web/flows: Simplified flow executor #10296

BeryJu · 2024-06-29T11:09:55Z

Details

Add a simplified flow executor for applications which cannot support a modern browser engine (sigh, microsoft)

Goals: compatible with IE ~11 and EdgeHTML ~18

Supported stage:

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make website)

netlify · 2024-06-29T11:10:12Z

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	`982721f`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/668830dfb5a4690008097cda

netlify · 2024-06-29T11:10:13Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`982721f`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/668830dfcca7010008763de6
😎 Deploy Preview	https://deploy-preview-10296--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

codecov · 2024-06-29T11:15:54Z

Codecov Report

Attention: Patch coverage is 84.61538% with 4 lines in your changes missing coverage. Please review.

Project coverage is 92.62%. Comparing base (a824fda) to head (982721f).
Report is 6 commits behind head on main.

Files	Patch %	Lines
authentik/flows/views/interface.py	82.60%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10296      +/-   ##
==========================================
- Coverage   92.62%   92.62%   -0.01%     
==========================================
  Files         713      714       +1     
  Lines       34989    35011      +22     
==========================================
+ Hits        32410    32429      +19     
- Misses       2579     2582       +3

Flag	Coverage Δ
e2e	`49.60% <84.61%> (+0.02%)`	⬆️
integration	`25.36% <0.00%> (-0.02%)`	⬇️
unit	`90.12% <84.61%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-06-29T11:43:52Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-982721fe87a8ec8db5febf1eeaa24027bcbc4972
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-982721fe87a8ec8db5febf1eeaa24027bcbc4972-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-982721fe87a8ec8db5febf1eeaa24027bcbc4972

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-982721fe87a8ec8db5febf1eeaa24027bcbc4972-arm64

Afterwards, run the upgrade commands from the latest release notes.

kensternberg-authentik

I found a few problems that may not be relevant in the environment in which this code is expected to operate, just the (one generation previous) that I have set up for testing. I would still like some comments for the xak bit, though.

kensternberg-authentik · 2024-07-01T15:09:49Z

web/sfe/index.ts

+            finalData = {};
+            data.forEach((value, key) => {
+                finalData[key] = value;
+            });


Problem: I don't have MSEdge 18, only MSEdge 17. After filling in the "Email / Username" field, I received the error from MSEdge that SCRIPT438: [FormData] Object doesn't support property or method 'forEach'; I tried a variety of options (Array.from, for loop, etc) and none of them resolved to show me the data. Not sure what's going on there. I am informed that earlier versions of MSEdge should support it, but that some of the polyfills are unreliable.

kensternberg-authentik · 2024-07-01T15:10:44Z

web/sfe/index.ts

+            case "ak-stage-password":
+                new PasswordStage(this).render();
+                return;
+            case "xak-flow-redirect":


Maybe a comment here explaining why this is, what? Temporarily disabled? Commented out? Pointing to an alternative challenge component key?

xak- stages are "meta" stages that don't have their own UI and are things like redirects and shell

kensternberg-authentik · 2024-07-01T15:27:49Z

web/sfe/index.ts

+        $("#ident-form").on("submit", (ev) => {
+            ev.preventDefault();
+            const data = new FormData(ev.target as HTMLFormElement);
+            this.executor.submit(data);


My experience suggests that, rather than attempt to use these features in an IE-like environment, fall back on older-school tactics:

$("#ident-form").on("submit", (ev) => { const data = { uid_field: $('#ident-form input[name="uid_field"]').val(), }; if (this.executor.challenge.password_fields) { data["password"] = $('#ident-form input[name="password"]').val(); } this.executor.submit(data); });

Substituting this for the uid_field, and doing the equivalent for the password field, allowed me to log in. The UserLibrary didn't resolve, but... 🤷‍♀️

kensternberg-authentik · 2024-07-01T15:28:20Z

web/sfe/index.ts

+        $("#password-form input").trigger("focus");
+        $("#password-form").on("submit", (ev) => {
+            ev.preventDefault();
+            const data = new FormData(ev.target as HTMLFormElement);


$("#password-form").on("submit", (ev) => { ev.preventDefault(); const data = { password: $('#password-form input[name="password"]').val(), }; this.executor.submit(data); });

kensternberg-authentik · 2024-07-01T15:29:04Z

web/sfe/index.ts

+        $("#totp-form input").trigger("focus");
+        $("#totp-form").on("submit", (ev) => {
+            ev.preventDefault();
+            const data = new FormData(ev.target as HTMLFormElement);


Didn't test this. May have similar issues.

tanberry

changes requested, but approving so as to not hold you up...

website/docs/flow/executors/if-flow.md

website/docs/flow/executors/sfe.md

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

prevent issues in restricted browsers where users might not be able to return Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Jens L. <jens@beryju.org>

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Signed-off-by: Jens L. <jens@beryju.org>

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu · 2024-07-05T17:24:46Z

/cherry-pick version-2024.6

gcp-cherry-pick-bot · 2024-07-05T17:50:26Z

Cherry-pick failed with Merge error bfc2fe7703a072200a3611a63b733ee146828190 into temp-cherry-pick-c2aeae-version-2024.6

gcp-cherry-pick-bot · 2024-07-05T17:50:38Z

Cherry-pick failed with Merge error bfc2fe7703a072200a3611a63b733ee146828190 into temp-cherry-pick-c2aeae-version-2024.6

* initial sfe Signed-off-by: Jens Langhammer <jens@goauthentik.io> * build sfe Signed-off-by: Jens Langhammer <jens@goauthentik.io> * downgrade bootstrap Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix path Signed-off-by: Jens Langhammer <jens@goauthentik.io> * make IE compatible Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix query string missing Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add autosubmit stage Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add background image Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add code support Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add support for combo ident/password Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix logo rendering Signed-off-by: Jens Langhammer <jens@goauthentik.io> * only use for edge 18 and before Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix lint Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add docs Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add webauthn support Signed-off-by: Jens Langhammer <jens@goauthentik.io> * migrate to TS for some creature comforts Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix ci Signed-off-by: Jens Langhammer <jens@goauthentik.io> * dedupe dependabot Signed-off-by: Jens Langhammer <jens@goauthentik.io> * use API client...kinda Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add more docs Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add more polyfills yay Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix Signed-off-by: Jens Langhammer <jens@goauthentik.io> * turn powered by into span prevent issues in restricted browsers where users might not be able to return Signed-off-by: Jens Langhammer <jens@goauthentik.io> * allow non-link footer entries Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix tsc errors Signed-off-by: Jens Langhammer <jens@goauthentik.io> * Apply suggestions from code review Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Jens L. <jens@beryju.org> * auto switch for macos Signed-off-by: Jens Langhammer <jens@goauthentik.io> * reword Signed-off-by: Jens Langhammer <jens@goauthentik.io> * Update website/docs/flow/executors/if-flow.md Signed-off-by: Jens L. <jens@beryju.org> * format Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Signed-off-by: Jens L. <jens@beryju.org> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Jens Langhammer <jens@goauthentik.io> # Conflicts: # .github/workflows/ci-web.yml # Dockerfile # website/developer-docs/api/flow-executor.md

* main: (350 commits) web: bump @swc/core from 1.6.6 to 1.6.7 in /web/sfe (#10395) web: bump @sentry/browser from 8.14.0 to 8.15.0 in /web in the sentry group across 1 directory (#10388) website/integrations: aws: cleanup (#10355) web: bump API Client version (#10389) web/flows: Simplified flow executor (#10296) website/docs: sources: ldap: remove extra example (#10387) website/docs: add new content from old PR #9524 (#10158) stages/authenticator_validate: fix friendly_name being required (#10382) core: bump go api client (#10383) web: bump API Client version (#10381) outposts: make refresh interval configurable (#10138) core, web: update translations (#10378) web: bump @sentry/browser from 8.13.0 to 8.14.0 in /web in the sentry group (#10379) core: bump goauthentik.io/api/v3 from 3.2024060.3 to 3.2024060.4 (#10380) sources/oauth: fix link not being saved (#10374) website/docs: update postgres on docker: fix backtick (#10372) website/integrations: apache guacamole: cleanup doc page (#10354) web: bump API Client version (#10371) Revert "core: applications api: add option to only list apps with launch url (#10336)" (#10370) web: bump @wdio/cli from 8.39.0 to 8.39.1 in /web (#10362) ...

* main: (179 commits) website/integrations: add offline_access scope to DokuWiki (#10208) api: use custom json renderer for speed (#9977) core: bump github.com/sethvargo/go-envconfig from 1.0.3 to 1.1.0 (#10405) core: bump goauthentik.io/api/v3 from 3.2024060.5 to 3.2024060.6 (#10404) web: bump glob from 10.4.2 to 10.4.3 in /web (#10407) web: bump @swc/core from 1.6.7 to 1.6.13 in /web/sfe (#10408) core: bump ruff from 0.5.0 to 0.5.1 (#10390) web: bump @swc/cli from 0.3.14 to 0.4.0 in /web/sfe (#10394) core: bump certifi from 2024.2.2 to 2024.7.4 (#10398) web: bump @swc/core from 1.6.6 to 1.6.7 in /web/sfe (#10395) web: bump @sentry/browser from 8.14.0 to 8.15.0 in /web in the sentry group across 1 directory (#10388) website/integrations: aws: cleanup (#10355) web: bump API Client version (#10389) web/flows: Simplified flow executor (#10296) website/docs: sources: ldap: remove extra example (#10387) website/docs: add new content from old PR #9524 (#10158) stages/authenticator_validate: fix friendly_name being required (#10382) core: bump go api client (#10383) web: bump API Client version (#10381) outposts: make refresh interval configurable (#10138) ...

* main: (29 commits) website/integrations: aws: cleanup (#10355) web: bump API Client version (#10389) web/flows: Simplified flow executor (#10296) website/docs: sources: ldap: remove extra example (#10387) website/docs: add new content from old PR #9524 (#10158) stages/authenticator_validate: fix friendly_name being required (#10382) core: bump go api client (#10383) web: bump API Client version (#10381) outposts: make refresh interval configurable (#10138) core, web: update translations (#10378) web: bump @sentry/browser from 8.13.0 to 8.14.0 in /web in the sentry group (#10379) core: bump goauthentik.io/api/v3 from 3.2024060.3 to 3.2024060.4 (#10380) sources/oauth: fix link not being saved (#10374) website/docs: update postgres on docker: fix backtick (#10372) website/integrations: apache guacamole: cleanup doc page (#10354) web: bump API Client version (#10371) Revert "core: applications api: add option to only list apps with launch url (#10336)" (#10370) web: bump @wdio/cli from 8.39.0 to 8.39.1 in /web (#10362) core: bump goauthentik.io/api/v3 from 3.2024060.2 to 3.2024060.3 (#10356) website: bump react-tooltip from 5.27.0 to 5.27.1 in /website (#10357) ...

BeryJu requested review from a team as code owners June 29, 2024 11:09

BeryJu added the deploy_me Deploy the PR changes on a test environment label Jun 29, 2024

BeryJu removed the deploy_me Deploy the PR changes on a test environment label Jun 29, 2024

BeryJu force-pushed the web/flows/sfe branch from ce3ba27 to eb7228c Compare June 30, 2024 13:51

BeryJu requested a review from a team as a code owner June 30, 2024 13:51

kensternberg-authentik reviewed Jul 1, 2024

View reviewed changes

tanberry approved these changes Jul 2, 2024

View reviewed changes

BeryJu force-pushed the web/flows/sfe branch from 1538706 to 9530e4b Compare July 2, 2024 20:07

BeryJu added 16 commits July 5, 2024 11:59

initial sfe

319186c

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

build sfe

283aafc

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

downgrade bootstrap

84d5a8f

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix path

985323e

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

make IE compatible

0babef7

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix query string missing

505bc67

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add autosubmit stage

e7d4ef2

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add background image

3965c07

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add code support

21f412e

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add support for combo ident/password

47d68db

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix logo rendering

ad4cbae

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

only use for edge 18 and before

2b6b97f

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix lint

f051800

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add docs

803634f

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add webauthn support

c9a893f

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

migrate to TS for some creature comforts

834b74c

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu added 8 commits July 5, 2024 11:59

fix ci

51365fa

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

dedupe dependabot

3c0bf4d

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

use API client...kinda

9834114

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add more docs

cb70f35

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add more polyfills yay

5399337

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

fix

f75ac7b

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

turn powered by into span

744cf71

prevent issues in restricted browsers where users might not be able to return Signed-off-by: Jens Langhammer <jens@goauthentik.io>

allow non-link footer entries

0146d4b

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu force-pushed the web/flows/sfe branch from 7558046 to 0146d4b Compare July 5, 2024 09:59

BeryJu and others added 6 commits July 5, 2024 16:39

fix tsc errors

d2f0334

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Apply suggestions from code review

41ebbb8

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Jens L. <jens@beryju.org>

auto switch for macos

1352f02

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

reword

b98f0f4

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Update website/docs/flow/executors/if-flow.md

51096a3

Signed-off-by: Jens L. <jens@beryju.org>

format

982721f

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu merged commit bfc2fe7 into main Jul 5, 2024
58 of 59 checks passed

BeryJu deleted the web/flows/sfe branch July 5, 2024 17:24

This was referenced Jul 23, 2024

SAML Authentication is not working on Embedded browser (Palo Alto Global protect app). #8396

Closed

Palo alto global protect Saml 2.0 - getting not found error when i am trying to access it using global protect client . #8223

Closed

mokrinsky mentioned this pull request Sep 28, 2024

Support the new flow used in Authentik Versent/saml2aws#1350

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

web/flows: Simplified flow executor #10296

web/flows: Simplified flow executor #10296

BeryJu commented Jun 29, 2024 •

edited

Loading

netlify bot commented Jun 29, 2024 •

edited

Loading

netlify bot commented Jun 29, 2024 •

edited

Loading

codecov bot commented Jun 29, 2024 •

edited

Loading

github-actions bot commented Jun 29, 2024 •

edited

Loading

kensternberg-authentik left a comment

kensternberg-authentik Jul 1, 2024

kensternberg-authentik Jul 1, 2024

BeryJu Jul 1, 2024

kensternberg-authentik Jul 1, 2024

kensternberg-authentik Jul 1, 2024

kensternberg-authentik Jul 1, 2024

tanberry left a comment

BeryJu commented Jul 5, 2024

gcp-cherry-pick-bot bot commented Jul 5, 2024

gcp-cherry-pick-bot bot commented Jul 5, 2024

web/flows: Simplified flow executor #10296

web/flows: Simplified flow executor #10296

Conversation

BeryJu commented Jun 29, 2024 • edited Loading

Details

Checklist

netlify bot commented Jun 29, 2024 • edited Loading

✅ Deploy Preview for authentik-storybook canceled.

netlify bot commented Jun 29, 2024 • edited Loading

✅ Deploy Preview for authentik-docs ready!

codecov bot commented Jun 29, 2024 • edited Loading

Codecov Report

github-actions bot commented Jun 29, 2024 • edited Loading

kensternberg-authentik left a comment

Choose a reason for hiding this comment

kensternberg-authentik Jul 1, 2024

Choose a reason for hiding this comment

kensternberg-authentik Jul 1, 2024

Choose a reason for hiding this comment

BeryJu Jul 1, 2024

Choose a reason for hiding this comment

kensternberg-authentik Jul 1, 2024

Choose a reason for hiding this comment

kensternberg-authentik Jul 1, 2024

Choose a reason for hiding this comment

kensternberg-authentik Jul 1, 2024

Choose a reason for hiding this comment

tanberry left a comment

Choose a reason for hiding this comment

BeryJu commented Jul 5, 2024

gcp-cherry-pick-bot bot commented Jul 5, 2024

gcp-cherry-pick-bot bot commented Jul 5, 2024

BeryJu commented Jun 29, 2024 •

edited

Loading

netlify bot commented Jun 29, 2024 •

edited

Loading

netlify bot commented Jun 29, 2024 •

edited

Loading

codecov bot commented Jun 29, 2024 •

edited

Loading

github-actions bot commented Jun 29, 2024 •

edited

Loading