Thore Cimbal
826fc8dbd3
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
2FA is intentionally optional (not_configured_action=skip on the login flow's validate stage). Users who opt in use the built-in single-stage default-authenticator-totp-setup / -webauthn-setup flows directly, since /if/user/ is blocked for type=external Matrix accounts. Both flows had nothing after the setup stage, so completing enrollment fell back to that same blocked dashboard. Appended the shared redirect stage.
209 lines
7.9 KiB
YAML
209 lines
7.9 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authentik-blueprints
|
|
namespace: authentik
|
|
data:
|
|
matrix-invitation-flow.yaml: |
|
|
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
|
|
version: 1
|
|
metadata:
|
|
name: matrix-invitation-flow
|
|
labels:
|
|
blueprints.goauthentik.io/instantiate: "true"
|
|
entries:
|
|
# Reaffirm the flow itself (already created manually; matched by slug)
|
|
- model: authentik_flows.flow
|
|
state: present
|
|
identifiers:
|
|
slug: matrix-invitation
|
|
id: matrix_invitation_flow
|
|
attrs:
|
|
name: matrix-invitation
|
|
title: matrix-invitation
|
|
designation: enrollment
|
|
|
|
# The prompt stage had accumulated 16 unrelated system validation_policies
|
|
# (e.g. default-user-settings-authorization, default-oobe-password-usable)
|
|
# from manual UI setup, likely a "select all" slip in the policy picker.
|
|
# These crash on an anonymous enrollment context ('AnonymousUser' object
|
|
# has no attribute 'group_attributes', etc). A prompt stage needs none here.
|
|
- model: authentik_stages_prompt.promptstage
|
|
state: present
|
|
identifiers:
|
|
name: matrix-invitation-prompt
|
|
attrs:
|
|
validation_policies: []
|
|
|
|
# Correct stage chain, mirroring the working matrix-enrollment flow:
|
|
# Invite -> Prompt (username/email/password) -> Write -> Password -> Login
|
|
# Root cause of the original bug: only Invite+Prompt were bound, both at
|
|
# order=0, so the flow never wrote the user to the DB or logged them in.
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 0
|
|
attrs:
|
|
stage: !Find [authentik_stages_invitation.invitationstage, [name, matrix-enrollment-invitation]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 1
|
|
attrs:
|
|
stage: !Find [authentik_stages_prompt.promptstage, [name, matrix-invitation-prompt]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 2
|
|
attrs:
|
|
stage: !Find [authentik_stages_user_write.userwritestage, [name, default-source-enrollment-write]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 3
|
|
attrs:
|
|
stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 4
|
|
attrs:
|
|
stage: !Find [authentik_stages_user_login.userloginstage, [name, default-source-enrollment-login]]
|
|
|
|
# Without an explicit destination, the flow falls back to Authentik's own
|
|
# /if/user/ dashboard, which refuses type=external users ("Die Oberflaeche
|
|
# kann nur von internen Nutzern geoeffnet werden") - exactly the user type
|
|
# these Matrix-only accounts correctly have. Send them to Element instead.
|
|
- model: authentik_stages_redirect.redirectstage
|
|
state: present
|
|
identifiers:
|
|
name: matrix-invitation-redirect
|
|
id: matrix_invitation_redirect_stage
|
|
attrs:
|
|
mode: static
|
|
target_static: https://axion1337.chat
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_invitation_flow
|
|
order: 5
|
|
attrs:
|
|
stage: !KeyOf matrix_invitation_redirect_stage
|
|
matrix-recovery-flow.yaml: |
|
|
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
|
|
version: 1
|
|
metadata:
|
|
name: matrix-recovery-flow
|
|
labels:
|
|
blueprints.goauthentik.io/instantiate: "true"
|
|
entries:
|
|
# matrix-recovery existed but had zero stage bindings (dead flow), and the
|
|
# real login flow (default-authentication-flow, used by the MAS OAuth2
|
|
# provider's authentication_flow) didn't link to it at all - no "Forgot
|
|
# password?" link was ever shown. Reuses the same default-recovery-*
|
|
# stages the built-in default-recovery-flow already uses successfully,
|
|
# plus our own redirect stage instead of falling back to the authentik
|
|
# dashboard (blocked for type=external Matrix users).
|
|
- model: authentik_flows.flow
|
|
state: present
|
|
identifiers:
|
|
slug: matrix-recovery
|
|
id: matrix_recovery_flow
|
|
attrs:
|
|
designation: recovery
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_recovery_flow
|
|
order: 10
|
|
attrs:
|
|
stage: !Find [authentik_stages_identification.identificationstage, [name, default-recovery-identification]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_recovery_flow
|
|
order: 20
|
|
attrs:
|
|
stage: !Find [authentik_stages_email.emailstage, [name, default-recovery-email]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_recovery_flow
|
|
order: 30
|
|
attrs:
|
|
stage: !Find [authentik_stages_prompt.promptstage, [name, "Change your password"]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_recovery_flow
|
|
order: 40
|
|
attrs:
|
|
stage: !Find [authentik_stages_user_write.userwritestage, [name, default-recovery-user-write]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_recovery_flow
|
|
order: 100
|
|
attrs:
|
|
stage: !Find [authentik_stages_user_login.userloginstage, [name, default-recovery-user-login]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !KeyOf matrix_recovery_flow
|
|
order: 110
|
|
attrs:
|
|
stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
|
|
|
|
# Wire the "Forgot password?" link on the real login flow used by MAS
|
|
- model: authentik_stages_identification.identificationstage
|
|
state: present
|
|
identifiers:
|
|
name: default-authentication-identification
|
|
attrs:
|
|
recovery_flow: !KeyOf matrix_recovery_flow
|
|
matrix-mfa-setup-redirect.yaml: |
|
|
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
|
|
version: 1
|
|
metadata:
|
|
name: matrix-mfa-setup-redirect
|
|
labels:
|
|
blueprints.goauthentik.io/instantiate: "true"
|
|
entries:
|
|
# 2FA is optional (default-authentication-mfa-validation has
|
|
# not_configured_action=skip - login never blocks on missing MFA).
|
|
# Users who want to opt in use these built-in single-stage setup flows
|
|
# directly (unreachable via /if/user/, which is blocked for type=external
|
|
# Matrix accounts). Without a stage after the setup itself, completion
|
|
# fell back to the same blocked /if/user/ dashboard - append our redirect.
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !Find [authentik_flows.flow, [slug, default-authenticator-totp-setup]]
|
|
order: 10
|
|
attrs:
|
|
stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
state: present
|
|
identifiers:
|
|
target: !Find [authentik_flows.flow, [slug, default-authenticator-webauthn-setup]]
|
|
order: 10
|
|
attrs:
|
|
stage: !Find [authentik_stages_redirect.redirectstage, [name, matrix-invitation-redirect]]
|