authentik/v2022.5.md at a286f999e240814ae760ce5bdf56069e3e7e7ee3

This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.

title	slug
Release 2022.5	2022.5

Breaking changes

Twitter Source has been migrated to OAuth2

This requires some reconfiguration on both Twitter's and authentik's side. Check out the new Twitter integration docs here
OAuth Provider: Redirect URIs are now checked using regular expressions

Allowed Redirect URIs now accepts regular expressions to check redirect URIs to support wildcards. In most cases this will not change anything, however casing is also important now. Meaning if your redirect URI is "https://Foo.bar" and allowed is "https://foo.bar", authorization will not be allowed. Additionally, the special handling when Redirect URIs/Origins is set to * has been removed. To get the same behaviour, set Redirect URIs/Origins to .+.

LDAP Outpost cached binding

Instead of always executing the configured flow when a new Bind request is received, the provider can now be configured to cache the session from the initial flow execution, and directly validate credentials in the outpost. This drastically improves the bind performance.

See LDAP provider
OAuth2: Add support for form_post response mode
Don't prompt users for MFA when they've authenticated themselves within a time period

You can now configure any Authenticator Validation Stage stage to not ask for MFA validation if the user has previously authenticated themselves with an MFA device (of any of the selected classes) in the Last validation threshold.
Optimise bundling of web assets

Previous versions had the entire frontend bundled in a single file (per interface). This has been revamped to produce smaller bundle sizes for each interface to improve the loading times.

Additionally, only the locales configured will be loaded on start, instead of all locales.

Certain parts of the application are purposefully still contained in the initial bundle, especially for commonly used pages and default routes.

*: decrease frequency of background tasks, smear tasks based on name and fqdn
api: fix OwnerFilter filtering out objects for superusers
core: add custom shell command which imports all models and creates events for model events
core: add flag to globally disable impersonation
events: fix created events only being logged as debug level
flows: handle flow title formatting error better, add user to flow title context
internal: add signal handler for SIGTERM
outposts/ldap: cached bind (#2824)
policies: fix current user not being set in server-side policy deny
providers/oauth2: add support for form_post response mode (#2818)
providers/oauth2: allow regex matches for allowed redirect_uri
providers/oauth2: don't create events before client_id can be verified to prevent spam
providers/saml: make SAML metadata generation consistent
root: export poetry deps to requirements.txt so we don't need poetry … (#2823)
root: handle JSON error in metrics
root: set SESSION_SAVE_EVERY_REQUEST to enable sliding sessions
sources/oauth: Fix wording for OAuth source names (#2732)
stages/authenticator_validate: remember (#2828)
stages/identification: redirect with QS to keep next parameters (#2909)
stages/user_delete: fix delete stage failing when pending user is not explicitly set
web: fix dateTimeLocal() dropping local timezone
web: lazy load parts of interfaces (#2864)
web/user: add missing checkbox element in user settings (#2762)

core: fix username validator not allowing changes that can be done via flows
crypto: set SAN in default generated Certificate to semi-random domain
ensure all viewsets have filter and search and add tests (#2946)
events: fix transport not allowing blank values
flows: fix re-imports of entries with identical PK re-creating objects (#2941)
providers/oauth2: improve error handling for invalid regular expressions
providers/oauth2: set related_name for many-to-many connections so used by detects the connection
providers/saml: handle parse error
stages/user_write: fix typo in request context variable
web: decrease elements that refresh on global refresh signal
web/admin: add set password button to user view page
web/admin: fix broken flow execute link (#2940)
web/admin: fix display of LDAP bind mode
web/admin: fix flow diagram not updating on flow changes
web/admin: fix phrasing on LDAP provider form for bind mode
web/admin: refactor table refresh to preserve selected/expanded elements correctly
web/elements: fix missing click handler on wizard close button
web/elements: fix used_by refreshing for all elements when using DeleteBulkForm

This release does not introduce any new requirements.

Download the docker-compose file for 2022.5 from here. Afterwards, simply run docker-compose up -d.

Update your values to use the new images:

image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.5.1