website/docs/releases/2024/v2024.6.md
With this release, authentik now requires PostgreSQL version 14 or later. We recommend upgrading to the latest version if you are running an older version.
The provided Helm chart defaults to PostgreSQL 15. If you are using the Helm chart with the default values, no action is required.
The provided Compose file was updated with PostgreSQL 16. You can follow the procedure here to upgrade.
With this release, authentik now enforces unique group names. Existing groups with name collisions that were created in earlier versions can still exist, but any new groups you create will need a unique name. If changing attributes, permission-level, or parent on an existing group with a name collision, you need to also change its name to be unique. Note that changing members or roles associated with the group does not require a rename.
The context["geoip"] and context["asn"] objects available in expression policies are now dictionaries. Attributes must now be accessed via dictionary accessors. See our policy examples for the updated syntax.
Google Workspace Provider :ak-enterprise :ak-preview
With the Google Workspace provider, authentik serves as the single source of truth for all users and groups, when using Google products like Gmail.
For details refer to the Google Workspace Provider documentation
Microsoft Entra ID Provider :ak-enterprise :ak-preview
With the Microsoft Entra ID provider, authentik serves as the single source of truth for all users and groups. Configuring Entra ID as a provider allows for auto-discovery of user and group accounts, on-going synchronization of user data such as email address, name, and status, and integrated data mapping of field names and values.
For details refer to the Microsoft Entra ID documentation
Read-replica DB support
Multiple read-only databases can be configured to route read-only requests to the non-primary database instance so that the main database can be reserved to write requests.
For details refer to the PostgreSQL configuration
Improved CAPTCHA stage
Thresholds can now be configured on the CAPTCHA stage to customize its result. Additionally, the stage can be configured to continue the flow if the CAPTCHA score is outside of those thresholds for further decision making via expression policies.
For details refer to the CAPTCHA stage
Optimize sync and property mapping execution
The synchronization process from sources has been optimized to avoid unnecessary operations. Additionally, the Python compilation of property mappings is now cached so that it only happens once per sync.
Wizards now use a grid layout
The provider and source creation wizards now use a grid layout showing logos and descriptions of available protocols and services.
Reworked proxy provider redirect
Following-up on a highly requested issue, we've reworked our Proxy provider to avoid invalid user-facing redirects.
With this release, authentik now requires PostgreSQL version 14 or later. We recommend upgrading to the latest version if needed. Follow the instructions here if you need to upgrade PostgreSQL with docker-compose.
To upgrade, download the new docker-compose.yml file and update the Docker stack with the new version, using these commands:
wget -O docker-compose.yml https://goauthentik.io/version/2024.6/docker-compose.yml
docker compose up -d
The -O flag retains the downloaded file's name, overwriting any existing local file with the same name.
Upgrade the Helm Chart to the new version, using the following commands:
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.6
GET /propertymappings/provider/google_workspace/POST /propertymappings/provider/google_workspace/GET /propertymappings/provider/google_workspace/{pm_uuid}/PUT /propertymappings/provider/google_workspace/{pm_uuid}/DELETE /propertymappings/provider/google_workspace/{pm_uuid}/PATCH /propertymappings/provider/google_workspace/{pm_uuid}/GET /propertymappings/provider/google_workspace/{pm_uuid}/used_by/GET /propertymappings/provider/microsoft_entra/POST /propertymappings/provider/microsoft_entra/GET /propertymappings/provider/microsoft_entra/{pm_uuid}/PUT /propertymappings/provider/microsoft_entra/{pm_uuid}/DELETE /propertymappings/provider/microsoft_entra/{pm_uuid}/PATCH /propertymappings/provider/microsoft_entra/{pm_uuid}/GET /propertymappings/provider/microsoft_entra/{pm_uuid}/used_by/GET /providers/google_workspace/POST /providers/google_workspace/GET /providers/google_workspace/{id}/PUT /providers/google_workspace/{id}/DELETE /providers/google_workspace/{id}/PATCH /providers/google_workspace/{id}/GET /providers/google_workspace/{id}/sync/status/GET /providers/google_workspace/{id}/used_by/GET /providers/google_workspace_groups/POST /providers/google_workspace_groups/GET /providers/google_workspace_groups/{id}/DELETE /providers/google_workspace_groups/{id}/GET /providers/google_workspace_groups/{id}/used_by/GET /providers/google_workspace_users/POST /providers/google_workspace_users/GET /providers/google_workspace_users/{id}/DELETE /providers/google_workspace_users/{id}/GET /providers/google_workspace_users/{id}/used_by/GET /providers/microsoft_entra/POST /providers/microsoft_entra/GET /providers/microsoft_entra/{id}/PUT /providers/microsoft_entra/{id}/DELETE /providers/microsoft_entra/{id}/PATCH /providers/microsoft_entra/{id}/GET /providers/microsoft_entra/{id}/sync/status/GET /providers/microsoft_entra/{id}/used_by/GET /providers/microsoft_entra_groups/POST /providers/microsoft_entra_groups/GET /providers/microsoft_entra_groups/{id}/DELETE /providers/microsoft_entra_groups/{id}/GET /providers/microsoft_entra_groups/{id}/used_by/GET /providers/microsoft_entra_users/POST /providers/microsoft_entra_users/GET /providers/microsoft_entra_users/{id}/DELETE /providers/microsoft_entra_users/{id}/GET /providers/microsoft_entra_users/{id}/used_by/GET /providers/scim/{id}/sync/status/GET /providers/scim_groups/POST /providers/scim_groups/GET /providers/scim_groups/{id}/DELETE /providers/scim_groups/{id}/GET /providers/scim_groups/{id}/used_by/GET /providers/scim_users/POST /providers/scim_users/GET /providers/scim_users/{id}/DELETE /providers/scim_users/{id}/GET /providers/scim_users/{id}/used_by/GET /sources/ldap/{slug}/sync/status/GET /providers/scim/{id}/sync_status/GET /sources/ldap/{slug}/sync_status/GET /admin/system/Changed response : 200 OK
application/json
Changed property runtime (object)
Get versions
New required properties:
authentik_versionopenssl_fips_modeopenssl_versionNew optional properties:
gunicorn_versionAdded property openssl_version (string)
Added property openssl_fips_mode (boolean)
Added property authentik_version (string)
Deleted property gunicorn_version (string)
POST /admin/system/Changed response : 200 OK
application/json
Changed property runtime (object)
Get versions
New required properties:
authentik_versionopenssl_fips_modeopenssl_versionNew optional properties:
gunicorn_versionAdded property openssl_version (string)
Added property openssl_fips_mode (boolean)
Added property authentik_version (string)
Deleted property gunicorn_version (string)
GET /events/events/actions/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /outposts/instances/{uuid}/health/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Outpost health status
New required properties:
fips_enabledgolang_versionopenssl_enabledopenssl_versionAdded property golang_version (string)
Added property openssl_enabled (boolean)
Added property openssl_version (string)
Added property fips_enabled (boolean)
Get FIPS enabled
GET /outposts/service_connections/all/types/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /policies/all/types/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /policies/event_matcher/{policy_uuid}/Changed response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingPUT /policies/event_matcher/{policy_uuid}/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingChanged response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingPATCH /policies/event_matcher/{policy_uuid}/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingChanged response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingPOST /propertymappings/all/{pm_uuid}/test/Changed content type : application/json
New optional properties:
usergroup (string)GET /propertymappings/all/types/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /providers/all/types/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /sources/all/types/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /stages/all/types/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /stages/email/templates/Changed response : 200 OK
Changed content type : application/json
Changed items (object): > Types of an object that can be created
icon_url (string)GET /core/groups/{group_uuid}/Added: include_users in query
POST /policies/event_matcher/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingChanged response : 201 Created
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingGET /policies/event_matcher/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Event Matcher Policy Serializer
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum values:
authentik.enterprise.providers.google_workspaceauthentik.enterprise.providers.microsoft_entraChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingGET /providers/all/Added: backchannel in query
When not set all providers are returned. When set to true, only backchannel providers are returned. When set to false, backchannel providers are excluded
Deleted: backchannel_only in query
POST /rbac/permissions/assigned_by_roles/{uuid}/assign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingPATCH /rbac/permissions/assigned_by_roles/{uuid}/unassign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingPOST /rbac/permissions/assigned_by_users/{id}/assign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingPATCH /rbac/permissions/assigned_by_users/{id}/unassign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_google_workspace.googleworkspaceprovidermappingauthentik_providers_microsoft_entra.microsoftentraproviderauthentik_providers_microsoft_entra.microsoftentraprovidermappingGET /sources/ldap/{slug}/Changed response : 200 OK
application/json
icon (string)PUT /sources/ldap/{slug}/Changed response : 200 OK
application/json
icon (string)PATCH /sources/ldap/{slug}/Changed response : 200 OK
application/json
icon (string)GET /sources/oauth/{slug}/Changed response : 200 OK
application/json
icon (string)PUT /sources/oauth/{slug}/Changed response : 200 OK
application/json
icon (string)PATCH /sources/oauth/{slug}/Changed response : 200 OK
application/json
icon (string)GET /sources/plex/{slug}/Changed response : 200 OK
application/json
icon (string)PUT /sources/plex/{slug}/Changed response : 200 OK
application/json
icon (string)PATCH /sources/plex/{slug}/Changed response : 200 OK
application/json
icon (string)GET /sources/saml/{slug}/Changed response : 200 OK
application/json
icon (string)PUT /sources/saml/{slug}/Changed response : 200 OK
application/json
icon (string)PATCH /sources/saml/{slug}/Changed response : 200 OK
application/json
icon (string)GET /events/system_tasks/{uuid}/Changed response : 200 OK
application/json
Added property expires (string)
Added property expiring (boolean)
GET /rbac/permissions/assigned_by_roles/Changed: model in query
GET /rbac/permissions/assigned_by_users/Changed: model in query
POST /sources/ldap/Changed response : 201 Created
application/json
icon (string)GET /sources/ldap/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > LDAP Source Serializer
icon (string)POST /sources/oauth/Changed response : 201 Created
application/json
icon (string)GET /sources/oauth/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > OAuth Source Serializer
icon (string)POST /sources/plex/Changed response : 201 Created
application/json
icon (string)GET /sources/plex/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Plex Source Serializer
icon (string)POST /sources/saml/Changed response : 201 Created
application/json
icon (string)GET /sources/saml/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SAMLSource Serializer
icon (string)GET /stages/captcha/{stage_uuid}/Changed response : 200 OK
application/json
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions
PUT /stages/captcha/{stage_uuid}/Changed content type : application/json
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions
Changed response : 200 OK
application/json
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions
PATCH /stages/captcha/{stage_uuid}/Changed content type : application/json
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions
Changed response : 200 OK
application/json
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions
PUT /core/transactional/applications/Changed content type : application/json
Changed property provider_model (string)
Added enum values:
authentik_providers_google_workspace.googleworkspaceproviderauthentik_providers_microsoft_entra.microsoftentraproviderChanged property provider (object)
Added 'authentik_providers_google_workspace.googleworkspaceprovider' provider_model:
Property name (string)
Property property_mappings (array)
Items (string):
Property property_mappings_group (array)
Property mappings used for group creation/updating.
Items (string):
Property delegated_subject (string)
Property credentials (object)
Property scopes (string)
Property exclude_users_service_account (boolean)
Property filter_group (string)
Property user_delete_action (string)
Enum values:
do_nothingdeletesuspendProperty group_delete_action (string)
Property default_group_email_domain (string)
Added 'authentik_providers_microsoft_entra.microsoftentraprovider' provider_model:
Property name (string)
Property property_mappings (array)
Property property_mappings_group (array)
Property mappings used for group creation/updating.
Property client_id (string)
Property client_secret (string)
Property tenant_id (string)
Property exclude_users_service_account (boolean)
Property filter_group (string)
Property user_delete_action (string)
Property group_delete_action (string)
GET /events/system_tasks/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Serialize TaskInfo and TaskResult
Added property expires (string)
Added property expiring (boolean)
POST /stages/captcha/Changed content type : application/json
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions
Changed response : 201 Created
application/json
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions
GET /stages/captcha/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > CaptchaStage Serializer
Added property score_min_threshold (number)
Added property score_max_threshold (number)
Added property error_on_invalid_score (boolean)
When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions