decorators/listen"; +import Styles from "#elements/Diagram/ak-diagram.css"; +import { EmptyState } from "#elements/EmptyState"; +import MermaidStyles from "#elements/mermaid/mermaid.css"; +import { loadMermaid } from "#elements/mermaid/utils"; +import { SlottedTemplateResult } from "#elements/types"; + +import { CSSResult, PropertyValues } from "lit"; +import { guard } from "lit-html/directives/guard.js"; +import { customElement, property } from "lit/decorators.js"; +import { unsafeHTML } from "lit/directives/unsafe-html.js"; +import { until } from "lit/directives/until.js"; + +@customElement("ak-diagram") +export class Diagram extends AKElement { + static styles: CSSResult[] = [MermaidStyles, Styles]; + + #diagram = ""; + @property({ attribute: false, useDefault: true }) + public get diagram(): string { + return this.#diagram || this.textContent.trim() || ""; + } + + public set diagram(value: string) { + const previous = this.#diagram; + this.#diagram = value.trim(); + + this.requestUpdate("diagram", previous); + } + + @listen(AKRefreshEvent, { + target: window, + }) + protected syncDiagramContent = (): void => { + if (!this.textContent) return; + this.diagram = this.textContent; + }; + + loadingPlaceholder: EmptyState; + + constructor() { + super(); + this.loadingPlaceholder = new EmptyState(); + this.loadingPlaceholder.loading = true; + } + + protected firstUpdated(changedProperties: PropertyValues): void { + super.firstUpdated(changedProperties); + this.syncDiagramContent(); + } + + protected renderMermaid(): Promise { + return loadMermaid(this.activeTheme).then((mermaid) => { + if (!this.diagram) { + return null; + } + + return mermaid.render(`mermaid-svg-${this.localName}`, this.diagram).then((result) => { + result.bindFunctions?.(this.renderRoot as HTMLElement); + + return unsafeHTML(result.svg); + }); + }); + } + + protected override render(): SlottedTemplateResult { + const { diagram, loadingPlaceholder, activeTheme } = this; + + return guard([diagram, activeTheme], () => { + if (!diagram) { + return loadingPlaceholder; + } + + return until(this.renderMermaid(), loadingPlaceholder); + }); + } +} + +declare global { + interface HTMLElementTagNameMap { + "ak-diagram": Diagram; + } +} diff --git a/web/src/elements/ak-dual-select/components/ak-pagination.ts b/web/src/elements/ak-dual-select/components/ak-pagination.ts index ebafbd2555..96d42c6bcc 100644 --- a/web/src/elements/ak-dual-select/components/ak-pagination.ts +++ b/web/src/elements/ak-dual-select/components/ak-pagination.ts @@ -18,8 +18,8 @@ export class AkPagination extends CustomEmitterElement(AKEl css` :host([theme="dark"]) { .pf-c-pagination__nav-control .pf-c-button { - color: var(--pf-c-button--m-plain--disabled--Color); - --pf-c-button--disabled--Color: var(--pf-c-button--m-plain--Color); + color: var(--pf-c-button--m-plain--Color); + --pf-c-button--disabled--Color: var(--pf-c-button--m-plain--disabled--Color); } .pf-c-pagination__nav-control .pf-c-button:disabled { diff --git a/web/src/elements/ak-mdx/ak-mdx.tsx b/web/src/elements/ak-mdx/ak-mdx.tsx index 94d100d833..cbc50c2dcc 100644 --- a/web/src/elements/ak-mdx/ak-mdx.tsx +++ b/web/src/elements/ak-mdx/ak-mdx.tsx @@ -11,12 +11,12 @@ import { remarkHeadings } from "#elements/ak-mdx/remark/remark-headings"; import { remarkLists } from "#elements/ak-mdx/remark/remark-lists"; import Styles from "#elements/ak-mdx/styles.css"; import { AKElement } from "#elements/Base"; +import MermaidStyles from "#elements/mermaid/mermaid.css"; +import { loadMermaid } from "#elements/mermaid/utils"; import { DistDirectoryName, StaticDirectoryName } from "#paths"; import OneDark from "#styles/atom/one-dark.css"; -import { UiThemeEnum } from "@goauthentik/api"; - import { compile as compileMDX, run as runMDX } from "@mdx-js/mdx"; import apacheGrammar from "highlight.js/lib/languages/apache"; import diffGrammar from "highlight.js/lib/languages/diff"; @@ -77,6 +77,7 @@ export class AKMDX extends AKElement { PFTable, PFContent, OneDark, + MermaidStyles, Styles, ]; @@ -113,6 +114,8 @@ export class AKMDX extends AKElement { mdxModule.content, ); + const { activeTheme } = this; + const mdx = await compileMDX(normalized, { outputFormat: "function-body", remarkPlugins: [ @@ -132,7 +135,8 @@ export class AKMDX extends AKElement { rehypeMermaid, { prefix: "mermaid-svg-", - colorScheme: this.activeTheme === UiThemeEnum.Dark ? "dark" : "light", + colorScheme: activeTheme, + mermaidConfig: await loadMermaid(activeTheme), } satisfies RehypeMermaidOptions, ], ], diff --git a/web/src/elements/ak-mdx/styles.css b/web/src/elements/ak-mdx/styles.css index 025074820d..7db3238078 100644 --- a/web/src/elements/ak-mdx/styles.css +++ b/web/src/elements/ak-mdx/styles.css @@ -59,21 +59,6 @@ pre:has(.hljs) { padding: var(--pf-global--spacer--md); } -svg[id^="mermaid-svg-"] { - .rect { - fill: var( - --ak-mermaid-box-background-color, - var(--pf-global--BackgroundColor--light-300) - ) !important; - } - - .messageText { - stroke-width: 4; - fill: var(--ak-mermaid-message-text) !important; - paint-order: stroke; - } -} - ak-alert + :is(h2, p) { padding-top: var(--pf-global--spacer--md); } @@ -81,19 +66,7 @@ ak-alert + :is(h2, p) { /* #region Dark Theme */ :host([theme="dark"]) { - --ak-mermaid-message-text: var(--ak-dark-foreground); - --ak-mermaid-box-background-color: var(--ak-dark-background-lighter); --ak-table-stripe-background: var(--pf-global--BackgroundColor--dark-200); - - svg[id^="mermaid-svg-"] { - line[class^="messageLine"] { - /* - Mermaid's support for dynamic palette changes leaves a lot to be desired. - This is a workaround to keep content readable while not breaking the rest of the theme. - */ - filter: invert(1) !important; - } - } } /* #endregion */ diff --git a/web/src/elements/mermaid/mermaid.css b/web/src/elements/mermaid/mermaid.css new file mode 100644 index 0000000000..4e66674c8a --- /dev/null +++ b/web/src/elements/mermaid/mermaid.css @@ -0,0 +1,59 @@ +/* svg[id^="mermaid-svg-"] { */ +/* &.flowchart { + .edgeLabel .label { + padding: 4px 10px; + border-radius: 4px; + background: rgba(0, 0, 0, 0.55); + color: var(--ak-foreground, #fff); + } + } */ + +.flowchart { + foreignObject:has(.edgeLabel) { + display: flex; + align-items: center; + justify-content: center; + overflow: visible; + } + + .edgeLabel, + .edgeLabel .labelBkg { + background-color: transparent; + display: flex !important; + } + + .edgeLabel > span, + .labelBkg > span.edgeLabel { + margin-inline: auto; + max-width: max-content; + padding: 3px 12px; + border-radius: 6px; + white-space: nowrap; + } + + .edgeLabel { + background-color: var(--pf-global--palette--gold-200) !important; + border: 1px solid var(--pf-global--palette--gold-500) !important; + } +} + +svg[id^="mermaid-svg-"] { + & > .rect { + fill: color-mix(var(--pf-global--palette--gold-100), transparent 95%); + stroke: var(--pf-global--palette--gold-100); + stroke-width: 1; + } + + .messageText { + fill: var(--pf-global--Color--100) !important; + } + + .messageLine0 { + stroke: var(--pf-global--palette--purple-300) !important; + } + + [id$="-arrowhead"] path { + fill: var(--pf-global--palette--purple-300) !important; + stroke: var(--pf-global--palette--purple-300) !important; + } +} diff --git a/web/src/elements/mermaid/theme.ts b/web/src/elements/mermaid/theme.ts new file mode 100644 index 0000000000..e2db5ae298 --- /dev/null +++ b/web/src/elements/mermaid/theme.ts @@ -0,0 +1,164 @@ +import type { MermaidConfig } from "mermaid"; + +/** + * Resolves PatternFly CSS custom properties into concrete hex colors and maps + * them onto Mermaid's `themeVariables` keyset. + * + * @remarks + * + * Colors are parsed through a 1x1 canvas so that any valid CSS color form + * (named, rgb/rgba, hsl, or a `var()` chain) collapses to a hex string Mermaid + * can consume. Fully transparent values resolve to `"transparent"`. + * + * PatternFly 4 handles light/dark theming at the token level, so a single token + * set resolves correctly under either theme — no per-theme branching needed. + */ +export class MermaidThemeAdapter { + canvas = new OffscreenCanvas(1, 1); + ctx = this.canvas.getContext("2d"); + + constructor(protected computedStyle: CSSStyleDeclaration) {} + + /** + * Resolve a CSS custom property to a hex color string. + * + * @param cssProperty The CSS custom property name to read. + * @param fallback Color used when the property is unset or empty. + * + * @returns A hex color code string, or `"transparent"` for fully transparent values. + */ + public readHexColorVariable = (cssProperty: string, fallback = "#ff0000"): string => { + if (!this.ctx) { + throw new Error("Could not create canvas context for color parsing"); + } + + this.ctx.clearRect(0, 0, 1, 1); + this.ctx.fillStyle = this.computedStyle.getPropertyValue(cssProperty).trim() || fallback; + this.ctx.fillRect(0, 0, 1, 1); + + const [r, g, b, a] = this.ctx.getImageData(0, 0, 1, 1).data; + + if (a === 0) { + return "transparent"; + } + + // eslint-disable-next-line no-bitwise + return `#${((1 << 24) + (r << 16) + (g << 8) + b).toString(16).slice(1)}`; + }; + + /** + * Read a surface color, substituting an opaque fallback when the token + * resolves to `transparent`. Node fills must never be see-through. + */ + protected readSurface = (cssProperty: string, fallback: string): string => { + const value = this.readHexColorVariable(cssProperty, fallback); + + return value === "transparent" ? fallback : value; + }; + + /** + * Map PatternFly tokens onto Mermaid's `themeVariables`. + * + * @remarks + * + * Requires `theme: "base"` in the Mermaid config — other built-in themes + * ignore most of these overrides. + */ + public toThemeVariables(darkMode?: boolean): MermaidConfig["themeVariables"] { + const { readHexColorVariable: read, readSurface } = this; + + const surface = readSurface("--pf-global--palette--purple-50", "#ffffff"); + const surfaceAlt = readSurface("--pf-global--palette--blue-50", surface); + const surfaceDark = readSurface("--pf-global--palette--black-200", surfaceAlt); + + const textBase = read("--pf-global--palette--purple-700"); + const textSecondary = read( + darkMode ? "--pf-global--palette--gold-100" : "--pf-global--palette--gold-400", + ); + const border = read( + darkMode ? "--pf-global--palette--purple-300" : "--pf-global--palette--purple-700", + ); + + const primaryBorder = read("--pf-global--palette--purple-400"); + const primaryAccent = read("--pf-global--palette--purple-100"); + const primaryAccentText = read("--pf-global--palette--purple-700"); + + const success = read("--pf-global--success-color--100"); + const danger = read("--pf-global--danger-color--100"); + const warning = read("--pf-global--warning-color--100"); + const info = read("--pf-global--info-color--100"); + + return { + // Base / canvas + background: surface, + mainBkg: surface, + fontFamily: "var(--ak-font-family-sans-serif)", + + // Primary node + primaryColor: surface, + primaryBorderColor: primaryBorder, + primaryTextColor: textBase, + + // Secondary node + secondaryColor: surfaceAlt, + secondaryBorderColor: border, + secondaryTextColor: textBase, + + // Tertiary node + tertiaryColor: surfaceDark, + tertiaryBorderColor: border, + tertiaryTextColor: textBase, + + // Edges / lines / labels + lineColor: textSecondary, + edgeLabelBackground: surface, + titleColor: textBase, + + // Generic node fallbacks + nodeBorder: border, + nodeTextColor: textBase, + + // Clusters / subgraphs + clusterBkg: surfaceDark, + clusterBorder: border, + + // Notes + noteBkgColor: warning, + noteTextColor: textBase, + noteBorderColor: border, + + // Brand accents (classDef / linkStyle) + primaryColorAccent: primaryAccent, + primaryTextColorAccent: primaryAccentText, + + // Status (state / git / quadrant diagrams) + successColor: success, + errorColor: danger, + warningColor: warning, + infoColor: info, + + // Sequence / state actors + actorBkg: surface, + actorBorder: border, + actorTextColor: textBase, + labelBoxBkgColor: surface, + labelTextColor: textBase, + }; + } + + /** + * Semantic accent colors for emitting `linkStyle` / `classDef` directives + * into diagram source (e.g. coloring policy pass/fail edges). + */ + public toAccents() { + const { readHexColorVariable: read } = this; + + return { + success: read("--pf-global--success-color--100"), + danger: read("--pf-global--danger-color--100"), + warning: read("--pf-global--warning-color--100"), + info: read("--pf-global--info-color--100"), + primary: read("--pf-global--palette--purple-100"), + }; + } +} diff --git a/web/src/elements/mermaid/utils.ts b/web/src/elements/mermaid/utils.ts new file mode 100644 index 0000000000..a6192cb826 --- /dev/null +++ b/web/src/elements/mermaid/utils.ts @@ -0,0 +1,76 @@ +import MermaidStyles from "./mermaid.css"; + +import { DOM_PURIFY_STRICT } from "#common/purify"; +import { ResolvedUITheme } from "#common/theme"; + +import { MermaidThemeAdapter } from "#elements/mermaid/theme"; + +import elkLayouts from "@mermaid-js/layout-elk"; +import type { Mermaid, MermaidConfig } from "mermaid"; + +export const DefaultMermaidConfig: Readonly = { + logLevel: "fatal", + startOnLoad: false, + htmlLabels: true, + fontFamily: "var(--ak-font-family-sans-serif)", + layout: "elk", + flowchart: { + curve: "linear", + + nodeSpacing: 25, + rankSpacing: 25, + wrappingWidth: 500, + }, + theme: "base", + securityLevel: "strict", + dompurifyConfig: DOM_PURIFY_STRICT, +}; + +let lastActiveTheme: ResolvedUITheme | null = null; +let mermaid: Mermaid | null = null; + +/** + * Load the Mermaid library and initialize it with the appropriate theme based + * on the provided UI theme. + * + * @remarks + * + * Mermaid is only loaded once and cached for subsequent calls. Note that + * Mermaid is a singleton and does not support multiple instances with different + * configurations. Re-initialization occurs only when the active theme changes. + * + * @param uiTheme The resolved UI theme to derive Mermaid colors from. + * @returns The initialized Mermaid singleton. + */ +export async function loadMermaid(uiTheme: ResolvedUITheme): Promise { + if (!mermaid) { + const mermaidModule = await import("mermaid"); + mermaid = mermaidModule.default; + mermaid.registerLayoutLoaders(elkLayouts); + } + + if (uiTheme && uiTheme === lastActiveTheme) { + return mermaid; + } + + await new Promise((resolve) => requestAnimationFrame(resolve)); + + const computedStyle = getComputedStyle(document.documentElement); + const darkMode = uiTheme === "dark"; + + const themeAdapter = new MermaidThemeAdapter(computedStyle); + const themeVariables = themeAdapter.toThemeVariables(darkMode); + + mermaid.initialize({ + ...DefaultMermaidConfig, + themeVariables: { + ...themeVariables, + }, + darkMode, + themeCSS: String(MermaidStyles), + }); + + lastActiveTheme = uiTheme; + + return mermaid; +} diff --git a/web/src/flow/stages/captcha/CaptchaStage.css b/web/src/flow/stages/captcha/CaptchaStage.css index 1256ec09e1..4a70ac0c7e 100644 --- a/web/src/flow/stages/captcha/CaptchaStage.css +++ b/web/src/flow/stages/captcha/CaptchaStage.css @@ -36,4 +36,9 @@ ak-stage-captcha[theme="dark"].style-scope { background-color: var(--captcha-background-from); animation: captcha-background-animation 1s infinite var(--pf-global--TimingFunction); } + + &[data-transparent-loading="true"][data-ready="loading"] { + background-color: transparent; + animation: none; + } } diff --git a/web/src/flow/stages/captcha/CaptchaStage.ts b/web/src/flow/stages/captcha/CaptchaStage.ts index 51859f2596..dfd3198fd2 100644 --- a/web/src/flow/stages/captcha/CaptchaStage.ts +++ b/web/src/flow/stages/captcha/CaptchaStage.ts @@ -12,6 +12,7 @@ import { AKFormErrors, ErrorProp } from "#components/ak-field-errors"; import { FlowUserDetails } from "#flow/FormStatic"; import { BaseStage } from "#flow/stages/base"; import Styles from "#flow/stages/captcha/CaptchaStage.css"; +import { CapController, isCapWidgetURL } from "#flow/stages/captcha/controllers/cap"; import { CaptchaController, CaptchaControllerConstructor, @@ -53,7 +54,14 @@ interface LoadMessage { message: "load"; } -type IframeMessageEvent = MessageEvent; +interface ErrorMessage { + source?: string; + context?: string; + message: "error"; + error: string; +} + +type IframeMessageEvent = MessageEvent; @customElement("ak-stage-captcha") export class CaptchaStage @@ -79,6 +87,7 @@ export class CaptchaStage HCaptchaController, GReCaptchaController, TurnstileController, + CapController, ]); #logger = ConsoleLogger.prefix("flow:captcha"); @@ -165,6 +174,9 @@ export class CaptchaStage return match(data) .with({ message: "captcha" }, ({ token }) => this.onTokenChange(token)) .with({ message: "load" }, this.#loadListener) + .with({ message: "error" }, ({ error }) => { + this.error = error; + }) .otherwise(({ message }) => { this.#logger.debug(`Unknown message: ${message}`); }); @@ -183,12 +195,18 @@ export class CaptchaStage } if (this.challenge?.interactive) { + // Cap renders its own framed widget, so the generic iframe loading shimmer looks like + // an extra CAPTCHA box flashing behind it. + const isCapChallenge = + URL.canParse(this.challenge.jsUrl) && isCapWidgetURL(new URL(this.challenge.jsUrl)); + return html` @@ -306,8 +324,13 @@ export class CaptchaStage // Then, load the new script... const scriptElement = document.createElement("script"); + const matchedController = Array.from(CaptchaStage.controllers).find((Controller) => + Controller.matchesURL(challengeURL), + ); scriptElement.src = challengeURL.toString(); + scriptElement.type = + matchedController?.scriptType === "module" ? "module" : "text/javascript"; scriptElement.async = true; scriptElement.defer = true; scriptElement.onload = this.#scriptLoadListener; @@ -528,6 +551,7 @@ export class CaptchaStage challengeURL: challengeURL.toString(), theme: this.activeTheme, scriptOnLoad: !(controller instanceof TurnstileController), + scriptType: controller.scriptType, }); if ( diff --git a/web/src/flow/stages/captcha/controllers/CaptchaController.ts b/web/src/flow/stages/captcha/controllers/CaptchaController.ts index 6da5320f84..6c0c2820d6 100644 --- a/web/src/flow/stages/captcha/controllers/CaptchaController.ts +++ b/web/src/flow/stages/captcha/controllers/CaptchaController.ts @@ -28,6 +28,20 @@ export abstract class CaptchaController implements ReactiveController { return (this.constructor as typeof CaptchaController).globalName; } + public static readonly scriptType: "classic" | "module" = "classic"; + + public get scriptType(): "classic" | "module" { + return (this.constructor as typeof CaptchaController).scriptType; + } + + public static isAvailable(): boolean { + return Object.hasOwn(window, this.globalName); + } + + public static matchesURL(_url: URL): boolean { + return false; + } + /** * A prefix for log messages from this controller. */ @@ -42,7 +56,7 @@ export abstract class CaptchaController implements ReactiveController { ): Array { return Array.from(controllerConstructors).filter((Controller) => { // Can we find the global for this captcha provider? - return Object.hasOwn(window, Controller.globalName); + return Controller.isAvailable(); }); } @@ -98,6 +112,9 @@ export abstract class CaptchaController implements ReactiveController { export type CaptchaControllerConstructor = { globalName: string; + scriptType: "classic" | "module"; + isAvailable: () => boolean; + matchesURL: (url: URL) => boolean; } & (new (host: CaptchaHandlerHost) => CaptchaController); export interface CaptchaHandlerHost extends ReactiveControllerHost { diff --git a/web/src/flow/stages/captcha/controllers/cap.ts b/web/src/flow/stages/captcha/controllers/cap.ts new file mode 100644 index 0000000000..47dfaa3f81 --- /dev/null +++ b/web/src/flow/stages/captcha/controllers/cap.ts @@ -0,0 +1,61 @@ +import { CaptchaController } from "#flow/stages/captcha/controllers/CaptchaController"; + +import { html } from "lit"; + +export function isCapWidgetURL(url: URL): boolean { + return url.pathname.includes("cap-widget") || url.pathname.endsWith("/assets/widget.js"); +} + +export class CapController extends CaptchaController { + public static readonly globalName = "cap-widget"; + + public static readonly scriptType = "module"; + + public static override isAvailable(): boolean { + return customElements.get("cap-widget") !== undefined; + } + + public static override matchesURL(url: URL): boolean { + return isCapWidgetURL(url); + } + + public interactive = () => { + const endpoint = this.host.challenge?.siteKey ?? ""; + + return html`
+ +
+ `; + }; + + public refreshInteractive = async () => { + this.host.iframeRef.value?.contentWindow?.location.reload(); + }; + + public execute = async () => { + throw new Error("Cap requires interactive mode."); + }; + + public refresh = async () => { + throw new Error("Cap requires interactive mode."); + }; +} diff --git a/web/src/flow/stages/captcha/shared.ts b/web/src/flow/stages/captcha/shared.ts index 5245809e7f..a3613aa421 100644 --- a/web/src/flow/stages/captcha/shared.ts +++ b/web/src/flow/stages/captcha/shared.ts @@ -30,6 +30,7 @@ export interface IFrameTemplateInit { * Defaults to `true`. */ scriptOnLoad?: boolean; + scriptType?: "classic" | "module"; } /** @@ -42,7 +43,7 @@ export interface IFrameTemplateInit { */ export function iframeTemplate( children: TemplateResult, - { challengeURL, theme, scriptOnLoad = true }: IFrameTemplateInit, + { challengeURL, theme, scriptOnLoad = true, scriptType = "classic" }: IFrameTemplateInit, ) { return createDocumentTemplate({ head: html` @@ -75,7 +76,7 @@ export function iframeTemplate( ${children} `, diff --git a/web/src/flow/stages/identification/controllers/CaptchaDisplayController.ts b/web/src/flow/stages/identification/controllers/CaptchaDisplayController.ts index b77691567d..918db04736 100644 --- a/web/src/flow/stages/identification/controllers/CaptchaDisplayController.ts +++ b/web/src/flow/stages/identification/controllers/CaptchaDisplayController.ts @@ -49,6 +49,12 @@ export class CaptchaDisplayController implements ReactiveController { const input = this.#inputRef.value; if (!input) return; input.value = token; + // The surrounding identification form only updates its validity when form controls + // emit normal input events, so mirror a user's field change after the CAPTCHA solves. + input.dispatchEvent(new Event("input", { bubbles: true, composed: true })); + input.dispatchEvent(new Event("change", { bubbles: true, composed: true })); + this.#loaded = true; + this.host.requestUpdate(); }; public onFailure() { diff --git a/web/src/polyfill/custom-elements-get-name.ts b/web/src/polyfill/custom-elements-get-name.ts new file mode 100644 index 0000000000..9ca03e62cc --- /dev/null +++ b/web/src/polyfill/custom-elements-get-name.ts @@ -0,0 +1,56 @@ +/** + * @file Polyfill for `CustomElementRegistry.getName()` on older WebKit. + * + * `getName()` is the reverse of `customElements.get()`: given a custom-element + * constructor, it returns the tag name it was registered under (or `null`). + * It landed in Chrome/Edge 117, Firefox 119, and Safari 17.4 — so iOS 16, the + * iOS 17.0–17.3 series, and any WebKit WebView pinned below 17.4 reach the + * authentik flow renderer without it and crash at the first call site. + * + * The polyfill keeps a reverse map by wrapping `define()` so that any later + * registration is recorded; on browsers that already implement `getName()` + * natively it is a no-op. Because the wrap can only observe registrations made + * *after* it installs, this module must be imported before any + * `customElements.define(...)` call — which is what the polyfill entry point + * guarantees, since it is loaded ahead of every interface bundle in + * `base/skeleton.html`. + */ + +/** + * Install the `getName()` polyfill on the given registry if it is absent. + * + * Exported separately from the side-effect import so that unit tests can drive + * the polyfill against a fake registry without touching the global one. + */ +export function applyCustomElementsGetNamePolyfill( + registry: Partial, +): asserts registry is CustomElementRegistry { + if (typeof registry.getName === "function") return; + + if (typeof registry.define !== "function") { + console.warn( + "CustomElementRegistry.getName polyfill: registry lacks define() method, cannot install polyfill", + ); + return; + } + + const nameByCtor = new WeakMap(); + const originalDefine = registry.define.bind(registry); + + registry.define = function define( + name: string, + ctor: CustomElementConstructor, + options?: ElementDefinitionOptions, + ): void { + nameByCtor.set(ctor, name); + return originalDefine(name, ctor, options); + }; + + registry.getName = function getName(ctor: CustomElementConstructor): string | null { + return nameByCtor.get(ctor) ?? null; + }; +} + +if (typeof window !== "undefined" && window.customElements) { + applyCustomElementsGetNamePolyfill(window.customElements); +} diff --git a/web/src/polyfill/custom-elements-get-name.unit.test.ts b/web/src/polyfill/custom-elements-get-name.unit.test.ts new file mode 100644 index 0000000000..1010965204 --- /dev/null +++ b/web/src/polyfill/custom-elements-get-name.unit.test.ts @@ -0,0 +1,106 @@ +import { applyCustomElementsGetNamePolyfill } from "./custom-elements-get-name.js"; + +import { describe, expect, it, vi } from "vitest"; + +type CustomElementRegistryMock = Omit & { + getName?: CustomElementRegistry["getName"]; +}; + +type ElementConstructorInfo = [ + name: string, + constructor: CustomElementConstructor, + options: ElementDefinitionOptions | undefined, +]; + +/** + * Build a minimal `CustomElementRegistry`-shaped object suitable for driving + * the polyfill in a Node environment. `getName` is omitted to simulate older + * WebKit; `defined` collects the args that reach the underlying `define`. + */ +function createMockRegistry(): { + registry: CustomElementRegistryMock; + defined: ElementConstructorInfo[]; +} { + const defined: ElementConstructorInfo[] = []; + + const registry: CustomElementRegistryMock = { + define: vi.fn((name: string, ctor: CustomElementConstructor, options?) => { + defined.push([name, ctor, options]); + }), + get: vi.fn(), + whenDefined: vi.fn(), + upgrade: vi.fn(), + }; + + return { registry, defined }; +} + +describe("applyCustomElementsGetNamePolyfill", () => { + it("installs getName when the registry lacks it", () => { + const { registry } = createMockRegistry(); + + expect(typeof registry.getName).toBe("undefined"); + + applyCustomElementsGetNamePolyfill(registry); + + expect(typeof registry.getName).toBe("function"); + }); + + it("returns the registered tag name for a constructor defined after install", () => { + const { registry } = createMockRegistry(); + applyCustomElementsGetNamePolyfill(registry); + + const Ctor = class {} as unknown as CustomElementConstructor; + + registry.define("ak-test-element", Ctor); + + expect(registry.getName(Ctor)).toBe("ak-test-element"); + }); + + it("forwards the define call to the original implementation with all arguments", () => { + const { registry, defined } = createMockRegistry(); + applyCustomElementsGetNamePolyfill(registry); + + const Ctor = class {} as unknown as CustomElementConstructor; + + const options = { extends: "button" }; + + registry.define("ak-extends-button", Ctor, options); + + expect(defined).toHaveLength(1); + + expect(defined[0]?.[0]).toBe("ak-extends-button"); + expect(defined[0]?.[1]).toBe(Ctor); + expect(defined[0]?.[2]).toBe(options); + }); + + it("returns null for a constructor that was never registered", () => { + const { registry } = createMockRegistry(); + applyCustomElementsGetNamePolyfill(registry); + const Unregistered = class {} as unknown as CustomElementConstructor; + + if (typeof registry.getName !== "function") { + throw new Error("getName should have been installed by the polyfill"); + } + + expect(registry.getName(Unregistered)).toBeNull(); + }); + + it("does nothing when the registry already implements getName natively", () => { + const nativeGetName = vi.fn(() => "native-tag"); + const nativeDefine = vi.fn(); + + const registry: CustomElementRegistryMock = { + define: nativeDefine, + getName: nativeGetName, + get: vi.fn(), + whenDefined: vi.fn(), + upgrade: vi.fn(), + }; + + applyCustomElementsGetNamePolyfill(registry); + + expect(registry.getName).toBe(nativeGetName); + expect(registry.define).toBe(nativeDefine); + }); +}); diff --git a/web/src/polyfill/index.entrypoint.ts b/web/src/polyfill/index.entrypoint.ts index 08417ec3b3..641c2285c4 100644 --- a/web/src/polyfill/index.entrypoint.ts +++ b/web/src/polyfill/index.entrypoint.ts @@ -1,6 +1,7 @@ // sort-imports-ignore import "@webcomponents/webcomponentsjs"; import "lit/polyfill-support.js"; +import "./custom-elements-get-name.js"; import "core-js/actual"; import "@formatjs/intl-listformat/polyfill.js"; import "@formatjs/intl-listformat/locale-data/en.js"; diff --git a/web/xliff/cs-CZ.xlf b/web/xliff/cs-CZ.xlf index 5515cebdbf..e0b633b284 100644 --- a/web/xliff/cs-CZ.xlf +++ b/web/xliff/cs-CZ.xlf @@ -6187,10 +6187,6 @@ neprojde, když jedna nebo obě z vybraných možností jsou rovny nebo nad prah Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Volitelně omezte, které typy zařízení WebAuthn mohou být použity. Pokud nejsou vybrány žádné typy zařízení, jsou povolena všechna zařízení. - - This restriction only applies to devices created in authentik 2024.4 or later. - Toto omezení se vztahuje pouze na zařízení vytvořená v authentik 2024.4 nebo novějších verzích. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Krok použitý k nastavení WebAuthn autentizátoru (např. Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/de-DE.xlf b/web/xliff/de-DE.xlf index e07cd9f2c7..7d7b38120e 100644 --- a/web/xliff/de-DE.xlf +++ b/web/xliff/de-DE.xlf @@ -6213,10 +6213,6 @@ Beim Erstellen eines festen Auswahlfelds aktiviere „Als Ausdruck interpretiere Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Optional kannst du einschränken, welche WebAuthn-Gerätetypen verwendet werden dürfen. Wenn keine Gerätetypen ausgewählt sind, sind alle Geräte erlaubt. - - This restriction only applies to devices created in authentik 2024.4 or later. - Diese Beschränkung gilt nur für Geräte, die in authentik 2024.4 oder neuer erstellt wurden. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Stage zur Konfiguration eines WebAuthn-Authenticators (z. B. Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/en.xlf b/web/xliff/en.xlf index 53c95b2ad2..299855a203 100644 --- a/web/xliff/en.xlf +++ b/web/xliff/en.xlf @@ -4781,9 +4781,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. - - This restriction only applies to devices created in authentik 2024.4 or later. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/es-ES.xlf b/web/xliff/es-ES.xlf index 2d8e26c5f6..57a0f06b07 100644 --- a/web/xliff/es-ES.xlf +++ b/web/xliff/es-ES.xlf @@ -6153,10 +6153,6 @@ El valor de este campo se compara con el atributo de pertenencia del usuario.Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Opcionalmente, restrinja los tipos de dispositivos WebAuthn que se pueden usar. Si no se selecciona ningún tipo de dispositivo, se permiten todos. - - This restriction only applies to devices created in authentik 2024.4 or later. - Esta restricción solo se aplica a dispositivos creados en authentik 2024.4 o posterior. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Etapa utilizada para configurar un autenticador WebAuthn (es decir, Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/fi-FI.xlf b/web/xliff/fi-FI.xlf index 908b56d2af..64c19da239 100644 --- a/web/xliff/fi-FI.xlf +++ b/web/xliff/fi-FI.xlf @@ -6328,10 +6328,6 @@ läpäisy estyy kun jompi kumpi tai molemmat vaihtoehdot ylittävät raja-arvon. Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Valinnaisesti voit rajoittaa, mitä WebAuthn-laitetyyppejä voidaan käyttää. Jos mitään tyyppiä ei ole valittu, kaiken tyyppiset laitteet sallitaan. - - This restriction only applies to devices created in authentik 2024.4 or later. - Tämä rajoitus koskee vain laitteita, jotka on luotu authentik 2024.4 tai uudemmalla versiolla. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Vaihe, jolla määritellään WebAuthn-todentaja (esim. Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/fr-FR.xlf b/web/xliff/fr-FR.xlf index d0b4174309..831b3d0501 100644 --- a/web/xliff/fr-FR.xlf +++ b/web/xliff/fr-FR.xlf @@ -6318,10 +6318,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Optionnel, restreindre quels types d'appareil WebAuthn peuvent être utilisés. Lorsqu'aucun type d'appareil n'est sélectionné, tout les appareils sont autorisés. - - This restriction only applies to devices created in authentik 2024.4 or later. - Les restrictions ne s'appliquent qu'aux appareils créés dans authentik 2024.4 ou ultérieur. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Étape de configuration d'un authentificateur WebAuthn (Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/it-IT.xlf b/web/xliff/it-IT.xlf index ae785e0830..70bea2cf10 100644 --- a/web/xliff/it-IT.xlf +++ b/web/xliff/it-IT.xlf @@ -6110,10 +6110,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Facoltativamente limitare quali tipi di dispositivi WebAuthn possono essere utilizzati. Quando non vengono selezionati tipi di dispositivi, tutti i dispositivi sono consentiti. - - This restriction only applies to devices created in authentik 2024.4 or later. - Questa restrizione si applica solo ai dispositivi creati in authentik 2024.4 o versione successiva. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Fase utilizzato per configurare un autenticatore WebAuthn (ovvero Yubikey, FaceId/Windows Hello). diff --git a/web/xliff/ja-JP.xlf b/web/xliff/ja-JP.xlf index c050ecbbe8..938133e8c1 100644 --- a/web/xliff/ja-JP.xlf +++ b/web/xliff/ja-JP.xlf @@ -6322,10 +6322,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. どの WebAuthn デバイスタイプを使用できるかをオプションで制限します。デバイスタイプが選択されていない場合、すべてのデバイスが許可されます。 - - This restriction only applies to devices created in authentik 2024.4 or later. - この制限は authentik 2024.4 以降で作成されたデバイスにのみ適用されます。 - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). WebAuthn 認証器を設定するために使用されるステージ(例:Yubikey、FaceID/Windows Hello)。 diff --git a/web/xliff/ko-KR.xlf b/web/xliff/ko-KR.xlf index 4c3f600733..f8d0affac6 100644 --- a/web/xliff/ko-KR.xlf +++ b/web/xliff/ko-KR.xlf @@ -5880,10 +5880,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. - - This restriction only applies to devices created in authentik 2024.4 or later. - 이 제한은 authentik 2024.4 또는 이후에 등록된 기기에만 적용됩니다. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). WebAuthn 인증기를 구성하는 데 사용되는 스테이지(예: Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/nl-NL.xlf b/web/xliff/nl-NL.xlf index d47029f2d6..35dcea3012 100644 --- a/web/xliff/nl-NL.xlf +++ b/web/xliff/nl-NL.xlf @@ -5665,9 +5665,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. - - This restriction only applies to devices created in authentik 2024.4 or later. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/pl-PL.xlf b/web/xliff/pl-PL.xlf index 55bf4aab79..b9082faea9 100644 --- a/web/xliff/pl-PL.xlf +++ b/web/xliff/pl-PL.xlf @@ -5896,10 +5896,6 @@ Można tu używać tylko zasad, ponieważ dostęp jest sprawdzany przed uwierzyt Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Opcjonalnie ogranicza, które typy urządzeń WebAuthn mogą być używane. Jeśli nie wybrano żadnego typu urządzenia, wszystkie urządzenia są dozwolone. - - This restriction only applies to devices created in authentik 2024.4 or later. - To ograniczenie dotyczy tylko urządzeń utworzonych w wersji authentik 2024.4 lub nowszej. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Etap używany do konfiguracji uwierzytelniacza WebAuthn (np. Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/pt-BR.xlf b/web/xliff/pt-BR.xlf index e9454e0fc0..345b3dbad6 100644 --- a/web/xliff/pt-BR.xlf +++ b/web/xliff/pt-BR.xlf @@ -6322,10 +6322,6 @@ retorne uma lista para fornecer várias opções padrão. Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Opcionalmente restrinja quais tipos de dispositivos WebAuthn podem ser usados. Quando nenhum tipo de dispositivo é selecionado, todos os dispositivos são permitidos. - - This restriction only applies to devices created in authentik 2024.4 or later. - Essa restrição se aplica apenas a dispositivos criados no authentik 2024.4 ou posterior. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Etapa usada para configurar um autenticador WebAuthn (ex.: Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/ru-RU.xlf b/web/xliff/ru-RU.xlf index e685331bb5..87eb455407 100644 --- a/web/xliff/ru-RU.xlf +++ b/web/xliff/ru-RU.xlf @@ -5946,10 +5946,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. Опционально ограничьте типы устройств WebAuthn, которые могут быть использованы. Если типы устройств не выбраны, разрешены все устройства. - - This restriction only applies to devices created in authentik 2024.4 or later. - Это ограничение распространяется только на устройства, созданные в authentik 2024.4 или более поздней версии. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Этап, используемый для настройки аутентификатора WebAuthn (например, Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/tr-TR.xlf b/web/xliff/tr-TR.xlf index 150b9b802c..e30d5d4895 100644 --- a/web/xliff/tr-TR.xlf +++ b/web/xliff/tr-TR.xlf @@ -5944,10 +5944,6 @@ Belirlenen seçeneklerden biri veya her ikisi de eşiğe eşit veya eşiğin üz Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. İsteğe bağlı olarak, hangi WebAuthn cihaz türlerinin kullanılabileceğini kısıtlayın. Hiçbir cihaz türü seçilmediğinde, tüm cihazlara izin verilir. - - This restriction only applies to devices created in authentik 2024.4 or later. - Bu kısıtlama yalnızca authentik 2024.4 veya sonraki sürümlerde oluşturulan cihazlar için geçerlidir. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). Bir WebAuthn kimlik doğrulayıcısını yapılandırmak için kullanılan sahne alanı (ör. Yubikey, FaceID/Windows Hello). diff --git a/web/xliff/zh-Hans.xlf b/web/xliff/zh-Hans.xlf index c2c7379fed..f686ae61eb 100644 --- a/web/xliff/zh-Hans.xlf +++ b/web/xliff/zh-Hans.xlf @@ -6379,10 +6379,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. 可选的 WebAuthn 可用设备类型限制。如果未选择设备类型,则允许所有设备。 - - This restriction only applies to devices created in authentik 2024.4 or later. - 此限制仅适用于在 authentik 2024.4 或更新版本中创建的设备。 - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). 用来配置 WebAuthn 身份验证器(即 Yubikey、FaceID/Windows Hello)的阶段。 diff --git a/web/xliff/zh-Hant.xlf b/web/xliff/zh-Hant.xlf index 569e92981a..7cbccaf305 100644 --- a/web/xliff/zh-Hant.xlf +++ b/web/xliff/zh-Hant.xlf @@ -5707,9 +5707,6 @@ doesn't pass when either or both of the selected options are equal or above the Optionally restrict which WebAuthn device types may be used. When no device types are selected, all devices are allowed. - - This restriction only applies to devices created in authentik 2024.4 or later. - Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello). 用於設定 WebAuthn 身份認證器的階段(例如 Yubikey、FaceID/Windows Hello)。 diff --git a/website/api/package.json b/website/api/package.json index 027e19b221..c416ba9206 100644 --- a/website/api/package.json +++ b/website/api/package.json @@ -48,9 +48,9 @@ "typescript": "^6.0.3" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40", diff --git a/website/docs/add-secure-apps/flows-stages/stages/captcha/index.md b/website/docs/add-secure-apps/flows-stages/stages/captcha/index.md index 3f65660a9c..79ef5679e6 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/captcha/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/captcha/index.md @@ -2,7 +2,7 @@ title: Captcha stage --- -The Captcha stage adds CAPTCHA verification to a flow by using Google reCAPTCHA or compatible alternatives like hCaptcha and Cloudflare Turnstile. +The Captcha stage adds CAPTCHA verification to a flow by using Google reCAPTCHA or compatible alternatives like hCaptcha, Cloudflare Turnstile, and Cap. ## Overview @@ -20,6 +20,7 @@ It can either be bound to a flow or embedded inside the [Identification stage](. - **Error on invalid score**: show an error immediately when the score is outside the configured threshold. If disabled, the flow continues and policies can inspect the result from context. - **JS URL**: JavaScript loader URL for the provider. - **API URL**: verification endpoint URL for the provider. +- **Request content type**: content type used when authentik verifies the CAPTCHA token with the provider. ## Flow integration @@ -55,6 +56,25 @@ Recommended values: Score thresholds only apply to hCaptcha Enterprise. +### Cap + +Cap is a self-hostable CAPTCHA server that uses proof-of-work challenges. + +See https://trycap.dev/guide/. + +authentik supports Cap's default widget. The floating widget is not supported. + +Recommended values: + +- **Public key**: public Cap endpoint for the site key path, for example `https://cap.example.com/site-key/` +- **Private key**: Cap secret key +- **Interactive**: enabled +- **JS URL**: self-hosted Cap widget asset, for example `https://cap.example.com/assets/widget.js`. If you use a CDN, pin a reviewed release such as `https://cdn.jsdelivr.net/npm/cap-widget@` instead of the unversioned package URL. See [Cap releases](https://github.com/tiagozip/cap/releases). +- **API URL**: Cap verification endpoint, for example `https://cap.example.com/site-key/siteverify` +- **Request content type**: JSON + +Cap does not use score thresholds. + ### Cloudflare Turnstile See https://developers.cloudflare.com/turnstile/get-started/migrating-from-recaptcha. diff --git a/website/docs/add-secure-apps/providers/scim/create-scim-provider.md b/website/docs/add-secure-apps/providers/scim/create-scim-provider.md new file mode 100644 index 0000000000..7258c50f62 --- /dev/null +++ b/website/docs/add-secure-apps/providers/scim/create-scim-provider.md @@ -0,0 +1,71 @@ +--- +title: Create a SCIM provider +--- + +## Create a SCIM provider with token authentication + +To create a provider along with a corresponding application, navigate to **Applications** > **Applications** and click **New Application**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to solely create the provider by navigating to **Applications** > **Providers** and clicking **New Provider**. + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. +3. On the **Application** page, define the application settings, and then click **Next**. +4. Select **SCIM** as the **Provider Type**, and then click **Next**. +5. On the **Configure Provider** page, provide the configuration settings, and then click **Next**. +6. On the **Configure Bindings** page, click **Next**. +7. Click **Create** to create both the application and the provider. + +### Set the SCIM provider as a backchannel provider for the application + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click the edit icon of the new SCIM application. +3. Click the plus icon (+) next to **Backchannel providers**. +4. Select the new SCIM provider, and then click **Confirm**. +5. Click **Save changes**. + +## Create a SCIM provider with OAuth authentication + +There are 3 required steps to creating a SCIM provider: + +1. [Create an OAuth source](#create-an-oauth-source) +2. [Create a SCIM application and provider](#create-a-scim-application-and-provider) +3. [Set the SCIM provider as a backchannel provider for the application](#set-the-scim-provider-as-a-backchannel-provider-for-the-application) + +If using OAuth (Interactive) mode, you will also need to: + +4. [Provide admin authorization](#provide-admin-authorization-oauth-interactive-mode-only) + +### Create an OAuth source + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Directory** > **Federation and Social login** and click **New Source**. +3. Select **OpenID OAuth Source** as the **Source type**. +4. On the **OpenID OAuth Source Details** page, provide the configuration settings provided by the SCIM endpoint that you are provisioning to, and then click **Create**. + +### Create a SCIM application and provider + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. +3. On the **Application** page, define the application settings, and then click **Next**. +4. Select **SCIM** as the **Provider Type**, and then click **Next**. +5. On the **Configure Provider** page, configure the required settings. Set **Authentication mode** to the desired OAuth option, select the **OAuth source** you created in the previous section, and then click **Next**. +6. On the **Configure Bindings** page, click **Next**. +7. Click **Create** to create both the application and the provider. + +### Set the SCIM provider as a backchannel provider for the application + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click the edit icon of the new SCIM application. +3. Click the plus icon (+) next to **Backchannel providers**. +4. Select the new SCIM provider, and then click **Confirm**. +5. Click **Save changes**. + +### Provide admin authorization (OAuth Interactive mode only) + +If you selected **OAuth (Interactive)** as the **Authentication mode** for the SCIM provider, you will need to authorize the initial OAuth connection. + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click the name of the new SCIM provider. +3. Next to **OAuth Status**, click **(Re-)Authenticate**. +4. You should be redirected to the SCIM endpoint that you are provisioning to for authentication. +5. Once authenticated, you should be redirected back to authentik. If successful, **OAuth Status** should now show as **Authenticated**. + This step is only required when initially configuring the SCIM provider; subsequent authentications will be automatic. diff --git a/website/docs/add-secure-apps/providers/scim/index.md b/website/docs/add-secure-apps/providers/scim/index.md index 0c516b745c..12f1ef9cc2 100644 --- a/website/docs/add-secure-apps/providers/scim/index.md +++ b/website/docs/add-secure-apps/providers/scim/index.md @@ -8,13 +8,7 @@ A SCIM provider requires a SCIM base URL for the endpoint and an authentication SCIM providers in authentik always serve as [backchannel providers](../../applications/manage_apps.mdx#backchannel-providers), which are used in addition to the main provider that supplies SSO authentication. A backchannel provider is used for an application that requires backend authentication, directory synchronization, or other additional authentication needs. -## Set up a SCIM provider - -Many applications use SCIM together with another SSO protocol such as OAuth/OIDC or SAML. For example, you can create an application and provider pair for Slack by using SAML for authentication and SCIM for provisioning. For this setup, use the following workflow: - -1. [Create](../../applications/manage_apps.mdx#create-an-application-and-provider-pair) the application and provider pair. -2. [Create](../../applications/manage_apps.mdx#backchannel-providers) the SCIM backchannel provider. -3. Edit the application, and in the **Backchannel Providers** field add the SCIM provider that you created. +For instructions on creating a SCIM provider, refer to the [Create a SCIM provider](./create-scim-provider.md) documentation. ## Authentication modes @@ -23,12 +17,6 @@ In authentik, there are two ways to authenticate SCIM requests: - **Static token** provided by the application. This is the default authentication mode. - **OAuth token** that authentik retrieves from a specified source and uses for authentication. -When you create a new SCIM provider, select the **Authentication Mode** that the application supports. - -![Creating a SCIM provider](./scim_oauth.png) - -For either mode, enter the SCIM base **URL** for the endpoint. - ### Static token When the authentication mode is set to **Static token**, authentik sends the token provided by the application with outgoing SCIM requests to authenticate each request. @@ -37,6 +25,12 @@ When the authentication mode is set to **Static token**, authentik sends the tok When you configure a SCIM provider to use OAuth for authentication, authentik generates short-lived tokens through an OAuth flow and sends them to the SCIM endpoint. This offers improved security and control compared with a static token. +authentik supports two types of SCIM OAuth authentication: + +- **Silent OAuth** – The system obtains or refreshes access tokens automatically, without any administrator interaction. This is the typical approach used for ongoing SCIM provisioning. + +- **Interactive OAuth** – During setup, an administrator is required to authorize the connection before the SCIM integration can obtain its initial token. authentik then stores a refresh token, and provisioning then runs in the background without further admin interaction. + You can also add additional token request parameters such as `grant_type`, `subject_token`, or `client_assertion`. **Example**: diff --git a/website/docs/install-config/first-steps/index.mdx b/website/docs/install-config/first-steps/index.mdx index 25f0f1e0ed..e07e6d0ffe 100644 --- a/website/docs/install-config/first-steps/index.mdx +++ b/website/docs/install-config/first-steps/index.mdx @@ -102,7 +102,7 @@ Every application that you add to authentik requires a provider, which is used t authorization, etc. - **Protocol settings**: provide the following required configurations: - Note the **Client ID**, **Client Secret**, and **Slug** values because they will be required later when you configure Grafana to use authentik. - - Set the **Redirect URI** as a `Strict` redirect to `https://grafana.company/login/generic_oauth`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://grafana.company/login/generic_oauth`. - TIP: The Redirect URI is where a user is directed to, as soon as authentik's authorization flow is successfully completed. - **Grant Types** (required): Select at least one [grant type](../../add-secure-apps/providers/oauth2/#oauth-20-flows-and-grant-types) that the provider can use. diff --git a/website/docs/releases/2026/v2026.5.md b/website/docs/releases/2026/v2026.5.md index 5805ee48d5..efbd4abcd2 100644 --- a/website/docs/releases/2026/v2026.5.md +++ b/website/docs/releases/2026/v2026.5.md @@ -515,6 +515,18 @@ This release has been skipped. - security: GHSA-wr38-7xg8-fqxr - security: GHSA-xp7f-xjjx-gwm8 +## Fixed in 2026.5.3 + +- blueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5) (#22927) +- core: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5) (#22962) +- endpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5) (#22951) +- enterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5) (#22861) +- providers/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5) (#22955) +- providers/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5) (#22967) +- tests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5) (#22792) +- web/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5) (#22895) +- web/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5) (#22963) + ## API Changes ### authentik (v 2026.5.0) diff --git a/website/docs/sidebar.mjs b/website/docs/sidebar.mjs index 8ee5468744..d32fe47197 100644 --- a/website/docs/sidebar.mjs +++ b/website/docs/sidebar.mjs @@ -254,7 +254,15 @@ const items = [ "add-secure-apps/providers/saml/saml_single_logout", ], }, - "add-secure-apps/providers/scim/index", + { + type: "category", + label: "SCIM Provider", + link: { + type: "doc", + id: "add-secure-apps/providers/scim/index", + }, + items: ["add-secure-apps/providers/scim/create-scim-provider"], + }, { type: "category", label: "SSF Provider", diff --git a/website/docs/users-sources/sources/protocols/scim/index.md b/website/docs/users-sources/sources/protocols/scim/index.md index d2cb08c2d2..f9aa53d593 100644 --- a/website/docs/users-sources/sources/protocols/scim/index.md +++ b/website/docs/users-sources/sources/protocols/scim/index.md @@ -24,6 +24,39 @@ Endpoint to list, create, update and delete groups. There are also `/v2/ServiceProviderConfig` and `/v2/ResourceTypes`, which are used by SCIM-enabled applications to find out which features authentik supports. +## Trust model and security + +The SCIM source Bearer token is a **high-trust provisioning credential**. Anyone who can use the token can manage users and groups through the SCIM endpoints for that source. Treat it like a secret with roughly the same sensitivity as an administrative provisioning integration, not like a narrowly scoped API key. + +By default, authentik applies the following behavior for inbound SCIM requests: + +### User and group correlation + +On create and update, authentik may **correlate** SCIM resources to **existing** directory objects in the same tenant: + +- **Users** are matched by `userName` across the entire tenant, not only users already linked to this SCIM source. +- **Groups** are matched by `displayName` (mapped to the group `name`) across the entire tenant, not only groups already linked to this SCIM source. + +If a matching object exists, the SCIM source adopts and updates that object. + +### Group membership + +Group `members` operations accept **any user UUID in the tenant**. authentik does not require that member users were originally created by, or are exclusively managed by, the same SCIM source. + +### Deprovisioning (DELETE) + +SCIM **DELETE** on a user or group removes the **underlying authentik `User` or `Group` object**, not only the SCIM source link. This applies to correlated objects as well as objects created through SCIM. + +### Default bootstrap layout + +Fresh installs create a superuser group named **`authentik Admins`** (`is_superuser=true`) and an initial admin user. Because group correlation is tenant-wide, a SCIM token holder can interact with that group if they use the same `displayName`, including changing membership or deleting the group after correlating to it. + +### Recommendations + +- Restrict network access to SCIM endpoints where possible. +- Rotate and revoke SCIM tokens when an IdP integration is decommissioned. +- Do not share SCIM tokens across untrusted systems. + ## SCIM source property mappings See the [overview](../../property-mappings/index.md) for information on how property mappings work. diff --git a/website/docusaurus-theme/package.json b/website/docusaurus-theme/package.json index 5bee5f5934..bca9755382 100644 --- a/website/docusaurus-theme/package.json +++ b/website/docusaurus-theme/package.json @@ -34,7 +34,7 @@ "fast-glob": "^3.3.3", "remark-directive": "^4.0.0", "remark-github": "^12.0.0", - "semver": "^7.8.1", + "semver": "^7.8.2", "typescript": "^6.0.3", "unist-util-visit": "^5.0.0" } diff --git a/website/integrations/_redirect-uri-2026-5-note.mdx b/website/integrations/_redirect-uri-2026-5-note.mdx new file mode 100644 index 0000000000..309aa5dc3f --- /dev/null +++ b/website/integrations/_redirect-uri-2026-5-note.mdx @@ -0,0 +1,3 @@ +:::info Redirect URI changes in authentik 2026.5 +In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. +::: diff --git a/website/integrations/chat-communication-collaboration/affine/index.md b/website/integrations/chat-communication-collaboration/affine/index.md index 62d37b65e3..260489d9b8 100644 --- a/website/integrations/chat-communication-collaboration/affine/index.md +++ b/website/integrations/chat-communication-collaboration/affine/index.md @@ -4,6 +4,8 @@ sidebar_label: AFFiNE support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is AFFiNE? > AFFiNE is an open-source, self-hostable workspace for documents, whiteboards, and databases. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of AFFiNE with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of AFFiNE with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Add one `Strict` redirect URI and set it to `https://affine.company/oauth/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://affine.company/oauth/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/chatgpt/index.mdx b/website/integrations/chat-communication-collaboration/chatgpt/index.mdx index 8108314f42..427cccdcd9 100644 --- a/website/integrations/chat-communication-collaboration/chatgpt/index.mdx +++ b/website/integrations/chat-communication-collaboration/chatgpt/index.mdx @@ -4,6 +4,7 @@ sidebar_label: ChatGPT support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -38,6 +39,8 @@ You can configure ChatGPT to use either OIDC or SAML; this guide explains both o ## authentik configuration + + To support the integration of ChatGPT with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -48,7 +51,7 @@ To support the integration of ChatGPT with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Temporarily set a `Strict` redirect URI to `https://temp.temp`. + - Temporarily add a **Redirect URI** of type `Strict` `Authorization` as `https://temp.temp`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. @@ -77,7 +80,7 @@ ChatGPT only enables the **Manage SSO** wizard after you verify ownership of you 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created ChatGPT provider. -3. Under **Protocol settings**, set the **Redirect URIs** to the **Login redirect URI** from ChatGPT. +3. Under **Protocol settings**, add a **Redirect URI** of type `Strict` `Authorization` as the **Login redirect URI** value from ChatGPT. 4. Click **Update**. diff --git a/website/integrations/chat-communication-collaboration/espo-crm/index.md b/website/integrations/chat-communication-collaboration/espo-crm/index.md index f497fdb616..072cab9d27 100644 --- a/website/integrations/chat-communication-collaboration/espo-crm/index.md +++ b/website/integrations/chat-communication-collaboration/espo-crm/index.md @@ -4,6 +4,8 @@ sidebar_label: EspoCRM support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is EspoCRM? > EspoCRM is a CRM (customer relationship management) web application that allows users to store, visualize, and analyze their company's business-related relationships such as opportunities, people, businesses, and projects. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of EspoCRM with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -37,7 +41,7 @@ To support the integration of EspoCRM with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://espocrm.company/oauth-callback.php`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://espocrm.company/oauth-callback.php`. - Select any available signing key. - Under **Advanced protocol settings**, set **Subject mode** to **Based on the User's username**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/grommunio/index.md b/website/integrations/chat-communication-collaboration/grommunio/index.md index 3671d94f37..052a2a2eb9 100644 --- a/website/integrations/chat-communication-collaboration/grommunio/index.md +++ b/website/integrations/chat-communication-collaboration/grommunio/index.md @@ -4,6 +4,8 @@ sidebar_label: grommunio support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is grommunio? @@ -25,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To integrate authentik with grommunio, you will need to create an application and provider pair in authentik. :::info Keycloak-compatible endpoints @@ -39,7 +43,7 @@ grommunio-web expects Keycloak-compatible OIDC endpoints. Because authentik does - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name, the authorization flow to use, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://grommunio.company/web`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://grommunio.company/web`. - Set **Signing Key** to an available RSA key. - Under **Advanced protocol settings**: - Add the `authentik default OAuth Mapping: OpenID 'offline_access'` scope to **Selected Scopes**. diff --git a/website/integrations/chat-communication-collaboration/hedgedoc/index.md b/website/integrations/chat-communication-collaboration/hedgedoc/index.md index b4e41f8dab..50883c1ca1 100644 --- a/website/integrations/chat-communication-collaboration/hedgedoc/index.md +++ b/website/integrations/chat-communication-collaboration/hedgedoc/index.md @@ -4,6 +4,8 @@ sidebar_label: HedgeDoc support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is HedgeDoc? > HedgeDoc lets you create real-time collaborative markdown notes. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of HedgeDoc with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of HedgeDoc with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://hedgedoc.company/auth/oauth2/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hedgedoc.company/auth/oauth2/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. diff --git a/website/integrations/chat-communication-collaboration/kanboard/index.md b/website/integrations/chat-communication-collaboration/kanboard/index.md index b204eca231..389713f351 100644 --- a/website/integrations/chat-communication-collaboration/kanboard/index.md +++ b/website/integrations/chat-communication-collaboration/kanboard/index.md @@ -4,6 +4,8 @@ sidebar_label: Kanboard support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Kanboard? > Kanboard is a free and open source Kanban project management software. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Kanboard with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Kanboard with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://kanboard.company/oauth/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://kanboard.company/oauth/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.md b/website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.md index 609173069d..9f30192c53 100644 --- a/website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.md +++ b/website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.md @@ -4,6 +4,8 @@ sidebar_label: mailcow Logs Viewer support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is mailcow Logs Viewer? > A modern, self-hosted dashboard for monitoring, analyzing, and managing your mailcow mail server. Track email delivery, investigate spam, manage quarantine, detect bounce-based abuse, and validate DNS configurations, all from a single interface. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of mailcow Logs Viewer with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of mailcow Logs Viewer with authentik, you need to cr - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **application slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://mailcow-logs-viewer.company/api/auth/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mailcow-logs-viewer.company/api/auth/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/mailcow/index.md b/website/integrations/chat-communication-collaboration/mailcow/index.md index d5fe636eb3..1fcdc73dc4 100644 --- a/website/integrations/chat-communication-collaboration/mailcow/index.md +++ b/website/integrations/chat-communication-collaboration/mailcow/index.md @@ -4,6 +4,8 @@ sidebar_label: mailcow support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is mailcow? > mailcow is a Dockerized, open-source groupware and email suite based on Docker. It relies on many well-known and long-used components, which, when combined, result in a comprehensive email server solution. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of mailcow with authentik, you need to create a property mapping, set the `email_verified` attribute on required users, and create an application/provider pair in authentik. ### Create a property mapping @@ -56,7 +60,7 @@ Repeat these steps for all users that need to use the Mailcow integration. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://mailcow.company`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mailcow.company`. - Select any available signing key. - Under **Advanced protocol settings**: - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope from **Selected Scopes**. diff --git a/website/integrations/chat-communication-collaboration/mastodon/index.md b/website/integrations/chat-communication-collaboration/mastodon/index.md index 61aaa6c24b..6b2a6589e8 100644 --- a/website/integrations/chat-communication-collaboration/mastodon/index.md +++ b/website/integrations/chat-communication-collaboration/mastodon/index.md @@ -4,6 +4,8 @@ sidebar_label: Mastodon support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Mastodon? > Mastodon is free and open-source software for running self-hosted social networking services. It has microblogging features similar to Twitter @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Mastodon with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Mastodon with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://mastodon.company/auth/auth/openid_connect/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mastodon.company/auth/auth/openid_connect/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/matrix-synapse/index.md b/website/integrations/chat-communication-collaboration/matrix-synapse/index.md index d57e7f6b50..1d79d8ac53 100644 --- a/website/integrations/chat-communication-collaboration/matrix-synapse/index.md +++ b/website/integrations/chat-communication-collaboration/matrix-synapse/index.md @@ -4,6 +4,8 @@ sidebar_label: Matrix Synapse support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Matrix Synapse? > Matrix is an open source project that publishes the Matrix open standard for secure, decentralized, real-time communication, and its Apache licensed reference implementations. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Matrix Synapse with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Matrix Synapse with authentik, you need to create - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://matrix.company/_synapse/client/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://matrix.company/_synapse/client/oidc/callback`. - Select any available RSA signing key. Matrix Synapse doesn't support ECC keys. - Do not set an encryption key because this is not supported by Matrix Synapse. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/mattermost-team-edition/index.mdx b/website/integrations/chat-communication-collaboration/mattermost-team-edition/index.mdx index 3311917e88..6ac90c4476 100644 --- a/website/integrations/chat-communication-collaboration/mattermost-team-edition/index.mdx +++ b/website/integrations/chat-communication-collaboration/mattermost-team-edition/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Mattermost Team Edition support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -45,6 +46,8 @@ Once configured, Mattermost will display a login button with the GitLab icon, bu ## authentik configuration + + To support the integration of Mattermost Team Edition with authentik, you need to create property mappings and an application/provider pair in authentik. ### Create property mappings @@ -84,7 +87,7 @@ The following `id` property mapping is optional. If omitted, Mattermost will gen - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://mattermost.company/signup/gitlab/complete`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mattermost.company/signup/gitlab/complete`. - Select any available signing key. - Under **Advanced protocol settings**, add the scopes you just created to the list of selected scopes. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/mobilizon/index.md b/website/integrations/chat-communication-collaboration/mobilizon/index.md index 51fb0c597f..f3a190d6fe 100644 --- a/website/integrations/chat-communication-collaboration/mobilizon/index.md +++ b/website/integrations/chat-communication-collaboration/mobilizon/index.md @@ -4,6 +4,8 @@ sidebar_label: Mobilizon support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Mobilizon? > Gather, organize and mobilize yourselves with a convivial, ethical, and emancipating tool. https://joinmobilizon.org @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Mobilizon with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Mobilizon with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://mobilizon.company/auth/keycloak/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mobilizon.company/auth/keycloak/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/nextcloud/index.mdx b/website/integrations/chat-communication-collaboration/nextcloud/index.mdx index 1601cad068..476f1b7e38 100644 --- a/website/integrations/chat-communication-collaboration/nextcloud/index.mdx +++ b/website/integrations/chat-communication-collaboration/nextcloud/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Nextcloud support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; ## What is Nextcloud? @@ -116,13 +117,16 @@ To connect to an existing Nextcloud user, set the `nextcloud_user_id` attribute ## Create an application and provider in authentik + + 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://nextcloud.company/apps/user_oidc/code`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://nextcloud.company/apps/user_oidc/code`. + - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://nextcloud.company`. - Select any available signing key. - Under **Advanced protocol settings**: - _(optional)_ If you created the `Nextcloud Profile` scope mapping, add it to **Selected Scopes**. diff --git a/website/integrations/chat-communication-collaboration/opencloud/index.mdx b/website/integrations/chat-communication-collaboration/opencloud/index.mdx new file mode 100644 index 0000000000..f082bd73df --- /dev/null +++ b/website/integrations/chat-communication-collaboration/opencloud/index.mdx @@ -0,0 +1,189 @@ +--- +title: Integrate with OpenCloud +sidebar_label: OpenCloud +support_level: community +--- + +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; +import TabItem from "@theme/TabItem"; +import Tabs from "@theme/Tabs"; + +## What is OpenCloud? + +> OpenCloud is an open-source content collaboration platform for storing, syncing, and sharing files, built on the Infinite Scale (oCIS) architecture. +> +> -- https://opencloud.eu + +## Preparation + +The following placeholders are used in this guide: + +- `opencloud.company` is the FQDN of the OpenCloud installation. +- `authentik.company` is the FQDN of the authentik installation. + +This guide covers integrating authentik with the [`opencloud-compose`](https://github.com/opencloud-eu/opencloud-compose) Docker deployment. OpenCloud only supports authentication via OpenID Connect (OIDC). + +Choose your setup below. The **Web only** tab logs in through the browser. The **Web, desktop & mobile** tab also enables the native sync clients, which each use a distinct client ID and require some extra issuer configuration. + + + + +## authentik configuration + + + +1. Log in to authentik as an administrator and open the Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application**. + - **Application**: provide a name and note the **slug**. + - **Choose a Provider type**: select **OAuth2/OpenID Connect**. + - **Configure the Provider**: + - **Client type**: `Public` + - **Client ID**: `web` + - **Redirect URIs**: + - `Strict` `Authorization`: `https://opencloud.company/oidc-callback.html` + - `Strict` `Authorization`: `https://opencloud.company/oidc-silent-redirect.html` + - `Strict` `Authorization`: `https://opencloud.company/` + - **Signing Key**: select any available key. + - **Scopes**: `openid`, `profile`, `email`. +3. Click **Submit**. + +## OpenCloud configuration + +In the `opencloud-compose` project, enable the external IdP overlay in `COMPOSE_FILE`. This replaces OpenCloud's built-in IdP, so login goes through authentik only. + +```bash +COMPOSE_FILE=docker-compose.yml:idm/external-idp.yml:custom/authentik-roles.yml +``` + +Set the OIDC values in `.env`: + +```bash +OC_DOMAIN=opencloud.company +IDP_DOMAIN=authentik.company +IDP_ISSUER_URL=https://authentik.company/application/o// +OC_OIDC_CLIENT_ID=web +OC_OIDC_CLIENT_SCOPES=openid profile email +WEBFINGER_WEB_OIDC_CLIENT_ID=web +WEBFINGER_WEB_OIDC_CLIENT_SCOPES=openid profile email +``` + +Create `custom/authentik-roles.yml` to assign every user the default role: + +```yaml +--- +services: + opencloud: + environment: + PROXY_ROLE_ASSIGNMENT_DRIVER: "default" + GRAPH_ASSIGN_DEFAULT_USER_ROLE: "true" +``` + +Then reboot your Docker containers. + +## Configuration verification + +Open `https://opencloud.company` in a new browser window. You are redirected to authentik to log in, and after authenticating you are returned to OpenCloud. + + + + +OpenCloud's web, desktop, Android, and iOS clients each use a distinct client ID, but must validate tokens against one issuer. authentik gives every application its own issuer by default, so this setup uses **GLOBAL issuer mode** (all providers share `https://authentik.company/`) plus a reverse proxy that serves OIDC discovery at that shared issuer. + +## Reverse proxy configuration + +With GLOBAL issuer mode enabled, tokens use an issuer of `iss = https://authentik.company/`, but authentik only exposes OpenID Connect discovery at `https://authentik.company/application/o//.well-known/openid-configuration`. To reconcile this, place a reverse proxy in front of authentik that maps the root discovery URL to a specific provider’s discovery endpoint. Any reverse proxy can handle this; for example, with Caddy: + +```caddy +# Forward authentik.company to this; it in turn forwards to authentik. +:8081 { + @discovery path /.well-known/openid-configuration + rewrite @discovery /application/o//.well-known/openid-configuration + reverse_proxy authentik-upstream:9000 { + # keep authentik building https URLs if it is behind TLS termination + header_up X-Forwarded-Proto https + } +} +``` + +## authentik configuration + +Repeat these steps for **each** of the four clients (Web, Desktop, Android, and iOS), using the per-client values from the table below. + +| Client | Client ID | Redirect URIs | +| ------- | ------------------ | ------------------------------------------------------------------------------------------------------------- | +| Web | `web` | `Strict` `Authorization`: `https://opencloud.company/oidc-callback.html`, `…/oidc-silent-redirect.html`, `…/` | +| Desktop | `OpenCloudDesktop` | `Regex` `Authorization`: `http://127.0.0.1(:[0-9]+)?(/.*)?` and `http://localhost(:[0-9]+)?(/.*)?` | +| Android | `OpenCloudAndroid` | `Strict` `Authorization`: `oc://android.opencloud.eu` | +| iOS | `OpenCloudIOS` | `Strict` `Authorization`: `oc://ios.opencloud.eu` | + +1. Log in to authentik as an administrator and open the Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application**. + - **Application**: provide a name and note the **slug**. + - **Choose a Provider type**: select **OAuth2/OpenID Connect**. + - **Configure the Provider**: + - **Client type**: `Public` + - **Client ID**: the client's value from the table above. + - **Redirect URIs**: the client's value from the table above. + - **Signing Key**: select the **same** key for all four providers (the shared issuer exposes a single `jwks_uri`, so all clients' tokens must be signed by one key). + - Under **Advanced protocol settings**, add `offline_access` to **Selected scopes**. + - **Under advanced protocol settings**: + - **Issuer mode**: `Same identifier is used for all providers`. +3. Click **Submit**. + +## OpenCloud configuration + +In the `opencloud-compose` project, enable the external IdP overlay in `COMPOSE_FILE`. This replaces OpenCloud's built-in IdP, so login goes through authentik only. + +```bash +COMPOSE_FILE=docker-compose.yml:idm/external-idp.yml:custom/authentik-roles.yml +``` + +Set the OIDC values in `.env`. `OC_OIDC_ISSUER` points at the shared (root) issuer, and each client uses its own WebFinger client ID: + +```bash +OC_DOMAIN=opencloud.company +IDP_DOMAIN=authentik.company +IDP_ISSUER_URL=https://authentik.company/ +OC_OIDC_CLIENT_ID=web +OC_OIDC_CLIENT_SCOPES=openid profile email + +WEBFINGER_WEB_OIDC_CLIENT_ID=web +WEBFINGER_WEB_OIDC_CLIENT_SCOPES=openid profile email +WEBFINGER_DESKTOP_OIDC_CLIENT_ID=OpenCloudDesktop +WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES=openid profile email offline_access +WEBFINGER_IOS_OIDC_CLIENT_ID=OpenCloudIOS +WEBFINGER_IOS_OIDC_CLIENT_SCOPES=openid profile email offline_access +WEBFINGER_ANDROID_OIDC_CLIENT_ID=OpenCloudAndroid +WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES=openid profile email offline_access +``` + +Create `custom/authentik-roles.yml` to assign every user the default role: + +```yaml +--- +services: + opencloud: + environment: + PROXY_ROLE_ASSIGNMENT_DRIVER: "default" + GRAPH_ASSIGN_DEFAULT_USER_ROLE: "true" +``` + +Then reboot your Docker containers. + +## Configuration verification + +Open `https://opencloud.company` in a browser, and add the account in the Desktop, iOS, and Android apps using the same server URL. Each client is redirected to authentik to log in and returned to the client afterwards. + + + + +## Resources + +- [OpenCloud docs — Integrating external OpenID Connect Identity Providers](https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/external-idp) +- [opencloud-compose](https://github.com/opencloud-eu/opencloud-compose) diff --git a/website/integrations/chat-communication-collaboration/openproject/index.md b/website/integrations/chat-communication-collaboration/openproject/index.md index 810faadcb7..5fa39a36f0 100644 --- a/website/integrations/chat-communication-collaboration/openproject/index.md +++ b/website/integrations/chat-communication-collaboration/openproject/index.md @@ -4,6 +4,8 @@ sidebar_label: OpenProject support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is OpenProject? > OpenProject is a web-based project management software. Use OpenProject to manage your projects, tasks and goals. Collaborate via work packages and link them to your pull requests on GitHub. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of OpenProject with authentik, you need to create a property mapping and an application/provider pair in authentik. ### Create a scope mapping @@ -61,7 +65,7 @@ OpenProject requires a first and last name for each user. By default authentik o - **Protocol settings**: - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - **Redirect URI**: - - Strict: `https://openproject.company/auth/oidc-authentik/callback` + - `Strict` `Authorization`: `https://openproject.company/auth/oidc-authentik/callback` - **Signing key**: select any available signing key. - **Advanced protocol settings**: - **Scopes**: diff --git a/website/integrations/chat-communication-collaboration/owncloud/index.md b/website/integrations/chat-communication-collaboration/owncloud/index.md index 3fe9e17576..2ffe8b378d 100644 --- a/website/integrations/chat-communication-collaboration/owncloud/index.md +++ b/website/integrations/chat-communication-collaboration/owncloud/index.md @@ -4,6 +4,8 @@ sidebar_label: ownCloud support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is ownCloud? > ownCloud is a free and open-source software project for content collaboration and sharing and syncing of files. @@ -23,6 +25,8 @@ This guide focuses on deploying ownCloud installations using Docker. If you depl ## authentik configuration + + To support the integration of ownCloud with authentik, you need to create multiple application/provider pairs in authentik. A different pair is required for the Web UI, Desktop application, Android application, and iOS application. The configuration for each application is nearly identical, except for the **Client ID**, **Client Secret**, and the **Redirect URI** values, which are [predefined](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html#client-ids-secrets-and-redirect-uris) by ownCloud for the Desktop, Android, and iOS applications. @@ -43,29 +47,29 @@ The configuration for each application is nearly identical, except for the **Cli - **Client ID**: Use the value generated by authentik. - **Client Secret**: Use the value generated by authentik. - **Redirect URIs**: - - Strict: `https://owncloud.company/apps/openidconnect/redirect` + - `Strict` `Authorization`: `https://owncloud.company/apps/openidconnect/redirect` **Desktop Application** - **Signing Key**: Select any available signing key. - **Client ID**: Use the predefined value found in the [ownCloud admin manual](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html#client-id). - **Client Secret**: Use the predefined value found in the [ownCloud admin manual](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html#client-secret). - **Redirect URIs**: - - Regex: `http://localhost:\d+` - - Regex: `http://127.0.0.1:\d+` + - `Regex` `Authorization`: `http://localhost:\d+` + - `Regex` `Authorization`: `http://127.0.0.1:\d+` **Android Application** - **Signing Key**: Select any available signing key. - **Client ID**: Use the predefined value found in the [ownCloud admin manual](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html#client-id). - **Client Secret**: Use the predefined value found in the [ownCloud admin manual](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html#client-secret). - **Redirect URI**: - - Strict: `oc://android.owncloud.com` + - `Strict` `Authorization`: `oc://android.owncloud.com` **iOS Application** - **Signing Key**: Select any available signing key. - **Client ID**: Use the predefined value found in the [ownCloud admin manual](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html#client-id). - **Client Secret**: Use the predefined value found in the [ownCloud admin manual](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html#client-secret). - **Redirect URI**: - - Strict: `oc://ios.owncloud.com` + - `Strict` `Authorization`: `oc://ios.owncloud.com` - **Advanced protocol settings:** - **Scopes**: Select the following scopes for each of the four application/provider pairs: `email`, `offline_access`, `openid`, `profile`. diff --git a/website/integrations/chat-communication-collaboration/planka/index.mdx b/website/integrations/chat-communication-collaboration/planka/index.mdx index 3cb8a3938c..184f8fb23a 100644 --- a/website/integrations/chat-communication-collaboration/planka/index.mdx +++ b/website/integrations/chat-communication-collaboration/planka/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Planka support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Planka? > Planka is an open-source, Trello-like application with a Kanban board system, used for project management. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Planka with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Planka with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://planka.company/oidc-callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://planka.company/oidc-callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/rocketchat/index.md b/website/integrations/chat-communication-collaboration/rocketchat/index.md index ec6b751bc9..eb4dc1657f 100644 --- a/website/integrations/chat-communication-collaboration/rocketchat/index.md +++ b/website/integrations/chat-communication-collaboration/rocketchat/index.md @@ -4,6 +4,8 @@ sidebar_label: Rocket.chat support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Rocket.chat? > Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript for organizations with high standards of data protection. It is licensed under the MIT License with some other licenses mixed in. See [Rocket.chat GitHub](https://github.com/RocketChat/Rocket.Chat/blob/develop/LICENSE) for licensing information. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Rocket.chat with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Rocket.chat with authentik, you need to create an - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://rocket.company/\_oauth/authentik`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://rocket.company/\_oauth/authentik`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/roundcube/index.md b/website/integrations/chat-communication-collaboration/roundcube/index.md index 16ea18ad68..a87f28148e 100644 --- a/website/integrations/chat-communication-collaboration/roundcube/index.md +++ b/website/integrations/chat-communication-collaboration/roundcube/index.md @@ -4,6 +4,8 @@ sidebar_label: Roundcube support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Roundcube? > Roundcube is a browser-based multilingual IMAP client with an application-like user interface. It provides the full functionality you expect from an email client, including MIME support, address book, folder manipulation, message searching and spell checking. @@ -29,6 +31,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Roundcube with authentik, you need to create an application/provider pair in authentik. ### Create property mappings @@ -59,7 +63,7 @@ To support the integration of Roundcube with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://roundcube.company/index.php?\_task=settings&\_action=plugin.oauth_redirect`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://roundcube.company/index.php?\_task=settings&\_action=plugin.oauth_redirect`. - Select any available signing key. - Under **Advanced protocol settings**: - Under **Scopes**, add `dovecotprofile` and `authentik default OAuth Mapping: OpenID 'offline_access'` to the list of selected scopes. diff --git a/website/integrations/chat-communication-collaboration/sharepoint-se/index.md b/website/integrations/chat-communication-collaboration/sharepoint-se/index.md index b10ca7489b..8f1ecac453 100644 --- a/website/integrations/chat-communication-collaboration/sharepoint-se/index.md +++ b/website/integrations/chat-communication-collaboration/sharepoint-se/index.md @@ -4,6 +4,8 @@ sidebar_label: SharePoint Server SE support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Microsoft SharePoint? > SharePoint is a proprietary, web-based collaborative platform that integrates natively with Microsoft 365. @@ -66,6 +68,8 @@ These guidelines use the following placeholders for the overall setup: ## authentik configuration + + ### Step 1: Create authentik OpenID property mappings SharePoint requires additional properties within the OpenID and profile scopes in order to operate OIDC properly and map incoming authentik OID claims with Microsoft claims. @@ -140,7 +144,7 @@ From the authentik Admin Dashboard: :::info use the explicit flow if user consents are required ::: - - **Redirect URIs / Origins**: `auth.providerRedirectURI` + - **Redirect URIs / Origins** (`Strict` `Authorization`): `auth.providerRedirectURI` - **Signing Key**: authentik Self-signed Certificate :::info The certificate is used for signing JWT tokens; if you change it after the integration do not forget to update your SharePoint Trusted Certificate. diff --git a/website/integrations/chat-communication-collaboration/vikunja/index.mdx b/website/integrations/chat-communication-collaboration/vikunja/index.mdx index ffc336152c..8d528ffe16 100644 --- a/website/integrations/chat-communication-collaboration/vikunja/index.mdx +++ b/website/integrations/chat-communication-collaboration/vikunja/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Vikunja support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -31,6 +32,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Vikunja with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -41,8 +44,8 @@ To support the integration of Vikunja with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - For web login, set a `Strict` redirect URI to `https://vikunja.company/auth/openid/authentik`. - - If using the Vikunja desktop client, add a `Regex` redirect URI such as `^http://127\\.0\\.0\\.1:[0-9]+/auth/openid/authentik$` to allow loopback redirects to `127.0.0.1`. + - For web login, add a **Redirect URI** of type `Strict` `Authorization` as `https://vikunja.company/auth/openid/authentik`. + - If using the Vikunja desktop client, add a **Redirect URI** of type `Regex` `Authorization` such as `^http://127\\.0\\.0\\.1:[0-9]+/auth/openid/authentik$` to allow loopback redirects to `127.0.0.1`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. diff --git a/website/integrations/chat-communication-collaboration/wekan/index.mdx b/website/integrations/chat-communication-collaboration/wekan/index.mdx index bc3c91a631..008d8557bf 100644 --- a/website/integrations/chat-communication-collaboration/wekan/index.mdx +++ b/website/integrations/chat-communication-collaboration/wekan/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Wekan support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Wekan? > Wekan is an open-source kanban board which allows a card-based task and to-do management. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Wekan with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Wekan with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://wekan.company/_oauth/oidc`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wekan.company/_oauth/oidc`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/chat-communication-collaboration/writefreely/index.md b/website/integrations/chat-communication-collaboration/writefreely/index.md index 435217e1f9..180e536ddd 100644 --- a/website/integrations/chat-communication-collaboration/writefreely/index.md +++ b/website/integrations/chat-communication-collaboration/writefreely/index.md @@ -4,6 +4,8 @@ sidebar_label: Writefreely support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Writefreely? > An open source platform for building a writing space on the web. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Writefreely with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Writefreely with authentik, you need to create an - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://writefreely.company/oauth/callback/generic`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://writefreely.company/oauth/callback/generic`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/cloud-providers/aws-classic/index.mdx b/website/integrations/cloud-providers/aws-classic/index.mdx index 21a3c348a8..6838258512 100644 --- a/website/integrations/cloud-providers/aws-classic/index.mdx +++ b/website/integrations/cloud-providers/aws-classic/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Amazon Web Services (Classic IAM) support_level: authentik --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -44,6 +45,8 @@ SCIM Provisioning is only supported in conjunction with [IAM Identity Center](.. ## authentik configuration + + To support the integration of AWS with authentik via the Classic IAM method, you need to create two property mappings, an application/provider pair, and application entitlements for the AWS roles that users can assume. ### Create property mappings @@ -273,7 +276,7 @@ To support the integration of AWS with authentik using OIDC, you need to create - **Choose a Provider type**: Select OAuth2/OpenID Provider as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **slug** values because they will be required later. - - Set a `Strict` redirect URI to match the AWS resource that you want to access via OIDC. + - Add a **Redirect URI** of type `Strict` `Authorization` that matches the AWS resource that you want to access via OIDC. - Select any available signing key. - Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: OpenID 'entitlements'`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/cloud-providers/digitalocean/index.md b/website/integrations/cloud-providers/digitalocean/index.md index 12fb4abfd6..a0b6dbacd8 100644 --- a/website/integrations/cloud-providers/digitalocean/index.md +++ b/website/integrations/cloud-providers/digitalocean/index.md @@ -4,6 +4,8 @@ sidebar_label: DigitalOcean support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is DigitalOcean? > DigitalOcean is a cloud infrastructure provider that offers developers simple, scalable virtual servers (droplets), managed databases, and other cloud services to deploy and manage applications efficiently. @@ -22,6 +24,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of DigitalOcean with authentik, you need to create a scope mapping, an application/provider pair, and application entitlements for the DigitalOcean roles that users should receive. ### Create a scope mapping @@ -72,7 +76,7 @@ To support the integration of DigitalOcean with authentik, you need to create a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://cloud.digitalocean.com/sessions/sso/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://cloud.digitalocean.com/sessions/sso/callback`. - Select any available signing key. - Under **Advanced protocol settings**: - Add the `profile` scope created in the previous section. Do not remove authentik’s `authentik default OAuth Mapping: OpenID 'profile'`, as claims such as `name` are required by DigitalOcean. diff --git a/website/integrations/cloud-providers/oracle-cloud/index.md b/website/integrations/cloud-providers/oracle-cloud/index.md index 70ba59ce8b..2eb4bea93e 100644 --- a/website/integrations/cloud-providers/oracle-cloud/index.md +++ b/website/integrations/cloud-providers/oracle-cloud/index.md @@ -4,6 +4,8 @@ sidebar_label: Oracle Cloud support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Oracle Cloud? > Oracle Cloud is the first public cloud built from the ground up to be a better cloud for every application. By rethinking core engineering and systems design for cloud computing, we created innovations that accelerate migrations, deliver better reliability and performance for all applications, and offer the complete services customers need to build innovative cloud applications. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Oracle Cloud with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -35,7 +39,7 @@ To support the integration of Oracle Cloud with authentik, you need to create an - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://tenant.identity.oraclecloud.com/oauth2/v1/social/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://tenant.identity.oraclecloud.com/oauth2/v1/social/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/dashboards/dashy/index.md b/website/integrations/dashboards/dashy/index.md index 382d70586f..580e689017 100644 --- a/website/integrations/dashboards/dashy/index.md +++ b/website/integrations/dashboards/dashy/index.md @@ -4,6 +4,8 @@ sidebar_label: Dashy support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Dashy? > Dashy is a self-hostable personal dashboard built for you. Includes status-checking, widgets, themes, icon packs, a UI editor and tons more. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Dashy with authentik, you need to create an application/provider pair in authentik. If you want to manage Dashy administrator access through authentik, create or choose a group for Dashy administrators and add the appropriate users to it. Note the exact group name because it will be required later. @@ -36,7 +40,7 @@ If you want to manage Dashy administrator access through authentik, create or ch - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **slug** values because they will be required later. - Set the **Client type** to `Public`. Dashy runs entirely in the browser and does not store a client secret. - - Create two `Strict` redirect URIs: + - Add two **Redirect URIs** of type `Strict` `Authorization`: - `https://dashy.company` - `https://dashy.company/` - Select any available signing key. diff --git a/website/integrations/dashboards/homarr/index.md b/website/integrations/dashboards/homarr/index.md index 0005de3bcc..550e93b9e8 100644 --- a/website/integrations/dashboards/homarr/index.md +++ b/website/integrations/dashboards/homarr/index.md @@ -4,6 +4,8 @@ sidebar_label: Homarr support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Homarr? > A sleek, modern dashboard that puts all of your apps and services at your fingertips. Control everything in one convenient location. Seamlessly integrates with the apps you've added, providing you with valuable information. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Homarr with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Homarr with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Create two `Strict` redirect URIs: `https://homarr.company/api/auth/callback/oidc` and `http://localhost:50575/api/auth/callback/oidc`. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://homarr.company/api/auth/callback/oidc` and `http://localhost:50575/api/auth/callback/oidc`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/dashboards/linkwarden/index.md b/website/integrations/dashboards/linkwarden/index.md index 60cffdfc14..73d572ed29 100644 --- a/website/integrations/dashboards/linkwarden/index.md +++ b/website/integrations/dashboards/linkwarden/index.md @@ -4,6 +4,8 @@ sidebar_label: Linkwarden support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Linkwarden? > Linkwarden is an open-source collaborative bookmark manager used to collect, organize, and preserve webpages. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Linkwarden with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Linkwarden with authentik, you need to create an a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://linkwarden.company/api/v1/auth/callback/authentik`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://linkwarden.company/api/v1/auth/callback/authentik`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/coder/index.md b/website/integrations/development/coder/index.md index a0d75d89eb..94570c3081 100644 --- a/website/integrations/development/coder/index.md +++ b/website/integrations/development/coder/index.md @@ -4,6 +4,8 @@ sidebar_label: Coder support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Coder? > Coder is an open-source platform that provides browser-based cloud development environments, enabling developers and teams to securely write, edit, and manage code remotely without the need for local setup. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Coder with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Coder with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://coder.company/api/v2/users/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://coder.company/api/v2/users/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/engomo/index.mdx b/website/integrations/development/engomo/index.mdx index d9cedfb59f..c8f3967bf3 100644 --- a/website/integrations/development/engomo/index.mdx +++ b/website/integrations/development/engomo/index.mdx @@ -4,6 +4,8 @@ sidebar_label: engomo support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is engomo? > engomo is a low-code app development platform to create enterprise apps for smartphones and tablets based on Android, iOS, or iPadOS. @@ -25,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Engomo with authentik, you need to create an application/provider pair in authentik. ### Create property mappings @@ -46,7 +50,7 @@ To support the integration of Engomo with authentik, you need to create an appli - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **slug** values because they will be required later. - Set the **Client type** to `Public`. - - Add two `Strict` redirect URIs and set them to `https://engomo.company/auth` and `com.engomo.engomo://callback/`. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://engomo.company/auth` and `com.engomo.engomo://callback/`. - Select any available signing key. - Under **Advanced protocol settings**, add the scope you just created to the list of available scopes. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/forgejo/index.md b/website/integrations/development/forgejo/index.md index a29b10f261..df34aa3bf3 100644 --- a/website/integrations/development/forgejo/index.md +++ b/website/integrations/development/forgejo/index.md @@ -4,6 +4,8 @@ sidebar_label: Forgejo support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Forgejo? > Forgejo is a lightweight, self‑hosted alternative to GitHub/GitLab, with a strong emphasis on community governance and open development. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Forgejo with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Forgejo with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https:///user/oauth2/authentik/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https:///user/oauth2/authentik/callback`. - Select any available signing key. - Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: OpenID 'entitlements'`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/frappe/index.md b/website/integrations/development/frappe/index.md index e5664a78a1..b893d8de94 100644 --- a/website/integrations/development/frappe/index.md +++ b/website/integrations/development/frappe/index.md @@ -4,6 +4,8 @@ sidebar_label: Frappe support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + :::info These instructions apply to all projects in the Frappe Family, including ERPNext. ::: @@ -28,6 +30,8 @@ This documentation only lists the settings that have been changed from their def ## authentik configuration + + To support the integration of Frappe with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -39,7 +43,7 @@ To support the integration of Frappe with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://frappe.company/api/method/frappe.integrations.oauth2_logins.custom/`. Replace `` with the name of the provider in Frappe. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://frappe.company/api/method/frappe.integrations.oauth2_logins.custom/`. Replace `` with the name of the provider in Frappe. - Select any available signing key. - Under **Advanced protocol settings**, set **Subject mode** to be `Based on the Users's username`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/gitea/index.md b/website/integrations/development/gitea/index.md index 33dfaa2094..eda4ad538f 100644 --- a/website/integrations/development/gitea/index.md +++ b/website/integrations/development/gitea/index.md @@ -4,6 +4,8 @@ sidebar_label: Gitea support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Gitea? > Gitea is a community managed lightweight code hosting solution written in Go. It is published under the MIT license. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Gitea with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Gitea with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https:///user/oauth2/authentik/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https:///user/oauth2/authentik/callback`. - Select any available signing key. - Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: OpenID 'entitlements'`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/gitlab/index.mdx b/website/integrations/development/gitlab/index.mdx index 6154cc6239..e8e243e85d 100644 --- a/website/integrations/development/gitlab/index.mdx +++ b/website/integrations/development/gitlab/index.mdx @@ -4,6 +4,8 @@ sidebar_label: GitLab support_level: authentik --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is GitLab? > GitLab is a complete DevOps platform with features for version control, CI/CD, issue tracking, and collaboration, facilitating efficient software development and deployment workflows. @@ -43,6 +45,8 @@ import Tabs from "@theme/Tabs"; ## authentik configuration + + To support the integration of GitLab with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -110,7 +114,7 @@ To support the integration of GitLab with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://gitlab.company/users/auth/openid_connect/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gitlab.company/users/auth/openid_connect/callback`. - Select any available signing key. - Under **Advanced protocol settings**, set the **Subject mode** to `Based on the User's Email`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/gravitee/index.md b/website/integrations/development/gravitee/index.md index f05fdfd16f..0e4565936f 100644 --- a/website/integrations/development/gravitee/index.md +++ b/website/integrations/development/gravitee/index.md @@ -4,6 +4,8 @@ sidebar_label: Gravitee support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Gravitee? > Gravitee.io API Management is a flexible, lightweight and blazing-fast Open Source solution that helps your organization control who, when and how users access your APIs. @@ -25,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Gravitee with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -36,7 +40,7 @@ To support the integration of Gravitee with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Add two `Strict` redirect URI and set them to `https://gravitee.company/user/login` and `https://gravitee.company/console/`. Ensure a trailing slash is present at the end of the second redirect URI. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://gravitee.company/user/login` and `https://gravitee.company/console/`. Ensure a trailing slash is present at the end of the second redirect URI. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/jenkins/index.md b/website/integrations/development/jenkins/index.md index 0ce37bf2c0..470bc2dd47 100644 --- a/website/integrations/development/jenkins/index.md +++ b/website/integrations/development/jenkins/index.md @@ -4,6 +4,8 @@ sidebar_label: Jenkins support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Jenkins? > The leading open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Jenkins with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Jenkins with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://jenkins.company/securityRealm/finishLogin`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://jenkins.company/securityRealm/finishLogin`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/development/node-red/index.md b/website/integrations/development/node-red/index.md index f0ef11869f..4e21606981 100644 --- a/website/integrations/development/node-red/index.md +++ b/website/integrations/development/node-red/index.md @@ -4,6 +4,8 @@ sidebar_label: Node-RED support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Node-RED? > Node-RED is a programming tool for wiring together hardware devices, APIs and online services in new and interesting ways. @@ -29,6 +31,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Node-RED with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -40,7 +44,7 @@ To support the integration of Node-RED with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://nodered.company/auth/strategy/callback/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://nodered.company/auth/strategy/callback/`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/device-management/apple/index.md b/website/integrations/device-management/apple/index.md index 5a259e2680..37d0798933 100644 --- a/website/integrations/device-management/apple/index.md +++ b/website/integrations/device-management/apple/index.md @@ -13,6 +13,8 @@ authentik_enterprise: true authentik_preview: true --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Apple Business Manager? > Apple Business Manager is a web-based portal for IT administrators, managers, and procurement professionals to manage devices and automate device enrollment. @@ -71,6 +73,8 @@ Be aware that Apple Business Manager imposes the following restrictions on feder ## authentik configuration + + The workflow to configure authentik as an identity provider for Apple Business Manager involves creating scope mappings, signing keys, a Shared Signals Framework provider, and an OIDC provider/application pair. Together, these components will handle the authentication flow and backchannel communication between authentik and Apple Business Manager. @@ -160,7 +164,7 @@ You will need to create an [OAuth2/OpenID Provider](/docs/add-secure-apps/provid - **Choose a Provider type**: select **OAuth2/OpenID Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://gsa-ws.apple.com/grandslam/GsService2/acs`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gsa-ws.apple.com/grandslam/GsService2/acs`. - Select any available signing key. - Under **Advanced protocol settings**, in addition to the default scopes, add the four following **Selected Scopes** to the provider. - `Apple Business Manager ssf.manage` diff --git a/website/integrations/device-management/meshcentral/index.md b/website/integrations/device-management/meshcentral/index.md index 226adb7a07..9329c80bc7 100644 --- a/website/integrations/device-management/meshcentral/index.md +++ b/website/integrations/device-management/meshcentral/index.md @@ -4,6 +4,8 @@ sidebar_label: MeshCentral support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is MeshCentral? > MeshCentral is a free, open source, web-based platform for remote device management. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of MeshCentral with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of MeshCentral with authentik, you need to create an - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://meshcentral.company/auth-oidc-callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://meshcentral.company/auth-oidc-callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/device-management/omnissa-workspace-one-access/index.md b/website/integrations/device-management/omnissa-workspace-one-access/index.md index 6b8a5baa32..8bc4bc2330 100644 --- a/website/integrations/device-management/omnissa-workspace-one-access/index.md +++ b/website/integrations/device-management/omnissa-workspace-one-access/index.md @@ -4,6 +4,8 @@ sidebar_label: Omnissa Workspace ONE Access support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Omnissa Workspace ONE Access? > Omnissa Workspace ONE Access, now Omnissa Access, is the identity and access service for the Omnissa Workspace ONE platform. It provides single sign-on, access policies, and identity federation for applications and devices, and can delegate authentication to external identity providers such as authentik. @@ -31,6 +33,8 @@ You can leave the form open in another browser tab while configuring authentik. ## authentik configuration + + To support the integration of Omnissa Workspace ONE Access with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -43,8 +47,8 @@ To support the integration of Omnissa Workspace ONE Access with authentik, you n - Note the **Client ID** and **Client Secret** values because they will be required later. - **Protocol Settings**: - **Redirect URI**: - - Strict: the redirect URI you noted in the Omnissa Workspace ONE Access pre-configuration step. - - Strict: `awgb://oauth2`. This URI is used by the Workspace ONE mobile applications. + - `Strict` `Authorization`: the redirect URI you noted in the Omnissa Workspace ONE Access pre-configuration step. + - `Strict` `Authorization`: `awgb://oauth2`. This URI is used by the Workspace ONE mobile applications. - **Signing Key**: select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/bookstack/index.mdx b/website/integrations/documentation/bookstack/index.mdx index a73e7894fb..e80c785311 100644 --- a/website/integrations/documentation/bookstack/index.mdx +++ b/website/integrations/documentation/bookstack/index.mdx @@ -4,6 +4,7 @@ sidebar_label: BookStack support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -38,6 +39,8 @@ You can configure Bookstack to use either OIDC or SAML, and this guide explains ## authentik configuration + + To support the integration of BookStack with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -48,7 +51,7 @@ To support the integration of BookStack with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://bookstack.company/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://bookstack.company/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/dokuwiki/dokuwiki_oauth_generic.png b/website/integrations/documentation/dokuwiki/dokuwiki_oauth_generic.png index 6141ebf419..6230969002 100644 Binary files a/website/integrations/documentation/dokuwiki/dokuwiki_oauth_generic.png and b/website/integrations/documentation/dokuwiki/dokuwiki_oauth_generic.png differ diff --git a/website/integrations/documentation/dokuwiki/index.md b/website/integrations/documentation/dokuwiki/index.md index 349507c5aa..1d45852a02 100644 --- a/website/integrations/documentation/dokuwiki/index.md +++ b/website/integrations/documentation/dokuwiki/index.md @@ -4,6 +4,8 @@ sidebar_label: DokuWiki support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is DokuWiki? > DokuWiki is an open source wiki application licensed under GPLv2 and written in the PHP programming language. It works on plain text files and thus does not need a database. Its syntax is similar to the one used by MediaWiki and it is often recommended as a more lightweight, easier to customize alternative to MediaWiki. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of DokuWiki with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -35,7 +39,8 @@ To support the integration of DokuWiki with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://dokuwiki.company/doku.php`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://dokuwiki.company/doku.php`. + - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://dokuwiki.company/doku.php`. - Select any available signing key. - Under **Advanced protocol settings**, add the following OAuth mapping under **Scopes**: `authentik default OAuth Mapping: OpenID 'offline_access'` - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. @@ -68,6 +73,7 @@ For **oauthgeneric**: - Set `plugin»oauthgeneric»authurl` to `https://authentik.company/application/o/authorize/` - Set `plugin»oauthgeneric»tokenurl` to `https://authentik.company/application/o/token/` - Set `plugin»oauthgeneric»userurl` to `https://authentik.company/application/o/userinfo/` +- Set `plugin»oauthgeneric»logouturl` to `https://authentik.company/application/o/end-session/` - Set `plugin»oauthgeneric»authmethod` to `Bearer Header` - Set `plugin»oauthgeneric»scopes` to `email, openid, profile, offline_access` - Select `plugin»oauthgeneric»needs-state` @@ -75,6 +81,7 @@ For **oauthgeneric**: - Set `plugin»oauthgeneric»json-name` to `name` - Set `plugin»oauthgeneric»json-mail` to `email` - Set `plugin»oauthgeneric»json-grps` to`groups` +- Set `plugin»oauthgeneric»color ` to `#fd4b2d` ![](./dokuwiki_oauth_generic.png) diff --git a/website/integrations/documentation/dropbox-sign/index.mdx b/website/integrations/documentation/dropbox-sign/index.mdx new file mode 100644 index 0000000000..3577b1de44 --- /dev/null +++ b/website/integrations/documentation/dropbox-sign/index.mdx @@ -0,0 +1,107 @@ +--- +title: Integrate with Dropbox Sign +sidebar_label: Dropbox Sign +support_level: community +--- + +import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; + +## What is Dropbox Sign? + +> Dropbox Sign is an electronic signature platform for preparing, sending, signing, and tracking documents and agreements. +> +> -- https://sign.dropbox.com/ + +## Preparation + +The following placeholders are used in this guide: + +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +:::info Dropbox Sign requirements +SAML SSO requires a Dropbox Sign Premium plan. +::: + +## authentik configuration + +To support the integration of Dropbox Sign with authentik, you need to create property mappings and an application/provider pair in authentik. + +### Create property mappings + +Dropbox Sign expects the SAML assertion to include `FirstName` and `LastName` attributes. Because authentik stores a user's full name as a single string, create SAML provider property mappings that split the full name into first and last names. + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Customization** > **Property Mappings** and click **Create**. +3. Select **SAML Provider Property Mapping** as the property mapping type and click **Next**. +4. Create a property mapping with the following values: + - **Name**: `Dropbox Sign FirstName` + - **SAML Attribute Name**: `FirstName` + - **Expression**: + + ```python + name = request.user.name or request.user.username + return name.split(" ", 1)[0] + ``` + +5. Click **Finish** to save the property mapping. +6. Repeat steps 2-5 to create the following additional SAML provider property mapping: + - **Name**: `Dropbox Sign LastName` + - **SAML Attribute Name**: `LastName` + - **Expression**: + + ```python + name = request.user.name or request.user.username + return name.rsplit(" ", 1)[-1] if " " in name else "" + ``` + +### Create an application and provider in authentik + + + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. + - **Choose a Provider type**: select **SAML Provider** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Set **ACS URL** to `https://app.hellosign.com/account/ssoLogIn`. + - Set **Audience** to `https://app.hellosign.com`. + - Under **Advanced protocol settings**: + - Set **Signing Certificate** to any available certificate. + - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. + - Set **Default NameID Policy** to `Email address`. + - Add the `Dropbox Sign FirstName` and `Dropbox Sign LastName` property mappings that you created in the previous section. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. +3. Click **Submit** to save the new application and provider. + +### Download and prepare the signing certificate + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click the name of the newly created Dropbox Sign provider. +3. Under **Related objects** > **Download signing certificate**, click **Download**. +4. Open the downloaded certificate file in plain text, remove the first and last lines (`-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`), then remove all line breaks from the remaining certificate text. This certificate text will be required in the next section. + +## Dropbox Sign configuration + +1. Log in to Dropbox Sign as an administrator. +2. Hover over your email address in the top-right corner, then select **Admin console**. +3. In the left sidebar, click **Security**, then locate **SSO**. +4. Configure the following required settings: + - **Identity Provider Single Sign-On URL**: `https://authentik.company/application/saml//` + - **Identity Provider Issuer**: `https://authentik.company/application/saml//metadata/` + - **X.509 Certificate**: paste the certificate text that you prepared from the authentik signing certificate. +5. Keep **Allow standard logins for admins** enabled while testing the SAML configuration. +6. Click **Save**. + +## Configuration verification + +To confirm that authentik is properly configured with Dropbox Sign, open the Dropbox Sign application from the authentik Application Dashboard. You should be redirected to Dropbox Sign and signed in as the matching Dropbox Sign user. + +After you verify that SAML SSO works, decide whether to disable **Allow standard logins for admins** in Dropbox Sign. + +## Resources + +- [Dropbox Help - Dropbox Sign SAML SSO configuration](https://help.dropbox.com/security/dropbox-sign-saml-sso-configuration) diff --git a/website/integrations/documentation/karakeep/index.md b/website/integrations/documentation/karakeep/index.md index 19d6b625ad..1eb9d46a33 100644 --- a/website/integrations/documentation/karakeep/index.md +++ b/website/integrations/documentation/karakeep/index.md @@ -4,6 +4,8 @@ sidebar_label: Karakeep support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Karakeep? > A self-hostable bookmark-everything app (links, notes and images) with AI-based automatic tagging and full-text search. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Karakeep with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Karakeep with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://karakeep.company/api/auth/callback/custom`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://karakeep.company/api/auth/callback/custom`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/kitchenowl/index.md b/website/integrations/documentation/kitchenowl/index.md index 87aa24dbb0..802e171e35 100644 --- a/website/integrations/documentation/kitchenowl/index.md +++ b/website/integrations/documentation/kitchenowl/index.md @@ -4,6 +4,8 @@ sidebar_label: KitchenOwl support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is KitchenOwl? > KitchenOwl is a smart self-hosted grocery list and recipe manager. Easily add items to your shopping list before you go shopping. You can also create recipes and set up meal plans to help you organize your cooking. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of KitchenOwl with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of KitchenOwl with authentik, you need to create an a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret** values because they will be required later. - - Create two `Strict` redirect URIs and set them to `https://kitchenowl.company/signin/redirect` and `kitchenowl:/signin/redirect`. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://kitchenowl.company/signin/redirect` and `kitchenowl:/signin/redirect`. 3. Click **Submit** to save the new application and provider. diff --git a/website/integrations/documentation/mealie/index.md b/website/integrations/documentation/mealie/index.md index d21edafe32..96117a7172 100644 --- a/website/integrations/documentation/mealie/index.md +++ b/website/integrations/documentation/mealie/index.md @@ -4,6 +4,8 @@ sidebar_label: Mealie support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Mealie? > Mealie is a self-hosted recipe manager and meal planner. Easily add recipes by providing the URL and Mealie will automatically import the relevant data or add a family recipe with the UI editor. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Mealie with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Mealie with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, , and **slug** values because they will be required later. - - Create two `Strict` redirect URIs and set to `https://mealie.company/login` and `https://mealie.company/login?direct=1`. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://mealie.company/login` and `https://mealie.company/login?direct=1`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/netbox/index.md b/website/integrations/documentation/netbox/index.md index 8a4cdaa9c8..0cdcffef91 100644 --- a/website/integrations/documentation/netbox/index.md +++ b/website/integrations/documentation/netbox/index.md @@ -4,6 +4,8 @@ sidebar_label: NetBox support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is NetBox? > NetBox is the leading solution for modeling and documenting modern networks. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of NetBox with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of NetBox with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://netbox.company/oauth/complete/oidc/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://netbox.company/oauth/complete/oidc/`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/notion/index.md b/website/integrations/documentation/notion/index.md new file mode 100644 index 0000000000..9607dc8a4f --- /dev/null +++ b/website/integrations/documentation/notion/index.md @@ -0,0 +1,203 @@ +--- +title: Integrate with Notion +sidebar_label: Notion +support_level: community +--- + +## What is Notion? + +> Notion is a workspace for notes, docs, projects, wikis, and collaboration. +> +> -- https://www.notion.com + +## Preparation + +The following placeholders are used in this guide: + +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +:::info Notion requirements +SAML SSO requires a Notion Business or Enterprise plan. SCIM provisioning requires a Notion Enterprise plan. Notion requires domain verification before SAML SSO can be enabled; domain verification is outside the scope of this guide. +::: + +## authentik configuration + +To support the integration of Notion with authentik, you need to create property mappings and an application/provider pair in authentik. + +### Create property mappings + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Customization** > **Property Mappings** and click **Create**. +3. Create four **SAML Provider Property Mapping**s with the following settings: + - **Email mapping**: + - **Name**: `Notion email` + - **SAML Attribute Name**: `email` + - **Expression**: + + ```python + return request.user.email + ``` + + - **First name mapping**: + - **Name**: `Notion firstName` + - **SAML Attribute Name**: `firstName` + - **Expression**: + + ```python + return request.user.name + ``` + + - **Last name mapping**: + - **Name**: `Notion lastName` + - **SAML Attribute Name**: `lastName` + - **Expression**: + + ```python + return "" + ``` + + - **Profile photo mapping**: + - **Name**: `Notion profilePhoto` + - **SAML Attribute Name**: `profilePhoto` + - **Expression**: + + ```python + avatar = request.user.avatar + if "://" not in avatar: + return "" + return avatar + ``` + +### Create an application and provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. + - **Choose a Provider type**: select **SAML Provider** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Set **ACS URL** to `https://temp.temp`. You will replace this after completing the Notion configuration. + - Set **Audience** to `https://www.notion.so/sso/saml`. + - Under **Advanced protocol settings**: + - Select an available **Signing Certificate**. + - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. + - Add the four property mappings that you created in the previous section. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. +3. Click **Submit** to save the new application and provider. + +## Notion configuration + +### Configure SAML SSO + +1. Log in to Notion as a workspace owner. +2. Open the SAML SSO settings: + - **Business Plan**: navigate to **Settings** > **General**. If you want access controlled through SAML or SCIM, remove all entries from **Allowed email domains**; otherwise, users with those domains can still join outside IdP provisioning. Then, open **Settings** > **Identity**. + - **Enterprise Plan**: open the workspace switcher, select **Manage organization**, and open the **General** tab. +3. Enable **SAML SSO**. +4. In the SAML SSO configuration modal, under **Identity Provider Details**, select **Identity Provider URL** and enter `https://authentik.company/application/saml//metadata/`. +5. Copy the **Assertion Consumer Service (ACS) URL** from Notion. +6. Save the SAML SSO configuration. + +## Reconfigure authentik provider + +1. In authentik, navigate to **Applications** > **Providers**. +2. Edit the SAML provider that you created for Notion. +3. Set **ACS URL** to the **Assertion Consumer Service (ACS) URL** that you copied from Notion. +4. Click **Update**. + +## SCIM provisioning _(optional)_ + +You can configure SCIM provisioning to sync users and groups from authentik to Notion. Notion requires one SCIM API token per workspace. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized. + +### Notion configuration + +#### Create a SCIM API token + +1. Log in to Notion as an Enterprise Plan organization owner. +2. Open the workspace switcher and select **Manage organization**. +3. In the **General** tab, select **SCIM provisioning**. +4. Copy an existing token or click **Add token** to create a new token. + +### authentik configuration + +#### Create a SCIM property mapping + +Notion requires the SCIM `userName` field to contain the user's email address. + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Customization** > **Property Mappings** and click **Create**. +3. Select **SCIM Provider Mapping** and click **Next**. +4. Enter the following values: + - **Name**: `Notion SCIM user` + - **Expression**: + + ```python + given_name, family_name = request.user.name, " " + formatted = request.user.name + " " + if " " in request.user.name: + given_name, _, family_name = request.user.name.partition(" ") + formatted = request.user.name + + avatar = request.user.avatar + photos = None + if "://" in avatar: + photos = [{"value": avatar, "type": "photo"}] + + emails = [] + if request.user.email != "": + emails = [{ + "value": request.user.email, + "type": "work", + "primary": True, + }] + return { + "userName": request.user.email, + "name": { + "formatted": formatted, + "givenName": given_name, + "familyName": family_name, + }, + "displayName": request.user.name, + "photos": photos, + "active": request.user.is_active, + "emails": emails, + } + ``` + +5. Click **Finish**. + +#### Create a SCIM provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click **Create**. + - **Choose a Provider type**: select **SCIM Provider** as the provider type. + - **Configure the Provider**: provide a name for the provider, and the following required configurations. + - **URL**: `https://api.notion.com/scim/v2` + - **Token**: paste the SCIM API token from Notion. + - Under **Attribute mapping**: + - Remove `authentik default SCIM Mapping: User` from **Selected User Property Mappings** and add `Notion SCIM user`. + - Under **Selected Group Property Mappings**, add `authentik default SCIM Mapping: Group`. +3. Click **Finish** to save the provider. + +#### Set the SCIM provider as a backchannel provider + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click the name of your Notion application. +3. Click the plus (+) icon next to **Backchannel Providers** and select the SCIM provider that you created. +4. Click **Save Changes**. + +## Configuration verification + +To confirm that authentik is properly configured with Notion, open Notion and log in with SAML SSO. + +To confirm that SCIM is properly configured, open the Notion SCIM provider in authentik and click the run button on the **Full sync for SCIM provider** task. After the sync completes, verify that users with access to the Notion application are provisioned in Notion. + +## Resources + +- [Notion Help Center - SAML SSO](https://www.notion.com/help/saml-sso-configuration) +- [Notion Help Center - Set up Identity Provider (IdP) for SAML SSO](https://www.notion.com/help/set-up-identity-provider-for-saml-sso) +- [Notion Help Center - Provision users & groups with SCIM](https://www.notion.com/help/provision-users-and-groups-with-scim) +- [Notion Help Center - Set up Identity Provider (IdP) for SCIM](https://www.notion.com/help/set-up-identity-provider-for-scim) diff --git a/website/integrations/documentation/outline/index.md b/website/integrations/documentation/outline/index.md index ab058984bc..547fd9cc2e 100644 --- a/website/integrations/documentation/outline/index.md +++ b/website/integrations/documentation/outline/index.md @@ -4,6 +4,8 @@ sidebar_label: Outline support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Outline? > Your team's knowledge base. @@ -24,6 +26,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Outline with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -35,7 +39,7 @@ To support the integration of Outline with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://outline.company/auth/oidc.callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://outline.company/auth/oidc.callback`. - Select any available signing key. - Under **Advanced protocol settings**, set the **Subject Mode** to **Based on the User's username**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/paperless-ngx/index.mdx b/website/integrations/documentation/paperless-ngx/index.mdx index 758116cee2..c14dcbbc85 100644 --- a/website/integrations/documentation/paperless-ngx/index.mdx +++ b/website/integrations/documentation/paperless-ngx/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Paperless-ngx support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Paperless-ngx? > Paperless-ngx is an application that indexes your scanned documents and allows you to easily search for documents and store metadata alongside your documents. It was a fork from Paperless-ng, in turn a fork from the original Paperless, neither of which are maintained any longer. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Paperless-ngx with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Paperless-ngx with authentik, you need to create a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://paperless.company/accounts/oidc/authentik/login/callback/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://paperless.company/accounts/oidc/authentik/login/callback/`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. - **Advanced protocol settings**: - **Selected Scopes**: Add the following diff --git a/website/integrations/documentation/papra/index.mdx b/website/integrations/documentation/papra/index.mdx index 06f04fd13a..3ded3f7628 100644 --- a/website/integrations/documentation/papra/index.mdx +++ b/website/integrations/documentation/papra/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Papra support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Papra? > An open-source document management platform designed to help you organize, secure, and archive your files effortlessly. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Papra with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Papra with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **Slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://papra.company/api/auth/oauth2/callback/authentik`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://papra.company/api/auth/oauth2/callback/authentik`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/tandoor/index.md b/website/integrations/documentation/tandoor/index.md index 75a7259e7c..dde4f187b1 100644 --- a/website/integrations/documentation/tandoor/index.md +++ b/website/integrations/documentation/tandoor/index.md @@ -4,6 +4,8 @@ sidebar_label: Tandoor support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Tandoor? > Application for managing recipes, planning meals and building shopping lists. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Tandoor with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Tandoor with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://tandoor.company/accounts/oidc/authentik/login/callback/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://tandoor.company/accounts/oidc/authentik/login/callback/`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/documentation/wiki-js/index.md b/website/integrations/documentation/wiki-js/index.md index d02f80d636..9353aec562 100644 --- a/website/integrations/documentation/wiki-js/index.md +++ b/website/integrations/documentation/wiki-js/index.md @@ -4,6 +4,8 @@ sidebar_label: Wiki.js support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Wiki.js? > Wiki.js is a wiki engine running on Node.js and written in JavaScript. It is free software released under the Affero GNU General Public License. It is available as a self-hosted solution or using "single-click" install on the DigitalOcean and AWS marketplace. @@ -33,6 +35,8 @@ Add a _Generic OpenID Connect / OAuth2_ strategy and take note of the _Callback ## authentik configuration + + To support the integration of Wiki.js with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -44,7 +48,7 @@ To support the integration of Wiki.js with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://wiki.company/login/id-from-wiki/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wiki.company/login/id-from-wiki/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/hypervisors-orchestrators/arcane/index.md b/website/integrations/hypervisors-orchestrators/arcane/index.md index c2ca0a3774..805f50c3b0 100644 --- a/website/integrations/hypervisors-orchestrators/arcane/index.md +++ b/website/integrations/hypervisors-orchestrators/arcane/index.md @@ -4,6 +4,8 @@ sidebar_label: Arcane support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Arcane? > Modern Docker Management, Designed for Everyone. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Arcane with authentik, you need to create an application/provider pair in authentik. ### Create custom scope mapping @@ -53,7 +57,7 @@ Arcane either requires the email scope to return a `true` value for whether the - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://arcane.company/auth/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://arcane.company/auth/oidc/callback`. - Select any available signing key. - Under **Advanced protocol settings**: - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope, and add the custom scope mapping you created above. diff --git a/website/integrations/hypervisors-orchestrators/portainer/index.md b/website/integrations/hypervisors-orchestrators/portainer/index.md index be6161989c..8e43594255 100644 --- a/website/integrations/hypervisors-orchestrators/portainer/index.md +++ b/website/integrations/hypervisors-orchestrators/portainer/index.md @@ -4,6 +4,8 @@ sidebar_label: Portainer support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Portainer? > Portainer is a powerful, GUI-based Container-as-a-Service solution that helps organizations manage and deploy cloud-native applications easily and securely. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Portainer with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Portainer with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://portainer.company/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://portainer.company/`. - Select any available signing key. - Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: OpenID 'entitlements'`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/hypervisors-orchestrators/proxmox-ve/index.md b/website/integrations/hypervisors-orchestrators/proxmox-ve/index.md index a9506d099f..b388bb87ad 100644 --- a/website/integrations/hypervisors-orchestrators/proxmox-ve/index.md +++ b/website/integrations/hypervisors-orchestrators/proxmox-ve/index.md @@ -4,6 +4,8 @@ sidebar_label: Proxmox VE support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Proxmox VE? > Proxmox Virtual Environment is an open source server virtualization management solution based on QEMU/KVM and LXC. You can manage virtual machines, containers, highly available clusters, storage, and networks with an integrated, easy-to-use web interface or via CLI. Proxmox VE code is licensed under the GNU Affero General Public License, version 3. The project is developed and maintained by Proxmox Server Solutions GmbH. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Proxmox with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Proxmox with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://proxmox.company:8006`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://proxmox.company:8006`. - Select any available signing key. - Ensure that encryption is disabled. - Under **Advanced protocol settings**: diff --git a/website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.md b/website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.md index eaff37aad4..c969104797 100644 --- a/website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.md +++ b/website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.md @@ -4,6 +4,8 @@ sidebar_label: VMware Cloud Director support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is VMware Cloud Director? > VMware Cloud Director is a platform that enables service providers and enterprises to create multi-tenant virtual data centers (VDCs) from underlying VMware vSphere infrastructure. It supports self-service resource provisioning, secure tenant isolation, and management of compute, storage, and networking via web portals and APIs. @@ -21,6 +23,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of VMware Cloud Director with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -31,7 +35,7 @@ To support the integration of VMware Cloud Director with authentik, you need to - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://clouddirector.company/login/oauth?service=provider`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://clouddirector.company/login/oauth?service=provider`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/flows-stages/bindings/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/hypervisors-orchestrators/vmware-vcenter/index.md b/website/integrations/hypervisors-orchestrators/vmware-vcenter/index.md index da00fb37bd..e4a44cab11 100644 --- a/website/integrations/hypervisors-orchestrators/vmware-vcenter/index.md +++ b/website/integrations/hypervisors-orchestrators/vmware-vcenter/index.md @@ -4,6 +4,8 @@ sidebar_label: VMware vCenter support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is vCenter? > vCenter Server is the centralized management utility for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location. VMware vMotion and svMotion require the use of vCenter and ESXi hosts. @@ -25,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of vCenter with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -36,7 +40,7 @@ To support the integration of vCenter with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://vcenter.company/ui/login/oauth2/authcode`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://vcenter.company/ui/login/oauth2/authcode`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/hypervisors-orchestrators/xen-orchestra/index.md b/website/integrations/hypervisors-orchestrators/xen-orchestra/index.md index e984d08396..4807639da1 100644 --- a/website/integrations/hypervisors-orchestrators/xen-orchestra/index.md +++ b/website/integrations/hypervisors-orchestrators/xen-orchestra/index.md @@ -4,6 +4,8 @@ sidebar_label: Xen Orchestra support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Xen Orchestra? > Xen Orchestra provides a user friendly web interface for every Xen based hypervisor (XenServer, xcp-ng, etc.). @@ -28,6 +30,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Xen Orchestra with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -39,7 +43,7 @@ To support the integration of Xen Orchestra with authentik, you need to create a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://xenorchestra.company/signin/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://xenorchestra.company/signin/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/apache-guacamole/index.mdx b/website/integrations/infrastructure/apache-guacamole/index.mdx index a91a85d647..be8e3ed55a 100644 --- a/website/integrations/infrastructure/apache-guacamole/index.mdx +++ b/website/integrations/infrastructure/apache-guacamole/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Apache Guacamole support_level: authentik --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -26,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Apache Guacamole with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -37,7 +40,7 @@ To support the integration of Apache Guacamole with authentik, you need to creat - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://guacamole.company/`. If you have configured [Apache Tomcat](https://tomcat.apache.org/) to run Apache Guacamole on a subpath, you will need to update this value accordingly. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://guacamole.company/`. If you have configured [Apache Tomcat](https://tomcat.apache.org/) to run Apache Guacamole on a subpath, you will need to update this value accordingly. - Select any available signing key. - Note that Apache Guacamole does not support session tokens longer than 300 minutes (5 hours). - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/argocd/index.md b/website/integrations/infrastructure/argocd/index.md index ae576f176d..6c201276c3 100644 --- a/website/integrations/infrastructure/argocd/index.md +++ b/website/integrations/infrastructure/argocd/index.md @@ -4,6 +4,8 @@ sidebar_label: ArgoCD support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is ArgoCD? > Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of ArgoCD with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of ArgoCD with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Add two `Strict` redirect URI and set them to `https://argocd.company/api/dex/callback` and `https://localhost:8085/auth/callback`. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://argocd.company/api/dex/callback` and `https://localhost:8085/auth/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/harbor/index.md b/website/integrations/infrastructure/harbor/index.md index cb18da1d9c..4d7ec76acc 100644 --- a/website/integrations/infrastructure/harbor/index.md +++ b/website/integrations/infrastructure/harbor/index.md @@ -4,6 +4,8 @@ sidebar_label: Harbor support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Harbor? > Harbor is an open source container image registry that secures images with role-based access control, scans images for vulnerabilities, and signs images as trusted. A CNCF Graduated project, Harbor delivers compliance, performance, and interoperability to help you consistently and securely manage images across cloud native compute platforms like Kubernetes and Docker. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Harbor with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -35,7 +39,7 @@ To support the integration of Harbor with authentik, you need to create an appli - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **Protocol Settings**: - **Redirect URI**: - - Strict: `https://harbor.company/c/oidc/callback`. + - `Strict` `Authorization`: `https://harbor.company/c/oidc/callback`. - **Signing Key**: select any available signing key. - **Advanced Protocol Settings**: - **Scopes**: add `authentik default OAuth Mapping: OpenID 'offline_access'` to **Selected Scopes**. diff --git a/website/integrations/infrastructure/iis/index.md b/website/integrations/infrastructure/iis/index.md new file mode 100644 index 0000000000..8a01c76fd5 --- /dev/null +++ b/website/integrations/infrastructure/iis/index.md @@ -0,0 +1,132 @@ +--- +title: Integrate with IIS +sidebar_label: IIS +support_level: community +--- + +import TabItem from "@theme/TabItem"; +import Tabs from "@theme/Tabs"; + +## What is IIS? + +> Internet Information Services (IIS) for Windows Server is a flexible, secure and manageable Web server for hosting anything on the Web. +> +> -- https://www.iis.net + +This guide uses authentik's proxy provider to protect an IIS-hosted site. + +## Preparation + +The following placeholders are used in this guide: + +- `iis.company` is the FQDN of the IIS site that users access. +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +## authentik configuration + +To support the integration of IIS with authentik, you need to create an application/provider pair in authentik and assign it to a proxy outpost. + +### Create an application and provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. + - **Choose a Provider type**: select **Proxy Provider** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Set **Mode** to **Proxy**. + - Set **External host** to `https://iis.company`. + - Set **Internal host** to the URL of the IIS backend site as reached by the authentik proxy outpost, such as `http://localhost:8080`. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. + +3. Click **Submit** to save the new application and provider. + +### Configure proxy outpost + +The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. + +Add the IIS application to a proxy outpost that will serve it: + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Outposts**. +3. Click the edit icon for the proxy outpost. +4. Under **Available Applications**, select the IIS application and move it to **Selected Applications**. +5. Click **Update** to save your changes. + +## IIS configuration + + + + +Use this option when the authentik proxy outpost should receive requests for `https://iis.company`. + +1. Configure DNS or your reverse proxy so that `iis.company` routes to the authentik proxy outpost. +2. Configure the IIS backend site so that it is reachable from the authentik proxy outpost at the **Internal host** URL. +3. If the IIS backend site runs on the same Windows server, use a separate binding or port for the backend site, such as `http://localhost:8080`. + +No SSO configuration is required in IIS for this option. The authentik proxy outpost authenticates the user before forwarding allowed requests to IIS. + + + + + +Use this option when IIS should receive requests for `https://iis.company` and forward them to the authentik proxy outpost. The authentik proxy outpost then forwards authenticated requests to the IIS backend site. + +:::warning ARR host header setting +`preserveHostHeader` is a server-level ARR setting. Review other IIS reverse proxy sites before changing it on a shared IIS server. +::: + +1. Install the IIS **URL Rewrite** module and **Application Request Routing**. +2. In IIS Manager, select the server node, open **Application Request Routing Cache**, click **Server Proxy Settings**, enable **Enable proxy**, and apply the change. +3. From an elevated Command Prompt, configure ARR to preserve the original host header and avoid rewriting response `Location` headers: + + ```cmd title="Administrator Command Prompt" + %windir%\System32\inetsrv\appcmd.exe set config -section:system.webServer/proxy /preserveHostHeader:"True" /reverseRewriteHostInResponseHeaders:"False" /commit:apphost + ``` + +4. Configure the public IIS site for `iis.company` to proxy requests to the authentik proxy outpost. + + If the site already has a `web.config` file, merge the `rewrite` section into the existing `system.webServer` section. + + ```xml title="web.config" + + + + + + + + + + + + + + ``` + + This example uses the outpost HTTP port. If the outpost uses HTTPS, use `https://authentik.company:9443/{R:1}`. + +5. Configure the IIS backend site so that it is reachable from the authentik proxy outpost at the **Internal host** URL. The backend site must use a different binding, hostname, or port than the public IIS reverse proxy site to avoid routing requests back to itself. + + + + +## Configuration verification + +To confirm that authentik is properly configured with IIS, open the IIS site. You should be redirected to authentik before the IIS site is shown. + +## Resources + +- [Microsoft IIS - Overview](https://www.iis.net/overview) +- [Microsoft Learn - IIS Web Server Overview](https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-web-server-overview) +- [Microsoft Learn - Install Application Request Routing Version 2](https://learn.microsoft.com/en-us/iis/extensions/installing-application-request-routing-arr/install-application-request-routing-version-2) +- [Microsoft Learn - Reverse Proxy with URL Rewrite v2 and Application Request Routing](https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/reverse-proxy-with-url-rewrite-v2-and-application-request-routing) +- [Microsoft Learn - ARR as generic proxy in Hotmail and SkyDrive](https://learn.microsoft.com/en-us/iis/extensions/configuring-application-request-routing-arr/arr-as-generic-proxy-in-hotmail-and-skydrive) diff --git a/website/integrations/infrastructure/keycloak/index.mdx b/website/integrations/infrastructure/keycloak/index.mdx index df90fb72c6..b4ba14dc11 100644 --- a/website/integrations/infrastructure/keycloak/index.mdx +++ b/website/integrations/infrastructure/keycloak/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Keycloak support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -39,6 +40,8 @@ Keycloak can be configured to use either OIDC or SAML for federated login source ## authentik configuration + + To support the integration of Keycloak with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -49,7 +52,7 @@ To support the integration of Keycloak with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://keycloak.company/access/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://keycloak.company/access/oidc/callback`. - Set the **Logout URI** to `https://keycloak.company/realms//protocol/openid-connect/logout/backchannel-logout`. - Set the **Logout Method** to `Back-channel`. - Select any available signing key. diff --git a/website/integrations/infrastructure/komodo/index.mdx b/website/integrations/infrastructure/komodo/index.mdx index de4d83794a..a8abba5089 100644 --- a/website/integrations/infrastructure/komodo/index.mdx +++ b/website/integrations/infrastructure/komodo/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Komodo support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Komodo? > Komodo is a web-based application designed to organize and streamline the management of servers, builds, deployments, and automated tasks. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Komodo with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Komodo with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://komodo.company/auth/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://komodo.company/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. - **Configure Launch URL** _(optional)_: set to `https://komodo.company/auth/oidc/login`. diff --git a/website/integrations/infrastructure/minio/index.mdx b/website/integrations/infrastructure/minio/index.mdx index a82346f0c7..e53fc9e4d7 100644 --- a/website/integrations/infrastructure/minio/index.mdx +++ b/website/integrations/infrastructure/minio/index.mdx @@ -4,6 +4,7 @@ sidebar_label: MinIO support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -30,6 +31,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of MinIO with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -40,7 +43,7 @@ To support the integration of MinIO with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://minio.company/oauth_callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://minio.company/oauth_callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/nexterm/index.md b/website/integrations/infrastructure/nexterm/index.md index ab4e0eb326..7a5284b1f3 100644 --- a/website/integrations/infrastructure/nexterm/index.md +++ b/website/integrations/infrastructure/nexterm/index.md @@ -4,6 +4,8 @@ sidebar_label: Nexterm support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Nexterm? > Nexterm is an open-source server management platform for SSH, VNC, and RDP. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Nexterm with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Nexterm with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://nexterm.company/api/auth/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://nexterm.company/api/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/osticket/index.md b/website/integrations/infrastructure/osticket/index.md index 57f6f202b1..e1a5976301 100644 --- a/website/integrations/infrastructure/osticket/index.md +++ b/website/integrations/infrastructure/osticket/index.md @@ -4,6 +4,8 @@ sidebar_label: osTicket support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is osTicket? > osTicket is a web-based, open source user support/ticketing solution. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of osTicket with authentik, you need to create an application/provider pair in authentik. 1. Log in to authentik as an administrator and open the authentik Admin interface. @@ -31,7 +35,7 @@ To support the integration of osTicket with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret** and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://osticket.company/osticket/api/auth/oauth2`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://osticket.company/osticket/api/auth/oauth2`. - Select any available signing key. - Under **Advanced protocol settings**: - **Subject Mode**: `Based on the User's Email` diff --git a/website/integrations/infrastructure/pgadmin/index.md b/website/integrations/infrastructure/pgadmin/index.md index ff0e1fb1fe..8f63db21c0 100644 --- a/website/integrations/infrastructure/pgadmin/index.md +++ b/website/integrations/infrastructure/pgadmin/index.md @@ -4,6 +4,8 @@ sidebar_label: pgAdmin support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is pgAdmin? > pgAdmin is a management tool for PostgreSQL and derivative relational databases such as EnterpriseDB's EDB Advanced Server. It may be run either as a web or desktop application. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of pgAdmin with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -37,7 +41,7 @@ To support the integration of pgAdmin with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://pgadmin.company/oauth2/authorize`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://pgadmin.company/oauth2/authorize`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/plesk/index.md b/website/integrations/infrastructure/plesk/index.md index 9a261458a7..54d57cd237 100644 --- a/website/integrations/infrastructure/plesk/index.md +++ b/website/integrations/infrastructure/plesk/index.md @@ -4,6 +4,8 @@ sidebar_label: Plesk support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Plesk? > Plesk is a web hosting platform with a control panel that helps manage servers, applications, and websites through a comprehensive graphical user interface. It provides tools for web professionals, IT administrators, and hosting companies to simplify the process of hosting and managing websites. @@ -27,6 +29,8 @@ Replace these placeholders in the guide with your values: ## authentik configuration + + To support the integration of Plesk with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Plesk with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://plesk.company/modules/oauth/public/login.php`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://plesk.company/modules/oauth/public/login.php`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/rabbitmq/index.mdx b/website/integrations/infrastructure/rabbitmq/index.mdx index 5b10602f2b..cf4d6d9b25 100644 --- a/website/integrations/infrastructure/rabbitmq/index.mdx +++ b/website/integrations/infrastructure/rabbitmq/index.mdx @@ -4,6 +4,7 @@ sidebar_label: RabbitMQ support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -28,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of RabbitMQ with authentik, you need to create a property mapping, two user groups, and an application/provider pair. ### Create a property mapping @@ -66,7 +69,7 @@ After creating the groups, select a group, navigate to the **Users** tab, and ma - Set **Client Type** to **Public**. - Note the **Client ID** and **slug** values because they will be required later. - Under **Grant Types**, select **Authorization Code** and **Client credentials**. - - Set a `Strict` redirect URI to `https://rabbitmq.company:15672/js/oidc-oauth/login-callback.html`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://rabbitmq.company:15672/js/oidc-oauth/login-callback.html`. - Select any available signing key. - Under **Advanced protocol settings**: - Add the `RabbitMQ claims` scope that you created in the previous section to **Selected Scopes**. diff --git a/website/integrations/infrastructure/rustdesk-pro/index.mdx b/website/integrations/infrastructure/rustdesk-pro/index.mdx index f50a6e2052..4aef8bb2ce 100644 --- a/website/integrations/infrastructure/rustdesk-pro/index.mdx +++ b/website/integrations/infrastructure/rustdesk-pro/index.mdx @@ -4,6 +4,8 @@ sidebar_label: RustDesk Server Pro support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is RustDesk Server Pro? > RustDesk Server Pro is a premium self-hosted solution for managing remote desktop connections securely and efficiently. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Rustdesk Server Pro with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Rustdesk Server Pro with authentik, you need to cr - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://rustdesk.company/api/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://rustdesk.company/api/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/semaphore/index.mdx b/website/integrations/infrastructure/semaphore/index.mdx index e2e7f7117a..4ffdeb8337 100644 --- a/website/integrations/infrastructure/semaphore/index.mdx +++ b/website/integrations/infrastructure/semaphore/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Semaphore support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Semaphore UI? > Semaphore UI is a modern web interface for managing popular DevOps tools. @@ -25,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Semaphore with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -35,7 +39,7 @@ To support the integration of Semaphore with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://semaphore.company/api/auth/oidc/authentik/redirect`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://semaphore.company/api/auth/oidc/authentik/redirect`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/synology-dsm/index.md b/website/integrations/infrastructure/synology-dsm/index.md index b3d9fe326a..c5811b0909 100644 --- a/website/integrations/infrastructure/synology-dsm/index.md +++ b/website/integrations/infrastructure/synology-dsm/index.md @@ -4,6 +4,8 @@ sidebar_label: Synology DSM (DiskStation Manager) support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Synology DSM? > Synology Inc. is a Taiwanese corporation that specializes in network-attached storage (NAS) appliances. Synology's line of NAS is known as the DiskStation for desktop models, FlashStation for all-flash models, and RackStation for rack-mount models. Synology's products are distributed worldwide and localized in several languages. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Synology DSM with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Synology DSM with authentik, you need to create an - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://synology.company`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://synology.company`. - Select any available signing key. - Under **Advanced protocol settings**, set the **subject mode** to be based on the user's email. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/termix/index.mdx b/website/integrations/infrastructure/termix/index.mdx index 5db31fb6ce..4eac67e7a4 100644 --- a/website/integrations/infrastructure/termix/index.mdx +++ b/website/integrations/infrastructure/termix/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Termix support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Termix? > Termix is a clientless web-based server management platform with SSH terminal, tunneling, and file editing capabilities. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Termix with authentik, you need to create an application/provider pair in authentik. 1. Log in to authentik as an administrator and open the authentik Admin interface. @@ -31,7 +35,7 @@ To support the integration of Termix with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://termix.company/users/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://termix.company/users/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/terrakube/index.md b/website/integrations/infrastructure/terrakube/index.md index 10f7a4f35a..b10aba8f25 100644 --- a/website/integrations/infrastructure/terrakube/index.md +++ b/website/integrations/infrastructure/terrakube/index.md @@ -4,6 +4,8 @@ sidebar_label: Terrakube support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Terrakube? > Terrakube is an open-source collaboration platform designed for managing remote Infrastructure-as-Code (IaC) operations with Terraform. It serves as an alternative to proprietary tools like Terraform Enterprise. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Terrakube with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Terrakube with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://terrakube-dex.company/dex/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://terrakube-dex.company/dex/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/zammad/index.md b/website/integrations/infrastructure/zammad/index.md index 6cc586b61d..13788cac5c 100644 --- a/website/integrations/infrastructure/zammad/index.md +++ b/website/integrations/infrastructure/zammad/index.md @@ -4,6 +4,7 @@ sidebar_label: Zammad support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../\_saml-provider-2026-5-warning.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -40,6 +41,8 @@ values={[ ## authentik configuration + + To support the integration of Zammad with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -102,7 +105,7 @@ To support the integration of Zammad with authentik, you need to create an appli - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **Client type** to `Public`. - Take note of the **Client ID** and **slug** values because they will be required later. - - Set the **Redirect URIs/Origins** to `Strict` / `https://zammad.company/auth/openid_connect/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://zammad.company/auth/openid_connect/callback`. - Select a **Signing Key**. - Under **Advanced protocol settings**, set **Subject mode** to **Based on the User's Email**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/zendesk/index.mdx b/website/integrations/infrastructure/zendesk/index.mdx index 2ea808ab58..3897cc8bd6 100644 --- a/website/integrations/infrastructure/zendesk/index.mdx +++ b/website/integrations/infrastructure/zendesk/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Zendesk support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -38,6 +39,8 @@ Zendesk can be configured to use either OIDC or SAML. This guide covers both met ## authentik configuration + + To support the integration of Zendesk with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -48,7 +51,7 @@ To support the integration of Zendesk with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://company.zendesk.com/access/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://company.zendesk.com/access/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/infrastructure/zot/index.md b/website/integrations/infrastructure/zot/index.md index 4c6b0945be..3c8f47151d 100644 --- a/website/integrations/infrastructure/zot/index.md +++ b/website/integrations/infrastructure/zot/index.md @@ -4,6 +4,8 @@ sidebar_label: Zot support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Zot? > Zot is an OCI-native container registry for distributing container images and OCI artifacts. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Zot with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -35,11 +39,9 @@ To support the integration of Zot with authentik, you need to create an applicat - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **Protocol Settings**: - **Redirect URI**: - - Strict: `https://zot.company/zot/auth/callback/oidc`. + - `Strict` `Authorization`: `https://zot.company/zot/auth/callback/oidc`. - **Signing Key**: select any available signing key. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://zot.company/zot/auth/callback/oidc`. - - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. diff --git a/website/integrations/learning/absorb-lms/index.mdx b/website/integrations/learning/absorb-lms/index.mdx index 2445d92fd1..f29b7e71fc 100644 --- a/website/integrations/learning/absorb-lms/index.mdx +++ b/website/integrations/learning/absorb-lms/index.mdx @@ -5,6 +5,7 @@ support_level: community authentik_version: 2026.5 --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -39,6 +40,8 @@ values={[ ## authentik configuration + + To integrate authentik with Absorb LMS via OIDC, you will need to create an application and provider pair in authentik. ### Create an application and provider in authentik @@ -49,7 +52,7 @@ To integrate authentik with Absorb LMS via OIDC, you will need to create an appl - **Choose a Provider type**: select **OAuth2/OIDC Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Take note of the **Client ID** and **Client Secret** values as these will be required in the next section. - - Set a `Strict` Redirect URI to `https://company.myabsorb.com/account/openidconnect` + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://company.myabsorb.com/account/openidconnect` - Select any available **Signing key**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications in a user's **Application Dashboard**. diff --git a/website/integrations/media/audiobookshelf/index.md b/website/integrations/media/audiobookshelf/index.md index eb85cec8c3..0918f4713b 100644 --- a/website/integrations/media/audiobookshelf/index.md +++ b/website/integrations/media/audiobookshelf/index.md @@ -4,6 +4,8 @@ sidebar_label: Audiobookshelf support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Audiobookshelf? > Audiobookshelf is a self-hosted audiobook and podcast server. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Audiobookshelf with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,9 +37,10 @@ To support the integration of Audiobookshelf with authentik, you need to create - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Add two `Strict` redirect URIs: - - `https://audiobookshelf.company/auth/openid/callback` - - `https://audiobookshelf.company/auth/openid/mobile-redirect` + - Add three **Redirect URIs**: + - `Strict` `Authorization` `https://audiobookshelf.company/auth/openid/callback` + - `Strict` `Authorization` `https://audiobookshelf.company/auth/openid/mobile-redirect` + - `Strict` `Post Logout` `https://audiobookshelf.company/login` - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. @@ -53,6 +58,7 @@ To support the integration of Audiobookshelf with authentik, you need to create - **Token URL**: `https://authentik.company/application/o/token/` - **User Info URL**: `https://authentik.company/application/o/userinfo/` - **JWKS URL**: `https://authentik.company/application/o//jwks/` + - **Logout URL**: `https://auth.yoursite.com/application/o//end-session/` - **Signing Algorithm**: `RS256` - **Allow Mobile Redirect URLs**: `https://audiobookshelf.company/auth/openid/mobile-redirect` - **Match existing users by**: `username` diff --git a/website/integrations/media/freshrss/index.mdx b/website/integrations/media/freshrss/index.mdx index ebc10d11f8..9945828a29 100644 --- a/website/integrations/media/freshrss/index.mdx +++ b/website/integrations/media/freshrss/index.mdx @@ -4,6 +4,8 @@ sidebar_label: FreshRSS support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is FreshRSS? > FreshRSS is a self-hosted RSS feed aggregator. @@ -23,6 +25,8 @@ This documentation only lists the settings that have been changed from their def ## authentik configuration + + To support the integration of FreshRSS with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of FreshRSS with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Add two `Strict` redirect URIs and set them to `https://freshrss.company/i/oidc/` and `https://freshrss.company:443/i/oidc/`. If FreshRSS is exposed on a port other than `443`, update the second redirect URI accordingly. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://freshrss.company/i/oidc/` and `https://freshrss.company:443/i/oidc/`. If FreshRSS is exposed on a port other than `443`, update the second redirect URI accordingly. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/media/immich/index.md b/website/integrations/media/immich/index.md index 9668fc947c..c8212d7fb1 100644 --- a/website/integrations/media/immich/index.md +++ b/website/integrations/media/immich/index.md @@ -4,6 +4,8 @@ sidebar_label: Immich support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Immich? > Immich is a self-hosted backup solution for photos and videos on mobile devices. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Immich with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Immich with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Add three `Strict` redirect URIs and set them to `app.immich:///oauth-callback`, `https://immich.company/auth/login`, and `https://immich.company/user-settings`. + - Add three **Redirect URIs** of type `Strict` `Authorization` as `app.immich:///oauth-callback`, `https://immich.company/auth/login`, and `https://immich.company/user-settings`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. - **Configure Launch URL** _(optional)_: set the [Launch URL](/docs/add-secure-apps/applications/#appearance) to `https://immich.company/auth/login?autoLaunch=1` to allow automatic login to Immich when clicking the application from within authentik. diff --git a/website/integrations/media/jellyfin/index.md b/website/integrations/media/jellyfin/index.md index f0252d06fd..815be053f5 100644 --- a/website/integrations/media/jellyfin/index.md +++ b/website/integrations/media/jellyfin/index.md @@ -4,6 +4,8 @@ sidebar_label: Jellyfin support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Jellyfin? > Jellyfin is a free and open source media management and streaming platform for movies, TV shows, and music. @@ -95,6 +97,8 @@ At this point, enter a username and click **Save Search Attribute Settings and Q ## OIDC configuration + + ### authentik configuration **Provider Settings** @@ -102,7 +106,7 @@ At this point, enter a username and click **Save Search Attribute Settings and Q In authentik under **Providers**, create an OAuth2/OpenID Provider with these settings: - Name: `jellyfin` -- Redirect URI: `https://jellyfin.company/sso/OID/redirect/authentik` +- **Redirect URI**: `Strict` `Authorization` `https://jellyfin.company/sso/OID/redirect/authentik` Everything else is up to you, just make sure to grab the client ID and the client secret! diff --git a/website/integrations/media/kavita/index.md b/website/integrations/media/kavita/index.md new file mode 100644 index 0000000000..84854af511 --- /dev/null +++ b/website/integrations/media/kavita/index.md @@ -0,0 +1,65 @@ +--- +title: Integrate with Kavita +sidebar_label: Kavita +support_level: community +--- + +## What is Kavita? + +> Kavita is a self-hosted digital library and reading server for manga, comics, books, and other digital media, with support for organizing collections and reading in the browser. +> +> -- https://www.kavitareader.com/ + +## Preparation + +The following placeholders are used in this guide: + +- `kavita.company` is the FQDN of the Kavita installation. +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +## authentik configuration + +To support the integration of Kavita with authentik, you need to create an application/provider pair in authentik. + +### Create an application and provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. + - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://kavita.company/signin-oidc` + - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://kavita.company/signout-callback-oidc` + - **Logout URI**: `https://kavita.company/signout-oidc` + - **Logout Method**: `Front-channel` + - Select any available signing key. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. + +3. Click **Submit** to save the new application and provider. + +## Kavita configuration + +1. Log in to Kavita as an administrator. +2. Navigate to **Settings** > **OpenID Connect**. +3. Configure the following settings: + - **Authority**: `https://authentik.company/application/o//` + - **Client Id**: enter the Client ID from authentik. + - **Secret**: enter the Client Secret from authentik. + - **Provision Accounts**: enable this setting to automatically create Kavita accounts for users who log in through authentik. + - **Require Verified Emails**: disable this setting. +4. Click **Save**. + +Restart your Kavita instance for these changes to take effect. + +## Configuration verification + +To confirm that authentik is properly configured with Kavita, log out of Kavita and then log back in using the **Login with SSO** option. You should be redirected to authentik for authentication and then redirected back to Kavita as a logged-in user. + +## Resources + +- [Kavita OpenID Connect documentation](https://wiki.kavitareader.com/guides/admin-settings/open-id-connect/) diff --git a/website/integrations/media/komga/index.md b/website/integrations/media/komga/index.md index 10ed952c3c..27cb7f3cc0 100644 --- a/website/integrations/media/komga/index.md +++ b/website/integrations/media/komga/index.md @@ -4,6 +4,8 @@ sidebar_label: Komga support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Komga? > Komga is an open-source comic and manga server that lets users organize, read, and stream their digital comic collections with ease. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Komga with authentik, you need to create an application/provider pair in authentik. ### Create an email verification scope mapping in authentik @@ -40,7 +44,7 @@ Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/index - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://komga.company/login/oauth2/code/authentik`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://komga.company/login/oauth2/code/authentik`. - Select any available signing key. - **Advanced protocol settings** > **Scopes**: - Add `OAuth Mapping: OpenID 'email' with "email_verified"` to the **Selected Scopes**. diff --git a/website/integrations/media/miniflux/index.md b/website/integrations/media/miniflux/index.md index 9bea7a0a77..97f98adf79 100644 --- a/website/integrations/media/miniflux/index.md +++ b/website/integrations/media/miniflux/index.md @@ -4,6 +4,8 @@ sidebar_label: Miniflux support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Miniflux? > Miniflux is a minimalist and opinionated RSS feed reader. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Miniflux with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Miniflux with authentik, you need to create an app - **Choose a Provider type**: Select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://miniflux.company/oauth2/oidc/callback` + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://miniflux.company/oauth2/oidc/callback` - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/media/photoprism/index.md b/website/integrations/media/photoprism/index.md index 9857859d1e..287fb75624 100644 --- a/website/integrations/media/photoprism/index.md +++ b/website/integrations/media/photoprism/index.md @@ -4,6 +4,8 @@ sidebar_label: PhotoPrism support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is PhotoPrism? > PhotoPrism is an AI-powered photos app that lets you browse, organize, and find photos and videos on a home server, private server, or in the cloud. @@ -27,6 +29,8 @@ PhotoPrism requires HTTPS for OpenID Connect (OIDC). Make sure that the `PHOTOPR ## authentik configuration + + To support the integration of PhotoPrism with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -37,7 +41,7 @@ To support the integration of PhotoPrism with authentik, you need to create an a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Add one `Strict` redirect URI and set it to `https://photoprism.company/api/v1/oidc/redirect`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://photoprism.company/api/v1/oidc/redirect`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/media/seafile/index.md b/website/integrations/media/seafile/index.md index 67e2e2dec9..4b5e99fbfd 100644 --- a/website/integrations/media/seafile/index.md +++ b/website/integrations/media/seafile/index.md @@ -4,6 +4,8 @@ sidebar_label: Seafile support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Seafile? > Seafile is an open-source, cross-platform file-hosting software system. Files are stored on a central server and can be synchronized with personal computers and mobile devices through apps. Files on the Seafile server can also be accessed directly via the server's web interface. @@ -22,6 +24,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Seafile with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -32,7 +36,7 @@ To support the integration of Seafile with authentik, you need to create an appl - **Choose a Provider type**: select OAuth2/OpenID Connect as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://seafile.company/oauth/callback/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://seafile.company/oauth/callback/`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. diff --git a/website/integrations/media/seerr/index.md b/website/integrations/media/seerr/index.md index f6e1cc3a35..74a2a527a6 100644 --- a/website/integrations/media/seerr/index.md +++ b/website/integrations/media/seerr/index.md @@ -4,6 +4,8 @@ sidebar_label: Seerr support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Seerr? > Seerr (previously Jellyseerr) is a free and open source application for managing requests in your media library. It integrates with media servers like Jellyfin, Plex, and Emby, and services such as Sonarr and Radarr. @@ -17,6 +19,8 @@ support_level: community ## authentik configuration + + To support the integration of Seerr with authentik, you need to create an application/provider pair in authentik. 1. Log in to authentik as an administrator and open the authentik Admin interface. @@ -25,7 +29,7 @@ To support the integration of Seerr with authentik, you need to create an applic - **Choose a Provider type**: OAuth2/OpenID - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and any required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://seerr.company/login`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://seerr.company/login`. - Select any available signing key. - **Configure Bindings** _(optional):_ you can create a [binding](https://docs.goauthentik.io/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user’s **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/actual-budget/index.mdx b/website/integrations/miscellaneous/actual-budget/index.mdx index 1ecc595a90..f04328b09c 100644 --- a/website/integrations/miscellaneous/actual-budget/index.mdx +++ b/website/integrations/miscellaneous/actual-budget/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Actual Budget support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -26,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Actual Budget with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -36,7 +39,7 @@ To support the integration of Actual Budget with authentik, you need to create a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://actual.company/openid/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://actual.company/openid/callback`. - Select any available signing key. Actual Budget only supports the RS256 algorithm. Be aware of this when choosing a signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/adventurelog/index.mdx b/website/integrations/miscellaneous/adventurelog/index.mdx index a599de2c8a..b81f0afc60 100644 --- a/website/integrations/miscellaneous/adventurelog/index.mdx +++ b/website/integrations/miscellaneous/adventurelog/index.mdx @@ -4,6 +4,8 @@ sidebar_label: AdventureLog support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is AdventureLog? > AdventureLog is a self-hosted travel tracker and trip planner. AdventureLog is the ultimate travel companion for the modern-day explorer. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of AdventureLog with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of AdventureLog with authentik, you need to create an - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Regex` redirect URI to `^https://adventurelog.company/accounts/oidc/.\*$`. + - Add a **Redirect URI** of type `Regex` `Authorization` as `^https://adventurelog.company/accounts/oidc/.\*$`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/ezbookkeeping/index.mdx b/website/integrations/miscellaneous/ezbookkeeping/index.mdx index d16aaf1c2b..fd98dbd539 100644 --- a/website/integrations/miscellaneous/ezbookkeeping/index.mdx +++ b/website/integrations/miscellaneous/ezbookkeeping/index.mdx @@ -4,6 +4,7 @@ sidebar_label: ezBookkeeping support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -26,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of ezBookkeeping with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -36,7 +39,7 @@ To support the integration of ezBookkeeping with authentik, you need to create a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://ezbookkeeping.company/oauth2/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://ezbookkeeping.company/oauth2/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/filerise/index.mdx b/website/integrations/miscellaneous/filerise/index.mdx index 0311d22e73..783d388e57 100644 --- a/website/integrations/miscellaneous/filerise/index.mdx +++ b/website/integrations/miscellaneous/filerise/index.mdx @@ -4,6 +4,8 @@ sidebar_label: FileRise support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is FileRise? > Lightweight, self-hosted web-based file manager with multi-file upload, editing, and batch operations. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of FileRise with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of FileRise with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set **Redirect URI** to `https://filerise.company/api/auth/auth.php?oidc=callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://filerise.company/api/auth/auth.php?oidc=callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/home-assistant/index.md b/website/integrations/miscellaneous/home-assistant/index.md index 6ea250576a..f7d6e83d4c 100644 --- a/website/integrations/miscellaneous/home-assistant/index.md +++ b/website/integrations/miscellaneous/home-assistant/index.md @@ -4,6 +4,8 @@ sidebar_label: Home Assistant support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Home Assistant? @@ -47,6 +49,8 @@ values={[ ## authentik configuration + + To support the integration of Home Assistant with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -58,7 +62,7 @@ To support the integration of Home Assistant with authentik, you need to create - Choose a **Provider Type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://hass.company/auth/openid/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hass.company/auth/openid/callback`. - Select any available signing key (to use the RS256 `id_token_signing_alg`) - Configure Bindings (optional): you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. @@ -109,7 +113,7 @@ To support the integration of Home Assistant with authentik, you need to create - Choose a **Provider Type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://hass.company/auth/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hass.company/auth/oidc/callback`. - Select any available signing key (to use the RS256 `id_token_signing_alg`) - Configure Bindings (optional): you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/open-webui/index.md b/website/integrations/miscellaneous/open-webui/index.md index a5dfbc91f9..c5ceb67eaa 100644 --- a/website/integrations/miscellaneous/open-webui/index.md +++ b/website/integrations/miscellaneous/open-webui/index.md @@ -4,6 +4,8 @@ sidebar_label: Open WebUI support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Open WebUI? > Open WebUI is a simple, self-hosted AI platform that works entirely offline. It supports tools like Ollama and OpenAI-style APIs and has a built-in engine for RAG tasks. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Open WebUI with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Open WebUI with authentik, you need to create an a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://openwebui.company/oauth/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://openwebui.company/oauth/oidc/callback`. - Select any available signing key. - Make sure to leave the **Encryption Key** field empty. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/wallos/index.mdx b/website/integrations/miscellaneous/wallos/index.mdx index b24f151b0e..7606385b16 100644 --- a/website/integrations/miscellaneous/wallos/index.mdx +++ b/website/integrations/miscellaneous/wallos/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Wallos support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Wallos? > Wallos is a self-hosted subscription and budget planning application. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Wallos with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Wallos with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://wallos.company/index.php`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wallos.company/index.php`. - Select any available signing key. - **Configure Bindings** (optional): you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/miscellaneous/zipline/index.md b/website/integrations/miscellaneous/zipline/index.md index 38f1e5997f..814477df42 100644 --- a/website/integrations/miscellaneous/zipline/index.md +++ b/website/integrations/miscellaneous/zipline/index.md @@ -4,6 +4,8 @@ sidebar_label: Zipline support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Zipline? > Zipline is a self-hostable file upload server designed for easy file sharing, supporting tools like ShareX and Flameshot, with features such as simplified setup and extensive customization options. @@ -27,6 +29,8 @@ This guide is compatible with Zipline [version `v4.0.0`](https://github.com/dice ## authentik configuration + + To support the integration of Zipline with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Zipline with authentik, you need to create an appl - **Choose a Provider type**: Select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: Provide a name (or accept the auto-provided name), choose the authorization flow for this provider, and configure the following required settings: - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://zipline.company/api/auth/oauth/oidc`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://zipline.company/api/auth/oauth/oidc`. - Select any available signing key. - Under **Advanced protocol settings** > **Scopes**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to the **Selected Scopes** list. - **Configure Bindings** _(optional)_: Create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/beszel/index.mdx b/website/integrations/monitoring/beszel/index.mdx index e7a3c01b8c..ebe9f916cc 100644 --- a/website/integrations/monitoring/beszel/index.mdx +++ b/website/integrations/monitoring/beszel/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Beszel support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Beszel? > Beszel is a lightweight server monitoring platform that provides Docker statistics, historical data, and configurable alerts. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + The steps to configure authentik include creating an email verification scope mapping, creating an application and provider pair in authentik, obtaining the Client ID and Client Secret values, setting the redirect URI, and selecting a signing key. ### Create an email verification scope mapping in authentik @@ -44,7 +48,7 @@ Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/index - **Choose a Provider type**: OAuth2/OpenID - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and any required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://beszel.company/api/oauth2-redirect`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://beszel.company/api/oauth2-redirect`. - Select any available signing key. - **Advanced protocol settings** > **Scopes**: - Add `OAuth Mapping: OpenID 'email' with "email_verified"` to the **Selected Scopes**. diff --git a/website/integrations/monitoring/chronograf/index.mdx b/website/integrations/monitoring/chronograf/index.mdx index e8d7bc2f6c..5ed04465f5 100644 --- a/website/integrations/monitoring/chronograf/index.mdx +++ b/website/integrations/monitoring/chronograf/index.mdx @@ -3,6 +3,8 @@ title: Integrate with Chronograf sidebar_label: Chronograf --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Chronograf? > Chronograf lets you quickly visualize the data stored in InfluxDB, enabling you to build robust queries and alerts. It is simple to use and comes with templates and libraries for rapidly creating dashboards with real-time data visualizations. @@ -22,6 +24,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Chronograf with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Chronograf with authentik, you need to create an a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://chronograf.company/oauth/authentik/callback/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://chronograf.company/oauth/authentik/callback/`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/dozzle/index.md b/website/integrations/monitoring/dozzle/index.md new file mode 100644 index 0000000000..97103068ce --- /dev/null +++ b/website/integrations/monitoring/dozzle/index.md @@ -0,0 +1,81 @@ +--- +title: Integrate with Dozzle +sidebar_label: Dozzle +support_level: community +--- + +## What is Dozzle? + +> Dozzle is a lightweight, web-based log viewer designed to simplify monitoring and debugging containerized applications across Docker, Docker Swarm, and Kubernetes environments. +> +> -- https://dozzle.dev/guide/what-is-dozzle + +Dozzle supports forward-proxy authentication. Use authentik as a forward auth proxy in front of Dozzle, and configure Dozzle to read the authenticated user details from the proxy headers set by authentik. + +## Preparation + +The following placeholders are used in this guide: + +- `dozzle.company` is the FQDN of the Dozzle installation. +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +:::warning Protect Docker access +Dozzle can access the Docker API through the mounted Docker socket. Only expose Dozzle behind authentication, and keep Dozzle actions and shell access disabled unless you need them. +::: + +## authentik configuration + +To support the integration of Dozzle with authentik, you need to create an application/provider pair in authentik. This guide assumes that Dozzle is already deployed behind a reverse proxy that supports authentik forward auth. + +### Create an application and provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. + - **Choose a Provider type**: select **Proxy Provider** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Set **Mode** to **Forward auth (single application)**. + - Set **External host** to `https://dozzle.company`. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. + +3. Click **Submit** to save the new application and provider. + +### Configure proxy outpost + +The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. + +Add the Dozzle application to a proxy outpost that will serve it: + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Outposts**. +3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. +4. Under **Available Applications**, select the Dozzle application and move it to **Selected Applications**. +5. Click **Update** to save your changes. + +## Dozzle configuration + +Configure Dozzle to use the `forward-proxy` authentication provider. Add the following environment variables to your Dozzle configuration: + +```env title=".env" +DOZZLE_AUTH_PROVIDER=forward-proxy +DOZZLE_AUTH_HEADER_USER=X-Authentik-Username +DOZZLE_AUTH_HEADER_EMAIL=X-Authentik-Email +DOZZLE_AUTH_HEADER_NAME=X-Authentik-Name +DOZZLE_AUTH_LOGOUT_URL=https://dozzle.company/outpost.goauthentik.io/sign_out +``` + +Configure your reverse proxy to use the authentik outpost as the forward auth endpoint for `https://dozzle.company`. Requests to `/outpost.goauthentik.io` must be routed to the authentik outpost, and all other requests must be routed to Dozzle. + +After making these changes, restart Dozzle and reload your reverse proxy. + +## Configuration verification + +To verify the login flow, open Dozzle. You should be redirected to authentik before the Dozzle web interface is shown. + +## Resources + +- [Dozzle - What is Dozzle?](https://dozzle.dev/guide/what-is-dozzle) diff --git a/website/integrations/monitoring/gatus/index.mdx b/website/integrations/monitoring/gatus/index.mdx index 7a1b81b638..a4fe0a9362 100644 --- a/website/integrations/monitoring/gatus/index.mdx +++ b/website/integrations/monitoring/gatus/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Gatus support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Gatus? > Gatus is a developer-oriented health dashboard that gives you the ability to monitor your services using HTTP, ICMP, TCP, and even DNS queries as well as evaluate the result of said queries by using a list of conditions on values like the status code, the response time, the certificate expiration, the body and many others. The icing on top is that each of these health checks can be paired with alerting via Slack, Teams, PagerDuty, Discord, Twilio and many more. @@ -23,6 +25,8 @@ This documentation only lists the settings that have been changed from their def ## authentik configuration + + To support the integration of Gatus with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Gatus with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://gatus.company/authorization-code/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gatus.company/authorization-code/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/glitchtip/index.md b/website/integrations/monitoring/glitchtip/index.md index 0f05c9f64f..feb67a9e65 100644 --- a/website/integrations/monitoring/glitchtip/index.md +++ b/website/integrations/monitoring/glitchtip/index.md @@ -4,6 +4,8 @@ sidebar_label: Glitchtip support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Glitchtip? > Bugs are inevitable in web development. The important thing is to catch them when they appear. With GlitchTip, you can rest easy knowing that if your web app throws an error or goes down, you will be notified immediately. GlitchTip combines error tracking and uptime monitoring in one open-source package to keep you and your team fully up-to-date on the status of your projects. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Glitchtip with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Glitchtip with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://glitchtip.company/accounts/oidc/authentik/login/callback/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://glitchtip.company/accounts/oidc/authentik/login/callback/`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/grafana/index.mdx b/website/integrations/monitoring/grafana/index.mdx index 5fedbdaaf3..43596d0225 100644 --- a/website/integrations/monitoring/grafana/index.mdx +++ b/website/integrations/monitoring/grafana/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Grafana support_level: authentik --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Grafana? > Grafana is a multi-platform open source analytics and interactive visualization web application. It provides charts, graphs, and alerts for the web when connected to supported data sources, Grafana Enterprise version with additional capabilities is also available. It is expandable through a plug-in system. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Grafana with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Grafana with authentik, you need to create an appl - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://grafana.company/login/generic_oauth`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://grafana.company/login/generic_oauth`. - Set the Logout URI to `https://grafana.company/logout`. - Set the Logout Method to `Front-channel`. - Select any available signing key. diff --git a/website/integrations/monitoring/icinga/index.md b/website/integrations/monitoring/icinga/index.md index 06e29e3962..792b203e50 100644 --- a/website/integrations/monitoring/icinga/index.md +++ b/website/integrations/monitoring/icinga/index.md @@ -4,6 +4,8 @@ sidebar_label: Icinga Web 2 support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Icinga Web 2? > Icinga Web 2 is the next-generation web interface for the Icinga monitoring stack. It provides a flexible UI to view monitoring states, drill into problems, and integrate with the Icinga 2 backend. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Icinga Web 2 with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -37,7 +41,7 @@ To support the integration of Icinga Web 2 with authentik, you need to create an - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://icinga.company/icingaweb2/oidc/authentication/realm?name=authentik`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://icinga.company/icingaweb2/oidc/authentication/realm?name=authentik`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/observium/index.md b/website/integrations/monitoring/observium/index.md index 4b9e6381c3..d660c5854e 100644 --- a/website/integrations/monitoring/observium/index.md +++ b/website/integrations/monitoring/observium/index.md @@ -4,6 +4,8 @@ sidebar_label: Observium support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Observium? > Observium is a network monitoring and management platform that provides real-time insight into network health and performance. @@ -40,6 +42,8 @@ apt install ./libapache2-mod-auth-openidc_2.4.15.7-1.bookworm_amd64.deb ## authentik configuration + + To support the integration of Observium with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -51,7 +55,7 @@ To support the integration of Observium with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://observium.company/secure/redirect_uri`. Note that the Redirect URI can be anything, as long as it does not point to existing content. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://observium.company/secure/redirect_uri`. Note that the Redirect URI can be anything, as long as it does not point to existing content. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/pulse/index.md b/website/integrations/monitoring/pulse/index.md index c5ea687734..da36ce91ec 100644 --- a/website/integrations/monitoring/pulse/index.md +++ b/website/integrations/monitoring/pulse/index.md @@ -4,6 +4,8 @@ sidebar_label: Pulse support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Pulse? > Pulse is an open-source monitoring platform that provides real-time insight into Proxmox, Docker, and Kubernetes infrastructure. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Pulse with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Pulse with authentik, you need to create an applic - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://pulse.company/api/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://pulse.company/api/oidc/callback`. - Select any available signing key. - Under **Advanced protocol settings**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to the selected scopes if you want long-lived sessions backed by refresh tokens. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/ubuntu-landscape/index.md b/website/integrations/monitoring/ubuntu-landscape/index.md index f4161b36d9..d4e4deab7d 100644 --- a/website/integrations/monitoring/ubuntu-landscape/index.md +++ b/website/integrations/monitoring/ubuntu-landscape/index.md @@ -4,6 +4,8 @@ sidebar_label: Ubuntu Landscape support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Ubuntu Landscape? > Landscape is a systems management tool developed by Canonical. It can be run on-premises or in the cloud depending on the needs of the user. It is primarily designed for use with Ubuntu derivatives such as Desktop, Server, and Core. @@ -29,6 +31,8 @@ Landscape uses the OpenID Connect protocol for single sign-on. ## authentik configuration + + To support the integration of Landscape with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -40,7 +44,7 @@ To support the integration of Landscape with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://landscape.company/login/handle-openid`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://landscape.company/login/handle-openid`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/monitoring/wazuh/index.mdx b/website/integrations/monitoring/wazuh/index.mdx index 672d73f5a3..df1555b334 100644 --- a/website/integrations/monitoring/wazuh/index.mdx +++ b/website/integrations/monitoring/wazuh/index.mdx @@ -52,6 +52,12 @@ To support the integration of Wazuh with authentik, you need to create a group, ### Create an application and provider in authentik +:::warning SAML provider changes in authentik 2026.5 +authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` + +Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. +::: + 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) @@ -200,7 +206,7 @@ And the `metadata_file`, `kibana_url`, and `exchange_key` parameters in the `sam Click **Save role mapping** -4. On the Wazuh Dashboard server, add these lines to the `/etc/wazuh-dashboard/opensearch_dashboards.yml` file: +4. On the Wazuh Dashboard server, add these lines to the `/etc/wazuh-dashboard/opensearch_dashboards.yml` file. If the entry `opensearch_security.session.keepalive` already exists in your config, change it to `false`. ```yaml showLineNumbers opensearch_security.auth.type: "saml" @@ -213,6 +219,20 @@ And the `metadata_file`, `kibana_url`, and `exchange_key` parameters in the `sam opensearch_security.session.keepalive: false ``` + Use this config block if you want to use both authentication methods (username/password and SSO): + + ```yaml showLineNumbers + opensearch_security.auth.type: ["basicauth", "saml"] + opensearch_security.auth.multiple_auth_enabled: true + server.xsrf.allowlist: + [ + "/_opendistro/_security/saml/acs", + "/_opendistro/_security/saml/logout", + "/_opendistro/_security/saml/acs/idpinitiated", + ] + opensearch_security.session.keepalive: false + ``` + 5. Restart the Wazuh dashboard service using the following command: ```bash diff --git a/website/integrations/monitoring/whats-up-docker/index.md b/website/integrations/monitoring/whats-up-docker/index.md index ed47fd8a62..c85db5da6b 100644 --- a/website/integrations/monitoring/whats-up-docker/index.md +++ b/website/integrations/monitoring/whats-up-docker/index.md @@ -4,6 +4,8 @@ sidebar_label: What's Up Docker support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is What's Up Docker? > What's Up Docker (WUD) is an easy-to-use tool that alerts you whenever a new version of your Docker containers is released. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of What's Up Docker with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of What's Up Docker with authentik, you need to creat - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://wud.company/auth/oidc/authentik/cb`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wud.company/auth/oidc/authentik/cb`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/networking/firezone/index.md b/website/integrations/networking/firezone/index.md index 7209c8d314..0ed2e1bcfe 100644 --- a/website/integrations/networking/firezone/index.md +++ b/website/integrations/networking/firezone/index.md @@ -4,6 +4,8 @@ sidebar_label: Firezone support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Firezone? > Firezone is an open-source remote access platform built on WireGuard®, a modern VPN protocol that's 4-6x faster than OpenVPN. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Firezone with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -34,7 +38,7 @@ To support the integration of Firezone with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://firezone.company/auth/oidc/authentik/callback/`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://firezone.company/auth/oidc/authentik/callback/`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/networking/gravity/index.md b/website/integrations/networking/gravity/index.md index 01384e25f6..8c4aae2c9e 100644 --- a/website/integrations/networking/gravity/index.md +++ b/website/integrations/networking/gravity/index.md @@ -4,6 +4,8 @@ sidebar_label: Gravity support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Gravity? > Gravity is a fully-replicated DNS, DHCP, and TFTP server powered by [etcd](https://etcd.io/), offering features like built-in caching, ad/privacy blocking, automatic DNS registration, and metric tracking. @@ -27,6 +29,8 @@ Gravity automatically triggers SSO authentication when configured. To prevent th ## authentik configuration + + To support the integration of Gravity with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Gravity with authentik, you need to create an appl - **Choose a Provider type**: Select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: Provide a name (or accept the auto-provided name), choose the authorization flow for this provider, and configure the following required settings: - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://gravity.company/auth/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gravity.company/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: Create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/networking/headscale/index.md b/website/integrations/networking/headscale/index.md index 2fa1fd81c6..5cad73276e 100644 --- a/website/integrations/networking/headscale/index.md +++ b/website/integrations/networking/headscale/index.md @@ -4,6 +4,8 @@ sidebar_label: Headscale support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Headscale? > Headscale is an open source alternative to the Tailscale coordination server and can be self-hosted for a single tailnet. Headscale is a re-implemented version of the Tailscale coordination server, developed independently and completely separate from Tailscale, with its own independent community of users and developers. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Headscale with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Headscale with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://headscale.company/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://headscale.company/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/networking/hoop.dev/index.md b/website/integrations/networking/hoop.dev/index.md index c8307cd3fd..679e85679d 100644 --- a/website/integrations/networking/hoop.dev/index.md +++ b/website/integrations/networking/hoop.dev/index.md @@ -4,6 +4,8 @@ sidebar_label: Hoop.dev support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Hoop.dev? > Hoop.dev is an access gateway for databases and servers with AI-powered automations that eliminate cumbersome access policies and break-glass workflows without compromising security. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Hoop.dev with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Hoop.dev with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://hoop.company/api/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hoop.company/api/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/networking/netbird/index.mdx b/website/integrations/networking/netbird/index.mdx index 1ae5d51621..4ce088796e 100644 --- a/website/integrations/networking/netbird/index.mdx +++ b/website/integrations/networking/netbird/index.mdx @@ -4,6 +4,7 @@ sidebar_label: NetBird support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -41,6 +42,8 @@ NetBird can use authentik in two ways: ## authentik configuration + + To support adding authentik as an external identity provider in NetBird, you need to create an application/provider pair and application entitlements in authentik. ### Create an application and provider in authentik @@ -80,7 +83,7 @@ Name each entitlement exactly as the NetBird group value that NetBird should syn - **Issuer**: `https://authentik.company/application/o//` 4. Copy the redirect URL shown by NetBird. Do not complete the provider setup yet. 5. Return to authentik, navigate to **Applications** > **Providers**, and edit the NetBird provider. -6. Under **Redirect URIs/Origins**, add the redirect URL from NetBird as a `Strict` redirect. +6. Under **Redirect URIs/Origins**, add the redirect URL from NetBird as a `Strict` `Authorization` redirect. 7. Click **Update**. 8. Return to NetBird and complete the identity provider setup. @@ -109,8 +112,8 @@ To support replacing NetBird's embedded IdP with authentik, you need to create a - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** value because it will be required later. - Set **Client type** to `Public`. - - Add a `Strict` redirect URI to `http://localhost:53000`. - - Add a `Regex` redirect URI to `https://netbird.company/.*`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `http://localhost:53000`. + - Add a **Redirect URI** of type `Regex` `Authorization` as `https://netbird.company/.*`. - Select any available signing key. - Under **Advanced protocol settings**, set **Access Code Validity** to `minutes=10`. - Under **Advanced protocol settings**, set **Subject Mode** to `Based on the User's ID`. diff --git a/website/integrations/networking/pangolin/index.mdx b/website/integrations/networking/pangolin/index.mdx index 1b9c1f9d9c..c25c233df5 100644 --- a/website/integrations/networking/pangolin/index.mdx +++ b/website/integrations/networking/pangolin/index.mdx @@ -4,6 +4,8 @@ sidebar_label: Pangolin support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is Pangolin? > Pangolin is a self-hosted tunneled reverse proxy server with identity and access control, designed to securely expose private resources on distributed networks. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Pangolin with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Pangolin with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, and **Client Secret** values because they will be required later. - - Temporarily set **Redirect URI** to `https://temp.temp`. + - Temporarily add a **Redirect URI** of type `Strict` `Authorization` as `https://temp.temp`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. @@ -61,7 +65,7 @@ To support the integration of Pangolin with authentik, you need to create an app 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created Pangolin provider. -3. Set the **Redirect URI** to the value taken from Pangolin (e.g. `https://pangolin.company/auth/idp//oidc/callback`). +3. Add a **Redirect URI** of type `Strict` `Authorization` as the value taken from Pangolin (e.g. `https://pangolin.company/auth/idp//oidc/callback`). 4. Click **Update**. ## Configuration verification diff --git a/website/integrations/networking/tailscale/index.md b/website/integrations/networking/tailscale/index.md index 3df0c2dd67..859640e4a6 100644 --- a/website/integrations/networking/tailscale/index.md +++ b/website/integrations/networking/tailscale/index.md @@ -4,6 +4,8 @@ sidebar_label: Tailscale support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Tailscale? > Tailscale is a mesh VPN service that creates secure, encrypted, peer-to-peer connections between devices across different networks using the WireGuard protocol. @@ -42,6 +44,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Tailscale with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -52,7 +56,7 @@ To support the integration of Tailscale with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://login.tailscale.com/a/oauth_response`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://login.tailscale.com/a/oauth_response`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/networking/technitium/index.md b/website/integrations/networking/technitium/index.md index c34f85e40d..698b8b630f 100644 --- a/website/integrations/networking/technitium/index.md +++ b/website/integrations/networking/technitium/index.md @@ -4,6 +4,8 @@ sidebar_label: Technitium DNS support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Technitium DNS? > Technitium DNS Server is a free, open source, cross-platform, authoritative and recursive DNS server that can be self-hosted for privacy and security, software development, and testing on small to medium-sized networks. @@ -25,6 +27,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Technitium DNS with authentik, you need to create a scope mapping, an application/provider pair, and application entitlements in authentik. ### Create a scope mapping in authentik @@ -59,7 +63,7 @@ Technitium DNS uses the `roles` claim to map SSO users to local groups. Create a - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Set **Client type** to `Confidential`. - - Set a `Strict` redirect URI to `https://technitium.company/sso/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://technitium.company/sso/callback`. - Select any available signing key. - Ensure that the `openid`, `email`, and `profile` scopes are selected. Remove the `email` scope if you prefer usernames to use the preferred username claim instead of the email address. - Under **Advanced protocol settings** > **Selected Scopes**, add the scope mapping that you created in the previous section. diff --git a/website/integrations/platforms/box/index.md b/website/integrations/platforms/box/index.md new file mode 100644 index 0000000000..64d4a02050 --- /dev/null +++ b/website/integrations/platforms/box/index.md @@ -0,0 +1,126 @@ +--- +title: Integrate with Box +sidebar_label: Box +support_level: community +--- + +## What is Box? + +> Box is a cloud content management platform for secure file storage, sharing, collaboration, e-signatures, and content workflows. +> +> -- https://www.box.com/ + +## Preparation + +The following placeholders are used in this guide: + +- `authentik.company` is the FQDN of the authentik installation. + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +:::info Box requirements +Box SSO requires a Business or Enterprise account. To let Box create users automatically from SSO, make sure each authentik user has an email address and a full name with a first and last name. +::: + +## authentik configuration + +To support the integration of Box with authentik, you need to create property mappings and an application/provider pair in authentik. + +### Create property mappings + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Customization** > **Property Mappings** and click **Create**. +3. Create three **SAML Provider Property Mapping**s with the following settings: + - **Email mapping**: + - **Name**: `Box email` + - **SAML Attribute Name**: `email` + - **Expression**: + + ```python + return request.user.email + ``` + + - **First name mapping**: + - **Name**: `Box firstName` + - **SAML Attribute Name**: `firstName` + - **Expression**: + + ```python + name = request.user.name.strip() + return name.split(" ", 1)[0] if name else "" + ``` + + - **Last name mapping**: + - **Name**: `Box lastName` + - **SAML Attribute Name**: `lastName` + - **Expression**: + + ```python + name = request.user.name.strip() + return name.rsplit(" ", 1)[1] if " " in name else "" + ``` + +### Create an application and provider in authentik + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. + - **Choose a Provider type**: select **SAML Provider** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Set **ACS URL** to `https://sso.services.box.net/sp/ACS.saml2`. + - Set **Audience** to `box.net`. + - Under **Advanced protocol settings**: + - Select an available **Signing Certificate**. + - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. + - Add the three property mappings that you created in the previous section. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. +3. Click **Submit** to save the new application and provider. + +### Download metadata file + +1. In authentik, navigate to **Applications** > **Providers** and click the provider that you created for Box. +2. Under **Related objects** > **Metadata**, click **Download**. This metadata file is required in the next section. + +## Box configuration + +1. Log in to Box and open the **Admin Console**. +2. Navigate to **Enterprise Settings** > **User Settings**. +3. In the **Configure Single Sign-On (SSO) for All Users** section, click **Configure**. +4. Submit the [Box SSO Setup Support Form](https://support.box.com/hc/en-us/requests/new) and provide the authentik metadata file. +5. Use the following values for individual SAML fields: + - **Entity ID**, **Connection ID**, or **External Key**: `https://authentik.company/application/saml//metadata/` + - **Redirect URL**: `https://authentik.company/application/saml//` + - **Public Certificate**: the signing certificate from the authentik SAML provider. + - **Email attribute**: `email` + - **First name attribute**: `firstName` + - **Last name attribute**: `lastName` +6. After Box processes the SSO configuration, return to **Admin Console** > **Enterprise Settings** > **User Settings**. +7. In the **Enable Single Sign-On (SSO) for All Users** section, enable **SSO Test Mode**. +8. After you test the integration, disable **SSO Test Mode** and enable **SSO Required**. + +:::warning SSO Required +Test the SSO login flow before enabling **SSO Required**. Enabling **SSO Required** limits managed users to SSO login and is treated by Box as a critical administrator action. +::: + +## Box SSO account settings + +### On-the-fly registration _(optional)_ + +Box can create user accounts when a user signs in with SSO for the first time. To use on-the-fly registration, contact Box Customer Success or Box Product Support and provide the `email`, `firstName`, and `lastName` SAML attribute names. + +### Group membership _(optional)_ + +Box can update Box group membership from SAML assertions when users sign in. To send authentik group names to Box, add `authentik default SAML Mapping: Groups` to the Box SAML provider's **Property mappings**. + +If Box does not show the **User Groups Settings** section after SSO is enabled, contact Box Customer Success or Box Product Support to enable SAML groups. Nested group membership is not supported by Box. + +## Configuration verification + +To confirm that authentik is properly configured with Box, open Box in a private or incognito browser window. Click **Sign In with SSO**, enter the email address of a managed Box user, and confirm that you are redirected to authentik and then back to Box. + +## Resources + +- [Box Support - Setting Up Single Sign-On (SSO) for Your Organization](https://support.box.com/hc/en-us/articles/360043696514-Setting-Up-Single-Sign-On-SSO-for-Your-Organization) +- [Box Support - Logging in with Single Sign On (SSO)](https://support.box.com/hc/en-us/articles/360044195153-Logging-in-with-Single-Sign-On-SSO) diff --git a/website/integrations/platforms/budibase/index.md b/website/integrations/platforms/budibase/index.md index 693a7d7ac0..d2a45e6c0e 100644 --- a/website/integrations/platforms/budibase/index.md +++ b/website/integrations/platforms/budibase/index.md @@ -4,6 +4,8 @@ sidebar_label: Budibase support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Budibase? > Budibase is an open source low-code platform, and the easiest way to build internal tools that improve productivity. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Budibase with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of Budibase with authentik, you need to create an app - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://budibase.company/api/global/auth/oidc/callback`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://budibase.company/api/global/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/platforms/drupal/index.md b/website/integrations/platforms/drupal/index.md index 0afc315b4c..89d4b8b05e 100644 --- a/website/integrations/platforms/drupal/index.md +++ b/website/integrations/platforms/drupal/index.md @@ -4,6 +4,8 @@ sidebar_label: Drupal support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Drupal? > Drupal is a free and open-source content management system written in PHP and @@ -28,6 +30,8 @@ There are many different modules for Drupal that allow you to set up SSO using d ## authentik configuration + + To support the integration of Drupal with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -38,7 +42,7 @@ To support the integration of Drupal with authentik, you need to create an appli - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. The **slug** will be used in URLs and should match the `drupal-slug` placeholder defined earlier. - **Choose a Provider type**: select **OAuth2/OpenID Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), and configure the following required settings: - - Add the following **Redirect URI**: `https://drupal.company/openid-connect/generic` + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://drupal.company/openid-connect/generic`. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. diff --git a/website/integrations/platforms/hubspot/index.md b/website/integrations/platforms/hubspot/index.md new file mode 100644 index 0000000000..aacc7943ec --- /dev/null +++ b/website/integrations/platforms/hubspot/index.md @@ -0,0 +1,100 @@ +--- +title: Integrate with HubSpot +sidebar_label: HubSpot +support_level: community +--- + +import SAMLProvider20265Warning from "../../\_saml-provider-2026-5-warning.mdx"; + +## What is HubSpot? + +> HubSpot is a customer platform with tools for CRM, marketing, sales, customer service, content management, operations, and commerce. +> +> -- https://www.hubspot.com/ + +## Preparation + +The following placeholders are used in this guide: + +- `authentik.company` is the FQDN of the authentik installation. + +:::info HubSpot requirements +This guide covers SAML Single Sign-On (SSO) for HubSpot. HubSpot SSO requires a HubSpot Professional or Enterprise account, or an active Professional or Enterprise trial, and a HubSpot user with **Super Admin** permissions. HubSpot identifies SSO users by email address, so the NameID sent by authentik must match the user's email address in HubSpot. +::: + +:::info +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. +::: + +## authentik configuration + +To support the integration of HubSpot with authentik, you need to create an application/provider pair in authentik. + +### Create an application and provider in authentik + + + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: set **Application Name**, **Slug**, an optional group, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. + - **Choose a Provider**: select **SAML Provider** on the **Choose a Provider Type** page. + - **Configure SAML Provider**: provide a name (or accept the auto-provided name), select the authorization flow to use for this provider, and set the following values. + - Set **ACS URL** to `https://temp.temp`. + - Set **Audience** to `https://temp.temp`. + - Under **Advanced protocol settings**: + - Select an available **Signing Certificate**. + - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. + - Set **Service Provider Binding** to **Post**. + - Set **Default NameID Policy** to **Email address**. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. + +3. Click **Create Application** to save the new application and provider. + +### Copy the SAML values from authentik + +1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click the SAML provider that you created for HubSpot. +2. Copy the **SAML Endpoint** value. This value is required in HubSpot. +3. Under **Related objects** > **Download signing certificate**, click **Download**. +4. Open the downloaded certificate file and copy the full PEM certificate. + +## HubSpot configuration + +1. Log in to HubSpot as a Super Admin. +2. In the top navigation bar, click the **settings** icon. +3. In the left sidebar, navigate to **Security**. +4. On the **Login** tab, do one of the following: + - If portal login settings have not been configured yet, click **Setup Portal Login Settings**. + - If portal login settings have already been configured, click **Set up** in the **Configure single sign-on (SSO)** section. +5. In the right panel, select the **All Other Identity Providers** tab. +6. Set the following values: + - **Identity Provider Identifier or Issuer URL**: `https://authentik.company/application/saml//metadata/` + - **Identity Provider Single Sign-On URL**: the **SAML Endpoint** value from authentik. + - **X.509 Certificate**: the full PEM certificate that you downloaded from authentik. +7. Copy the following values from HubSpot. You will use them to finish the SAML provider configuration in authentik. + - **Audience URI** + - **ACS URL** +8. Keep the SSO setup panel open. + +## Configure the remaining information in authentik + +1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click the SAML provider that you created for HubSpot. +2. Click **Edit**. +3. Under **Protocol settings**, set the following values: + - **ACS URL**: the **ACS URL** value from HubSpot. + - **Audience**: the **Audience URI** value from HubSpot. +4. Click **Save Changes**. + +## Verify HubSpot configuration + +1. Return to the HubSpot SSO setup panel. +2. Click **Verify** and complete the authentik login flow. + +## Configuration verification + +To confirm that authentik is properly configured with HubSpot, open HubSpot in a private browser window, click **Log in with SSO**, and enter the email address of a HubSpot user whose email address matches an authentik user. + +## Resources + +- [HubSpot Knowledge Base - Set up single sign-on (SSO)](https://knowledge.hubspot.com/account-security/set-up-single-sign-on-sso) +- [HubSpot - Single Sign-on in HubSpot](https://www.hubspot.com/products/single-sign-on) +- [Cisco Duo - Duo Single Sign-On for HubSpot](https://duo.com/docs/sso-hubspot) diff --git a/website/integrations/platforms/personio/index.md b/website/integrations/platforms/personio/index.md index 74b89535d1..62506db268 100644 --- a/website/integrations/platforms/personio/index.md +++ b/website/integrations/platforms/personio/index.md @@ -4,6 +4,8 @@ sidebar_label: Personio support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Personio? > Personio is an HR software platform for managing core HR processes such as recruiting, onboarding, payroll, time tracking, and performance management. @@ -22,6 +24,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Personio with authentik, you need to create an application/provider pair in authentik. ### Copy the Personio callback URL @@ -40,7 +44,7 @@ To support the integration of Personio with authentik, you need to create an app - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Set the **Client type** to `Confidential`. - - Add two `Strict` redirect URIs: + - Add two **Redirect URIs** of type `Strict` `Authorization`: - The **Callback URLs/Redirect URIs** value from Personio. - `https://login.personio.com/login/callback` - Select any available signing key. diff --git a/website/integrations/platforms/pocketbase/index.md b/website/integrations/platforms/pocketbase/index.md index 747e5bbbca..643fd453e5 100644 --- a/website/integrations/platforms/pocketbase/index.md +++ b/website/integrations/platforms/pocketbase/index.md @@ -4,6 +4,8 @@ sidebar_label: PocketBase support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is PocketBase? > PocketBase is an open source backend consisting of an embedded SQLite database, realtime subscriptions, built-in auth management, a dashboard UI, and a REST-like API. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of PocketBase with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -33,7 +37,7 @@ To support the integration of PocketBase with authentik, you need to create an a - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://pocketbase.company/api/oauth2-redirect`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://pocketbase.company/api/oauth2-redirect`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/platforms/wordpress/index.md b/website/integrations/platforms/wordpress/index.md index 9f9ea62820..8eb025e5e1 100644 --- a/website/integrations/platforms/wordpress/index.md +++ b/website/integrations/platforms/wordpress/index.md @@ -4,6 +4,8 @@ sidebar_label: WordPress support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is WordPress? > WordPress is an open source publishing platform used to create websites, blogs, and other web content. @@ -27,6 +29,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of WordPress with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider @@ -37,7 +41,7 @@ To support the integration of WordPress with authentik, you need to create an ap - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and application **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://wp.company/wp-admin/admin-ajax.php?action=openid-connect-authorize`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wp.company/wp-admin/admin-ajax.php?action=openid-connect-authorize`. - Select any available signing key. - Under **Advanced protocol settings** > **Scopes**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to the **Selected Scopes** list. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/integrations/security/1password/index.mdx b/website/integrations/security/1password/index.mdx index 18d81c8f8e..bae482d09f 100644 --- a/website/integrations/security/1password/index.mdx +++ b/website/integrations/security/1password/index.mdx @@ -4,6 +4,8 @@ sidebar_label: 1Password support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is 1Password? > 1Password is a password management tool that simplifies the process of creating, storing, and sharing passwords. It allows you to create strong, unique passwords, securely store them in a vault, and automatically fill them in when needed. @@ -24,6 +26,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of 1Password with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -35,7 +39,7 @@ To support the integration of 1Password with authentik, you need to create an ap - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Client Type** to `Public`. - Note the **Client ID** and **slug** values because they will be required later. - - Add two `Strict` redirect URIs and set them to `https://your-domain.1password.com/sso/oidc/redirect/` and `onepassword://sso/oidc/redirect`. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://your-domain.1password.com/sso/oidc/redirect/` and `onepassword://sso/oidc/redirect`. - Select any available **Signing Key**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add a SCIM provider as a backchannel provider later, only users who can view this application are synchronized. diff --git a/website/integrations/security/bitwarden/index.mdx b/website/integrations/security/bitwarden/index.mdx index 18303a537a..9ec8306744 100644 --- a/website/integrations/security/bitwarden/index.mdx +++ b/website/integrations/security/bitwarden/index.mdx @@ -4,6 +4,7 @@ sidebar_label: Bitwarden support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; import SAMLProvider20265Warning from "../../_saml-provider-2026-5-warning.mdx"; import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; @@ -25,7 +26,7 @@ The following placeholders are used in this guide: This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ::: -:::info +:::info Enterprise subscription To enable Single Sign-On (SSO) with Bitwarden, an [enterprise subscription](https://bitwarden.com/help/password-manager-plans/#compare-business-plans) is required. ::: @@ -43,67 +44,48 @@ You can configure Bitwarden to use either OIDC or SAML; this guide explains both ## authentik configuration -To support the integration of Bitwarden with authentik, you need to create a property mapping and an application/provider pair in authentik. + -### Create a property mapping - -Bitwarden requires a first and last name for every user. However, authentik, by default, only supplies a full name as a single string. As a result, a property mapping must be created to separate and provide first and last names to Bitwarden. - -1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Customization** > **Property Mappings** and click **Create**. - - **Select type**: select **Scope Mapping**. - - **Configure the Scope Mapping**: Provide a descriptive name (e.g. `Bitwarden Profile Scope`), and an optional description. - - **Scope name**: `profile` - - **Expression**: - - ```python showLineNumbers - return { - "name": request.user.name, - "preferred_username": request.user.username, - "nickname": request.user.username, - "groups": [group.name for group in request.user.groups.all()], - "surname": request.user.name.rsplit(" ", 1)[-1], - "givenname": request.user.name.rsplit(" ", 1)[0], - } - ``` - -3. Click **Finish** to save the property mapping. +To support the integration of Bitwarden with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to: - - `https://sso.bitwarden.com/oidc-signin` for non-EU-based SaaS Bitwarden. - - `https://sso.bitwarden.eu/oidc-signin` for EU-based SaaS Bitwarden. - - `https://bitwarden.company/oidc-signin` for self-hosted Bitwarden. - - Select any available signing key. - - Under **Advanced protocol settings**, **Selected Scopes**: - - Remove `authentik default OAuth Mapping: OpenID 'profile'` and add the property mapping that you created. + - Add the redirect URIs for your Bitwarden deployment: + - For Bitwarden Cloud US: + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://sso.bitwarden.com/oidc-signin`. + - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://sso.bitwarden.com/oidc-signedout`. + - For Bitwarden Cloud EU: + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://sso.bitwarden.eu/oidc-signin`. + - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://sso.bitwarden.eu/oidc-signedout`. + - For self-hosted Bitwarden: + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://bitwarden.company/sso/oidc-signin`. + - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://bitwarden.company/sso/oidc-signedout`. + - Select any available **Signing Key**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Bitwarden configuration -1. Log in to the [Bitwarden dashboard](https://vault.bitwarden.com/#/login) as an administrator (choose `Accessing: bitwarden.eu` for Bitwarden accounts based in the EU). If you are using a self-hosted Bitwarden, go to `https://bitwarden.company/#/login`. -2. In the sidebar, navigate to **Admin Console** > **Settings** > **Single sign-on**, and enter the following settings: +1. Log in to the Bitwarden web app as an administrator. For Bitwarden Cloud EU accounts, select `bitwarden.eu` from the **Accessing** menu. If you are using self-hosted Bitwarden, log in to `https://bitwarden.company/#/login`. +2. Open the **Admin Console** using the product switcher. +3. In the sidebar, navigate to **Settings** > **Single sign-on**, and enter the following settings: - **Allow SSO authentication**: Select this option. - - **SSO Identifier**: enter a globally unique SSO identifier (this is not required if using self-hosted Bitwarden, or if you have claimed a domain, see the [Bitwarden Claimed Domains documentation](https://bitwarden.com/help/claimed-domains/)). - - **Type**: `OIDC` + - **SSO Identifier**: enter a globally unique SSO identifier. Members with a matching [claimed domain](https://bitwarden.com/help/claimed-domains/) can bypass entering this identifier; domain verification is outside the scope of this guide. + - **Type**: select **OpenID Connect**. - Under **OpenID connect configuration**: - **Authority**: `https://authentik.company/application/o//` - - **Client ID**: Client ID from authentik. - - **Client secret**: Client secret from authentik. - - **Metadata address**: `https://authentik.company/application/o//.well-known/openid-configuration` - - **OIDC redirect behavior**: `Redirect GET` - - **Get claims from user info endpoint**: Select this option. + - **Client ID**: `` + - **Client Secret**: `` + - **OIDC Redirect Behavior**: select **Redirect GET**. -3. Click **Save**. +4. Click **Save**. @@ -118,12 +100,12 @@ To support the integration of Bitwarden with authentik, you need to create an ap 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp` - - Under **Advanced protocol settings**, set **Signing Certificate** to use any available certificate. + - Under **Advanced protocol settings**, select any available **Signing Certificate**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. @@ -136,20 +118,21 @@ To support the integration of Bitwarden with authentik, you need to create an ap ## Bitwarden configuration -1. Log in to the [Bitwarden dashboard](https://vault.bitwarden.com/#/login) as an administrator (select `Accessing: bitwarden.eu` for EU-based Bitwarden accounts). For self-hosted Bitwarden use `https://bitwarden.company/#/login`. -2. In the sidebar, navigate to **Admin Console** > **Settings** > **Single sign-on**, and enter the following settings: +1. Log in to the Bitwarden web app as an administrator. For Bitwarden Cloud EU accounts, select `bitwarden.eu` from the **Accessing** menu. If you are using self-hosted Bitwarden, log in to `https://bitwarden.company/#/login`. +2. Open the **Admin Console** using the product switcher. +3. In the sidebar, navigate to **Settings** > **Single sign-on**, and enter the following settings: - **Allow SSO authentication**: Select this option. - - **SSO Identifier**: enter a globally unique SSO identifier (this is not required if using self-hosted Bitwarden, or if you have claimed a domain, see the [Bitwarden Claimed Domains documentation](https://bitwarden.com/help/claimed-domains/)). - - **Type**: `SAML 2.0` + - **SSO Identifier**: enter a globally unique SSO identifier. Members with a matching [claimed domain](https://bitwarden.com/help/claimed-domains/) can bypass entering this identifier; domain verification is outside the scope of this guide. + - **Type**: select **SAML 2.0**. - Under **SAML service provider configuration**: - **Expect signed assertions**: Select this option. - Under **SAML identity provider configuration**: - **Entity ID**: `https://authentik.company/application/saml//metadata/` - **Single sign-on service URL**: `https://authentik.company/application/saml//` - **Single log-out service URL**: `https://authentik.company/application/saml//` - - **X509 public certificate**: Paste the contents of your certificate file. -3. Under **SAML service provider configuration**, take note of the **SP entity ID** and **Assertion consumer service (ACS) URL** values. These will be required in the next section. -4. Click **Save**. + - **X509 public certificate**: Paste the contents of your certificate file, without the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. +4. Under **SAML service provider configuration**, note the **SP entity ID** and **Assertion consumer service (ACS) URL** values because they will be required in the next section. +5. Click **Save**. ## Reconfigure authentik provider @@ -158,23 +141,24 @@ To support the integration of Bitwarden with authentik, you need to create an ap 3. Under **Protocol settings**, set the following required configurations: - **ACS URL**: set to the **Assertion consumer service (ACS) URL** from Bitwarden. - **Audience**: set to the **SP entity ID** from Bitwarden. -4. Click **Update** +4. Click **Update**. ## Configuration verification -To confirm that authentik is properly configured with Bitwarden, log out and go to the [Bitwarden login page](https://vault.bitwarden.com/#/login) (select `Accessing: bitwarden.eu` for EU-based Bitwarden accounts or use `https://bitwarden.company/#/login` for self-hosted Bitwarden). +To confirm that authentik is properly configured with Bitwarden, log out and open Bitwarden. Enter the email address of a Bitwarden account and click **Use single sign-on**. If you haven't claimed the email domain in Bitwarden, enter the unique SSO identifier that you selected, and click **Continue**. You should be redirected to authentik to log in. After successfully logging in, you should be redirected to the Bitwarden dashboard. -:::info -Depending on your `Member decryption options` setting, which is set in Bitwarden via **Admin Console** > **Settings** > **Single sign-on**, you may still be required to enter your master password after signing in via SSO. +:::info Member decryption options +Depending on your **Member decryption options** setting in Bitwarden, you may still be required to enter your master password after signing in via SSO. ::: ## Resources - [Bitwarden Help - OIDC Configuration](https://bitwarden.com/help/configure-sso-oidc/) - [Bitwarden Help - SAML 2.0 Configuration](https://bitwarden.com/help/configure-sso-saml/) +- [Bitwarden Help - About Single Sign-On](https://bitwarden.com/help/about-sso/) - [Bitwarden Help - Claimed Domains](https://bitwarden.com/help/claimed-domains/) diff --git a/website/integrations/security/cloudflare-access/index.md b/website/integrations/security/cloudflare-access/index.md index 1809dbc669..61e736c569 100644 --- a/website/integrations/security/cloudflare-access/index.md +++ b/website/integrations/security/cloudflare-access/index.md @@ -4,6 +4,8 @@ sidebar_label: Cloudflare Access support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Cloudflare Access? > Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources. @@ -14,55 +16,57 @@ support_level: community The following placeholders are used in this guide: -- `company.cloudflareaccess.com` is the FQDN of your Cloudflare Access subdomain. +- `company.cloudflareaccess.com` is the FQDN of your Cloudflare Access team domain. - `authentik.company` is the FQDN of the authentik installation. -To proceed, you need to register for a free Cloudflare Access account and have both a Cloudflare account and a publicly accessible authentik instance with a trusted SSL certificate. +To proceed, you need a Cloudflare account with Cloudflare Zero Trust enabled and a publicly accessible authentik instance with a trusted SSL certificate. :::info This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ::: -:::info +:::info Cloudflare Dashboard SSO Looking to integrate authentik with your Cloudflare Dashboard? See our [integration guide](../../platforms/cloudflare/index.md) for more information. ::: ## authentik configuration + + To support the integration of Cloudflare Access with authentik, you need to create an application/provider pair in authentik. +Cloudflare uses your Cloudflare Access team name in the callback URL. You can find the team name in the Cloudflare dashboard under **Settings** > **Team name and domain** > **Team name**. + ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - -- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. -- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. -- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://company.cloudflareaccess.com/cdn-cgi/access/callback`. - - Select any available signing key. -- **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. - + - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. + - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. + - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. + - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://company.cloudflareaccess.com/cdn-cgi/access/callback`. + - Select any available signing key. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Cloudflare Access configuration -1. Open the [Cloudflare Access dashboard](https://one.dash.cloudflare.com) and navigate to **Integrations** > **Identity provider**. -2. Click **Add an identity provider**, and then select **OpenID Connect**. -3. From the authentik provider you created earlier, copy the following details and paste them into the corresponding fields: - - **Client ID** > App ID - - **Client Secret** > Client Secret - - **Authorize URL** > Auth URL - - **Token URL** > Token URL - - **JWKS URL** > Certificate URL +1. Open the [Cloudflare dashboard](https://one.dash.cloudflare.com) and go to **Zero Trust** > **Integrations** > **Identity providers**. +2. Under **Your identity providers**, click **Add new identity provider**, and then select **OpenID Connect**. +3. Configure the identity provider using values from the authentik provider created earlier: + - **Name**: enter a descriptive name, for example `authentik`. + - **App ID**: enter the **Client ID** from authentik. + - **Client Secret**: enter the **Client Secret** from authentik. + - **Auth URL**: enter `https://authentik.company/application/o/authorize/`. + - **Token URL**: enter `https://authentik.company/application/o/token/`. + - **Certificate URL**: enter `https://authentik.company/application/o//jwks/`. 4. Click **Save**. -5. Click **Test** to verify the login provider. ## Configuration verification -To confirm that authentik is properly configured with Cloudflare Access, click the **Test** button found right next to the **Save** button from the previous step. +To confirm that authentik is properly configured with Cloudflare Access, open Cloudflare Access, go to **Authentication** > **Login methods**, and click **Test** next to the authentik login method. Complete the login flow and verify that Cloudflare displays a successful test result. ## Resources -- [Cloudflare Access Generic OIDC documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/generic-oidc/) +- [Cloudflare Access Generic OIDC documentation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-oidc/) diff --git a/website/integrations/security/fortimail/index.mdx b/website/integrations/security/fortimail/index.mdx index 4efe22e7ec..5f12a910f8 100644 --- a/website/integrations/security/fortimail/index.mdx +++ b/website/integrations/security/fortimail/index.mdx @@ -19,22 +19,26 @@ import TabItem from "@theme/TabItem"; The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. -- `fortimailadmin.company` is the FQDN (or IP) of your FortiMail admin interface. -- `fortimailuser.company` is the WAN-facing FQDN of your FortiMail user/webmail portal. +- `fortimailadmin.company` is the FQDN or IP address of your FortiMail admin interface. +- `fortimailuser.company` is the FQDN or IP address of your FortiMail user/webmail portal. :::info -This documentation lists only the settings that you need to change from their default values. Changing settings not mentioned in this guide can prevent single sign-on from working correctly. +This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ::: -:::info -FortiMail 7.6.4 and later allows you to configure separate service providers for the admin and user/webmail portals. If you plan to use the user/webmail portal, avoid importing FortiMail’s auto-generated metadata directly, as you will need to edit the ACS URL in that XML to replace the host with your user-facing FQDN. +:::info FortiMail Cloud +FortiMail Cloud supports SSO for webmail users. The Admin Portal SSO steps apply to FortiMail Appliance and VM. +::: + +:::info Webmail limitations +When SSO is enabled for FortiMail webmail users, CalDAV and WebDAV authentication do not use SSO and continue to require local password authentication. If your FortiMail system is deployed in server mode, configure an LDAP profile for the domain users before enabling webmail SSO. ::: ## authentik configuration -To support the integration of the FortiMail with authentik, you need to create an application/provider pair in authentik. +To support the integration of FortiMail with authentik, you need to create an application/provider pair in authentik. -You can configure either Admin Portal SSO or User Portal SSO (or both), depending on the intended user and the desired scope of authentication. +You can configure either Admin Portal SSO or User Portal SSO, or both, depending on the intended users and the desired scope of authentication. 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - - **Application**: provide a descriptive name (e.g. `FortiMail Admin`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name (for example, `FortiMail Admin`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - - Set the **ACS URL** to `https://fortimailadmin.company/sso/SAML2/POST`. - - Set the **Audience** to `https://fortimailadmin.company/sp`. - - Under **Advanced protocol settings**: - - Select any available certificate as the **Signing Certificate** and enable **Sign Assertions**. - - Ensure that `authentik default SAML Mapping: Username` is selected as a **Selected User Property Mappings**; other mappings are optional and can be removed if not needed. - - **Configure Bindings** _(optional)_: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which administrators see the FortiMail Admin application on the **Application Dashboard** page. - -3. Click **Submit** to save the application and provider. + - Temporarily set the **ACS URL** to `https://temp.temp`. + - Temporarily set the **Audience** to `https://temp.temp`. + - Under **Advanced protocol settings**, select any available certificate as the **Signing Certificate**. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. +3. Click **Create Application** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section (e.g. `Provider for FortiMail Admin`). -3. Under **Related objects** > **Metadata**, click on **Download**. This downloaded file is your metadata file and it will be required in the next section. +2. Navigate to **Applications** > **Providers** and click the name of the provider that you created in the previous section (for example, `Provider for FortiMail Admin`). +3. Under **Related objects** > **Metadata**, click **Download**. This file is required in the next section. ## FortiMail configuration 1. Sign in to the FortiMail admin interface. -2. Navigate to **System** > **Single Sign On** and select the **Setting** tab. -3. Enable **Single sign-on** and note the values that FortiMail displays (the ACS field is read-only): +2. Navigate to **System** > **Single Sign On** and open the **Profile** tab. +3. Create a new SSO profile and configure the following settings: + - **Profile name**: enter a descriptive name (for example, `authentik-admin`). + - **Metadata**: upload the authentik metadata file that you downloaded in the previous section. + - **Attribute used to identify email address**: `http://schemas.goauthentik.io/2021/02/saml/username` +4. Click **Create** or **OK** to save the SSO profile. +5. Open the **Setting** tab and enable **Single sign-on**. +6. If FortiMail displays **Use different service provider for admin and webmail access**, select **Admin** as the service provider metadata target. +7. In the **Service Provider Metadata** section, configure the following values: - **Entity ID**: `https://fortimailadmin.company/sp` - - **Assertion consumer service (ACS) URL**: `https://fortimailadmin.company/sso/SAML2/POST` + - **Host name**: `fortimailadmin.company` +8. Click **Apply**. +9. Copy the following FortiMail service provider values: + - **Entity ID** + - **ACS URL** -Ensure that these values match those configured in authentik. If not, update the values in authentik and re-download the [authentik metadata file](#download-metadata-file). +### Reconfigure the authentik provider -4. Upload the authentik SAML metadata file that you downloaded in the previous step. -5. Switch to the **Profile** tab and configure the attribute mapping: - - Set **Attribute used to identify email address** to `http://schemas.goauthentik.io/2021/02/saml/username`. +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click the provider that you created for FortiMail Admin. +3. Click **Edit**. +4. Under **Protocol settings**, set the following values: + - **ACS URL**: paste the **ACS URL** value from FortiMail. + - **Audience**: paste the **Entity ID** value from FortiMail. +5. Click **Update**. -:::info User Provisioning -FortiMail does not auto-provision administrator accounts via SSO. +### Configure administrator accounts -You must manually create admin users and, for each account, configure the **Authentication type** as `Single Sign On` to enable authentication through the SAML provider. -::: +FortiMail does not automatically provision administrator accounts through SSO. Create or edit each administrator that should use SSO: + +1. In the FortiMail admin interface, navigate to **System** > **Administrator** > **Administrator**. +2. For each SSO-enabled administrator, set **Authentication type** to **Single Sign On** and set **Single sign on profile** to the SSO profile that you created for authentik. ### Enforce SSO-only access (optional) -To require SSO for FortiMail Admin Portal logins: +To show only SSO on the administrator login page, run the following commands in the FortiMail CLI: -1. Sign in to the FortiMail admin interface. -2. Navigate to **System** > **Customization** > **Appearance** > **Webmail Portal** and set **Login page** to `Single Sign On only`. +```shell +config system appearance +set admin-sso-login-option sso-only +end +``` + +:::warning Administrator recovery +When administrator SSO-only login is enabled, the built-in `admin` account cannot sign in to the GUI. Keep SSH or local console access available before enabling this option. +::: -## authentik configuration - -To support the integration of the FortiMail User Portal with authentik, you need to create an application/provider pair in authentik. - ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - - **Application**: provide a descriptive name (e.g. `FortiMail User Portal`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later. +2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. + - **Application**: provide a descriptive name (for example, `FortiMail User Portal`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - - Set the **ACS URL** to `https://fortimailuser.company/sp2/sso/SAML2/POST`. - - Set the **Audience** to `https://fortimailuser.company/sp`. - - Under **Advanced protocol settings**, choose any available certificate as the **Signing Certificate** and enable **Sign Assertions**. Ensure `authentik default SAML Mapping: Email` is selected as a **Selected User Property Mapping**; other mappings are optional and can be removed if not needed. - - **Configure Bindings** _(optional)_: create a [binding](/docs/add-secure-apps/bindings-overview/) to control which end users see the FortiMail webmail application on the **Application Dashboard** page. - -3. Click **Submit** to save the application and provider. + - Temporarily set the **ACS URL** to `https://temp.temp`. + - Temporarily set the **Audience** to `https://temp.temp`. + - Under **Advanced protocol settings**, select any available certificate as the **Signing Certificate**. + - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. +3. Click **Create Application** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section (e.g. `Provider for FortiMail User Portal`). -3. Under **Related objects** > **Metadata**, click on **Download**. This downloaded file is your metadata file and it will be required in the next section. +2. Navigate to **Applications** > **Providers** and click the name of the provider that you created in the previous section (for example, `Provider for FortiMail User Portal`). +3. Under **Related objects** > **Metadata**, click **Download**. This file is required in the next section. ## FortiMail configuration 1. Sign in to the FortiMail admin interface. -2. Navigate to **System** > **Single Sign On** and select the **Setting** tab. -3. Enable **Use different service provider for admin and webmail access**, and select the **Webmail** service provider. -4. For the user/webmail service provider, note the values that FortiMail displays (the ACS field is read-only): - - **Entity ID**: `https://fortimailuser.company/sp` - - **Assertion consumer service (ACS) URL**: replace the host portion with `fortimailuser.company` (for example, `https://fortimailuser.company/sp2/sso/SAML2/POST`) +2. Navigate to **System** > **Single Sign On** and open the **Profile** tab. +3. Create a new SSO profile and configure the following settings: + - **Profile name**: enter a descriptive name (for example, `authentik-webmail`). + - **Metadata**: upload the authentik metadata file that you downloaded in the previous section. + - **Attribute used to identify email address**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` +4. Click **Create** or **OK** to save the SSO profile. +5. Open the **Setting** tab and enable **Single sign-on**. +6. Enable **Use different service provider for admin and webmail access**, and then select **Webmail** as the service provider metadata target. +7. In the **Service Provider Metadata** section, configure the following values: + - **Entity ID**: `https://fortimailuser.company/sp2` + - **Host name**: `fortimailuser.company` +8. Click **Apply**. +9. Copy the following FortiMail service provider values: + - **Entity ID** + - **ACS URL** -Ensure that these values match those configured in authentik. If not, update the values in authentik and re-download the [authentik metadata file](#download-metadata-file). +### Reconfigure the authentik provider -5. Upload the authentik SAML metadata file you downloaded in the previous step. -6. On the **Profile** tab for the user/webmail provider, set **Attribute used to identify email address** to `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`. +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click the provider that you created for the FortiMail User Portal. +3. Click **Edit**. +4. Under **Protocol settings**, set the following values: + - **ACS URL**: paste the **ACS URL** value from FortiMail. + - **Audience**: paste the **Entity ID** value from FortiMail. +5. Click **Update**. + +### Configure webmail access + +1. In the FortiMail admin interface, navigate to **Domain & Users** > **Domain** and edit the domain that should use SSO. +2. Open **Advanced Setting** > **Other** and set **Webmail single sign on** to the SSO profile that you created for authentik. ### Enforce SSO-only access (optional) -To require SSO for FortiMail User Portal logins: +To show only SSO on the webmail login page, run the following commands in the FortiMail CLI: -1. Sign in to the FortiMail admin interface. -2. Navigate to **Domain & Users** > **Domain**, edit the domain entry, then open **Advanced Setting** > **Other** and set **Webmail single sign on** to the SSO profile you created for end users. +```shell +config system appearance +set webmail-sso-login-option sso-only +end +``` ## Configuration verification -1. Open a new browser session (or private window) and navigate to the relevant FortiMail portal (admin or user). -2. Initiate the SSO login flow (this happens automatically if you enabled the SSO-only options) and confirm that you are redirected to authentik for authentication. Sign in with an account permitted to use that portal. -3. After successful authentication, verify that you return to the FortiMail portal without being prompted for additional credentials. +To confirm that authentik is properly configured with FortiMail, open the FortiMail portal that you configured and start the SSO login flow. After authenticating with authentik, verify that you return to FortiMail without being prompted for additional credentials. + +## Resources + +- [Fortinet - FortiMail](https://www.fortinet.com/products/email-security) +- [Fortinet Docs - Configuring single sign-on (SSO)](https://docs.fortinet.com/document/fortimail/8.0.0/administration-guide/73231/configuring-single-sign-on-sso) +- [Fortinet Docs - FortiMail Cloud Configuring single sign-on (SSO)](https://docs.fortinet.com/document/fortimail-cloud/1.0.0/fortimail-cloud-administration-guide/73231/configuring-single-sign-on-sso) +- [Fortinet Docs - system saml](https://docs.fortinet.com/document/fortimail/8.0.0/cli-reference/856423/system-saml) +- [Fortinet Docs - system appearance](https://docs.fortinet.com/document/fortimail/7.4.3/cli-reference/523895/system-appearance) diff --git a/website/integrations/security/hashicorp-vault/index.md b/website/integrations/security/hashicorp-vault/index.md index f31df5dab4..9f14ceac9c 100644 --- a/website/integrations/security/hashicorp-vault/index.md +++ b/website/integrations/security/hashicorp-vault/index.md @@ -4,6 +4,8 @@ sidebar_label: HashiCorp Vault support_level: authentik --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is HashiCorp Vault? > HashiCorp Vault secures, stores, and controls access to tokens, passwords, certificates, encryption keys, and other sensitive data. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of HashiCorp Vault with authentik, you need to create an application and provider pair in authentik. ### Create an application and provider @@ -33,7 +37,7 @@ To support the integration of HashiCorp Vault with authentik, you need to create - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set two `Strict` redirect URIs to `https://vault.company/ui/vault/auth/oidc/oidc/callback` and `http://localhost:8250/oidc/callback`. + - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://vault.company/ui/vault/auth/oidc/oidc/callback` and `http://localhost:8250/oidc/callback`. - Select any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. diff --git a/website/integrations/security/vaultwarden/index.md b/website/integrations/security/vaultwarden/index.md index a039ae91e5..9b588144d8 100644 --- a/website/integrations/security/vaultwarden/index.md +++ b/website/integrations/security/vaultwarden/index.md @@ -4,6 +4,8 @@ sidebar_label: Vaultwarden support_level: community --- +import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx"; + ## What is Vaultwarden? > Vaultwarden is an alternative server implementation of the Bitwarden Client API, written in Rust and compatible with official Bitwarden clients, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal. @@ -23,6 +25,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of Vaultwarden with authentik, you need to create an application/provider pair in authentik. ### Create custom scope mapping @@ -53,7 +57,7 @@ Vaultwarden requires the email scope to return either `email_verified: True` or - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - - Set a `Strict` redirect URI to `https://vaultwarden.company/identity/connect/oidc-signin`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://vaultwarden.company/identity/connect/oidc-signin`. - Select any available signing key. - Under **Advanced protocol settings**: - Set **Access token validity** to more than 5 minutes. diff --git a/website/integrations/security/xcreds/index.mdx b/website/integrations/security/xcreds/index.mdx index 81be6f33d9..baaf24a556 100644 --- a/website/integrations/security/xcreds/index.mdx +++ b/website/integrations/security/xcreds/index.mdx @@ -4,6 +4,8 @@ sidebar_label: XCreds support_level: community --- +import RedirectURI20265Note from "../../_redirect-uri-2026-5-note.mdx"; + ## What is XCreds? > XCreds is an open source project for synchronizing IdP passwords with macOS login passwords. XCreds replaces the macOS login window to provide authentication to the cloud provider; a user enters their cloud password for authentication and XCreds keeps the local Mac password synchronized with the cloud password. @@ -26,6 +28,8 @@ This documentation lists only the settings that you need to change from their de ## authentik configuration + + To support the integration of XCreds with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik @@ -36,7 +40,7 @@ To support the integration of XCreds with authentik, you need to create an appli - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - - Set a `Strict` redirect URI to `https://127.0.0.1/xcreds`. + - Add a **Redirect URI** of type `Strict` `Authorization` as `https://127.0.0.1/xcreds`. - Select any available signing key. - Under **Advanced protocol settings**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to **Selected Scopes**. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. diff --git a/website/package-lock.json b/website/package-lock.json index e3d5eedd60..d5921e608b 100644 --- a/website/package-lock.json +++ b/website/package-lock.json @@ -38,9 +38,9 @@ "npm": ">=11.14.1" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40", @@ -213,9 +213,9 @@ "typescript": "^6.0.3" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40", @@ -279,7 +279,7 @@ "fast-glob": "^3.3.3", "remark-directive": "^4.0.0", "remark-github": "^12.0.0", - "semver": "^7.8.1", + "semver": "^7.8.2", "typescript": "^6.0.3", "unist-util-visit": "^5.0.0" } @@ -6298,9 +6298,9 @@ } }, "node_modules/@rspack/binding-darwin-arm64": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.4.tgz", - "integrity": "sha512-0Q1QXFEsZfDc4opiDnb8q50KlBbC2VovViDaYlMJZBzvjAo325mh3itXPfz7YZ31M+TxRE7TUiJXH3ltiV1Hdg==", + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.6.tgz", + "integrity": "sha512-0giCKiWlBfcM4i2scv1j2k9HlSecO9Ybhaa5wsMUyvcFeKr9HbNHh7C2eDFlC6zaI85IUdY71TXF/g/Tcxr9MA==", "cpu": [ "arm64" ], @@ -6324,9 +6324,9 @@ ] }, "node_modules/@rspack/binding-linux-arm64-gnu": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.4.tgz", - "integrity": "sha512-BEk6mIYBK4BihW9qXXITJORrVXecTlkRjrqhgefili4xjXtLdcUnxAm9sN/2oJ8m378n2h33qDh4gr2orPBFWQ==", + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.6.tgz", + "integrity": "sha512-H6ACzeM1KBxYDEF8YAim3501Jb1aCsSG79Gjm1M4pwJ5OJPK2ydiJEa438ugXmh0962eKYMHI2yZY0sQq8txaw==", "cpu": [ "arm64" ], @@ -6356,9 +6356,9 @@ ] }, "node_modules/@rspack/binding-linux-x64-gnu": { - "version": "2.0.4", - "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.4.tgz", - "integrity": "sha512-xHorBPBZAg0Pn9Q0k9dWZ9euowieDxcSOzQ9JhTCmhDY6wZH5M/kCBFlCs/OQeW5/NUArW3x3MwEdO/0QJHMxg==", + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.6.tgz", + "integrity": "sha512-rerCAz022zf0ewxI+7n3SrqLEaxCL+MXRxKjK5FLUGFa8UkIrivq+VUP/1OB6JLh2Bucebc7Y9WoWHvtk22mLA==", "cpu": [ "x64" ], @@ -22765,9 +22765,9 @@ } }, "node_modules/semver": { - "version": "7.8.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.1.tgz", - "integrity": "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==", + "version": "7.8.2", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.2.tgz", + "integrity": "sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ==", "license": "ISC", "bin": { "semver": "bin/semver.js" diff --git a/website/package.json b/website/package.json index b874c75b17..1c52cc7d3e 100644 --- a/website/package.json +++ b/website/package.json @@ -36,9 +36,9 @@ "typescript-eslint": "^8.59.3" }, "optionalDependencies": { - "@rspack/binding-darwin-arm64": "2.0.4", - "@rspack/binding-linux-arm64-gnu": "2.0.4", - "@rspack/binding-linux-x64-gnu": "2.0.4", + "@rspack/binding-darwin-arm64": "2.0.6", + "@rspack/binding-linux-arm64-gnu": "2.0.6", + "@rspack/binding-linux-x64-gnu": "2.0.6", "@swc/core-darwin-arm64": "1.15.40", "@swc/core-linux-arm64-gnu": "1.15.40", "@swc/core-linux-x64-gnu": "1.15.40",