Thore Cimbal
027f567c8b
After the login stage, the flow had no destination, so it fell back to authentik's own /if/user/ interface - which refuses type=external users (the correct type for Matrix-only accounts), showing "Die Oberflaeche kann nur von internen Nutzern geoeffnet werden". Added a static redirect to https://axion1337.chat as the final stage.
102 lines
3.7 KiB
YAML
102 lines
3.7 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authentik-blueprints
|
|
namespace: authentik
|
|
data:
|
|
matrix-invitation-flow.yaml: |
|
|
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
|
|
version: 1
|
|
metadata:
|
|
name: matrix-invitation-flow
|
|
labels:
|
|
blueprints.goauthentik.io/instantiate: "true"
|
|
entries:
|
|
# Reaffirm the flow itself (already created manually; matched by slug)
|
|
- model: authentik_flows.flow
|
|
state: present
|
|
identifiers:
|
|
slug: matrix-invitation
|
|
id: matrix_invitation_flow
|
|
attrs:
|
|
name: matrix-invitation
|
|
title: matrix-invitation
|
|
designation: enrollment
|
|
|
|
# The prompt stage had accumulated 16 unrelated system validation_policies
|
|
# (e.g. default-user-settings-authorization, default-oobe-password-usable)
|
|
# from manual UI setup, likely a "select all" slip in the policy picker.
|
|
# These crash on an anonymous enrollment context ('AnonymousUser' object
|
|
# has no attribute 'group_attributes', etc). A prompt stage needs none here.
|
|
- model: authentik_stages_prompt.promptstage
|
|
state: present
|
|
identifiers:
|
|
name: matrix-invitation-prompt
|
|
attrs:
|
|
validation_policies: []
|
|
|
|
# Correct stage chain, mirroring the working matrix-enrollment flow:
|
|
# Invite -> Prompt (username/email/password) -> Write -> Password -> Login
|
|
# Root cause of the original bug: only Invite+Prompt were bound, both at
|
|
# order=0, so the flow never wrote the user to the DB or logged them in.
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 0
|
|
attrs:
|
|
stage: !Find [authentik_stages_invitation.invitationstage, [name, matrix-enrollment-invitation]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 1
|
|
attrs:
|
|
stage: !Find [authentik_stages_prompt.promptstage, [name, matrix-invitation-prompt]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 2
|
|
attrs:
|
|
stage: !Find [authentik_stages_user_write.userwritestage, [name, default-source-enrollment-write]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 3
|
|
attrs:
|
|
stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 4
|
|
attrs:
|
|
stage: !Find [authentik_stages_user_login.userloginstage, [name, default-source-enrollment-login]]
|
|
|
|
# Without an explicit destination, the flow falls back to Authentik's own
|
|
# /if/user/ dashboard, which refuses type=external users ("Die Oberflaeche
|
|
# kann nur von internen Nutzern geoeffnet werden") - exactly the user type
|
|
# these Matrix-only accounts correctly have. Send them to Element instead.
|
|
- model: authentik_stages_redirect.redirectstage
|
|
state: present
|
|
identifiers:
|
|
name: matrix-invitation-redirect
|
|
id: matrix_invitation_redirect_stage
|
|
attrs:
|
|
mode: static
|
|
target_static: https://axion1337.chat
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 5
|
|
attrs:
|
|
stage: !KeyOf matrix_invitation_redirect_stage
|