From 95e750f19bef72f6b5fe1dd7f0472992d3f53d67 Mon Sep 17 00:00:00 2001 From: Dominic Roy Date: Tue, 14 Jul 2026 06:37:52 -0400 Subject: [PATCH] Cherry-pick #23967 to version-2026.5 (with conflicts) This cherry-pick has conflicts that need manual resolution. Original PR: #23967 Original commit: a694dcffca4d59d728639fba74c8751d308ea008 --- .../applications/manage_apps.mdx | 2 +- .../flows-stages/flow/context/index.mdx | 2 +- .../flows-stages/flow/planner.md | 42 ++++++++++ .../stages/authenticator_duo/index.md | 6 ++ .../flows-stages/stages/prompt/index.md | 2 +- .../add-secure-apps/providers/entra/index.md | 2 +- .../add-secure-apps/providers/gws/index.md | 2 +- .../providers/oauth2/token_exchange.md | 81 +++++++++++++++++++ .../add-secure-apps/providers/proxy/index.md | 4 +- .../add-secure-apps/providers/saml/index.md | 4 +- .../providers/scim/create-scim-provider.md | 2 +- .../add-secure-apps/providers/scim/index.md | 2 +- .../add-secure-apps/providers/ssf/index.md | 4 +- website/docs/customize/blueprints/export.mdx | 2 +- website/docs/customize/blueprints/index.mdx | 4 +- website/docs/customize/file-picker.md | 2 +- website/docs/customize/files.md | 2 +- .../interfaces/_enabledfeatureslist.mdx | 2 +- .../policies/types/password-uniqueness.md | 2 +- .../docs/writing-documentation.md | 14 ++-- .../setup/full-dev-environment.mdx | 2 +- .../authentik-agent/index.mdx | 2 +- .../device-compliance/configuration.md | 2 +- .../device-compliance/connectors/index.mdx | 8 +- .../device-compliance-policy.md | 2 +- .../device-compliance/device-reporting.md | 2 +- website/docs/install-config/beta.mdx | 2 +- .../configuration/configuration.mdx | 2 +- .../docs/install-config/first-steps/index.mdx | 4 +- website/docs/sys-mgmt/background-tasks.md | 2 +- website/docs/sys-mgmt/certificates.md | 2 +- .../docs/sys-mgmt/events/logging-events.mdx | 2 +- .../sys-mgmt/object-lifecycle-management.md | 4 +- website/docs/sys-mgmt/ops/geoip.mdx | 2 +- website/docs/sys-mgmt/ops/storage-s3.md | 4 +- website/docs/troubleshooting/logs/logs.mdx | 8 +- .../troubleshooting/logs/outpost_logs.mdx | 8 +- .../postgres/upgrade_kubernetes.md | 2 +- .../access-control/permissions.md | 2 +- .../users-sources/groups/manage_groups.mdx | 2 +- website/docs/users-sources/roles/index.md | 2 +- .../sources/social-logins/apple/index.md | 8 +- .../sources/social-logins/discord/index.md | 6 +- .../sources/social-logins/github/index.mdx | 2 +- .../sources/social-logins/index.mdx | 2 +- 45 files changed, 198 insertions(+), 69 deletions(-) create mode 100644 website/docs/add-secure-apps/flows-stages/flow/planner.md create mode 100644 website/docs/add-secure-apps/providers/oauth2/token_exchange.md diff --git a/website/docs/add-secure-apps/applications/manage_apps.mdx b/website/docs/add-secure-apps/applications/manage_apps.mdx index 5541648ba75c..f4087527f88c 100644 --- a/website/docs/add-secure-apps/applications/manage_apps.mdx +++ b/website/docs/add-secure-apps/applications/manage_apps.mdx @@ -69,7 +69,7 @@ An authentik admin can create an entitlement [in the Admin interface](#create-an Because entitlements exist within an application, names of entitlements must be unique within an application. This also means that entitlements are deleted when an application is deleted. -### Using entitlements +### Use entitlements Entitlements to which a user has access can be retrieved using the `user.app_entitlements()` function in property mappings/policies. This function needs to be passed the specific application for which to get the entitlements. For example: diff --git a/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx b/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx index 58f720294227..a28dea47282d 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx +++ b/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx @@ -5,7 +5,7 @@ toc_max_heading_level: 5 Each flow execution has an independent _context_. This context holds all of the arbitrary data about that specific flow, data which can then be used and transformed by stages and policies. -## Managing data in a flow context +## Manage data in a flow context You create and manage the data for a context by configuring policies, stages, and bindings. As you plan your flow, and set up the required stages, etc. you are creating the context data for that flow. diff --git a/website/docs/add-secure-apps/flows-stages/flow/planner.md b/website/docs/add-secure-apps/flows-stages/flow/planner.md new file mode 100644 index 000000000000..1049a244da9e --- /dev/null +++ b/website/docs/add-secure-apps/flows-stages/flow/planner.md @@ -0,0 +1,42 @@ +--- +title: Flow Planner +--- + +The Flow Planner is the component of authentik that takes a configured [flow](./index.md) and, for each incoming request for that flow, determines the specific stages to run and the order in which they will run. + +A flow describes a sequence of stages and policies. A flow plan is the per-session execution plan derived from that flow after authentik evaluates the request, the user, and the policies bound to the flow and its stage bindings. + +## How the planner works + +When a flow is executed, authentik creates a flow plan and does the following: + +1. Verifies that the flow can be used in the current authentication context. +2. Evaluates policies bound directly to the flow. +3. Loads the flow's stage bindings in order. +4. Evaluates stage binding policies when **Evaluate when flow is planned** is enabled. +5. Stores the resulting ordered stage list and [flow context](./context/index.mdx) in the user's session. + +The [flow executor](./executors/if-flow.md) then presents the first stage of the flow plan. When the stage completes successfully, authentik removes it from the flow plan and continues with the next stage. When no stages remain, the flow plan has completed. + +## Planning and stage policies + +Stage binding policies can be evaluated at two different times: + +- **Evaluate when flow is planned**: The policy is evaluated when the flow plan is created. If the policy does not pass, that stage is not included in the plan. +- **Evaluate when stage is run** (_default_): The policy is evaluated immediately before the stage is presented. If the policy does not pass at that point, authentik skips that stage and continues with the next planned stage. + +Both options can be enabled for the same stage binding. Use planning-time evaluation when a policy can be evaluated before any stages run. Use run-time evaluation when a policy depends on data that might be added to the flow context by earlier stages. + +For example, a password stage usually depends on the user identified by an earlier identification stage. If a policy for a later stage depends on `pending_user`, evaluate that policy when the stage is run, or ensure `pending_user` is already present when the plan is created. + +## Inspect a plan + +Use the [Flow Inspector](./inspector.md) to execute a flow and, while it executes, view the current stage, the next planned stage, the plan history, and the current plan context. + +The Flow Inspector is accessed via the Flow Overview page and is particularly useful for troubleshooting flows and determining why stage binding policies fail to pass. It's also useful to evaluate values for use in policies. + +## Caching and session state + +authentik can cache flow plans so repeated executions of the same flow for the same user do not need to rebuild the same stage list every time. The active plan for a running flow is stored in the HTTP session, so browser-based and API-based flow executors must keep using the same session while the flow is running. + +If flow behavior changes after editing stage bindings or policies, start a new flow execution before troubleshooting. Existing sessions may already have a plan in progress. diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md index c25a228d1999..91d6b8f598c0 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md @@ -35,7 +35,13 @@ To require Duo during authentication, add an [Authenticator Validation stage](.. Due to the way the Duo API works, authentik can only automatically import existing Duo users when a Duo MFA or higher license is active. ::: +<<<<<<< HEAD If you already have Duo users, you can import their authenticators into authentik from the admin UI. The Duo username can be found in the Duo Admin dashboard under **Users**. If needed, you can also use the Duo user ID shown in the Duo Admin URL for that user. +======= +The Duo Auth API enrollment flow creates a new Duo user. If a Duo user already exists with the same username, Duo rejects the enrollment request. To use that existing Duo user in authentik, configure the optional Duo Admin API credentials on the stage and import the authenticator instead of using the enrollment flow. If the Admin API is not available, delete or rename the existing Duo user before enrolling the authenticator. + +If you already have Duo users, you can import their authenticators into authentik from the Admin interface. The Duo username can be found in the Duo Admin dashboard under **Users**. If needed, you can also use the Duo user ID shown in the Duo Admin URL for that user. +>>>>>>> a694dcffc (website/docs: cleanup 07-12: use direct documentation wording (#23967)) For direct API use, the import endpoint accepts: diff --git a/website/docs/add-secure-apps/flows-stages/stages/prompt/index.md b/website/docs/add-secure-apps/flows-stages/stages/prompt/index.md index 7e63629c6f58..61aebe123e81 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/prompt/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/prompt/index.md @@ -76,7 +76,7 @@ Common follow-ups include: ## Notes -### Accessing submitted data +### Access submitted data Prompt values are stored in `prompt_data`: diff --git a/website/docs/add-secure-apps/providers/entra/index.md b/website/docs/add-secure-apps/providers/entra/index.md index 8905915babc4..f68c2a31c699 100644 --- a/website/docs/add-secure-apps/providers/entra/index.md +++ b/website/docs/add-secure-apps/providers/entra/index.md @@ -56,7 +56,7 @@ By default, authentik only maps a group's name, `mail_enabled` status, `security Refer to the Entra ID documentation for further details on these attributes and which attributes can be mapped: [Microsoft Graph - Create Group](https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0&tabs=http#request-body) -### Skipping objects during synchronization +### Skip objects during synchronization To exclude specific users or groups from Entra ID synchronization, you can create a property mapping that raises the `SkipObject` exception. When this exception is raised during the evaluation of a property mapping, the object is skipped and the sync continues with the next object. diff --git a/website/docs/add-secure-apps/providers/gws/index.md b/website/docs/add-secure-apps/providers/gws/index.md index 82d506fe45f6..02e0e6c871d5 100644 --- a/website/docs/add-secure-apps/providers/gws/index.md +++ b/website/docs/add-secure-apps/providers/gws/index.md @@ -58,7 +58,7 @@ By default, authentik only maps a group's name. Refer to Google documentation for further details on which attributes can be mapped: [Google Workspace Reference - Resource: Group](https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups#Group) -### Skipping objects during synchronization +### Skip objects during synchronization To exclude specific users or groups from Google Workspace synchronization, you can create a property mapping that raises the `SkipObject` exception. When this exception is raised during the evaluation of a property mapping, the object is skipped and the sync continues with the next object. diff --git a/website/docs/add-secure-apps/providers/oauth2/token_exchange.md b/website/docs/add-secure-apps/providers/oauth2/token_exchange.md new file mode 100644 index 000000000000..b92e6e3d1ad2 --- /dev/null +++ b/website/docs/add-secure-apps/providers/oauth2/token_exchange.md @@ -0,0 +1,81 @@ +--- +title: Token exchange +--- + +Token exchange allows a client to trade a token it already holds for a new token issued by a different authentik provider. It is defined by [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693), whose abstract states: + +> This specification defines a protocol for an HTTP- and JSON-based Security Token Service (STS) by defining how to request and obtain security tokens from OAuth 2.0 authorization servers, including security tokens employing impersonation and delegation. + +The typical use is a service that must call another service on behalf of the user who called it. The calling service presents the access token it received as a _subject token_, and receives a token that the second service accepts. + +authentik implements _impersonation_: the issued token speaks for the user identified by the subject token, and records no acting party. _Delegation_, in which the issued token names both the user and the service acting on their behalf, is not supported. + +### Requirements + +The provider performing the exchange must have `Token exchange` selected under **Grant Types**. + +The subject token must be verifiable by that provider. Under **Machine-to-Machine authentication settings**, either: + +- Add the provider that issued the subject token to **Federated OAuth2/OpenID Providers**, or +- Add the source that issued the subject token to **Federated OIDC Sources**. + +A subject token that neither trust relationship covers is rejected. This is the same trust configuration used by the [machine-to-machine](./machine_to_machine.mdx) JWT flow. + +Confidential clients must authenticate to the token endpoint. The subject token is not a substitute for client credentials. + +### Exchange a token + +Send a POST request to the token endpoint: + +```http +POST /application/o/token/ HTTP/1.1 +Host: authentik.company +Content-Type: application/x-www-form-urlencoded + +grant_type=urn:ietf:params:oauth:grant-type:token-exchange& +client_id=application_client_id& +client_secret=application_client_secret& +subject_token=token_issued_by_the_federated_provider& +subject_token_type=urn:ietf:params:oauth:token-type:access_token& +scope=openid email +``` + +The response contains the following fields: + +- `access_token`: The issued token +- `issued_token_type`: The type identifier of the issued token +- `token_type`: Always `Bearer` +- `expires_in`: The total seconds after which the issued token will expire +- `scope`: The scopes granted to the issued token + +The issued token is a new access token for the requesting provider, carrying the identity of the user named by the subject token. + +### Supported token types + +`subject_token_type` and `requested_token_type` accept: + +- `urn:ietf:params:oauth:token-type:access_token` +- `urn:ietf:params:oauth:token-type:jwt` + +authentik access tokens are themselves JWTs, so both identifiers refer to the same token. `requested_token_type` is optional and defaults to `urn:ietf:params:oauth:token-type:access_token`. + +Any other token type is rejected with `invalid_request`. + +### Unsupported parameters + +authentik rejects the following rather than ignoring them, so that a client is never led to believe a restriction was applied when it was not: + +- `actor_token` and `actor_token_type` are rejected with `invalid_request`, because delegation is not supported. +- `audience` and `resource` are rejected with `invalid_target`, because the issued token cannot be scoped to a named target. + +### Scopes + +The scopes granted to the issued token are the requested `scope` values, reduced to those the requesting provider is configured to issue. If `scope` is omitted, the issued token is granted no scopes. + +### Configure token exchange + +1. Log in to authentik as an administrator and open the authentik Admin interface. +2. Navigate to **Applications** > **Providers** and click the **Edit** icon on the provider that will perform the exchange. +3. Under **Grant Types**, select `Token exchange`. +4. Expand **Machine-to-Machine authentication settings** and add the issuing provider to **Federated OAuth2/OpenID Providers**. +5. Click **Update**. diff --git a/website/docs/add-secure-apps/providers/proxy/index.md b/website/docs/add-secure-apps/providers/proxy/index.md index 5c80a0172785..3eba492982e4 100644 --- a/website/docs/add-secure-apps/providers/proxy/index.md +++ b/website/docs/add-secure-apps/providers/proxy/index.md @@ -85,7 +85,7 @@ The outpost listens on port `9000` for HTTP and port `9443` for HTTPS. If your upstream host is HTTPS, and you're not using forward auth, you need to access the outpost over HTTPS too. ::: -## Logging out +## Log out Login is initiated automatically when you visit the protected application without a valid cookie. @@ -96,7 +96,7 @@ To log out, navigate to `/outpost.goauthentik.io/sign_out` on the host that serv Logging out of a provider invalidates all sessions for that user within the respective outpost. -## Allowing unauthenticated requests +## Allow unauthenticated requests To allow unauthenticated requests to specific paths or URLs, use the **Unauthenticated Paths** or **Unauthenticated URLs** field on the proxy provider. diff --git a/website/docs/add-secure-apps/providers/saml/index.md b/website/docs/add-secure-apps/providers/saml/index.md index d968d76ea84f..5c4da093047a 100644 --- a/website/docs/add-secure-apps/providers/saml/index.md +++ b/website/docs/add-secure-apps/providers/saml/index.md @@ -28,11 +28,11 @@ The previous binding-specific endpoints (`/sso/binding/redirect/`, `/sso/binding SAML Metadata ensures that SAML single sign-on works reliably by exchanging and maintaining identity and connection information. SAML metadata is an XML document that defines how IdPs and SPs securely interact for authentication. It includes information such as endpoints, bindings, certificates, and unique identifiers. -### Importing SP SAML metadata +### Import SP SAML metadata You can [import SP SAML metadata](./create-saml-provider.md#create-a-saml-provider-from-sp-metadata-import-sp-metadata) to automatically configure a SAML provider based on the requirements of an SP. -### Exporting authentik SAML metadata +### Export authentik SAML metadata You can [export SAML metadata from an authentik SAML provider](./create-saml-provider.md#export-authentik-saml-provider-metadata) to an SP to automatically provide important endpoint and certificate information to the SP. diff --git a/website/docs/add-secure-apps/providers/scim/create-scim-provider.md b/website/docs/add-secure-apps/providers/scim/create-scim-provider.md index 7258c50f626c..c938f666274a 100644 --- a/website/docs/add-secure-apps/providers/scim/create-scim-provider.md +++ b/website/docs/add-secure-apps/providers/scim/create-scim-provider.md @@ -67,5 +67,5 @@ If you selected **OAuth (Interactive)** as the **Authentication mode** for the S 2. Navigate to **Applications** > **Providers** and click the name of the new SCIM provider. 3. Next to **OAuth Status**, click **(Re-)Authenticate**. 4. You should be redirected to the SCIM endpoint that you are provisioning to for authentication. -5. Once authenticated, you should be redirected back to authentik. If successful, **OAuth Status** should now show as **Authenticated**. +5. After you authenticate, you should be redirected back to authentik. If successful, **OAuth Status** should now show as **Authenticated**. This step is only required when initially configuring the SCIM provider; subsequent authentications will be automatic. diff --git a/website/docs/add-secure-apps/providers/scim/index.md b/website/docs/add-secure-apps/providers/scim/index.md index 9a50534bf686..17939fa7fadb 100644 --- a/website/docs/add-secure-apps/providers/scim/index.md +++ b/website/docs/add-secure-apps/providers/scim/index.md @@ -83,7 +83,7 @@ return { Use the schema URN and field names expected by the target SCIM service. If the remote service supports only a fixed set of schemas or filters unknown attributes from responses, the attribute might not appear even when authentik sends it. -#### Skipping objects during synchronization +#### Skip objects during synchronization To exclude specific users or groups from SCIM synchronization, you can create a property mapping that raises the `SkipObject` exception. When this exception is raised during the evaluation of a property mapping, the object is skipped and the sync continues with the next object. diff --git a/website/docs/add-secure-apps/providers/ssf/index.md b/website/docs/add-secure-apps/providers/ssf/index.md index 128ef22b33d4..8c2a46c0d1fa 100644 --- a/website/docs/add-secure-apps/providers/ssf/index.md +++ b/website/docs/add-secure-apps/providers/ssf/index.md @@ -19,13 +19,13 @@ Refer to our documentation to learn how to [create a SSF provider](./create-ssf- ## Example use cases -One important use case for SSF is to [integrate Apple Business Manager](https://integrations.goauthentik.io/device-management/apple/) or any of the Apple device management platforms with authentik, so that users can enroll their Apple devices using their authentik credentials. When a user signs in with their email address, Apple redirects them to authentik for authentication. Once authenticated, Apple enrolls the user's device and grants access to Apple services. +One important use case for SSF is to [integrate Apple Business Manager](https://integrations.goauthentik.io/device-management/apple/) or any of the Apple device management platforms with authentik, so that users can enroll their Apple devices using their authentik credentials. When a user signs in with their email address, Apple redirects them to authentik for authentication. After authentication, Apple enrolls the user's device and grants access to Apple services. Another use case for SSF is when an administrator wants to know when a user logs out of authentik, so that the user is then also automatically logged out of all other work-focused applications. Another example use case is when an application uses SSF to subscribe to authorization events because the application needs to know if a user changed their password in authentik. If a user did change their password, then the application receives a POST request to write the fact that the password was changed. -## Using the authentik SSF provider +## Use the authentik SSF provider The SSF provider serves as a [backchannel provider](../../applications/manage_apps#backchannel-providers). Backchannel providers are used to augment the functionality of the main provider for an application. diff --git a/website/docs/customize/blueprints/export.mdx b/website/docs/customize/blueprints/export.mdx index f8d0ee6329bd..7e53f62e6531 100644 --- a/website/docs/customize/blueprints/export.mdx +++ b/website/docs/customize/blueprints/export.mdx @@ -18,6 +18,6 @@ A specific flow with its attached stages, policies, and other objects can be exp This export can be triggered via the API or the Admin interface by clicking the **Export** button (download icon) next to the flow in the flow list. -## Cleaning up +## Clean up Exports from either method will contain a (potentially) long list of objects, all with hardcoded primary keys and no ability for templating/instantiation. This is because currently, authentik does not check which primary keys are used where. It is assumed that for most exports, there'll be some manual changes done regardless, to filter out unwanted objects, adjust properties, etc. diff --git a/website/docs/customize/blueprints/index.mdx b/website/docs/customize/blueprints/index.mdx index 2a19905c418f..26685eabf55b 100644 --- a/website/docs/customize/blueprints/index.mdx +++ b/website/docs/customize/blueprints/index.mdx @@ -8,7 +8,7 @@ Blueprints are used to manage authentik's default flows and other system objects Custom blueprints can be used to replace or modify default blueprints in certain circumstances. For example, you could create a new flow that is based on the `default-authentication-flow` but adds an additional stage or policy. -## Applying blueprints +## Apply blueprints To _apply_ a blueprint means that the content in the blueprint file is instantiated and then implemented by authentik. Blueprints can be applied in one of two ways: @@ -79,7 +79,7 @@ Any additional `.yaml` file in `/blueprints` will be discovered and automaticall To disable existing blueprints, an empty file can be mounted over the existing blueprint. -File-based blueprints are automatically removed once they become unavailable, however none of the objects created by those blueprints are affected by this. +File-based blueprints are automatically removed when they become unavailable. However, none of the objects created by those blueprints are affected. :::info Please note that, by default, blueprint discovery and evaluation is not guaranteed to follow any specific order. diff --git a/website/docs/customize/file-picker.md b/website/docs/customize/file-picker.md index d37c798d1853..b3e757772f02 100644 --- a/website/docs/customize/file-picker.md +++ b/website/docs/customize/file-picker.md @@ -48,7 +48,7 @@ authentik resolves `%(theme)s` to: This resolution happens on the backend, which means it also works with storage backends that need signed URLs, such as S3. -The `%(theme)s` placeholder is supported in all current Admin UI fields that use the shared file picker: +The `%(theme)s` placeholder is supported in all current Admin interface fields that use the shared file picker: - Brand **Logo** - Brand **Favicon** diff --git a/website/docs/customize/files.md b/website/docs/customize/files.md index aeaf8d9865e9..58c7d869d173 100644 --- a/website/docs/customize/files.md +++ b/website/docs/customize/files.md @@ -31,7 +31,7 @@ The shared file picker is a UI on top of the files API and the storage backends. ```mermaid flowchart LR - A["Admin user"] --> B["Admin UI
ak-file-search-input / ak-file-upload-form"] + A["Admin user"] --> B["Admin interface
ak-file-search-input / ak-file-upload-form"] B --> C["authentik server router
(lightweight Go router / proxy)"] C --> D["authentik Core backend"] D --> E["FileView API
/api/v3/admin/file/"] diff --git a/website/docs/customize/interfaces/_enabledfeatureslist.mdx b/website/docs/customize/interfaces/_enabledfeatureslist.mdx index 54e2508e8285..03e6d04ed3e3 100644 --- a/website/docs/customize/interfaces/_enabledfeatureslist.mdx +++ b/website/docs/customize/interfaces/_enabledfeatureslist.mdx @@ -1,4 +1,4 @@ -### Enabling/disabling features +### Enable or disable features The features listed below can be enabled or disabled through attributes set on the Brand. By default, all of the listed features are enabled. To disable a specific feature, set its value to `false`. diff --git a/website/docs/customize/policies/types/password-uniqueness.md b/website/docs/customize/policies/types/password-uniqueness.md index d8fa0462ed1b..4d3fbb4dd0d2 100644 --- a/website/docs/customize/policies/types/password-uniqueness.md +++ b/website/docs/customize/policies/types/password-uniqueness.md @@ -23,7 +23,7 @@ If the new password matches one of those historical entries, the policy fails an Password history is maintained automatically while the policy is in use. :::info Password History Start -This policy only starts building password history once it is in use. The first password change after you enable it seeds the history; there is no older password history to compare against before that point. +This policy starts building password history after you enable it. The first subsequent password change seeds the history; there is no older password history to compare against before that point. ::: ## When to use it diff --git a/website/docs/developer-docs/docs/writing-documentation.md b/website/docs/developer-docs/docs/writing-documentation.md index 1223ee3c2808..cf0c4d493468 100644 --- a/website/docs/developer-docs/docs/writing-documentation.md +++ b/website/docs/developer-docs/docs/writing-documentation.md @@ -34,7 +34,7 @@ Adhering to the following guidelines will help us get your PRs merged more easil - [docs templates](./templates/index.md) - [integration guide template](https://integrations.goauthentik.io/applications#add-a-new-application) -## Setting up a docs development environment +## Set up a docs development environment ### Prerequisites @@ -85,7 +85,7 @@ This command installs or updates the build dependencies such as Docusaurus, Pret If you have the [full development environment](../setup/full-dev-environment.mdx) installed you can run `make install` to get all of the latest build tools and dependencies, not just those for building documentation. ::: -## Writing or modifying technical docs +## Write or modify technical docs In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines about our technical documentation (https://docs.goauthentik.io/): @@ -112,7 +112,7 @@ make docs-watch Starts a local development server for the documentation site and opens a preview in your browser. This command will automatically rebuild your local documentation site in real time, as you write or make changes to the Markdown files in the `website/docs` directory. -## Writing or modifying integration guides +## Write or modify integration guides In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines about our integration guides (https://integrations.goauthentik.io/). @@ -148,7 +148,7 @@ Starts a local development server for the integrations site and opens a preview The [authentik glossary](/core/glossary/) provides definitions for both industry-standard terms (like LDAP, OAuth2, SAML) and authentik-specific concepts (like Flows, Stages, Blueprints). -### Adding a new glossary term +### Add a new glossary term 1. Create a new `.mdx` file in `website/docs/core/glossary/terms/` (e.g., `my-term.mdx`). @@ -192,7 +192,7 @@ sidebar_custom_props: Every documentation page you see on our website starts as a simple Markdown file in our repository. When you create or edit these files, our build system automatically transforms them into web pages with predictable URLs. -### Converting file paths to URLs +### Convert file paths to URLs Let's take a look at the file path of the [Style Guide page](https://docs.goauthentik.io/developer-docs/docs/style-guide/): @@ -258,7 +258,7 @@ When a reader first visits a documentation page or refreshes their browser: 3. If not, it checks our `_redirects` file for a matching rule. 4. The server sends back the correct page, or a 404 if no matching rule exists. -#### Navigating between pages (client-side) +#### Navigate between pages (client-side) When a reader clicks a link to another documentation page: @@ -270,7 +270,7 @@ If Docusaurus's router attempts to render a page that does not exist, the `_redi Whether the reader is viewing a page for the first time or navigating between pages, this arrangement allows us to have a single source of truth for all URLs, ensuring that each page remains consistently accessible across authentik versions and throughout our three Docusaurus deployments (Topics, Integrations, and API). -### Updating a page's URL +### Update a page's URL :::danger[Every URL is a promise] diff --git a/website/docs/developer-docs/setup/full-dev-environment.mdx b/website/docs/developer-docs/setup/full-dev-environment.mdx index ca9d5bb5dff4..90a31896cef1 100644 --- a/website/docs/developer-docs/setup/full-dev-environment.mdx +++ b/website/docs/developer-docs/setup/full-dev-environment.mdx @@ -256,7 +256,7 @@ You can run all these checks at once with: make all ``` -### Submitting your changes +### Submit your changes After your code passes all checks, submit a pull request on [GitHub](https://github.com/goauthentik/authentik/pulls). Be sure to: diff --git a/website/docs/endpoint-devices/authentik-agent/index.mdx b/website/docs/endpoint-devices/authentik-agent/index.mdx index 0e95fd1e8416..52a2dbeb4218 100644 --- a/website/docs/endpoint-devices/authentik-agent/index.mdx +++ b/website/docs/endpoint-devices/authentik-agent/index.mdx @@ -42,7 +42,7 @@ All authentik Agent components communicate via gRPC and Unix domain sockets/Wind Sentry reporting is currently enabled by default and cannot be disabled. This will be configurable in a future release. -## Reporting issues +## Report issues Please report issues and bugs via the [authentik Platform GitHub repository](https://github.com/goauthentik/platform). diff --git a/website/docs/endpoint-devices/device-compliance/configuration.md b/website/docs/endpoint-devices/device-compliance/configuration.md index 1f00648cb710..2a3a0328c880 100644 --- a/website/docs/endpoint-devices/device-compliance/configuration.md +++ b/website/docs/endpoint-devices/device-compliance/configuration.md @@ -17,6 +17,6 @@ Device compliance functionality requires the following: Verify that the endpoint device is reporting its facts on the [Devices](../manage-devices.mdx) page. -## Using device compliance +## Use device compliance Now that the endpoint device is configured, you can create [device compliance policies](./device-compliance-policy.md) to control access to applications and more. diff --git a/website/docs/endpoint-devices/device-compliance/connectors/index.mdx b/website/docs/endpoint-devices/device-compliance/connectors/index.mdx index 6b72c4c35a80..0bf88cdda4bc 100644 --- a/website/docs/endpoint-devices/device-compliance/connectors/index.mdx +++ b/website/docs/endpoint-devices/device-compliance/connectors/index.mdx @@ -16,11 +16,11 @@ The following connectors are currently available: Connectors are in development for Entra, Intune, Cloudflare WARP and other services. -## Managing connectors +## Manage connectors Use the following instructions to manage your connectors: -### Adding a connector +### Add a connector For more specific instructions on adding a connector refer to the [authentik Agent connector](./authentik-agent.md) or [Fleet connector](./fleetdm.md) documentation. @@ -32,7 +32,7 @@ For more specific instructions on adding a connector refer to the [authentik Age - **Enabled**: enable or disable the connector. 4. Click **Finish**. -### Editing a connector +### Edit a connector 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. @@ -40,7 +40,7 @@ For more specific instructions on adding a connector refer to the [authentik Age 4. Update any settings that you want to change. 5. Click **Update**. -### Deleting a connector +### Delete a connector 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. diff --git a/website/docs/endpoint-devices/device-compliance/device-compliance-policy.md b/website/docs/endpoint-devices/device-compliance/device-compliance-policy.md index 4ef5af7f9a94..eedc6aa9ec31 100644 --- a/website/docs/endpoint-devices/device-compliance/device-compliance-policy.md +++ b/website/docs/endpoint-devices/device-compliance/device-compliance-policy.md @@ -14,7 +14,7 @@ Device compliance policies are currently in development and inaccessible. Howeve You must have [configured compliance](./configuration.md) in authentik and on the endpoint device ([Linux](../../authentik-agent/agent-deployment/linux/#enable-device-compliance-ssh-server-authentication-and-local-device-login), [Windows](../../authentik-agent/agent-deployment/windows/#enable-device-compliance-and-local-device-login), [macOS](../../authentik-agent/agent-deployment/macos/#enable-device-compliance)). -## Accessing device facts within a flow +## Access device facts within a flow To access device facts within a flow, the flow must include an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.md). The Endpoint stage fetches device facts via a configured [Connector](./connectors/index.mdx) and adds them to the [Flow context](../../add-secure-apps/flows-stages/flow/context/index.mdx). diff --git a/website/docs/endpoint-devices/device-compliance/device-reporting.md b/website/docs/endpoint-devices/device-compliance/device-reporting.md index 0a9878610574..6202bd1552ca 100644 --- a/website/docs/endpoint-devices/device-compliance/device-reporting.md +++ b/website/docs/endpoint-devices/device-compliance/device-reporting.md @@ -14,7 +14,7 @@ tags: authentik_version: "2025.12.0" --- -Endpoint Devices registered with authentik via a [connector](./connectors/index.mdx), such as the [authentik Agent](./connectors/authentik-agent.md) connector, regularly [check-in](#device-check-in) with authentik and report their [device facts](#device-facts). +Endpoint Devices registered with authentik via a [connector](./connectors/index.mdx), such as the [authentik Agent](./connectors/authentik-agent.md) connector, regularly [check in](#device-check-in) with authentik and report their [device facts](#device-facts). These facts are shown on the [Devices](../manage-devices.mdx) page and are also accessible to policies and can be used to make policy decisions. See [Device Compliance Policy](./device-compliance-policy.md) for more details. diff --git a/website/docs/install-config/beta.mdx b/website/docs/install-config/beta.mdx index 9c0ce0511916..50bc3cb2a083 100644 --- a/website/docs/install-config/beta.mdx +++ b/website/docs/install-config/beta.mdx @@ -139,6 +139,6 @@ helm upgrade authentik authentik/authentik -f values.yaml If you are upgrading from an older Beta release to the most recent Beta release, you might need to run `kubectl rollout restart deployment`, because Helm needs to recreate the pods in order to pick up the new image (the tag doesn't change). ::: -## Verifying the installation +## Verify the installation To verify whether the upgrade was successful, go to your Admin panel and navigate to the Overview dashboard. There, you can check the version number to ensure that you are using the RC or Beta version you intended. diff --git a/website/docs/install-config/configuration/configuration.mdx b/website/docs/install-config/configuration/configuration.mdx index e08110730b42..7a31366a13e6 100644 --- a/website/docs/install-config/configuration/configuration.mdx +++ b/website/docs/install-config/configuration/configuration.mdx @@ -225,7 +225,7 @@ Use index `1`, `2`, and so on for additional replicas. - Parameters passed with this setting will override those passed with other settings. - The value must be a base64-encoded JSON dictionary. -### Using a PostgreSQL Connection Pooler +### Use a PostgreSQL connection pooler {#using-a-postgresql-connection-pooler} If authentik connects through a pooler such as PgBouncer or Pgpool, review these settings carefully: diff --git a/website/docs/install-config/first-steps/index.mdx b/website/docs/install-config/first-steps/index.mdx index 2cf06b9bb49c..1da81507bf93 100644 --- a/website/docs/install-config/first-steps/index.mdx +++ b/website/docs/install-config/first-steps/index.mdx @@ -209,7 +209,7 @@ Now that you have added your first application, and a new user, here are some ty Review the following information to learn more about the basics of setting up authentik and for troubleshooting tips. -### Modifying the Docker Compose file +### Modify the Docker Compose file Especially when you are just starting out with authentik, we recommend that you use the default `docker-compose.yml` file that comes with the download, instead of trying to write the file from scratch. After you have successfully installed, configured, and accessed authentik, you can edit the file to do more advanced configurations, as documented in the [Configuration section](../../install-config/configuration/configuration.mdx). @@ -222,7 +222,7 @@ Typically authentik is set up with a reverse proxy in front of it. If you alread The `:latest` tag has been deprecated and will never be updated from the 2025.2 release. Instead, use a specific version tag for authentik instances' container images, such as `:2025.12`. -### Using bindings to allow or restrict access to applications +### Use bindings to allow or restrict access to applications {#using-bindings-to-allow-or-restrict-access-to-applications} Note that if you do not define any [bindings](../../add-secure-apps/bindings-overview/index.md), then all users have access to the application. To control access, you can [create a binding](../../add-secure-apps/bindings-overview/work-with-bindings.md). For more information about user access, refer to our documentation about [authorization](../../add-secure-apps/applications/manage_apps.mdx#policy-driven-authorization) and [hiding an application](../../add-secure-apps/applications/manage_apps.mdx#hide-applications). diff --git a/website/docs/sys-mgmt/background-tasks.md b/website/docs/sys-mgmt/background-tasks.md index 89f7ed772b21..ccedd0f664d1 100644 --- a/website/docs/sys-mgmt/background-tasks.md +++ b/website/docs/sys-mgmt/background-tasks.md @@ -80,7 +80,7 @@ When a task fails, i.e. when the code throws an exception, the task will be retr Failed tasks will be displayed like any other tasks. Each task can be expanded to show its logs. The logs are split into two parts: "Current execution logs" for the current execution, and "Previous execution logs" for logs from previous executions that happened before a retry was initiated. The information contained in the logs indicates either a transient error (a network connection failed for example), a misconfiguration (wrong password set in the LDAP source for example), or a bug in authentik. -#### Restarting tasks +#### Restart tasks To restart a task, click the retry arrow next to the task. It will be queued again and picked up by a worker. diff --git a/website/docs/sys-mgmt/certificates.md b/website/docs/sys-mgmt/certificates.md index 3b3f0c68f7af..99a2ef6998f0 100644 --- a/website/docs/sys-mgmt/certificates.md +++ b/website/docs/sys-mgmt/certificates.md @@ -38,7 +38,7 @@ We recommend using a certificate generated outside of authentik that matches you We recommend using a certificate generated outside of authentik. A privately issued certificate is sufficient. -## Downloading SAML certificates +## Download SAML certificates To download a certificate for SAML configuration: diff --git a/website/docs/sys-mgmt/events/logging-events.mdx b/website/docs/sys-mgmt/events/logging-events.mdx index 9df25defde74..9f6041d43a7b 100644 --- a/website/docs/sys-mgmt/events/logging-events.mdx +++ b/website/docs/sys-mgmt/events/logging-events.mdx @@ -26,7 +26,7 @@ You can view audit details in the following areas of the authentik Admin interfa - **Admin interface** > **Events** > **Logs**: In the event list, click the arrow toggle next to the event you want to view. -## Viewing events in maps and charts :ak-enterprise {#viewing-events-in-maps-and-charts} +## View events in maps and charts :ak-enterprise {#viewing-events-in-maps-and-charts} With the enterprise version, you can view recent events on both a world map view with pinpoints indicating where each event occurred and also a color-coded chart that highlights event types and volume. diff --git a/website/docs/sys-mgmt/object-lifecycle-management.md b/website/docs/sys-mgmt/object-lifecycle-management.md index 4334d224953a..bd3a1a6fa03e 100644 --- a/website/docs/sys-mgmt/object-lifecycle-management.md +++ b/website/docs/sys-mgmt/object-lifecycle-management.md @@ -85,7 +85,7 @@ If multiple rules apply to the same object, each rule runs its own review cycle To review and approve an object for a lifecycle rule, follow the steps below. A reviewer can be either a user set as an explicit reviewer or a member of a configured reviewer group. -1. Once a new review cycle starts, you receive a notification that a review is due (via the configured notification transports). +1. After a new review cycle starts, you receive a notification that a review is due through the configured notification transports. 2. Click on the link in the notification to navigate to the object's detail page. Alternatively, you can navigate to the **Events** > **Reviews** page and enable "Only show reviews where I am a reviewer" filter to see reviews awaiting your action. @@ -96,7 +96,7 @@ To review and approve an object for a lifecycle rule, follow the steps below. A 3. Review the object's current configuration. 4. Go back to the **Lifecycle** tab. 5. Find the review for the relevant rule and click **Review** to submit your review, optionally including a note. -6. Once all of the rule's reviewer requirements are met, that review automatically transitions to the **Reviewed** state. +6. After all of the rule's reviewer requirements are met, that review automatically transitions to the **Reviewed** state. ### Submit a review diff --git a/website/docs/sys-mgmt/ops/geoip.mdx b/website/docs/sys-mgmt/ops/geoip.mdx index 3180dd4587a1..af6fbf10cef0 100644 --- a/website/docs/sys-mgmt/ops/geoip.mdx +++ b/website/docs/sys-mgmt/ops/geoip.mdx @@ -10,7 +10,7 @@ Starting with authentik 2022.12, GeoIP is bundled and does not require any addit By default, the GeoIP database is loaded from `/geoip/GeoLite2-City.mmdb`. If more frequent database updates are desired, a volume can be mounted to `/geoip` to update this file externally. authentik will automatically re-load the file when it changes. -### Deactivating GeoIP +### Deactivate GeoIP If you want to disable GeoIP, you can set the path to a non-existent path and authentik will skip the GeoIP. diff --git a/website/docs/sys-mgmt/ops/storage-s3.md b/website/docs/sys-mgmt/ops/storage-s3.md index e7a48d38d5c3..8484bbe1b61c 100644 --- a/website/docs/sys-mgmt/ops/storage-s3.md +++ b/website/docs/sys-mgmt/ops/storage-s3.md @@ -120,7 +120,7 @@ aws s3 cp \ The `Content-Type` header is not set when files are programmatically uploaded to S3 via Terraform. ::: -### Configuring authentik +### Configure authentik Add the following to your `.env` file: @@ -166,7 +166,7 @@ You can omit `ACCESS_KEY` and `SECRET_KEY` when using AWS SDK authentication (in For more options (including `AUTHENTIK_STORAGE__S3__USE_SSL`, session profiles, and security tokens), see the [configuration reference](../../install-config/configuration/configuration.mdx#storage-settings). -## Migrating between storage backends +## Migrate between storage backends The following assumes the local storage path is `/data` and the bucket is `authentik-data`. Ensure your `aws` CLI is configured to talk to your provider (add `--endpoint-url` or `--region` as needed). diff --git a/website/docs/troubleshooting/logs/logs.mdx b/website/docs/troubleshooting/logs/logs.mdx index 98c00531a8cc..a4660994fbf7 100644 --- a/website/docs/troubleshooting/logs/logs.mdx +++ b/website/docs/troubleshooting/logs/logs.mdx @@ -9,7 +9,7 @@ When troubleshooting issues in authentik, reviewing the logs can be invaluable. For information on capturing standalone outpost logs, refer to [capturing standalone outpost logs](./outpost_logs.mdx). -## Adjusting log levels +## Adjust log levels The server and worker containers support multiple log levels: `debug`, `info`, `warning`, and `error`. By default, the log level is set to `info`. @@ -47,7 +47,7 @@ To modify the log level, follow the steps for your platform -## Enabling `trace` mode +## Enable `trace` mode :::danger The trace log level provides deeper insights, but be aware that using trace logs can expose sensitive information, including session cookies. Handle these logs with extreme caution and avoid using trace unless absolutely necessary. @@ -95,7 +95,7 @@ To avoid exposing sensitive information, remember to reduce the log level from ` -## Viewing past logs +## View past logs To review historical logs, you can use the `--since` option with both `docker logs` and `kubectl logs`. This option allows you to specify either a duration (e.g., `1m30s`, `3h`) or a specific timestamp (e.g., `2006-01-02T07:00`, `2006-01-02`) to view logs generated after that point in time. @@ -128,7 +128,7 @@ kubectl logs --since 5m -## Streaming logs in real-time +## Stream logs in real time To continuously monitor logs, use the `--follow` (`-f`) option. This will stream log output to your terminal until manually stopped (`Ctrl + C` or closing the terminal). diff --git a/website/docs/troubleshooting/logs/outpost_logs.mdx b/website/docs/troubleshooting/logs/outpost_logs.mdx index 56f3c105f8bb..9efbd4138bcc 100644 --- a/website/docs/troubleshooting/logs/outpost_logs.mdx +++ b/website/docs/troubleshooting/logs/outpost_logs.mdx @@ -9,7 +9,7 @@ This guide only applies to standalone [outposts](../../add-secure-apps/outposts/ Standalone outposts continually output logs that can be helpful when troubleshooting issues. Just like when capturing authentik logs, the log level can be adjusted. -## Adjusting log levels +## Adjust log levels Outpost containers support multiple log levels: `debug`, `info`, `warning`, and `error`. By default, the log level is set to `info`. @@ -53,7 +53,7 @@ Then, redeploy the outpost container for the change to take effect. -## Enabling `trace` mode +## Enable `trace` mode :::danger The trace log level provides deeper insights, but be aware that using trace logs can expose sensitive information, including session cookies. Handle these logs with extreme caution and avoid using trace unless absolutely necessary. @@ -107,7 +107,7 @@ To avoid exposing sensitive information, remember to reduce the log level from ` -## Viewing past logs +## View past logs To review historical logs, you can use the `--since` option with both `docker logs` and `kubectl logs`. This option allows you to specify either a duration (e.g., `1m30s`, `3h`) or a specific timestamp (e.g., `2006-01-02T07:00`, `2006-01-02`) to view logs generated after that point in time. @@ -140,7 +140,7 @@ kubectl logs --since 5m -## Streaming logs in real-time +## Stream logs in real time To continuously monitor logs, use the `--follow` (`-f`) option. This will stream log output to your terminal until manually stopped (`Ctrl + C` or closing the terminal). diff --git a/website/docs/troubleshooting/postgres/upgrade_kubernetes.md b/website/docs/troubleshooting/postgres/upgrade_kubernetes.md index f99347b23e77..71fa1c18498f 100644 --- a/website/docs/troubleshooting/postgres/upgrade_kubernetes.md +++ b/website/docs/troubleshooting/postgres/upgrade_kubernetes.md @@ -156,7 +156,7 @@ If `dump.sql` is missing after the restart: - You may need to restore from the external backup if you copied it out of the pod - The volume might have been recreated if you're using ephemeral storage -### Restoring the original database +### Restore the original database If you need to roll back to the old PostgreSQL data directory: diff --git a/website/docs/users-sources/access-control/permissions.md b/website/docs/users-sources/access-control/permissions.md index be9243b8d32b..8380183927ed 100644 --- a/website/docs/users-sources/access-control/permissions.md +++ b/website/docs/users-sources/access-control/permissions.md @@ -40,7 +40,7 @@ An object permission grants permission (via a role) on a single, specific object For example, a role with the object permission to change only the Default Authentication flow will not be able to change any other flow. -## Viewing permissions +## View permissions Many objects in authentik's Admin interface have a **Permissions** tab, where you can check which roles have rights on that particular object. Those permissions describe what those roles can do _to_ the object detailed on the page. diff --git a/website/docs/users-sources/groups/manage_groups.mdx b/website/docs/users-sources/groups/manage_groups.mdx index 3fbd9c05fcea..3e41aa1bb35e 100644 --- a/website/docs/users-sources/groups/manage_groups.mdx +++ b/website/docs/users-sources/groups/manage_groups.mdx @@ -61,7 +61,7 @@ These bindings control which groups can access an application, and whether or no For instructions refer to [Manage applications](../../add-secure-apps/applications/manage_apps.mdx#bind-a-user-or-group-to-an-application). -## Delegating group member management +## Delegate group member management To give a specific role or user the ability to manage group members, the following permissions need to be granted on the matching group object: diff --git a/website/docs/users-sources/roles/index.md b/website/docs/users-sources/roles/index.md index ae86d28833b1..aea61c4c58ed 100644 --- a/website/docs/users-sources/roles/index.md +++ b/website/docs/users-sources/roles/index.md @@ -16,7 +16,7 @@ For example, let's take a look at the following scenario: The easiest workflow for setting up these new users involves [creating a role](./manage_roles.md#create-a-role) specifically for their type of work, and then [assigning that role to a group](./manage_roles.md#assign-a-role-to-a-group) to which all of the users belong. -## Viewing roles for users and groups +## View roles for users and groups You can view the roles assigned to a user or group through their detail pages in the Admin interface. diff --git a/website/docs/users-sources/sources/social-logins/apple/index.md b/website/docs/users-sources/sources/social-logins/apple/index.md index efc53e1480f4..6e2e1eff8fd5 100644 --- a/website/docs/users-sources/sources/social-logins/apple/index.md +++ b/website/docs/users-sources/sources/social-logins/apple/index.md @@ -18,7 +18,7 @@ Apple mandates the use of a [registered top-level domain](https://en.wikipedia.o To integrate Apple with authentik, you need to register two identifiers and a key in the Apple Developer Portal. -### Registering identifiers +### Register identifiers 1. Log in to the [Apple Developer Portal](https://developer.apple.com/account/), and navigate to **Account** > **Certificates, IDs & Profiles**, then click **Identifiers** in the sidebar. 2. Register a new identifier with the type of **App IDs**, and the subtype **App**. @@ -36,16 +36,16 @@ To integrate Apple with authentik, you need to register two identifiers and a ke ![](./service_id.png) -### Configuring identifier +### Configure an identifier -11. Once back at the overview list, click the just-created identifier. +11. After you return to the overview list, click the identifier that you created. 12. Enable the checkbox next to **Sign In with Apple**, and click **Configure** 13. Under **Domains and Subdomains**, enter `authentik.company`. 14. Under **Return URLs**, enter `https://authentik.company/source/oauth/callback/apple/`. ![](./app_service_config.png) -### Registering a key +### Register a key 15. Click **Keys** in the sidebar, then register a new key with any name, and select **Sign in with Apple**. 16. Click **Configure**, then select the App ID that you created. diff --git a/website/docs/users-sources/sources/social-logins/discord/index.md b/website/docs/users-sources/sources/social-logins/discord/index.md index 4e5a242fd895..9a4c7ad89baa 100644 --- a/website/docs/users-sources/sources/social-logins/discord/index.md +++ b/website/docs/users-sources/sources/social-logins/discord/index.md @@ -49,7 +49,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Optional additional configuration -### Syncing Discord roles and avatars to authentik +### Sync Discord roles and avatars to authentik The following property mapping allows you to synchronize roles from a Discord guild to roles in authentik. @@ -132,7 +132,7 @@ return { 7. Under **OAuth Attribute mapping** add the newly created property mapping to **Selected User Property Mappings**. 8. Click **Update**. -### Checking Discord Guild membership +### Check Discord Guild membership :::info Ensure that the Discord OAuth source in **Federation and Social login** has the additional `guilds guilds.members.read` scopes added under **Protocol settings** > **Scopes**. @@ -183,7 +183,7 @@ return user_matched 8. Select the policy that you previously created and click **Create Policy Binding**. 9. Optionally, repeat the process for any other flows that you want the policy applied to. -### Checking Discord Guild role membership +### Check Discord Guild role membership :::info Ensure that the Discord OAuth source in **Federation and Social login** has the additional `guilds guilds.members.read` scopes added under **Protocol settings** > **Scopes**. diff --git a/website/docs/users-sources/sources/social-logins/github/index.mdx b/website/docs/users-sources/sources/social-logins/github/index.mdx index 18ac8598eb8b..256d9a00317f 100644 --- a/website/docs/users-sources/sources/social-logins/github/index.mdx +++ b/website/docs/users-sources/sources/social-logins/github/index.mdx @@ -52,7 +52,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Optional additional configuration -### Checking for membership of a GitHub Organization +### Check for membership of a GitHub organization :::info Ensure that the GitHub OAuth source in **Federation and Social login** has the additional `read:org` scope added under **Protocol settings** > **Scopes**. diff --git a/website/docs/users-sources/sources/social-logins/index.mdx b/website/docs/users-sources/sources/social-logins/index.mdx index 0ac89ded0708..dabda260a016 100644 --- a/website/docs/users-sources/sources/social-logins/index.mdx +++ b/website/docs/users-sources/sources/social-logins/index.mdx @@ -51,7 +51,7 @@ sequenceDiagram In short, the user requests access to a resource on the SP, the SP requests a SAML assertion from the IdP, the IdP authenticates the user and returns a SAML assertion, and the SP establishes a session for the user. -## Configuring authentik +## Configure authentik While we provide detailed guides for popular services such as Google, GitHub, and Microsoft Entra ID, you can configure any standards-compliant provider using the same basic process.