authentik

No entries match these filters. Clear filters

1. announced Nov 3, 2026 · issue 130

   authentik adds ML-DSAML-DSANIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. certificates, ML-DSA OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. token signing, ML-DSA passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., and AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. encryption in version 2026.11⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • authentik now generates and stores ML-DSA-44, ML-DSA-65ML-DSA-65NIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. and ML-DSA-87ML-DSA-87NIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. certificates alongside existing RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it., ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace., Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. and Ed448 certificates for use with TLS between components, mutual TLS, and RADIUS with EAP-TLS 1.3 (requires outposts on 2026.11 or newer to verify them; unavailable when FIPS compliance mode is on).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. providers can now sign ID tokens, access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. and client assertions with an ML-DSA certificate; the proxy outpost and OAuth sources verify ML-DSA-signed tokens for federation with an upstream IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. that signs with ML-DSA; DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. proofs can be bound to ML-DSA keys.
   • WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. registration and login now accept ML-DSA credentials, placed at the bottom of the accepted algorithm list so only an authenticator that offers nothing else will use it.
   • SAML and WS-Federation providers now let you choose the assertion encryption algorithm, defaulting new providers to AES-256-GCM; existing providers keep AES-128-CBC until changed; SAML sources now request AES-256-GCM from upstream IdPs.
   • authentik now generates and stores ML-DSA-44, ML-DSA-65ML-DSA-65NIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. and ML-DSA-87ML-DSA-87NIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. certificates alongside existing RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it., ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace., Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. and Ed448 certificates for use with TLS between components, mutual TLS, and RADIUS with EAP-TLS 1.3 (requires outposts on 2026.11 or newer to verify them; unavailable when FIPS compliance mode is on).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. providers can now sign ID tokens, access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. and client assertions with an ML-DSA certificate; the proxy outpost and OAuth sources verify ML-DSA-signed tokens for federation with an upstream IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. that signs with ML-DSA; DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. proofs can be bound to ML-DSA keys.
   • WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. registration and login now accept ML-DSA credentials, placed at the bottom of the accepted algorithm list so only an authenticator that offers nothing else will use it.

   1 more in Everything

2. version/2026.8.3 Sep 17, 2026 · release notes

   SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. GitLab compatibility option, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. ID attribute registration, and case-insensitive file search

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch version/2026.8.3 https://github.com/goauthentik/authentik.git
   # already have the repo? check out this version:
   $ git checkout version/2026.8.3

   └──▷ HOW TO FIND IT
   Configure SCIM to work with GitLab by selecting the new compatibility option in the provider form.
   📍In the authentik admin UI, navigate to Providers › SCIM Provider and select gitlab from the Compatibility dropdown.
   Map specific attributes from a SAML source during identity binding.
   📍In the SAML Source settings, locate the ID Attributes section to register your custom attribute mappings.
   • Adds gitlab compatibility option to the SCIM provisioning form for better GitLab integration.
   • Enables registration of ID attributes in SAML sources (sources/saml).
   • Makes file search in the admin panel case-insensitive.

   3 details in Everything

3. docs update Sep 11, 2026 · issue 071

   authentik now supports fully air-gapped deployments with offline Enterprise license installation and local validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Install an Enterprise license in an air-gapped authentik instance after transferring the license key.
   📍1. In the authentik Admin interface, go to Enterprise › Licenses. 2. Copy Your Install ID. 3. On a connected system, obtain a license key from the Customer Portal using that Install ID. 4. Transfer the license key file into the air-gapped environment. 5. Back in Enterprise › Licenses, click Install, paste the key into License key, and submit the form. 6. Verify Current license status, user capacity, and expiry date on the Licenses page.
   • Supports air-gapped deployments where license installation and validation are performed locally with no internet connection required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports installing Enterprise licenses offline: navigate to Enterprise > Licenses, copy Your Install ID, obtain a key on a connected system, transfer it, and paste it into the License key field.
   • Supports internal Helm chart registry workflows: download the chart archive on a connected system with helm repo add authentik https://charts.goauthentik.io, transfer the archive, and install with helm install from the local file.
   • Documents internal network port requirements for air-gapped deployments: authentik server on HTTP 9000 / HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. 9443, PostgreSQL on 5432, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. outpost on 3389/6636, RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. outpost on UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. 1812, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. on 25/465/587.

   4 details in Everything

4. docs update Sep 11, 2026 · issue 071

   authentik Enterprise adds agent accounts, scheduled user offboarding, and privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (preview features).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds agent accounts that act on behalf of a parent user when accessing the authentik API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds scheduled user offboarding to deactivate or delete users at a scheduled time, with optional session and token revocation (preview).
   • Adds privileged access management letting users request access to applications and entitlements, with approval rules and time-limited grants (preview).
   • Adds Fleet device-aware access decisions using device information from Fleet (preview).

   4 details in Everything

5. advisory CVE-2026-94613 Sep 9, 2026 · issue 128
   • CVE-2026-94613: Denial of Service via Malformed SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Messages (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 2026.8.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. advisory CVE-2026-94611 Sep 9, 2026 · issue 128
   • CVE-2026-94611: Certain stored credentials readable with view permission alone (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects <= 2026.2.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
7. advisory CVE-2026-94612 Sep 9, 2026 · issue 128
   • CVE-2026-94612: Authentication bypass in SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Sources via assertion confusion and replay (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects <= 2026.2.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. advisory CVE-2026-94609 Sep 9, 2026 · issue 128
   • CVE-2026-94609: Privilege escalationPrivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. via delegated group and user management (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <= 2026.5.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. advisory CVE-2026-94606 Sep 9, 2026 · issue 128
   • CVE-2026-94606: MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. bypass via recipient override in the email authenticator (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.9, affects <= 2026.8.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
10. announced Sep 1, 2026 · issue 064

    authentik 2026.8 adds PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded., agent accounts, user switching, scheduled offboarding, OAuth token exchangeOAuth token exchangeAn OAuth 2.0 extension (RFC 8693) that lets a service swap one token for another with different scopes, audience, or type, so cyber tools can delegate access across service boundaries without re-authenticating the user., DCR, and OpenID CertificationOpenID CertificationA conformance-testing and certification program run by the OpenID Foundation that verifies an implementation correctly follows OpenID Connect specs, giving tool builders assurance of interoperability with other compliant identity systems.

    └──▷ HOW TO FIND IT
    Enable OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. on a provider so a service can trade an upstream token for an authentik access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. without forwarding the original credential.
    📍In the Admin UI, open Providers › <your provider> › Edit, locate the Grant Types setting, and enable Token Exchange. Then configure trusted providers or sources under the provider's JWT federation settings.
    Set the required base URL for your instance via environment variable before the 2026.11 deadline, ensuring event links and redirects resolve correctly.
    .env copy

    AUTHENTIK_WEB__BASE_URL=https://auth.example.com

    Pipe a password securely into hash_password for automation without exposing it in shell history.
    copy

    $ echo "$PASSWORD" | docker compose run --rm server hash_password

    • Adds AUTHENTIK_WEB__BASE_URL environment variable (and the Base URL setting under System > Settings and via API) to record the external URL of the instance; required in 2026.11.
    • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 token exchange, enabled per-provider under the Grant Types setting, letting applications trade a trusted token for an authentik access token representing the same user.
    • Adds RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user. on-behalf-of (OBO) token exchange: clients supply actor_token and actor_token_type to receive a token carrying both the user and the actor via the act claim.
    • Adds Sync Group Parents option to LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sources to preserve nested group hierarchy when synchronizing from a directory.
    • Adds Captcha stage support for JSON verification requests and the self-hostable Cap CAPTCHA provider.

    +19 more show less

    • Adds Ed448 signing key support for OAuth providers.
    • New privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (Enterprise): users can request access to applications and entitlements from the UI; admins define request rules controlling requestors, approvers (users, groups, or policies), reviewer counts, and grant validity with automatic expiration and event-log tracking.
    • New agent accounts (Enterprise): a new service-account type that acts on behalf of a parent user when calling the authentik API, with configurable policy inheritance, expiration rules, and audit events; users can optionally self-create agents from the UI.
    • New user switching: multiple authentik accounts can stay signed in simultaneously in one browser and be switched via the account menu; enable by selecting a User switch flow for your brand, and policies control whether the switch requires a password, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., or lighter check.
    • New scheduled user offboarding (Enterprise): administrators can schedule deactivation or deletion at a specific date and time, with optional concurrent session and token revocation, review/cancel capability, automatic retry on failure, and full event-log records.
    • New object attributes: custom text, number, and Boolean fields defined under Directory > Object attributes, with required/unique/regex-validation options, surfaced when editing users, groups, application entitlements, and device access groups, and enforced through the API.
    • New self-hosted event maps (Enterprise): the events map now ships a bundled basemap with no external requests by default, supporting air-gapped deployments; each brand can use the bundled map or point at a self-hosted tile server under the Map tiles setting.
    • New dynamic client registration (Enterprise): applications can self-register via OAuth 2.0 / OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. DCR with admin-controlled policy bindings, grant type restrictions, scope mappings, and token validity limits.
    • Adds OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect key-bound ID token issuance: providers can issue tokens requiring the client to prove key possession, available for authorization code, device code, and refresh flows.
    • Expiring policy, group, and user bindings: bindings can now carry an expiration date and time after which they no longer grant access or contribute a successful policy result.
    • PostgreSQL transaction-mode connection-pooler support: a separate direct connection can be configured alongside the existing pooler settings for operations requiring a stable session.
    • WS-Federation providers can now issue SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. 1.1 assertions, enabling integration with Microsoft 365 and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
    • SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. providers gain a GitLab compatibility mode.
    • SAML authentication requests that set ForceAuthn now require fresh authentication.
    • AKQL queries against JSON fields now match numeric and Boolean values in addition to strings.
    • Application Dashboard gains a compact list view that is persisted in the browser alongside the existing card grid.
    • Server and proxy outpost rewritten in Rust (replacing Go), with health checks for server and worker now running through the Rust entrypoint.
    • authentik is now officially OpenID Certified for Basic, Implicit, Hybrid, Config, and Form Post OP profiles and RP-Initiated, Front-Channel, and Back-Channel logout profiles.
    • Over 40 new application integration guides added, including Microsoft 365 via WS-Federation, Directus, Discourse, HubSpot, Infisical, n8n, NocoDB, Notion, and Veeam Backup & Replication, plus new source guides for GitLab and JumpCloud login.

    24 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hash_password management command no longer accepts a positional password argument (to prevent shell-history exposure); run it without arguments for an interactive prompt or pipe via stdin: echo "$PASSWORD" | docker compose run --rm server hash_password.
    • !The Prevent duplicate device option has been removed from the WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. setup stage (it was disabled by default since 2026.5.4); no action needed on upgrade.
    • !AUTHENTIK_POSTGRESQL__CONN_OPTIONS and its replica equivalent are deprecated and will be removed in an upcoming version.
    • !AUTHENTIK_WEB__BASE_URL becomes a required setting in 2026.11; configure it now under System > Settings to avoid a future hard requirement.
    • !Tasks that logged errors but previously finished as successful (e.g. a sync that failed for a single object) now show as errors or warnings on the System Tasks page; existing pre-upgrade task statuses remain until those tasks run again.
11. docs update Aug 19, 2026 · issue 050

    authentik adds a dedicated email configuration guide covering global SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. env vars, ak test_email CLI, and TLS cert mounting.

    └──▷ TRY IT
    Verify that global SMTP email delivery is working from the authentik worker container in a Docker Compose deployment.
    copy

    $ docker compose exec worker ak test_email [email protected]

    Test a specific Email stage's SMTP settings (rather than the global config) to confirm stage-level overrides are routing correctly.
    copy

    $ docker compose exec worker ak test_email [email protected] -S my-email-stage

    • Adds AUTHENTIK_EMAIL__HOST, AUTHENTIK_EMAIL__PORT, AUTHENTIK_EMAIL__USERNAME, AUTHENTIK_EMAIL__PASSWORD, AUTHENTIK_EMAIL__USE_TLS, AUTHENTIK_EMAIL__USE_SSL, AUTHENTIK_EMAIL__TIMEOUT, and AUTHENTIK_EMAIL__FROM environment variables (in .env) for configuring global SMTP settings in Docker deployments.
    • Adds email.host, email.port, email.username, email.password, email.use_tls, email.use_ssl, email.timeout, and email.from keys under the authentik: block in values.yaml for Helm/Kubernetes deployments.
    • Introduces the ak test_email <to_address> CLI command to verify global SMTP delivery from the authentik worker, with -S <stage_name> flag to test a specific Email stage's SMTP settings instead.
    • Documents SSL_CERT_FILE environment variable for pointing authentik server and worker containers at a custom CA bundle when connecting to SMTP servers with custom TLS certificates.
    • Supports per-Email-stage SMTP overrides (host, port, credentials, TLS) as an alternative to the global SMTP settings, enabling different mail servers for different stages.

    5 details in Everything

12. docs update Aug 19, 2026 · issue 050

    authentik adds automated install env vars including AUTHENTIK_BOOTSTRAP_PASSWORD_HASH for pre-hashed akadmin setup and a /api/v3/core/users/<id>/set_password_hash/ endpoint.

    └──▷ TRY IT
    Generate a hashed password non-interactively before first deployment to populate AUTHENTIK_BOOTSTRAP_PASSWORD_HASH without exposing the password in shell history.
    copy

    $ echo "$PASSWORD" | docker compose run --rm server hash_password

    Bootstrap the akadmin account automatically in Docker Compose using a pre-hashed password stored safely in a .env file.
    .env copy

    AUTHENTIK_BOOTSTRAP_PASSWORD_HASH='pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM='
    AUTHENTIK_BOOTSTRAP_TOKEN=your-token-here
    AUTHENTIK_BOOTSTRAP_EMAIL=admin@example.com

    Set a hashed password on an existing user post-install via the API, scoped to a service account or regular user.
    copy

    $ curl -X POST https://authentik.example.com/api/v3/core/users/1/set_password_hash/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"password": "pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="}'

    • Adds AUTHENTIK_BOOTSTRAP_PASSWORD_HASH environment variable on the worker container to set the akadmin password via a pre-hashed Django password value at first startup, bypassing the Out-of-box experience; generate the hash with docker compose run --rm server hash_password.
    • Adds AUTHENTIK_BOOTSTRAP_PASSWORD environment variable to set the akadmin plaintext password at first startup (setting both AUTHENTIK_BOOTSTRAP_PASSWORD and AUTHENTIK_BOOTSTRAP_PASSWORD_HASH together results in an error).
    • Adds AUTHENTIK_BOOTSTRAP_TOKEN environment variable to create an API token for the akadmin user at first startup, usable immediately for API authentication.
    • Adds AUTHENTIK_BOOTSTRAP_EMAIL environment variable to set the email address for the akadmin user at first startup.
    • Adds POST /api/v3/core/users/<id>/set_password_hash/ API endpoint (requiring the authentik_core.reset_user_password permission) to set hashed passwords on regular users or service accounts post-install, with the hash supplied in the password field.

    +2 more show less

    • Supports setting akadmin credentials via Helm values keys bootstrap_password_hash, bootstrap_token, and bootstrap_email under the authentik: block, or via a Kubernetes secret referenced through global.envFrom.secretRef.
    • Supports the password_hash user attribute in blueprints as a post-install path for setting hashed passwords, sharing the same validation and local-verifier-only behavior as AUTHENTIK_BOOTSTRAP_PASSWORD_HASH.

    7 details in Everything

13. docs update Aug 19, 2026 · issue 050

    authentik documents PostgreSQL read replicas, direct connection pooler bypass, and full TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. config via environment variables.

    └──▷ USE IT
    Route LISTEN/NOTIFY and advisory-lock traffic away from a PgBouncer transaction-pool pooler to avoid silent breakage of Channels and dramatiq workers.
    .env copy

    AUTHENTIK_POSTGRESQL__HOST=pgbouncer
    AUTHENTIK_POSTGRESQL__PORT=5432
    AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS=true
    AUTHENTIK_POSTGRESQL__DIRECT__HOST=postgres-primary
    AUTHENTIK_POSTGRESQL__DIRECT__PORT=5432

    Add a PostgreSQL read replica with mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. to distribute query load away from the primary.
    .env copy

    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__HOST=replica.db.internal
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PORT=5432
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__NAME=authentik
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__USER=authentik
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PASSWORD=file:///run/secrets/db_password
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLMODE=verify-full
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLROOTCERT=/certs/ca.pem
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLCERT=/certs/client.pem
    AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLKEY=/certs/client.key

    Verify the full resolved authentik configuration after applying environment variable changes in Docker Compose.
    copy

    $ docker compose run --rm worker ak dump_config

    • Adds AUTHENTIK_POSTGRESQL__READ_REPLICAS__<n>__HOST/NAME/USER/PORT/PASSWORD/SSLMODE/SSLROOTCERT/SSLCERT/SSLKEY/CONN_MAX_AGE/CONN_HEALTH_CHECKS/DISABLE_SERVER_SIDE_CURSORS environment variables to configure indexed PostgreSQL read replicas, with automatic read/write routing to the primary.
    • Adds AUTHENTIK_POSTGRESQL__DIRECT__HOST, AUTHENTIK_POSTGRESQL__DIRECT__PORT, AUTHENTIK_POSTGRESQL__DIRECT__NAME, AUTHENTIK_POSTGRESQL__DIRECT__USER, AUTHENTIK_POSTGRESQL__DIRECT__PASSWORD, AUTHENTIK_POSTGRESQL__DIRECT__SSLMODE, AUTHENTIK_POSTGRESQL__DIRECT__SSLROOTCERT, AUTHENTIK_POSTGRESQL__DIRECT__SSLCERT, and AUTHENTIK_POSTGRESQL__DIRECT__SSLKEY to route LISTEN/NOTIFY and advisory-lock connections (Channels, dramatiq, startup migrations) through a separate direct or session-mode endpoint, keeping them off a transaction-pooling pooler.
    • Adds AUTHENTIK_POSTGRESQL__SSLMODE (default: verify-ca), AUTHENTIK_POSTGRESQL__SSLROOTCERT, AUTHENTIK_POSTGRESQL__SSLCERT, and AUTHENTIK_POSTGRESQL__SSLKEY environment variables to control TLS/SSL and mutual TLS for the primary PostgreSQL connection.
    • Adds AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS (default: false) to enable health checks on persistent connections before reuse, reducing stale-connection errors behind proxies or poolers.
    • Adds AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS (default: false) to disable server-side cursors when using transaction-based connection pooling.

    +5 more show less

    • Adds AUTHENTIK_POSTGRESQL__CONN_MAX_AGE to control connection persistence: 0 (default) closes after each request, a positive integer sets max lifetime in seconds, and None enables unlimited persistence.
    • Adds AUTHENTIK_POSTGRESQL__DEFAULT_SCHEMA to specify a custom database schema (default: public); must be set before first startup with the schema pre-created and the user granted access.
    • Supports env://<name>?<default> and file://<name>?<default> URI formats for loading any configuration value from environment variables or files with optional fallback defaults.
    • Adds ak dump_config command (via docker compose run --rm worker ak dump_config or kubectl exec) to verify the full resolved authentik configuration.
    • Documents that AUTHENTIK_POSTGRESQL__HOST, AUTHENTIK_POSTGRESQL__PORT, AUTHENTIK_POSTGRESQL__USER, and AUTHENTIK_POSTGRESQL__PASSWORD support hot-reloading without restarting authentik.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !AUTHENTIK_POSTGRESQL__CONN_OPTIONS is deprecated as of version 2026.5 and will be removed in a future version.
    • !AUTHENTIK_POSTGRESQL__REPLICA_CONN_OPTIONS is deprecated as of version 2026.5 and will be removed in a future version.
14. docs update Aug 19, 2026 · issue 050

    authentik now supports one-click AWS deployment via a CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. template with full HA infrastructure.

    • New AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. template deploys a production-ready authentik stack including a VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., RDS PostgreSQL Multi-AZ cluster, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. cluster (server + worker tasks), ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. with ACM certificate, EFS filesystem, and AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. secrets for credentials.
    • The CloudFormation stack accepts a Certificate ARN input (from AWS Certificate Manager) and outputs the ALB endpoint for DNS configuration.
    • Initial setup is accessible at http://<domain_you_configured> and prompts for the akadmin default user password.

    3 details in Everything

15. docs update Aug 19, 2026 · issue 050

    authentik Enterprise adds identity provisioning, device-aware access, audit/compliance tools, and network authentication features.

    • New Google Workspace integration synchronizes users and groups from authentik to Google Workspace.
    • New Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. integration synchronizes users and groups from authentik to Microsoft Entra ID.
    • New Shared Signals Framework provider sends security events to subscribed applications, including Apple Business Manager.
    • New WS-Federation provider connects WS-Federation applications to authentik for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
    • OAuth authentication for SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. replaces static tokens with short-lived OAuth tokens for SCIM provisioning.

    +11 more show less

    • External OAuth and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. sources embed an external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. in a flow, enabling dynamic redirection to Entra ID or Google Workspace before continuing.
    • New RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. EAP-TLSEAP-TLSAn authentication protocol that uses mutual TLS certificate exchange inside the Extensible Authentication Protocol framework to verify both client and server identity on a network, eliminating password-based credential risk. support authenticates network clients using EAP-TLS and client certificates.
    • Client certificate authentication enrolls or authenticates users via client certificates from devices, smart cards, PIV cards, or hardware tokens.
    • Account Lockdown immediately secures a compromised account by disabling it, revoking its tokens, ending its sessions, and recording the action in the audit log.
    • Enhanced audit logging records detailed object changes with before-and-after values for compliance review.
    • Event maps and charts visualize recent events by location, type, and volume.
    • CSV data exports allow export of user and event data for analysis, reporting, or backup.
    • Object Lifecycle Management (preview) schedules periodic reviews of applications, groups, and roles, assigns reviewers, and tracks overdue reviews.
    • New Fleet connector uses device information from Fleet in device-aware access decisions.
    • New Google Chrome connector uses Chrome Enterprise Device Trust signals in device-aware access decisions.
    • Local device login (preview) enables users to sign in to Windows and Linux devices with authentik credentials.

    16 details in Everything

16. docs update Aug 19, 2026 · issue 050

    authentik documents unified file picker supporting uploaded files, static assets, external URLs, Font Awesome icons, and theme-aware %(theme)s paths

    • Adds %(theme)s placeholder support in file picker paths and URLs, resolving to light or dark based on the active theme — works across Brand Logo, Brand Favicon, Brand Default flow background, Flow Background, Application Icon, and Source Icon fields, including S3 presigned URLs.
    • Supports fa://fa-circle-user-style Font Awesome icon references in icon fields (not background image fields) via the shared file picker.
    • Enforces upload path rules: relative paths only (no leading slash, no .., no //, no leading .), max 25 MB per file, max 1024-character full path, max 255-character per segment, allowed characters limited to letters, numbers, ., _, -, /, and %(theme)s.

    3 details in Everything

17. docs update Aug 19, 2026 · issue 050

    authentik adds centralized file management UI and S3-backed media storage with theme-aware asset resolution

    └──▷ HOW TO FIND IT
    Upload a company logo and reference it as a theme-aware brand logo that serves different assets for light and dark mode.
    📍In the Admin interface, go to Customization › Files, upload your light and dark logo variants, then in your brand settings set the logo field to a %(theme)s-based path (e.g. /media/branding/%(theme)s/logo.png) so authentik resolves the correct variant per theme.
    • New Customization > Files section in the Admin interface provides centralized upload, delete, and search for image files used in branding and application icons.
    • Supports S3 storage as a backend for uploaded media files in addition to the default /data directory on disk.
    • File picker fields (brand logos, favicons, flow backgrounds, application icons, source icons) now accept uploaded files, built-in static assets, external URLs, Font Awesome icons via fa://... references, and theme-aware paths using %(theme)s.
    • Files API returns themed_urls maps for theme-aware assets, enabling separate presigned URLs per theme variant when using S3-backed media.
    • Brand and entity APIs expose new themed URL fields: branding_logo_themed_urls, branding_favicon_themed_urls, background_themed_urls, meta_icon_themed_urls, and icon_themed_urls for light/dark mode asset resolution.

    5 details in Everything

18. docs update Aug 19, 2026 · issue 050

    authentik proxy provider docs detail dynamic host-header control via ak_proxy.host_header scope mapping (2025.6.1+) and per-path unauthenticated access rules.

    └──▷ USE IT
    Dynamically route each user to a per-user upstream backend in proxy mode — useful when different users need isolated backend instances.
    python copy

    return {
        "ak_proxy": {
            "backend_override": f"http://foo.bar.baz/{request.user.username}"
        }
    }

    Override the host header sent to the upstream to match the provider's configured Internal host — prevents host-mismatch rejections on strict internal services (authentik 2025.6.1+).
    python copy

    from urllib.parse import urlparse
    parsed_url = urlparse(provider.proxyprovider.internal_host)
    return {
        "ak_proxy": {
            "host_header": parsed_url.netloc
        }
    }

    • Adds host_header key inside ak_proxy scope-mapping expression to dynamically override the host header sent to upstream, available from authentik 2025.6.1+.
    • Adds backend_override key inside ak_proxy scope-mapping expression to dynamically select the upstream backend per user in proxy mode.
    • Adds Unauthenticated Paths and Unauthenticated URLs fields on the proxy provider to allow unauthenticated access to specific paths or URLs via per-line Rust regex crate regular expressions; in proxy and single-application forward-auth modes expressions match the request path, in domain-level forward-auth mode they match the full URL including scheme and host.
    • Documents additionalHeaders attribute on groups or users to inject static upstream headers (e.g. X-test-header: test-value).
    • Documents /outpost.goauthentik.io/sign_out logout endpoint, available on the protected-application host in proxy/single-app mode or on the auth URL in domain-level mode, with session invalidation scoped to the outpost.

    +2 more show less

    • Documents the full set of user-specific and application-specific headers set by the proxy outpost: X-authentik-username, X-authentik-groups, X-authentik-entitlements, X-authentik-email, X-authentik-name, X-authentik-uid, X-authentik-meta-outpost, X-authentik-meta-provider, X-authentik-meta-app, X-authentik-meta-version, and X-Forwarded-Host (proxy mode only).
    • Clarifies that domain-level forward auth cannot enforce per-application authorization rules; single-application mode is required when each application needs its own policies or bindings.

    7 details in Everything

19. docs update Aug 19, 2026 · issue 050

    authentik introduces AKQL, a structured query language for filtering events, users, and groups in the Admin UI and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..

    └──▷ TRY IT
    Query the REST API for users with a specific username using AKQL via the search parameter.
    copy

    $ curl -s 'https://authentik.example.com/api/v3/core/users/?search=username%20%3D%20%22bob%22' -H 'Authorization: Bearer <token>'

    Restrict an Event Matcher policy to flag failed logins originating outside the United States using the Query field.
    📍In the Admin interface, go to Customization › Policies, create or edit an Event Matcher Policy, and enter in the Query field: action = login_failed and context.geo.country != United States
    • Adds AKQL (authentik Query Language) — a structured search syntax built on DjangoQL — for filtering events, users, and groups in the Admin interface with expressions like action = "login" or context.geo.country = "Germany".
    • Exposes AKQL via the search query parameter on REST API list endpoints that return an AKQL autocomplete schema, e.g. GET /api/v3/core/users/?search=username%20%3D%20%22bob%22.
    • Adds a Query field on Event Matcher policies that accepts AKQL expressions to match events, combinable with existing policy fields such as Action or App.
    • Supports dot-notation queries into JSON and nested fields, including context.geo.country, context.http_request.path, attributes.department, and other arbitrary key paths stored in event context or user/group attributes.
    • Supports operators =, !=, >, >=, <, <=, ~ (case-insensitive contains), !~, startswith, not startswith, endswith, not endswith, in (...), and not in (...) with typed values: strings, integers, floats, booleans (True/False), null (None), and lists.

    +3 more show less

    • Exposes searchable fields for Events (action, event_uuid, app, client_ip, user.username, user.email, brand.name, context.*, created), Users (username, name, email, path, is_active, type, attributes.*), and Groups (name, is_superuser, attributes.*).
    • Falls back to plain case-insensitive substring search when the input is not a valid AKQL expression, so bare terms like bob still work.
    • Provides autocomplete suggestions for fields, operators, and values in AKQL search fields, with keyboard shortcuts: ↓/↑ to navigate, Tab or Enter to accept, ESC to dismiss or clear.

    8 details in Everything

20. docs update Aug 19, 2026 · issue 050

    authentik now supports multiple simultaneous user account sessions with in-browser account switching.

    • Enables multiple user accounts to remain signed in within the same browser simultaneously, with switching available from the User interface header.

    1 detail in Everything

21. version/2026.8.0 Aug 18, 2026 · issue 050

    authentik 2026.8.0 adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. audience override, back-channel logout on deactivation, and configurable source-stage failure actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.8.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.8.0

    • Adds an audience override field to SAML sources, allowing operators to specify a custom audience value in the SAML source configuration.
    • Adds a configurable failure action to enterprise source stages, controlling what happens when a source stage fails.
    • Sends back-channel logout requests to OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. providers when a user is deactivated, ensuring downstream sessions are terminated.
    • Deletes all user sessions immediately when a user account is deactivated.
    • Includes the query string in post-authentication redirects for the proxy outpost, preserving URL parameters through the login flow.

    +1 more show less

    • Allows an empty message authenticator in the RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. provider, broadening compatibility with RADIUS clients that omit this field.

    6 details in Everything

22. version/2026.5.6 Jul 22, 2026 · release notes

    Add in-process per-IP rate limiting and env-overridable storage file paths

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.5.6 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.5.6

    • Adds in-process per-IP rate throttle to the service to limit request rates by source IP without external dependencies.
    • Enables overwriting storage file paths via environment variables for flexible configuration.

    2 details in Everything

23. version/2026.5.5 Jul 15, 2026 · issue 020

    authentik 2026.5.5 adds number and boolean support in AKQL queries on JSON fields and licensing usage totals in the admin UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.5.5 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.5.5

    • Adds number and boolean type support in AKQL queries on JSON fields via the API search interface.
    • Adds usage totals display to the licensing section in the admin web UI.

    2 details in Everything

24. advisory CVE-2026-61574 Jul 15, 2026 · issue 128
    • CVE-2026-61574: RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <= 2026.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
25. advisory CVE-2026-57580 Jul 15, 2026 · issue 128
    • CVE-2026-57580: Account Takeover via SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. NameID Comment Truncation (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.7, affects <= 2026.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
26. advisory CVE-2026-54730 Jul 15, 2026 · issue 128
    • CVE-2026-54730: Google Chrome device trust stages can be bypassed (affects <= 2026.2.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
27. advisory CVE-2026-55106 Jul 15, 2026 · issue 128
    • CVE-2026-55106: LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Source debug endpoint accessible without authorization (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects <= 2026.2.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
28. version/2026.5.4 Jul 8, 2026 · release notes

    Authentik 2026.5.4 adds post-logout URLs for DokuWiki and allows SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. discovery failures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.5.4 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.5.4

    • Adds post_logout_url and logout_urls fields to the DokuWiki integration settings.
    • Allows SCIM provider discovery steps to fail without stopping the entire sync process.

    2 details in Everything

29. version/2026.2.5 Jul 7, 2026 · issue 020

    authentik 2026.2.5 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. discovery support and in-process per-IP rate throttling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.2.5 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.2.5

    • Adds discovery support to the SCIM provider, enabling automatic capability negotiation with SCIM endpoints.
    • Introduces in-process per-IP rate throttling to limit abusive request rates without an external component.

    2 details in Everything

30. version/2026.2.4 May 28, 2026 · release notes

    Adds SSH hostkey lookup for federated authentication in Connectors Agent endpoints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.2.4 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.2.4

31. advisory CVE-2026-49443 May 28, 2026 · issue 128
    • CVE-2026-49443: UserSourceConnection.user and GroupSourceConnection.group are changeable through the API (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.8, affects <=2025.12.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
32. advisory CVE-2026-49448 May 28, 2026 · issue 128
    • CVE-2026-49448: SourceStage bypass via empty POST (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects <=2025.12.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
33. advisory CVE-2026-47201 May 28, 2026 · issue 128
    • CVE-2026-47201: XML Signature Wrapping in SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Source ACS allows authentication as arbitrary federated user (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.5, affects <= 2025.12.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
34. version/2026.5.0 May 22, 2026 · release notes

    SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provider adds support for interactive OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs.; SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. unified endpoint now handles XML declarations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.5.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.5.0

    • Adds interactive_oauth2 configuration to the SCIM provider to allow interactive OAuth2 flows
    • Enables the SAML unified endpoint to handle incoming XML declarations

    2 details in Everything

35. version/2026.2.3 May 12, 2026 · release notes

    Adds cross-provider token introspection for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. and configurable device scope clipping.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.2.3 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.2.3

    • providers/oauth2 allows cross provider token introspection for federated providers
    • providers/oauth2 clips device authorization scope against the provider's ScopeMapping set

    2 details in Everything

36. version/2025.12.5 May 12, 2026 · release notes

    Adds ES384 to enterprise license algorithms and continuous login flows for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.12.5 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.12.5

    • ES384 is now an available algorithm for the enterprise license signature
    • Adds auth_header support for passing the device code flow client ID during OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Device Authorization GrantDevice Authorization GrantAn OAuth 2.0 flow for devices that lack a browser or keyboard: the device gets a short code, displays it to the user, and polls the authorization server while the user approves on a separate device.

    2 details in Everything

37. advisory CVE-2026-41569 May 12, 2026 · issue 128
    • CVE-2026-41569: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <= 2026.2.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
38. advisory CVE-2026-42849 May 12, 2026 · issue 128
    • CVE-2026-42849: Reflected XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. in SFE (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.3, affects <= 2026.2.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
39. advisory CVE-2026-41577 May 12, 2026 · issue 128
    • CVE-2026-41577: SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. source does not validate Conditions, timing, or audience on assertions (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 2025.2.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
40. advisory CVE-2026-40166 May 12, 2026 · issue 128
    • CVE-2026-40166: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/ (affects <= 2026.2.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
41. version/2026.2.2 Apr 7, 2026 · release notes

    Add --skip-migrations flag to lifecycle/migrate, WS-Fed to app wizard, and login_hint support for agent connectors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2026.2.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2026.2.2

    • Adds --skip-migrations flag to the lifecycle/migrate command to bypass database migrations during startup
    • Adds WS-Federation (WS-Fed) support to the application creation wizard in the web UI
    • Adds login_hint support for interactive authentication in the enterprise agent connector endpoint

    3 details in Everything

42. version/2025.10.4 Feb 12, 2026 · release notes

    Adds logout+jwt OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. logout token type for RP-initiated single logout in authentik 2025.10.4

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.10.4 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.10.4

    └──▷ HOW TO FIND IT
    Configure your OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider to accept the new JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-formatted logout token, enabling RP-initiated single logout.
    📍# In your OAuth2/OIDC provider configuration, add or set the supported logout token types: # supported_logout_token_types: [jwt, logout+jwt] # When initiating a logout request from an application, ensure the id_token_hint is signed and # the token_type_hint is omitted or set to id_token, as the provider will now expect the new type.
43. advisory CVE-2026-25227 Feb 12, 2026 · issue 128
    • CVE-2026-25227: Authenticated Remote Code Execution via Policy/Property Mapping test endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 2021.3.1, < 2025.8.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
44. advisory CVE-2026-25748 Feb 12, 2026 · issue 128
    • CVE-2026-25748: Forward authentication bypass with malformed session cookie on Traefik and Caddy (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects <= 2025.10.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
45. version/2025.12.2 Jan 30, 2026 · release notes

    Adds logout+jwt token type for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. logout tokens and allows SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. encryption certs without private keys

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.12.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.12.2

    • The logout+jwt token type is a new value for an existing configuration field (token_type) in OIDC providers.

    1 detail in Everything

46. version/2025.12.1 Jan 16, 2026 · release notes

    Adds property mapping override for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. scope claims in access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.12.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.12.1

47. version/2025.12.0 Jan 13, 2026 · release notes

    agent config now exposes license status via endpoints and proxyv2 stale session fix.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.12.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.12.0

    • endpoints agent configuration now includes license status details.

    1 detail in Everything

48. version/2025.10.2 Nov 19, 2025 · release notes

    SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provider now supports custom schema data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.10.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.10.2

49. advisory CVE-2025-64708 Nov 19, 2025 · issue 128
    • CVE-2025-64708: Invitation expiry is delayed by at least 5 minutes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.8, affects <= 2025.10.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
50. advisory CVE-2025-64521 Nov 19, 2025 · issue 128
    • CVE-2025-64521: Deactivated service account can authenticate to OAuth (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.8, affects <= 2025.10.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
51. version/2025.10.0 Oct 27, 2025 · release notes

    Adds prometheus metrics for enterprise license usage and expiry

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.10.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.10.0

52. version/2025.8.1 Aug 22, 2025 · release notes

    Authentik v2025.8.1 adds ingress.pathType config for Outposts and fixes several bugs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.8.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.8.1

    • Adds ingress.pathType configuration option to Outposts to allow setting the Kubernetes Ingress path type

    1 detail in Everything

53. advisory CVE-2025-53942 Jul 22, 2025 · issue 128
    • CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Sources (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects < 2025.6.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
54. advisory CVE-2025-52553 Jun 27, 2025 · issue 128
    • CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.6, affects < 2025.6.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
55. version/2025.6.1 Jun 6, 2025 · release notes

    Adds property mapping to override proxy host header

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.6.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.6.1

56. version/2025.6.0 Jun 4, 2025 · release notes

    Adds name field to RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Permissions search and new documentation for sessions in database and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. lookup.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.6.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.6.0

57. version/2025.4.0 Apr 30, 2025 · release notes

    Adds explicit session cookie age configuration and Azure AD group sync support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.4.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.4.0

    • AK_SESSION_EXPIRATION environment variable to configure the maximum lifespan of user session cookies.
    • Azure AD source provider now includes user groups in directory synchronizations.

    2 details in Everything

58. advisory CVE-2025-29928 Mar 28, 2025 · issue 128
    • CVE-2025-29928: Deletion of sessions did not revoke sessions when using database session storage (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.0, affects < 2025.2.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
59. version/2025.2.1 Feb 26, 2025 · release notes

    Adds new pre-hydrated relative URL feature in core.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2025.2.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2025.2.1

    • core: add pre-hydrated relative URL

    1 detail in Everything

60. version/2024.12.0 Dec 19, 2024 · release notes

    Adds CONN_MAX_AGE, CONN_HEALTH_CHECKS and DISABLE_SERVER_SIDE_CURSORS environment variables for PostgreSQL configuration in authentik

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2024.12.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2024.12.0

61. advisory CVE-2024-52307 Nov 21, 2024 · issue 128
    • CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.6, affects < 2024.10.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
62. version/2024.6.4 Aug 22, 2024 · release notes

    Adds enabled filter for ldap_password_validate signal to control LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. credential validation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2024.6.4 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2024.6.4

63. version/2024.6.2 Jul 31, 2024 · release notes

    authentik 2024.6.2 adds configurable Outposts refresh interval and user reputation scores in admin UI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2024.6.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2024.6.2

    └──▷ HOW TO FIND IT
    View reputation scores for a specific user to assess their risk profile.
    📍Navigate to Authentik Admin › Users, click on a user, and locate the Matching User Reputation Scores section in the details panel.
    • Show matching user reputation scores in the web/admin user details view

    1 detail in Everything

64. version/2023.10.5 Dec 21, 2023 · release notes

    authentik v2023.10.5 adds user agent to event logs and fixes SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. familyName default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.10.5 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.10.5

    • Change the default value of familyName in SCIM provider mappings

    1 detail in Everything

65. version/2023.6.0 Jul 7, 2023 · release notes

    Authentik adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. blueprint ports, user_write groups optional, event_matcher model filter and ldap StartTLS/cert auth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.6.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.6.0

    • blueprints: allow setting password in blueprints to manage user passwords from blueprints
    • core: make groups field for user optional in API/schema
    • providers/ldap: add StartTLS support
    • policies/event_matcher: add model filter to EventMatcher policy
    • providers/oauth2: correctly advertise code_challenge_methods_supported

    +2 more show less

    • blueprints: support custom ports for OCI blueprints
    • website/integrations: add Google Workspace and Netbox integrations

    7 details in Everything

66. version/2023.5.0 May 16, 2023 · release notes

    Adds resolve_dns and reverse_dns evaluator functions and custom CSS loading support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.5.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.5.0

    └──▷ USE IT
    Dynamically validate a domain's DNS records during a flow stage using the new evaluator functions.
    text copy

    resolve_dns('example.com', 'A')

67. version/2023.4.0 Apr 14, 2023 · release notes

    Adds resolve_dns and reverse_dns functions to the evaluator; changes default flow stage binding settings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.4.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.4.0

    • Adds resolve_dns and reverse_dns functions to evaluator to allow DNS-based conditional logic in flows.
    • Changes default flow stage binding settings in flows planner.

    2 details in Everything

68. version/2023.3.1 Mar 16, 2023 · release notes

    authentik 2023.3.1 removes credential_id size limit for WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. and fixes API/validation bugs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.3.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.3.1

    • Removes the credential_id size limit in the stages/authenticator_webauthn stage to support larger keys

    1 detail in Everything

69. version/2023.3.0 Mar 13, 2023 · release notes

    Adds resolve_dns and reverse_dns functions to the evaluator; bootstraps email configuration by default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.3.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.3.0

    • Adds resolve_dns and reverse_dns functions to the evaluator for dynamic name resolution in expressions.
    • Bootstraps initial email configuration during setup so cyber tooling is ready for notifications out of the box.

    2 details in Everything

70. version/2023.2.1 Feb 14, 2023 · release notes

    Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Debug endpoint for troubleshooting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.2.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.2.1

71. version/2023.2.0 Feb 14, 2023 · release notes

    authentik v2023.2.0 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. unbind flow execution and initial outpost-wide logout capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.2.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.2.0

    • providers/ldap now executes a dedicated unbind flow, allowing the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to explicitly request client disconnection in LDAP sessions.
    • Initial implementation of outpost wide logout, enabling centralized termination of all active sessions for an outpost.
    • Change email to username functionality added to stages, allowing the email field to be repurposed as the unique username attribute.

    3 details in Everything

72. version/2023.1.0 Jan 18, 2023 · release notes

    New SLOSLOA Service Level Objective is a target threshold for a system's reliability or performance, such as 99.9% uptime or sub-200ms latency, giving cyber tools a measurable contract to enforce or report against. for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. source manual import, proxy header interception, and blueprint tags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2023.1.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2023.1.0

    • Adds !Enumerate, !Value, and !Index blueprints tags to allow iteration and value extraction in flow definitions
    • Initial SLO (Single Logout) implementation for SAML providers enabling session termination flows
    • Adds setting to intercept the authorization header in proxy providers for custom auth forwarding
    • Adds a manual import option for LDAP sources bypassing automatic synchronization
    • Includes task duration in the admin API response for monitoring flow execution time

    5 details in Everything

73. version/2022.12.2 Jan 5, 2023 · release notes

    Adds prefix to SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. entity descriptors and async API calls in admin UI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.12.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.12.2

    • Adds configurable prefix to SAML EntityDescriptor element for providers/saml integration

    1 detail in Everything

74. version/2022.12.0 Dec 28, 2022 · release notes

    Blueprints now support nested custom tags in !Find and !Format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.12.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.12.0

75. version/2022.11.1 Nov 23, 2022 · release notes

    Adds state attribute support to blueprint delete operations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.11.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.11.1

76. version/2022.11.0 Nov 21, 2022 · release notes

    Configurable Sentry DSN, custom source icons, and Kubernetes ingress class support for Outposts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.11.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.11.0

    • Makes the Sentry DSN configurable via environment variable SENTRY_DSN instead of hardcoding it
    • Adds icon_url field to sources, allowing custom icons for identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
    • Allows setting the ingressClass for authentik Outposts deployed on Kubernetes

    3 details in Everything

77. version/2022.10.1 Oct 29, 2022 · release notes

    Adds TrueCommand integration for authentik cyber tooling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.10.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.10.1

    • Adds TrueCommand integration

    1 detail in Everything

78. version/2022.9.0 Sep 23, 2022 · release notes

    Authentik 2022.9 introduces OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry support for blueprints, meta-models within blueprints, and x5c JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. claims for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. providers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.9.0 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.9.0

    • Add meta model to apply blueprint within blueprint for dependencies
    • Add x5c JWT header support in OAuth2 provider
    • Set default value for certificate select inputs in the web UI

    3 details in Everything

79. version/2022.8.2 Aug 19, 2022 · release notes

    Adds generic blueprint export and remote blueprint sources for workflow configuration management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.8.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.8.2

    └──▷ HOW TO FIND IT
    Configure a remote blueprint URL in the UI to pull workflow definitions from a Git repository.
    📍Go to blueprints settings › Sources › Add Remote › Enter HTTPS/Git URL.
    • blueprints module now supports generic export alongside the existing flow exporter
    • Adds support for adding remote blueprints to manage identity workflows via external repositories

    2 details in Everything

80. version/2022.8.1 Aug 16, 2022 · release notes

    authentik introduces Blueprints for managing configurations and adds Caddy endpoint support for proxy providers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2022.8.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2022.8.1

    • Feat: use mailcow full_name as username for mailcow source

    1 detail in Everything

81. version/2021.5.4 May 22, 2021 · release notes

    Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. provider (preview), ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. docker images, configurable source matching behavior, Plex source, and forwardAuth compatibility

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.5.4 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.5.4

    • ldap_provider: New technical-preview feature to configure an LDAP Provider for applications requiring LDAP binding; binds using authentik flows with objectClass filter support.
    • Adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Docker image support alongside existing amd64 images.
    • Configurable source matching behavior via new options: Identifier, Email (link), Email (deny), Username (link), and Username (deny).
    • New dedicated Plex authentication Source replaces the previous provider configuration, allowing access limiting based on Plex server membership.
    • Proxy compatibility with Traefik forwardAuth and Nginx auth_request via updated outpost configuration.

    5 details in Everything

82. version/2021.5.3 May 20, 2021 · release notes

    Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Provider in technical preview, Plex Source, configurable source matching, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker images.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.5.3 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.5.3

    • Adds an LDAP Provider (technical preview) allowing applications requiring legacy protocol access to query users and groups via a flow-based binding
    • Adds configurable source behavior options (Identifier, Email (link), Email (deny), Username (link), Username (deny)) to control user matching after authentication
    • Adds support for Docker images on ARM architecture (arm64) alongside existing amd64 builds
    • Introduces a new dedicated Plex Source allowing access limitation based on Plex server membership

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The static container is no longer required; setup complexity reduced as it was previously mandatory
    • !Traefik is no longer required in docker-compose setups if using the in-container reverse proxy for static files
83. version/2021.5.2 May 17, 2021 · release notes

    Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Provider (technical preview), Plex authentication source, and configurable source matching behaviour

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.5.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.5.2

    • Adds LDAP Provider in technical preview for applications requiring LDAP protocol support.
    • Adds new plex Authentication Source allowing access limits based on Plex server membership.
    • Adds configurable source matching behaviour to control user enrollment after authentication: Identifier, Email (link), Email (deny), Username (link), or Username (deny).

    3 details in Everything

84. version/2021.5.1 May 13, 2021 · release notes

    Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Provider in technical preview, Plex authentication source, configurable source matching behaviour, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker images, and Traefik/Nginx proxy compatibility

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.5.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.5.1

    • ldap_provider now supports binding via flows with identification and password stages for applications requiring legacy LDAP access
    • Configurable source matching behaviour allows selecting Identifier, Email (link/deny), or Username (link/deny) strategies instead of the previous automatic unique identifier check
    • New Plex authentication source replaces the previous OAuth Source provider model
    • Outposts proxy supports forwardAuth with Traefik and auth_request with Nginx via updated configuration
    • Docker images now built for arm64 architecture alongside amd64

    5 details in Everything

85. version/2021.4.6 May 12, 2021 · release notes

    authentik adds configurable policy engine modes (any/all) and expiring events with new API browser

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.4.6 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.4.6

    └──▷ USE IT
    Control how many worker processes are spawned in a docker-compose deployment
    shell copy

    export WORKERS=4 && docker-compose up -d

    • Adds WORKERS environment variable to docker-compose to specify the number of processes started

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated Group membership feature is removed, requiring migration to the new groups implementation.
86. version/2021.4.5 Apr 29, 2021 · release notes

    Configurable policy evaluation mode (all/any), expiring events, and API Browser under /api/v2beta/

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.4.5 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.4.5

    └──▷ HOW TO FIND IT
    Open the API Browser in your browser to explore available endpoints.
    📍https://authentik.company/api/v2beta/
    • CONFIGURABLE_POLICY_ENGINE_MODE allows setting all or any for Applications, Sources, Flows, and Flow-stage bindings.
    • New API Browser accessible at /api/v2beta/ endpoints.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated Group membership functionality has been removed.
87. version/2021.4.4 Apr 24, 2021 · release notes

    Configurable policy engine mode (all/any), expiring events, new SPA UI with API browser and token views, WORKERS env var

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.4.4 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.4.4

    • policy_engine_mode configuration added to Applications, Sources, Flows, and Flow-stage bindings to control whether all or any policies must pass
    • Events now automatically expire with a default timeout of 1 Year (applied to existing events via migration)
    • UI can now display a user's OAuth Access/Refresh tokensRefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. and their granted consents
    • UI now displays a per-object changelog based on model_create/update/delete events
    • New API Browser available at /api/v2beta/

    +1 more show less

    • WORKERS environment variable added to control the number of Docker Compose processes

    6 details in Everything

88. version/2021.4.3 Apr 20, 2021 · release notes

    Adds configurable policy engine mode, expiring events, and a new UI with API browser and per-object changelogs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.4.3 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.4.3

    └──▷ USE IT
    Set the number of worker processes for your authentik deployment.
    shell copy

    WORKERS=4 docker-compose up -d

    • WORKERS environment variable controls the number of docker-compose processes
    • Per-object changelog visible via model_create/update/delete events
    • API Browser available at /api/v2beta/
    • Policy engine mode configurable for Applications, Sources, Flows, and Flow-stage bindings (defaults to *any* for new objects)

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated Group membership functionality has been removed
89. version/2021.4.2 Apr 17, 2021 · release notes

    Configurable policy engine mode (any vs all) and expiring events with a 1-year default timeout.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.4.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.4.2

    └──▷ HOW TO FIND IT
    Access the new v2beta API schema directly in a browser to discover available endpoints.
    📍https://authentik.company/api/v2beta/
    • CONFIGURABLE_POLICY_ENGINE allows setting whether *all* or *any* policies must pass for Applications, Sources, Flows, and Flow-stage bindings (defaults to any for new objects).
    • Events now automatically expire with a configurable timeout (EVENT_EXPIRY_TIMEOUT), defaulting to 1 year.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated Group membership feature has been removed.
90. version/2021.4.1 Apr 14, 2021 · release notes

    Configurable policy engine mode (all vs any), expiring events, and new API browser

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.4.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.4.1

    └──▷ TRY IT
    Configure the policy engine to allow access if any single policy passes (e.g. for fallback scenarios), setting the default for new objects.
    copy

    $ POLICY_ENGINE_MODE='any' docker-compose up -d

    Access the API Browser to explore available endpoints for a specific authentik instance.
    📍https://<your-authentik-domain>/api/v2beta/
    • Adds POLICY_ENGINE_MODE environment variable to control if all or any policies must pass for Applications, Sources, Flows, and Flow-stage bindings.
    • Adds automatic event expiry with a default timeout of 1 Year, removing the need for manual cleanup of database events.
    • Adds a new API Browser accessible at /api/v2beta/ in the Web UI.
    • Enables viewing OAuth Access/Refresh tokensRefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. and user consents directly in the UI.
    • Adds per-object changelog views based on model_create/update/delete events.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated Group membership functionality has been removed.
91. version/2021.3.4 Mar 16, 2021 · release notes

    Adds WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. authenticator support, a Deny stage for conditional access control, and invisible reCAPTCHA.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.3.4 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.3.4

    └──▷ HOW TO FIND IT
    Configure a WebAuthn device for a user by adding the specific stage to their authentication flow.
    📍Add WebAuthn Authenticator Setup Stage to your flow pipeline
    Deny access for unauthenticated users by inserting the new stage and disabling auto-evaluation in the flow plan.
    📍In Flow Executor, add Deny stage -> Uncheck Evaluate on plan
    Generate new reCAPTCHA keys from Google Admin console before upgrading to avoid auth failures.
    📍Go to https://www.google.com/recaptcha/admin, create new site with type reCAPTCHA v2 and badge mode Invisible
    • Adds WebAuthn Authenticator Setup Stage to configure hardware keys like YubiKeys as an n-th factor.
    • Adds a new Deny stage to conditionally block user access during a flow (disable Evaluate on plan to make it conditional).
    • Replaces checkbox reCAPTCHA with reCAPTCHA v2 Invisible and requires new keys from Google Recaptcha Admin.
    • Allows selecting a specific Group or User directly in a binding for simplified role-based access, auto-migrating existing Group Membership policies.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !reCAPTCHA keys must be regenerated as reCAPTCHA v2 with Invisible reCAPTCHA badge mode; previous checkbox keys are no longer valid.
92. version/2021.3.3 Mar 9, 2021 · release notes

    Adds WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. support, Deny flow stage, simplified Group/User binding, and reCAPTCHA v2 Invisible

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.3.3 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.3.3

    └──▷ HOW TO FIND IT
    Configure WebAuthn hardware key as a second factor for authentication flows.
    📍In the flow editor, add WebAuthn Authenticator Setup Stage to your authentication plan and link it as an n-th factor alongside TOTP.
    Conditionally block unauthenticated users or specific actors within a custom flow logic.
    📍Insert the Deny stage into your flow plan to explicitly reject requests when preconditions are not met; ensure Evaluate on plan is disabled if used conditionally.
    Simplify access control by binding specific identities directly instead of creating group membership policies.
    📍In your binding configuration, select a specific User or Group directly from the dropdown to enforce access rules without intermediate policy objects.
    • Adds WebAuthn Authenticator Setup Stage for configuring hardware keys like YubiKeys as an n-th factor
    • Adds ability to select a specific User or Group directly in a binding for role-based access
    • Replaces checkbox reCAPTCHA with reCAPTCHA v2 Invisible
    • Migrates Flow Executor to SPA/API architecture for service integration
    • Adds Deny stage to conditionally block access during a flow

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !reCAPTCHA checkbox replaced with reCAPTCHA v2 Invisible, requiring new API keys from Google Recaptcha Admin
93. version/2021.3.2 Mar 4, 2021 · release notes

    Adds WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. stage, simplified group/user bindings, deny stage, and reCAPTCHA v2 Invisible support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.3.2 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.3.2

    └──▷ HOW TO FIND IT
    Configure WebAuthn for hardware key authentication
    📍In the console, go to Stages › Add Stage and select WebAuthn Authenticator Setup Stage.
    Use a new stage to block unauthenticated users in a flow
    📍In the console, go to Stages › Add Stage and select Deny stage.
    • Adds WebAuthn Authenticator Setup Stage for hardware key authentication
    • Allows direct user and group selection in role-based access bindings without Group Membership policies
    • Replaces checkbox reCAPTCHA with reCAPTCHA v2 Invisible
    • Migrates Flow Executor to SPA/API architecture for external service use
    • Adds Deny stage for conditional access blocking

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !reCAPTCHA keys are now specific to v2 Invisible; previously generic checkbox keys no longer work.
94. version/2021.3.1 Mar 3, 2021 · release notes

    Adds WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. hardware key support, a Deny stage for flows, simplified Group/User bindings, and reCAPTCHA v2 Invisible.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.3.1 https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.3.1

    • WebAuthn Authenticator Setup Stage enables hardware keys (e.g. YubiKeys) as an n-th factor
    • New Deny stage to conditionally block access within a flow
    • Direct User or Group selection in binding rules, replacing the need for Group Membership policies
    • Invisible reCAPTCHA v2 replaces checkbox-based reCAPTCHA

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !reCAPTCHA keys are only valid for a single type; you must create a new reCAPTCHA v2 key pair in Invisible reCAPTCHA badge mode at https://www.google.com/recaptcha/admin
95. version/2021.2.6-stable Feb 27, 2021 · release notes

    Adds managed objects lifecycle for property mappings and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. source improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.2.6-stable https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.2.6-stable

    • Introduces managed attribute to property mappings, enabling automatic creation, update, and deletion by authentik
    • LDAP source now syncs membership from groups to users instead of user to group
    • Adds property-mappings for groups in LDAP source to map attributes like name or is_superuser
    • Adds test view for debugging property-mappings

    4 details in Everything

96. version/2021.2.5-stable Feb 24, 2021 · release notes

    Adds managed object lifecycle for automatic updates and a property-mapping debug view

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.2.5-stable https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.2.5-stable

    └──▷ HOW TO FIND IT
    Debug why a property mapping isn't outputting the expected value during synchronization.
    📍Navigate to the property mapping in the authentik admin UI and use the Test view button.
    • Allows marking objects like property mappings as managed so authentik automatically creates, updates, and deletes them
    • Adds a test view to debug property-mappings directly within the application
    • Adds property-mappings for groups to map attributes such as name and is_superuser in LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sources

    3 details in Everything

97. version/2021.2.4-stable Feb 23, 2021 · release notes

    New managed objects lifecycle and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. source improvements including user-level sync and property mappings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.2.4-stable https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.2.4-stable

    • Adds ability to mark managed objects (e.g., property mappings) as managed so authentik automatically creates, updates, and deletes them.
    • Switches LDAP group membership synchronization logic from user-to-group to user-level sync for more accurate group state.
    • Adds property-mappings support for groups in the LDAP source to map attributes like name or is_superuser.
    • Adds a test view UI feature to debug and validate property-mappings.

    4 details in Everything

98. version/2021.2.3-stable Feb 10, 2021 · release notes

    adds managed object lifecycle and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sync/user mapping improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.2.3-stable https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.2.3-stable

    └──▷ HOW TO FIND IT
    Configure an LDAP source to sync group membership directly and map specific group attributes for non-AD environments.
    📍Enable sync membership on the user side in the LDAP Source settings and add property mappings for name and is_superuser.
    Debug how a specific LDAP attribute is being mapped to an internal property using the new debug interface.
    📍Navigate to the LDAP Source › Property Mappings section and use the Test View for the relevant mapping.
    • Adds ability to mark property mappings and generated tokens/users as managed for automatic creation, update, and deletion
    • Switches LDAP group membership sync direction from user-to-group to group-to-user
    • Adds property-mappings for groups to map attributes like name or is_superuser in non-Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. LDAP setups
    • Adds a test view to debug property-mappings

    4 details in Everything

99. version/2021.2.2-stable Feb 10, 2021 · release notes

    Managed objects lifecycle, improved LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. non-AD support, and a property mapping test view

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch version/2021.2.2-stable https://github.com/goauthentik/authentik.git
    # already have the repo? check out this version:
    $ git checkout version/2021.2.2-stable

    • managed flag on property mappings allows authentik to create, update, and delete the object automatically
    • LDAP source now supports core fields declared as lists instead of single values
    • New name and is_superuser property mappings available for group attribute sync
    • Added test view endpoint to debug property mappings

    4 details in Everything

100. version/2021.2.1-stable Feb 8, 2021 · release notes

     Adds managed objects lifecycle, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. list-field support, group-to-user sync, and a debug test view for property mappings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/2021.2.1-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/2021.2.1-stable

     • Objects such as property mappings can now be marked as managed, enabling authentik to automatically create, update, and delete them (used for default property mappings and outpost tokens/users).
     • LDAP source switches membership sync direction from user-to-group to group-to-user.
     • LDAP source now supports servers where core fields are declared as lists.
     • New property-mappings added for groups to map attributes like name and is_superuser.

     4 details in Everything

101. version/2021.1.4-stable Jan 29, 2021 · release notes

     Adds global email settings and a new notification system with default transports to replace per-stage configuration

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/2021.1.4-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/2021.1.4-stable

     └──▷ HOW TO FIND IT
     Configure the new global email transport for all notifications in a docker-compose setup.
     📍# Refer to the updated docker-compose installation docs for the new global email environment variables
     Configure the new global email transport for all notifications in a Kubernetes deployment.
     📍# Refer to the updated kubernetes installation docs for the new global email configuration fields
     • docker-compose and kubernetes installation docs now reference global email settings instead of per-[Email Stage](../flow/stages/email/index.md) configuration.
     • A new notification system introduced, creating default rules for policy exceptions, configuration errors, and updates, using a default transport via the global email transport.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The previous method of configuring email connection details per [Email Stage](../flow/stages/email/index.md) is superseded by the new global email settings.
102. version/2021.1.3-stable Jan 27, 2021 · release notes

     Adds global email settings and a new notification system with default rule-based transports to authentik.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/2021.1.3-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/2021.1.3-stable

     • Adds global email settings as a replacement for per-Stage configuration
     • Introduces a new notification system with default rules for policy exceptions and configuration errors

     2 details in Everything

103. version/2021.1.2-stable Jan 18, 2021 · release notes

     Adds global email settings and a new notification system with default rules and transports.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/2021.1.2-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/2021.1.2-stable

     • Adds global.email configuration section to replace per-Email Stage connection details for SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. server, port, username, and password
     • Creates default notification rules for policy exceptions, configuration errors, and updates upon upgrade

     2 details in Everything

104. version/2021.1.1-stable Jan 17, 2021 · release notes

     Adds global email settings and a new notification system with default rules and transports

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/2021.1.1-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/2021.1.1-stable

     └──▷ HOW TO FIND IT
     View the newly created default rules for policy exceptions and configuration errors in the UI.
     📍Navigate to Settings › Notifications › Rules
     • Adds global email settings, allowing configuration of email connection details at the application level instead of per-Email Stage.
     • Introduces a new notification system with a default transport that sends notifications about policy exceptions, configuration errors, and updates via the global email transport.
     • Creates default notification rules during update to monitor policy exceptions, configuration errors, and updates.

     3 details in Everything

105. version/0.14.0-stable Dec 28, 2020 · release notes

     New SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata import, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Authorization Code JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage., event logging for policy execution, and flow diagrams.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.14.0-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.14.0-stable

     • Adds SAMLProvider creation from SAML Metadata via the API or UI
     • Events now log Policy Execution, Policy Exceptions, and Property Mapping Exceptions
     • OAuth2 Authorization Codes are now generated as JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Tokens instead of opaque strings
     • Flows can now be visualized graphically in the UI to show stages and policy bindings
     • authentik proxy updated to oauth2_proxy 6.1.1

     5 details in Everything

106. version/0.13.0-stable Dec 14, 2020 · release notes

     authentik v0.13 adds dark mode, direct app icon upload, Docker Service Connections with certs, and a semi-SPA web interface.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.13.0-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.13.0-stable

     └──▷ HOW TO FIND IT
     Switch the UI to dark mode or toggle it via system settings.
     📍Change your OS display settings to Dark Mode; authentik's web interface will follow automatically.
     Upload a custom logo for an application instead of using a URL.
     📍In the authentik UI, navigate to the Application settings and use the Upload Icon button.
     • Adds darkmode to the web interface, enabled automatically based on the operating system setting
     • Allows uploading Application Icons directly to authentik instead of only loading them from a URL
     • Adds better support for Docker Service Connections with Certificates
     • Introduces a semi-SPA web experience with asynchronous operations, including a new refresh button

     4 details in Everything

107. version/0.12.9-stable Nov 10, 2020 · release notes

     authentik 0.12.9 adds remote outpost deployment via Output Service Connection and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. keypair verification

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.12.9-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.12.9-stable

     └──▷ HOW TO FIND IT
     Deploy an outpost to a remote environment by configuring the Output Service Connection instead of relying on local discovery.
     📍In the UI, go to Outposts › New and select Output Service Connection as the connection type, then provide the remote endpoint details.
     Enable signature verification in SAML when your IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. provides a certificate but no private key.
     📍In the SAML Provider configuration, add the public key to the Verification Keypair field.
     • Output Service Connection for deploying outposts on remote Kubernetes Clusters or Docker servers
     • SAML Provider Verification Keypair field to verify Assertions against Certificates without Private key

     2 details in Everything

108. version/0.12.7-stable Oct 27, 2020 · release notes

     Removes deprecated auth fallback; migrates login stage to use timedelta input for more precise timeout configuration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.12.7-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.12.7-stable

     • Adds timedelta input support in the user_login stage, replacing the previous integer seconds parameter.
     • Removes authentication fallback logic for proxies running versions prior to 0.12.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The implicit authentication fallback for proxy servers with version < 0.12 has been removed; these proxies must now handle auth directly.
109. version/0.12.4-stable Oct 20, 2020 · release notes

     authentik 0.12.4 adds evaluate_on_plan to flow stages for policy evaluation control

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.12.4-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.12.4-stable

     • Adds evaluate_on_plan parameter to flows, allowing stage policies to be evaluated during the planning phase

     1 detail in Everything

110. version/0.12.3-stable Oct 20, 2020 · release notes

     Adds DB backups via monitored tasks and fixes Kubernetes pod selector/logs

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.12.3-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.12.3-stable

     • Implement db backups with monitored tasks in the root package

     1 detail in Everything

111. version/0.12.0-stable Oct 19, 2020 · release notes

     authentik 0.12 adds multi-tenant Outpost state, K8s integration, user API token creation, and searchable audit logs

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.12.0-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.12.0-stable

     └──▷ USE IT
     Enable the Kubernetes Integration in your Helm values to deploy Outposts with high availability.
     yaml copy

     kubernetesIntegration: true

     Migrate your Helm config keys to the new snake_case structure (e.g. secretKey, logLevel).
     yaml copy

     kubernetesIntegration: true
     secretKey: 'your-fixed-key'
     errorReporting:
       enabled: false
     logLevel: warning

     Use the new Traefik 2.3 base in your docker-compose deployment.
     copy

     $ docker-compose up -d && docker-compose run --rm server migrate

     • Supports multiple concurrent Outpost instances in a single deployment via rewritten state logic
     • Deploys Outposts with High Availability inside a Kubernetes cluster through the new Kubernetes Integration
     • Displays a System Task Overview for background tasks including status, log output, and retry actions
     • Makes Audit Logs searchable via the UI
     • Allows users to create their own API Tokens from the interface

     +1 more show less

     • Updates default Traefik version to 2.3 in docker-compose deployments

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The config.secret_key Helm value is renamed to config.secretKey
     • !The config.error_reporting.enabled, config.error_reporting.environment, and config.error_reporting.send_pii Helm values are replaced by config.errorReporting.enabled, config.errorReporting.environment, and config.errorReporting.sendPii
     • !The config.log_level Helm value is renamed to config.logLevel
112. version/0.11.0-stable Oct 11, 2020 · release notes

     authentik 0.11.0 adds Backup/Restore, Outpost Docker Controller, table search, Token IDs, metrics dashboard, and policy-aware app API

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.11.0-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.11.0-stable

     • core/applications/list API endpoint now filters applications by the current user's access policies (previously returned all apps).
     • Adds backup and restore capability for authentik state.
     • Outpost now supports a Docker Controller that installs, updates, and manages the Outpost on the same host as passbook.
     • Adds search functionality to all table views in the UI.

     4 details in Everything

113. version/0.10.8-stable Sep 30, 2020 · release notes

     Adds benchmark command, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. introspection basic/bearer auth, pb_proxy scope, and consent pending_user support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.8-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.8-stable

     └──▷ TRY IT
     Profile your authentication flows to identify bottlenecks or performance issues.
     copy

     $ authentik benchmark <flow_name>

     • flows: add benchmark command adds a new benchmark subcommand for profiling flow performance.
     • providers/oauth2: rewrite introspection endpoint to allow basic or bearer auth allows the OAuth2 introspection endpoint to accept HTTP Basic or Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. authentication.
     • providers/proxy: add pb_proxy scope for proxy that sends user_attributes adds a pb_proxy scope to send user attributes in the proxy layer.
     • stages/consent: support pending_user from flow allows the consent stage to handle and process pending_user objects originating from a flow.

     4 details in Everything

114. version/0.10.7-stable Sep 26, 2020 · release notes

     Adds user.group_attributes field and makes upstream SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. validation configurable for proxy providers.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.7-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.7-stable

     └──▷ USE IT
     Configure whether the proxy provider validates the upstream server's SSL certificate.
     config copy

     UPSTREAM_VALIDATE_SSL: true/false

     • Adds user.group_attributes which merges attributes from all user groups
     • Re-adds Twitter OAuth client integration

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The pb_flow_plan variable is removed from flow context; use the context variable directly instead
115. version/0.10.6-stable Sep 21, 2020 · release notes

     authentik v0.10.6 adds SOURCE_LINKED audit events, per-request X-passbook-id header, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. password sync/validation and JSON user data archival

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.6-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.6-stable

     • Audit logs now include a SOURCE_LINKED event action for cross-referencing identity sources
     • Core creates audit logs for all model creation, updating, and deletion events
     • User data is saved as JSON in audit trails even after the user account is deleted
     • Every HTTP request now includes the X-passbook-id header with a unique trace ID
     • LDAP source now supports password validation and syncing against Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.

     +1 more show less

     • Prompt stage integrates automatic password comparison when multiple password fields are presented

     6 details in Everything

116. version/0.10.4-stable Sep 19, 2020 · release notes

     authentik 0.10.4 adds password flow cancellation on failed attempts and regex path skipping in proxy providers.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.4-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.4-stable

     • Adds skip_auth_paths_regex option to proxy providers to skip authentication for matching paths
     • Adds failed_attempts_before_cancel setting to stages/password to cancel a flow after a specified number of failed entries
     • Adds version checking support for outposts

     3 details in Everything

117. version/0.10.3-stable Sep 17, 2020 · release notes

     authentik v0.10.3 adds OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. CODE_ADFS protocol mode and configurable sub claims

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.3-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.3-stable

     • Adds CODE_ADFS code for the OAuth2 provider that uses id_token as the access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. instead of a standard code exchange.
     • Makes the sub claim configurable in the OAuth2 provider to allow custom subject mapping.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The is_superuser attribute is moved to groups; it is no longer available directly on the user model.
118. version/0.10.2-stable Sep 15, 2020 · release notes

     Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. source syncing on save

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.2-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.2-stable

119. version/0.10.1-stable Sep 14, 2020 · release notes

     Additions to Helm chart configuration and automatic application launch URL detection in v0.10.1

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.1-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.1-stable

     • Add soft affinity rules support in the Authentik Helm chart

     1 detail in Everything

120. version/0.10.0-stable Sep 13, 2020 · release notes

     authentik 0.10 adds OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs./OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. provider, Proxy Provider with Outpost system, and Flow import/export.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.0-stable https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.0-stable

     • OAuth2 and OpenID providers are merged into a single OAuth2Provider capable of Property Mappings
     • New ProxyProvider supports multiple applications per instance and TLS configuration via Passbook Keypairs
     • New Outpost object type manages service accounts for Proxy Provider communication with passbook
     • Flows can now be imported and exported via the API or UI

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Existing OpenIDProvider and OAuth2Provider objects must be re-created as they are no longer supported
     • !The ApplicationGatewayProvider has been replaced by the ProxyProvider
121. version/0.10.0-rc6 Prerelease Sep 10, 2020 · release notes

     authentik 0.10 introduces a merged OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs./OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Provider, Proxy Provider with Outposts support, and Flow import/export capabilities.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.10.0-rc6 https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.10.0-rc6

     • Adds new OAuth2/OpenID Provider merging previous providers with Property Mappings support
     • Adds Proxy Provider for application gateways with passbook integration via Outposts
     • Adds Outpost System object type to manage service account creation and permissions for proxies
     • Adds Flow Import/Export feature for backups and sharing complex flows

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !OpenID and OAuth2 Providers must be re-created as they are replaced by the new merged provider
122. version/0.9.0-rc2 Prerelease Jul 26, 2020 · release notes

     authentik 0.9.0-rc2 introduces User Consent flow stages and re-usable token expiry logic

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.9.0-rc2 https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.9.0-rc2

     • core: Extracts token expiry logic into a separate, reusable component.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !Path-based imports have been removed from all PropertyMappings, policies, providers, sources, and stages.
123. version/0.9.0-rc1 Prerelease Jul 15, 2020 · release notes

     Adds POST_AUTO binding for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. sources, static/login template extensions, IP Address comparison in evaluator, and prompt stage elements

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.9.0-rc1 https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.9.0-rc1

     • Adds POST_AUTO binding to SAML sources, which auto-redirects to the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
     • Introduces generic login/base_full template for static login views in core
     • Adds separate autosubmit_form template for use without flows
     • Enables IP Address comparison support in lib/evaluator
     • Adds helper to remove None-value keys from dict for policies in polices module

     5 details in Everything

124. version/0.8.14-beta Prerelease Apr 10, 2020 · release notes

     Adds private_key property and new crypto subsystem for certificate-key management

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.8.14-beta https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.8.14-beta

     • Adds crypto.private_key property to access the private key directly from the crypto module.

     1 detail in Everything

125. version/0.8.8-beta Prerelease Feb 23, 2020 · release notes

     authentik v0.8.8-beta adds pb_client_ip to expression policies

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.8.8-beta https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.8.8-beta

     └──▷ USE IT
     Use pb_client_ip in an expression to block specific subnet ranges.
     python copy

     import ipaddress
     
     def check_ip(request):
         client_ip = request.get('pb_client_ip', '')
         # Logic to validate or filter based on IP
         return True

     • Adds pb_client_ip field to the expression policy engine for use in custom logic

     1 detail in Everything

126. version/0.8.5-beta Prerelease Feb 20, 2020 · release notes

     authentik 0.8.5-beta adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. POST binding support and validates SAMLResponse signatures

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.8.5-beta https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.8.5-beta

127. version/0.8.0-beta Prerelease Feb 19, 2020 · release notes

     Adds expression policies via API and structured logging

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.8.0-beta https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.8.0-beta

     • Expose expression policy types in the API URLs, enabling programmatic management of custom logic.
     • Load custom policy templates during initialization to extend authentication workflows.
     • Output all logs in a structured format for easier parsing and integration with external SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point..

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Redundant policies are removed; use expressions to implement previous logic.
     • !Default OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Client now sends access_token as Bearer Authz instead of prior method.
     • !Pre-built supervisr and other redundant OAuth2Clients are no longer available.
128. version/0.7.17-beta Prerelease Feb 18, 2020 · release notes

     Adds Expression-based policy support in authentik 0.7.17-beta

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.7.17-beta https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.7.17-beta

     • Adds Expression based policy to the policies system

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The default value for assertion_valid_not_before in SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. providers changes to -5 minutes
129. version/0.7.15-beta Prerelease Feb 17, 2020 · release notes

     PropertyMapping now accepts Jinja2 expressions with admin-side highlighting and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. signature customization

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch version/0.7.15-beta https://github.com/goauthentik/authentik.git
     # already have the repo? check out this version:
     $ git checkout version/0.7.15-beta

     • providers/saml adds configurable signature and digest algorithm settings to control SAML assertion signing.
     • The PropertyMapping template field is replaced by an expression field accepting Jinja2 syntax.
     • Admin interface gains Jinja2 syntax highlighting for the PropertyMapping expression editor.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The template field on PropertyMapping is renamed to expression, which now expects Jinja2 syntax instead of raw Python templates.