stages/identification: only allow limited challenges for login sources

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

authentik/stages/identification/stage.py

@@ -16,10 +16,16 @@ from structlog.stdlib import get_logger
 
 from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import Application, Source, User
-from authentik.flows.challenge import Challenge, ChallengeResponse, ChallengeTypes
+from authentik.flows.challenge import (
+    Challenge,
+    ChallengeResponse,
+    ChallengeTypes,
+    RedirectChallenge,
+)
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
 from authentik.flows.stage import PLAN_CONTEXT_PENDING_USER_IDENTIFIER, ChallengeStageView
-from authentik.flows.views.executor import SESSION_KEY_APPLICATION_PRE, challenge_types
+from authentik.flows.views.executor import SESSION_KEY_APPLICATION_PRE
+from authentik.sources.plex.models import PlexAuthenticationChallenge
 from authentik.stages.identification.models import IdentificationStage
 from authentik.stages.identification.signals import identification_failed
 from authentik.stages.password.stage import authenticate
@@ -29,8 +35,11 @@ LOGGER = get_logger()
 
 @extend_schema_field(
     PolymorphicProxySerializer(
-        component_name="ChallengeTypes",
+        component_name="LoginChallengeTypes",
-        serializers=challenge_types(),
+        serializers={
+            RedirectChallenge().fields["component"].default: RedirectChallenge,
+            PlexAuthenticationChallenge().fields["component"].default: PlexAuthenticationChallenge,
+        },
         resource_type_field_name="component",
     )
 )

schema.yml

@@ -22438,6 +22438,15 @@ components:
           type: string
       required:
       - link
+    LoginChallengeTypes:
+      oneOf:
+      - $ref: '#/components/schemas/RedirectChallenge'
+      - $ref: '#/components/schemas/PlexAuthenticationChallenge'
+      discriminator:
+        propertyName: component
+        mapping:
+          xak-flow-redirect: '#/components/schemas/RedirectChallenge'
+          ak-flow-sources-plex: '#/components/schemas/PlexAuthenticationChallenge'
     LoginMetrics:
       type: object
       description: Login Metrics per 1h
@@ -22465,7 +22474,7 @@ components:
           type: string
           nullable: true
         challenge:
-          $ref: '#/components/schemas/ChallengeTypes'
+          $ref: '#/components/schemas/LoginChallengeTypes'
       required:
       - challenge
       - name