mirror of
https://github.com/goauthentik/authentik.git
synced 2026-06-17 19:09:11 +03:00
Dominic R
899994027d
* core: add hash_password command and password_hash bootstrap support * core: prevent hash format exposure in validation error * core: remove redundant password length check * core: remove extra blank lines from hash_password command * core: add password_hash serializer tests, refine validation and imports * core: add null password fields test, add hash warning to docs * core: move hash validation to User.set_password_from_hash method * core: emit password_changed signal in set_password_from_hash * website: remove redundant hash security warning * core: wrap conflict error message for translation * core: wrap invalid hash error message for translation * web, core: add set_password_hash API endpoint and admin UI * core: simplify password_hash check to None comparison * core: use None check for password conflict validation * website: clarify Docker Compose $ escaping for .env vs compose.yml * website: lint * web: lint * core: add nosec comment for empty password string in signal * core: lint * web: Fix Password Hash help text * sources/kerberos,ldap: Gergo's review * add testing for ^^ and type fix * more general signal tests; not provider specific * only used in tests * add warning * we can do this * signals fix???? * core, web, website: review fixes * style(docs): format automated install guide * web: restore modal invoker import after rebase Co-authored-by: Codex <codex@openai.com> * fix generated clients * core: trim hash password command tests * core: add password hash permission * core: cover service account password hashes * web: remove password hash form * core: regenerate password hash migration * core: reuse password serializer for hashes * docs: clarify hashed password imports * Regenerate * core: deduplicate user serializer writes * core: deduplicate password update actions * core: deduplicate password change signaling * tests: reuse password hash API helper * tests: reuse SSF credential assertions * docs: centralize hashed password caveat * core: name password hash signal source * core: centralize password hash validation * core: deduplicate serializer password saves * docs: link source writeback caveats * api: clarify password hash request field * tests: deduplicate password hash API assertions * web: reuse user display-name helper * web: use existing user display formatter * core: reuse reset password permission for hash endpoint * core: keep separate password hash serializer * tests: remove redundant password hash permission test * 21745 Co-authored-by: Gergo <gergo@goauthentik.io> * core: preserve empty password handling in user serializer * core: inline blueprint user serializer fields * Use password hash constant * Simplify user serializer flow * Inline password update handling * Apply serializer cleanup * Clean blueprint password handling * Drop extra returns * Split password hash signal * Align hash signal receivers * Remove stale password guards * Inline password signal --------- Co-authored-by: Codex <codex@openai.com> Co-authored-by: Gergo <gergo@goauthentik.io>
99 lines
4.0 KiB
Plaintext
99 lines
4.0 KiB
Plaintext
---
|
|
title: Automated install
|
|
---
|
|
|
|
To install authentik automatically (skipping the Out-of-box experience), you can use the following environment variables on the worker container:
|
|
|
|
:::info
|
|
These can't be defined using the file-based syntax (`file://`), so you can't pass them in as secrets in a Docker Compose installation.
|
|
:::
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`
|
|
|
|
Configure the default password for the `akadmin` user using a pre-hashed Django password value. Only read on the first startup.
|
|
|
|
This stores the hash directly as authentik's local password verifier. Because authentik never sees the raw password, hashed-password imports do not propagate the password to LDAP or Kerberos integrations, even when password writeback is enabled.
|
|
|
|
To generate a hash, run this command before your initial deployment:
|
|
|
|
```bash
|
|
docker compose run --rm server hash_password 'your-password'
|
|
```
|
|
|
|
The generated hash includes a random salt, so running the command multiple times for the same password produces different output. Use the complete output as the value of `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.
|
|
|
|
:::warning Escaping `$` in Docker Compose
|
|
Password hashes contain `$` characters which Docker Compose interprets as variable references.
|
|
|
|
**In `.env` files**, use single quotes to prevent interpolation:
|
|
|
|
```bash
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD_HASH='pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM='
|
|
```
|
|
|
|
**In `docker-compose.yml`** (inline environment), escape each `$` with `$$`:
|
|
|
|
```yaml
|
|
services:
|
|
worker:
|
|
environment:
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD_HASH: "pbkdf2_sha256$$1000000$$xKKFuYtJEE27km09BD49x2$$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
|
|
```
|
|
|
|
See the Docker Compose documentation on [`.env` file interpolation](https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/) and [Compose file interpolation](https://docs.docker.com/reference/compose-file/interpolation/) for details.
|
|
:::
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_PASSWORD`
|
|
|
|
:::warning
|
|
This option stores plaintext passwords in environment variables. Use [`AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`](#authentik_bootstrap_password_hash) instead.
|
|
:::
|
|
|
|
Configure the default password for the `akadmin` user. Only read on the first startup.
|
|
|
|
Setting both `AUTHENTIK_BOOTSTRAP_PASSWORD` and `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH` will result in an error.
|
|
|
|
### Other hashed-password import paths
|
|
|
|
For post-install automation, hashed passwords can also be set via blueprints with the `password_hash` user attribute, or via the `/api/v3/core/users/<id>/set_password_hash/` API endpoint with the hash provided in the `password` field. The API endpoint requires the `authentik_core.reset_user_password` permission and can target regular users or service accounts.
|
|
|
|
These paths share the same local-verifier-only behavior as `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_TOKEN`
|
|
|
|
Create a token for the default `akadmin` user. Only read on the first startup. The string you specify for this variable is the token key you can use to authenticate yourself to the API.
|
|
|
|
### `AUTHENTIK_BOOTSTRAP_EMAIL`
|
|
|
|
Set the email address for the default `akadmin` user.
|
|
|
|
## Kubernetes
|
|
|
|
In the Helm values, set the `akadmin` user password hash and token:
|
|
|
|
```yaml
|
|
authentik:
|
|
bootstrap_password_hash: "pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
|
|
bootstrap_token: "your-token-here"
|
|
bootstrap_email: "admin@authentik.company"
|
|
```
|
|
|
|
:::note Helm escaping
|
|
When using password hashes in quoted YAML strings as shown above, no escaping of `$` characters is required. The `$` character only needs escaping when:
|
|
|
|
- Using Helm templating syntax (e.g., `{{ .Values.something }}`) where `$` has special meaning
|
|
- Referencing values from environment variable substitution in your values file
|
|
|
|
:::
|
|
|
|
Or store the password hash in a secret and reference it via `envFrom`:
|
|
|
|
```yaml
|
|
global:
|
|
envFrom:
|
|
- secretRef:
|
|
name: _some-secret_
|
|
```
|
|
|
|
where _some-secret_ contains the environment variables as documented above.
|