Enhance Authentik configuration by introducing dedicated authentication flows for public and lab brands, including stricter password policies and MFA requirements. Update README to clarify flow distinctions and invitation enrollment processes. Improve validation in Ansible tasks to ensure all necessary blueprint variables are set, enhancing deployment robustness.

2026-05-14 22:59:40 -04:00
parent 7b337f7128
commit 7fed8820ce
7 changed files with 435 additions and 21 deletions
--- a/ansible/roles/noble_authentik/templates/blueprints/21-noble-public-authentication-flow.yaml.j2
+++ b/ansible/roles/noble_authentik/templates/blueprints/21-noble-public-authentication-flow.yaml.j2
@@ -0,0 +1,80 @@
+# Noble — **public** hostname(s): same behaviour as stock **default-authentication-flow** (optional password / MFA skip for WebAuthn PWL), isolated slug for Brand binding.
+version: 1
+metadata:
+  name: noble-public-authentication-flow
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+entries:
+  - model: authentik_blueprints.metaapplyblueprint
+    attrs:
+      identifiers:
+        name: Default - Password change flow
+      required: false
+  - model: authentik_flows.flow
+    id: flow
+    identifiers:
+      slug: {{ noble_authentik_blueprint_public_auth_flow_slug | trim | to_json }}
+    attrs:
+      name: Noble public sign-in
+      title: Sign in
+      designation: authentication
+      authentication: none
+  - id: noble-public-identification-binding
+    model: authentik_flows.flowstagebinding
+    identifiers:
+      order: 10
+      stage: !Find [authentik_stages_identification.identificationstage, [name, default-authentication-identification]]
+      target: !KeyOf flow
+  - id: noble-public-password-binding
+    model: authentik_flows.flowstagebinding
+    identifiers:
+      order: 20
+      stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
+      target: !KeyOf flow
+    attrs:
+      re_evaluate_policies: true
+  - id: noble-public-authenticator-binding
+    model: authentik_flows.flowstagebinding
+    identifiers:
+      order: 30
+      stage: !Find [authentik_stages_authenticator_validate.authenticatorvalidatestage, [name, default-authentication-mfa-validation]]
+      target: !KeyOf flow
+  - model: authentik_flows.flowstagebinding
+    identifiers:
+      order: 100
+      stage: !Find [authentik_stages_user_login.userloginstage, [name, default-authentication-login]]
+      target: !KeyOf flow
+  - model: authentik_policies_expression.expressionpolicy
+    id: noble-public-password-optional
+    identifiers:
+      name: noble-public-password-optional
+    attrs:
+      expression: |
+        flow_plan = request.context.get("flow_plan")
+        if not flow_plan:
+            return True
+        return not hasattr(flow_plan.context.get("pending_user"), "backend")
+  - model: authentik_policies_expression.expressionpolicy
+    id: noble-public-authenticator-validate-optional
+    identifiers:
+      name: noble-public-authenticator-validate-optional
+    attrs:
+      expression: |
+        flow_plan = request.context.get("flow_plan")
+        if not flow_plan:
+            return True
+        return not (flow_plan.context.get("auth_method") == "auth_webauthn_pwl")
+  - model: authentik_policies.policybinding
+    identifiers:
+      order: 10
+      target: !KeyOf noble-public-password-binding
+      policy: !KeyOf noble-public-password-optional
+    attrs:
+      failure_result: true
+  - model: authentik_policies.policybinding
+    identifiers:
+      order: 10
+      target: !KeyOf noble-public-authenticator-binding
+      policy: !KeyOf noble-public-authenticator-validate-optional
+    attrs:
+      failure_result: true