add flow blueprint templates for authentication, email recovery and invitation enrollment with german language support
This commit is contained in:
parent
b21f73b275
commit
af029ff773
|
@ -33,3 +33,6 @@ AUTHENTIK_LOG_LEVEL=info
|
|||
# SECRET_ADMIN_PASS_VERSION=v1
|
||||
|
||||
# X_FRAME_OPTIONS_ALLOW_FROM=dashboard.example.org
|
||||
## FLOW OPTIONS
|
||||
WELCOME_MESSAGE="Welcome to Authentik"
|
||||
DEFAULT_LANGUAGE=en
|
||||
|
|
10
compose.yml
10
compose.yml
|
@ -20,6 +20,9 @@ x-env: &env
|
|||
- AUTHENTIK_EMAIL__FROM
|
||||
- AUTHENTIK_LOG_LEVEL
|
||||
- AUTHENTIK_SETTINGS__THEME__BACKGROUND
|
||||
- WELCOME_MESSAGE
|
||||
- DEFAULT_LANGUAGE
|
||||
- DOMAIN
|
||||
|
||||
|
||||
version: '3.8'
|
||||
|
@ -83,6 +86,9 @@ services:
|
|||
- media:/media
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- custom-templates:/templates
|
||||
configs:
|
||||
- source: custom_flows
|
||||
target: /blueprints/custom_flows.yaml
|
||||
environment: *env
|
||||
|
||||
db:
|
||||
|
@ -151,3 +157,7 @@ configs:
|
|||
name: ${STACK_NAME}_custom_css_${CUSTOM_CSS_VERSION}
|
||||
file: custom.css.tmpl
|
||||
template_driver: golang
|
||||
custom_flows:
|
||||
name: ${STACK_NAME}_custom_flows_${CUSTOM_FLOWS_VERSION}
|
||||
file: custom_flows.yaml.tmpl
|
||||
template_driver: golang
|
||||
|
|
|
@ -0,0 +1,355 @@
|
|||
version: 1
|
||||
metadata:
|
||||
labels:
|
||||
blueprints.goauthentik.io/instantiate: "true"
|
||||
name: Custom - Flows
|
||||
context:
|
||||
####### Translations ########
|
||||
transl_recovery: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort Zurücksetzen {{ else }} Reset your password {{ end }}
|
||||
transl_password: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort {{ else }} Password {{ end }}
|
||||
transl_password_repeat: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Passwort (wiederholen) {{ else }} Password (repeat) {{ end }}
|
||||
transl_username: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Benutzername {{ else }} Username {{ end }}
|
||||
transl_name: {{ if eq (env "DEFAULT_LANGUAGE") "de" }} Vor- und Nachname {{ else }} Full name {{ end }}
|
||||
|
||||
entries:
|
||||
######## Email Recovery Flow ########
|
||||
- identifiers:
|
||||
slug: default-recovery-flow
|
||||
id: recovery_flow
|
||||
model: authentik_flows.flow
|
||||
attrs:
|
||||
name: Default recovery flow
|
||||
title: !Context transl_recovery
|
||||
designation: recovery
|
||||
|
||||
### PROMPTS
|
||||
- identifiers:
|
||||
field_key: password
|
||||
label: !Context transl_password
|
||||
id: prompt-field-password
|
||||
model: authentik_stages_prompt.prompt
|
||||
attrs:
|
||||
type: password
|
||||
required: true
|
||||
placeholder: !Context transl_password
|
||||
order: 30
|
||||
placeholder_expression: false
|
||||
- identifiers:
|
||||
field_key: password_repeat
|
||||
label: !Context transl_password_repeat
|
||||
id: prompt-field-password-repeat
|
||||
model: authentik_stages_prompt.prompt
|
||||
attrs:
|
||||
type: password
|
||||
required: true
|
||||
placeholder: !Context transl_password_repeat
|
||||
order: 31
|
||||
placeholder_expression: false
|
||||
|
||||
|
||||
### STAGES
|
||||
- identifiers:
|
||||
name: default-recovery-email
|
||||
id: default-recovery-email
|
||||
model: authentik_stages_email.emailstage
|
||||
attrs:
|
||||
use_global_settings: true
|
||||
token_expiry: 30
|
||||
subject: authentik
|
||||
template: email/password_reset.html
|
||||
activate_user_on_success: true
|
||||
- identifiers:
|
||||
name: default-recovery-user-write
|
||||
id: default-recovery-user-write
|
||||
model: authentik_stages_user_write.userwritestage
|
||||
- identifiers:
|
||||
name: default-recovery-identification
|
||||
id: default-recovery-identification
|
||||
model: authentik_stages_identification.identificationstage
|
||||
attrs:
|
||||
user_fields:
|
||||
- email
|
||||
- username
|
||||
- identifiers:
|
||||
name: default-recovery-user-login
|
||||
id: default-recovery-user-login
|
||||
model: authentik_stages_user_login.userloginstage
|
||||
attrs:
|
||||
session_duration: seconds=0
|
||||
- identifiers:
|
||||
name: Change your password
|
||||
id: stage-prompt-password
|
||||
model: authentik_stages_prompt.promptstage
|
||||
attrs:
|
||||
fields:
|
||||
- !KeyOf prompt-field-password
|
||||
- !KeyOf prompt-field-password-repeat
|
||||
validation_policies: []
|
||||
|
||||
### STAGE BINDINGS
|
||||
- identifiers:
|
||||
target: !KeyOf recovery_flow
|
||||
stage: !KeyOf default-recovery-identification
|
||||
order: 10
|
||||
model: authentik_flows.flowstagebinding
|
||||
id: flow-binding-identification
|
||||
attrs:
|
||||
evaluate_on_plan: true
|
||||
re_evaluate_policies: true
|
||||
policy_engine_mode: any
|
||||
invalid_response_action: retry
|
||||
- identifiers:
|
||||
target: !KeyOf recovery_flow
|
||||
stage: !KeyOf default-recovery-email
|
||||
order: 20
|
||||
model: authentik_flows.flowstagebinding
|
||||
id: flow-binding-email
|
||||
attrs:
|
||||
evaluate_on_plan: true
|
||||
re_evaluate_policies: true
|
||||
policy_engine_mode: any
|
||||
invalid_response_action: retry
|
||||
- identifiers:
|
||||
target: !KeyOf recovery_flow
|
||||
stage: !KeyOf stage-prompt-password
|
||||
order: 30
|
||||
model: authentik_flows.flowstagebinding
|
||||
attrs:
|
||||
evaluate_on_plan: true
|
||||
re_evaluate_policies: false
|
||||
policy_engine_mode: any
|
||||
invalid_response_action: retry
|
||||
- identifiers:
|
||||
target: !KeyOf recovery_flow
|
||||
stage: !KeyOf default-recovery-user-write
|
||||
order: 40
|
||||
model: authentik_flows.flowstagebinding
|
||||
attrs:
|
||||
evaluate_on_plan: true
|
||||
re_evaluate_policies: false
|
||||
policy_engine_mode: any
|
||||
invalid_response_action: retry
|
||||
- identifiers:
|
||||
target: !KeyOf recovery_flow
|
||||
stage: !KeyOf default-recovery-user-login
|
||||
order: 100
|
||||
model: authentik_flows.flowstagebinding
|
||||
attrs:
|
||||
evaluate_on_plan: true
|
||||
re_evaluate_policies: false
|
||||
policy_engine_mode: any
|
||||
invalid_response_action: retry
|
||||
|
||||
### POLICIES
|
||||
## ISSUES with this policy
|
||||
## https://github.com/goauthentik/authentik/blob/493cdd5c0f8caaec7a7dd474f1aa131e32fd39c3/blueprints/example/flows-recovery-email-verification.yaml#L37
|
||||
## https://github.com/goauthentik/authentik/commit/317e9ec6053742e17ba74fb6aa38dc15aaf6657f#diff-a5c56bb7c60e27dda1b131b3fc2a17e3af6624e7cfaaa2337ec6b077ca489f34
|
||||
# - identifiers:
|
||||
# name: default-recovery-skip-if-restored
|
||||
# id: default-recovery-skip-if-restored
|
||||
# model: authentik_policies_expression.expressionpolicy
|
||||
# attrs:
|
||||
# expression: |
|
||||
# return request.context.get('is_restored', False)
|
||||
|
||||
### POLICY BINDINGS
|
||||
# - identifiers:
|
||||
# policy: !KeyOf default-recovery-skip-if-restored
|
||||
# target: !KeyOf flow-binding-identification
|
||||
# order: 0
|
||||
# model: authentik_policies.policybinding
|
||||
# attrs:
|
||||
# negate: false
|
||||
# enabled: true
|
||||
# timeout: 30
|
||||
# - identifiers:
|
||||
# policy: !KeyOf default-recovery-skip-if-restored
|
||||
# target: !KeyOf flow-binding-email
|
||||
# order: 0
|
||||
# model: authentik_policies.policybinding
|
||||
# attrs:
|
||||
# negate: false
|
||||
# enabled: true
|
||||
# timeout: 30
|
||||
|
||||
|
||||
|
||||
######## Authentication Flow ########
|
||||
- attrs:
|
||||
designation: authentication
|
||||
name: custom-authentication-flow
|
||||
title: {{ env "WELCOME_MESSAGE" }}
|
||||
identifiers:
|
||||
slug: custom-authentication-flow
|
||||
id: authentication_flow
|
||||
model: authentik_flows.flow
|
||||
|
||||
### STAGES
|
||||
- attrs:
|
||||
backends:
|
||||
- authentik.core.auth.InbuiltBackend
|
||||
- authentik.sources.ldap.auth.LDAPBackend
|
||||
- authentik.core.auth.TokenBackend
|
||||
configure_flow: !Find [authentik_flows.flow, [slug, default-password-change]]
|
||||
identifiers:
|
||||
name: custom-authentication-password
|
||||
id: custom-authentication-password
|
||||
model: authentik_stages_password.passwordstage
|
||||
|
||||
- identifiers:
|
||||
name: custom-authentication-mfa-validation
|
||||
id: custom-authentication-mfa-validation
|
||||
model: authentik_stages_authenticator_validate.authenticatorvalidatestage
|
||||
|
||||
- attrs:
|
||||
password_stage: !KeyOf custom-authentication-password
|
||||
recovery_flow: !KeyOf recovery_flow # !Find [authentik_flows.flow, [slug, default-recovery-flow]]
|
||||
user_fields:
|
||||
- email
|
||||
- username
|
||||
identifiers:
|
||||
name: custom-authentication-identification
|
||||
id: custom-authentication-identification
|
||||
model: authentik_stages_identification.identificationstage
|
||||
|
||||
- attrs:
|
||||
session_duration: seconds=0
|
||||
identifiers:
|
||||
name: custom-authentication-login
|
||||
id: custom-authentication-login
|
||||
model: authentik_stages_user_login.userloginstage
|
||||
|
||||
### STAGE BINDINGS
|
||||
- identifiers:
|
||||
order: 10
|
||||
stage: !KeyOf custom-authentication-identification
|
||||
target: !KeyOf authentication_flow
|
||||
model: authentik_flows.flowstagebinding
|
||||
- identifiers:
|
||||
order: 30
|
||||
stage: !KeyOf custom-authentication-mfa-validation
|
||||
target: !KeyOf authentication_flow
|
||||
model: authentik_flows.flowstagebinding
|
||||
- identifiers:
|
||||
order: 100
|
||||
stage: !KeyOf custom-authentication-login
|
||||
target: !KeyOf authentication_flow
|
||||
model: authentik_flows.flowstagebinding
|
||||
|
||||
######## Invitation Enrollment Flow ########
|
||||
- attrs:
|
||||
designation: enrollment
|
||||
name: invitation-enrollment-flow
|
||||
title: {{ env "WELCOME_MESSAGE" }}
|
||||
identifiers:
|
||||
slug: invitation-enrollment-flow
|
||||
id: invitation-enrollment-flow
|
||||
model: authentik_flows.flow
|
||||
|
||||
### PROMPTS
|
||||
- identifiers:
|
||||
field_key: username
|
||||
label: !Context transl_username
|
||||
id: prompt-field-username
|
||||
model: authentik_stages_prompt.prompt
|
||||
attrs:
|
||||
type: username
|
||||
required: true
|
||||
placeholder: !Context transl_username
|
||||
order: 0
|
||||
placeholder_expression: false
|
||||
- identifiers:
|
||||
field_key: name
|
||||
label: !Context transl_name
|
||||
id: prompt-field-name
|
||||
model: authentik_stages_prompt.prompt
|
||||
attrs:
|
||||
type: text
|
||||
required: true
|
||||
placeholder: !Context transl_name
|
||||
order: 1
|
||||
placeholder_expression: false
|
||||
- identifiers:
|
||||
field_key: email
|
||||
label: Email
|
||||
id: prompt-field-email
|
||||
model: authentik_stages_prompt.prompt
|
||||
attrs:
|
||||
type: email
|
||||
required: true
|
||||
placeholder: muster@example.com
|
||||
order: 2
|
||||
placeholder_expression: false
|
||||
|
||||
### STAGES
|
||||
|
||||
- id: invitation-stage
|
||||
identifiers:
|
||||
name: invitation-stage
|
||||
model: authentik_stages_invitation.invitationstage
|
||||
|
||||
- attrs:
|
||||
fields:
|
||||
- !KeyOf prompt-field-username
|
||||
- !KeyOf prompt-field-name
|
||||
- !KeyOf prompt-field-email
|
||||
- !KeyOf prompt-field-password
|
||||
- !KeyOf prompt-field-password-repeat
|
||||
id: enrollment-prompt-userdata
|
||||
identifiers:
|
||||
name: enrollment-prompt-userdata
|
||||
model: authentik_stages_prompt.promptstage
|
||||
|
||||
- id: enrollment-user-write
|
||||
identifiers:
|
||||
name: enrollment-user-write
|
||||
model: authentik_stages_user_write.userwritestage
|
||||
|
||||
- attrs:
|
||||
session_duration: seconds=0
|
||||
id: enrollment-user-login
|
||||
identifiers:
|
||||
name: enrollment-user-login
|
||||
model: authentik_stages_user_login.userloginstage
|
||||
|
||||
### STAGE BINDINGS
|
||||
- identifiers:
|
||||
order: 1
|
||||
stage: !KeyOf invitation-stage
|
||||
target: !KeyOf invitation-enrollment-flow
|
||||
model: authentik_flows.flowstagebinding
|
||||
- identifiers:
|
||||
order: 10
|
||||
stage: !KeyOf enrollment-prompt-userdata
|
||||
target: !KeyOf invitation-enrollment-flow
|
||||
model: authentik_flows.flowstagebinding
|
||||
- identifiers:
|
||||
order: 20
|
||||
stage: !KeyOf enrollment-user-write
|
||||
target: !KeyOf invitation-enrollment-flow
|
||||
model: authentik_flows.flowstagebinding
|
||||
- identifiers:
|
||||
order: 100
|
||||
stage: !KeyOf enrollment-user-login
|
||||
target: !KeyOf invitation-enrollment-flow
|
||||
model: authentik_flows.flowstagebinding
|
||||
|
||||
######## System Tenant ##########
|
||||
- attrs:
|
||||
attributes:
|
||||
settings:
|
||||
locale: {{ env "DEFAULT_LANGUAGE" }}
|
||||
# branding_favicon: /static/dist/assets/icons/icon.png
|
||||
# branding_logo: /static/dist/assets/icons/icon_left_brand.svg
|
||||
# branding_title: Authentik
|
||||
# default: true
|
||||
domain: {{ env "DOMAIN" }}
|
||||
# event_retention: days=365
|
||||
flow_authentication: !KeyOf authentication_flow
|
||||
flow_recovery: !KeyOf recovery_flow
|
||||
flow_invalidation: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
|
||||
flow_user_settings: !Find [authentik_flows.flow, [slug, default-user-settings-flow]]
|
||||
identifiers:
|
||||
pk: 047cce25-aae2-4b02-9f96-078e155f803d
|
||||
id: system_tenant
|
||||
model: authentik_tenants.tenant
|
Loading…
Reference in New Issue