Release 2022.5

Breaking changes

• Twitter Source has been migrated to OAuth2

  This requires some reconfiguration on both Twitter's and authentik's side. Check out the new Twitter integration docs here.

• OAuth Provider: Redirect URIs are now checked using regular expressions

  Allowed Redirect URIs now accepts regular expressions to check redirect URIs to support wildcards. In most cases this will not change anything, however casing is also important now. Meaning if your redirect URI is "https://Foo.bar" and allowed is "https://foo.bar", authorization will not be allowed. Additionally, the special handling when Redirect URIs/Origins is set to * has been removed. To get the same behaviour, set Redirect URIs/Origins to .+.

New features

• LDAP Outpost cached binding

  Instead of always executing the configured flow when a new Bind request is received, the provider can now be configured to cache the session from the initial flow execution, and directly validate credentials in the outpost. This drastically improves the bind performance.

  See LDAP provider

• OAuth2: Add support for form_post response mode

• Don't prompt users for MFA when they've authenticated themselves within a time period

  You can now configure any Authenticator Validation Stage stage to not ask for MFA validation if the user has previously authenticated themselves with an MFA device (of any of the selected classes) in the Last validation threshold.

• Optimize bundling of web assets

  Previous versions had the entire frontend bundled in a single file (per interface). This has been revamped to produce smaller bundle sizes for each interface to improve the loading times.

  Additionally, only the locales configured will be loaded on start, instead of all locales.

  Certain parts of the application are purposefully still contained in the initial bundle, especially for commonly used pages and default routes.

Minor changes/fixes

• *: decrease frequency of background tasks, smear tasks based on name and fqdn
• api: fix OwnerFilter filtering out objects for superusers
• core: add custom shell command which imports all models and creates events for model events
• core: add flag to globally disable impersonation
• events: fix created events only being logged as debug level
• flows: handle flow title formatting error better, add user to flow title context
• internal: add signal handler for SIGTERM
• outposts/ldap: cached bind (#2824)
• policies: fix current user not being set in server-side policy deny
• providers/oauth2: add support for form_post response mode (#2818)
• providers/oauth2: allow regex matches for allowed redirect_uri
• providers/oauth2: don't create events before client_id can be verified to prevent spam
• providers/saml: make SAML metadata generation consistent
• root: export poetry deps to requirements.txt so we don't need poetry … (#2823)
• root: handle JSON error in metrics
• root: set SESSION_SAVE_EVERY_REQUEST to enable sliding sessions
• sources/oauth: Fix wording for OAuth source names (#2732)
• stages/authenticator_validate: remember (#2828)
• stages/identification: redirect with QS to keep next parameters (#2909)
• stages/user_delete: fix delete stage failing when pending user is not explicitly set
• web: fix dateTimeLocal() dropping local timezone
• web: lazy load parts of interfaces (#2864)
• web/user: add missing checkbox element in user settings (#2762)

Fixed in 2022.5.2

• internal: fix nil pointer dereference in ldap outpost
• internal: revert cookie path on proxy causing redirect loops
• outposts: allow externally managed SSH Config for outposts (#2917)
• outposts: ensure the user and token are created on initial outpost save
• root: fix missing curl in dockerfile
• web/admin: improve error handling in TokenCopyButton
• web/admin: make external host clickable
• web/user: fix use sub-pages not redirecting back to the subpage

Fixed in 2022.5.3

• api: migrate to openapi generator v6 (#2968)
• api: update API browser to match admin UI and auto-switch theme
• core: fix username validator not allowing changes that can be done via flows
• crypto: set SAN in default generated Certificate to semi-random domain
• ensure all viewsets have filter and search and add tests (#2946)
• events: fix transport not allowing blank values
• flows: fix re-imports of entries with identical PK re-creating objects (#2941)
• providers/oauth2: handle attribute errors when validation JWK contains private key
• providers/oauth2: improve error handling for invalid regular expressions
• providers/oauth2: only set expiry on user when it was freshly created
• providers/oauth2: regex-escape URLs when set to blank
• providers/oauth2: set related_name for many-to-many connections so used by detects the connection
• providers/saml: handle parse error
• root: Add docker-compose postgresql and redis healthchecks (#2958)
• stages/user_write: fix typo in request context variable
• web: decrease elements that refresh on global refresh signal
• web/admin: add note that regex is used for redirect URIs
• web/admin: add set password button to user view page
• web/admin: fix broken flow execute link (#2940)
• web/admin: fix display of LDAP bind mode
• web/admin: fix flow diagram not updating on flow changes
• web/admin: fix phrasing on LDAP provider form for bind mode
• web/admin: refactor table refresh to preserve selected/expanded elements correctly
• web/elements: fix missing click handler on wizard close button
• web/elements: fix used_by refreshing for all elements when using DeleteBulkForm
• website/docs: Fix misconfiguration causing POST requests behind Nginx to timeout (#2967)

Upgrading

This release does not introduce any new requirements.

docker-compose

Download the docker-compose file for 2022.5 from here. Afterwards, simply run docker-compose up -d.

Kubernetes

Update your values to use the new images:

image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.5.1