eliott/authentik
1
0
Fork 0
mirror of https://github.com/goauthentik/authentik synced 2026-04-25 17:15:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

website/docs: Modal and wizard button labels (#21549)

Browse Source 
* website/integrations: rename "Create with Provider" to "New Application"

The application list page now uses a split-button labeled
"New Application" instead of the old "Create with Provider" dropdown.
Update all 113 integration guides to match.

* website/docs: update flow, stage, and policy button labels

- "Create" → "New Flow", "New Stage", "New Policy" for trigger buttons
- "Finish" → "Create Flow", "Create Stage", "Create Policy" for submit
- "Create and bind stage" → "New Stage" / "Bind Existing Stage"
- "Create" (binding submit) → "Create Stage Binding"

* website/docs: update provider button labels

- "Create" → "New Provider" for trigger buttons
- "Create with Provider" → "New Application" in RAC docs
- "Create" → "New Property Mapping", "New RAC Endpoint", "New Prompt"
  for related entity creation

* website/docs: update directory button labels

- "Create" → "New Source" for federation/social login pages
- "Create" → "New Role", submit → "Create Role"
- "Create" → "New Invitation"
- Policy binding submit → "Create Policy Binding"

* website/docs: update endpoint device and system management button labels

- "Create" → "New Endpoint Connector", "New Enrollment Token",
  "New Device Access Group", "New Flow"
- Submit → "Create Device Access Group"
- "Create" → "New Notification Rule", "New Notification Transport"
- Binding submit → "Create Policy Binding"

* Reorganize policy documentation

* website/docs: address policy docs review feedback

* post-rebase

* website/docs: Reorganize policy documentation -- Revisions (#21601)

* apply suggestions

* Fix escaped.

* Fix whitespace.

* Update button label.

* Fix phrasing.

* Fix phrasing.

* Clean up stragglers.

* Format.

---------

Co-authored-by: Dominic R <dominic@sdko.org>
This commit is contained in:
Teffen Ellis
2026-04-16 19:35:38 +02:00
committed by GitHub
parent b6496950bf
commit 6ed5cb5249
176 changed files with 261 additions and 261 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
website/docs/add-secure-apps/applications/manage_apps.mdx
View File

@@ -10,7 +10,7 @@ To add an application to authentik and have it display on users' **My applicatio
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications > Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can create only an application, without a provider, by clicking **Create.)**
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. Alternatively, you can first create a provider separately, then create the application and connect it to the provider.
3. In the **New application** box, define the application details, the provider type and configuration settings, and bindings for the application.
- **Application**: provide a name, an optional group for the type of application, the policy engine mode, and optional UI settings.
@@ -96,10 +96,10 @@ return {
1. Open the Admin interface and navigate to **Applications > Applications**.
2. Click the name of the application for which you want to create an entitlement.
3. Click the **Application entitlements** tab at the top of the page, and then click **Create entitlement**. Provide a name for the entitlement, enter any optional **Attributes**, and then click **Create**.
3. Click the **Application entitlements** tab at the top of the page, and then click **New Entitlement**. Provide a name for the entitlement, enter any optional **Attributes**, and then click **Create**.
4. In the list locate the entitlement to which you want to bind a user or group, and then **click the caret (>) to expand the entitlement details.**
5. In the expanded area, click **Bind existing Group/User**.
6. In the **Create Binding** box, select either the tab for **Group** or **User**, and then in the drop-down list, select the group or user.
6. In the **New Binding** box, select either the tab for **Group** or **User**, and then in the drop-down list, select the group or user.
7. Optionally, configure additional settings for the binding, and then click **Create** to create the binding and close the box.
## Hide applications

2
website/docs/add-secure-apps/flows-stages/stages/authenticator_email/index.md
View File

@@ -14,7 +14,7 @@ The email address will be saved and can be used with the [Authenticator validati
To use the Email Authenticator Setup stage in a flow, follow these steps:
1. [Create](../../flow/index.md#create-a-flow) a new flow or edit an existing one.
2. On the flow's **Stage Bindings** tab, click **Create and bind stage** to create and add the Email Authenticator Setup stage. (If the stage already exists, click **Bind existing stage**.)
2. On the flow's **Stage Bindings** tab, click **New Stage** to create and add the Email Authenticator Setup stage. (If the stage already exists, click **Bind Existing Stage**.)
3. Configure the stage settings as described below.
- **Name**: provide a descriptive name, such as Email Authenticator Setup.
- **Authenticator type name**: define the display name for this stage.

2
website/docs/add-secure-apps/flows-stages/stages/captcha/index.md
View File

@@ -48,7 +48,7 @@ See https://developers.cloudflare.com/turnstile/get-started/migrating-from-recap
#### Configuration options
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Stages** and click **Create**.
2. Navigate to **Flows and Stages** > **Stages** and click **New Stage**.
3. Select **Captcha Stage** and click **Next**.
4. Provide a descriptive name for the stage (e.g. `authentication-captcha`) and configure the following required settings based on the values of your [Cloudflare Turnstile Widget](https://developers.cloudflare.com/turnstile/concepts/widget/):
- Under **Stage-specific settings**:

6
website/docs/add-secure-apps/flows-stages/stages/index.md
View File

@@ -41,7 +41,7 @@ To create a stage, follow these steps:
1. Log in as an admin to authentik, and go to the Admin interface.
2. In the Admin interface, navigate to **Flows and Stages > Stages**.
3. Click **Create**, define the stage using the configuration settings, and then click **Finish**.
3. Click **New Stage**, select the stage type, define the stage using the configuration settings, and then click **Create Stage**.
After creating the stage, you can then use bindings to determine whether or not the stage will be implemented in the flow.
@@ -65,7 +65,7 @@ To bind a stage to a flow (which adds the stage as a "step" in the flow), follow
2. In the Admin interface, navigate to **Flows and Stages > Flows**.
3. In the list of flows, click the name of the flow to which you want to bind one or more stages.
4. On the Flow page, click the **Stage Bindings** tab at the top.
5. Here, you can decide if you want to create a new stage and bind it to the flow (**Create and bind Stage**), or if you want to select an existing stage and bind it to the flow (**Bind existing stage**).
5. Here, you can decide if you want to create a new stage and bind it to the flow (**New Stage**), or if you want to select an existing stage and bind it to the flow (**Bind Existing Stage**).
### Control access to a stage
@@ -88,6 +88,6 @@ To bind a user or a group to a stage binding for a specific flow, follow these s
6. In the expanded area, click **Bind existing policy/group/user**.
7. In the **Create Binding** box, select either the tab for **Group** or **User**.
8. In the drop-down list, select the group or user.
9. Optionally, configure additional settings for the binding, and then click **Create** to create the binding and close the box.
9. Optionally, configure additional settings for the binding, and then click **Create Stage Binding** to create the binding and close the box.
Learn more about the different types of [bindings](../../bindings-overview/index.md) in authentik and [working with them](../../bindings-overview/work-with-bindings.md).

2
website/docs/add-secure-apps/flows-stages/stages/mtls/index.md
View File

@@ -105,7 +105,7 @@ When using authentik without a reverse proxy, select the certificate authorities
2. Navigate to **System** > **Certificates**, and either generate or add the certificate you’ll use as a certificate authority.
3. Then, navigate to **Flows and Stages** > **Stages** and click **Create**. Select **Mutual TLS Stage**, click **Next**, and set the following fields:
3. Then, navigate to **Flows and Stages** > **Stages** and click **New Stage**. Select **Mutual TLS Stage**, click **Next**, and set the following fields:
- **Name**: provide a descriptive name, such as "chrome-device-trust".
- **Stage-specific settings**:

2
website/docs/add-secure-apps/flows-stages/stages/password/index.md
View File

@@ -7,7 +7,7 @@ This is a generic password prompt that authenticates the current `pending_user`.
## Create a Password stage
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages > Stages** and click **Create**.
2. Navigate to **Flows and Stages > Stages** and click **New Stage**.
3. In the **New Stage** dialog select **Password stage**, and then click **Next**.
4. Provide the following settings:

8
website/docs/add-secure-apps/providers/entra/create-entra-provider.md
View File

@@ -12,9 +12,9 @@ To create an Entra ID provider in authentik, you must have already [configured E
## Create an Entra ID provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **Create**.
2. Navigate to **Applications** > **Providers** and click **New Provider**.
3. Select **Microsoft Entra Provider** as the provider type, then click **Next**.
4. On the **Create Microsoft Entra Provider** page, set the following configurations:
4. On the **New Microsoft Entra Provider** page, set the following configurations:
- **Name**: provide a descriptive name (e.g. `Entra ID provider`)
- Under **Protocol settings**:
- **Client ID**: the Client ID that you copied when [configuring Entra ID](./configure-entra.md)
@@ -38,7 +38,7 @@ To create an Entra ID provider in authentik, you must have already [configured E
## Create an Entra ID application in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications**, click **Create**, and set the following configurations:
2. Navigate to **Applications** > **Applications**, click **New Application**, and set the following configurations:
- **Name**: provide a name for the application (e.g. `Entra ID`)
- **Slug**: enter the name that you want to appear in the URL
- **Provider**: this field should be left empty
@@ -62,7 +62,7 @@ These are limited access accounts that must use email for verification when logg
This is possible via a modified property mapping:
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Property Mappings** and click **Create**.
2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**.
3. Select **Microsoft Entra Provider Mapping** as the property mapping type and click **Next**.
4. Provide a **Name** for the property mapping and set the following **Expression**:

6
website/docs/add-secure-apps/providers/gws/create-gws-provider.md
View File

@@ -12,9 +12,9 @@ To create a Google Workspace provider in authentik, you must have already [confi
## Create a Google Workspace provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **Create**.
2. Navigate to **Applications** > **Providers** and click **New Provider**.
3. Select **Google Workspace Provider** as the provider type, then click **Next**.
4. On the **Create Google Workspace Provider** page, set the following configurations:
4. On the **New Google Workspace Provider** page, set the following configurations:
- **Name**: provide a descriptive name (e.g. `GWS provider`)
- Under **Protocol settings**:
- **Credentials**: paste the contents of the JSON file that you downloaded when [configuring Google Workspace](./configure-gws.md)
@@ -42,7 +42,7 @@ If you have configured the [Google Workspace SAML integration](/integrations/ser
:::
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications**, click **Create**, and set the following configurations:
2. Navigate to **Applications** > **Applications**, click **New Application**, and set the following configurations:
- **Name**: provide a name for the application (e.g. `GWS`)
- **Slug**: enter the name that you want to appear in the URL
- **Provider**: when _not_ used in conjunction with the [Google SAML configuration](/integrations/cloud-providers/google), this should be left empty.

2
website/docs/add-secure-apps/providers/index.mdx
View File

@@ -9,7 +9,7 @@ A Provider is an authentication method, a service that is used by authentik to a
Providers are the "other half" of [applications](../applications/index.md). They typically exist in a 1-to-1 relationship; each application needs a provider and every provider can be used with one application.
You can create a new provider in the Admin interface, or you can use the [**Create with Provider** option](../applications/manage_apps.mdx#create-an-application-and-provider-pair) to create a new application and its provider at the same time.
You can create a new provider in the Admin interface, or you can use the [**New Application** option](../applications/manage_apps.mdx#create-an-application-and-provider-pair) to create a new application and its provider at the same time.
Applications can use additional providers to augment the functionality of the main provider. For more information, see [Backchannel providers](../applications/manage_apps.mdx#backchannel-providers).

6
website/docs/add-secure-apps/providers/ldap/create-ldap-provider.mdx
View File

@@ -61,7 +61,7 @@ Finally, you'll need to create a User Login Stage.
Now you'll need to create the LDAP authentication flow and bind the previously created stages.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**, click **Create**, and set the following required configurations:
2. Navigate to **Flows and Stages** > **Flows**, click **New Flow**, and set the following required configurations:
- Provide a **Name**, **Title** and **Slug** for the flow (e.g. `ldap-authentication-flow`).
- Set **Designation** to `Authentication`.
3. Click **Create**.
@@ -75,7 +75,7 @@ Now you'll need to create the LDAP authentication flow and bind the previously c
The LDAP application and provider can now be created.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications**, click **Create with Provider** to create an application and provider pair.
2. Navigate to **Applications** > **Applications**, click **New Application** to create an application and provider pair.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **LDAP Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure LDAP Provider** page, provide the configuration settings and then click **Submit** to create both the application and the provider.
@@ -117,7 +117,7 @@ The service account needs permissions to search the LDAP directory. You'll need
The LDAP provider requires the deployment of an LDAP [Outpost](../../outposts/index.mdx).
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Outposts**, click **Create** and set the following required configurations:
2. Navigate to **Applications** > **Outposts**, click **New Outpost** and set the following required configurations:
- Provide a **Name** for the outpost (e.g. `LDAP Outpost').
- Set the **Type** as `LDAP`.
- Set **Integration** to match your deployment method or manually deploy an outpost via [Docker-Compose](../../outposts/manual-deploy-docker-compose.md) or [Kubernetes](../../outposts/manual-deploy-kubernetes.md). For more information, refer to the [Outpost documentation](../../outposts/index.mdx).

4
website/docs/add-secure-apps/providers/oauth2/create-oauth2-provider.md
View File

@@ -2,10 +2,10 @@
title: Create an OAuth2 provider
---
To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **Create with provider**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to solely create the provider by navigating to **Applications** > **Providers** and clicking **Create**.
To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **New Provider**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to solely create the provider by navigating to **Applications** > **Providers** and clicking **Create**.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications > Applications** and click **Create with provider** to create an application and provider pair.
2. Navigate to **Applications > Applications** and click **New Provider** to create an application and provider pair.
3. On the **New application** page, define the application settings, and then click **Next**.
4. Select **OAuth2/OIDC** as the **Provider Type**, and then click **Next**.
5. On the **Configure OAuth2/OpenId Provider** page, provide the configuration settings and then click **Submit** to create both the application and the provider.

2
website/docs/add-secure-apps/providers/oauth2/device_code.md
View File

@@ -64,7 +64,7 @@ If the user _has_ finished the authentication and authorization, the response wi
### Create and apply a device code flow
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click **Create**.
2. Navigate to **Flows and Stages** > **Flows** and click **New Flow**.
3. Set the following required configurations:
- **Name**: provide a name (e.g. `default-device-code-flow`)
- **Title**: provide a title (e.g. `Device code flow`)

10
website/docs/add-secure-apps/providers/rac/create-rac-provider.md
View File

@@ -21,10 +21,10 @@ Depending on whether you are connecting using RDP, SSH, or VNC, the exact config
### Create a RAC provider and application pair
To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **Create with Provider**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to create only the provider by navigating to **Applications** > **Providers** and clicking **Create**.
To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **New Application**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to create only the provider by navigating to **Applications** > **Providers** and clicking **New Provider**.
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair.
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select the **RAC** provider type, and then click **Next**.
5. On the **Configure Remote Access Provider** page, provide the configuration settings and then click **Submit** to create both the application and the provider.
@@ -36,9 +36,9 @@ Next, you need to add property mappings for each remote machine you want to acce
Refer to the [RAC Credentials Prompt](./rac_credentials_prompt.md) and [RAC SSH Public Key Authentication](./rac-public-key.md) documentation for alternative methods of handling RAC authentication.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Property Mappings**, and click **Create**.
2. Navigate to **Customization** > **Property Mappings**, and click **New Property Mapping**.
3. Select **RAC Provider Property Mapping** as the property mapping type, and then click **Next**.
4. On the **Create RAC Provider Property Mapping** page, provide the following configuration settings:
4. On the **New RAC Provider Property Mapping** page, provide the following configuration settings:
- **Name**: provide a name for the property mapping
- Under **General settings**:
- **Username**: the username for the remote machine
@@ -55,7 +55,7 @@ Then, you need to create an endpoint corresponding to each remote machine you wa
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Click the **Edit** button on the RAC provider that you previously created.
4. On the Provider page, under **Endpoints**, click **Create**, and provide the following settings:
4. On the Provider page, under **Endpoints**, click **New RAC Endpoint**, and provide the following settings:
- **Provider Name** (endpoint name): define a name for the endpoint
- **Protocol**: select the appropriate protocol
- **Host**: enter the host name or IP address of the remote machine. Optionally include the port.

4
website/docs/add-secure-apps/providers/rac/rac-public-key.md
View File

@@ -60,7 +60,7 @@ The pipe character (`|`) is required to preserve linebreaks in the YAML text. Se
## Apply a private key to an RAC property mapping
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Property Mappings** and click **Create**, then create a **RAC Provider Property Mapping** with the following settings:
2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**, then create a **RAC Provider Property Mapping** with the following settings:
- **Name**: Choose a descriptive name
- Under **Advanced Settings**:
- **Expression**:
@@ -95,7 +95,7 @@ The pipe character (`|`) is required to preserve linebreaks in the YAML text. Se
## Retrieve a private key from a user's attributes and apply it to an RAC property mapping
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **RAC Provider Property Mapping** with the following settings:
2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. Create a **RAC Provider Property Mapping** with the following settings:
- **Name**: Choose a descriptive name
- Under **Advanced Settings**:
- **Expression**:

10
website/docs/add-secure-apps/providers/rac/rac_credentials_prompt.md
View File

@@ -18,7 +18,7 @@ This configurations requires:
## Create a new authorization flow
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**, click **Create**, and enter the following required settings:
2. Navigate to **Flows and Stages** > **Flows**, click **New Flow**, and enter the following required settings:
- **Name**: Enter a descriptive name for the flow.
- **Title**: Enter a title for the flow. This will be displayed to users when they're prompted for their credentials.
- **Slug**: Enter a slug for the flow. This will be displayed in the flow URL.
@@ -29,15 +29,15 @@ This configurations requires:
## Create prompts
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Prompts**, click **Create**, and enter the following required settings:
2. Navigate to **Flows and Stages** > **Prompts**, click **New Prompt**, and enter the following required settings:
- **Name**: Enter a descriptive name for the prompt (e.g. `username`).
- **Field Key**: `connection_settings.username`
- **Label**: Enter a label for the field which will be displayed above it.
- **Type**: `Text`
- **Required**: Toggled on.
- **Order**: `0`
3. Click **Create** to save the prompt.
4. On the **Prompts** page, click **Create** again, and enter the following required settings:
3. Click **Create Prompt** to save the prompt.
4. On the **Prompts** page, click **New Prompt** again, and enter the following required settings:
- **Name**: Enter a descriptive name for the prompt (e.g. `password`).
- **Field Key**: `connection_settings.password`
- **Label**: Enter a label for the field which will be displayed above it.
@@ -55,7 +55,7 @@ You can optionally add other prompt fields such as `domain` (e.g. `connection_se
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**.
3. Click the name of the newly created authorization flow.
4. Click on **Stage bindings**, click **Create and bind stage**, and enter the following required settings:
4. Click on **Stage bindings**, click **New Stage**, and enter the following required settings:
- **Select Type**: Select `Prompt stage` as the prompt type.
- **Create Prompt Stage**:
- **Name**: Enter a name for the prompt stage.

12
website/docs/add-secure-apps/providers/saml/create-saml-provider.md
View File

@@ -6,10 +6,10 @@ authentik SAML providers can be created either from scratch or by using SAML met
## Create a SAML provider and application pair
To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **Create with provider**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to solely create the provider by navigating to **Applications** > **Providers** and clicking **Create**.
To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **New Provider**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to solely create the provider by navigating to **Applications** > **Providers** and clicking **Create**.
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with provider** to create an application and provider pair.
2. Navigate to **Applications** > **Applications** and click **New Provider** to create an application and provider pair.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **SAML Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure SAML Provider** page, provide the configuration settings and then click **Submit** to create both the application and the provider.
@@ -19,9 +19,9 @@ To create a provider along with the corresponding application that uses it for a
If you have exported SAML metadata from your SP, you can optionally create the authentik SAML provider by importing this metadata.
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **Create** to create a provider.
2. Navigate to **Applications** > **Providers** and click **New Provider** to create a provider.
3. Select **SAML Provider from Metadata** as the **Provider Type**, and then click **Next**.
4. On the **Create SAML Provider from Metadata** page, provide the configuration settings along with an SP metadata file and then click **Finish** to create the provider.
4. On the **New SAML Provider from Metadata** page, provide the configuration settings along with an SP metadata file and then click **Finish** to create the provider.
5. (Optional) Edit the created SAML provider and configure any further settings.
## Export authentik SAML provider metadata
@@ -33,7 +33,7 @@ After an authentik SAML provider has been created via any of the above methods,
To download the metadata of an authentik SAML provider, follow these steps:
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
2. Navigate to **Applications** > **Providers**.
3. Click the name of the provider you want metadata from to open its overview tab.
4. In the **Related objects** section, under **Metadata** click on **Download**. This will download the metadata XML file for that provider.
@@ -42,7 +42,7 @@ To download the metadata of an authentik SAML provider, follow these steps:
To view and optionally download the metadata of an authentik SAML provider, follow these steps:
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
2. Navigate to **Applications** > **Providers**.
3. Click the name of the provider you want metadata from to open its overview tab.
4. Navigate to the **Metadata** tab.
5. The metadata for the provider will be shown in a codebox. You can optionally use the **Download** button to obtain the metadata as a file.

10
website/docs/add-secure-apps/providers/ssf/create-ssf-provider.md
View File

@@ -16,22 +16,22 @@ Follow this workflow to create and configure an SSF provider for an application:
## Create the SSF provider
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **Create** to create a provider.
2. Navigate to **Applications** > **Providers** and click **New Provider** to create a provider.
3. Select **Shared Signals Framework Provider** as the **Provider Type**, and then click **Next**.
4. On the **Create SSF Provider** page, provide the configuration settings. Be sure to select a **Signing Key**.
4. On the **New SSF Provider** page, provide the configuration settings. Be sure to select a **Signing Key**.
5. Click **Finish** to create the provider.
## Create the OIDC provider
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **Create** to create a provider.
2. Navigate to **Applications** > **Providers** and click **New Provider** to create a provider.
3. Select **OAuth2/OpenID Provider** as the **Provider Type**, and then click **Next**.
4. On the **Create OAuth2/OpenID Provider** page, provide the configuration settings and then click **Finish** to create the provider.
4. On the **New OAuth2/OpenID Provider** page, provide the configuration settings and then click **Finish** to create the provider.
## Create the application
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create** to create an application.
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application.
3. Configure the following required settings for the application:
- **Name**: provide a descriptive name of the application.
- **Slug**: provide the application slug used in URLs.

6
website/docs/add-secure-apps/providers/wsfed/create-wsfed-provider.md
View File

@@ -7,7 +7,7 @@ An authentik WS-Federation provider is typically created as part of an applicati
## Create a WS-Federation provider and application pair
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications > Applications** and click **Create with provider** to create an application and provider pair.
2. Navigate to **Applications > Applications** and click **New Provider** to create an application and provider pair.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **WS-Federation Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure WS-Federation Provider** page, provide a name for the provider, select an authorization flow, and the two required configuration settings:
@@ -24,7 +24,7 @@ After an authentik WS-Federation provider has been created via any of the above
To download the metadata of an authentik WS-Federation provider, follow these steps:
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications > Providers**.
2. Navigate to **Applications > Providers**.
3. Click the name of the provider you want metadata for.
4. On the **Overview** tab, in the **Related objects** section, click on **Download** under **Metadata**. This will download the metadata XML file for that provider.
@@ -33,6 +33,6 @@ To download the metadata of an authentik WS-Federation provider, follow these st
To view and optionally download the metadata of an authentik WS-Federation provider, follow these steps:
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications > Providers**.
2. Navigate to **Applications > Providers**.
3. Click the name of the provider you want metadata for, and then click the **Metadata** tab.
4. The metadata for the provider will be shown in a code box. You can optionally use the **Download** button to obtain the metadata as a file.

2
website/docs/customize/blueprints/v1/models.mdx
View File

@@ -30,7 +30,7 @@ For example:
Via the standard API, a user's password can only be set via the separate `/api/v3/core/users/<id>/set_password/` endpoint. In blueprints, the password of a user can be set using the `password` field.
Keep in mind that if an LDAP Source is configured and the user maps to an LDAP user, this password change will be propagated to the LDAP server.
Keep in mind that if an LDAP Source is configured and the user maps to an LDAP user, this password change will be propagated to the LDAP server.
For example:

2
website/docs/customize/file-picker.md
View File

@@ -12,7 +12,7 @@ This applies to:
- **System** > **Brands** > **Default flow background**
- **Flows and Stages** > **Flows** > **Background**
- **Applications** > **Applications** > **Icon**
- **Applications** > **Create application** wizard > **Icon**
- **Applications** > **New Application** wizard > **Icon**
- **Directory** > **Federation and Social login** > source **Icon** fields for SAML, OAuth, Plex, and Kerberos sources
## Accepted values

72
website/docs/developer-docs/contributing.md
View File

@@ -49,47 +49,47 @@ authentik
├── lib - Generic library of functions, few dependencies on other packages.
├── outposts - Configure and deploy outposts on Kubernetes and Docker.
├── policies - General PolicyEngine
│   ├── dummy - A Dummy policy used for testing
│   ├── event_matcher - Match events based on different criteria
│   ├── expiry - Check when a user's password was last set
│   ├── expression - Execute any arbitrary python code
│   ├── password - Check a password against several rules
│   └── reputation - Check the user's/client's reputation
│ ├── dummy - A Dummy policy used for testing
│ ├── event_matcher - Match events based on different criteria
│ ├── expiry - Check when a user's password was last set
│ ├── expression - Execute any arbitrary python code
│ ├── password - Check a password against several rules
│ └── reputation - Check the user's/client's reputation
├── providers
│   ├── ldap - Provide LDAP access to authentik users/groups using an outpost
│   ├── oauth2 - OIDC-compliant OAuth2 provider
│   ├── proxy - Provides an identity-aware proxy using an outpost
│   ├── radius - Provides a RADIUS server that authenticates using flows
│   ├── saml - SAML2 provider
│   └── scim - SCIM provider
│ ├── ldap - Provide LDAP access to authentik users/groups using an outpost
│ ├── oauth2 - OIDC-compliant OAuth2 provider
│ ├── proxy - Provides an identity-aware proxy using an outpost
│ ├── radius - Provides a RADIUS server that authenticates using flows
│ ├── saml - SAML2 provider
│ └── scim - SCIM provider
├── recovery - Generate keys to use in case you lock yourself out
├── root - Root Django application, contains global settings and routes
├── sources
│   ├── kerberos - Sync Kerberos users into authentik
│   ├── ldap - Sync LDAP users from OpenLDAP or Active Directory into authentik
│   ├── oauth - OAuth1 and OAuth2 source
│   ├── plex - Plex source
│   ├── saml - SAML2 source
│   └── telegram - Telegram source
│ ├── kerberos - Sync Kerberos users into authentik
│ ├── ldap - Sync LDAP users from OpenLDAP or Active Directory into authentik
│ ├── oauth - OAuth1 and OAuth2 source
│ ├── plex - Plex source
│ ├── saml - SAML2 source
│ └── telegram - Telegram source
├── stages
│   ├── authenticator_duo - Configure a DUO authenticator
│   ├── authenticator_static - Configure TOTP backup keys
│   ├── authenticator_totp - Configure a TOTP authenticator
│   ├── authenticator_validate - Validate any authenticator
│   ├── authenticator_webauthn - Configure a WebAuthn / Passkeys authenticator
│   ├── captcha - Make the user pass a captcha
│   ├── consent - Let the user decide if they want to consent to an action
│   ├── deny - Static deny, can be used with policies
│   ├── dummy - Dummy stage to test
│   ├── email - Send the user an email and block execution until they click the link
│   ├── identification - Identify a user with any combination of fields
│   ├── invitation - Invitation system to limit flows to certain users
│   ├── password - Password authentication
│   ├── prompt - Arbitrary prompts
│   ├── user_delete - Delete the currently pending user
│   ├── user_login - Login the currently pending user
│   ├── user_logout - Logout the currently pending user
│   └── user_write - Write any currently pending data to the user.
│ ├── authenticator_duo - Configure a DUO authenticator
│ ├── authenticator_static - Configure TOTP backup keys
│ ├── authenticator_totp - Configure a TOTP authenticator
│ ├── authenticator_validate - Validate any authenticator
│ ├── authenticator_webauthn - Configure a WebAuthn / Passkeys authenticator
│ ├── captcha - Make the user pass a captcha
│ ├── consent - Let the user decide if they want to consent to an action
│ ├── deny - Static deny, can be used with policies
│ ├── dummy - Dummy stage to test
│ ├── email - Send the user an email and block execution until they click the link
│ ├── identification - Identify a user with any combination of fields
│ ├── invitation - Invitation system to limit flows to certain users
│ ├── password - Password authentication
│ ├── prompt - Arbitrary prompts
│ ├── user_delete - Delete the currently pending user
│ ├── user_login - Login the currently pending user
│ ├── user_logout - Logout the currently pending user
│ └── user_write - Write any currently pending data to the user.
├── tasks - Background tasks
└── tenants - Soft tenancy, configure defaults and branding per domain
```

2
website/docs/endpoint-devices/authentik-agent/agent-deployment/automated.mdx
View File

@@ -18,7 +18,7 @@ If you have already created an enrollment token, skip to the next section.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik Agent.
4. Under **Enrollment Tokens**, click **Create**, and configure the following settings:
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
- **Token name**: provide a descriptive name for the token
- **Device group _(optional)_**: select a device access group for the device to be added to after completing enrollment
- **Expiring _(optional)_**: set whether or not the enrollment token will expire

2
website/docs/endpoint-devices/authentik-agent/agent-deployment/linux.mdx
View File

@@ -25,7 +25,7 @@ If you have already created have an enrollment token, skip to the [next section]
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent.
4. Under **Enrollment Tokens**, click **Create**, and configure the following settings:
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
- **Token name**: provide a descriptive name for the token
- **Device group _(optional)_**: select a device access group for the device to be added to after completing enrollment
- **Expiring _(optional)_**: set whether or not the enrollment token will expire

2
website/docs/endpoint-devices/authentik-agent/agent-deployment/macos.md
View File

@@ -22,7 +22,7 @@ If you already have an enrollment token, skip to the [next section](#install-the
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent.
4. Under **Enrollment Tokens**, click **Create**, and configure the following settings:
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
- **Token name**: provide a descriptive name for the token
- **Device group _(optional)_**: select a device access group for the device to be added to after completing enrollment
- **Expiring _(optional)_**: set whether or not the enrollment token will expire

2
website/docs/endpoint-devices/authentik-agent/agent-deployment/windows.md
View File

@@ -41,7 +41,7 @@ If you already have an enrollment token, skip to the [next section](#install-the
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent.
4. Under **Enrollment Tokens**, click **Create**, and configure the following settings:
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
- **Token name**: provide a descriptive name for the token
- **Device group _(optional)_**: select a device access group for the device to be added to after completing enrollment
- **Expiring _(optional)_**: set whether or not the enrollment token will expire

6
website/docs/endpoint-devices/authentik-agent/configuration.md
View File

@@ -18,7 +18,7 @@ The OAuth device code flow enables secure authentication for input-limited clien
If you have already deployed the authentik OAuth device code flow, skip to the [next section](#create-an-application-and-provider-in-authentik-for-cli).
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click **Create**.
2. Navigate to **Flows and Stages** > **Flows** and click **New Flow**.
3. Set the following required configurations:
- **Name**: provide a name (e.g. `default-device-code-flow`)
- **Title**: provide a title (e.g. `Device code flow`)
@@ -34,7 +34,7 @@ If you have already deployed the authentik OAuth device code flow, skip to the [
The authentik Agent requires an OAuth application/provider pair to handle authentication.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. Alternatively, you can first create a provider separately, then create the application and connect it to the provider.
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. Alternatively, you can first create a provider separately, then create the application and connect it to the provider.
- **Application**: set the **Name** and **Slug** to `authentik-cli`, and provide an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
@@ -52,7 +52,7 @@ The authentik Agent requires an OAuth application/provider pair to handle authen
The authentik Agent [Connector](../device-compliance/connectors/authentik-agent.md) allows device information to be reported to authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **Create**.
2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.
3. Select **Agent Connector** as the agent type and click **Next**.
4. Configure the following required settings:
- **Connector name**: provide a descriptive name (e.g. `authentik Agent`)

2
website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/aws.mdx
View File

@@ -18,7 +18,7 @@ To support the integration of authentik Agent with AWS CLI, you need to create a
### Create an application and provider in authentik for AWS CLI
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
- **Application**: provide a descriptive name (e.g. `authentik-aws-cli`), an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.

2
website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/k8s.mdx
View File

@@ -18,7 +18,7 @@ To support the integration of authentik Agent with `kubectl`, you need to create
### Create an application and provider in authentik for Kubernetes
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
- **Application**: provide a descriptive name (e.g. `kubernetes-cluster`), an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.

4
website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.md
View File

@@ -32,8 +32,8 @@ When configured correctly, when logging in you should see a prompt for **authent
Local device login requires that the authenticating user is authorized to access the device. Access is controlled via [device access groups](../device-access-groups.mdx), which always apply. On Enterprise, direct device bindings (users, groups, or policies bound directly to the device) also affect access. If no device access group or direct binding is configured with the appropriate bindings, **all login attempts will be denied**.
1. In the Admin interface, navigate to **Endpoint Devices** > **Device access groups** and click **Create**.
2. Provide a **Group name** (e.g. `linux-devices`) and click **Create**.
1. In the Admin interface, navigate to **Endpoint Devices** > **Device access groups** and click **New Device Access Group**.
2. Provide a **Group name** (e.g. `linux-devices`) and click **Create Device Access Group**.
3. Expand the newly created device access group and click **Bind existing Policy / Group / User**.
4. Select **Group** and choose a group that contains the users who should be allowed to log in to the device. Alternatively, bind a specific **User** or a **Policy**.
5. Click **Create**.

4
website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/windows.md
View File

@@ -46,8 +46,8 @@ Currently, only local login is supported; RDP login is not yet available and is
Local device login requires that the authenticating user is authorized to access the device. Access is controlled via [device access groups](../device-access-groups.mdx), which always apply. On Enterprise, direct device bindings (users, groups, or policies bound directly to the device) also affect access. If no device access group or direct binding is configured with the appropriate bindings, **all login attempts will be denied**.
1. In the Admin interface, navigate to **Endpoint Devices** > **Device access groups** and click **Create**.
2. Provide a **Group name** (e.g. `windows-devices`) and click **Create**.
1. In the Admin interface, navigate to **Endpoint Devices** > **Device access groups** and click **New Device Access Group**.
2. Provide a **Group name** (e.g. `windows-devices`) and click **Create Device Access Group**.
3. Expand the newly created device access group and click **Bind existing Policy / Group / User**.
4. Select **Group** and choose a group that contains the users who should be allowed to log in to the device. Alternatively, bind a specific **User** or a **Policy**.
5. Click **Create**.

2
website/docs/endpoint-devices/device-compliance/connectors/authentik-agent.md
View File

@@ -16,7 +16,7 @@ The agent connector mainly holds configuration for the agent itself, as well as
Follow these instructions to configure the authentik Agent connector:
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **Create**.
2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.
3. Select **Agent Connector** as the connector type, click **Next**, and configure the following required settings:
- **Connector name**: provide a descriptive name for the connector.
- **Refresh interval**: select how often the agent will attempt to update its configuration.

2
website/docs/endpoint-devices/device-compliance/connectors/fleetdm.md
View File

@@ -24,7 +24,7 @@ Do not use an API key from a normal user because these keys expire.
Follow these instructions to configure the Fleet connector in authentik:
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **Create**.
2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.
3. Select **Fleet Connector** as the connector type, click **Next**, and configure the following settings:
- **Connector name**: provide a descriptive name for the connector.
- **Fleet Server URL**: enter your **Fleet web address** URL.

2
website/docs/endpoint-devices/device-compliance/connectors/google-chrome.md
View File

@@ -65,7 +65,7 @@ For detailed instructions, refer to Google documentation.
### Create the connector
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **Create**.
2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.
3. Select **Google Device Trust Connector** as the connector type, click **Next**, and configure the following settings:
- **Name**: define a descriptive name, such as "chrome-device-trust".
- **Google Verified Access API**

10
website/docs/endpoint-devices/device-compliance/device-compliance-policy.md
View File

@@ -39,9 +39,9 @@ If your goal is to only allow authentication via endpoint devices, this is achie
#### Create an Endpoint stage
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages > Flows**.
2. Navigate to **Flows and Stages > Flows**.
3. Select the authentication flow that you want to modify.
4. Open the **Stage Bindings** tab and click **Create and bind stage**.
4. Open the **Stage Bindings** tab and click **New Stage**.
5. Select Endpoint stage as the stage type, click **Next**, and configure the following settings:
- **Name**: provide a name for the stage
- **Connector**: select a connector for the stage to fetch device facts from (e.g. `authentik agent`)
@@ -59,9 +59,9 @@ The following example will only allow authentication via Apple devices.
#### Create an Endpoint stage
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages > Flows**.
2. Navigate to **Flows and Stages > Flows**.
3. Select the authentication flow that you want to modify.
4. Open the **Stage Bindings** tab and click **Create and bind stage**.
4. Open the **Stage Bindings** tab and click **New Stage**.
5. Select Endpoint stage as the stage type, click **Next**, and configure the following settings:
- **Name**: provide a name for the stage
- **Connector**: select a connector for the stage to fetch device facts from (e.g. `authentik agent`)
@@ -72,7 +72,7 @@ The following example will only allow authentication via Apple devices.
#### Create a Deny stage
9. On the **Stage Bindings** tab, click **Create and bind stage**.
9. On the **Stage Bindings** tab, click **New Stage**.
10. Select **Deny Stage** as the stage type and configure the following settings:
- **Name**: provide a name for the stage
- **Deny message**: provide a message explaining why access was denied

2
website/docs/install-config/install/aws.md
View File

@@ -17,7 +17,7 @@ Under the **Certificate ARN** input, enter the previously created certificate AR
This stack will create the following resources:
- AWS SSM secrets for the PostgreSQL user and the authentik secret key
- AWS SSM secrets for the PostgreSQL user and the authentik secret key
- A VPC for all other resources
- A RDS PostgreSQL Multi-AZ cluster
- An ECS cluster with two tasks:

2
website/docs/releases/old/v0.14.md
View File

@@ -50,7 +50,7 @@ This release does not introduce any new requirements.
### docker-compose
Download the docker-compose file for 0.14 from  [here](https://goauthentik.io/version/0.14/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.
Download the docker-compose file for 0.14 from [here](https://goauthentik.io/version/0.14/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.
### Kubernetes

8
website/docs/security/audits-and-certs/2024-11-cobalt.md
View File

@@ -2,7 +2,7 @@
We are committed to engaging in regular pentesting and security audits of authentik. Defining and adhering to a cadence of external testing ensures a stronger probability that our code base, our features, and our architecture is as secure and non-exploitable as possible.
In August-September of 2024, we had a pentest conducted by [Cobalt](https://www.cobalt.io). This document covers the findings of the audit, how we addressed the noted issues, and the subsequent [re-testing](https://goauthentik.io/resources/fullReport_authentik-cobalt-test-instance-august-2024-pt26135.pdf) by Cobalt to confirm that all issues were resolved.
In August-September of 2024, we had a pentest conducted by [Cobalt](https://www.cobalt.io). This document covers the findings of the audit, how we addressed the noted issues, and the subsequent [re-testing](https://goauthentik.io/resources/fullReport_authentik-cobalt-test-instance-august-2024-pt26135.pdf) by Cobalt to confirm that all issues were resolved.
Cobalt described their process for testing:
@@ -18,7 +18,7 @@ In total, there were 5 low-level and one info-level vulnerabilities reported. By
## Responses to specific findings
From the audit, this is the complete list of findings, with information about how we addressed each.
From the audit, this is the complete list of findings, with information about how we addressed each.
### HTML Injection
@@ -30,7 +30,7 @@ From the audit, this is the complete list of findings, with information about h
**Issue**: The pentesters discovered that the application was susceptible to insecure file upload and stored Cross-Site Scripting (XSS) vulnerabilities by uploading crafted SVG files that were used as application icons. (This action could only be performed by an authenticated admin user, and thus had little practical value as an attack vector.)
**Fix**: The fix was to add a CSP header to files that are stored in the `/media` directory of the installation. For details, refer to [Pull Request #12092](https://github.com/goauthentik/authentik/pull/12092).
**Fix**: The fix was to add a CSP header to files that are stored in the `/media` directory of the installation. For details, refer to [Pull Request #12092](https://github.com/goauthentik/authentik/pull/12092).
### Vulnerability through footer links on website
@@ -60,4 +60,4 @@ The absence of Content Security Policy (CSP) headers means that the application
The subsequent retest conducted by Cobalt deemed all issues resolved. See page 17 of the [report](https://goauthentik.io/resources/fullReport_authentik-cobalt-test-instance-august-2024-pt26135.pdf) for the mitigation status ("fixed") for each of the issues discovered in September.
We are pleased to share this pentest and the final results of the retest. We encourage an open and ongoing communication with our users and community. For more information abut our security stance, read our [Security Policy](https://docs.goauthentik.io/docs/security/policy), [Hardening authentik](https://docs.goauthentik.io/docs/security/security-hardening), and our other [security-related documentation](https://docs.goauthentik.io/docs/security). If you have any questions or feedback you can reach us on [GitHub](https://github.com/goauthentik/authentik), [Discord](https://discord.com/channels/809154715984199690/809154716507963434), or via email to [hello@goauthentik.io](mailto:hello@goauthentik.io).
We are pleased to share this pentest and the final results of the retest. We encourage an open and ongoing communication with our users and community. For more information abut our security stance, read our [Security Policy](https://docs.goauthentik.io/docs/security/policy), [Hardening authentik](https://docs.goauthentik.io/docs/security/security-hardening), and our other [security-related documentation](https://docs.goauthentik.io/docs/security). If you have any questions or feedback you can reach us on [GitHub](https://github.com/goauthentik/authentik), [Discord](https://discord.com/channels/809154715984199690/809154716507963434), or via email to [hello@goauthentik.io](mailto:hello@goauthentik.io).

2
website/docs/sys-mgmt/brands/index.md
View File

@@ -12,7 +12,7 @@ For an overview of branding and other customization options in authentik refer t
To create or edit a brand, follow these steps:
1. Log in as an administrator, open the authentik Admin interface, and navigate to **System** > **Brands**.
1. Log in as an administrator, open the authentik Admin interface, and navigate to **System** > **Brands**.
2. Click **Create** to add a new brand, or click the **Edit** icon next to an existing brand to modify it.

2
website/docs/sys-mgmt/events/notifications.md
View File

@@ -48,7 +48,7 @@ For more code examples, see [notification rule expression policies](./notificati
After you've created the policies to match the events you want, create a notification rule.
1. Log in as an administrator, open the authentik Admin interface, and navigate to **Event > Notification Rules**.
1. Log in as an administrator, open the authentik Admin interface, and navigate to **Event > Notification Rules**.
2. Click **New Notification Rule** to add a new notification rule or click the **Edit** icon next to an existing rule to modify it.

6
website/docs/sys-mgmt/events/transports.md
View File

@@ -77,8 +77,8 @@ This sends a request using the Slack-specific format. This is also compatible wi
## Create a notification transport
1. Log in as an administrator to the authentik Admin interface, and then navigate to **Event > Notification Transports**.
1. Log in as an administrator to the authentik Admin interface, and then navigate to **Event > Notification Transports**.
2. Click **Create** to add a new transport or click the **Edit** icon next to an existing notification transport to modify it.
2. Click **New Notification Transport** to add a new transport or click the **Edit** icon next to an existing notification transport to modify it.
3. Define the **Name** and **Mode** for the notification transport, enter required configuration settings, and then click **Create**.
3. Define the **Name** and **Mode** for the notification transport, enter required configuration settings, and then click **Create Notification Transport**.

2
website/docs/users-sources/roles/manage_roles.md
View File

@@ -14,7 +14,7 @@ Roles are intended to be assigned to groups, not to individual users. However, i
To create a new role, follow these steps:
1. In the Admin interface, navigate to **Directory > Roles**.
2. Click **Create**, enter the name of the role, and then click **Create** in the box.
2. Click **New Role**, enter the name of the role, and then click **Create Role** to save.
3. Next, [assign permissions for the role](../access-control/manage_permissions.md#assign-or-remove-permissions-for-a-specific-role).
## Modify a role

2
website/docs/users-sources/sources/directory-sync/freeipa/index.md
View File

@@ -53,7 +53,7 @@ See the [LDAP Source documentation](../../protocols/ldap) for more information o
To create a new LDAP Source in authentik:
1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social Login**, click **Create**, select **LDAP Source**, and click **Next**.
2. Navigate to **Directory** > **Federation and Social Login**, click **New Source**, select **LDAP Source**, and click **Next**.
3. Configure the following settings:
- **Name**: Provide a descriptive name for the LDAP source.
- **Slug**: Provide a slug for the LDAP source.

2
website/docs/users-sources/sources/protocols/kerberos/index.md
View File

@@ -124,7 +124,7 @@ These property mappings are configured with the most common Kerberos setups.
### Expression data
The following variable is available to Kerberos source property mappings:
The following variable is available to Kerberos source property mappings:
- `principal`: a Python string containing the Kerberos principal. For example `alice@REALM.COMPANY` or `HTTP/authentik.company@REALM.COMPANY`.

2
website/docs/users-sources/sources/protocols/ldap/index.md
View File

@@ -90,7 +90,7 @@ These are configured with most common LDAP setups.
### Expression data
The following variables are available to LDAP source property mappings:
The following variables are available to LDAP source property mappings:
- `ldap`: A Python dictionary containing data from LDAP.
- `dn`: The object DN.

2
website/docs/users-sources/sources/protocols/oauth/index.mdx
View File

@@ -39,7 +39,7 @@ See the [overview](../../property-mappings/index.md) for information on how prop
### Expression data
The following variables are available to OAuth source property mappings:
The following variables are available to OAuth source property mappings:
- `info`: A Python dictionary containing OAuth claims. For example (values might differ depending on the source):
```python

2
website/docs/users-sources/sources/protocols/saml/index.md
View File

@@ -88,7 +88,7 @@ See the [overview](../../property-mappings/index.md) for information on how prop
### Expression data
The following variables are available to SAML source property mappings:
The following variables are available to SAML source property mappings:
- `root`: An XML `ETree` object containing data from the source.
- `name_id`: An XML `Element` object identifying the user.

2
website/docs/users-sources/sources/social-logins/apple/index.md
View File

@@ -60,7 +60,7 @@ To integrate Apple with authentik, you will need to register two identifiers and
To support the integration of Apple with authentik, you need to create an Apple OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, then configure the following settings:
- **Select type**: select **Apple OAuth Source**.
- **Create Apple OAuth Source**: provide a name, a slug which must match the slug used in the Apple `Return URL`, and the following required configurations:
- Under **Protocol Settings**:

6
website/docs/users-sources/sources/social-logins/discord/index.md
View File

@@ -28,7 +28,7 @@ To integrate Discord with authentik you will need to create an OAuth application
## authentik configuration
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Discord OAuth Source** as the source type.
- **Create Discord OAuth Source**: provide a name, a slug which must match the slug used in the Discord `Redirect URI` (e.g. `discord`), and the following required configurations:
- Under **Protocol Settings**:
@@ -179,7 +179,7 @@ return user_matched
5. Click **Finish**. You can now bind this policy to the chosen enrollment and/or authentication flow of the Discord OAuth source.
6. Navigate to **Flows and Stages** > **Flows** and click the name of the flow in question.
7. Open the **Policy/Group/User Bindings** tab and click **Bind existing Policy/Group/User**.
8. Select the policy that you previously created and click **Create**.
8. Select the policy that you previously created and click **Create Policy Binding**.
9. Optionally, repeat the process for any other flows that you want the policy applied to.
### Checking Discord Guild role membership
@@ -249,7 +249,7 @@ return user_matched
5. Click **Finish**. You can now bind this policy to the chosen enrollment and/or authentication flow of the Discord OAuth source.
6. Navigate to **Flows and Stages** > **Flows** and click the name of the flow in question.
7. Open the **Policy/Group/User Bindings** tab and click **Bind existing Policy/Group/User**.
8. Select the policy that you previously created and click **Create**.
8. Select the policy that you previously created and click **Create Policy Binding**.
9. Optionally, repeat the process for any other flows that you want the policy applied to.
## Resources

2
website/docs/users-sources/sources/social-logins/entra-id/oauth/index.mdx
View File

@@ -56,7 +56,7 @@ To support the integration of Entra ID with authentik, you need to create an Ent
### Create Entra ID OAuth source
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Entra ID OAuth Source** as the source type.
- **Create Entra ID OAuth Source**: provide a name, a slug which must match the slug used in the Entra ID `Redirect URI`, and the following required configurations:
- Under **Protocol Settings**:

2
website/docs/users-sources/sources/social-logins/entra-id/scim/index.mdx
View File

@@ -25,7 +25,7 @@ To integrate authentik with Entra ID via SCIM, you need to create a SCIM source
### Create SCIM source
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **SCIM Source**.
- **Create SCIM Source**: provide a name and a slug.
- All other configurations are optional.

2
website/docs/users-sources/sources/social-logins/facebook/index.md
View File

@@ -48,7 +48,7 @@ Finally, you need to publish the Facebook app.
To support the integration of Facebook with authentik, you need to create a Facebook OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Facebook OAuth Source** as the source type.
- **Create Facebook OAuth Source**: provide a name, a slug which must match the slug used in the Facebook `Valid OAuth redirect URIs` field (e.g. `facebook`), and the following required configurations:
- **Protocol settings**

2
website/docs/users-sources/sources/social-logins/github/index.mdx
View File

@@ -32,7 +32,7 @@ To integrate GitHub with authentik, you need to create an OAuth application in G
To support the integration of GitHub with authentik, you need to create a GitHub OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **GitHub OAuth Source** as the source type.
- **Create GitHub OAuth Source**: provide a name, a slug which must match the slug used in the GitHub `Authorization callback URL` field (e.g. `github`), and set the following required configurations:
- **Protocol settings**

4
website/docs/users-sources/sources/social-logins/google/cloud/index.md
View File

@@ -66,7 +66,7 @@ To integrate Google with authentik, you need to create a new project and OAuth c
To support the integration of Google with authentik, you need to create a Google OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Google OAuth Source** as the source type.
- **Create Google OAuth Source**: provide a name, a slug that must match the slug used in the Google `Authorized redirect URI` field (e.g. `google`), and set the following required configurations:
- **Protocol settings**
@@ -107,7 +107,7 @@ return False
5. Click **Finish**. You can now bind this policy to the chosen enrollment flow of the Google OAuth source.
6. Navigate to **Flows and Stages** > **Flows** and click the name of the flow in question.
7. Open the **Stage Bindings** tab, expand the policies bound to the first stage and click **Bind existing Policy/Group/User**.
8. Select the policy that you previously created and click **Create**.
8. Select the policy that you previously created and click **Create Policy Binding**.
:::note
If using the default enrollment flow the policy should be bound to the **default-source-enrollment-prompt** stage. Ensure that the policy comes before **default-source-enrollment-if-username**.

2
website/docs/users-sources/sources/social-logins/google/workspace/index.md
View File

@@ -105,7 +105,7 @@ authentik is acting as both a Service Provider (SP) to Google and an Identity Pr
### Create a SAML source in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login** and click **Create**.
2. Navigate to **Directory** > **Federation and Social login** and click **New Source**.
3. Select **SAML Source** and configure the following settings:
- Set **Name** to `Google Workspace`.
- Set **Slug** to `google` (must match the slug used in Google Workspace ACS URL).

2
website/docs/users-sources/sources/social-logins/keycloak/index.md
View File

@@ -88,7 +88,7 @@ Before configuring either service, you need to export the signing certificates f
### Create a SAML source in authentik
1. Navigate to **Directory** > **Federation and Social login** and click **Create**.
1. Navigate to **Directory** > **Federation and Social login** and click **New Source**.
2. Select **SAML Source** and configure the following settings:
- Set **Name** to `Keycloak`.
- Set **Slug** to `keycloak`.

2
website/docs/users-sources/sources/social-logins/mailcow/index.md
View File

@@ -26,7 +26,7 @@ To integrate Mailcow with authentik you will need to create an OAuth application
## authentik configuration
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **OAuth Source** as the source type.
- **Create OAuth Source**: provide a name, a slug which must match the slug used in the Mailcow `Redirect URI` field (e.g. `mailcow`), and set the following required configurations:
- **Protocol settings**

2
website/docs/users-sources/sources/social-logins/okta/index.md
View File

@@ -33,7 +33,7 @@ To integrate Okta with authentik you will need to create an App Integration in t
To support the integration of Okta with authentik, you need to create an Okta OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Okta OAuth Source** as the source type.
- **Create Okta OAuth Source**: provide a name, a slug which must match the slug used in the Okta Sign-in redirect URI field (e.g. `okta`), and the following required settings:
- Under **Protocol settings**:

2
website/docs/users-sources/sources/social-logins/plex/index.md
View File

@@ -16,7 +16,7 @@ None
To support the integration of Plex with authentik, you need to create a Plex source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Plex Source** as the source type.
- **Create Plex Source**: provide a name, a slug, and set the following required configurations:
- **Icon**: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.md).

2
website/docs/users-sources/sources/social-logins/shibboleth/index.md
View File

@@ -23,7 +23,7 @@ To integrate Shibboleth with authentik you will need to create a SAML source in
### Create a SAML source in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login** and click **Create**.
2. Navigate to **Directory** > **Federation and Social login** and click **New Source**.
3. Select **SAML Source** and configure the following settings:
- Set **Name** to `Shibboleth`.
- Set **Slug** to `shibboleth` (this sets the slug used in Shibboleth's metadata url).

2
website/docs/users-sources/sources/social-logins/telegram/index.md
View File

@@ -27,7 +27,7 @@ Now that the bot is configured you can proceed to creating a source in authentik
## authentik configuration
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Telegram** as the source type.
- **Create Telegram Source**: provide a name, a slug, and the following required configurations:
- **Bot username**: The username of your Telegram bot (e.g., `authentik_bot`).

2
website/docs/users-sources/sources/social-logins/twitch/index.md
View File

@@ -34,7 +34,7 @@ To integrate Twitch with authentik you will need to create an OAuth application
To support the integration of Twitch with authentik, you need to create an Twitch OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Twitch OAuth Source** as the source type.
- **Create OAuth Source**: provide a name, a slug which must match the slug used in the Twitch `OAuth Redirect URLs` field (e.g. `twitch`), and set the following required configurations:
- **Protocol settings**

2
website/docs/users-sources/sources/social-logins/twitter/index.md
View File

@@ -36,7 +36,7 @@ To integrate X with authentik you will need to create an OAuth application in th
To support the integration of X with authentik, you need to create a Twitter OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **Twitter OAuth Source** as the source type.
- **Create OAuth Source**: provide a name, a slug which must match the slug used in the X `Callback URI / Redirect URL` field (e.g. `x`), and set the following required configurations:
- **Protocol settings**

2
website/docs/users-sources/sources/social-logins/wechat/index.md
View File

@@ -32,7 +32,7 @@ This integration uses the WeChat "Website Application" login flow (QR Code login
To support the integration of WeChat with authentik, you need to create a WeChat OAuth source in authentik.
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **Create**, and then configure the following settings:
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
- **Select type**: select **WeChat OAuth Source** as the source type.
- **Create OAuth Source**: provide a name, a slug (e.g. `wechat`), and set the following required configurations:
- **Protocol settings**

2
website/integrations/chat-communication-collaboration/affine/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of AFFiNE with authentik, you need to create an appli
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/espo-crm/index.md
View File

@@ -32,7 +32,7 @@ To support the integration of EspoCRM with authentik, you need to create an appl
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/hedgedoc/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of HedgeDoc with authentik, you need to create an app
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/joplin/index.md
View File

@@ -51,7 +51,7 @@ To support the integration of Joplin with authentik, you need to create property
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/chat-communication-collaboration/kanboard/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Kanboard with authentik, you need to create an app
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.

2
website/integrations/chat-communication-collaboration/kimai/index.md
View File

@@ -29,7 +29,7 @@ To support the integration of Kimai with authentik, you need to create an applic
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later.
- **Choose a Provider type**: select **SAML Provider** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.

2
website/integrations/chat-communication-collaboration/mailcow/index.md
View File

@@ -32,7 +32,7 @@ To support the integration of mailcow with authentik, you need to create an appl
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/mastodon/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Mastodon with authentik, you need to create an app
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/matrix-synapse/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Matrix Synapse with authentik, you need to create
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/mautic/index.md
View File

@@ -65,7 +65,7 @@ Because Mautic requires a first name and last name attribute, create two [SAML p
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider**: select **SAML Provider** as the provider type.
- **Configure the Provider**:

2
website/integrations/chat-communication-collaboration/mobilizon/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Mobilizon with authentik, you need to create an ap
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/openproject/index.md
View File

@@ -53,7 +53,7 @@ OpenProject requires a first and last name for each user. By default authentik o
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Provider** as the provider type.

2
website/integrations/chat-communication-collaboration/owncloud/index.md
View File

@@ -30,7 +30,7 @@ The configuration for each application is nearly identical, except for the **Cli
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) You will need to repeat the process four times: once each for the Desktop application, Web UI, Android application, and iOS application.
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. You will need to repeat the process four times: once each for the Desktop application, Web UI, Android application, and iOS application.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/placetel/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Placetel with authentik, you need to create an app
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value as it will be required later.
- **Choose a Provider type**: select **SAML Provider** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.

2
website/integrations/chat-communication-collaboration/rocketchat/index.md
View File

@@ -32,7 +32,7 @@ To support the integration of Rocket.chat with authentik, you need to create an
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/roundcube/index.md
View File

@@ -53,7 +53,7 @@ To support the integration of Roundcube with authentik, you need to create an ap
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/seatable/index.md
View File

@@ -32,7 +32,7 @@ To support the integration of SeaTable with authentik, you need to create an app
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- Set the **Launch URL** to `https://seatable.company/sso/`.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/chat-communication-collaboration/slack/index.md
View File

@@ -45,7 +45,7 @@ To support the integration of Slack with authentik, you need to create an applic
#### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/chat-communication-collaboration/writefreely/index.md
View File

@@ -32,7 +32,7 @@ To support the integration of Writefreely with authentik, you need to create an
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/chat-communication-collaboration/zoom/index.md
View File

@@ -32,7 +32,7 @@ To support the integration of Zoom with authentik, you need to create an applica
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **SAML Provider** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations:

2
website/integrations/chat-communication-collaboration/zulip/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Zulip with authentik, you need to create an applic
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/cloud-providers/digitalocean/index.md
View File

@@ -58,7 +58,7 @@ To support the integration of DigitalOcean with authentik, you need to create a
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.

2
website/integrations/cloud-providers/hashicorp-cloud/index.md
View File

@@ -33,7 +33,7 @@ To support the integration of HashiCorp Cloud with authentik, you need to create
### Create an Application and Provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider**.
2. Navigate to **Applications** > **Applications** and click **New Application**.
- **Application**: Provide a descriptive name, an optional group, and UI settings. Take note of the **slug** as it will be required later.
- **Choose a Provider type**: Select **SAML Provider**.
- **Configure the Provider**:

2
website/integrations/cloud-providers/oracle-cloud/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Oracle Cloud with authentik, you need to create an
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- Optionally set the **Launch URL** to `https://cloud.oracle.com?tenant=friendly-tenant-name` where `friendly-tenant-name` is the name of the tenant used when logging in via the [Oracle Cloud website](https://cloud.oracle.com).

2
website/integrations/cloud-providers/ovhcloud/index.md
View File

@@ -23,7 +23,7 @@ To support the integration of OVHcloud with authentik, you need to create an app
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively, you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: Provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: Select **SAML Provider** as the provider type.
- **Configure the Provider**: Provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations:

2
website/integrations/dashboards/homarr/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Homarr with authentik, you need to create an appli
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/dashboards/linkwarden/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Linkwarden with authentik, you need to create an a
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/development/coder/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Coder with authentik, you need to create an applic
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/development/forgejo/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Forgejo with authentik, you need to create an appl
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.

2
website/integrations/development/frappe/index.md
View File

@@ -33,7 +33,7 @@ To support the integration of Frappe with authentik, you need to create an appli
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/development/gitea/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Gitea with authentik, you need to create an applic
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/development/github-enterprise-cloud/index.md
View File

@@ -32,7 +32,7 @@ To support the integration of GitHub Enterprise Cloud with authentik, you need t
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/development/github-enterprise-emu/index.md
View File

@@ -44,7 +44,7 @@ GitHub will create usernames for your EMU users based on the SAML `NameID` prope
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/development/github-enterprise-server/index.md
View File

@@ -34,7 +34,7 @@ In order to use GitHub Enterprise Server, SCIM must also be set up.
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/development/github-organization/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of GitHub Organization with authentik, you need to cr
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later.
- **Choose a Provider type**: select **SAML Provider** as the provider type.

2
website/integrations/development/gravitee/index.md
View File

@@ -30,7 +30,7 @@ To support the integration of Gravitee with authentik, you need to create an app
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

2
website/integrations/development/jenkins/index.md
View File

@@ -28,7 +28,7 @@ To support the integration of Jenkins with authentik, you need to create an appl
### Create an application and provider in authentik
1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.

Some files were not shown because too many files have changed in this diff Show More