From 85c3a36b62eb40b83d0131d05c30a03524fa65fb Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 14:54:44 +0200 Subject: [PATCH 01/77] website: clear up comparison Signed-off-by: Jens Langhammer --- website/src/comparison.jsx | 56 +++++++++++++++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-) diff --git a/website/src/comparison.jsx b/website/src/comparison.jsx index 51fe05150..6439c8a92 100644 --- a/website/src/comparison.jsx +++ b/website/src/comparison.jsx @@ -22,7 +22,7 @@ function Comparison() { - Protocol Support + Protocol Support (as a provider) @@ -64,6 +64,60 @@ function Comparison() { + + + Federation support + + + + + + + + + + + + SAML2 + + + + + + + + + + OAuth2 and OIDC + + + + + + + + + + OAuth1 + + + + + + + + + + LDAP + + + + + + + + + Use-cases From 28cb803fd955211c96c63c0e7469bad964b776b4 Mon Sep 17 00:00:00 2001 From: Ernie Date: Wed, 16 Jun 2021 13:38:34 -0400 Subject: [PATCH 02/77] website/docs: Add a note about Protocol Overwrite (#1031) Added a note in the Nextcloud section for Protocol overwrite when behind a reverse proxy --- website/docs/integrations/services/nextcloud/index.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/website/docs/integrations/services/nextcloud/index.md b/website/docs/integrations/services/nextcloud/index.md index 571123d92..4d18f5671 100644 --- a/website/docs/integrations/services/nextcloud/index.md +++ b/website/docs/integrations/services/nextcloud/index.md @@ -55,6 +55,12 @@ Under Attribute mapping, set these values: - Attribute to map the email address to.: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - Attribute to map the users groups to.: `http://schemas.xmlsoap.org/claims/Group` +:::note +If Nextcloud is behind a reverse proxy you may need to force Nextcloud to use HTTPS. +To do this you will need to add the line `'overwriteprotocol' => 'https'` to `config.php` in the Nextcloud `config\config.php` file +See https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html#overwrite-parameters for additional information +::: + ## Group Quotas Create a group for each different level of quota you want users to have. Set a custom attribute, for example called `nextcloud_quota`, to the quota you want, for example `15 GB`. From 426686957d4c58ed28f3f003dccc045d92d869a1 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 22:43:43 +0200 Subject: [PATCH 03/77] website/docs: remove migrate command Signed-off-by: Jens Langhammer --- azure-pipelines.yml | 2 +- website/docs/installation/docker-compose.md | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/azure-pipelines.yml b/azure-pipelines.yml index 9bae8cce6..5f03da0c7 100644 --- a/azure-pipelines.yml +++ b/azure-pipelines.yml @@ -148,7 +148,7 @@ stages: inputs: script: | pipenv run python -m scripts.generate_ci_config - pipenv run ./manage.py migrate + pipenv run python -m lifecycle.migrate - job: migrations_from_previous_release pool: vmImage: 'ubuntu-latest' diff --git a/website/docs/installation/docker-compose.md b/website/docs/installation/docker-compose.md index a65635751..3476adad3 100644 --- a/website/docs/installation/docker-compose.md +++ b/website/docs/installation/docker-compose.md @@ -74,7 +74,6 @@ Afterwards, run these commands to finish ```shell docker-compose pull docker-compose up -d -docker-compose run --rm server migrate ``` The compose file statically references the latest version available at the time of downloading, which can be overridden with the `SERVER_TAG` environment variable. From 79044368d218cf04c8e3c2d60765e4fb640deb9c Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 22:45:42 +0200 Subject: [PATCH 04/77] core: fix error getting stages when enrollment flow isn't set Signed-off-by: Jens Langhammer --- authentik/core/sources/flow_manager.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/authentik/core/sources/flow_manager.py b/authentik/core/sources/flow_manager.py index d871d03e6..173064822 100644 --- a/authentik/core/sources/flow_manager.py +++ b/authentik/core/sources/flow_manager.py @@ -183,6 +183,8 @@ class SourceFlowManager: # pylint: disable=unused-argument def get_stages_to_append(self, flow: Flow) -> list[Stage]: """Hook to override stages which are appended to the flow""" + if not self.source.enrollment_flow: + return [] if flow.slug == self.source.enrollment_flow.slug: return [ in_memory_stage(PostUserEnrollmentStage), From d4419d66c196260363772a12b591d4e9f170d418 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 22:48:26 +0200 Subject: [PATCH 05/77] core: fix error when creating AuthenticatedSession without key Signed-off-by: Jens Langhammer --- authentik/core/models.py | 6 +++++- authentik/core/signals.py | 4 +++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/authentik/core/models.py b/authentik/core/models.py index 677627d64..fc88d10e8 100644 --- a/authentik/core/models.py +++ b/authentik/core/models.py @@ -494,8 +494,12 @@ class AuthenticatedSession(ExpiringModel): last_used = models.DateTimeField(auto_now=True) @staticmethod - def from_request(request: HttpRequest, user: User) -> "AuthenticatedSession": + def from_request( + request: HttpRequest, user: User + ) -> Optional["AuthenticatedSession"]: """Create a new session from a http request""" + if not hasattr(request, "session") or not request.session.session_key: + return None return AuthenticatedSession( session_key=request.session.session_key, user=user, diff --git a/authentik/core/signals.py b/authentik/core/signals.py index daca16ce1..497fbdc8b 100644 --- a/authentik/core/signals.py +++ b/authentik/core/signals.py @@ -49,7 +49,9 @@ def user_logged_in_session(sender, request: HttpRequest, user: "User", **_): """Create an AuthenticatedSession from request""" from authentik.core.models import AuthenticatedSession - AuthenticatedSession.from_request(request, user).save() + session = AuthenticatedSession.from_request(request, user) + if session: + session.save() @receiver(user_logged_out) From b53c94d76aabb045192bcc18b3c3e0b5b3c8cf88 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 22:52:00 +0200 Subject: [PATCH 06/77] flows: fix error when stage has incorrect type Signed-off-by: Jens Langhammer --- authentik/flows/views.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/authentik/flows/views.py b/authentik/flows/views.py index a8b0d9720..c02396012 100644 --- a/authentik/flows/views.py +++ b/authentik/flows/views.py @@ -164,7 +164,11 @@ class FlowExecutorView(APIView): current_stage=self.current_stage, flow_slug=self.flow.slug, ) - stage_cls = self.current_stage.type + try: + stage_cls = self.current_stage.type + except NotImplementedError as exc: + self._logger.debug("Error getting stage type", exc=exc) + return self.stage_invalid() self.current_stage_view = stage_cls(self) self.current_stage_view.args = self.args self.current_stage_view.kwargs = self.kwargs From b20a8b7c1796a42f9afff42dbc34ce55d880da35 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 22:59:16 +0200 Subject: [PATCH 07/77] stages/authenticator_duo: fix error when enrolling an existing user Signed-off-by: Jens Langhammer --- authentik/flows/stage.py | 16 ---------------- authentik/flows/views.py | 10 +++++++++- authentik/stages/authenticator_duo/stage.py | 12 +++++++++++- 3 files changed, 20 insertions(+), 18 deletions(-) diff --git a/authentik/flows/stage.py b/authentik/flows/stage.py index 3c32472c3..8502a42c6 100644 --- a/authentik/flows/stage.py +++ b/authentik/flows/stage.py @@ -18,27 +18,11 @@ from authentik.flows.challenge import ( ) from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER from authentik.flows.views import FlowExecutorView -from authentik.lib.sentry import SentryIgnoredException PLAN_CONTEXT_PENDING_USER_IDENTIFIER = "pending_user_identifier" LOGGER = get_logger() -class InvalidChallengeError(SentryIgnoredException): - """Error raised when a challenge from a stage is not valid""" - - def __init__(self, errors, stage_view: View, challenge: Challenge) -> None: - super().__init__() - self.errors = errors - self.stage_view = stage_view - self.challenge = challenge - - def __str__(self) -> str: - return ( - f"Invalid challenge from {self.stage_view}: {self.errors}\n{self.challenge}" - ) - - class StageView(View): """Abstract Stage, inherits TemplateView but can be combined with FormView""" diff --git a/authentik/flows/views.py b/authentik/flows/views.py index c02396012..2cfcfc06b 100644 --- a/authentik/flows/views.py +++ b/authentik/flows/views.py @@ -44,6 +44,7 @@ from authentik.flows.planner import ( FlowPlan, FlowPlanner, ) +from authentik.lib.sentry import SentryIgnoredException from authentik.lib.utils.reflection import all_subclasses, class_to_path from authentik.lib.utils.urls import is_url_absolute, redirect_with_qs from authentik.tenants.models import Tenant @@ -93,6 +94,10 @@ def challenge_response_types(): return Inner() +class InvalidStageError(SentryIgnoredException): + """Error raised when a challenge from a stage is not valid""" + + @method_decorator(xframe_options_sameorigin, name="dispatch") class FlowExecutorView(APIView): """Stage 1 Flow executor, passing requests to Stage Views""" @@ -173,7 +178,10 @@ class FlowExecutorView(APIView): self.current_stage_view.args = self.args self.current_stage_view.kwargs = self.kwargs self.current_stage_view.request = request - return super().dispatch(request) + try: + return super().dispatch(request) + except InvalidStageError as exc: + return self.stage_invalid(str(exc)) @extend_schema( responses={ diff --git a/authentik/stages/authenticator_duo/stage.py b/authentik/stages/authenticator_duo/stage.py index 999f5d82c..6007ad9c2 100644 --- a/authentik/stages/authenticator_duo/stage.py +++ b/authentik/stages/authenticator_duo/stage.py @@ -3,6 +3,7 @@ from django.http import HttpRequest, HttpResponse from rest_framework.fields import CharField from structlog.stdlib import get_logger +from authentik.events.models import Event, EventAction from authentik.flows.challenge import ( Challenge, ChallengeResponse, @@ -11,6 +12,7 @@ from authentik.flows.challenge import ( ) from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER from authentik.flows.stage import ChallengeStageView +from authentik.flows.views import InvalidStageError from authentik.stages.authenticator_duo.models import AuthenticatorDuoStage, DuoDevice LOGGER = get_logger() @@ -42,7 +44,15 @@ class AuthenticatorDuoStageView(ChallengeStageView): def get_challenge(self, *args, **kwargs) -> Challenge: user = self.get_pending_user() stage: AuthenticatorDuoStage = self.executor.current_stage - enroll = stage.client.enroll(user.username) + try: + enroll = stage.client.enroll(user.username) + except RuntimeError as exc: + Event.new( + EventAction.CONFIGURATION_ERROR, + message=f"Failed to enroll user: {str(exc)}", + user=user, + ).from_http(self.request).set_user(user).save() + raise InvalidStageError(str(exc)) from exc user_id = enroll["user_id"] self.request.session[SESSION_KEY_DUO_USER_ID] = user_id self.request.session[SESSION_KEY_DUO_ACTIVATION_CODE] = enroll[ From e743f13f8183c67b84fe83602abd39ef9c45833d Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 23:04:35 +0200 Subject: [PATCH 08/77] recovery: fix error when creating multiple keys for the same user Signed-off-by: Jens Langhammer --- authentik/recovery/management/commands/create_recovery_key.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authentik/recovery/management/commands/create_recovery_key.py b/authentik/recovery/management/commands/create_recovery_key.py index 0ce420880..aa502d6bd 100644 --- a/authentik/recovery/management/commands/create_recovery_key.py +++ b/authentik/recovery/management/commands/create_recovery_key.py @@ -44,7 +44,7 @@ class Command(BaseCommand): user=user, intent=TokenIntents.INTENT_RECOVERY, description=f"Recovery Token generated by {getuser()} on {_now}", - identifier=f"ak-recovery-{user}", + identifier=f"ak-recovery-{user}-{_now}", ) self.stdout.write( ( From 8962081d929b7db28499304126883b8a77a70a87 Mon Sep 17 00:00:00 2001 From: Ernie Date: Wed, 16 Jun 2021 17:08:58 -0400 Subject: [PATCH 09/77] website/docs: add wekan (#1032) * Create index.mdx Add Wekan example * updated to include wekan entry --- .../integrations/services/wekan/index.mdx | 80 +++++++++++++++++++ website/sidebars.js | 1 + 2 files changed, 81 insertions(+) create mode 100644 website/docs/integrations/services/wekan/index.mdx diff --git a/website/docs/integrations/services/wekan/index.mdx b/website/docs/integrations/services/wekan/index.mdx new file mode 100644 index 000000000..714e2d4b5 --- /dev/null +++ b/website/docs/integrations/services/wekan/index.mdx @@ -0,0 +1,80 @@ +--- +title: Wekan +--- + +## What is Wekan + +From https://github.com/wekan/wekan/wiki + +:::note +Wekan is an open-source kanban board which allows a card-based task and to-do management. +::: + +## Preparation + +The following placeholders will be used: + +- `wekan.company` is the FQDN of the wekan install. +- `authentik.company` is the FQDN of the authentik install. + +Create an application in authentik. Create an OAuth2/OpenID provider with the following parameters: + +- Client Type: `Confidential` +- JWT Algorithm: `RS256` +- Scopes: OpenID, Email and Profile +- RSA Key: Select any available key +- Redirect URIs: `https://wekan.company/_oauth/oidc` + +Note the Client ID and Client Secret values. Create an application, using the provider you've created above. Note the slug of the application you've created. + +## Wekan + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + + + +If your Wekan is running in docker, add the following environment variables for Authentik + +```yaml +environment: + OAUTH2_ENABLED=true + OAUTH2_LOGIN_STYLE=redirect + OAUTH2_CLIENT_ID= + OAUTH2_SERVER_URL=https://authentik.company + OAUTH2_AUTH_ENDPOINT=/application/o/authorize/ + OAUTH2_USERINFO_ENDPOINT=/application/o/userinfo/ + OAUTH2_TOKEN_ENDPOINT=/application/o/token/ + OAUTH2_SECRET= + OAUTH2_ID_MAP=preferred_username + OAUTH2_USERNAME_MAP=preferred_username + OAUTH2_FULLNAME_MAP=given_name + OAUTH2_EMAIL_MAP=email +``` + + + +edit `.env` and add the following: + +```ini + # Authentik OAUTH Config + OAUTH2_ENABLED='true' + OAUTH2_LOGIN_STYLE='redirect' + OAUTH2_CLIENT_ID='' + OAUTH2_SERVER_URL='https://authentik.company' + OAUTH2_AUTH_ENDPOINT='/application/o/authorize/' + OAUTH2_USERINFO_ENDPOINT='/application/o/userinfo/' + OAUTH2_TOKEN_ENDPOINT='/application/o/token/' + OAUTH2_SECRET='' + OAUTH2_ID_MAP='preferred_username' + OAUTH2_USERNAME_MAP='preferred_username' + OAUTH2_FULLNAME_MAP='given_name' + OAUTH2_EMAIL_MAP='email' +``` + + diff --git a/website/sidebars.js b/website/sidebars.js index 6b415fd74..9fb7a23a1 100644 --- a/website/sidebars.js +++ b/website/sidebars.js @@ -89,6 +89,7 @@ module.exports = { "integrations/services/ubuntu-landscape/index", "integrations/services/veeam-enterprise-manager/index", "integrations/services/vmware-vcenter/index", + "integrations/services/wekan/index", "integrations/services/wiki-js/index", "integrations/services/zabbix/index", ], From cbea51ae5b175d29e0be03e39b0e42523c7b6fa6 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 16 Jun 2021 23:17:26 +0200 Subject: [PATCH 10/77] stages/authenticator_duo: make Duo-admin viewset writeable Signed-off-by: Jens Langhammer --- authentik/stages/authenticator_duo/api.py | 4 +- schema.yml | 130 +++++++++++++++++++++- 2 files changed, 131 insertions(+), 3 deletions(-) diff --git a/authentik/stages/authenticator_duo/api.py b/authentik/stages/authenticator_duo/api.py index 4e02f5966..b44670a8b 100644 --- a/authentik/stages/authenticator_duo/api.py +++ b/authentik/stages/authenticator_duo/api.py @@ -9,7 +9,7 @@ from rest_framework.permissions import IsAdminUser from rest_framework.request import Request from rest_framework.response import Response from rest_framework.serializers import ModelSerializer -from rest_framework.viewsets import GenericViewSet, ModelViewSet, ReadOnlyModelViewSet +from rest_framework.viewsets import GenericViewSet, ModelViewSet from authentik.api.authorization import OwnerFilter, OwnerPermissions from authentik.core.api.used_by import UsedByMixin @@ -94,7 +94,7 @@ class DuoDeviceViewSet( filter_backends = [OwnerFilter, DjangoFilterBackend, OrderingFilter, SearchFilter] -class DuoAdminDeviceViewSet(ReadOnlyModelViewSet): +class DuoAdminDeviceViewSet(ModelViewSet): """Viewset for Duo authenticator devices (for admins)""" permission_classes = [IsAdminUser] diff --git a/schema.yml b/schema.yml index e44f9233d..bc212a950 100644 --- a/schema.yml +++ b/schema.yml @@ -1,7 +1,7 @@ openapi: 3.0.3 info: title: authentik - version: 2021.6.1-rc5 + version: 2021.6.1-rc6 description: Making authentication simple. contact: email: hello@beryju.org @@ -236,6 +236,37 @@ paths: $ref: '#/components/schemas/ValidationError' '403': $ref: '#/components/schemas/GenericError' + post: + operationId: authenticators_admin_duo_create + description: Viewset for Duo authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + application/x-www-form-urlencoded: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + multipart/form-data: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + required: true + security: + - authentik: [] + - cookieAuth: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/schemas/ValidationError' + '403': + $ref: '#/components/schemas/GenericError' /api/v2beta/authenticators/admin/duo/{id}/: get: operationId: authenticators_admin_duo_retrieve @@ -263,6 +294,103 @@ paths: $ref: '#/components/schemas/ValidationError' '403': $ref: '#/components/schemas/GenericError' + put: + operationId: authenticators_admin_duo_update + description: Viewset for Duo authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + application/x-www-form-urlencoded: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + multipart/form-data: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + required: true + security: + - authentik: [] + - cookieAuth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/schemas/ValidationError' + '403': + $ref: '#/components/schemas/GenericError' + patch: + operationId: authenticators_admin_duo_partial_update + description: Viewset for Duo authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDuoDeviceRequest' + application/x-www-form-urlencoded: + schema: + $ref: '#/components/schemas/PatchedDuoDeviceRequest' + multipart/form-data: + schema: + $ref: '#/components/schemas/PatchedDuoDeviceRequest' + security: + - authentik: [] + - cookieAuth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/schemas/ValidationError' + '403': + $ref: '#/components/schemas/GenericError' + delete: + operationId: authenticators_admin_duo_destroy + description: Viewset for Duo authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + security: + - authentik: [] + - cookieAuth: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/schemas/ValidationError' + '403': + $ref: '#/components/schemas/GenericError' /api/v2beta/authenticators/admin/static/: get: operationId: authenticators_admin_static_list From 57c49c3865cda317fb6e8a4765ac27fa5a27cf18 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Jun 2021 08:50:43 +0200 Subject: [PATCH 11/77] build(deps): bump psycopg2-binary from 2.8.6 to 2.9.1 (#1038) --- Pipfile.lock | 74 ++++++++++++++++++++++++---------------------------- 1 file changed, 34 insertions(+), 40 deletions(-) diff --git a/Pipfile.lock b/Pipfile.lock index ae276bd31..1850fafef 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -130,11 +130,11 @@ }, "botocore": { "hashes": [ - "sha256:240a9ef007292e986a4e11662f9038435d9d4fd242e083db160c86eb5c24af30", - "sha256:dc215f59735a3abde6c66a61f43f10d95bc18754d310da4e2037b3b8c4d8aa2d" + "sha256:204f7403bfe1ab837784421ddd069fd880be99d946cb59cbf31c72296ea9507a", + "sha256:b18d2d016b371b769a88cb080088ce75582748b4a7efa5748e9ced4f23bdbc99" ], "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", - "version": "==1.20.95" + "version": "==1.20.96" }, "cachetools": { "hashes": [ @@ -794,44 +794,38 @@ }, "psycopg2-binary": { "hashes": [ - "sha256:0deac2af1a587ae12836aa07970f5cb91964f05a7c6cdb69d8425ff4c15d4e2c", - "sha256:0e4dc3d5996760104746e6cfcdb519d9d2cd27c738296525d5867ea695774e67", - "sha256:11b9c0ebce097180129e422379b824ae21c8f2a6596b159c7659e2e5a00e1aa0", - "sha256:15978a1fbd225583dd8cdaf37e67ccc278b5abecb4caf6b2d6b8e2b948e953f6", - "sha256:1fabed9ea2acc4efe4671b92c669a213db744d2af8a9fc5d69a8e9bc14b7a9db", - "sha256:2dac98e85565d5688e8ab7bdea5446674a83a3945a8f416ad0110018d1501b94", - "sha256:42ec1035841b389e8cc3692277a0bd81cdfe0b65d575a2c8862cec7a80e62e52", - "sha256:6422f2ff0919fd720195f64ffd8f924c1395d30f9a495f31e2392c2efafb5056", - "sha256:6a32f3a4cb2f6e1a0b15215f448e8ce2da192fd4ff35084d80d5e39da683e79b", - "sha256:7312e931b90fe14f925729cde58022f5d034241918a5c4f9797cac62f6b3a9dd", - "sha256:7d92a09b788cbb1aec325af5fcba9fed7203897bbd9269d5691bb1e3bce29550", - "sha256:833709a5c66ca52f1d21d41865a637223b368c0ee76ea54ca5bad6f2526c7679", - "sha256:89705f45ce07b2dfa806ee84439ec67c5d9a0ef20154e0e475e2b2ed392a5b83", - "sha256:8cd0fb36c7412996859cb4606a35969dd01f4ea34d9812a141cd920c3b18be77", - "sha256:950bc22bb56ee6ff142a2cb9ee980b571dd0912b0334aa3fe0fe3788d860bea2", - "sha256:a0c50db33c32594305b0ef9abc0cb7db13de7621d2cadf8392a1d9b3c437ef77", - "sha256:a0eb43a07386c3f1f1ebb4dc7aafb13f67188eab896e7397aa1ee95a9c884eb2", - "sha256:aaa4213c862f0ef00022751161df35804127b78adf4a2755b9f991a507e425fd", - "sha256:ac0c682111fbf404525dfc0f18a8b5f11be52657d4f96e9fcb75daf4f3984859", - "sha256:ad20d2eb875aaa1ea6d0f2916949f5c08a19c74d05b16ce6ebf6d24f2c9f75d1", - "sha256:b4afc542c0ac0db720cf516dd20c0846f71c248d2b3d21013aa0d4ef9c71ca25", - "sha256:b8a3715b3c4e604bcc94c90a825cd7f5635417453b253499664f784fc4da0152", - "sha256:ba28584e6bca48c59eecbf7efb1576ca214b47f05194646b081717fa628dfddf", - "sha256:ba381aec3a5dc29634f20692349d73f2d21f17653bda1decf0b52b11d694541f", - "sha256:bd1be66dde2b82f80afb9459fc618216753f67109b859a361cf7def5c7968729", - "sha256:c2507d796fca339c8fb03216364cca68d87e037c1f774977c8fc377627d01c71", - "sha256:cec7e622ebc545dbb4564e483dd20e4e404da17ae07e06f3e780b2dacd5cee66", - "sha256:d14b140a4439d816e3b1229a4a525df917d6ea22a0771a2a78332273fd9528a4", - "sha256:d1b4ab59e02d9008efe10ceabd0b31e79519da6fb67f7d8e8977118832d0f449", - "sha256:d5227b229005a696cc67676e24c214740efd90b148de5733419ac9aaba3773da", - "sha256:e1f57aa70d3f7cc6947fd88636a481638263ba04a742b4a37dd25c373e41491a", - "sha256:e74a55f6bad0e7d3968399deb50f61f4db1926acf4a6d83beaaa7df986f48b1c", - "sha256:e82aba2188b9ba309fd8e271702bd0d0fc9148ae3150532bbb474f4590039ffb", - "sha256:ee69dad2c7155756ad114c02db06002f4cded41132cc51378e57aad79cc8e4f4", - "sha256:f5ab93a2cb2d8338b1674be43b442a7f544a0971da062a5da774ed40587f18f5" + "sha256:0b7dae87f0b729922e06f85f667de7bf16455d411971b2043bbd9577af9d1975", + "sha256:0f2e04bd2a2ab54fa44ee67fe2d002bb90cee1c0f1cc0ebc3148af7b02034cbd", + "sha256:123c3fb684e9abfc47218d3784c7b4c47c8587951ea4dd5bc38b6636ac57f616", + "sha256:1473c0215b0613dd938db54a653f68251a45a78b05f6fc21af4326f40e8360a2", + "sha256:14db1752acdd2187d99cb2ca0a1a6dfe57fc65c3281e0f20e597aac8d2a5bd90", + "sha256:1e3a362790edc0a365385b1ac4cc0acc429a0c0d662d829a50b6ce743ae61b5a", + "sha256:1e85b74cbbb3056e3656f1cc4781294df03383127a8114cbc6531e8b8367bf1e", + "sha256:20f1ab44d8c352074e2d7ca67dc00843067788791be373e67a0911998787ce7d", + "sha256:2f62c207d1740b0bde5c4e949f857b044818f734a3d57f1d0d0edc65050532ed", + "sha256:3242b9619de955ab44581a03a64bdd7d5e470cc4183e8fcadd85ab9d3756ce7a", + "sha256:35c4310f8febe41f442d3c65066ca93cccefd75013df3d8c736c5b93ec288140", + "sha256:4235f9d5ddcab0b8dbd723dca56ea2922b485ea00e1dafacf33b0c7e840b3d32", + "sha256:5ced67f1e34e1a450cdb48eb53ca73b60aa0af21c46b9b35ac3e581cf9f00e31", + "sha256:7360647ea04db2e7dff1648d1da825c8cf68dc5fbd80b8fb5b3ee9f068dcd21a", + "sha256:8c13d72ed6af7fd2c8acbd95661cf9477f94e381fce0792c04981a8283b52917", + "sha256:988b47ac70d204aed01589ed342303da7c4d84b56c2f4c4b8b00deda123372bf", + "sha256:995fc41ebda5a7a663a254a1dcac52638c3e847f48307b5416ee373da15075d7", + "sha256:a36c7eb6152ba5467fb264d73844877be8b0847874d4822b7cf2d3c0cb8cdcb0", + "sha256:aed4a9a7e3221b3e252c39d0bf794c438dc5453bc2963e8befe9d4cd324dff72", + "sha256:aef9aee84ec78af51107181d02fe8773b100b01c5dfde351184ad9223eab3698", + "sha256:b0221ca5a9837e040ebf61f48899926b5783668b7807419e4adae8175a31f773", + "sha256:b4d7679a08fea64573c969f6994a2631908bb2c0e69a7235648642f3d2e39a68", + "sha256:c250a7ec489b652c892e4f0a5d122cc14c3780f9f643e1a326754aedf82d9a76", + "sha256:ca86db5b561b894f9e5f115d6a159fff2a2570a652e07889d8a383b5fae66eb4", + "sha256:cfc523edecddaef56f6740d7de1ce24a2fdf94fd5e704091856a201872e37f9f", + "sha256:da113b70f6ec40e7d81b43d1b139b9db6a05727ab8be1ee559f3a69854a69d34", + "sha256:f6fac64a38f6768e7bc7b035b9e10d8a538a9fadce06b983fb3e6fa55ac5f5ce", + "sha256:f8559617b1fcf59a9aedba2c9838b5b6aa211ffedecabca412b92a1ff75aac1a", + "sha256:fbb42a541b1093385a2d8c7eec94d26d30437d0e77c1d25dae1dcc46741a385e" ], "index": "pypi", - "version": "==2.8.6" + "version": "==2.9.1" }, "pyasn1": { "hashes": [ @@ -1563,7 +1557,7 @@ "sha256:0a943902919f65c5684ac4e0154b1ad4fac6dcaa5d9f3426b732f1c8b5419be6", "sha256:2bb1680aad211e3c9944dbce1d4ba09a989f04e238296c87fe2139faa26d655d" ], - "markers": "python_version >= '3.6' and python_version < '4'", + "markers": "python_version >= '3.6' and python_version < '4.0'", "version": "==5.8.0" }, "lazy-object-proxy": { From 23a8052cc89b3c8ee006284929aebd843e42313f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Jun 2021 08:50:52 +0200 Subject: [PATCH 12/77] build(deps): bump boto3 from 1.17.95 to 1.17.96 (#1037) --- Pipfile.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Pipfile.lock b/Pipfile.lock index 1850fafef..39d789d61 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -122,11 +122,11 @@ }, "boto3": { "hashes": [ - "sha256:8e5af9c7ea16ce1c35b7c3220d073dea9735bb1790107820d475462500ae1eff", - "sha256:e61607211816c194dbe2701db48dcddc87cf19372e6f57a9ebe4dfe93dfe177c" + "sha256:67a4b0578944f061fbfa05206eb5b10c5250374e9849743413739c539584b60e", + "sha256:c7d6f3f09081440ca80500e679fec19f0b7597648ee380ae940ed29ad5c3768f" ], "index": "pypi", - "version": "==1.17.95" + "version": "==1.17.96" }, "botocore": { "hashes": [ From 73b67cf0f0bb9c05e48881a15aa3090b1b17fb08 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Jun 2021 08:51:00 +0200 Subject: [PATCH 13/77] build(deps): bump typescript from 4.3.2 to 4.3.3 in /web (#1036) --- web/package-lock.json | 14 +++++++------- web/package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index 22e05a570..ed386f151 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -58,7 +58,7 @@ "rollup-plugin-terser": "^7.0.2", "ts-lit-plugin": "^1.2.1", "tslib": "^2.3.0", - "typescript": "^4.3.2", + "typescript": "^4.3.3", "webcomponent-qr-code": "^1.0.5", "yaml": "^1.10.2" } @@ -7605,9 +7605,9 @@ } }, "node_modules/typescript": { - "version": "4.3.2", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.2.tgz", - "integrity": "sha512-zZ4hShnmnoVnAHpVHWpTcxdv7dWP60S2FsydQLV8V5PbS3FifjWFFRiHSWpDJahly88PRyV5teTSLoq4eG7mKw==", + "version": "4.3.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.3.tgz", + "integrity": "sha512-rUvLW0WtF7PF2b9yenwWUi9Da9euvDRhmH7BLyBG4DCFfOJ850LGNknmRpp8Z8kXNUPObdZQEfKOiHtXuQHHKA==", "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" @@ -13898,9 +13898,9 @@ } }, "typescript": { - "version": "4.3.2", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.2.tgz", - "integrity": "sha512-zZ4hShnmnoVnAHpVHWpTcxdv7dWP60S2FsydQLV8V5PbS3FifjWFFRiHSWpDJahly88PRyV5teTSLoq4eG7mKw==" + "version": "4.3.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.3.tgz", + "integrity": "sha512-rUvLW0WtF7PF2b9yenwWUi9Da9euvDRhmH7BLyBG4DCFfOJ850LGNknmRpp8Z8kXNUPObdZQEfKOiHtXuQHHKA==" }, "uglify-js": { "version": "3.13.0", diff --git a/web/package.json b/web/package.json index 29ab20e3a..015702ae5 100644 --- a/web/package.json +++ b/web/package.json @@ -87,7 +87,7 @@ "rollup-plugin-terser": "^7.0.2", "ts-lit-plugin": "^1.2.1", "tslib": "^2.3.0", - "typescript": "^4.3.2", + "typescript": "^4.3.3", "webcomponent-qr-code": "^1.0.5", "yaml": "^1.10.2" }, From cba0cf0d7656fde3fe0770c79cf62f24c0bc1a54 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Jun 2021 08:51:11 +0200 Subject: [PATCH 14/77] build(deps): bump @lingui/core from 3.10.3 to 3.10.4 in /web (#1035) --- web/package-lock.json | 14 +++++++------- web/package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index ed386f151..0072453eb 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -16,7 +16,7 @@ "@babel/preset-typescript": "^7.14.5", "@fortawesome/fontawesome-free": "^5.15.3", "@lingui/cli": "^3.10.2", - "@lingui/core": "^3.10.3", + "@lingui/core": "^3.10.4", "@lingui/macro": "^3.10.2", "@patternfly/patternfly": "^4.108.2", "@polymer/iron-form": "^3.0.1", @@ -2047,9 +2047,9 @@ } }, "node_modules/@lingui/core": { - "version": "3.10.3", - "resolved": "https://registry.npmjs.org/@lingui/core/-/core-3.10.3.tgz", - "integrity": "sha512-BiuWi5xPpQa27oIWWnkOYNx4qTMdMeu7vp5y1AGPYQ/4SO0rHfAtOxXtvRU/ktVwht/lIgx5Ygq5J3F+XLvOQA==", + "version": "3.10.4", + "resolved": "https://registry.npmjs.org/@lingui/core/-/core-3.10.4.tgz", + "integrity": "sha512-V9QKQ9PFMTPrGGz2PaeKHZcxFikQZzJbptyQbVFJdXaKhdE2RH6HhdK1PIziDHqp6ZWPthVIfVLURT3ku8eu5w==", "dependencies": { "@babel/runtime": "^7.11.2", "make-plural": "^6.2.2", @@ -9431,9 +9431,9 @@ } }, "@lingui/core": { - "version": "3.10.3", - "resolved": "https://registry.npmjs.org/@lingui/core/-/core-3.10.3.tgz", - "integrity": "sha512-BiuWi5xPpQa27oIWWnkOYNx4qTMdMeu7vp5y1AGPYQ/4SO0rHfAtOxXtvRU/ktVwht/lIgx5Ygq5J3F+XLvOQA==", + "version": "3.10.4", + "resolved": "https://registry.npmjs.org/@lingui/core/-/core-3.10.4.tgz", + "integrity": "sha512-V9QKQ9PFMTPrGGz2PaeKHZcxFikQZzJbptyQbVFJdXaKhdE2RH6HhdK1PIziDHqp6ZWPthVIfVLURT3ku8eu5w==", "requires": { "@babel/runtime": "^7.11.2", "make-plural": "^6.2.2", diff --git a/web/package.json b/web/package.json index 015702ae5..9c6a0fe56 100644 --- a/web/package.json +++ b/web/package.json @@ -45,7 +45,7 @@ "@babel/preset-typescript": "^7.14.5", "@fortawesome/fontawesome-free": "^5.15.3", "@lingui/cli": "^3.10.2", - "@lingui/core": "^3.10.3", + "@lingui/core": "^3.10.4", "@lingui/macro": "^3.10.2", "@patternfly/patternfly": "^4.108.2", "@polymer/iron-form": "^3.0.1", From f3c6b9a4f6bd277cdfd4991be4a00d37063f8afe Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Jun 2021 08:51:22 +0200 Subject: [PATCH 15/77] build(deps): bump postcss from 8.3.4 to 8.3.5 in /website (#1034) --- website/package-lock.json | 14 +++++++------- website/package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/website/package-lock.json b/website/package-lock.json index 120fc79ad..1b62bb300 100644 --- a/website/package-lock.json +++ b/website/package-lock.json @@ -11,7 +11,7 @@ "@docusaurus/preset-classic": "2.0.0-beta.0", "@mdx-js/react": "^1.6.22", "clsx": "^1.1.1", - "postcss": "^8.3.4", + "postcss": "^8.3.5", "rapidoc": "^9.0.0", "react": "^17.0.2", "react-before-after-slider": "^1.0.4", @@ -9636,9 +9636,9 @@ } }, "node_modules/postcss": { - "version": "8.3.4", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.3.4.tgz", - "integrity": "sha512-/tZY0PXExXXnNhKv3TOvZAOUYRyuqcCbBm2c17YMDK0PlVII3K7/LKdt3ScHL+hhouddjUWi+1sKDf9xXW+8YA==", + "version": "8.3.5", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.3.5.tgz", + "integrity": "sha512-NxTuJocUhYGsMiMFHDUkmjSKT3EdH4/WbGF6GCi1NDGk+vbcUTun4fpbOqaPtD8IIsztA2ilZm2DhYCuyN58gA==", "dependencies": { "colorette": "^1.2.2", "nanoid": "^3.1.23", @@ -22424,9 +22424,9 @@ "integrity": "sha1-AerA/jta9xoqbAL+q7jB/vfgDqs=" }, "postcss": { - "version": "8.3.4", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.3.4.tgz", - "integrity": "sha512-/tZY0PXExXXnNhKv3TOvZAOUYRyuqcCbBm2c17YMDK0PlVII3K7/LKdt3ScHL+hhouddjUWi+1sKDf9xXW+8YA==", + "version": "8.3.5", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.3.5.tgz", + "integrity": "sha512-NxTuJocUhYGsMiMFHDUkmjSKT3EdH4/WbGF6GCi1NDGk+vbcUTun4fpbOqaPtD8IIsztA2ilZm2DhYCuyN58gA==", "requires": { "colorette": "^1.2.2", "nanoid": "^3.1.23", diff --git a/website/package.json b/website/package.json index 358cce4d9..19bcd3411 100644 --- a/website/package.json +++ b/website/package.json @@ -14,7 +14,7 @@ "@docusaurus/preset-classic": "2.0.0-beta.0", "@mdx-js/react": "^1.6.22", "clsx": "^1.1.1", - "postcss": "^8.3.4", + "postcss": "^8.3.5", "rapidoc": "^9.0.0", "react": "^17.0.2", "react-before-after-slider": "^1.0.4", From ac880c28d73aa45d7f77e60d4c90c627eed58908 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Jun 2021 08:51:31 +0200 Subject: [PATCH 16/77] build(deps): bump rollup from 2.51.2 to 2.52.0 in /web (#1033) --- web/package-lock.json | 18 +++++++++--------- web/package.json | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index 0072453eb..21be67a59 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -48,7 +48,7 @@ "lit-html": "^1.4.1", "moment": "^2.29.1", "rapidoc": "^9.0.0", - "rollup": "^2.51.2", + "rollup": "^2.52.0", "rollup-plugin-commonjs": "^10.1.0", "rollup-plugin-copy": "^3.4.0", "rollup-plugin-cssimport": "^1.0.2", @@ -6771,9 +6771,9 @@ } }, "node_modules/rollup": { - "version": "2.51.2", - "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.51.2.tgz", - "integrity": "sha512-ReV2eGEadA7hmXSzjxdDKs10neqH2QURf2RxJ6ayAlq93ugy6qIvXMmbc5cWMGCDh1h5T4thuWO1e2VNbMq8FA==", + "version": "2.52.0", + "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.52.0.tgz", + "integrity": "sha512-lSkBDGsVoXjqaBf7dsHwxBJz+p+hJEP72P+LOitA0yVs+Nzxj76FidkZE2thrmhjwGqLYiJo39opi7mAfaQ/Vg==", "bin": { "rollup": "dist/bin/rollup" }, @@ -6781,7 +6781,7 @@ "node": ">=10.0.0" }, "optionalDependencies": { - "fsevents": "~2.3.1" + "fsevents": "~2.3.2" } }, "node_modules/rollup-plugin-commonjs": { @@ -13202,11 +13202,11 @@ } }, "rollup": { - "version": "2.51.2", - "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.51.2.tgz", - "integrity": "sha512-ReV2eGEadA7hmXSzjxdDKs10neqH2QURf2RxJ6ayAlq93ugy6qIvXMmbc5cWMGCDh1h5T4thuWO1e2VNbMq8FA==", + "version": "2.52.0", + "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.52.0.tgz", + "integrity": "sha512-lSkBDGsVoXjqaBf7dsHwxBJz+p+hJEP72P+LOitA0yVs+Nzxj76FidkZE2thrmhjwGqLYiJo39opi7mAfaQ/Vg==", "requires": { - "fsevents": "~2.3.1" + "fsevents": "~2.3.2" } }, "rollup-plugin-commonjs": { diff --git a/web/package.json b/web/package.json index 9c6a0fe56..90d214c64 100644 --- a/web/package.json +++ b/web/package.json @@ -77,7 +77,7 @@ "lit-html": "^1.4.1", "moment": "^2.29.1", "rapidoc": "^9.0.0", - "rollup": "^2.51.2", + "rollup": "^2.52.0", "rollup-plugin-commonjs": "^10.1.0", "rollup-plugin-copy": "^3.4.0", "rollup-plugin-cssimport": "^1.0.2", From 14c70b3e4aec82fee80bf7ce18dd77efcbc6a3ba Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Jun 2021 08:53:11 +0200 Subject: [PATCH 17/77] build(deps): bump rollup from 2.52.0 to 2.52.1 in /web (#1039) --- web/package-lock.json | 14 +++++++------- web/package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index 21be67a59..d6e740e38 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -48,7 +48,7 @@ "lit-html": "^1.4.1", "moment": "^2.29.1", "rapidoc": "^9.0.0", - "rollup": "^2.52.0", + "rollup": "^2.52.1", "rollup-plugin-commonjs": "^10.1.0", "rollup-plugin-copy": "^3.4.0", "rollup-plugin-cssimport": "^1.0.2", @@ -6771,9 +6771,9 @@ } }, "node_modules/rollup": { - "version": "2.52.0", - "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.52.0.tgz", - "integrity": "sha512-lSkBDGsVoXjqaBf7dsHwxBJz+p+hJEP72P+LOitA0yVs+Nzxj76FidkZE2thrmhjwGqLYiJo39opi7mAfaQ/Vg==", + "version": "2.52.1", + "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.52.1.tgz", + "integrity": "sha512-/SPqz8UGnp4P1hq6wc9gdTqA2bXQXGx13TtoL03GBm6qGRI6Hm3p4Io7GeiHNLl0BsQAne1JNYY+q/apcY933w==", "bin": { "rollup": "dist/bin/rollup" }, @@ -13202,9 +13202,9 @@ } }, "rollup": { - "version": "2.52.0", - "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.52.0.tgz", - "integrity": "sha512-lSkBDGsVoXjqaBf7dsHwxBJz+p+hJEP72P+LOitA0yVs+Nzxj76FidkZE2thrmhjwGqLYiJo39opi7mAfaQ/Vg==", + "version": "2.52.1", + "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.52.1.tgz", + "integrity": "sha512-/SPqz8UGnp4P1hq6wc9gdTqA2bXQXGx13TtoL03GBm6qGRI6Hm3p4Io7GeiHNLl0BsQAne1JNYY+q/apcY933w==", "requires": { "fsevents": "~2.3.2" } diff --git a/web/package.json b/web/package.json index 90d214c64..53b7808eb 100644 --- a/web/package.json +++ b/web/package.json @@ -77,7 +77,7 @@ "lit-html": "^1.4.1", "moment": "^2.29.1", "rapidoc": "^9.0.0", - "rollup": "^2.52.0", + "rollup": "^2.52.1", "rollup-plugin-commonjs": "^10.1.0", "rollup-plugin-copy": "^3.4.0", "rollup-plugin-cssimport": "^1.0.2", From fcb795c273826596fb8919824b13936aa2db804b Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Thu, 17 Jun 2021 12:22:40 +0200 Subject: [PATCH 18/77] providers/saml: fix NameIDPolicy not being parsed correctly, improve error handling Signed-off-by: Jens Langhammer --- .../saml/processors/request_parser.py | 2 +- authentik/providers/saml/views/flows.py | 29 ++++++++++++------- authentik/sources/saml/exceptions.py | 12 +++++--- authentik/stages/authenticator_duo/stage.py | 2 +- 4 files changed, 29 insertions(+), 16 deletions(-) diff --git a/authentik/providers/saml/processors/request_parser.py b/authentik/providers/saml/processors/request_parser.py index f1d9393b3..7cc18e572 100644 --- a/authentik/providers/saml/processors/request_parser.py +++ b/authentik/providers/saml/processors/request_parser.py @@ -69,7 +69,7 @@ class AuthNRequestParser: auth_n_request = AuthNRequest(id=root.attrib["ID"], relay_state=relay_state) # Check if AuthnRequest has a NameID Policy object - name_id_policies = root.findall(f"{{{NS_SAML_PROTOCOL}}}:NameIDPolicy") + name_id_policies = root.findall(f"{{{NS_SAML_PROTOCOL}}}NameIDPolicy") if len(name_id_policies) > 0: name_id_policy = name_id_policies[0] auth_n_request.name_id_policy = name_id_policy.attrib["Format"] diff --git a/authentik/providers/saml/views/flows.py b/authentik/providers/saml/views/flows.py index 803ff6d19..f7f4c13de 100644 --- a/authentik/providers/saml/views/flows.py +++ b/authentik/providers/saml/views/flows.py @@ -17,6 +17,7 @@ from authentik.providers.saml.models import SAMLBindings, SAMLProvider from authentik.providers.saml.processors.assertion import AssertionProcessor from authentik.providers.saml.processors.request_parser import AuthNRequest from authentik.providers.saml.utils.encoding import deflate_and_base64_encode, nice64 +from authentik.sources.saml.exceptions import SAMLException LOGGER = get_logger() URL_VALIDATOR = URLValidator(schemes=("http", "https")) @@ -56,22 +57,30 @@ class SAMLFlowFinalView(ChallengeStageView): provider: SAMLProvider = get_object_or_404( SAMLProvider, pk=application.provider_id ) - # Log Application Authorization - Event.new( - EventAction.AUTHORIZE_APPLICATION, - authorized_application=application, - flow=self.executor.plan.flow_pk, - ).from_http(self.request) - if SESSION_KEY_AUTH_N_REQUEST not in self.request.session: return self.executor.stage_invalid() auth_n_request: AuthNRequest = self.request.session.pop( SESSION_KEY_AUTH_N_REQUEST ) - response = AssertionProcessor( - provider, request, auth_n_request - ).build_response() + try: + response = AssertionProcessor( + provider, request, auth_n_request + ).build_response() + except SAMLException as exc: + Event.new( + EventAction.CONFIGURATION_ERROR, + message=f"Failed to process SAML assertion: {str(exc)}", + provider=provider, + ).from_http(self.request) + return self.executor.stage_invalid() + + # Log Application Authorization + Event.new( + EventAction.AUTHORIZE_APPLICATION, + authorized_application=application, + flow=self.executor.plan.flow_pk, + ).from_http(self.request) if provider.sp_binding == SAMLBindings.POST: form_attrs = { diff --git a/authentik/sources/saml/exceptions.py b/authentik/sources/saml/exceptions.py index 09f7afbff..344ee005b 100644 --- a/authentik/sources/saml/exceptions.py +++ b/authentik/sources/saml/exceptions.py @@ -2,17 +2,21 @@ from authentik.lib.sentry import SentryIgnoredException -class MissingSAMLResponse(SentryIgnoredException): +class SAMLException(SentryIgnoredException): + """Base SAML Exception""" + + +class MissingSAMLResponse(SAMLException): """Exception raised when request does not contain SAML Response.""" -class UnsupportedNameIDFormat(SentryIgnoredException): +class UnsupportedNameIDFormat(SAMLException): """Exception raised when SAML Response contains NameID Format not supported.""" -class MismatchedRequestID(SentryIgnoredException): +class MismatchedRequestID(SAMLException): """Exception raised when the returned request ID doesn't match the saved ID.""" -class InvalidSignature(SentryIgnoredException): +class InvalidSignature(SAMLException): """Signature of XML Object is either missing or invalid""" diff --git a/authentik/stages/authenticator_duo/stage.py b/authentik/stages/authenticator_duo/stage.py index 6007ad9c2..abca61479 100644 --- a/authentik/stages/authenticator_duo/stage.py +++ b/authentik/stages/authenticator_duo/stage.py @@ -51,7 +51,7 @@ class AuthenticatorDuoStageView(ChallengeStageView): EventAction.CONFIGURATION_ERROR, message=f"Failed to enroll user: {str(exc)}", user=user, - ).from_http(self.request).set_user(user).save() + ).from_http(self.request, user) raise InvalidStageError(str(exc)) from exc user_id = enroll["user_id"] self.request.session[SESSION_KEY_DUO_USER_ID] = user_id From 4ca564490ebb772bd7111446a78266a57d64dfc0 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Thu, 17 Jun 2021 12:26:01 +0200 Subject: [PATCH 19/77] providers/saml: add support for NameID type unspecified Signed-off-by: Jens Langhammer --- authentik/providers/saml/processors/assertion.py | 6 +++++- authentik/providers/saml/processors/request_parser.py | 8 +++++--- authentik/providers/saml/tests/test_auth_n_request.py | 4 ++-- authentik/sources/saml/processors/constants.py | 3 +++ 4 files changed, 15 insertions(+), 6 deletions(-) diff --git a/authentik/providers/saml/processors/assertion.py b/authentik/providers/saml/processors/assertion.py index ea273ab6b..f441fe657 100644 --- a/authentik/providers/saml/processors/assertion.py +++ b/authentik/providers/saml/processors/assertion.py @@ -24,6 +24,7 @@ from authentik.sources.saml.processors.constants import ( SAML_NAME_ID_FORMAT_EMAIL, SAML_NAME_ID_FORMAT_PERSISTENT, SAML_NAME_ID_FORMAT_TRANSIENT, + SAML_NAME_ID_FORMAT_UNSPECIFIED, SAML_NAME_ID_FORMAT_WINDOWS, SAML_NAME_ID_FORMAT_X509, SIGN_ALGORITHM_TRANSFORM_MAP, @@ -165,7 +166,10 @@ class AssertionProcessor: if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_EMAIL: name_id.text = self.http_request.user.email return name_id - if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_PERSISTENT: + if name_id.attrib["Format"] in [ + SAML_NAME_ID_FORMAT_PERSISTENT, + SAML_NAME_ID_FORMAT_UNSPECIFIED, + ]: name_id.text = persistent return name_id if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_X509: diff --git a/authentik/providers/saml/processors/request_parser.py b/authentik/providers/saml/processors/request_parser.py index 7cc18e572..dec31251a 100644 --- a/authentik/providers/saml/processors/request_parser.py +++ b/authentik/providers/saml/processors/request_parser.py @@ -20,7 +20,7 @@ from authentik.sources.saml.processors.constants import ( RSA_SHA256, RSA_SHA384, RSA_SHA512, - SAML_NAME_ID_FORMAT_EMAIL, + SAML_NAME_ID_FORMAT_UNSPECIFIED, ) LOGGER = get_logger() @@ -42,7 +42,7 @@ class AuthNRequest: relay_state: Optional[str] = None - name_id_policy: str = SAML_NAME_ID_FORMAT_EMAIL + name_id_policy: str = SAML_NAME_ID_FORMAT_UNSPECIFIED class AuthNRequestParser: @@ -72,7 +72,9 @@ class AuthNRequestParser: name_id_policies = root.findall(f"{{{NS_SAML_PROTOCOL}}}NameIDPolicy") if len(name_id_policies) > 0: name_id_policy = name_id_policies[0] - auth_n_request.name_id_policy = name_id_policy.attrib["Format"] + auth_n_request.name_id_policy = name_id_policy.attrib.get( + "Format", SAML_NAME_ID_FORMAT_UNSPECIFIED + ) return auth_n_request diff --git a/authentik/providers/saml/tests/test_auth_n_request.py b/authentik/providers/saml/tests/test_auth_n_request.py index b5527b5d5..ba5915a8e 100644 --- a/authentik/providers/saml/tests/test_auth_n_request.py +++ b/authentik/providers/saml/tests/test_auth_n_request.py @@ -14,7 +14,7 @@ from authentik.providers.saml.processors.assertion import AssertionProcessor from authentik.providers.saml.processors.request_parser import AuthNRequestParser from authentik.sources.saml.exceptions import MismatchedRequestID from authentik.sources.saml.models import SAMLSource -from authentik.sources.saml.processors.constants import SAML_NAME_ID_FORMAT_EMAIL +from authentik.sources.saml.processors.constants import SAML_NAME_ID_FORMAT_UNSPECIFIED from authentik.sources.saml.processors.request import ( SESSION_REQUEST_ID, RequestProcessor, @@ -206,5 +206,5 @@ class TestAuthNRequest(TestCase): REDIRECT_REQUEST, REDIRECT_RELAY_STATE, REDIRECT_SIGNATURE, REDIRECT_SIG_ALG ) self.assertEqual(parsed_request.id, "_dcf55fcd27a887e60a7ef9ee6fd3adab") - self.assertEqual(parsed_request.name_id_policy, SAML_NAME_ID_FORMAT_EMAIL) + self.assertEqual(parsed_request.name_id_policy, SAML_NAME_ID_FORMAT_UNSPECIFIED) self.assertEqual(parsed_request.relay_state, REDIRECT_RELAY_STATE) diff --git a/authentik/sources/saml/processors/constants.py b/authentik/sources/saml/processors/constants.py index b688ddac6..967a365cb 100644 --- a/authentik/sources/saml/processors/constants.py +++ b/authentik/sources/saml/processors/constants.py @@ -15,6 +15,9 @@ NS_MAP = { SAML_NAME_ID_FORMAT_EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" SAML_NAME_ID_FORMAT_PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" +SAML_NAME_ID_FORMAT_UNSPECIFIED = ( + "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" +) SAML_NAME_ID_FORMAT_X509 = "urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName" SAML_NAME_ID_FORMAT_WINDOWS = ( "urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName" From 19cac4bf43b50fae9c3427003b3da0f1d7ce2cd9 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Thu, 17 Jun 2021 13:52:10 +0200 Subject: [PATCH 20/77] providers/saml: fix error when getting transient user identifier Signed-off-by: Jens Langhammer --- authentik/providers/saml/processors/assertion.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authentik/providers/saml/processors/assertion.py b/authentik/providers/saml/processors/assertion.py index f441fe657..20e14e1bf 100644 --- a/authentik/providers/saml/processors/assertion.py +++ b/authentik/providers/saml/processors/assertion.py @@ -184,7 +184,7 @@ class AssertionProcessor: return name_id if name_id.attrib["Format"] == SAML_NAME_ID_FORMAT_TRANSIENT: # Use the hash of the user's session, which changes every session - session_key: str = self.http_request.user.session.session_key + session_key: str = self.http_request.session.session_key name_id.text = sha256(session_key.encode()).hexdigest() return name_id raise UnsupportedNameIDFormat( From fe6963c42823b9e1178ae3db99c88df3c466c061 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Thu, 17 Jun 2021 22:14:52 +0200 Subject: [PATCH 21/77] release: 2021.6.1 --- .bumpversion.cfg | 2 +- .github/workflows/release.yml | 20 +++++++++---------- authentik/__init__.py | 2 +- docker-compose.yml | 4 ++-- internal/constants/constants.go | 2 +- outpost/pkg/version.go | 2 +- web/src/constants.ts | 2 +- website/docs/installation/docker-compose.md | 4 ++-- .../outposts/manual-deploy-docker-compose.md | 4 ++-- .../docs/outposts/manual-deploy-kubernetes.md | 14 ++++++------- 10 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.bumpversion.cfg b/.bumpversion.cfg index dcc09ed28..dc7733656 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 2021.6.1-rc6 +current_version = 2021.6.1 tag = True commit = True parse = (?P\d+)\.(?P\d+)\.(?P\d+)\-?(?P.*) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 988aa397a..84f67e36b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,15 +33,15 @@ jobs: with: push: ${{ github.event_name == 'release' }} tags: | - beryju/authentik:2021.6.1-rc6, + beryju/authentik:2021.6.1, beryju/authentik:latest, - ghcr.io/goauthentik/server:2021.6.1-rc6, + ghcr.io/goauthentik/server:2021.6.1, ghcr.io/goauthentik/server:latest platforms: linux/amd64,linux/arm64 context: . - name: Building Docker Image (stable) uses: docker/build-push-action@v2 - if: ${{ github.event_name == 'release' && !contains('2021.6.1-rc6', 'rc') }} + if: ${{ github.event_name == 'release' && !contains('2021.6.1', 'rc') }} with: push: true tags: | @@ -76,15 +76,15 @@ jobs: with: push: ${{ github.event_name == 'release' }} tags: | - beryju/authentik-proxy:2021.6.1-rc6, + beryju/authentik-proxy:2021.6.1, beryju/authentik-proxy:latest, - ghcr.io/goauthentik/proxy:2021.6.1-rc6, + ghcr.io/goauthentik/proxy:2021.6.1, ghcr.io/goauthentik/proxy:latest file: outpost/proxy.Dockerfile platforms: linux/amd64,linux/arm64 - name: Building Docker Image (stable) uses: docker/build-push-action@v2 - if: ${{ github.event_name == 'release' && !contains('2021.6.1-rc6', 'rc') }} + if: ${{ github.event_name == 'release' && !contains('2021.6.1', 'rc') }} with: push: true tags: | @@ -119,15 +119,15 @@ jobs: with: push: ${{ github.event_name == 'release' }} tags: | - beryju/authentik-ldap:2021.6.1-rc6, + beryju/authentik-ldap:2021.6.1, beryju/authentik-ldap:latest, - ghcr.io/goauthentik/ldap:2021.6.1-rc6, + ghcr.io/goauthentik/ldap:2021.6.1, ghcr.io/goauthentik/ldap:latest file: outpost/ldap.Dockerfile platforms: linux/amd64,linux/arm64 - name: Building Docker Image (stable) uses: docker/build-push-action@v2 - if: ${{ github.event_name == 'release' && !contains('2021.6.1-rc6', 'rc') }} + if: ${{ github.event_name == 'release' && !contains('2021.6.1', 'rc') }} with: push: true tags: | @@ -168,5 +168,5 @@ jobs: SENTRY_PROJECT: authentik SENTRY_URL: https://sentry.beryju.org with: - version: authentik@2021.6.1-rc6 + version: authentik@2021.6.1 environment: beryjuorg-prod diff --git a/authentik/__init__.py b/authentik/__init__.py index 18b50e8bb..a1441c72f 100644 --- a/authentik/__init__.py +++ b/authentik/__init__.py @@ -1,3 +1,3 @@ """authentik""" -__version__ = "2021.6.1-rc6" +__version__ = "2021.6.1" ENV_GIT_HASH_KEY = "GIT_BUILD_HASH" diff --git a/docker-compose.yml b/docker-compose.yml index a005cfe5a..04292c919 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -21,7 +21,7 @@ services: networks: - internal server: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.6.1-rc6} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.6.1} restart: unless-stopped command: server environment: @@ -52,7 +52,7 @@ services: - "0.0.0.0:9000:9000" - "0.0.0.0:9443:9443" worker: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.6.1-rc6} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2021.6.1} restart: unless-stopped command: worker networks: diff --git a/internal/constants/constants.go b/internal/constants/constants.go index 493c21ea2..9707afadd 100644 --- a/internal/constants/constants.go +++ b/internal/constants/constants.go @@ -1,3 +1,3 @@ package constants -const VERSION = "2021.6.1-rc6" +const VERSION = "2021.6.1" diff --git a/outpost/pkg/version.go b/outpost/pkg/version.go index d3f886517..7c32c942b 100644 --- a/outpost/pkg/version.go +++ b/outpost/pkg/version.go @@ -5,7 +5,7 @@ import ( "os" ) -const VERSION = "2021.6.1-rc6" +const VERSION = "2021.6.1" func BUILD() string { build := os.Getenv("GIT_BUILD_HASH") diff --git a/web/src/constants.ts b/web/src/constants.ts index cb7a06fd5..b1af40459 100644 --- a/web/src/constants.ts +++ b/web/src/constants.ts @@ -3,7 +3,7 @@ export const SUCCESS_CLASS = "pf-m-success"; export const ERROR_CLASS = "pf-m-danger"; export const PROGRESS_CLASS = "pf-m-in-progress"; export const CURRENT_CLASS = "pf-m-current"; -export const VERSION = "2021.6.1-rc6"; +export const VERSION = "2021.6.1"; export const PAGE_SIZE = 20; export const EVENT_REFRESH = "ak-refresh"; export const EVENT_NOTIFICATION_TOGGLE = "ak-notification-toggle"; diff --git a/website/docs/installation/docker-compose.md b/website/docs/installation/docker-compose.md index 3476adad3..0421768f7 100644 --- a/website/docs/installation/docker-compose.md +++ b/website/docs/installation/docker-compose.md @@ -12,11 +12,11 @@ This installation method is for test-setups and small-scale productive setups. ## Preparation -Download the latest `docker-compose.yml` from [here](https://raw.githubusercontent.com/goauthentik/authentik/version/2021.6.1-rc6/docker-compose.yml). Place it in a directory of your choice. +Download the latest `docker-compose.yml` from [here](https://raw.githubusercontent.com/goauthentik/authentik/version/2021.6.1/docker-compose.yml). Place it in a directory of your choice. To optionally enable error-reporting, run `echo AUTHENTIK_ERROR_REPORTING__ENABLED=true >> .env` -To optionally deploy a different version run `echo AUTHENTIK_TAG=2021.6.1-rc6 >> .env` +To optionally deploy a different version run `echo AUTHENTIK_TAG=2021.6.1 >> .env` If this is a fresh authentik install run the following commands to generate a password: diff --git a/website/docs/outposts/manual-deploy-docker-compose.md b/website/docs/outposts/manual-deploy-docker-compose.md index c70082a65..4bffc4d32 100644 --- a/website/docs/outposts/manual-deploy-docker-compose.md +++ b/website/docs/outposts/manual-deploy-docker-compose.md @@ -11,7 +11,7 @@ version: "3.5" services: authentik_proxy: - image: ghcr.io/goauthentik/proxy:2021.6.1-rc6 + image: ghcr.io/goauthentik/proxy:2021.6.1 ports: - 4180:4180 - 4443:4443 @@ -21,7 +21,7 @@ services: AUTHENTIK_TOKEN: token-generated-by-authentik # Or, for the LDAP Outpost authentik_proxy: - image: ghcr.io/goauthentik/ldap:2021.6.1-rc6 + image: ghcr.io/goauthentik/ldap:2021.6.1 ports: - 389:3389 environment: diff --git a/website/docs/outposts/manual-deploy-kubernetes.md b/website/docs/outposts/manual-deploy-kubernetes.md index e36d3c79e..eaf6fcf88 100644 --- a/website/docs/outposts/manual-deploy-kubernetes.md +++ b/website/docs/outposts/manual-deploy-kubernetes.md @@ -14,7 +14,7 @@ metadata: app.kubernetes.io/instance: __OUTPOST_NAME__ app.kubernetes.io/managed-by: goauthentik.io app.kubernetes.io/name: authentik-proxy - app.kubernetes.io/version: 2021.6.1-rc6 + app.kubernetes.io/version: 2021.6.1 name: authentik-outpost-api stringData: authentik_host: "__AUTHENTIK_URL__" @@ -29,7 +29,7 @@ metadata: app.kubernetes.io/instance: __OUTPOST_NAME__ app.kubernetes.io/managed-by: goauthentik.io app.kubernetes.io/name: authentik-proxy - app.kubernetes.io/version: 2021.6.1-rc6 + app.kubernetes.io/version: 2021.6.1 name: authentik-outpost spec: ports: @@ -54,7 +54,7 @@ metadata: app.kubernetes.io/instance: __OUTPOST_NAME__ app.kubernetes.io/managed-by: goauthentik.io app.kubernetes.io/name: authentik-proxy - app.kubernetes.io/version: 2021.6.1-rc6 + app.kubernetes.io/version: 2021.6.1 name: authentik-outpost spec: selector: @@ -62,14 +62,14 @@ spec: app.kubernetes.io/instance: __OUTPOST_NAME__ app.kubernetes.io/managed-by: goauthentik.io app.kubernetes.io/name: authentik-proxy - app.kubernetes.io/version: 2021.6.1-rc6 + app.kubernetes.io/version: 2021.6.1 template: metadata: labels: app.kubernetes.io/instance: __OUTPOST_NAME__ app.kubernetes.io/managed-by: goauthentik.io app.kubernetes.io/name: authentik-proxy - app.kubernetes.io/version: 2021.6.1-rc6 + app.kubernetes.io/version: 2021.6.1 spec: containers: - env: @@ -88,7 +88,7 @@ spec: secretKeyRef: key: authentik_host_insecure name: authentik-outpost-api - image: ghcr.io/goauthentik/proxy:2021.6.1-rc6 + image: ghcr.io/goauthentik/proxy:2021.6.1 name: proxy ports: - containerPort: 4180 @@ -110,7 +110,7 @@ metadata: app.kubernetes.io/instance: __OUTPOST_NAME__ app.kubernetes.io/managed-by: goauthentik.io app.kubernetes.io/name: authentik-proxy - app.kubernetes.io/version: 2021.6.1-rc6 + app.kubernetes.io/version: 2021.6.1 name: authentik-outpost spec: rules: From 35f2c5d96a1ac460fc67979c06b99633923ca210 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Thu, 17 Jun 2021 22:52:39 +0200 Subject: [PATCH 22/77] website/docs: add release notes for 2021.6 Signed-off-by: Jens Langhammer --- website/docs/releases/v2021.6.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/website/docs/releases/v2021.6.md b/website/docs/releases/v2021.6.md index fd118bfcb..2b2ee140d 100644 --- a/website/docs/releases/v2021.6.md +++ b/website/docs/releases/v2021.6.md @@ -80,6 +80,23 @@ slug: "2021.6" - web/flows: improve display of allowed fields for identification stage - website/docs: add docs for outpost configuration +## Fixed in 2021.6.1 + +- core: fix error getting stages when enrollment flow isn't set +- core: fix error when creating AuthenticatedSession without key +- flows: fix error when stage has incorrect type +- providers/saml: add support for NameID type unspecified +- providers/saml: fix error when getting transient user identifier +- providers/saml: fix NameIDPolicy not being parsed correctly +- recovery: fix error when creating multiple keys for the same user +- stages/authenticator_duo: fix error when enrolling an existing user +- stages/authenticator_duo: make Duo-admin viewset writeable +- website/docs: Add a note about Protocol Overwrite (#1031) +- website/docs: add changelog for release candidates +- website/docs: add docs for flow executor +- website/docs: add wekan (#1032) +- website/docs: remove migrate command + ## Upgrading This release does not introduce any new requirements. From 591a339302565e0b86f15fa15efb864915a915a4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 18 Jun 2021 07:23:41 +0200 Subject: [PATCH 23/77] build(deps): bump celery from 5.1.0 to 5.1.1 (#1047) --- Pipfile.lock | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/Pipfile.lock b/Pipfile.lock index 39d789d61..5af8a35d5 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -130,11 +130,11 @@ }, "botocore": { "hashes": [ - "sha256:204f7403bfe1ab837784421ddd069fd880be99d946cb59cbf31c72296ea9507a", - "sha256:b18d2d016b371b769a88cb080088ce75582748b4a7efa5748e9ced4f23bdbc99" + "sha256:000cf4a3670ab47e14ddb5bd68fe050c6136029a478cf0b18a78779897d4175c", + "sha256:f7e119cf3e0f4a36100f0e983583afa91a84fb27c479a1716820aee4f2e190ab" ], "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", - "version": "==1.20.96" + "version": "==1.20.97" }, "cachetools": { "hashes": [ @@ -165,11 +165,11 @@ }, "celery": { "hashes": [ - "sha256:1329de1edeaf734ef859e630cb42df2c116d53e59d2f46433b13aed196e85620", - "sha256:65f061c04578cf189cd7352c192e1a79fdeb370b916bff792bcc769560e81184" + "sha256:54436cd97b031bf2e08064223240e2a83d601d9414bcb1b702f94c6c33c29485", + "sha256:b5399d76cf70d5cfac3ec993f8796ec1aa90d4cef55972295751f384758a80d7" ], "index": "pypi", - "version": "==5.1.0" + "version": "==5.1.1" }, "certifi": { "hashes": [ @@ -786,11 +786,11 @@ }, "prompt-toolkit": { "hashes": [ - "sha256:bf00f22079f5fadc949f42ae8ff7f05702826a97059ffcc6281036ad40ac6f04", - "sha256:e1b4f11b9336a28fa11810bc623c357420f69dfdb6d2dac41ca2c21a55c033bc" + "sha256:08360ee3a3148bdb5163621709ee322ec34fc4375099afa4bbf751e9b7b7fa4f", + "sha256:7089d8d2938043508aa9420ec18ce0922885304cddae87fb96eebca942299f88" ], "markers": "python_full_version >= '3.6.1'", - "version": "==3.0.18" + "version": "==3.0.19" }, "psycopg2-binary": { "hashes": [ @@ -1532,11 +1532,11 @@ }, "gitpython": { "hashes": [ - "sha256:3283ae2fba31c913d857e12e5ba5f9a7772bbc064ae2bb09efafa71b0dd4939b", - "sha256:be27633e7509e58391f10207cd32b2a6cf5b908f92d9cd30da2e514e1137af61" + "sha256:b838a895977b45ab6f0cc926a9045c8d1c44e2b653c1fcc39fe91f42c6e8f05b", + "sha256:fce760879cd2aebd2991b3542876dc5c4a909b30c9d69dfc488e504a8db37ee8" ], - "markers": "python_version >= '3.4'", - "version": "==3.1.14" + "markers": "python_version >= '3.6'", + "version": "==3.1.18" }, "idna": { "hashes": [ From 41f135126b8405e1a1bfdbd7f6ea865496437057 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 18 Jun 2021 07:23:49 +0200 Subject: [PATCH 24/77] build(deps): bump typescript from 4.3.3 to 4.3.4 in /web (#1045) --- web/package-lock.json | 14 +++++++------- web/package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index d6e740e38..123c0371b 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -58,7 +58,7 @@ "rollup-plugin-terser": "^7.0.2", "ts-lit-plugin": "^1.2.1", "tslib": "^2.3.0", - "typescript": "^4.3.3", + "typescript": "^4.3.4", "webcomponent-qr-code": "^1.0.5", "yaml": "^1.10.2" } @@ -7605,9 +7605,9 @@ } }, "node_modules/typescript": { - "version": "4.3.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.3.tgz", - "integrity": "sha512-rUvLW0WtF7PF2b9yenwWUi9Da9euvDRhmH7BLyBG4DCFfOJ850LGNknmRpp8Z8kXNUPObdZQEfKOiHtXuQHHKA==", + "version": "4.3.4", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.4.tgz", + "integrity": "sha512-uauPG7XZn9F/mo+7MrsRjyvbxFpzemRjKEZXS4AK83oP2KKOJPvb+9cO/gmnv8arWZvhnjVOXz7B49m1l0e9Ew==", "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" @@ -13898,9 +13898,9 @@ } }, "typescript": { - "version": "4.3.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.3.tgz", - "integrity": "sha512-rUvLW0WtF7PF2b9yenwWUi9Da9euvDRhmH7BLyBG4DCFfOJ850LGNknmRpp8Z8kXNUPObdZQEfKOiHtXuQHHKA==" + "version": "4.3.4", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.3.4.tgz", + "integrity": "sha512-uauPG7XZn9F/mo+7MrsRjyvbxFpzemRjKEZXS4AK83oP2KKOJPvb+9cO/gmnv8arWZvhnjVOXz7B49m1l0e9Ew==" }, "uglify-js": { "version": "3.13.0", diff --git a/web/package.json b/web/package.json index 53b7808eb..6c31b0c74 100644 --- a/web/package.json +++ b/web/package.json @@ -87,7 +87,7 @@ "rollup-plugin-terser": "^7.0.2", "ts-lit-plugin": "^1.2.1", "tslib": "^2.3.0", - "typescript": "^4.3.3", + "typescript": "^4.3.4", "webcomponent-qr-code": "^1.0.5", "yaml": "^1.10.2" }, From 402819107dcc538a879f32ed4edb6aa526453b42 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 18 Jun 2021 07:24:02 +0200 Subject: [PATCH 25/77] build(deps): bump boto3 from 1.17.96 to 1.17.97 (#1046) --- Pipfile.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Pipfile.lock b/Pipfile.lock index 5af8a35d5..34664222b 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -122,11 +122,11 @@ }, "boto3": { "hashes": [ - "sha256:67a4b0578944f061fbfa05206eb5b10c5250374e9849743413739c539584b60e", - "sha256:c7d6f3f09081440ca80500e679fec19f0b7597648ee380ae940ed29ad5c3768f" + "sha256:0ab5afc51461c30f27aebef944211d16f47697b98ff8d2e2f6e49e59584853bb", + "sha256:77ea9ff6ce1d4a64839c358a713be80256584f478289a13562d1e0c1b9c362cc" ], "index": "pypi", - "version": "==1.17.96" + "version": "==1.17.97" }, "botocore": { "hashes": [ @@ -1557,7 +1557,7 @@ "sha256:0a943902919f65c5684ac4e0154b1ad4fac6dcaa5d9f3426b732f1c8b5419be6", "sha256:2bb1680aad211e3c9944dbce1d4ba09a989f04e238296c87fe2139faa26d655d" ], - "markers": "python_version >= '3.6' and python_version < '4.0'", + "markers": "python_version >= '3.6' and python_version < '4'", "version": "==5.8.0" }, "lazy-object-proxy": { From 932cf48d2b1e874ec9e1f1b2241d5e0d8843fc32 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Fri, 18 Jun 2021 09:10:19 +0200 Subject: [PATCH 26/77] website/docs: remove old branding settings Signed-off-by: Jens Langhammer --- website/docs/installation/configuration.md | 8 -------- 1 file changed, 8 deletions(-) diff --git a/website/docs/installation/configuration.md b/website/docs/installation/configuration.md index f8ec1a80d..cbf5e20b8 100644 --- a/website/docs/installation/configuration.md +++ b/website/docs/installation/configuration.md @@ -105,11 +105,3 @@ Defaults to `info`. - `AUTHENTIK_AUTHENTIK__AVATARS` Controls which avatars are shown. Defaults to `gravatar`. Can be set to `none` to disable avatars. - -- `AUTHENTIK_AUTHENTIK__BRANDING__TITLE` - - Branding title used throughout the UI. Defaults to `authentik`. - -- `AUTHENTIK_AUTHENTIK__BRANDING__LOGO` - - Logo shown in the sidebar and flow executions. Defaults to `/static/dist/assets/icons/icon_left_brand.svg` From 405c6901935fbe1551ce5e16c3d8dfd4c52ccdba Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Fri, 18 Jun 2021 18:42:03 +0200 Subject: [PATCH 27/77] tests/e2e: test additionalHeaders with proxy Signed-off-by: Jens Langhammer --- tests/e2e/test_provider_proxy.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tests/e2e/test_provider_proxy.py b/tests/e2e/test_provider_proxy.py index 467d1349b..c75a43a25 100644 --- a/tests/e2e/test_provider_proxy.py +++ b/tests/e2e/test_provider_proxy.py @@ -21,7 +21,13 @@ from authentik.outposts.models import ( ) from authentik.outposts.tasks import outpost_local_connection from authentik.providers.proxy.models import ProxyProvider -from tests.e2e.utils import SeleniumTestCase, apply_migration, object_manager, retry +from tests.e2e.utils import ( + USER, + SeleniumTestCase, + apply_migration, + object_manager, + retry, +) @skipUnless(platform.startswith("linux"), "requires local docker") @@ -67,6 +73,11 @@ class TestProviderProxy(SeleniumTestCase): @object_manager def test_proxy_simple(self): """Test simple outpost setup with single provider""" + # set additionalHeaders to test later + user = USER() + user.attributes["additionalHeaders"] = {"X-Foo": "bar"} + user.save() + proxy: ProxyProvider = ProxyProvider.objects.create( name="proxy_provider", authorization_flow=Flow.objects.get( @@ -106,6 +117,7 @@ class TestProviderProxy(SeleniumTestCase): full_body_text = self.driver.find_element(By.CSS_SELECTOR, "pre").text self.assertIn("X-Forwarded-Preferred-Username: akadmin", full_body_text) + self.assertIn("X-Foo: bar", full_body_text) @skipUnless(platform.startswith("linux"), "requires local docker") From 641872a33a9692e55f10d6058bfe44db1c2f40b6 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Sat, 19 Jun 2021 12:42:29 +0200 Subject: [PATCH 28/77] web/admin: fix tenant's default flag not being saved Signed-off-by: Jens Langhammer #1044 --- web/src/pages/tenants/TenantForm.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/src/pages/tenants/TenantForm.ts b/web/src/pages/tenants/TenantForm.ts index 4dd79ca3a..07b4f895f 100644 --- a/web/src/pages/tenants/TenantForm.ts +++ b/web/src/pages/tenants/TenantForm.ts @@ -49,7 +49,7 @@ export class TenantForm extends ModelForm {

${t`Matching is done based on domain suffix, so if you enter domain.tld, foo.domain.tld will still match.`}

- +