diff --git a/Makefile b/Makefile index 49845df42..531619624 100644 --- a/Makefile +++ b/Makefile @@ -65,6 +65,7 @@ gen-build: gen-changelog: git log --pretty=format:" - %s" $(shell git describe --tags $(shell git rev-list --tags --max-count=1))...$(shell git branch --show-current) | sort > changelog.md + npx prettier --write changelog.md gen-diff: git show $(shell git describe --tags $(shell git rev-list --tags --max-count=1)):schema.yml > old_schema.yml @@ -75,6 +76,7 @@ gen-diff: --markdown /local/diff.md \ /local/old_schema.yml /local/schema.yml rm old_schema.yml + npx prettier --write diff.md gen-clean: rm -rf web/api/src/ diff --git a/website/docs/providers/radius.md b/website/docs/providers/radius/index.md similarity index 56% rename from website/docs/providers/radius.md rename to website/docs/providers/radius/index.md index 4065d5acb..4f71e65c7 100644 --- a/website/docs/providers/radius.md +++ b/website/docs/providers/radius/index.md @@ -9,18 +9,20 @@ This feature is still in technical preview, so please report any Bugs you run in You can configure a Radius Provider for applications that don't support any other protocols or require Radius. :::info -Note: This provider requires the deployment of the [Radius Outpost](../outposts/) +This provider requires the deployment of the [RADIUS Outpost](../../outposts/) ::: Currently, only authentication requests are supported. +### Authentication flow + Authentication requests against the Radius Server use a flow in the background. This allows you to use the same policies and flows as you do for web-based logins. The following stages are supported: -- [Identification](../flow/stages/identification/index.md) -- [Password](../flow/stages/password/index.md) -- [Authenticator validation](../flow/stages/authenticator_validate/index.md) +- [Identification](../../flow/stages/identification/index.md) +- [Password](../../flow/stages/password/index.md) +- [Authenticator validation](../../flow/stages/authenticator_validate/index.md) Note: Authenticator validation currently only supports DUO, TOTP and static authenticators. @@ -28,6 +30,14 @@ The following stages are supported: SMS-based authenticators are not supported as they require a code to be sent from authentik, which is not possible during the bind. -- [User Logout](../flow/stages/user_logout.md) -- [User Login](../flow/stages/user_login/index.md) -- [Deny](../flow/stages/deny.md) +- [User Logout](../../flow/stages/user_logout.md) +- [User Login](../../flow/stages/user_login/index.md) +- [Deny](../../flow/stages/deny.md) + +### Limitations + +The RADIUS provider only supports the clear-text protocol: + +![](./protocols.png) + +This does not mean that passwords are stored in cleartext, they are hashed and salted in authentik. However as all protocols besides Clear-text, EAP-MD5 and EAP-PWD require the password to be stored in the database in clear text, they are not supported. diff --git a/website/docs/providers/radius/protocols.png b/website/docs/providers/radius/protocols.png new file mode 100644 index 000000000..cc60a3ecf Binary files /dev/null and b/website/docs/providers/radius/protocols.png differ diff --git a/website/docs/providers/saml.md b/website/docs/providers/saml/index.md similarity index 92% rename from website/docs/providers/saml.md rename to website/docs/providers/saml/index.md index 73788168b..d4192f42c 100644 --- a/website/docs/providers/saml.md +++ b/website/docs/providers/saml/index.md @@ -2,7 +2,7 @@ title: SAML Provider --- -This provider allows you to integrate enterprise software using the SAML2 Protocol. It supports signed requests and uses [Property Mappings](../property-mappings/#saml-property-mapping) to determine which fields are exposed and what values they return. This makes it possible to expose vendor-specific fields. +This provider allows you to integrate enterprise software using the SAML2 Protocol. It supports signed requests and uses [Property Mappings](../../property-mappings/#saml-property-mapping) to determine which fields are exposed and what values they return. This makes it possible to expose vendor-specific fields. Default fields are exposed through auto-generated Property Mappings, which are prefixed with "authentik default". | Endpoint | URL | diff --git a/website/docs/releases/2023/v2023.3.md b/website/docs/releases/2023/v2023.3.md index a83961627..f2f5ed36c 100644 --- a/website/docs/releases/2023/v2023.3.md +++ b/website/docs/releases/2023/v2023.3.md @@ -13,7 +13,7 @@ slug: "/releases/2023.3" authentik can now provision users into other IT systems via the SCIM (System for Cross-domain Identity Management) protocol. The provider synchronizes Users, Groups and the user membership. Objects are synced both when they are saved and based on a pre-defined schedule in the background. - Documentation: https://goauthentik.io/docs/providers/scim/ + Documentation: [SCIM Provider](../../../docs/providers/scim/) - Theming improvements diff --git a/website/docs/releases/2023/v2023.4.md b/website/docs/releases/2023/v2023.4.md index 2925a4ce4..9102c2970 100644 --- a/website/docs/releases/2023/v2023.4.md +++ b/website/docs/releases/2023/v2023.4.md @@ -1,10 +1,38 @@ --- -title: Release 2023.4 +title: Release 2023.4 - RADIUS support slug: "/releases/2023.4" --- ## New features +- RADIUS support + + :::info + This feature is still in technical preview, so please report any Bugs you run into on [GitHub](https://github.com/goauthentik/authentik/issues). + ::: + + authentik now supports the [RADIUS protocol](https://en.wikipedia.org/wiki/RADIUS) for authentication, allowing for the integration of a wider variety of systems such as VPN software, network switches/routers, and others. + + The RADIUS provider also uses a flow to authenticate users, and supports the same stages as the [LDAP Provider](../../../docs/providers/ldap). + + Documentation: [RADIUS Provider](../../../docs/providers/radius/) + +- Decreased CPU usage for workers + + Previously, authentik used a method to ensure that the worker containers are running correctly called "pinging", which would send a request to the worker and ensure it was processed correctly. This however used a lot of resources every time the health check ran. We've switched to a simpler method, one that will reduce CPU and memory usage (only affects Docker-Compose). + +- Configurable authentication flow for providers + + It is now possible to configure the authentication flow per provider. This configured flow will be used when an un-authenticated user tries to access the application the provider is used with. If no flow is set on a provider, the default authentication flow configured on the tenant will be used. + +- "Stay logged in" prompt + + In the [User login stage](../../../docs/flow/stages/user_login/), an admin can use the new "Stay Logged In" option to add additional minutes or hours to the defined `session duration` value. When this "Stay Logged In" offset time is configured, the user logging in is presented with a prompt asking if they want to extend their session. + +- Prompt preview + + When creating a single prompt for use with a [Prompt stage](../../../docs/flow/stages/prompt/), a live preview of the prompt is now shown. This makes it easier to test how a prompt will behave, and also shows what data it will send, and how it will be available in the flow context. + ## Upgrading This release does not introduce any new requirements. @@ -28,22 +56,42 @@ image: - \*: load websocket paths similarly to URLs (#5018) - blueprints: allow setting of token key in blueprint context (#4995) - core: Add unique constraint to user UUID (#5004) -- providers: Add ability to choose a default authentication flow (#5070) +- core: extend Postgres configuration (#5138) +- core: fix app launch URL flow selection (#5113) +- lifecycle: also migrate before starting worker, trap exit to cleanup mode (#5123) +- lifecycle: don't use celery ping for worker healthcheck (#5153) +- outposts: run containers as non root (#5212) +- outposts: set Kubernetes deployment security context (#5163) +- policies: provider raw result for better policy reusability (#5189) - providers/ldap: fix duplicate attributes (#4972) - providers/oauth2: fix response for response_type code and response_mode fragment (#4975) - providers/proxy: rework endpoints logic (#4993) -- providers/radius: simple radius outpost (#1796) +- providers/radius: simple RADIUS outpost (#1796) +- providers/scim: add missing default fields (#5108) +- providers/scim: fix error when user-group m2m is updated forward (#5082) +- providers: Add ability to choose a default authentication flow (#5070) +- stages/authenticator_validate: fix stage not working without pending user (#5096) +- stages/identification: revert is_active check (#5183) - stages/prompt: Add Radio Button Group, Dropdown and Text Area prompt fields (#4822) +- stages/prompt: Fix dropdown invalid choice (#5046) - stages/user_login: stay logged in (#4958) +- stages/user_write: improve error handling (#5136) +- stages: Add ability to set user friendly names for MFA stages (#5005) - web/admin: fix error adding users to groups (#5016) - web/admin: fix error listing blueprints with missing metadata (#5041) - web/admin: fix error when creating bindings due to hidden inputs (#5081) - web/admin: fix inconsistent display of flows in selections (#4977) +- web/admin: fix ldap form when editing scim provider from view page (#5164) - web/admin: fix prompt field display (#4990) +- web/admin: fix sidebar avatar not loaded (#5184) - web/admin: prompt preview (#5078) +- web/admin: show warning when adding user to superuser group (#5091) - web/elements: fix search select inconsistency (#4989) - web/elements: only render form once instance is loaded (#5049) - web/flows: fix authenticator selector in dark mode (#4974) +- web/user: rework search (#5107) +- web: only show debug locale if debug mode is enabled (#5111) +- web: remove more until (#5057) ## API Changes diff --git a/website/sidebars.js b/website/sidebars.js index 882ac3454..9385a4099 100644 --- a/website/sidebars.js +++ b/website/sidebars.js @@ -54,8 +54,8 @@ module.exports = { "providers/oauth2/device_code", ], }, - "providers/saml", - "providers/radius", + "providers/saml/index", + "providers/radius/index", { type: "category", label: "Proxy Provider", @@ -240,13 +240,14 @@ module.exports = { description: "Release notes for recent authentik versions", }, items: [ + "releases/2023/v2023.4", "releases/2023/v2023.3", "releases/2023/v2023.2", - "releases/2023/v2023.1", { type: "category", label: "Previous versions", items: [ + "releases/2023/v2023.1", "releases/2022/v2022.12", "releases/2022/v2022.11", "releases/2022/v2022.10",