1 changed files with 29 additions and 0 deletions
@@ -177,3 +177,32 @@ data:
          name: default-authentication-identification
        attrs:
          recovery_flow: !KeyOf matrix_recovery_flow
  matrix-mfa-setup-redirect.yaml: |
    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
    version: 1
    metadata:
      name: matrix-mfa-setup-redirect
      labels:
        blueprints.goauthentik.io/instantiate: "true"
    entries:
      # 2FA is optional (default-authentication-mfa-validation has
      # not_configured_action=skip - login never blocks on missing MFA).
      # Users who want to opt in use these built-in single-stage setup flows
      # directly (unreachable via /if/user/, which is blocked for type=external
      # Matrix accounts). Without a stage after the setup itself, completion
      # fell back to the same blocked /if/user/ dashboard - append our redirect.
      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !Find [authentik_flows.flow, [slug, default-authenticator-totp-setup]]
          order: 10
        attrs:
          stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
      - model: authentik_flows.flowstagebinding
        state: present
        identifiers:
          target: !Find [authentik_flows.flow, [slug, default-authenticator-webauthn-setup]]
          order: 10
        attrs:
          stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]