From 784459beed0ed00f2c89c2419633e91b5ce91020 Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Mon, 27 Jul 2026 23:11:38 +0200 Subject: [PATCH] fix: Clear erroneous validation_policies on matrix-invitation-prompt The prompt stage had 16 unrelated system policies bound (OOBE, user settings, recovery, etc.), likely from a "select all" slip while configuring it manually. They crash when evaluated in an anonymous enrollment context (AnonymousUser has no group_attributes, etc.), surfacing as opaque errors after form submit. Cleared live and via the blueprint so re-application doesn't reintroduce them. --- apps/authentik/authentik-blueprints.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml index eba7b98..c1821c9 100644 --- a/apps/authentik/authentik-blueprints.yaml +++ b/apps/authentik/authentik-blueprints.yaml @@ -23,6 +23,18 @@ data: title: matrix-invitation designation: enrollment + # The prompt stage had accumulated 16 unrelated system validation_policies + # (e.g. default-user-settings-authorization, default-oobe-password-usable) + # from manual UI setup, likely a "select all" slip in the policy picker. + # These crash on an anonymous enrollment context ('AnonymousUser' object + # has no attribute 'group_attributes', etc). A prompt stage needs none here. + - model: authentik_stages_prompt.promptstage + state: present + identifiers: + name: matrix-invitation-prompt + attrs: + validation_policies: [] + # Correct stage chain, mirroring the working matrix-enrollment flow: # Invite -> Prompt (username/email/password) -> Write -> Password -> Login # Root cause of the original bug: only Invite+Prompt were bound, both at