add flow blueprint templates for authentication, email recovery and invitation enrollment with german language support
This commit is contained in:
parent
b21f73b275
commit
af029ff773
|
@ -33,3 +33,6 @@ AUTHENTIK_LOG_LEVEL=info
|
||||||
# SECRET_ADMIN_PASS_VERSION=v1
|
# SECRET_ADMIN_PASS_VERSION=v1
|
||||||
|
|
||||||
# X_FRAME_OPTIONS_ALLOW_FROM=dashboard.example.org
|
# X_FRAME_OPTIONS_ALLOW_FROM=dashboard.example.org
|
||||||
|
## FLOW OPTIONS
|
||||||
|
WELCOME_MESSAGE="Welcome to Authentik"
|
||||||
|
DEFAULT_LANGUAGE=en
|
||||||
|
|
1
abra.sh
1
abra.sh
|
@ -1 +1,2 @@
|
||||||
export CUSTOM_CSS_VERSION=v1
|
export CUSTOM_CSS_VERSION=v1
|
||||||
|
export CUSTOM_FLOWS_VERSION=v1
|
||||||
|
|
10
compose.yml
10
compose.yml
|
@ -20,6 +20,9 @@ x-env: &env
|
||||||
- AUTHENTIK_EMAIL__FROM
|
- AUTHENTIK_EMAIL__FROM
|
||||||
- AUTHENTIK_LOG_LEVEL
|
- AUTHENTIK_LOG_LEVEL
|
||||||
- AUTHENTIK_SETTINGS__THEME__BACKGROUND
|
- AUTHENTIK_SETTINGS__THEME__BACKGROUND
|
||||||
|
- WELCOME_MESSAGE
|
||||||
|
- DEFAULT_LANGUAGE
|
||||||
|
- DOMAIN
|
||||||
|
|
||||||
|
|
||||||
version: '3.8'
|
version: '3.8'
|
||||||
|
@ -83,6 +86,9 @@ services:
|
||||||
- media:/media
|
- media:/media
|
||||||
- /var/run/docker.sock:/var/run/docker.sock
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
- custom-templates:/templates
|
- custom-templates:/templates
|
||||||
|
configs:
|
||||||
|
- source: custom_flows
|
||||||
|
target: /blueprints/custom_flows.yaml
|
||||||
environment: *env
|
environment: *env
|
||||||
|
|
||||||
db:
|
db:
|
||||||
|
@ -151,3 +157,7 @@ configs:
|
||||||
name: ${STACK_NAME}_custom_css_${CUSTOM_CSS_VERSION}
|
name: ${STACK_NAME}_custom_css_${CUSTOM_CSS_VERSION}
|
||||||
file: custom.css.tmpl
|
file: custom.css.tmpl
|
||||||
template_driver: golang
|
template_driver: golang
|
||||||
|
custom_flows:
|
||||||
|
name: ${STACK_NAME}_custom_flows_${CUSTOM_FLOWS_VERSION}
|
||||||
|
file: custom_flows.yaml.tmpl
|
||||||
|
template_driver: golang
|
||||||
|
|
|
@ -0,0 +1,355 @@
|
||||||
|
version: 1
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
blueprints.goauthentik.io/instantiate: "true"
|
||||||
|
name: Custom - Flows
|
||||||
|
context:
|
||||||
|
####### Translations ########
|
||||||
|
transl_recovery: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort Zurücksetzen {{ else }} Reset your password {{ end }}
|
||||||
|
transl_password: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort {{ else }} Password {{ end }}
|
||||||
|
transl_password_repeat: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort (wiederholen) {{ else }} Password (repeat) {{ end }}
|
||||||
|
transl_username: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Benutzername {{ else }} Username {{ end }}
|
||||||
|
transl_name: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Vor- und Nachname {{ else }} Full name {{ end }}
|
||||||
|
|
||||||
|
entries:
|
||||||
|
######## Email Recovery Flow ########
|
||||||
|
- identifiers:
|
||||||
|
slug: default-recovery-flow
|
||||||
|
id: recovery_flow
|
||||||
|
model: authentik_flows.flow
|
||||||
|
attrs:
|
||||||
|
name: Default recovery flow
|
||||||
|
title: !Context transl_recovery
|
||||||
|
designation: recovery
|
||||||
|
|
||||||
|
### PROMPTS
|
||||||
|
- identifiers:
|
||||||
|
field_key: password
|
||||||
|
label: !Context transl_password
|
||||||
|
id: prompt-field-password
|
||||||
|
model: authentik_stages_prompt.prompt
|
||||||
|
attrs:
|
||||||
|
type: password
|
||||||
|
required: true
|
||||||
|
placeholder: !Context transl_password
|
||||||
|
order: 30
|
||||||
|
placeholder_expression: false
|
||||||
|
- identifiers:
|
||||||
|
field_key: password_repeat
|
||||||
|
label: !Context transl_password_repeat
|
||||||
|
id: prompt-field-password-repeat
|
||||||
|
model: authentik_stages_prompt.prompt
|
||||||
|
attrs:
|
||||||
|
type: password
|
||||||
|
required: true
|
||||||
|
placeholder: !Context transl_password_repeat
|
||||||
|
order: 31
|
||||||
|
placeholder_expression: false
|
||||||
|
|
||||||
|
|
||||||
|
### STAGES
|
||||||
|
- identifiers:
|
||||||
|
name: default-recovery-email
|
||||||
|
id: default-recovery-email
|
||||||
|
model: authentik_stages_email.emailstage
|
||||||
|
attrs:
|
||||||
|
use_global_settings: true
|
||||||
|
token_expiry: 30
|
||||||
|
subject: authentik
|
||||||
|
template: email/password_reset.html
|
||||||
|
activate_user_on_success: true
|
||||||
|
- identifiers:
|
||||||
|
name: default-recovery-user-write
|
||||||
|
id: default-recovery-user-write
|
||||||
|
model: authentik_stages_user_write.userwritestage
|
||||||
|
- identifiers:
|
||||||
|
name: default-recovery-identification
|
||||||
|
id: default-recovery-identification
|
||||||
|
model: authentik_stages_identification.identificationstage
|
||||||
|
attrs:
|
||||||
|
user_fields:
|
||||||
|
- email
|
||||||
|
- username
|
||||||
|
- identifiers:
|
||||||
|
name: default-recovery-user-login
|
||||||
|
id: default-recovery-user-login
|
||||||
|
model: authentik_stages_user_login.userloginstage
|
||||||
|
attrs:
|
||||||
|
session_duration: seconds=0
|
||||||
|
- identifiers:
|
||||||
|
name: Change your password
|
||||||
|
id: stage-prompt-password
|
||||||
|
model: authentik_stages_prompt.promptstage
|
||||||
|
attrs:
|
||||||
|
fields:
|
||||||
|
- !KeyOf prompt-field-password
|
||||||
|
- !KeyOf prompt-field-password-repeat
|
||||||
|
validation_policies: []
|
||||||
|
|
||||||
|
### STAGE BINDINGS
|
||||||
|
- identifiers:
|
||||||
|
target: !KeyOf recovery_flow
|
||||||
|
stage: !KeyOf default-recovery-identification
|
||||||
|
order: 10
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
id: flow-binding-identification
|
||||||
|
attrs:
|
||||||
|
evaluate_on_plan: true
|
||||||
|
re_evaluate_policies: true
|
||||||
|
policy_engine_mode: any
|
||||||
|
invalid_response_action: retry
|
||||||
|
- identifiers:
|
||||||
|
target: !KeyOf recovery_flow
|
||||||
|
stage: !KeyOf default-recovery-email
|
||||||
|
order: 20
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
id: flow-binding-email
|
||||||
|
attrs:
|
||||||
|
evaluate_on_plan: true
|
||||||
|
re_evaluate_policies: true
|
||||||
|
policy_engine_mode: any
|
||||||
|
invalid_response_action: retry
|
||||||
|
- identifiers:
|
||||||
|
target: !KeyOf recovery_flow
|
||||||
|
stage: !KeyOf stage-prompt-password
|
||||||
|
order: 30
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
attrs:
|
||||||
|
evaluate_on_plan: true
|
||||||
|
re_evaluate_policies: false
|
||||||
|
policy_engine_mode: any
|
||||||
|
invalid_response_action: retry
|
||||||
|
- identifiers:
|
||||||
|
target: !KeyOf recovery_flow
|
||||||
|
stage: !KeyOf default-recovery-user-write
|
||||||
|
order: 40
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
attrs:
|
||||||
|
evaluate_on_plan: true
|
||||||
|
re_evaluate_policies: false
|
||||||
|
policy_engine_mode: any
|
||||||
|
invalid_response_action: retry
|
||||||
|
- identifiers:
|
||||||
|
target: !KeyOf recovery_flow
|
||||||
|
stage: !KeyOf default-recovery-user-login
|
||||||
|
order: 100
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
attrs:
|
||||||
|
evaluate_on_plan: true
|
||||||
|
re_evaluate_policies: false
|
||||||
|
policy_engine_mode: any
|
||||||
|
invalid_response_action: retry
|
||||||
|
|
||||||
|
### POLICIES
|
||||||
|
## ISSUES with this policy
|
||||||
|
## https://github.com/goauthentik/authentik/blob/493cdd5c0f8caaec7a7dd474f1aa131e32fd39c3/blueprints/example/flows-recovery-email-verification.yaml#L37
|
||||||
|
## https://github.com/goauthentik/authentik/commit/317e9ec6053742e17ba74fb6aa38dc15aaf6657f#diff-a5c56bb7c60e27dda1b131b3fc2a17e3af6624e7cfaaa2337ec6b077ca489f34
|
||||||
|
# - identifiers:
|
||||||
|
# name: default-recovery-skip-if-restored
|
||||||
|
# id: default-recovery-skip-if-restored
|
||||||
|
# model: authentik_policies_expression.expressionpolicy
|
||||||
|
# attrs:
|
||||||
|
# expression: |
|
||||||
|
# return request.context.get('is_restored', False)
|
||||||
|
|
||||||
|
### POLICY BINDINGS
|
||||||
|
# - identifiers:
|
||||||
|
# policy: !KeyOf default-recovery-skip-if-restored
|
||||||
|
# target: !KeyOf flow-binding-identification
|
||||||
|
# order: 0
|
||||||
|
# model: authentik_policies.policybinding
|
||||||
|
# attrs:
|
||||||
|
# negate: false
|
||||||
|
# enabled: true
|
||||||
|
# timeout: 30
|
||||||
|
# - identifiers:
|
||||||
|
# policy: !KeyOf default-recovery-skip-if-restored
|
||||||
|
# target: !KeyOf flow-binding-email
|
||||||
|
# order: 0
|
||||||
|
# model: authentik_policies.policybinding
|
||||||
|
# attrs:
|
||||||
|
# negate: false
|
||||||
|
# enabled: true
|
||||||
|
# timeout: 30
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
######## Authentication Flow ########
|
||||||
|
- attrs:
|
||||||
|
designation: authentication
|
||||||
|
name: custom-authentication-flow
|
||||||
|
title: {{ env "WELCOME_MESSAGE" }}
|
||||||
|
identifiers:
|
||||||
|
slug: custom-authentication-flow
|
||||||
|
id: authentication_flow
|
||||||
|
model: authentik_flows.flow
|
||||||
|
|
||||||
|
### STAGES
|
||||||
|
- attrs:
|
||||||
|
backends:
|
||||||
|
- authentik.core.auth.InbuiltBackend
|
||||||
|
- authentik.sources.ldap.auth.LDAPBackend
|
||||||
|
- authentik.core.auth.TokenBackend
|
||||||
|
configure_flow: !Find [authentik_flows.flow, [slug, default-password-change]]
|
||||||
|
identifiers:
|
||||||
|
name: custom-authentication-password
|
||||||
|
id: custom-authentication-password
|
||||||
|
model: authentik_stages_password.passwordstage
|
||||||
|
|
||||||
|
- identifiers:
|
||||||
|
name: custom-authentication-mfa-validation
|
||||||
|
id: custom-authentication-mfa-validation
|
||||||
|
model: authentik_stages_authenticator_validate.authenticatorvalidatestage
|
||||||
|
|
||||||
|
- attrs:
|
||||||
|
password_stage: !KeyOf custom-authentication-password
|
||||||
|
recovery_flow: !KeyOf recovery_flow # !Find [authentik_flows.flow, [slug, default-recovery-flow]]
|
||||||
|
user_fields:
|
||||||
|
- email
|
||||||
|
- username
|
||||||
|
identifiers:
|
||||||
|
name: custom-authentication-identification
|
||||||
|
id: custom-authentication-identification
|
||||||
|
model: authentik_stages_identification.identificationstage
|
||||||
|
|
||||||
|
- attrs:
|
||||||
|
session_duration: seconds=0
|
||||||
|
identifiers:
|
||||||
|
name: custom-authentication-login
|
||||||
|
id: custom-authentication-login
|
||||||
|
model: authentik_stages_user_login.userloginstage
|
||||||
|
|
||||||
|
### STAGE BINDINGS
|
||||||
|
- identifiers:
|
||||||
|
order: 10
|
||||||
|
stage: !KeyOf custom-authentication-identification
|
||||||
|
target: !KeyOf authentication_flow
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
- identifiers:
|
||||||
|
order: 30
|
||||||
|
stage: !KeyOf custom-authentication-mfa-validation
|
||||||
|
target: !KeyOf authentication_flow
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
- identifiers:
|
||||||
|
order: 100
|
||||||
|
stage: !KeyOf custom-authentication-login
|
||||||
|
target: !KeyOf authentication_flow
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
|
||||||
|
######## Invitation Enrollment Flow ########
|
||||||
|
- attrs:
|
||||||
|
designation: enrollment
|
||||||
|
name: invitation-enrollment-flow
|
||||||
|
title: {{ env "WELCOME_MESSAGE" }}
|
||||||
|
identifiers:
|
||||||
|
slug: invitation-enrollment-flow
|
||||||
|
id: invitation-enrollment-flow
|
||||||
|
model: authentik_flows.flow
|
||||||
|
|
||||||
|
### PROMPTS
|
||||||
|
- identifiers:
|
||||||
|
field_key: username
|
||||||
|
label: !Context transl_username
|
||||||
|
id: prompt-field-username
|
||||||
|
model: authentik_stages_prompt.prompt
|
||||||
|
attrs:
|
||||||
|
type: username
|
||||||
|
required: true
|
||||||
|
placeholder: !Context transl_username
|
||||||
|
order: 0
|
||||||
|
placeholder_expression: false
|
||||||
|
- identifiers:
|
||||||
|
field_key: name
|
||||||
|
label: !Context transl_name
|
||||||
|
id: prompt-field-name
|
||||||
|
model: authentik_stages_prompt.prompt
|
||||||
|
attrs:
|
||||||
|
type: text
|
||||||
|
required: true
|
||||||
|
placeholder: !Context transl_name
|
||||||
|
order: 1
|
||||||
|
placeholder_expression: false
|
||||||
|
- identifiers:
|
||||||
|
field_key: email
|
||||||
|
label: Email
|
||||||
|
id: prompt-field-email
|
||||||
|
model: authentik_stages_prompt.prompt
|
||||||
|
attrs:
|
||||||
|
type: email
|
||||||
|
required: true
|
||||||
|
placeholder: muster@example.com
|
||||||
|
order: 2
|
||||||
|
placeholder_expression: false
|
||||||
|
|
||||||
|
### STAGES
|
||||||
|
|
||||||
|
- id: invitation-stage
|
||||||
|
identifiers:
|
||||||
|
name: invitation-stage
|
||||||
|
model: authentik_stages_invitation.invitationstage
|
||||||
|
|
||||||
|
- attrs:
|
||||||
|
fields:
|
||||||
|
- !KeyOf prompt-field-username
|
||||||
|
- !KeyOf prompt-field-name
|
||||||
|
- !KeyOf prompt-field-email
|
||||||
|
- !KeyOf prompt-field-password
|
||||||
|
- !KeyOf prompt-field-password-repeat
|
||||||
|
id: enrollment-prompt-userdata
|
||||||
|
identifiers:
|
||||||
|
name: enrollment-prompt-userdata
|
||||||
|
model: authentik_stages_prompt.promptstage
|
||||||
|
|
||||||
|
- id: enrollment-user-write
|
||||||
|
identifiers:
|
||||||
|
name: enrollment-user-write
|
||||||
|
model: authentik_stages_user_write.userwritestage
|
||||||
|
|
||||||
|
- attrs:
|
||||||
|
session_duration: seconds=0
|
||||||
|
id: enrollment-user-login
|
||||||
|
identifiers:
|
||||||
|
name: enrollment-user-login
|
||||||
|
model: authentik_stages_user_login.userloginstage
|
||||||
|
|
||||||
|
### STAGE BINDINGS
|
||||||
|
- identifiers:
|
||||||
|
order: 1
|
||||||
|
stage: !KeyOf invitation-stage
|
||||||
|
target: !KeyOf invitation-enrollment-flow
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
- identifiers:
|
||||||
|
order: 10
|
||||||
|
stage: !KeyOf enrollment-prompt-userdata
|
||||||
|
target: !KeyOf invitation-enrollment-flow
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
- identifiers:
|
||||||
|
order: 20
|
||||||
|
stage: !KeyOf enrollment-user-write
|
||||||
|
target: !KeyOf invitation-enrollment-flow
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
- identifiers:
|
||||||
|
order: 100
|
||||||
|
stage: !KeyOf enrollment-user-login
|
||||||
|
target: !KeyOf invitation-enrollment-flow
|
||||||
|
model: authentik_flows.flowstagebinding
|
||||||
|
|
||||||
|
######## System Tenant ##########
|
||||||
|
- attrs:
|
||||||
|
attributes:
|
||||||
|
settings:
|
||||||
|
locale: {{ env "DEFAULT_LANGUAGE" }}
|
||||||
|
# branding_favicon: /static/dist/assets/icons/icon.png
|
||||||
|
# branding_logo: /static/dist/assets/icons/icon_left_brand.svg
|
||||||
|
# branding_title: Authentik
|
||||||
|
# default: true
|
||||||
|
domain: {{ env "DOMAIN" }}
|
||||||
|
# event_retention: days=365
|
||||||
|
flow_authentication: !KeyOf authentication_flow
|
||||||
|
flow_recovery: !KeyOf recovery_flow
|
||||||
|
flow_invalidation: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
|
||||||
|
flow_user_settings: !Find [authentik_flows.flow, [slug, default-user-settings-flow]]
|
||||||
|
identifiers:
|
||||||
|
pk: 047cce25-aae2-4b02-9f96-078e155f803d
|
||||||
|
id: system_tenant
|
||||||
|
model: authentik_tenants.tenant
|
Loading…
Reference in New Issue