mirror of
https://github.com/goauthentik/authentik
synced 2026-04-30 11:27:15 +02:00
website: fix typos (#20996)
This commit is contained in:
Dominic R
@@ -13,7 +13,7 @@ The following placeholders are used in this guide:
|
||||
- `REALM.COMPANY` is the Kerberos realm.
|
||||
- `authentik.company` is the FQDN of the authentik install.
|
||||
|
||||
Examples are shown for an MIT Krb5 KDC system; you might need to adapt them for you Kerberos installation.
|
||||
Examples are shown for an MIT Krb5 KDC system; you might need to adapt them for your Kerberos installation.
|
||||
|
||||
There are three ways to use the Kerberos source:
|
||||
|
||||
@@ -21,7 +21,7 @@ There are three ways to use the Kerberos source:
|
||||
- As a directory source, where users are synced from the KDC.
|
||||
- With SPNEGO, where users can log in to authentik with their [browser](./browser.md) and their Kerberos credentials.
|
||||
|
||||
You can choose to use one or several of those methods.
|
||||
You can choose to use one or more of those methods.
|
||||
|
||||
## Common settings
|
||||
|
||||
@@ -62,7 +62,7 @@ In authentik, configure these extra options:
|
||||
- Sync principal: `authentik/admin@REALM.COMPANY`
|
||||
- Sync keytab: the base64-encoded keytab created above.
|
||||
|
||||
If you do not wish to use a keytab, you can also configure authentik to authenticate using a password, or an existing credentials cache.
|
||||
If you do not wish to use a keytab, you can also configure authentik to authenticate using a password or an existing credentials cache.
|
||||
|
||||
## SPNEGO
|
||||
|
||||
@@ -85,7 +85,7 @@ If you do not wish to use a keytab, you can also configure authentik to use an e
|
||||
|
||||
You can also override the SPNEGO server name if needed.
|
||||
|
||||
You might need to configure your web browser to allow SPNEGO. Check out [our documentation](./browser.md) on how to do so. You can now login to authentik using SPNEGO.
|
||||
You might need to configure your web browser to allow SPNEGO. Check out [our documentation](./browser.md) on how to do so. You can now log in to authentik using SPNEGO.
|
||||
|
||||
### Custom server name
|
||||
|
||||
@@ -113,7 +113,7 @@ Kerberos property mappings are used when you define a Kerberos source. These map
|
||||
- authentik default Kerberos User Mapping: Add realm as group
|
||||
The realm of the user will be added as a group for that user.
|
||||
- authentik default Kerberos User Mapping: Ignore other realms
|
||||
Realms other than the one configured on the source are ignored, and log in is not allowed.
|
||||
Realms other than the one configured on the source are ignored, and logging in is not allowed.
|
||||
- authentik default Kerberos User Mapping: Ignore system principals
|
||||
System principals such as `K/M` or `kadmin/admin` are ignored.
|
||||
- authentik default Kerberos User Mapping: Multipart principals as service accounts
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
title: LDAP Source
|
||||
---
|
||||
|
||||
Sources allow you to connect authentik to an existing user directory. This source allows you to import users and groups from an LDAP Server.
|
||||
Sources allow you to connect authentik to an existing user directory. This source allows you to import users and groups from an LDAP server.
|
||||
|
||||
:::info
|
||||
For Active Directory, follow the [Active Directory Integration](../../directory-sync/active-directory/index.md)
|
||||
@@ -49,7 +49,7 @@ To create or edit a source in authentik, open the Admin interface and navigate t
|
||||
- **Additional Group DN**: Prepended to the base DN for group queries.
|
||||
- **User object filter**: Consider objects matching this filter to be users.
|
||||
- **Group object filter**: Consider objects matching this filter to be groups.
|
||||
- **Lookup using a user attribute**: Acquire group membership from a User object attribute (`memberOf`) instead of a Group attribute (`member`). This works with directories with nested groups memberships (Active Directory, RedHat IDM/FreeIPA), using `memberOf:1.2.840.113556.1.4.1941:` as the group membership field.
|
||||
- **Lookup using a user attribute**: Acquire group membership from a User object attribute (`memberOf`) instead of a Group attribute (`member`). This works with directories with nested group memberships (Active Directory, RedHat IDM/FreeIPA), using `memberOf:1.2.840.113556.1.4.1941:` as the group membership field.
|
||||
- **Group membership field**: The user object attribute or the group object attribute that determines the group membership for a user. If **Lookup using a user attribute** is set, this should be a user object attribute, otherwise a group object attribute.
|
||||
- **User membership attribute**: Attribute name on authentik user objects which is checked against the **Group membership field**. Two common cases are:
|
||||
- If your groups have `member` attributes containing DNs, set this to `distinguishedName`. (The `distinguishedName` attribute for User objects in authentik is set automatically.)
|
||||
@@ -62,7 +62,7 @@ See the [overview](../../property-mappings/index.md) for information on how prop
|
||||
|
||||
By default, authentik ships with [pre-configured mappings](#built-in-property-mappings) for the most common LDAP setups. These mappings can be found on the LDAP Source Configuration page in the Admin interface.
|
||||
|
||||
You can assign the value of a mapping to any user attribute. Keep in mind though, data types from the LDAP server will be carried over. This means that with some implementations, where fields are stored as array in LDAP, they will be saved as array in authentik. To prevent this, use the built-in `list_flatten` function. Here is an example mapping for the user's username and a custom attribute for a phone number:
|
||||
You can assign the value of a mapping to any user attribute. Keep in mind, though, data types from the LDAP server will be carried over. This means that with some implementations, where fields are stored as an array in LDAP, they will be saved as an array in authentik. To prevent this, use the built-in `list_flatten` function. Here is an example mapping for the user's username and a custom attribute for a phone number:
|
||||
|
||||
```python
|
||||
return {
|
||||
@@ -75,7 +75,7 @@ return {
|
||||
|
||||
### Built-in property mappings
|
||||
|
||||
LDAP property mappings are used when you define a LDAP source. These mappings define which LDAP property maps to which authentik property. By default, the following mappings are created:
|
||||
LDAP property mappings are used when you define an LDAP source. These mappings define which LDAP property maps to which authentik property. By default, the following mappings are created:
|
||||
|
||||
- `authentik default Active Directory Mapping: givenName`
|
||||
- `authentik default Active Directory Mapping: sAMAccountName`
|
||||
@@ -97,7 +97,7 @@ The following variables are available to LDAP source property mappings:
|
||||
|
||||
### Additional expression semantics
|
||||
|
||||
If you need to skip synchronization for a specific object, you can raise the `SkipObject` exception. To do so, create or modify a LDAP property mapping to use an expression to define the object to skip.
|
||||
If you need to skip synchronization for a specific object, you can raise the `SkipObject` exception. To do so, create or modify an LDAP property mapping to use an expression to define the object to skip.
|
||||
|
||||
**Example:**
|
||||
|
||||
|
||||
@@ -2,13 +2,13 @@
|
||||
title: SCIM Source
|
||||
---
|
||||
|
||||
The SCIM source allows other applications to directly create users and groups within authentik. SCIM provides predefined schema for users and groups, with a RESTful API, to enable automatic user provisioning and deprovisioning, SCIM is supported by applications such as Microsoft Entra ID, Google Workspace, and Okta.
|
||||
The SCIM source allows other applications to directly create users and groups within authentik. SCIM provides a predefined schema for users and groups, along with a RESTful API, to enable automatic user provisioning and deprovisioning. SCIM is supported by applications such as Microsoft Entra ID, Google Workspace, and Okta.
|
||||
|
||||
The base SCIM URL is in the format of `https://authentik.company/source/scim/<source-slug>/v2`. Authentication is done via Bearer tokens that are generated by authentik. When an SCIM source is created, a service account is created and a matching token is provided.
|
||||
|
||||
## First steps
|
||||
|
||||
To set up an SCIM source, log in as an administrator into authentik. Navigate to **Directory->Federation & Social login**, and click on **Create**. Select the **SCIM Source** type, and give the source a name.
|
||||
To set up an SCIM source, log in to authentik as an administrator. Navigate to **Directory->Federation & Social login**, and click on **Create**. Select the **SCIM Source** type, and give the source a name.
|
||||
|
||||
After the source is created, click on the name of the source in the list, and you will see the **SCIM Base URL** which is used by the SCIM client. Use the **Click to copy token** button to copy the token which is used by the client to authenticate SCIM requests.
|
||||
|
||||
@@ -22,7 +22,7 @@ Endpoint to list, create, update and delete users.
|
||||
|
||||
Endpoint to list, create, update and delete groups.
|
||||
|
||||
There is also the `/v2/ServiceProviderConfig` and `/v2/ResourceTypes`, which is used by SCIM-enabled applications to find out which features authentik supports.
|
||||
There are also `/v2/ServiceProviderConfig` and `/v2/ResourceTypes`, which are used by SCIM-enabled applications to find out which features authentik supports.
|
||||
|
||||
## SCIM source property mappings
|
||||
|
||||
@@ -30,7 +30,7 @@ See the [overview](../../property-mappings/index.md) for information on how prop
|
||||
|
||||
### Expression data
|
||||
|
||||
Each top level SCIM attribute is available as a variable in the expression. For example given an SCIM request with the payload of
|
||||
Each top-level SCIM attribute is available as a variable in the expression. For example, given a SCIM request with the payload of
|
||||
|
||||
<!-- prettier-ignore-start -->
|
||||
```json
|
||||
@@ -70,5 +70,5 @@ The following variables are available in the expression:
|
||||
- `urn_scim_schemas_extension_enterprise_2_0` as a dictionary
|
||||
|
||||
:::info
|
||||
Top-level keys which include symbols not allowed in python syntax are converted to `_`.
|
||||
Top-level keys which include symbols not allowed in Python syntax are converted to `_`.
|
||||
:::
|
||||
|
||||
Reference in New Issue
Block a user