diff --git a/AGENTS.md b/AGENTS.md index 28c13c69ab..05da405e50 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -144,9 +144,9 @@ Authoritative contributor docs live under `website/docs/developer-docs/` and are - `setup/full-dev-environment.mdx` — full backend + frontend dev environment. - `setup/frontend-dev-environment.mdx` — web-only setup. -- `setup/debugging.md` — attaching a debugger (VS Code config included). +- `setup/debugging.mdx` — attaching a debugger (VS Code config included). - `docs/style-guide.mdx` — the canonical prose style guide (also governs this repo's docs). -- `contributing.md` / top-level `CONTRIBUTING.md` — contribution process. `SECURITY.md` — reporting vulnerabilities. +- `contributing.mdx` / top-level `CONTRIBUTING.md` — contribution process. `SECURITY.md` — reporting vulnerabilities. ## Tech stack diff --git a/authentik/blueprints/v1/importer.py b/authentik/blueprints/v1/importer.py index 9c535515c1..74f18c95e5 100644 --- a/authentik/blueprints/v1/importer.py +++ b/authentik/blueprints/v1/importer.py @@ -53,7 +53,7 @@ from authentik.policies.models import Policy, PolicyBindingModel from authentik.rbac.models import Role # Context set when the serializer is created in a blueprint context -# Update website/docs/customize/blueprints/v1/models.md when used +# Update website/docs/customize/blueprints/v1/models.mdx when used SERIALIZER_CONTEXT_BLUEPRINT = "blueprint_entry" diff --git a/authentik/lib/expression/evaluator.py b/authentik/lib/expression/evaluator.py index b05523e5e4..91e49e6fcf 100644 --- a/authentik/lib/expression/evaluator.py +++ b/authentik/lib/expression/evaluator.py @@ -63,8 +63,8 @@ class BaseEvaluator: def __init__(self, filename: str | None = None): self._filename = filename if filename else "BaseEvaluator" - # update website/docs/expressions/_objects.md - # update website/docs/expressions/_functions.md + # update website/docs/expressions/reference/_objects.mdx + # update website/docs/expressions/reference/_functions.mdx self._globals = { "ak_call_policy": self.expr_func_call_policy, "ak_create_event": self.expr_event_create, diff --git a/authentik/outposts/models.py b/authentik/outposts/models.py index 2628510158..68f78b3b54 100644 --- a/authentik/outposts/models.py +++ b/authentik/outposts/models.py @@ -53,7 +53,7 @@ class ServiceConnectionInvalid(SentryIgnoredException): class OutpostConfig: """Configuration an outpost uses to configure it self""" - # update website/docs/add-secure-apps/outposts/_config.md + # update website/docs/add-secure-apps/outposts/_config.mdx authentik_host: str = "" authentik_host_insecure: bool = False diff --git a/authentik/policies/expression/evaluator.py b/authentik/policies/expression/evaluator.py index 1561ed2aa4..a08090905a 100644 --- a/authentik/policies/expression/evaluator.py +++ b/authentik/policies/expression/evaluator.py @@ -28,8 +28,8 @@ class PolicyEvaluator(BaseEvaluator): def __init__(self, policy_name: str | None = None): super().__init__(policy_name or "PolicyEvaluator") self._messages = [] - # update website/docs/expressions/_objects.md - # update website/docs/expressions/_functions.md + # update website/docs/expressions/reference/_objects.mdx + # update website/docs/expressions/reference/_functions.mdx self._context["ak_message"] = self.expr_func_message self._context["ak_user_has_authenticator"] = self.expr_func_user_has_authenticator @@ -39,8 +39,8 @@ class PolicyEvaluator(BaseEvaluator): def set_policy_request(self, request: PolicyRequest): """Update context based on policy request (if http request is given, update that too)""" - # update website/docs/expressions/_objects.md - # update website/docs/expressions/_functions.md + # update website/docs/expressions/reference/_objects.mdx + # update website/docs/expressions/reference/_functions.mdx self._context["ak_is_sso_flow"] = request.context.get(PLAN_CONTEXT_SSO, False) if request.http_request: self.set_http_request(request.http_request) @@ -53,8 +53,8 @@ class PolicyEvaluator(BaseEvaluator): def set_http_request(self, request: HttpRequest): """Update context based on http request""" - # update website/docs/expressions/_objects.md - # update website/docs/expressions/_functions.md + # update website/docs/expressions/reference/_objects.mdx + # update website/docs/expressions/reference/_functions.mdx self._context["ak_client_ip"] = ip_address(ClientIPMiddleware.get_client_ip(request)) self._context["http_request"] = request diff --git a/authentik/stages/prompt/models.py b/authentik/stages/prompt/models.py index 23847b814c..d95465fe80 100644 --- a/authentik/stages/prompt/models.py +++ b/authentik/stages/prompt/models.py @@ -38,7 +38,7 @@ LOGGER = get_logger() class FieldTypes(models.TextChoices): """Field types an Prompt can be""" - # update website/docs/add-secure-apps/flows-stages/stages/prompt/index.md + # update website/docs/add-secure-apps/flows-stages/stages/prompt/index.mdx # Simple text field TEXT = "text", _("Text: Simple Text input") diff --git a/web/src/admin/applications/ApplicationListPage.ts b/web/src/admin/applications/ApplicationListPage.ts index 858108a1f6..d179b0e7c0 100644 --- a/web/src/admin/applications/ApplicationListPage.ts +++ b/web/src/admin/applications/ApplicationListPage.ts @@ -24,7 +24,7 @@ import { AKApplicationWizard } from "#admin/applications/wizard/ak-application-w import { Application, CoreApi, PoliciesApi } from "@goauthentik/api"; -import MDApplication from "~docs/add-secure-apps/applications/index.md"; +import MDApplication from "~docs/add-secure-apps/applications/index.mdx"; import { msg, str } from "@lit/localize"; import { css, CSSResult, html, nothing, PropertyValues, TemplateResult } from "lit"; diff --git a/web/src/admin/providers/proxy/ProxyProviderViewPage.ts b/web/src/admin/providers/proxy/ProxyProviderViewPage.ts index 103cb2d3ae..7dfa9fb301 100644 --- a/web/src/admin/providers/proxy/ProxyProviderViewPage.ts +++ b/web/src/admin/providers/proxy/ProxyProviderViewPage.ts @@ -20,13 +20,13 @@ import { SlottedTemplateResult } from "#elements/types"; import { ModelEnum, ProvidersApi, ProxyMode, ProxyProvider } from "@goauthentik/api"; -import MDCaddyStandalone from "~docs/add-secure-apps/providers/proxy/_caddy_standalone.md"; -import MDNginxIngress from "~docs/add-secure-apps/providers/proxy/_nginx_ingress.md"; -import MDNginxPM from "~docs/add-secure-apps/providers/proxy/_nginx_proxy_manager.md"; -import MDNginxStandalone from "~docs/add-secure-apps/providers/proxy/_nginx_standalone.md"; -import MDTraefikCompose from "~docs/add-secure-apps/providers/proxy/_traefik_compose.md"; -import MDTraefikIngress from "~docs/add-secure-apps/providers/proxy/_traefik_ingress.md"; -import MDTraefikStandalone from "~docs/add-secure-apps/providers/proxy/_traefik_standalone.md"; +import MDCaddyStandalone from "~docs/add-secure-apps/providers/proxy/_caddy_standalone.mdx"; +import MDNginxIngress from "~docs/add-secure-apps/providers/proxy/_nginx_ingress.mdx"; +import MDNginxPM from "~docs/add-secure-apps/providers/proxy/_nginx_proxy_manager.mdx"; +import MDNginxStandalone from "~docs/add-secure-apps/providers/proxy/_nginx_standalone.mdx"; +import MDTraefikCompose from "~docs/add-secure-apps/providers/proxy/_traefik_compose.mdx"; +import MDTraefikIngress from "~docs/add-secure-apps/providers/proxy/_traefik_ingress.mdx"; +import MDTraefikStandalone from "~docs/add-secure-apps/providers/proxy/_traefik_standalone.mdx"; import MDHeaderAuthentication from "~docs/add-secure-apps/providers/proxy/header_authentication.mdx"; import { msg } from "@lit/localize"; diff --git a/web/src/admin/providers/scim/SCIMProviderViewPage.ts b/web/src/admin/providers/scim/SCIMProviderViewPage.ts index 5f111b35a5..3452c314c2 100644 --- a/web/src/admin/providers/scim/SCIMProviderViewPage.ts +++ b/web/src/admin/providers/scim/SCIMProviderViewPage.ts @@ -34,7 +34,7 @@ import { SCIMProvider, } from "@goauthentik/api"; -import MDSCIMProvider from "~docs/add-secure-apps/providers/scim/index.md"; +import MDSCIMProvider from "~docs/add-secure-apps/providers/scim/index.mdx"; import { msg } from "@lit/localize"; import { CSSResult, html, nothing, PropertyValues } from "lit"; diff --git a/web/src/admin/sources/kerberos/KerberosSourceViewPage.ts b/web/src/admin/sources/kerberos/KerberosSourceViewPage.ts index 97a46c29b7..74ace3f77a 100644 --- a/web/src/admin/sources/kerberos/KerberosSourceViewPage.ts +++ b/web/src/admin/sources/kerberos/KerberosSourceViewPage.ts @@ -24,7 +24,7 @@ import { scheduleCard } from "#components/tasks/scheduleCard"; import { KerberosSource, ModelEnum, SourcesApi } from "@goauthentik/api"; -import MDSourceKerberosBrowser from "~docs/users-sources/sources/protocols/kerberos/browser.md"; +import MDSourceKerberosBrowser from "~docs/users-sources/sources/protocols/kerberos/browser.mdx"; import { msg } from "@lit/localize"; import { CSSResult, html, nothing } from "lit"; diff --git a/web/types/mdx.d.ts b/web/types/mdx.d.ts index c28cfa3550..dbed2be83c 100644 --- a/web/types/mdx.d.ts +++ b/web/types/mdx.d.ts @@ -1,18 +1,10 @@ /** * @file Provides types for ESBuild "virtual modules" generated from - * Markdown / MDX files. The bundler's `mdx-plugin` compiles these to + * MDX files. The bundler's `mdx-plugin` compiles these to * HTML at build time and emits a JSON envelope; importing the file * yields the URL of that JSON envelope. */ -declare module "~docs/*.md" { - /** - * URL of the JSON envelope emitted for the imported file. - */ - const url: string; - export default url; -} - declare module "~docs/*.mdx" { /** * URL of the JSON envelope emitted for the imported file. diff --git a/website/AGENTS.md b/website/AGENTS.md index 7fd4492109..931c95a3d2 100644 --- a/website/AGENTS.md +++ b/website/AGENTS.md @@ -10,7 +10,7 @@ A shared `docusaurus-theme/` workspace package (`@goauthentik/docusaurus-theme`) Theme customizations live in `docusaurus-theme/theme/` as **swizzled** components — Docusaurus's mechanism for overriding a built-in theme component by shadowing it at the same import path (e.g. `theme/EditThisPage`, `theme/DocItem/Content`, `theme/NotFound`). Most are _wrappers_ (render the original and add to it); a few are _ejected_ (full replacements). Because these override theme internals, they can break on a Docusaurus upgrade — prefer wrapping over ejecting, keep overrides minimal, and re-check them when bumping Docusaurus. Scaffold a new one with the `docusaurus swizzle` CLI (`npm run --prefix website/docs docusaurus -- swizzle @docusaurus/theme-classic --wrap`; use `--eject` only when wrapping cannot express the change), then move the result into `docusaurus-theme/theme/` so all three sites share it. -You are most often editing **Markdown/MDX content**, not application code. Treat documentation as a product: every page has a URL that is a promise to readers, and prose must pass the linters and the spell checker. +You are most often editing **MDX content**, not application code. Treat documentation as a product: every page has a URL that is a promise to readers, and prose must pass the linters and the spell checker. ## Commands @@ -73,7 +73,7 @@ website/ integrations/ # Integrations site (@goauthentik/integration-docs) //index.mdx # one folder per service categories.mjs # Category list — drives the AUTO-GENERATED sidebar - template/service.md # Template for a new integration guide + template/service.mdx # Template for a new integration guide static/_redirects api/ # API site (@goauthentik/api-docs) — generated from ../schema.yml docusaurus-theme/ # Shared theme/components/redirect logic for all three sites @@ -85,10 +85,10 @@ website/ ### Author-facing guides (source of truth — keep content consistent with these) -- `docs/developer-docs/docs/writing-documentation.md` — setup, build commands, glossary, page routing & redirects. +- `docs/developer-docs/docs/writing-documentation.mdx` — setup, build commands, glossary, page routing & redirects. - `docs/developer-docs/docs/style-guide.mdx` — the canonical style guide (terminology, voice, formatting, accessibility, metadata). -- `docs/developer-docs/docs/templates/` — `combo` / `procedural` / `conceptual` / `reference` templates (`*.tmpl.md`). Start from a template; default to **combo** unless the steps get buried, then split into procedural + conceptual. -- `docs/developer-docs/contributing.md` — general contribution guidelines. +- `docs/developer-docs/docs/templates/` — `combo` / `procedural` / `conceptual` / `reference` templates (`*.tmpl.mdx`). Start from a template; default to **combo** unless the steps get buried, then split into procedural + conceptual. +- `docs/developer-docs/contributing.mdx` — general contribution guidelines. When you change a documented workflow (commands, structure, conventions), update both this file **and** the corresponding author-facing guide so they don't drift. @@ -100,20 +100,20 @@ The one rule the linters and spell checker cannot enforce, and the one most ofte ### Adding a Topics page -1. Create the `.md`/`.mdx` file under the appropriate `docs//` directory. +1. Create the `.mdx` file under the appropriate `docs//` directory. 2. **Add it to `docs/sidebar.mjs`** — otherwise it won't appear in the navigation. 3. Run `make docs` before pushing. ### Adding an integration guide -1. Copy `integrations/template/service.md` into `integrations///index.mdx`. Pick a `` from `integrations/categories.mjs`. +1. Copy `integrations/template/service.mdx` into `integrations///index.mdx`. Pick a `` from `integrations/categories.mjs`. 2. Use placeholder domains `authentik.company` and `.company` (drop the service domain for SaaS). 3. **Do not edit the integrations sidebar** — it is auto-generated from `categories.mjs`. 4. Run `make integrations` before pushing. ### Adding a glossary term -Create `docs/core/glossary/terms/.mdx` with `sidebar_custom_props` frontmatter (`termName`, `tags`, optional `authentikSpecific`, `shortDescription`, optional `longDescription`). See `writing-documentation.md` for the field reference. +Create `docs/core/glossary/terms/.mdx` with `sidebar_custom_props` frontmatter (`termName`, `tags`, optional `authentikSpecific`, `shortDescription`, optional `longDescription`). See `writing-documentation.mdx` for the field reference. ## URLs and redirects @@ -155,7 +155,7 @@ Every PR gets a Netlify Deploy Preview — use it to verify rendering, links, an | Concern | Tooling | | -------------- | ----------------------------------------------------------------------------------- | | Site generator | Docusaurus 3.x (classic preset + Mermaid) | -| Content | Markdown / MDX + React | +| Content | MDX + React | | API reference | `docusaurus-plugin-openapi-docs` (from schema) | | Build runtime | Node ≥ 24, npm ≥ 11 (run via `corepack`) | | Package layout | NPM Workspaces (`docs`, `integrations`, `api`, `docusaurus-theme`) | diff --git a/website/api/authentication.md b/website/api/authentication.mdx similarity index 100% rename from website/api/authentication.md rename to website/api/authentication.mdx diff --git a/website/api/flow-executor.md b/website/api/flow-executor.mdx similarity index 100% rename from website/api/flow-executor.md rename to website/api/flow-executor.mdx diff --git a/website/api/index.md b/website/api/index.mdx similarity index 100% rename from website/api/index.md rename to website/api/index.mdx diff --git a/website/api/websocket.md b/website/api/websocket.mdx similarity index 100% rename from website/api/websocket.md rename to website/api/websocket.mdx diff --git a/website/docs/add-secure-apps/access-requests/index.mdx b/website/docs/add-secure-apps/access-requests/index.mdx index 9b5b245805..4f6eb5d558 100644 --- a/website/docs/add-secure-apps/access-requests/index.mdx +++ b/website/docs/add-secure-apps/access-requests/index.mdx @@ -24,13 +24,13 @@ Access requests provide: ## Terminology -| Term | Description | -| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Access request | A request from a specific user for access to an application. A request can be pending, approved, or denied. | -| Request rule | A configuration that determines which request flow is used, who reviews requests, and how reviewers are notified. If no request flow is set on the request rule, it falls back to the request flow value set on the [brand](../../customize/branding/index.md). | -| Request rule binding | A binding between a request rule and a requestable application. It also determines which users or groups can request access. | -| Reviewer | A user or group authorized to approve or deny an access request. | -| Expiry | The period for which access granted through an approved request remains valid. | +| Term | Description | +| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Access request | A request from a specific user for access to an application. A request can be pending, approved, or denied. | +| Request rule | A configuration that determines which request flow is used, who reviews requests, and how reviewers are notified. If no request flow is set on the request rule, it falls back to the request flow value set on the [brand](../../customize/branding/index.mdx). | +| Request rule binding | A binding between a request rule and a requestable application. It also determines which users or groups can request access. | +| Reviewer | A user or group authorized to approve or deny an access request. | +| Expiry | The period for which access granted through an approved request remains valid. | ## Access request lifecycle @@ -55,7 +55,7 @@ Submitting a request executes a request flow. Use this to collect a justificatio Configure a **Request flow** on either: - The request rule itself. -- As a default for the [brand](../../customize/branding/index.md). Used as a fallback when the request rule does not specify a request flow. +- As a default for the [brand](../../customize/branding/index.mdx). Used as a fallback when the request rule does not specify a request flow. authentik includes a `default-request` flow that is empty. This flow can be configured with any required stages and policies. Any prompt data entered by a requester during a request flow is shown to the reviewer in the **Requester notes** field. Request flows can be left empty if you don't require user interaction. @@ -73,7 +73,7 @@ authentik includes a `default-request` flow that is empty. This flow can be conf - **Everyone who can approve** - **Only individually-selected reviewers** - **A random subset (of size “minimum reviewers”) of everyone who can approve** - - **Notification transports** _(optional)_: The [notification transports](../../sys-mgmt/events/transports.md) used to notify reviewers. + - **Notification transports** _(optional)_: The [notification transports](../../sys-mgmt/events/transports.mdx) used to notify reviewers. - **Request flow** _(optional)_: The [request flow](#request-flows) presented to the user when requesting access. 4. Click **Create Request Rule**. @@ -146,7 +146,7 @@ Each stage of a request is recorded as an event and can be matched in event matc - `access_request_denied` - `access_request_revoked` -Pair an event matcher policy with a notification rule to alert security teams of access events via Slack, email, or webhooks. See [Events](../../sys-mgmt/events/index.md) and [Notifications](../../sys-mgmt/events/notifications.md) for more information. +Pair an event matcher policy with a notification rule to alert security teams of access events via Slack, email, or webhooks. See [Events](../../sys-mgmt/events/index.mdx) and [Notifications](../../sys-mgmt/events/notifications.mdx) for more information. ## Considerations and limitations diff --git a/website/docs/add-secure-apps/applications/index.md b/website/docs/add-secure-apps/applications/index.mdx similarity index 93% rename from website/docs/add-secure-apps/applications/index.md rename to website/docs/add-secure-apps/applications/index.mdx index 218c16ecba..d76e9547ef 100644 --- a/website/docs/add-secure-apps/applications/index.md +++ b/website/docs/add-secure-apps/applications/index.mdx @@ -9,7 +9,7 @@ When a user logs into authentik, they see a list of the applications for which a Applications are the "other half" of providers. They typically exist in a 1-to-1 relationship; each application needs a provider and every provider can be used with one application. Applications can, however, use specific, additional providers to augment the functionality of the main provider. For more information, see [Backchannel providers](./manage_apps.mdx#backchannel-providers). -Furthermore, the [RAC (Remote Access Control)](../providers/rac/index.md) feature uses a single application and a single provider, but multiple "endpoints". An endpoint defines each remote machine. +Furthermore, the [RAC (Remote Access Control)](../providers/rac/index.mdx) feature uses a single application and a single provider, but multiple "endpoints". An endpoint defines each remote machine. :::info For information about creating and managing applications, refer to [Manage applications](./manage_apps.mdx). @@ -33,7 +33,7 @@ The following options can be configured: Only apps with launch URLs that begin with `http://` or `https://`, or that use relative paths, appear on the user's **Application Dashboard** page. To keep an app accessible but remove it from that page, use the **Hide from Application Dashboard** option (see [Hide applications](./manage_apps.mdx#hide-applications)). -- _Icon (URL)_: Optionally configure an icon for the application. You can select from files uploaded to the [Files](../../customize/files.md) library or enter an absolute URL. +- _Icon (URL)_: Optionally configure an icon for the application. You can select from files uploaded to the [Files](../../customize/files.mdx) library or enter an absolute URL. - _Publisher_: Text shown in the application card's expandable kebab menu (⋮) - _Description_: Text shown in the application card's expandable kebab menu (⋮) diff --git a/website/docs/add-secure-apps/applications/manage_apps.mdx b/website/docs/add-secure-apps/applications/manage_apps.mdx index 20d6e541ef..42d50d99d8 100644 --- a/website/docs/add-secure-apps/applications/manage_apps.mdx +++ b/website/docs/add-secure-apps/applications/manage_apps.mdx @@ -27,7 +27,7 @@ By default, if you click **New Application**, you are prompted to create the new - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and any additional required configurations. - - **Configure Bindings**: optionally create a [binding](../bindings-overview/index.md) between the application and a policy, group, or user. Application bindings control whether users can view and access the application from their **Application Dashboard** page. If you do not define any bindings, all users have access to the application. For more information, see [policy-driven authorization](#policy-driven-authorization), [application entitlements](#application-entitlements), and [hiding an application](#hide-applications). + - **Configure Bindings**: optionally create a [binding](../bindings-overview/index.mdx) between the application and a policy, group, or user. Application bindings control whether users can view and access the application from their **Application Dashboard** page. If you do not define any bindings, all users have access to the application. For more information, see [policy-driven authorization](#policy-driven-authorization), [application entitlements](#application-entitlements), and [hiding an application](#hide-applications). 4. On the **Review and Submit Application** panel, review the configuration for the new application and its provider, and then click **Create Application**. @@ -44,12 +44,12 @@ When multiple policies, groups, or users are attached, use **Policy engine mode* The most common ways to control access to an application by using bindings are: -1. [Create a policy binding](../../customize/policies/working_with_policies.md#bind-a-policy-to-an-application) that determines whether a user can access an application. +1. [Create a policy binding](../../customize/policies/working_with_policies.mdx#bind-a-policy-to-an-application) that determines whether a user can access an application. 2. [Bind a user or group to the application](#bind-a-user-or-group-to-an-application). ### Policy-driven authorization -To use a [policy](../../customize/policies/index.md) to control which users or groups can access an application, click an application in the applications list, open the **Policy / Group / User Bindings** tab, and click **Create or bind...**. You can then create a new policy and bind it to the application, or select **Bind an existing policy** under **Bind Existing...**. +To use a [policy](../../customize/policies/index.mdx) to control which users or groups can access an application, click an application in the applications list, open the **Policy / Group / User Bindings** tab, and click **Create or bind...**. You can then create a new policy and bind it to the application, or select **Bind an existing policy** under **Bind Existing...**. ### Bind a user or group to an application @@ -125,7 +125,7 @@ To give users direct links to applications, you can now use a URL like `https:// ## Backchannel providers -Backchannel providers can augment the functionality of applications by using additional protocols. The main provider of an application provides the SSO protocol that is used for logging into the application. Then, additional backchannel providers can be used for protocols such as [SCIM](../providers/scim/index.md) and [LDAP](../providers/ldap/index.md) to provide directory syncing. +Backchannel providers can augment the functionality of applications by using additional protocols. The main provider of an application provides the SSO protocol that is used for logging into the application. Then, additional backchannel providers can be used for protocols such as [SCIM](../providers/scim/index.mdx) and [LDAP](../providers/ldap/index.mdx) to provide directory syncing. Note that any access restrictions that are configured on an application apply to all of its backchannel providers. @@ -134,7 +134,7 @@ To create a backchannel provider and then add it to an existing application, fol 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create**. -- **Choose a Provider Type**: The protocol for a backchannel provider must be [SCIM](../providers/scim/index.md), [LDAP](../providers/ldap/index.md), [Google Workspace (GWS)](../providers/gws/index.md), [Microsoft Entra ID](../providers/entra/index.md), or [Shared Signals Framework (SSF)](../providers/ssf/index.md). +- **Choose a Provider Type**: The protocol for a backchannel provider must be [SCIM](../providers/scim/index.mdx), [LDAP](../providers/ldap/index.mdx), [Google Workspace (GWS)](../providers/gws/index.mdx), [Microsoft Entra ID](../providers/entra/index.mdx), or [Shared Signals Framework (SSF)](../providers/ssf/index.mdx). - **Configure the Provider**: Enter any required configurations. 3. Click **Finish** to save the provider. diff --git a/website/docs/add-secure-apps/bindings-overview/index.md b/website/docs/add-secure-apps/bindings-overview/index.mdx similarity index 97% rename from website/docs/add-secure-apps/bindings-overview/index.md rename to website/docs/add-secure-apps/bindings-overview/index.mdx index ff197f55c5..7e8446d75a 100644 --- a/website/docs/add-secure-apps/bindings-overview/index.md +++ b/website/docs/add-secure-apps/bindings-overview/index.mdx @@ -6,12 +6,12 @@ sidebar_label: "Bindings" A binding connects one authentik object to another object that uses it. Bindings let authentik answer two common questions: -- Where should authentik evaluate this [policy](../../customize/policies/index.md), user, or group? -- Where should authentik insert this [stage](../flows-stages/stages/index.md) into a flow? +- Where should authentik evaluate this [policy](../../customize/policies/index.mdx), user, or group? +- Where should authentik insert this [stage](../flows-stages/stages/index.mdx) into a flow? A policy answers "should this request pass?" A policy binding decides where authentik asks that question. -For a step-by-step guide, see [Work with bindings](./work-with-bindings.md). +For a step-by-step guide, see [Work with bindings](./work-with-bindings.mdx). ## Binding types @@ -132,7 +132,7 @@ If a target has no applicable bindings, authentik treats the result as passing. A flow-stage binding attaches a stage to a flow and defines the order in which that stage runs. Flow-stage bindings are also called stage bindings. -authentik uses flow-stage bindings while building the [flow plan](../flows-stages/flow/planner.md). The flow plan determines which stages a user sees and in what order. +authentik uses flow-stage bindings while building the [flow plan](../flows-stages/flow/planner.mdx). The flow plan determines which stages a user sees and in what order. This matters because stages are reusable objects. The same stage can appear in multiple flows, but each flow-stage binding can have its own settings. When you bind a policy to a stage in a specific flow, you bind it to that flow-stage binding, not to the reusable stage definition itself. @@ -143,7 +143,7 @@ Flow-stage bindings have two policy evaluation options: - **Evaluate when flow is planned**: authentik evaluates policies while building the flow plan. - **Evaluate when stage is run**: authentik evaluates policies immediately before presenting the stage. -At least one of these options must be enabled, and both can be enabled at the same time. For the full behavior and guidance on choosing the right setting, see [Flow Planner](../flows-stages/flow/planner.md#planning-and-stage-policies). +At least one of these options must be enabled, and both can be enabled at the same time. For the full behavior and guidance on choosing the right setting, see [Flow Planner](../flows-stages/flow/planner.mdx#planning-and-stage-policies). ## What to remember diff --git a/website/docs/add-secure-apps/bindings-overview/work-with-bindings.md b/website/docs/add-secure-apps/bindings-overview/work-with-bindings.mdx similarity index 72% rename from website/docs/add-secure-apps/bindings-overview/work-with-bindings.md rename to website/docs/add-secure-apps/bindings-overview/work-with-bindings.mdx index c85cee3d41..9204c1ac1f 100644 --- a/website/docs/add-secure-apps/bindings-overview/work-with-bindings.md +++ b/website/docs/add-secure-apps/bindings-overview/work-with-bindings.mdx @@ -4,17 +4,17 @@ title: Work with bindings Bindings are configured from the object that uses them. The exact page depends on what you want the binding to control. -For the concepts behind each binding type, see [Bindings in authentik](./index.md). +For the concepts behind each binding type, see [Bindings in authentik](./index.mdx). ## Choose the right task -| Task | Start here | Use when | -| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | -| Add a stage to a flow | [Bind a stage to a flow](../flows-stages/stages/index.md#bind-a-stage-to-a-flow) | You want a flow to include a stage. | -| Control whether a stage runs | [Bind users and groups to a flow's stage binding](../flows-stages/stages/index.md#bind-users-and-groups-to-a-flows-stage-binding) | You want a stage to run only for specific users or groups. | -| Attach a policy to a target | [Bind a policy to a flow, stage binding, application, or source](../../customize/policies/working_with_policies.md#bind-a-policy-to-a-flow-stage-application-or-source) | You want a policy to decide whether a target passes. | -| Control application access | [Use bindings to control access](../applications/manage_apps.mdx#use-bindings-to-control-access) | You want to limit who can view and launch an application. | -| Control access inside an application | [Create an application entitlement](../applications/manage_apps.mdx#create-an-application-entitlement) | You want to grant access to a feature, role, or area inside an app. | +| Task | Start here | Use when | +| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------- | +| Add a stage to a flow | [Bind a stage to a flow](../flows-stages/stages/index.mdx#bind-a-stage-to-a-flow) | You want a flow to include a stage. | +| Control whether a stage runs | [Bind users and groups to a flow's stage binding](../flows-stages/stages/index.mdx#bind-users-and-groups-to-a-flows-stage-binding) | You want a stage to run only for specific users or groups. | +| Attach a policy to a target | [Bind a policy to a flow, stage binding, application, or source](../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-flow-stage-application-or-source) | You want a policy to decide whether a target passes. | +| Control application access | [Use bindings to control access](../applications/manage_apps.mdx#use-bindings-to-control-access) | You want to limit who can view and launch an application. | +| Control access inside an application | [Create an application entitlement](../applications/manage_apps.mdx#create-an-application-entitlement) | You want to grant access to a feature, role, or area inside an app. | ## General workflow @@ -34,4 +34,4 @@ Flow-stage bindings use the **Stage Bindings** tab on a flow. From that tab, you - If an application has no bindings, all users can access it. - If another policy binding target has no applicable bindings, authentik treats the result as passing. - User and group bindings require authentik to know the current user. In authentication and enrollment flows, bind user- or group-based checks to a flow-stage binding after the user is identified. -- If a stage decision depends on data collected during the flow, enable **Evaluate when stage is run** on the flow-stage binding. For more information, see [Planning and stage policies](../flows-stages/flow/planner.md#planning-and-stage-policies). +- If a stage decision depends on data collected during the flow, enable **Evaluate when stage is run** on the flow-stage binding. For more information, see [Planning and stage policies](../flows-stages/flow/planner.mdx#planning-and-stage-policies). diff --git a/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx b/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx index a28dea4728..2c6b0911b5 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx +++ b/website/docs/add-secure-apps/flows-stages/flow/context/index.mdx @@ -13,7 +13,7 @@ For example, in the Identification Stage (part of the default login flow), you c Any data can be stored in the flow context, however there are some reserved keys in the context dictionary that are used by authentik stages. -To manage flow context on a more granular level, see [Setting flow context keys](../../../../customize/policies/types/expression/managing_flow_context_keys.md). +To manage flow context on a more granular level, see [Setting flow context keys](../../../../customize/policies/types/expression/managing_flow_context_keys.mdx). ## Context dictionary and reserved keys @@ -29,13 +29,13 @@ Keys prefixed with `goauthentik.io` are used internally by authentik and are sub #### `pending_user` ([User object](../../../../users-sources/user/user_ref.mdx#object-properties)) -`pending_user` is used by multiple stages. In the context of most flow executions, it represents the data of the user that is executing the flow. This value is not set automatically, it is set via the [Identification stage](../../stages/identification/index.md). +`pending_user` is used by multiple stages. In the context of most flow executions, it represents the data of the user that is executing the flow. This value is not set automatically, it is set via the [Identification stage](../../stages/identification/index.mdx). -Stages that require a user, such as the [Password stage](../../stages/password/index.md), the [Authenticator validation stage](../../stages/authenticator_validate/index.md), and others will use this value if it is set, and fall back to the request's user when possible. +Stages that require a user, such as the [Password stage](../../stages/password/index.mdx), the [Authenticator validation stage](../../stages/authenticator_validate/index.mdx), and others will use this value if it is set, and fall back to the request's user when possible. #### `prompt_data` (Dictionary) -`prompt_data` is primarily used by the [Prompt stage](../../stages/prompt/index.md). The value of any field within a prompt stage is written to the `prompt_data` dictionary. For example, given a field with the _Field key_ `email` that was submitted with the value `foo@bar.baz` will result in the following context: +`prompt_data` is primarily used by the [Prompt stage](../../stages/prompt/index.mdx). The value of any field within a prompt stage is written to the `prompt_data` dictionary. For example, given a field with the _Field key_ `email` that was submitted with the value `foo@bar.baz` will result in the following context: ```json { @@ -45,7 +45,7 @@ Stages that require a user, such as the [Password stage](../../stages/password/i } ``` -This data can be modified with policies. The data is also used by stages like [User write](../../stages/user_write/index.md), which takes data in `prompt_data` and writes it to `pending_user`. +This data can be modified with policies. The data is also used by stages like [User write](../../stages/user_write/index.mdx), which takes data in `prompt_data` and writes it to `pending_user`. #### `redirect` (string) @@ -65,7 +65,7 @@ When a user authenticates/enrolls via an external source, this will be set to th #### `outpost` (dictionary) -When a flow is executed by an Outpost (for example the [LDAP](../../../providers/ldap/index.md) or [RADIUS](../../../providers/radius/index.mdx)), this will be set to a dictionary containing the Outpost instance under the key `"instance"`. +When a flow is executed by an Outpost (for example the [LDAP](../../../providers/ldap/index.mdx) or [RADIUS](../../../providers/radius/index.mdx)), this will be set to a dictionary containing the Outpost instance under the key `"instance"`. ### Scenario-specific keys @@ -75,11 +75,11 @@ This key is set to `True` when the flow is executed from an "SSO" context. For e #### `is_restored` (Token object) -This key is set when a flow execution is continued from a token. This happens for example when an [Email stage](../../stages/email/index.md) is used and the user clicks on the link within the email. The token object contains the key that was used to restore the flow execution. This field is also used by the [Source stage](../../stages/source/index.md) when returning back to the initial flow the Source stage was run on. +This key is set when a flow execution is continued from a token. This happens for example when an [Email stage](../../stages/email/index.mdx) is used and the user clicks on the link within the email. The token object contains the key that was used to restore the flow execution. This field is also used by the [Source stage](../../stages/source/index.mdx) when returning back to the initial flow the Source stage was run on. #### `is_redirected` (Flow object) -This key is set when the current flow was reached through a [Redirect stage](../../stages/redirect/index.md) in Flow mode. +This key is set when the current flow was reached through a [Redirect stage](../../stages/redirect/index.mdx) in Flow mode. ### Stage-specific keys @@ -149,11 +149,11 @@ Type the `pending_user` will be created as. Must be one of `internal`, `external ##### `user_backend` (string) -Set by the [Password stage](../../stages/password/index.md) after successfully authenticating the user. Contains a dot-notation to the authentication backend that was used to successfully authenticate the user. +Set by the [Password stage](../../stages/password/index.mdx) after successfully authenticating the user. Contains a dot-notation to the authentication backend that was used to successfully authenticate the user. ##### `auth_method` (string) -Set by the [Password stage](../../stages/password/index.md), the [Authenticator validation stage](../../stages/authenticator_validate/index.md), the [OAuth2 Provider](../../../providers/oauth2/index.mdx), and the API authentication depending on which method was used to authenticate. +Set by the [Password stage](../../stages/password/index.mdx), the [Authenticator validation stage](../../stages/authenticator_validate/index.mdx), the [OAuth2 Provider](../../../providers/oauth2/index.mdx), and the API authentication depending on which method was used to authenticate. Possible options: @@ -163,7 +163,7 @@ Possible options: - `auth_mfa` (Authentication via MFA device without password) - `auth_webauthn_pwl` (Passwordless authentication via WebAuthn with Passkeys) - `jwt` ([M2M](../../../providers/oauth2/machine_to_machine.mdx) authentication via an existing JWT) -- `mtls` (Authentication via Certificate, see [Mutual TLS Stage](../../stages/mtls/index.md)) +- `mtls` (Authentication via Certificate, see [Mutual TLS Stage](../../stages/mtls/index.mdx)) ##### `auth_method_args` (dictionary) @@ -227,7 +227,7 @@ This value can be set either via [Prompt data](#prompt_data-dictionary) or via p ##### `redirect_stage_target` (string) -[Set this key](../../../../customize/policies/types/expression/managing_flow_context_keys.md) in an Expression Policy to override [Redirect stage](../../stages/redirect/index.md) to force it to redirect to a certain URL or flow. This is useful when a flow requires that the redirection target be decided dynamically. +[Set this key](../../../../customize/policies/types/expression/managing_flow_context_keys.mdx) in an Expression Policy to override [Redirect stage](../../stages/redirect/index.mdx) to force it to redirect to a certain URL or flow. This is useful when a flow requires that the redirection target be decided dynamically. Use the format `ak-flow://{slug}` to use the Redirect stage in Flow mode. Any other format will result in the Redirect stage running in Static mode. diff --git a/website/docs/add-secure-apps/flows-stages/flow/default-flows.md b/website/docs/add-secure-apps/flows-stages/flow/default-flows.md deleted file mode 100644 index 16d4c8a5b6..0000000000 --- a/website/docs/add-secure-apps/flows-stages/flow/default-flows.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: Default flows ---- - -When you create a new provider, you can select certain default flows that will be used with the provider and its associated application. For example, you can [create a flow](./index.md#create-a-flow) that overrides the defaults configured on the brand. - -If no default flow is selected when the provider is created, authentik will first check if there is a default flow configured in the active [**Brand**](../../../customize/branding/index.md). If no default is configured there, authentik will go through all flows with the matching designation, sorted by `slug`, evaluate policies bound directly to the flows, and pick the first flow whose policies allow access. - -import DefaultFlowList from "../flow/flow_list/\_defaultflowlist.mdx"; - - diff --git a/website/docs/add-secure-apps/flows-stages/flow/default-flows.mdx b/website/docs/add-secure-apps/flows-stages/flow/default-flows.mdx new file mode 100644 index 0000000000..1789d35234 --- /dev/null +++ b/website/docs/add-secure-apps/flows-stages/flow/default-flows.mdx @@ -0,0 +1,11 @@ +--- +title: Default flows +--- + +When you create a new provider, you can select certain default flows that will be used with the provider and its associated application. For example, you can [create a flow](./index.mdx#create-a-flow) that overrides the defaults configured on the brand. + +If no default flow is selected when the provider is created, authentik will first check if there is a default flow configured in the active [**Brand**](../../../customize/branding/index.mdx). If no default is configured there, authentik will go through all flows with the matching designation, sorted by `slug`, evaluate policies bound directly to the flows, and pick the first flow whose policies allow access. + +import DefaultFlowList from "../flow/flow_list/\_defaultflowlist.mdx"; + + diff --git a/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md b/website/docs/add-secure-apps/flows-stages/flow/examples/flows.mdx similarity index 97% rename from website/docs/add-secure-apps/flows-stages/flow/examples/flows.md rename to website/docs/add-secure-apps/flows-stages/flow/examples/flows.mdx index 575deaba11..0628bc9557 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/examples/flows.md +++ b/website/docs/add-secure-apps/flows-stages/flow/examples/flows.mdx @@ -50,7 +50,7 @@ Passwordless login flow that lets users sign in from a link sent to their email Before importing this flow, make sure that global email settings are configured and that users have valid email addresses. Use this flow only when access to the user's email inbox is an acceptable sign-in factor for your environment. -After import, review the Email stage binding in the flow. The example uses the built-in account confirmation email template. You can replace it with a [custom email template](../../stages/email/index.md#custom-templates) if you want the email text to match the magic-link login experience. +After import, review the Email stage binding in the flow. The example uses the built-in account confirmation email template. You can replace it with a [custom email template](../../stages/email/index.mdx#custom-templates) if you want the email text to match the magic-link login experience. ## Log in with conditional CAPTCHA diff --git a/website/docs/add-secure-apps/flows-stages/flow/executors/headless.md b/website/docs/add-secure-apps/flows-stages/flow/executors/headless.mdx similarity index 81% rename from website/docs/add-secure-apps/flows-stages/flow/executors/headless.md rename to website/docs/add-secure-apps/flows-stages/flow/executors/headless.mdx index 7422831a19..cfa7537752 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/executors/headless.md +++ b/website/docs/add-secure-apps/flows-stages/flow/executors/headless.mdx @@ -6,6 +6,6 @@ The headless flow executor is used by clients that don't have access to the web The following stages are supported: -- [**Identification stage**](../../stages/identification/index.md) -- [**Password stage**](../../stages/password/index.md) -- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.md) +- [**Identification stage**](../../stages/identification/index.mdx) +- [**Password stage**](../../stages/password/index.mdx) +- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.mdx) diff --git a/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md b/website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.mdx similarity index 100% rename from website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.md rename to website/docs/add-secure-apps/flows-stages/flow/executors/if-flow.mdx diff --git a/website/docs/add-secure-apps/flows-stages/flow/executors/sfe.md b/website/docs/add-secure-apps/flows-stages/flow/executors/sfe.mdx similarity index 79% rename from website/docs/add-secure-apps/flows-stages/flow/executors/sfe.md rename to website/docs/add-secure-apps/flows-stages/flow/executors/sfe.mdx index f482ffdf70..b825fe3311 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/executors/sfe.md +++ b/website/docs/add-secure-apps/flows-stages/flow/executors/sfe.mdx @@ -11,16 +11,16 @@ Currently this flow executor is automatically used for the following browsers: The following stages are supported: -- [**Identification stage**](../../stages/identification/index.md) +- [**Identification stage**](../../stages/identification/index.mdx) :::info Only user identifier and user identifier + password stage configurations are supported; sources and passwordless configurations are not supported. ::: -- [**Password stage**](../../stages/password/index.md) -- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.md) +- [**Password stage**](../../stages/password/index.mdx) +- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.mdx) -Compared to the [default flow executor](./if-flow.md), this flow executor does _not_ support the following features: +Compared to the [default flow executor](./if-flow.mdx), this flow executor does _not_ support the following features: - Localization - Theming (Dark / light themes) diff --git a/website/docs/add-secure-apps/flows-stages/flow/executors/user-settings.md b/website/docs/add-secure-apps/flows-stages/flow/executors/user-settings.mdx similarity index 91% rename from website/docs/add-secure-apps/flows-stages/flow/executors/user-settings.md rename to website/docs/add-secure-apps/flows-stages/flow/executors/user-settings.mdx index 9b81391089..b5b40e901a 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/executors/user-settings.md +++ b/website/docs/add-secure-apps/flows-stages/flow/executors/user-settings.mdx @@ -6,4 +6,4 @@ The user interface (/if/user/) uses a specialized flow executor to allow individ Because the stages in a flow can change during its execution, be aware that configuring this executor to use any stage type other than Prompt or User Write will automatically trigger a redirect to the standard executor. -An admin can customize which fields can be changed by the user by updating the default-user-settings-flow, or copying it to create a new flow with a Prompt Stage and a User Write Stage. Different variants of your flow can be applied to different [Brands](../../../../customize/branding/index.md) on the same authentik instance. +An admin can customize which fields can be changed by the user by updating the default-user-settings-flow, or copying it to create a new flow with a Prompt Stage and a User Write Stage. Different variants of your flow can be applied to different [Brands](../../../../customize/branding/index.mdx) on the same authentik instance. diff --git a/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx b/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx index 28081710f2..bc5a633ff1 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx +++ b/website/docs/add-secure-apps/flows-stages/flow/flow_list/_defaultflowlist.mdx @@ -1,18 +1,18 @@ -- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.md) stage, which attaches the staged user to the current session. +- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.mdx) stage, which attaches the staged user to the current session. - **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required. -- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.md) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write/index.md) stage, which either updates the currently staged user, or if none exists, creates a new one. +- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write/index.mdx) stage, which either updates the currently staged user, or if none exists, creates a new one. - **Invalidation**: designates a default flow to be used to invalidate a session. There are two default invalidation flows: - - `default-invalidation-flow`: Used when a user logs out directly from authentik. This flow **includes** a [**User Logout**](../../stages/user_logout/index.md) stage, which ends the authentik session and triggers [Single Logout](../../../providers/single-logout/index.md) for all connected applications. + - `default-invalidation-flow`: Used when a user logs out directly from authentik. This flow **includes** a [**User Logout**](../../stages/user_logout/index.mdx) stage, which ends the authentik session and triggers [Single Logout](../../../providers/single-logout/index.mdx) for all connected applications. - - `default-provider-invalidation-flow`: Used when a user logs out from an application (OIDC, SAML, Proxy, or RAC providers). By default, this flow does **not** include a User Logout stage, meaning only the specific application session ends while the authentik session remains active. For instructions on how to also end the authentik session when a user logs out from an application, see the [Single Logout documentation](../../../providers/single-logout/index.md#enable-full-single-logout-for-rp-initiated-logout). + - `default-provider-invalidation-flow`: Used when a user logs out from an application (OIDC, SAML, Proxy, or RAC providers). By default, this flow does **not** include a User Logout stage, meaning only the specific application session ends while the authentik session remains active. For instructions on how to also end the authentik session when a user logs out from an application, see the [Single Logout documentation](../../../providers/single-logout/index.mdx#enable-full-single-logout-for-rp-initiated-logout). You can also create custom invalidation flows with branded background images or different logout options. -- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.md) or [**CAPTCHA**](../../stages/captcha/index.md). Afterwards, use the [**Prompt**](../../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../../stages/user_write/index.md) stage to update the password. +- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.mdx) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.mdx). Afterwards, use the [**Prompt**](../../stages/prompt/index.mdx) stage to ask the user for a new password and the [**User Write**](../../stages/user_write/index.mdx) stage to update the password. - **Stage Configuration**: designates a flow for general setup. This designation doesn't impose any constraints on what you can do. For example, by default this designation is used to configure authenticators, like changing a password and setting up TOTP. -- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.md) or [**Captcha**](../../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../../stages/user_delete/index.md) stage. +- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.mdx). As a final stage, to delete the account, use the [**user_delete**](../../stages/user_delete/index.mdx) stage. diff --git a/website/docs/add-secure-apps/flows-stages/flow/index.md b/website/docs/add-secure-apps/flows-stages/flow/index.mdx similarity index 80% rename from website/docs/add-secure-apps/flows-stages/flow/index.md rename to website/docs/add-secure-apps/flows-stages/flow/index.mdx index 7a8ded3812..a63abadf18 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/index.md +++ b/website/docs/add-secure-apps/flows-stages/flow/index.mdx @@ -3,9 +3,9 @@ title: Flows sidebar_label: "Flows" --- -Flows are a major component in authentik. In conjunction with [stages](../stages/index.md) and [policies](../../../customize/policies/index.md), flows are at the heart of our system of building blocks, used to define and execute the workflows of authentication, authorization, enrollment, and user settings. +Flows are a major component in authentik. In conjunction with [stages](../stages/index.mdx) and [policies](../../../customize/policies/index.mdx), flows are at the heart of our system of building blocks, used to define and execute the workflows of authentication, authorization, enrollment, and user settings. -There are over a dozen default, out-of-the-box flows available in authentik. Users can decide if they already have everything they need with the [default flows](../flow/default-flows.md) or if they want to [create](#create-a-flow) their own customized flow, using the Admin interface, Terraform, or via the API. +There are over a dozen default, out-of-the-box flows available in authentik. Users can decide if they already have everything they need with the [default flows](../flow/default-flows.mdx) or if they want to [create](#create-a-flow) their own customized flow, using the Admin interface, Terraform, or via the API. A flow is a method of describing a sequence of stages. A stage represents a single verification or logic step. By connecting a series of stages within a flow (and optionally attaching policies as needed) you can build a highly flexible process for authenticating users, enrolling them, and more. @@ -21,11 +21,11 @@ When these stages are successfully completed, authentik logs in the user. By default, policies bound to stage bindings are evaluated dynamically, right before the stage is presented to the user. This flexibility allows the login process to continue, change, or stop, based on the success or failure of each policy. -You can change this behavior by enabling the **Evaluate when flow is planned** option on the stage binding. When this option is enabled, authentik uses the [Flow Planner](./planner.md) to evaluate the stage binding's policies when the flow starts, and includes the stage in the flow plan only if those policies pass. +You can change this behavior by enabling the **Evaluate when flow is planned** option on the stage binding. When this option is enabled, authentik uses the [Flow Planner](./planner.mdx) to evaluate the stage binding's policies when the flow starts, and includes the stage in the flow plan only if those policies pass. ## Policies and permissions -Flows can have [policies](../../../customize/policies/index.md) assigned to them. These policies determine if the current user is allowed to see and use this flow. +Flows can have [policies](../../../customize/policies/index.mdx) assigned to them. These policies determine if the current user is allowed to see and use this flow. Keep in mind that in certain circumstances, policies cannot match against users and groups as there is no authenticated user yet. @@ -35,7 +35,7 @@ Flows can be imported and exported (as [blueprints](../../../customize/blueprint Flows can be imported to add new functionality to existing flows, or to add a new custom flow. -You can download our [Example flows](./examples/flows.md) and then import them into your authentik instance, or create a new flow. +You can download our [Example flows](./examples/flows.mdx) and then import them into your authentik instance, or create a new flow. Starting with authentik 2022.8, flows are exported as YAML, but legacy JSON-based flows can still be imported. @@ -53,9 +53,9 @@ To create a flow, follow these steps: 2. In the Admin interface, navigate to **Flows and Stages > Flows**. 3. Click **New Flow**, define the flow using the [configuration settings](#flow-configuration-options) described below, and then click **Create Flow**. -After creating the flow, you can then [bind specific stages](../stages/index.md#bind-a-stage-to-a-flow) to the flow and [bind policies](../../../customize/policies/bindings.md) to the flow to further customize the user's log in and authentication process. +After creating the flow, you can then [bind specific stages](../stages/index.mdx#bind-a-stage-to-a-flow) to the flow and [bind policies](../../../customize/policies/bindings.mdx) to the flow to further customize the user's log in and authentication process. -To determine which flow should be used, authentik will first check which default authentication flow is configured in the active [**Brand**](../../../customize/branding/index.md). If no default is configured there, the policies in all flows with the matching designation are checked, and the first flow with matching policies sorted by `slug` will be used. +To determine which flow should be used, authentik will first check which default authentication flow is configured in the active [**Brand**](../../../customize/branding/index.mdx). If no default is configured there, the policies in all flows with the matching designation are checked, and the first flow with matching policies sorted by `slug` will be used. ## Flow configuration options @@ -75,7 +75,7 @@ import Defaultflowlist from "../flow/flow_list/\_defaultflowlist.mdx"; -**Authentication**: Using this option, you can configure whether the flow requires initial authentication or not, whether the user must be a superuser, if the flow can only be started after being redirected by a [Redirect stage](../stages/redirect/index.md), or if the flow requires an outpost. +**Authentication**: Using this option, you can configure whether the flow requires initial authentication or not, whether the user must be a superuser, if the flow can only be started after being redirected by a [Redirect stage](../stages/redirect/index.mdx), or if the flow requires an outpost. **Behavior settings**: @@ -96,7 +96,7 @@ import Defaultflowlist from "../flow/flow_list/\_defaultflowlist.mdx"; - **Layout**: select how the UI displays the flow when it is executed; with stacked elements, content left or right, and sidebar left or right. -- **Background**: optionally, select a background image for the UI presentation of the flow. This overrides any default background image configured in the [Branding settings](../../../customize/branding/index.md#branding-settings). See [File picker values](../../../customize/file-picker.md). +- **Background**: optionally, select a background image for the UI presentation of the flow. This overrides any default background image configured in the [Branding settings](../../../customize/branding/index.mdx#branding-settings). See [File picker values](../../../customize/file-picker.mdx). ## Edit or delete a flow diff --git a/website/docs/add-secure-apps/flows-stages/flow/inspector.md b/website/docs/add-secure-apps/flows-stages/flow/inspector.mdx similarity index 89% rename from website/docs/add-secure-apps/flows-stages/flow/inspector.md rename to website/docs/add-secure-apps/flows-stages/flow/inspector.mdx index 8abca183b0..c64c5e3765 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/inspector.md +++ b/website/docs/add-secure-apps/flows-stages/flow/inspector.mdx @@ -2,7 +2,7 @@ title: Flow Inspector --- -The Flow Inspector allows administrators to visually determine how custom flows work, inspect the current [flow context](./context/index.mdx) by stepping through the flow process and observing the Inspector with each step, and investigate issues. It shows details from the active [flow plan](./planner.md). +The Flow Inspector allows administrators to visually determine how custom flows work, inspect the current [flow context](./context/index.mdx) by stepping through the flow process and observing the Inspector with each step, and investigate issues. It shows details from the active [flow plan](./planner.mdx). As shown in the screenshot below, the Flow Inspector displays to the right, beside the selected flow (in this case, "Change Password"), with [information](#flow-inspector-details) about that specific flow and flow context. @@ -11,10 +11,10 @@ As shown in the screenshot below, the Flow Inspector displays to the right, besi ## Access the Flow Inspector :::warning -Be aware that when running a flow with the Inspector enabled, the flow is still executed normally. This means that, for example, a [User write](../stages/user_write/index.md) stage _will_ write user data. +Be aware that when running a flow with the Inspector enabled, the flow is still executed normally. This means that, for example, a [User write](../stages/user_write/index.mdx) stage _will_ write user data. ::: -The Inspector is accessible to users that have been granted the [permission](../../../users-sources/access-control/permissions.md) **Can inspect a Flow's execution**, either directly or through a role. Superusers can always inspect flow executions. +The Inspector is accessible to users that have been granted the [permission](../../../users-sources/access-control/permissions.mdx) **Can inspect a Flow's execution**, either directly or through a role. Superusers can always inspect flow executions. ### Manually run a flow with the Inspector @@ -30,13 +30,13 @@ The Inspector is accessible to users that have been granted the [permission](../ Alternatively, a user with the correct permission can launch the Inspector by adding the query parameter `?inspector` to the URL after the URL opens on a flow. -Users with permissions to access the Flow Inspector see a button in the top-right corner of the [default flow executor](./executors/if-flow.md) to open the Inspector. +Users with permissions to access the Flow Inspector see a button in the top-right corner of the [default flow executor](./executors/if-flow.mdx) to open the Inspector. When developing authentik with the debug mode enabled, the Inspector is enabled by default and can be accessed by both unauthenticated users and standard users. However, debug mode should only be used for the development of authentik. Unless you are a developer and need the more verbose error information, the best practice for using the Flow Inspector is to assign the permission, not use debug mode. :::info Troubleshooting -- If the Flow Inspector does not launch and a "Bad request" error displays, this is likely either because you selected a flow that has a policy bound directly to it that prevents access (so the Inspector won't open because the flow can't be executed) or because you do not have [view permission](../../../users-sources/access-control/manage_permissions.md#view-permissions) on that specific flow. +- If the Flow Inspector does not launch and a "Bad request" error displays, this is likely either because you selected a flow that has a policy bound directly to it that prevents access (so the Inspector won't open because the flow can't be executed) or because you do not have [view permission](../../../users-sources/access-control/manage_permissions.mdx#view-permissions) on that specific flow. ::: ### Flow Inspector details @@ -45,7 +45,7 @@ The following information is shown in the Inspector: #### Next stage -This is the currently planned next stage. Stages that are evaluated when they run can still be skipped before they are shown. For more information, see [Planning and stage policies](./planner.md#planning-and-stage-policies). +This is the currently planned next stage. Stages that are evaluated when they run can still be skipped before they are shown. For more information, see [Planning and stage policies](./planner.mdx#planning-and-stage-policies). The name and kind of the stage, as well as the unique ID, are shown. diff --git a/website/docs/add-secure-apps/flows-stages/flow/planner.md b/website/docs/add-secure-apps/flows-stages/flow/planner.mdx similarity index 81% rename from website/docs/add-secure-apps/flows-stages/flow/planner.md rename to website/docs/add-secure-apps/flows-stages/flow/planner.mdx index 1049a244da..cde31cfa49 100644 --- a/website/docs/add-secure-apps/flows-stages/flow/planner.md +++ b/website/docs/add-secure-apps/flows-stages/flow/planner.mdx @@ -2,7 +2,7 @@ title: Flow Planner --- -The Flow Planner is the component of authentik that takes a configured [flow](./index.md) and, for each incoming request for that flow, determines the specific stages to run and the order in which they will run. +The Flow Planner is the component of authentik that takes a configured [flow](./index.mdx) and, for each incoming request for that flow, determines the specific stages to run and the order in which they will run. A flow describes a sequence of stages and policies. A flow plan is the per-session execution plan derived from that flow after authentik evaluates the request, the user, and the policies bound to the flow and its stage bindings. @@ -16,7 +16,7 @@ When a flow is executed, authentik creates a flow plan and does the following: 4. Evaluates stage binding policies when **Evaluate when flow is planned** is enabled. 5. Stores the resulting ordered stage list and [flow context](./context/index.mdx) in the user's session. -The [flow executor](./executors/if-flow.md) then presents the first stage of the flow plan. When the stage completes successfully, authentik removes it from the flow plan and continues with the next stage. When no stages remain, the flow plan has completed. +The [flow executor](./executors/if-flow.mdx) then presents the first stage of the flow plan. When the stage completes successfully, authentik removes it from the flow plan and continues with the next stage. When no stages remain, the flow plan has completed. ## Planning and stage policies @@ -31,7 +31,7 @@ For example, a password stage usually depends on the user identified by an earli ## Inspect a plan -Use the [Flow Inspector](./inspector.md) to execute a flow and, while it executes, view the current stage, the next planned stage, the plan history, and the current plan context. +Use the [Flow Inspector](./inspector.mdx) to execute a flow and, while it executes, view the current stage, the next planned stage, the plan history, and the current plan context. The Flow Inspector is accessed via the Flow Overview page and is particularly useful for troubleshooting flows and determining why stage binding policies fail to pass. It's also useful to evaluate values for use in policies. diff --git a/website/docs/add-secure-apps/flows-stages/stages/account_lockdown/index.md b/website/docs/add-secure-apps/flows-stages/stages/account_lockdown/index.mdx similarity index 96% rename from website/docs/add-secure-apps/flows-stages/stages/account_lockdown/index.md rename to website/docs/add-secure-apps/flows-stages/stages/account_lockdown/index.mdx index c13b89291a..c202bf6447 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/account_lockdown/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/account_lockdown/index.mdx @@ -8,7 +8,7 @@ authentik_enterprise: true This stage performs destructive actions on a user account. Ensure the flow includes appropriate warnings and confirmation steps before this stage executes. ::: -The Account Lockdown stage executes security lockdown actions on a target user account. For the feature overview and usage instructions, see [Account Lockdown](../../../../security/account-lockdown.md). +The Account Lockdown stage executes security lockdown actions on a target user account. For the feature overview and usage instructions, see [Account Lockdown](../../../../security/account-lockdown.mdx). ## Stage behavior @@ -61,7 +61,7 @@ The completion flow must have **Authentication** set to **No authentication requ ## Events -Creates a **User Write** event with an account-lockdown action ID. Use [Notification Rules](../../../../sys-mgmt/events/index.md) to send alerts. To match account-lockdown events, use action `user_write` and query `context.action_id = "account_lockdown"`. +Creates a **User Write** event with an account-lockdown action ID. Use [Notification Rules](../../../../sys-mgmt/events/index.mdx) to send alerts. To match account-lockdown events, use action `user_write` and query `context.action_id = "account_lockdown"`. ```json { diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.mdx similarity index 93% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.mdx index 3c632ab2ec..567665a3d1 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_duo/index.mdx @@ -6,7 +6,7 @@ The Duo Authenticator Setup stage enrolls a Duo authenticator for the current us ## About the Duo authenticator setup stage -This stage connects authentik to Duo and stores a Duo-backed authenticator for the user. Duo can then be used with the [Authenticator Validation stage](../authenticator_validate/index.md). +This stage connects authentik to Duo and stores a Duo-backed authenticator for the user. Duo can then be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx). ## Configuration options @@ -22,7 +22,7 @@ This stage connects authentik to Duo and stores a Duo-backed authenticator for t Use this stage in an enrollment or user-settings flow where the user should enroll Duo. -To require Duo during authentication, add an [Authenticator Validation stage](../authenticator_validate/index.md) to the login flow and allow the **Duo** device class. +To require Duo during authentication, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the login flow and allow the **Duo** device class. ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_email/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_email/index.mdx similarity index 84% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_email/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_email/index.mdx index 927ce69ac1..f2090d70ec 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_email/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_email/index.mdx @@ -9,7 +9,7 @@ The Email Authenticator Setup stage registers an email-based authenticator for t During enrollment, the user supplies an email address if one is not already known, then confirms ownership by entering a one-time code. -The enrolled email address can later be used with the [Authenticator Validation stage](../authenticator_validate/index.md). +The enrolled email address can later be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx). ## Configuration options @@ -32,9 +32,9 @@ For SMTP requirements and global email delivery settings, see [Email configurati ## Custom templates -This stage supports custom email templates in the same way as the [Email stage](../email/index.md#custom-templates). Mount your custom templates into authentik's template directory, and they will appear in the stage's **Template** dropdown. +This stage supports custom email templates in the same way as the [Email stage](../email/index.mdx#custom-templates). Mount your custom templates into authentik's template directory, and they will appear in the stage's **Template** dropdown. -For the full mounting instructions (Docker Compose and Kubernetes), a list of available template variables, and an example template, see [Custom templates](../email/index.md#custom-templates) in the Email stage documentation. +For the full mounting instructions (Docker Compose and Kubernetes), a list of available template variables, and an example template, see [Custom templates](../email/index.mdx#custom-templates) in the Email stage documentation. :::info If a custom template does not appear in the **Template** selector, check the worker container logs. Templates are discovered when the stage configuration form loads. @@ -44,10 +44,10 @@ If a custom template does not appear in the **Template** selector, check the wor Use this stage in an enrollment or user-settings flow where the user should add an email authenticator. -To use the enrolled address during login, add an [Authenticator Validation stage](../authenticator_validate/index.md) to the authentication flow and allow the **Email** device class. +To use the enrolled address during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **Email** device class. ## Notes - If **Use global connection settings** is enabled, configure the global email settings first. See the installation docs for [Docker Compose](../../../../install-config/install/docker-compose#email-configuration-optional-but-recommended) and [Kubernetes](../../../../install-config/install/kubernetes#email-configuration-optional-but-recommended). -- This stage is separate from the general-purpose [Email stage](../email/index.md), which is used for email verification and recovery. +- This stage is separate from the general-purpose [Email stage](../email/index.mdx), which is used for email verification and recovery. - If the user already has an email address on their account, authentik can use that address during enrollment instead of prompting for a new address. diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.mdx similarity index 89% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.mdx index a54b8b24e0..5bbcb6a1dd 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_endpoint_gdtc/index.mdx @@ -5,14 +5,14 @@ support_level: deprecated --- :::warning Deprecated -This stage is deprecated in favor of the [Google Chrome connector](../../../../endpoint-devices/device-compliance/connectors/google-chrome.md) used with the [Endpoint Devices](../../../../endpoint-devices/index.mdx) feature set. +This stage is deprecated in favor of the [Google Chrome connector](../../../../endpoint-devices/device-compliance/connectors/google-chrome.mdx) used with the [Endpoint Devices](../../../../endpoint-devices/index.mdx) feature set. ::: The Google Chrome Device Trust Authenticator Stage verifies a Chrome browser by using the Chrome Verified Access API. ## About the Google Chrome Device Trust authenticator stage -This stage validates Chrome Enterprise Device Trust signals from the user's browser. Unlike other authenticator setup stages, it does not enroll a reusable MFA device for later validation through the [Authenticator Validation stage](../authenticator_validate/index.md). +This stage validates Chrome Enterprise Device Trust signals from the user's browser. Unlike other authenticator setup stages, it does not enroll a reusable MFA device for later validation through the [Authenticator Validation stage](../authenticator_validate/index.mdx). It was designed to integrate Chrome browsers and ChromeOS devices with authentik as the identity provider so access decisions could take device posture into account. @@ -28,7 +28,7 @@ Typical use cases included remote-work, contractor, and BYOD environments where Bind this stage directly into a flow where Chrome browser verification should happen. -Compared to the newer [Endpoint stage](../endpoint/index.md), this stage is Chrome-specific and relies on the legacy Device Trust integration path. +Compared to the newer [Endpoint stage](../endpoint/index.mdx), this stage is Chrome-specific and relies on the legacy Device Trust integration path. ## Notes @@ -61,4 +61,4 @@ More concretely: ### Why this stage is different -This stage verifies the current Chrome browser directly and does not create a reusable MFA enrollment that is later selected by the Authenticator Validation stage. That difference is why the newer [Endpoint stage](../endpoint/index.md) is a better long-term replacement for most deployments. +This stage verifies the current Chrome browser directly and does not create a reusable MFA enrollment that is later selected by the Authenticator Validation stage. That difference is why the newer [Endpoint stage](../endpoint/index.mdx) is a better long-term replacement for most deployments. diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.mdx similarity index 88% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.mdx index 44a80f3741..ee6516da22 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_sms/index.mdx @@ -8,7 +8,7 @@ The SMS Authenticator Setup stage enrolls an SMS-based authenticator for the cur This stage stores a phone number, enabling one-time codes to be sent via SMS. -In normal mode, the enrolled phone number can later be used with the [Authenticator Validation stage](../authenticator_validate/index.md). In **verify only** mode, the stage only verifies ownership of a phone number during enrollment and stores a hash instead of the number itself. +In normal mode, the enrolled phone number can later be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx). In **verify only** mode, the stage only verifies ownership of a phone number during enrollment and stores a hash instead of the number itself. ## Configuration options @@ -27,9 +27,9 @@ In normal mode, the enrolled phone number can later be used with the [Authentica Use this stage in an enrollment or user-settings flow where the user should add an SMS authenticator. -To require SMS during login, add an [Authenticator Validation stage](../authenticator_validate/index.md) to the authentication flow and allow the **SMS** device class. +To require SMS during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **SMS** device class. -If you enable **Verify only**, phone numbers enrolled through this stage cannot be used by the [Authenticator Validation stage](../authenticator_validate/index.md). +If you enable **Verify only**, phone numbers enrolled through this stage cannot be used by the [Authenticator Validation stage](../authenticator_validate/index.mdx). ## Notes @@ -86,7 +86,7 @@ return { ### Limiting phone numbers -To control which phone numbers are accepted, collect the number in a [Prompt stage](../prompt/index.md) and validate it with an expression policy before this stage runs. If a prompt field uses the key `phone`, the SMS setup stage will read that value from `prompt_data` instead of prompting the user again. +To control which phone numbers are accepted, collect the number in a [Prompt stage](../prompt/index.mdx) and validate it with an expression policy before this stage runs. If a prompt field uses the key `phone`, the SMS setup stage will read that value from `prompt_data` instead of prompting the user again. Example expression policy: diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_static/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_static/index.mdx similarity index 85% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_static/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_static/index.mdx index 37af495bd3..3c4f75bb0e 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_static/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_static/index.mdx @@ -8,7 +8,7 @@ The Static Authenticator Setup stage creates one-time backup codes for a user. T This stage enrolls static backup codes for the current user and generates a set of recovery codes. Each code can be used once. -Because static codes are a device class supported by the [Authenticator Validation stage](../authenticator_validate/index.md), they are usually added as a backup factor rather than the primary factor. +Because static codes are a device class supported by the [Authenticator Validation stage](../authenticator_validate/index.mdx), they are usually added as a backup factor rather than the primary factor. ## Configuration options @@ -21,7 +21,7 @@ Because static codes are a device class supported by the [Authenticator Validati Use this stage in an enrollment or user-settings flow where the user is already authenticated or otherwise identified. -To use the generated backup codes during authentication, add an [Authenticator Validation stage](../authenticator_validate/index.md) to the login flow and allow the **Static** device class. +To use the generated backup codes during authentication, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the login flow and allow the **Static** device class. ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_totp/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_totp/index.mdx similarity index 87% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_totp/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_totp/index.mdx index b44682f3ba..5ead6c7cff 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_totp/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_totp/index.mdx @@ -8,7 +8,7 @@ The TOTP Authenticator Setup stage enrolls a time-based one-time password authen This stage creates a TOTP authenticator for the current user and presents a standard OTP configuration URL that authenticator apps can scan or import. -The enrolled TOTP authenticator can then be used with the [Authenticator Validation stage](../authenticator_validate/index.md). +The enrolled TOTP authenticator can then be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx). ## Configuration options @@ -20,7 +20,7 @@ The enrolled TOTP authenticator can then be used with the [Authenticator Validat Use this stage in an enrollment or user-settings flow where the user can add a TOTP authenticator. -To require that authenticator during login, add an [Authenticator Validation stage](../authenticator_validate/index.md) to the authentication flow and allow the **TOTP** device class. +To require that authenticator during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **TOTP** device class. ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_validate/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx similarity index 94% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_validate/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx index 1643aa7221..847cca4109 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_validate/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx @@ -8,12 +8,12 @@ The Authenticator Validation stage validates an already enrolled authenticator. This stage is used during authentication after a user has already enrolled one or more authenticators with a setup stage, such as: -- [Duo Authenticator Setup stage](../authenticator_duo/index.md) -- [Email Authenticator Setup stage](../authenticator_email/index.md) -- [SMS Authenticator Setup stage](../authenticator_sms/index.md) -- [Static Authenticator Setup stage](../authenticator_static/index.md) -- [TOTP Authenticator Setup stage](../authenticator_totp/index.md) -- [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.md) +- [Duo Authenticator Setup stage](../authenticator_duo/index.mdx) +- [Email Authenticator Setup stage](../authenticator_email/index.mdx) +- [SMS Authenticator Setup stage](../authenticator_sms/index.mdx) +- [Static Authenticator Setup stage](../authenticator_static/index.mdx) +- [TOTP Authenticator Setup stage](../authenticator_totp/index.mdx) +- [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.mdx) ## Configuration options @@ -34,7 +34,7 @@ This stage is used during authentication after a user has already enrolled one o ## Flow integration -This stage normally appears in authentication flows after [Identification](../identification/index.md) and [Password](../password/index.md), and before [User Login](../user_login/index.md). +This stage normally appears in authentication flows after [Identification](../identification/index.mdx) and [Password](../password/index.mdx), and before [User Login](../user_login/index.mdx). If **Not configured action** is set to **Configure**, the stage can bootstrap enrollment by injecting one or more authenticator setup stages into the running flow. @@ -103,9 +103,9 @@ To build a dedicated passwordless flow: 1. Create an **Authentication** flow. 2. Add an Authenticator Validation stage that allows the **WebAuthn** device class. 3. Add any extra verification stages you still require. -4. End the flow with a [User Login stage](../user_login/index.md). +4. End the flow with a [User Login stage](../user_login/index.mdx). -If you want users to choose a passkey directly from the browser's autofill UI on the identification screen, configure **Passkey autofill** in the [Identification stage](../identification/index.md#passkey-autofill-webauthn-conditional-ui). This requires a discoverable credential, also known as a resident key. +If you want users to choose a passkey directly from the browser's autofill UI on the identification screen, configure **Passkey autofill** in the [Identification stage](../identification/index.mdx#passkey-autofill-webauthn-conditional-ui). This requires a discoverable credential, also known as a resident key. Users can either access the passwordless flow directly or reach it through an Identification stage's **Passwordless flow** link. @@ -133,7 +133,7 @@ If the user has multiple compatible authenticators, authentik lets them choose o The available device-type entries are populated from the [FIDO Alliance Metadata Service](https://fidoalliance.org/metadata/) data and additional AAGUID metadata bundled with the authentik release. This is useful when you need to limit authentication to specific hardware families or compliance profiles. -These restrictions only apply to WebAuthn devices that have a stored device type. Devices enrolled in authentik 2024.4 or later store this information when the authenticator returns a known AAGUID. Older WebAuthn enrollments or devices without a stored type cannot be matched by this filter. To enforce a device-type policy for enrollment and later authentication, configure the same allowlist on the [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.md) and have users re-enroll devices that predate stored device types. +These restrictions only apply to WebAuthn devices that have a stored device type. Devices enrolled in authentik 2024.4 or later store this information when the authenticator returns a known AAGUID. Older WebAuthn enrollments or devices without a stored type cannot be matched by this filter. To enforce a device-type policy for enrollment and later authentication, configure the same allowlist on the [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.mdx) and have users re-enroll devices that predate stored device types. ### Throttling diff --git a/website/docs/add-secure-apps/flows-stages/stages/authenticator_webauthn/index.md b/website/docs/add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx similarity index 94% rename from website/docs/add-secure-apps/flows-stages/stages/authenticator_webauthn/index.md rename to website/docs/add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx index fb292954fc..c9237afcb9 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/authenticator_webauthn/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx @@ -12,7 +12,7 @@ This stage supports common WebAuthn authenticator types, including: - platform authenticators such as Windows Hello, Touch ID, or Face ID - passkeys stored by operating systems or password managers -Enrolled authenticators can later be used with the [Authenticator Validation stage](../authenticator_validate/index.md). +Enrolled authenticators can later be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx). ## Configuration options @@ -29,9 +29,9 @@ Enrolled authenticators can later be used with the [Authenticator Validation sta Use this stage in an enrollment or user-settings flow where the user should register a passkey or hardware key. -To require those devices during login, add an [Authenticator Validation stage](../authenticator_validate/index.md) to the authentication flow and allow the **WebAuthn** device class. +To require those devices during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **WebAuthn** device class. -If you want passkey autofill on the login form itself, configure the [Identification stage](../identification/index.md#passkey-autofill-webauthn-conditional-ui) to reference a WebAuthn-capable Authenticator Validation stage. +If you want passkey autofill on the login form itself, configure the [Identification stage](../identification/index.mdx#passkey-autofill-webauthn-conditional-ui) to reference a WebAuthn-capable Authenticator Validation stage. ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/captcha/index.md b/website/docs/add-secure-apps/flows-stages/stages/captcha/index.mdx similarity index 95% rename from website/docs/add-secure-apps/flows-stages/stages/captcha/index.md rename to website/docs/add-secure-apps/flows-stages/stages/captcha/index.mdx index ee22378f31..dd1d71aa97 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/captcha/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/captcha/index.mdx @@ -8,7 +8,7 @@ The Captcha stage adds CAPTCHA verification to a flow by using Google reCAPTCHA This stage verifies that the current interaction appears human before the flow continues. -It can either be bound to a flow or embedded inside the [Identification stage](../identification/index.md) by setting the Identification stage's **Captcha stage** option. +It can either be bound to a flow or embedded inside the [Identification stage](../identification/index.mdx) by setting the Identification stage's **Captcha stage** option. ## Configuration options @@ -26,7 +26,7 @@ It can either be bound to a flow or embedded inside the [Identification stage](. Use this stage anywhere a flow should require a CAPTCHA check, especially in enrollment, recovery, or other public-facing flows. -If you embed it in the [Identification stage](../identification/index.md), configure the CAPTCHA provider for invisible or background use. +If you embed it in the [Identification stage](../identification/index.mdx), configure the CAPTCHA provider for invisible or background use. ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/consent/index.md b/website/docs/add-secure-apps/flows-stages/stages/consent/index.mdx similarity index 100% rename from website/docs/add-secure-apps/flows-stages/stages/consent/index.md rename to website/docs/add-secure-apps/flows-stages/stages/consent/index.mdx diff --git a/website/docs/add-secure-apps/flows-stages/stages/deny/index.md b/website/docs/add-secure-apps/flows-stages/stages/deny/index.mdx similarity index 95% rename from website/docs/add-secure-apps/flows-stages/stages/deny/index.md rename to website/docs/add-secure-apps/flows-stages/stages/deny/index.mdx index 2f858fd567..9809c040c7 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/deny/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/deny/index.mdx @@ -19,7 +19,7 @@ Bind this stage where a flow should stop after a policy or earlier stage determi ## Notes :::caution -To use this stage effectively, make sure **Evaluate when flow is planned** is disabled on the stage binding. See [Planning and stage policies](../../flow/planner.md#planning-and-stage-policies). +To use this stage effectively, make sure **Evaluate when flow is planned** is disabled on the stage binding. See [Planning and stage policies](../../flow/planner.mdx#planning-and-stage-policies). ::: If the binding is evaluated during flow planning, the denial can happen earlier than intended and skip the checks that were meant to decide whether the user should be denied. diff --git a/website/docs/add-secure-apps/flows-stages/stages/email/index.md b/website/docs/add-secure-apps/flows-stages/stages/email/index.mdx similarity index 100% rename from website/docs/add-secure-apps/flows-stages/stages/email/index.md rename to website/docs/add-secure-apps/flows-stages/stages/email/index.mdx diff --git a/website/docs/add-secure-apps/flows-stages/stages/endpoint/index.md b/website/docs/add-secure-apps/flows-stages/stages/endpoint/index.mdx similarity index 100% rename from website/docs/add-secure-apps/flows-stages/stages/endpoint/index.md rename to website/docs/add-secure-apps/flows-stages/stages/endpoint/index.mdx diff --git a/website/docs/add-secure-apps/flows-stages/stages/identification/index.md b/website/docs/add-secure-apps/flows-stages/stages/identification/index.mdx similarity index 92% rename from website/docs/add-secure-apps/flows-stages/stages/identification/index.md rename to website/docs/add-secure-apps/flows-stages/stages/identification/index.mdx index 101e5f355e..02e101d7c9 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/identification/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/identification/index.mdx @@ -14,9 +14,9 @@ This stage lets the user identify themselves by username, email address, UPN, or - **Username** - **Email** - **UPN** -- **Password stage**: optional [Password stage](../password/index.md) to render inline instead of as a separate step. -- **Captcha stage**: optional [Captcha stage](../captcha/index.md) to run as part of identification. -- **WebAuthn Authenticator Validation Stage**: optional [Authenticator Validation stage](../authenticator_validate/index.md) used for passkey autofill. +- **Password stage**: optional [Password stage](../password/index.mdx) to render inline instead of as a separate step. +- **Captcha stage**: optional [Captcha stage](../captcha/index.mdx) to run as part of identification. +- **WebAuthn Authenticator Validation Stage**: optional [Authenticator Validation stage](../authenticator_validate/index.mdx) used for passkey autofill. - **Case-insensitive matching**: match identifiers regardless of case. - **Show matched user**: display the matched user's username and avatar after a valid identifier is entered. - **Pretend user exists**: continue even when the entered identifier does not match a real user. @@ -51,7 +51,7 @@ If you set a **Captcha stage** here, configure that CAPTCHA for invisible or bac ### Pretend user exists -When enabled, invalid identifiers still let the flow continue as long as the format is valid for the selected field type. Stages such as [Password](../password/index.md) and [Email](../email/index.md) are aware of this behavior and handle the synthetic pending user safely. +When enabled, invalid identifiers still let the flow continue as long as the format is valid for the selected field type. Stages such as [Password](../password/index.mdx) and [Email](../email/index.mdx) are aware of this behavior and handle the synthetic pending user safely. ### Source behavior @@ -82,9 +82,9 @@ authentik automatically falls back to the normal identification flow when passke #### Configuration -1. Create or edit an [Authenticator Validation stage](../authenticator_validate/index.md) that allows the **WebAuthn** device class. +1. Create or edit an [Authenticator Validation stage](../authenticator_validate/index.mdx) that allows the **WebAuthn** device class. 2. Set the Identification stage's **WebAuthn Authenticator Validation Stage** to that stage. -3. Make sure users have already enrolled a WebAuthn authenticator, for example with the [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.md). +3. Make sure users have already enrolled a WebAuthn authenticator, for example with the [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.mdx). If the user has multiple passkeys, the browser shows its own picker. In the default authentication flow, authentik skips the MFA validation stage after a passkey login with an expression policy; adjust that policy if you still want a second factor after passkey login. diff --git a/website/docs/add-secure-apps/flows-stages/stages/index.md b/website/docs/add-secure-apps/flows-stages/stages/index.mdx similarity index 91% rename from website/docs/add-secure-apps/flows-stages/stages/index.md rename to website/docs/add-secure-apps/flows-stages/stages/index.mdx index ccf1a9631a..026589b69d 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/index.mdx @@ -2,7 +2,7 @@ title: Stages --- -Stages are one of the fundamental building blocks in authentik, along with [flows](../flow/index.md) and [policies](../../../customize/policies/index.md). +Stages are one of the fundamental building blocks in authentik, along with [flows](../flow/index.mdx) and [policies](../../../customize/policies/index.mdx). A stage represents a single verification or logic step within a flow. You can bind one or more stages to a flow to create a customized, flexible login and authentication process. @@ -49,12 +49,12 @@ After creating the stage, you can use bindings to determine whether the stage ru A stage binding connects a stage to a flow. The binding adds that stage as a step in the flow. -You can use bindings to determine which [stages](../stages/index.md) are presented to a user or group. +You can use bindings to determine which [stages](../stages/index.mdx) are presented to a user or group. -For an overview of binding types and behavior, see [Bindings in authentik](../../bindings-overview/index.md). +For an overview of binding types and behavior, see [Bindings in authentik](../../bindings-overview/index.mdx). :::info -Some stages and flows do not allow user or group bindings. In some authentication or enrollment scenarios, the [flow plan](../flow/planner.md) does not yet know the current user or group. +Some stages and flows do not allow user or group bindings. In some authentication or enrollment scenarios, the [flow plan](../flow/planner.mdx) does not yet know the current user or group. ::: ### Bind a stage to a flow @@ -72,7 +72,7 @@ To bind a stage to a flow, follow these steps: There are several ways to control access to a specific stage of a flow: -- Bind a policy to a stage binding. See [Bind a policy to a stage binding](../../../customize/policies/working_with_policies.md#bind-a-policy-to-a-stage-binding). +- Bind a policy to a stage binding. See [Bind a policy to a stage binding](../../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-stage-binding). - Bind a user or group to the stage binding. See [Bind users and groups to a flow's stage binding](#bind-users-and-groups-to-a-flows-stage-binding). ### Bind users and groups to a flow's stage binding @@ -91,4 +91,4 @@ To bind a user or a group to a stage binding for a specific flow, follow these s 8. In the drop-down list, select the group or user. 9. Optionally, configure additional settings for the binding, and then click **Create** to create the binding and close the box. -Learn more about the different types of [bindings](../../bindings-overview/index.md) in authentik and [working with them](../../bindings-overview/work-with-bindings.md). +Learn more about the different types of [bindings](../../bindings-overview/index.mdx) in authentik and [working with them](../../bindings-overview/work-with-bindings.mdx). diff --git a/website/docs/add-secure-apps/flows-stages/stages/invitation/index.md b/website/docs/add-secure-apps/flows-stages/stages/invitation/index.mdx similarity index 95% rename from website/docs/add-secure-apps/flows-stages/stages/invitation/index.md rename to website/docs/add-secure-apps/flows-stages/stages/invitation/index.mdx index dc8dda8a8e..c328306899 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/invitation/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/invitation/index.mdx @@ -24,7 +24,7 @@ Users can enter the flow with an invitation token by using a URL like: https://authentik.example/if/flow/your-enrollment-flow/?itoken=invitation-token ``` -You can also collect the token with a [Prompt stage](../prompt/index.md) by using a prompt field with the key `token`. +You can also collect the token with a [Prompt stage](../prompt/index.mdx) by using a prompt field with the key `token`. ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/mtls/index.md b/website/docs/add-secure-apps/flows-stages/stages/mtls/index.mdx similarity index 98% rename from website/docs/add-secure-apps/flows-stages/stages/mtls/index.md rename to website/docs/add-secure-apps/flows-stages/stages/mtls/index.mdx index 093cb06ab4..5ab373d425 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/mtls/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/mtls/index.mdx @@ -97,7 +97,7 @@ See the [Envoy mTLS documentation](https://www.envoyproxy.io/docs/envoy/latest/s #### No reverse proxy -If authentik terminates TLS itself, configure the trusted client certificate authorities on the active [brand](../../../../customize/branding/index.md#client-certificates). +If authentik terminates TLS itself, configure the trusted client certificate authorities on the active [brand](../../../../customize/branding/index.mdx#client-certificates). ### Stage setup outline diff --git a/website/docs/add-secure-apps/flows-stages/stages/password/index.md b/website/docs/add-secure-apps/flows-stages/stages/password/index.mdx similarity index 84% rename from website/docs/add-secure-apps/flows-stages/stages/password/index.md rename to website/docs/add-secure-apps/flows-stages/stages/password/index.mdx index c704ce08ae..7b35df6eb2 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/password/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/password/index.mdx @@ -23,9 +23,9 @@ The stage supports authentik's built-in password database, app passwords, LDAP-b ## Flow integration -This stage is typically bound after an [Identification](../identification/index.md) stage and before an [Authenticator Validation](../authenticator_validate/index.md) or [User Login](../user_login/index.md) stage. +This stage is typically bound after an [Identification](../identification/index.mdx) stage and before an [Authenticator Validation](../authenticator_validate/index.mdx) or [User Login](../user_login/index.mdx) stage. -If the [Identification stage](../identification/index.md) has its **Password stage** option set, the password prompt is rendered as part of the identification step and the Password stage should not also be bound separately in the same flow. +If the [Identification stage](../identification/index.mdx) has its **Password stage** option set, the password prompt is rendered as part of the identification step and the Password stage should not also be bound separately in the same flow. ## Notes @@ -37,10 +37,10 @@ Service accounts have automatically generated app passwords. Those can be viewed There are two common ways to avoid prompting for a password: -- Use an [Authenticator Validation](../authenticator_validate/index.md#passwordless-authentication) stage with WebAuthn for a dedicated passwordless flow. +- Use an [Authenticator Validation](../authenticator_validate/index.mdx#passwordless-authentication) stage with WebAuthn for a dedicated passwordless flow. - Conditionally skip the Password stage by binding a policy to its stage binding. -If you want users to be able to pick a passkey from the browser's passkey/autofill UI without entering a username first, configure **Passkey autofill (WebAuthn conditional UI)** in the [Identification stage](../identification/index.md#passkey-autofill-webauthn-conditional-ui). This is separate from configuring a dedicated passwordless flow, and can be used alongside normal identification flows. +If you want users to be able to pick a passkey from the browser's passkey/autofill UI without entering a username first, configure **Passkey autofill (WebAuthn conditional UI)** in the [Identification stage](../identification/index.mdx#passkey-autofill-webauthn-conditional-ui). This is separate from configuring a dedicated passwordless flow, and can be used alongside normal identification flows. ### Dynamically skip a Password stage @@ -52,8 +52,8 @@ To configure this setup: 2. Navigate to **Customization** > **Policies** and create an [Expression Policy](../../../../customize/policies/types/expression/index.mdx). 3. Configure the expression so that it returns `True` only when the Password stage should run. Use one of the expressions below, depending on the authenticator type. 4. Navigate to **Flows and Stages** > **Flows** and open your authentication flow. -5. Open the **Stage Bindings** tab, expand the Password stage binding, and bind the Expression Policy there. Do not bind it to the flow itself or directly to the stage object. For more background, see [Bind a policy to a stage binding](../../../../customize/policies/working_with_policies.md#bind-a-policy-to-a-stage-binding). -6. On the Password stage binding, enable **Evaluate when stage is run**. Disable **Evaluate when flow is planned** unless the user is already known before the flow starts. See [Planning and stage policies](../../flow/planner.md#planning-and-stage-policies). +5. Open the **Stage Bindings** tab, expand the Password stage binding, and bind the Expression Policy there. Do not bind it to the flow itself or directly to the stage object. For more background, see [Bind a policy to a stage binding](../../../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-stage-binding). +6. On the Password stage binding, enable **Evaluate when stage is run**. Disable **Evaluate when flow is planned** unless the user is already known before the flow starts. See [Planning and stage policies](../../flow/planner.mdx#planning-and-stage-policies). #### WebAuthn diff --git a/website/docs/add-secure-apps/flows-stages/stages/prompt/index.md b/website/docs/add-secure-apps/flows-stages/stages/prompt/index.mdx similarity index 96% rename from website/docs/add-secure-apps/flows-stages/stages/prompt/index.md rename to website/docs/add-secure-apps/flows-stages/stages/prompt/index.mdx index 57ade4c08c..9375319e45 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/prompt/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/prompt/index.mdx @@ -70,8 +70,8 @@ Use this stage anywhere a flow needs user-provided input. Common follow-ups include: -- A [User Write](../user_write/index.md) stage to persist collected values -- An [Email](../email/index.md) or [Invitation](../invitation/index.md) stage to act on collected data +- A [User Write](../user_write/index.mdx) stage to persist collected values +- An [Email](../email/index.mdx) or [Invitation](../invitation/index.mdx) stage to act on collected data - Policy checks that read from `request.context["prompt_data"]` ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/redirect/index.md b/website/docs/add-secure-apps/flows-stages/stages/redirect/index.mdx similarity index 100% rename from website/docs/add-secure-apps/flows-stages/stages/redirect/index.md rename to website/docs/add-secure-apps/flows-stages/stages/redirect/index.mdx diff --git a/website/docs/add-secure-apps/flows-stages/stages/source/index.md b/website/docs/add-secure-apps/flows-stages/stages/source/index.mdx similarity index 79% rename from website/docs/add-secure-apps/flows-stages/stages/source/index.md rename to website/docs/add-secure-apps/flows-stages/stages/source/index.mdx index 65018ceadf..cff9b3042e 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/source/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/source/index.mdx @@ -3,7 +3,7 @@ title: Source stage authentik_enterprise: true --- -The Source stage sends the user to an [OAuth](../../../../users-sources/sources/protocols/oauth/index.mdx) or [SAML](../../../../users-sources/sources/protocols/saml/index.md) source before returning to the flow. +The Source stage sends the user to an [OAuth](../../../../users-sources/sources/protocols/oauth/index.mdx) or [SAML](../../../../users-sources/sources/protocols/saml/index.mdx) source before returning to the flow. ## About the source stage @@ -11,11 +11,11 @@ Use this stage when an external identity provider should be part of the current Common examples include: -- Authenticating against a legacy IdP such as [Microsoft Entra ID](../../../../users-sources/sources/social-logins/entra-id/oauth/index.mdx), [Google Workspace](../../../../users-sources/sources/social-logins/google/workspace/index.md), or [Okta](../../../../users-sources/sources/social-logins/okta/index.md) during an IdP migration and then using the returned identity and attributes inside authentik +- Authenticating against a legacy IdP such as [Microsoft Entra ID](../../../../users-sources/sources/social-logins/entra-id/oauth/index.mdx), [Google Workspace](../../../../users-sources/sources/social-logins/google/workspace/index.mdx), or [Okta](../../../../users-sources/sources/social-logins/okta/index.mdx) during an IdP migration and then using the returned identity and attributes inside authentik - Routing users through an external OAuth or SAML identity provider - Sending users through a custom device-health or posture-check system before continuing -For pure authentication or enrollment, an [OAuth](../../../../users-sources/sources/protocols/oauth/index.mdx) or [SAML](../../../../users-sources/sources/protocols/saml/index.md) source can also be used directly without a Source stage. Use the Source stage when that external step needs to be embedded inside another authentik flow. +For pure authentication or enrollment, an [OAuth](../../../../users-sources/sources/protocols/oauth/index.mdx) or [SAML](../../../../users-sources/sources/protocols/saml/index.mdx) source can also be used directly without a Source stage. Use the Source stage when that external step needs to be embedded inside another authentik flow. ## Configuration options @@ -32,7 +32,7 @@ The configured source must be a browser-based source such as OAuth or SAML. LDAP ### Important source-flow behavior -Do not bind a [User Login stage](../user_login/index.md) to the source's own authentication or enrollment flow. +Do not bind a [User Login stage](../user_login/index.mdx) to the source's own authentication or enrollment flow. The Source stage resumes the original flow by appending a dynamic in-memory stage to the source flow. If the source flow logs the user in directly, the original flow will not resume correctly. diff --git a/website/docs/add-secure-apps/flows-stages/stages/user_delete/index.md b/website/docs/add-secure-apps/flows-stages/stages/user_delete/index.mdx similarity index 100% rename from website/docs/add-secure-apps/flows-stages/stages/user_delete/index.md rename to website/docs/add-secure-apps/flows-stages/stages/user_delete/index.mdx diff --git a/website/docs/add-secure-apps/flows-stages/stages/user_login/index.md b/website/docs/add-secure-apps/flows-stages/stages/user_login/index.mdx similarity index 94% rename from website/docs/add-secure-apps/flows-stages/stages/user_login/index.md rename to website/docs/add-secure-apps/flows-stages/stages/user_login/index.mdx index f1bb154e9f..af8cf260d2 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/user_login/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/user_login/index.mdx @@ -24,8 +24,8 @@ Use this stage near the end of flows that should create an authenticated browser Common placements include: -- after a [Password](../password/index.md) or [Authenticator Validation](../authenticator_validate/index.md) stage in authentication flows -- after a [User Write](../user_write/index.md) stage in enrollment flows +- after a [Password](../password/index.mdx) or [Authenticator Validation](../authenticator_validate/index.mdx) stage in authentication flows +- after a [User Write](../user_write/index.mdx) stage in enrollment flows ## Notes diff --git a/website/docs/add-secure-apps/flows-stages/stages/user_logout/index.md b/website/docs/add-secure-apps/flows-stages/stages/user_logout/index.mdx similarity index 98% rename from website/docs/add-secure-apps/flows-stages/stages/user_logout/index.md rename to website/docs/add-secure-apps/flows-stages/stages/user_logout/index.mdx index d3b2eda196..2cdf7a5de3 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/user_logout/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/user_logout/index.mdx @@ -2,7 +2,7 @@ title: User logout stage --- -The User Logout stage ends the user's authentik session and, if configured, initiates [Single Logout](../../../providers/single-logout/index.md). +The User Logout stage ends the user's authentik session and, if configured, initiates [Single Logout](../../../providers/single-logout/index.mdx). ## About the user logout stage diff --git a/website/docs/add-secure-apps/flows-stages/stages/user_write/index.md b/website/docs/add-secure-apps/flows-stages/stages/user_write/index.mdx similarity index 81% rename from website/docs/add-secure-apps/flows-stages/stages/user_write/index.md rename to website/docs/add-secure-apps/flows-stages/stages/user_write/index.mdx index 30aeff993e..3a66bc703b 100644 --- a/website/docs/add-secure-apps/flows-stages/stages/user_write/index.md +++ b/website/docs/add-secure-apps/flows-stages/stages/user_write/index.mdx @@ -8,7 +8,7 @@ The User Write stage writes data from the current flow context into a user objec This stage updates the current `pending_user`, or creates a new user if the flow does not already have one and the configured creation mode allows it. -It is commonly used in enrollment, recovery, and profile-update flows after a [Prompt stage](../prompt/index.md) has collected input into `prompt_data`. +It is commonly used in enrollment, recovery, and profile-update flows after a [Prompt stage](../prompt/index.mdx) has collected input into `prompt_data`. ## Configuration options @@ -20,9 +20,9 @@ It is commonly used in enrollment, recovery, and profile-update flows after a [P ## Flow integration -Use this stage after one or more stages that populate flow context, usually a [Identification stage](../identification/index.md), [Prompt stage](../prompt/index.md), or [Email stage](../email/index.md). +Use this stage after one or more stages that populate flow context, usually a [Identification stage](../identification/index.mdx), [Prompt stage](../prompt/index.mdx), or [Email stage](../email/index.mdx). -In enrollment flows, this stage is often followed by a [User Login](../user_login/index.md) stage so the newly created user is immediately signed in. +In enrollment flows, this stage is often followed by a [User Login](../user_login/index.mdx) stage so the newly created user is immediately signed in. ## Notes diff --git a/website/docs/add-secure-apps/outposts/_config.md b/website/docs/add-secure-apps/outposts/_config.mdx similarity index 100% rename from website/docs/add-secure-apps/outposts/_config.md rename to website/docs/add-secure-apps/outposts/_config.mdx diff --git a/website/docs/add-secure-apps/outposts/embedded/embedded.mdx b/website/docs/add-secure-apps/outposts/embedded/embedded.mdx index 00ea23ad42..0a73d5975f 100644 --- a/website/docs/add-secure-apps/outposts/embedded/embedded.mdx +++ b/website/docs/add-secure-apps/outposts/embedded/embedded.mdx @@ -12,7 +12,7 @@ You can access the embedded outpost on the same ports as authentik itself, `9000 Use the embedded outpost when you are using the proxy provider and want the simplest deployment model. It is a good fit when authentik is already behind a reverse proxy and you want proxy provider traffic to be handled by the same authentik deployment, without a separate outpost deployment. -Use a [managed outpost](../index.mdx) instead when you want authentik to deploy and update a separate outpost through the [Docker](../integrations/docker.md) or [Kubernetes](../integrations/kubernetes.md) integrations, or when you want the outpost lifecycle to be separate from the core server. +Use a [managed outpost](../index.mdx) instead when you want authentik to deploy and update a separate outpost through the [Docker](../integrations/docker.mdx) or [Kubernetes](../integrations/kubernetes.mdx) integrations, or when you want the outpost lifecycle to be separate from the core server. If the embedded outpost does not fit your deployment, you can ignore it and use a [managed outpost](../index.mdx) instead. @@ -28,7 +28,7 @@ Make sure that you set a full URL. A hostname or FQDN by itself does not work. Most other outpost configuration options also apply to the embedded outpost, except for items that are marked as `non-embedded`. -import Configuration from "../_config.md"; +import Configuration from "../_config.mdx"; diff --git a/website/docs/add-secure-apps/outposts/index.mdx b/website/docs/add-secure-apps/outposts/index.mdx index 9a6c95b333..ae4f743e66 100644 --- a/website/docs/add-secure-apps/outposts/index.mdx +++ b/website/docs/add-secure-apps/outposts/index.mdx @@ -7,10 +7,10 @@ An outpost is a single deployment of an authentik component, essentially a servi An outpost is required if you use any of the following types of providers with your application: -- [LDAP Provider](../providers/ldap/index.md) -- [Proxy Provider](../providers/proxy/index.md) +- [LDAP Provider](../providers/ldap/index.mdx) +- [Proxy Provider](../providers/proxy/index.mdx) - [RADIUS Provider](../providers/radius/index.mdx) -- [RAC Provider](../providers/rac/index.md) +- [RAC Provider](../providers/rac/index.mdx) These types of providers use an outpost for increased flexibility and speed. Instead of the provider logic being implemented in authentik Core, these providers use an outpost to handle the logic, which provides improved performance. @@ -42,21 +42,21 @@ Upon creation, a service account and a token is generated. The service account o authentik can manage the deployment, updating, and general lifecycle of an outpost. To communicate with the underlying platforms on which the outpost is deployed, authentik has several built-in integrations. -- If you've deployed authentik on Docker Compose, authentik automatically creates an integration for the local docker socket (See [Docker](./integrations/docker.md)). -- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates an integration for the local Kubernetes Cluster (see [Kubernetes](./integrations/kubernetes.md)). +- If you've deployed authentik on Docker Compose, authentik automatically creates an integration for the local docker socket (See [Docker](./integrations/docker.mdx)). +- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates an integration for the local Kubernetes Cluster (see [Kubernetes](./integrations/kubernetes.mdx)). To deploy an outpost with these integrations, select them during the creation of an outpost. A background task is started, which creates the container/deployment. The outpost deployment can be monitored from the **Dashboards > System Tasks** page in the Admin interface. To deploy an outpost manually, see: -- [Kubernetes](./manual-deploy-kubernetes.md) -- [Docker Compose](./manual-deploy-docker-compose.md) +- [Kubernetes](./manual-deploy-kubernetes.mdx) +- [Docker Compose](./manual-deploy-docker-compose.mdx) ## Configuration Outposts fetch their configuration from authentik. Below are all the options you can set, and how they influence the outpost. -import Configuration from "./_config.md"; +import Configuration from "./_config.mdx"; diff --git a/website/docs/add-secure-apps/outposts/integrations/docker.md b/website/docs/add-secure-apps/outposts/integrations/docker.mdx similarity index 100% rename from website/docs/add-secure-apps/outposts/integrations/docker.md rename to website/docs/add-secure-apps/outposts/integrations/docker.mdx diff --git a/website/docs/add-secure-apps/outposts/integrations/kubernetes.md b/website/docs/add-secure-apps/outposts/integrations/kubernetes.mdx similarity index 95% rename from website/docs/add-secure-apps/outposts/integrations/kubernetes.md rename to website/docs/add-secure-apps/outposts/integrations/kubernetes.mdx index f2b8beafca..fbcac8d2fa 100644 --- a/website/docs/add-secure-apps/outposts/integrations/kubernetes.md +++ b/website/docs/add-secure-apps/outposts/integrations/kubernetes.mdx @@ -4,7 +4,7 @@ title: Kubernetes The Kubernetes integration automatically deploys and manages outposts in a Kubernetes cluster. -Compared with a [manual Kubernetes deployment](../manual-deploy-kubernetes.md), this integration keeps managed outposts aligned with authentik updates and reduces the amount of cluster-side configuration that you need to maintain. +Compared with a [manual Kubernetes deployment](../manual-deploy-kubernetes.mdx), this integration keeps managed outposts aligned with authentik updates and reduces the amount of cluster-side configuration that you need to maintain. ## Created resources diff --git a/website/docs/add-secure-apps/outposts/manual-deploy-docker-compose.md b/website/docs/add-secure-apps/outposts/manual-deploy-docker-compose.mdx similarity index 100% rename from website/docs/add-secure-apps/outposts/manual-deploy-docker-compose.md rename to website/docs/add-secure-apps/outposts/manual-deploy-docker-compose.mdx diff --git a/website/docs/add-secure-apps/outposts/manual-deploy-kubernetes.md b/website/docs/add-secure-apps/outposts/manual-deploy-kubernetes.mdx similarity index 100% rename from website/docs/add-secure-apps/outposts/manual-deploy-kubernetes.md rename to website/docs/add-secure-apps/outposts/manual-deploy-kubernetes.mdx diff --git a/website/docs/add-secure-apps/outposts/upgrading.md b/website/docs/add-secure-apps/outposts/upgrading.mdx similarity index 53% rename from website/docs/add-secure-apps/outposts/upgrading.md rename to website/docs/add-secure-apps/outposts/upgrading.mdx index a3ddc24c8f..d5d0c7b95a 100644 --- a/website/docs/add-secure-apps/outposts/upgrading.md +++ b/website/docs/add-secure-apps/outposts/upgrading.mdx @@ -2,7 +2,7 @@ title: Upgrading an Outpost --- -Outposts deployed using the [Docker](./integrations/docker.md) or [Kubernetes](./integrations/kubernetes.md) integrations are managed by authentik and are upgraded automatically. Outposts deployed manually via [Docker](./manual-deploy-docker-compose.md) or [Kubernetes](./manual-deploy-kubernetes.md) must be upgraded by updating the outpost's image tag to the new version. +Outposts deployed using the [Docker](./integrations/docker.mdx) or [Kubernetes](./integrations/kubernetes.mdx) integrations are managed by authentik and are upgraded automatically. Outposts deployed manually via [Docker](./manual-deploy-docker-compose.mdx) or [Kubernetes](./manual-deploy-kubernetes.mdx) must be upgraded by updating the outpost's image tag to the new version. To check if any outposts are out-of-date, navigate to **Applications** > **Outposts** and look for a message in the **Health and Version** column. diff --git a/website/docs/add-secure-apps/providers/entra/configure-entra.md b/website/docs/add-secure-apps/providers/entra/configure-entra.mdx similarity index 90% rename from website/docs/add-secure-apps/providers/entra/configure-entra.md rename to website/docs/add-secure-apps/providers/entra/configure-entra.mdx index bc65e1ebd2..dbe60421fe 100644 --- a/website/docs/add-secure-apps/providers/entra/configure-entra.md +++ b/website/docs/add-secure-apps/providers/entra/configure-entra.mdx @@ -3,9 +3,9 @@ title: Configure Entra ID authentik_enterprise: true --- -For more information about using an Entra ID provider, see the [Entra ID Overview](./index.md) documentation. +For more information about using an Entra ID provider, see the [Entra ID Overview](./index.mdx) documentation. -Your Entra ID tenant must be configured before you [create an Entra ID provider](./create-entra-provider.md). +Your Entra ID tenant must be configured before you [create an Entra ID provider](./create-entra-provider.mdx). This involves creating an app registration, generating a secret, and configuring the required API permissions. @@ -14,7 +14,7 @@ When the default `authentik default Microsoft Entra Mapping: User` property mapp In which case, you must configure each user's email domain as a [verified custom domain in Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/domains-manage#add-custom-domain-names-to-your-microsoft-entra-organization); otherwise, provisioning fails. The tenant's default `onmicrosoft.com` domain (e.g., `@.onmicrosoft.com`), is considered a verified domain. -Alternatively, if you need to provision users with email domains that you don't control, refer to [Email handling](./create-entra-provider.md#email-handling) for more information. +Alternatively, if you need to provision users with email domains that you don't control, refer to [Email handling](./create-entra-provider.mdx#email-handling) for more information. ::: ## Configure your Entra ID tenant @@ -25,13 +25,13 @@ Alternatively, if you need to provision users with email domains that you don't - Under **Supported account types**, select **Accounts in this organizational directory only** - Leave **Redirect URI** empty 3. Click **Register**. -4. On the app detail page, take note of the **Application (client) ID** and **Directory (tenant) ID**. These values will be required when you [create the Entra ID provider](./create-entra-provider.md) in authentik. +4. On the app detail page, take note of the **Application (client) ID** and **Directory (tenant) ID**. These values will be required when you [create the Entra ID provider](./create-entra-provider.mdx) in authentik. 5. Next, in the near-left navigation pane, click on **Certificates and Secrets**. 6. On the **Client secrets** tab, click **New client secret** and set the following configuration: - Provide a **Description** for the client secret - Set an expiry period for the secret. Please note that you will need to rotate the secret value in Entra ID and authentik upon expiry. 7. Click **Add**. -8. The **Value** of the client secret is shown only once. Take note of the value as it will be required when you [create the Entra ID provider](./create-entra-provider.md) in authentik. +8. The **Value** of the client secret is shown only once. Take note of the value as it will be required when you [create the Entra ID provider](./create-entra-provider.mdx) in authentik. 9. Next, in the near-left navigation pane, click on **API permissions**. 10. Click **Add a permission** and select **Microsoft Graph** as the API. 11. Select **Application permissions** as the permission type and assign the following permissions: @@ -42,4 +42,4 @@ Alternatively, if you need to provision users with email domains that you don't 12. Click **Add permissions**. 13. Under **Configured permissions**, click **Grant admin consent for default directory**. -Now that you have configured your Entra ID tenant, you are ready to [create an Entra ID provider](./create-entra-provider.md). +Now that you have configured your Entra ID tenant, you are ready to [create an Entra ID provider](./create-entra-provider.mdx). diff --git a/website/docs/add-secure-apps/providers/entra/create-entra-provider.md b/website/docs/add-secure-apps/providers/entra/create-entra-provider.mdx similarity index 97% rename from website/docs/add-secure-apps/providers/entra/create-entra-provider.md rename to website/docs/add-secure-apps/providers/entra/create-entra-provider.mdx index 216abb5b0c..7a3ef8cf5b 100644 --- a/website/docs/add-secure-apps/providers/entra/create-entra-provider.md +++ b/website/docs/add-secure-apps/providers/entra/create-entra-provider.mdx @@ -3,11 +3,11 @@ title: Create an Entra ID provider authentik_enterprise: true --- -For more information about using an Entra ID provider, see the [Overview](./index.md) documentation. +For more information about using an Entra ID provider, see the [Overview](./index.mdx) documentation. ## Prerequisites -To create an Entra ID provider in authentik, you must have already [configured Entra ID](./configure-entra.md). +To create an Entra ID provider in authentik, you must have already [configured Entra ID](./configure-entra.mdx). ## Create an Entra ID provider in authentik @@ -17,7 +17,7 @@ To create an Entra ID provider in authentik, you must have already [configured E 4. On the **New Microsoft Entra Provider** page, set the following configurations: - **Name**: provide a descriptive name (e.g. `Entra ID provider`) - Under **Protocol settings**: - - **Client ID**: the Client ID that you copied when [configuring Entra ID](./configure-entra.md) + - **Client ID**: the Client ID that you copied when [configuring Entra ID](./configure-entra.mdx) - **Client Secret**: the secret from Entra ID - **Tenant ID**: the Tenant ID from Entra ID - **User deletion action**: determines what authentik will do when a user is deleted from authentik @@ -30,7 +30,7 @@ To create an Entra ID provider in authentik, you must have already [configured E - **Group Property Mappings**: select any property mappings, or use the default :::info Skipping certain users or groups - The `SkipObject` exception can be used within a property mapping to prevent specific objects from being synced. Refer to the [Provider property mappings documentation](../property-mappings/index.md#skip-objects-during-synchronization) for more details. + The `SkipObject` exception can be used within a property mapping to prevent specific objects from being synced. Refer to the [Provider property mappings documentation](../property-mappings/index.mdx#skip-objects-during-synchronization) for more details. ::: 5. Click **Finish**. diff --git a/website/docs/add-secure-apps/providers/entra/index.md b/website/docs/add-secure-apps/providers/entra/index.mdx similarity index 94% rename from website/docs/add-secure-apps/providers/entra/index.md rename to website/docs/add-secure-apps/providers/entra/index.mdx index db56a6784a..f0d2adf956 100644 --- a/website/docs/add-secure-apps/providers/entra/index.md +++ b/website/docs/add-secure-apps/providers/entra/index.mdx @@ -7,10 +7,10 @@ sidebar_label: "Microsoft Entra ID Provider" The Entra ID provider allows you to integrate with your Entra ID tenant. It supports syncing users and groups from authentik to Entra ID, allowing authentik to act as a source of truth for all users and groups. -- For instructions on configuring your Entra ID tenant in prepation for creating an Entra ID provider, refer to [Configure Entra ID](./configure-entra.md). -- For instructions on creating an Entra ID provider, refer to [Create an Entra ID provider](./create-entra-provider.md). +- For instructions on configuring your Entra ID tenant in prepation for creating an Entra ID provider, refer to [Configure Entra ID](./configure-entra.mdx). +- For instructions on creating an Entra ID provider, refer to [Create an Entra ID provider](./create-entra-provider.mdx). -If you also want to authenticate to Entra ID using authentik credentials, refer to our [Microsoft 365 SAML](/integrations/platforms/microsoft-saml/index.md) or [Microsoft 365 WS-Federation](/integrations/platforms/microsoft-ws-federation/index.md) integrations guides. +If you also want to authenticate to Entra ID using authentik credentials, refer to our [Microsoft 365 SAML](/integrations/platforms/microsoft-saml/index.mdx) or [Microsoft 365 WS-Federation](/integrations/platforms/microsoft-ws-federation/index.mdx) integrations guides. ## Discovery diff --git a/website/docs/add-secure-apps/providers/gws/configure-gws.md b/website/docs/add-secure-apps/providers/gws/configure-gws.mdx similarity index 97% rename from website/docs/add-secure-apps/providers/gws/configure-gws.md rename to website/docs/add-secure-apps/providers/gws/configure-gws.mdx index 88f7de3e7d..2ebf90a492 100644 --- a/website/docs/add-secure-apps/providers/gws/configure-gws.md +++ b/website/docs/add-secure-apps/providers/gws/configure-gws.mdx @@ -3,9 +3,9 @@ title: Configure Google Workspace authentik_enterprise: true --- -For more information about using a Google Workspace provider, see the [Overview](./index.md) documentation. +For more information about using a Google Workspace provider, see the [Overview](./index.mdx) documentation. -Your Google Workspace organization must be configured before you [create a Google Workspace provider](./create-gws-provider.md). +Your Google Workspace organization must be configured before you [create a Google Workspace provider](./create-gws-provider.mdx). ## Configure your Google Workspace organization @@ -87,4 +87,4 @@ The Delagated Subject user requires the following permissions: - Users - Groups -Now that you have configured your Google Workspace organization, you are ready to [create a Google Workspace provider](./create-gws-provider.md). +Now that you have configured your Google Workspace organization, you are ready to [create a Google Workspace provider](./create-gws-provider.mdx). diff --git a/website/docs/add-secure-apps/providers/gws/create-gws-provider.md b/website/docs/add-secure-apps/providers/gws/create-gws-provider.mdx similarity index 94% rename from website/docs/add-secure-apps/providers/gws/create-gws-provider.md rename to website/docs/add-secure-apps/providers/gws/create-gws-provider.mdx index 1ad3fb275d..6cb78c5e1b 100644 --- a/website/docs/add-secure-apps/providers/gws/create-gws-provider.md +++ b/website/docs/add-secure-apps/providers/gws/create-gws-provider.mdx @@ -3,11 +3,11 @@ title: Create a Google Workspace provider authentik_enterprise: true --- -For more information about using a Google Workspace provider, see the [Overview](./index.md) documentation. +For more information about using a Google Workspace provider, see the [Overview](./index.mdx) documentation. ## Prerequisites -To create a Google Workspace provider in authentik, you must have already [configured Google Workspace](./configure-gws.md). +To create a Google Workspace provider in authentik, you must have already [configured Google Workspace](./configure-gws.mdx). ## Create a Google Workspace provider in authentik @@ -17,7 +17,7 @@ To create a Google Workspace provider in authentik, you must have already [confi 4. On the **New Google Workspace Provider** page, set the following configurations: - **Name**: provide a descriptive name (e.g. `GWS provider`) - Under **Protocol settings**: - - **Credentials**: paste the contents of the JSON file that you downloaded when [configuring Google Workspace](./configure-gws.md) + - **Credentials**: paste the contents of the JSON file that you downloaded when [configuring Google Workspace](./configure-gws.mdx) - **Delegated Subject**: enter the email address of the Google Workspace user that all authentik actions will be delegated to - **Default group email domain**: enter a domain which will be used to generate the email address for groups synced from authentik to Google Workspace - **User deletion action**: determines what authentik will do when a user is deleted from authentik @@ -30,7 +30,7 @@ To create a Google Workspace provider in authentik, you must have already [confi - **Group Property Mappings**: select any property mappings, or use the default :::info Skipping certain users or groups - The `SkipObject` exception can be used within a property mapping to prevent specific objects from being synced. Refer to the [Provider property mappings documentation](../property-mappings/index.md#skip-objects-during-synchronization) for more details. + The `SkipObject` exception can be used within a property mapping to prevent specific objects from being synced. Refer to the [Provider property mappings documentation](../property-mappings/index.mdx#skip-objects-during-synchronization) for more details. ::: 5. Click **Finish**. diff --git a/website/docs/add-secure-apps/providers/gws/index.md b/website/docs/add-secure-apps/providers/gws/index.mdx similarity index 97% rename from website/docs/add-secure-apps/providers/gws/index.md rename to website/docs/add-secure-apps/providers/gws/index.mdx index 1e23d4c8b1..5b9d7790e0 100644 --- a/website/docs/add-secure-apps/providers/gws/index.md +++ b/website/docs/add-secure-apps/providers/gws/index.mdx @@ -7,8 +7,8 @@ sidebar_label: "Google Workspace Provider" The Google Workspace provider allows you to integrate with your Google Workspace organization. It supports syncing users and groups from authentik to Google Workspace, allowing authentik to act as a source of truth for all users and groups. -- For instructions on configuring your Google Workspace organization in prepation for creating a Google Workspace provider, refer to the [Configure Google Workspace](./configure-gws.md) documentation. -- For instructions on creating a Google Workspace provider, refer to the [Create a Google Workspace provider](./create-gws-provider.md) documentation. +- For instructions on configuring your Google Workspace organization in prepation for creating a Google Workspace provider, refer to the [Configure Google Workspace](./configure-gws.mdx) documentation. +- For instructions on creating a Google Workspace provider, refer to the [Create a Google Workspace provider](./create-gws-provider.mdx) documentation. ## Discovery diff --git a/website/docs/add-secure-apps/providers/index.mdx b/website/docs/add-secure-apps/providers/index.mdx index 855bea1c06..255ada2f89 100644 --- a/website/docs/add-secure-apps/providers/index.mdx +++ b/website/docs/add-secure-apps/providers/index.mdx @@ -8,13 +8,13 @@ import DocCardList from "@theme/DocCardList"; A provider is an authentication method, a service that is used by authentik to authenticate the user for the associated application. Common providers are OpenID Connect (OIDC)/OAuth2, LDAP, SAML, a generic proxy provider, and others. -Providers are the "other half" of [applications](../applications/index.md). They typically exist in a 1-to-1 relationship; each application needs a provider and every provider can be used with one application. +Providers are the "other half" of [applications](../applications/index.mdx). They typically exist in a 1-to-1 relationship; each application needs a provider and every provider can be used with one application. You can create a new provider in the Admin interface, or you can use the [**New Application** option](../applications/manage_apps.mdx#create-an-application-and-provider-pair) to create a new application and its provider at the same time. Applications can use additional providers to augment the functionality of the main provider. For more information, see [Backchannel providers](../applications/manage_apps.mdx#backchannel-providers). -When you create certain types of providers, you need to select specific [flows](../flows-stages/flow/index.md) to apply to users who access authentik via the provider. To learn more, refer to our [default flow documentation](../flows-stages/flow/default-flows.md). +When you create certain types of providers, you need to select specific [flows](../flows-stages/flow/index.mdx) to apply to users who access authentik via the provider. To learn more, refer to our [default flow documentation](../flows-stages/flow/default-flows.mdx). You can also create a SAML provider by uploading an SP metadata XML file that contains the service provider's configuration data. SAML metadata is used to share configuration information between the Identity Provider (IdP) and the Service Provider (SP). An SP metadata XML file typically contains the SP certificate, the entity ID, the Assertion Consumer Service URL (ACS URL), and a logout URL (SingleLogoutService). diff --git a/website/docs/add-secure-apps/providers/ldap/create-ldap-provider.mdx b/website/docs/add-secure-apps/providers/ldap/create-ldap-provider.mdx index 3eb176f145..43bea08ab0 100644 --- a/website/docs/add-secure-apps/providers/ldap/create-ldap-provider.mdx +++ b/website/docs/add-secure-apps/providers/ldap/create-ldap-provider.mdx @@ -18,7 +18,7 @@ The `default-authentication-flow` validates MFA by default. Duo, TOTP, and stati If you plan to use only dedicated service accounts to bind to LDAP, or only use LDAP supported MFA authenticators, then you can use the default authentication flow and skip this section and continue with the [Create an LDAP application and provider](#create-an-ldap-application-and-provider) section. -Refer to [Code-Based MFA support](./index.md#code-based-mfa-support) for more information on LDAP and MFA. +Refer to [Code-Based MFA support](./index.mdx#code-based-mfa-support) for more information on LDAP and MFA. ### Create custom stages @@ -121,7 +121,7 @@ The LDAP provider requires the deployment of an LDAP [Outpost](../../outposts/in 2. Navigate to **Applications** > **Outposts**, click **New Outpost** and set the following required configurations: - Provide a **Name** for the outpost (e.g. `LDAP Outpost'). - Set the **Type** as `LDAP`. - - Set **Integration** to match your deployment method or manually deploy an outpost via [Docker-Compose](../../outposts/manual-deploy-docker-compose.md) or [Kubernetes](../../outposts/manual-deploy-kubernetes.md). For more information, refer to the [Outpost documentation](../../outposts/index.mdx). + - Set **Integration** to match your deployment method or manually deploy an outpost via [Docker-Compose](../../outposts/manual-deploy-docker-compose.mdx) or [Kubernetes](../../outposts/manual-deploy-kubernetes.mdx). For more information, refer to the [Outpost documentation](../../outposts/index.mdx). - Under **Applications**, select the LDAP application created in the previous section. - Under **Advanced settings**, set the required outpost configurations. For more information, refer to [Outpost Configuration](../../outposts/index.mdx#configuration) @@ -164,10 +164,10 @@ ldapsearch \ '(objectClass=user)' ``` -This example query will return all users and log the first successful attempt in an event in **Events** > **Logs**. Subsequent successful logins from the same user are not logged by default, as they are cached in the outpost. For more details see [Bind modes](./index.md#bind-modes). +This example query will return all users and log the first successful attempt in an event in **Events** > **Logs**. Subsequent successful logins from the same user are not logged by default, as they are cached in the outpost. For more details see [Bind modes](./index.mdx#bind-modes). :::warning LDAPS -In production it is recommended to use LDAPS, which requires `ldaps://` as the protocol, and port number `636` rather than `389`. See [LDAPS](./index.md#ldaps-via-ssl-or-starttls) for more information. +In production it is recommended to use LDAPS, which requires `ldaps://` as the protocol, and port number `636` rather than `389`. See [LDAPS](./index.mdx#ldaps-via-ssl-or-starttls) for more information. ::: @@ -179,10 +179,10 @@ To search the LDAP directory using the previously created `ldapservice` service dsquery * -s -u "cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io" -p -b "DC=ldap,DC=goauthentik,DC=io" -filter "(objectClass=user)" ``` -This example query will return all users and log the first successful attempt in an event in **Events** > **Logs**. Subsequent successful logins from the same user are not logged by default, as they are cached in the outpost. For more details see [Bind modes](./index.md#bind-modes). +This example query will return all users and log the first successful attempt in an event in **Events** > **Logs**. Subsequent successful logins from the same user are not logged by default, as they are cached in the outpost. For more details see [Bind modes](./index.mdx#bind-modes). :::warning LDAPS -In production it is recommended to use LDAPS, which requires `ldaps://` as the protocol, and port number `636` rather than `389`. See [LDAPS](./index.md#ldaps-via-ssl-or-starttls) for more information. +In production it is recommended to use LDAPS, which requires `ldaps://` as the protocol, and port number `636` rather than `389`. See [LDAPS](./index.mdx#ldaps-via-ssl-or-starttls) for more information. ::: diff --git a/website/docs/add-secure-apps/providers/ldap/index.md b/website/docs/add-secure-apps/providers/ldap/index.mdx similarity index 95% rename from website/docs/add-secure-apps/providers/ldap/index.md rename to website/docs/add-secure-apps/providers/ldap/index.mdx index 71229c1f79..6995ac91f2 100644 --- a/website/docs/add-secure-apps/providers/ldap/index.md +++ b/website/docs/add-secure-apps/providers/ldap/index.mdx @@ -86,12 +86,12 @@ The **Bind Flow** determines the flow used for binding/authenticating users, and The following flow stages are supported by the LDAP provider: -- [Identification stage](../../flows-stages/stages/identification/index.md) -- [Password stage](../../flows-stages/stages/password/index.md) -- [Authenticator validation stage](../../flows-stages/stages/authenticator_validate/index.md) -- [User Logout stage](../../flows-stages/stages/user_logout/index.md) -- [User Login stage](../../flows-stages/stages/user_login/index.md) -- [Deny stage](../../flows-stages/stages/deny/index.md) +- [Identification stage](../../flows-stages/stages/identification/index.mdx) +- [Password stage](../../flows-stages/stages/password/index.mdx) +- [Authenticator validation stage](../../flows-stages/stages/authenticator_validate/index.mdx) +- [User Logout stage](../../flows-stages/stages/user_logout/index.mdx) +- [User Login stage](../../flows-stages/stages/user_login/index.mdx) +- [Deny stage](../../flows-stages/stages/deny/index.mdx) ### Bind modes @@ -109,7 +109,7 @@ This mode uses the same logic as direct bind, however the result is cached for t Any user that is authorized to access the LDAP provider's application can search the LDAP directory. Without explicit permissions to do broader searches, a user's search request will return information about themselves, including user info, group info, and group membership. -[Users](../../../users-sources/user/index.mdx) and [roles](../../../users-sources/roles/index.md) can be assigned the permission `Search full LDAP directory` to allow them to search the full LDAP directory and retrieve information about all users in the authentik instance. +[Users](../../../users-sources/user/index.mdx) and [roles](../../../users-sources/roles/index.mdx) can be assigned the permission `Search full LDAP directory` to allow them to search the full LDAP directory and retrieve information about all users in the authentik instance. :::info Up to authentik version 2024.8 this was managed using the LDAP provider's **Search group** setting, where users could be added to a group to grant them this permission. With authentik 2024.8 this is automatically migrated to the `Search full LDAP directory` permission, which can be assigned more flexibly. @@ -135,7 +135,7 @@ Authenticator validation currently only supports DUO, TOTP and static authentica The LDAP provider supports code-based MFA. -Code-based authenticators are only supported when the **Code-based MFA Support** setting is enabled on the provider and the configured **Bind Flow** includes a [Authenticator Validation stage](../../flows-stages/stages/authenticator_validate/index.md). +Code-based authenticators are only supported when the **Code-based MFA Support** setting is enabled on the provider and the configured **Bind Flow** includes a [Authenticator Validation stage](../../flows-stages/stages/authenticator_validate/index.mdx). When enabled, all users that bind to the LDAP provider should have a supported authenticator configured, as otherwise a password might be incorrectly rejected if it contains a semicolon. diff --git a/website/docs/add-secure-apps/providers/oauth2/create-oauth2-provider.md b/website/docs/add-secure-apps/providers/oauth2/create-oauth2-provider.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/oauth2/create-oauth2-provider.md rename to website/docs/add-secure-apps/providers/oauth2/create-oauth2-provider.mdx diff --git a/website/docs/add-secure-apps/providers/oauth2/device_code.md b/website/docs/add-secure-apps/providers/oauth2/device_code.mdx similarity index 96% rename from website/docs/add-secure-apps/providers/oauth2/device_code.md rename to website/docs/add-secure-apps/providers/oauth2/device_code.mdx index 1d9a6c8251..e17b971a9d 100644 --- a/website/docs/add-secure-apps/providers/oauth2/device_code.md +++ b/website/docs/add-secure-apps/providers/oauth2/device_code.mdx @@ -9,7 +9,7 @@ The device code flow is also known as _device flow_ or _device authorization gra ### Requirements -This device flow is only possible if the active [brand](../../../customize/branding/index.md) has a device code flow configured. This flow is run _after_ the user logs in, and before the user authenticates. +This device flow is only possible if the active [brand](../../../customize/branding/index.mdx) has a device code flow configured. This flow is run _after_ the user logs in, and before the user authenticates. authentik does not include a default flow for this use case, so it is necessary to create a new one with a **Designation** of `Stage Configuration`. diff --git a/website/docs/add-secure-apps/providers/oauth2/frontchannel_and_backchannel_logout.mdx b/website/docs/add-secure-apps/providers/oauth2/frontchannel_and_backchannel_logout.mdx index e82a0ac0fc..6e9b1830af 100644 --- a/website/docs/add-secure-apps/providers/oauth2/frontchannel_and_backchannel_logout.mdx +++ b/website/docs/add-secure-apps/providers/oauth2/frontchannel_and_backchannel_logout.mdx @@ -10,7 +10,7 @@ sidebar_position: 4 OAuth2/OIDC logout is a security feature defined in the OpenID Connect specification. It allows an OIDC Provider (OP), such as authentik, to notify Relying Parties (RPs) when a user session ends. This ensures that all associated applications can properly terminate the user's session. -For more information about single logout across all providers, see the [Single Logout (SLO) Overview](../single-logout/index.md). +For more information about single logout across all providers, see the [Single Logout (SLO) Overview](../single-logout/index.mdx). :::warning Your OAuth application (Relying Party) must explicitly support OpenID Connect front-channel logout or back-channel logout to properly handle logout requests. Not all OAuth applications support these features, so compatibility should be verified. @@ -62,7 +62,7 @@ https://api.service.com/logout OIDC Relying Parties can initiate logout by redirecting a user to authentik's `end_session` endpoint. By default, only that application's session is ended while the authentik session remains active and the user stays logged in to other applications. -For instructions on how to trigger full Single Logout when a user logs out from an application, see [Enable full Single Logout for RP-initiated logout](../single-logout/index.md#enable-full-single-logout-for-rp-initiated-logout). +For instructions on how to trigger full Single Logout when a user logs out from an application, see [Enable full Single Logout for RP-initiated logout](../single-logout/index.mdx#enable-full-single-logout-for-rp-initiated-logout). ## How OpenID Connect single logout works @@ -118,8 +118,8 @@ Front-channel logout only works for user-initiated logouts through a logout flow ## Resources -- [Single Logout (SLO) Overview](../single-logout/index.md) -- [User Logout Stage](../../flows-stages/stages/user_logout/index.md) +- [Single Logout (SLO) Overview](../single-logout/index.mdx) +- [User Logout Stage](../../flows-stages/stages/user_logout/index.mdx) - [OAuth2 Provider Configuration](./index.mdx) - [OpenID Connect Back-Channel Logout 1.0 Specification](https://openid.net/specs/openid-connect-backchannel-1_0.html) - [OpenID Connect Front-Channel Logout 1.0 Specification](https://openid.net/specs/openid-connect-frontchannel-1_0.html) diff --git a/website/docs/add-secure-apps/providers/oauth2/github-compatibility.md b/website/docs/add-secure-apps/providers/oauth2/github-compatibility.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/oauth2/github-compatibility.md rename to website/docs/add-secure-apps/providers/oauth2/github-compatibility.mdx diff --git a/website/docs/add-secure-apps/providers/oauth2/index.mdx b/website/docs/add-secure-apps/providers/oauth2/index.mdx index 9f4b7af7d8..f903d1092f 100644 --- a/website/docs/add-secure-apps/providers/oauth2/index.mdx +++ b/website/docs/add-secure-apps/providers/oauth2/index.mdx @@ -2,7 +2,7 @@ title: OAuth 2.0 provider --- -In authentik, you can [create](./create-oauth2-provider.md) an [OAuth 2.0](https://oauth.net/2/) provider to authenticate users to an associated application. The provider supports both OAuth 2.0 and OpenID Connect (OIDC). +In authentik, you can [create](./create-oauth2-provider.mdx) an [OAuth 2.0](https://oauth.net/2/) provider to authenticate users to an associated application. The provider supports both OAuth 2.0 and OpenID Connect (OIDC). ## authentik and OAuth 2.0 @@ -11,11 +11,11 @@ Before taking a [closer look at OAuth 2.0 and OIDC](#about-oauth-20-and-oidc), i authentik can act as either an OpenID Provider (OP) or a Relying Party (RP): - To use authentik as an OP, create an OAuth 2.0 provider and associate it with an application. -- To use authentik as an RP, configure an OAuth or OIDC [source](../../../users-sources/sources/index.md). +- To use authentik as an RP, configure an OAuth or OIDC [source](../../../users-sources/sources/index.mdx). authentik can act as both an OP and an RP in the same deployment. -authentik supports common OAuth 2.0 and OIDC flows and grant types, including authorization code, client credentials, implicit, hybrid, device code, refresh token, and token exchange. authentik follows the [OpenID Connect specification](https://openid.net/specs/openid-connect-core-1_0.html) and supports PKCE, [GitHub compatibility](./github-compatibility.md), and scope mappings. +authentik supports common OAuth 2.0 and OIDC flows and grant types, including authorization code, client credentials, implicit, hybrid, device code, refresh token, and token exchange. authentik follows the [OpenID Connect specification](https://openid.net/specs/openid-connect-core-1_0.html) and supports PKCE, [GitHub compatibility](./github-compatibility.mdx), and scope mappings. The authentik OAuth 2.0 provider supports standard OAuth 2.0 security features, including secure credential storage, configurable signing and encryption, configurable token expiration times, and automatic refresh token rotation. @@ -122,7 +122,7 @@ authentik supports the following general OAuth 2.0 and OpenID Connect flows: The [refresh token](#refresh-token-grant) grant allows a client to obtain new access tokens without repeating the original authorization flow. -You can define which grant types are available for your OAuth2 provider when you [create and configure the provider](./create-oauth2-provider.md). By default, all types are selected. +You can define which grant types are available for your OAuth2 provider when you [create and configure the provider](./create-oauth2-provider.mdx). By default, all types are selected. ### 1. Web-based application authorization @@ -172,7 +172,7 @@ For more information, see [Machine-to-machine authentication](./machine_to_machi The device code flow is intended for devices that have limited input capabilities or do not have a suitable browser. For example, a television application can display a code that the user enters on a website using a phone or computer. After the user authenticates, the television application receives authorization. -For more information, see [Device code flow](./device_code.md). +For more information, see [Device code flow](./device_code.mdx). ### 4. Token exchange @@ -180,7 +180,7 @@ The token exchange grant allows a client to exchange an existing token for a new With delegation, also known as on-behalf-of (OBO) token exchange, the issued token identifies both the user and the authentik Actor acting on the user's behalf. -For configuration instructions and information about supported parameters, see [Token exchange](./token_exchange.md). +For configuration instructions and information about supported parameters, see [Token exchange](./token_exchange.mdx). :::info Delegation and on-behalf-of token exchange are available in authentik 2026.8 and later. @@ -192,7 +192,7 @@ The refresh token grant allows a client to obtain a new access token without req ## Scope mappings -Scopes can be configured using scope mappings, which are a type of [property mapping](../property-mappings/index.md#scope-mappings-with-oauth2). +Scopes can be configured using scope mappings, which are a type of [property mapping](../property-mappings/index.mdx#scope-mappings-with-oauth2). ## Scope authorization diff --git a/website/docs/add-secure-apps/providers/oauth2/token_exchange.md b/website/docs/add-secure-apps/providers/oauth2/token_exchange.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/oauth2/token_exchange.md rename to website/docs/add-secure-apps/providers/oauth2/token_exchange.mdx diff --git a/website/docs/add-secure-apps/providers/oauth2/webfinger_support.mdx b/website/docs/add-secure-apps/providers/oauth2/webfinger_support.mdx index 42c0a23bdf..b79c554ff8 100644 --- a/website/docs/add-secure-apps/providers/oauth2/webfinger_support.mdx +++ b/website/docs/add-secure-apps/providers/oauth2/webfinger_support.mdx @@ -9,6 +9,6 @@ The [WebFinger protocol](https://webfinger.net/) allows for the discovery of inf ## authentik WebFinger support -authentik provides a WebFinger endpoint when the **Default application** setting uses an OIDC provider. Instructions on how to set a **Default application** can be found in the [authentik Branding documentation](../../../customize/branding/index.md#external-user-settings). +authentik provides a WebFinger endpoint when the **Default application** setting uses an OIDC provider. Instructions on how to set a **Default application** can be found in the [authentik Branding documentation](../../../customize/branding/index.mdx#external-user-settings). The WebFinger endpoint is available at: `https://authentik.company/.well-known/webfinger` (where authentik.company is the FQDN of your authentik instance) diff --git a/website/docs/add-secure-apps/providers/property-mappings/expression.mdx b/website/docs/add-secure-apps/providers/property-mappings/expression.mdx index fa69782dfb..675886ca69 100644 --- a/website/docs/add-secure-apps/providers/property-mappings/expression.mdx +++ b/website/docs/add-secure-apps/providers/property-mappings/expression.mdx @@ -12,11 +12,11 @@ import Functions from "../../../expressions/reference/_functions.mdx"; ## Variables -import Objects from "../../../expressions/reference/_objects.md"; +import Objects from "../../../expressions/reference/_objects.mdx"; -import User from "../../../expressions/reference/_user.md"; +import User from "../../../expressions/reference/_user.mdx"; diff --git a/website/docs/add-secure-apps/providers/property-mappings/index.md b/website/docs/add-secure-apps/providers/property-mappings/index.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/property-mappings/index.md rename to website/docs/add-secure-apps/providers/property-mappings/index.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/__placeholders.md b/website/docs/add-secure-apps/providers/proxy/__placeholders.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/__placeholders.md rename to website/docs/add-secure-apps/providers/proxy/__placeholders.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_caddy_standalone.md b/website/docs/add-secure-apps/providers/proxy/_caddy_standalone.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_caddy_standalone.md rename to website/docs/add-secure-apps/providers/proxy/_caddy_standalone.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_envoy_istio.md b/website/docs/add-secure-apps/providers/proxy/_envoy_istio.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_envoy_istio.md rename to website/docs/add-secure-apps/providers/proxy/_envoy_istio.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_nginx_ingress.md b/website/docs/add-secure-apps/providers/proxy/_nginx_ingress.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_nginx_ingress.md rename to website/docs/add-secure-apps/providers/proxy/_nginx_ingress.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_nginx_proxy_manager.md b/website/docs/add-secure-apps/providers/proxy/_nginx_proxy_manager.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_nginx_proxy_manager.md rename to website/docs/add-secure-apps/providers/proxy/_nginx_proxy_manager.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_nginx_standalone.md b/website/docs/add-secure-apps/providers/proxy/_nginx_standalone.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_nginx_standalone.md rename to website/docs/add-secure-apps/providers/proxy/_nginx_standalone.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_traefik_compose.md b/website/docs/add-secure-apps/providers/proxy/_traefik_compose.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_traefik_compose.md rename to website/docs/add-secure-apps/providers/proxy/_traefik_compose.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_traefik_ingress.md b/website/docs/add-secure-apps/providers/proxy/_traefik_ingress.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_traefik_ingress.md rename to website/docs/add-secure-apps/providers/proxy/_traefik_ingress.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/_traefik_standalone.md b/website/docs/add-secure-apps/providers/proxy/_traefik_standalone.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/_traefik_standalone.md rename to website/docs/add-secure-apps/providers/proxy/_traefik_standalone.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/create-proxy-provider.md b/website/docs/add-secure-apps/providers/proxy/create-proxy-provider.mdx similarity index 99% rename from website/docs/add-secure-apps/providers/proxy/create-proxy-provider.md rename to website/docs/add-secure-apps/providers/proxy/create-proxy-provider.mdx index 90037a1272..4d9e13f2ee 100644 --- a/website/docs/add-secure-apps/providers/proxy/create-proxy-provider.md +++ b/website/docs/add-secure-apps/providers/proxy/create-proxy-provider.mdx @@ -2,7 +2,7 @@ title: Create a proxy provider --- -For an overview of how proxy providers work, see the [proxy provider](./index.md) documentation. +For an overview of how proxy providers work, see the [proxy provider](./index.mdx) documentation. ## Workflow to create a proxy provider diff --git a/website/docs/add-secure-apps/providers/proxy/custom_headers.md b/website/docs/add-secure-apps/providers/proxy/custom_headers.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/proxy/custom_headers.md rename to website/docs/add-secure-apps/providers/proxy/custom_headers.mdx diff --git a/website/docs/add-secure-apps/providers/proxy/index.md b/website/docs/add-secure-apps/providers/proxy/index.mdx similarity index 99% rename from website/docs/add-secure-apps/providers/proxy/index.md rename to website/docs/add-secure-apps/providers/proxy/index.mdx index 8ad0a034b0..fc9b8d96a4 100644 --- a/website/docs/add-secure-apps/providers/proxy/index.md +++ b/website/docs/add-secure-apps/providers/proxy/index.mdx @@ -11,7 +11,7 @@ Depending on the selected mode, one of the following happens: 1. The authentik outpost proxies requests to the upstream application. 2. Your existing reverse proxy handles the application traffic and asks the authentik outpost to check authentication and authorization. -Refer to the [create a proxy provider](./create-proxy-provider.md) documentation for setup instructions. +Refer to the [create a proxy provider](./create-proxy-provider.mdx) documentation for setup instructions. ```mermaid sequenceDiagram @@ -77,7 +77,7 @@ additionalHeaders: X-test-header: test-value ``` -For dynamic headers, see the [custom headers](./custom_headers.md) documentation. +For dynamic headers, see the [custom headers](./custom_headers.mdx) documentation. ## HTTPS diff --git a/website/docs/add-secure-apps/providers/proxy/server_caddy.mdx b/website/docs/add-secure-apps/providers/proxy/server_caddy.mdx index 007503478b..c45cb913da 100644 --- a/website/docs/add-secure-apps/providers/proxy/server_caddy.mdx +++ b/website/docs/add-secure-apps/providers/proxy/server_caddy.mdx @@ -5,8 +5,8 @@ title: Caddy import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; -import Placeholders from "./__placeholders.md"; -import CaddyStandalone from "./_caddy_standalone.md"; +import Placeholders from "./__placeholders.mdx"; +import CaddyStandalone from "./_caddy_standalone.mdx"; The configuration template shown below applies to both single-application and domain-level forward auth. diff --git a/website/docs/add-secure-apps/providers/proxy/server_envoy.mdx b/website/docs/add-secure-apps/providers/proxy/server_envoy.mdx index 4b56cc3f40..841cba428d 100644 --- a/website/docs/add-secure-apps/providers/proxy/server_envoy.mdx +++ b/website/docs/add-secure-apps/providers/proxy/server_envoy.mdx @@ -5,8 +5,8 @@ title: Envoy import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs"; -import Placeholders from "./__placeholders.md"; -import EnvoyIstio from "./_envoy_istio.md"; +import Placeholders from "./__placeholders.mdx"; +import EnvoyIstio from "./_envoy_istio.mdx"; The configuration template shown below applies to both single-application and domain-level forward auth. diff --git a/website/docs/add-secure-apps/providers/proxy/server_nginx.mdx b/website/docs/add-secure-apps/providers/proxy/server_nginx.mdx index b3dcf6fa08..e3d8a0ba6d 100644 --- a/website/docs/add-secure-apps/providers/proxy/server_nginx.mdx +++ b/website/docs/add-secure-apps/providers/proxy/server_nginx.mdx @@ -5,7 +5,7 @@ import Tabs from "@theme/Tabs"; The configuration templates shown below apply to both single-application and domain-level forward auth. -import Placeholders from "./__placeholders.md"; +import Placeholders from "./__placeholders.mdx"; @@ -18,21 +18,21 @@ import Placeholders from "./__placeholders.md"; ]}> -import NginxStandalone from "./_nginx_standalone.md"; +import NginxStandalone from "./_nginx_standalone.mdx"; -import NginxIngress from "./_nginx_ingress.md"; +import NginxIngress from "./_nginx_ingress.mdx"; -import NginxProxyManager from "./_nginx_proxy_manager.md"; +import NginxProxyManager from "./_nginx_proxy_manager.mdx"; diff --git a/website/docs/add-secure-apps/providers/proxy/server_traefik.mdx b/website/docs/add-secure-apps/providers/proxy/server_traefik.mdx index 602664d963..4e58fc5540 100644 --- a/website/docs/add-secure-apps/providers/proxy/server_traefik.mdx +++ b/website/docs/add-secure-apps/providers/proxy/server_traefik.mdx @@ -5,7 +5,7 @@ import Tabs from "@theme/Tabs"; The configuration templates shown below apply to both single-application and domain-level forward auth. -import Placeholders from "./__placeholders.md"; +import Placeholders from "./__placeholders.mdx"; @@ -18,21 +18,21 @@ import Placeholders from "./__placeholders.md"; ]}> -import TraefikStandalone from "./_traefik_standalone.md"; +import TraefikStandalone from "./_traefik_standalone.mdx"; -import TraefikCompose from "./_traefik_compose.md"; +import TraefikCompose from "./_traefik_compose.mdx"; -import TraefikIngress from "./_traefik_ingress.md"; +import TraefikIngress from "./_traefik_ingress.mdx"; diff --git a/website/docs/add-secure-apps/providers/rac/create-rac-provider.md b/website/docs/add-secure-apps/providers/rac/create-rac-provider.mdx similarity index 89% rename from website/docs/add-secure-apps/providers/rac/create-rac-provider.md rename to website/docs/add-secure-apps/providers/rac/create-rac-provider.mdx index fa67b9d450..6a458a189e 100644 --- a/website/docs/add-secure-apps/providers/rac/create-rac-provider.md +++ b/website/docs/add-secure-apps/providers/rac/create-rac-provider.mdx @@ -2,11 +2,19 @@ title: Create a Remote Access Control (RAC) provider --- -For an overview of Remote Access Control (RAC), see the [RAC provider](./index.md) documentation. +For an overview of Remote Access Control (RAC), see the [RAC provider](./index.mdx) documentation. You can also watch our video on YouTube for setting up RAC: - + ## Workflow to create an RAC provider @@ -33,7 +41,7 @@ To create a provider along with the corresponding application that uses it for a Next, you need to add property mappings for each remote machine you want to access. RAC property mappings can be used to pass the access credentials and connection settings of the remote machine. -Refer to the [RAC Credentials Prompt](./rac_credentials_prompt.md) and [RAC SSH Public Key Authentication](./rac-public-key.md) documentation for alternative methods of handling RAC authentication. +Refer to the [RAC Credentials Prompt](./rac_credentials_prompt.mdx) and [RAC SSH Public Key Authentication](./rac-public-key.mdx) documentation for alternative methods of handling RAC authentication. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**, and click **New Property Mapping**. @@ -44,7 +52,7 @@ Refer to the [RAC Credentials Prompt](./rac_credentials_prompt.md) and [RAC SSH - **Username**: the username for the remote machine - **Password**: the password for the remote machine - Under **Advanced settings**: - - **Expression _(optional)_**: define other connection settings to be used, such as an SSH key. For more information, refer to the [Connection settings](./index.md#connection-settings) documentation. + - **Expression _(optional)_**: define other connection settings to be used, such as an SSH key. For more information, refer to the [Connection settings](./index.mdx#connection-settings) documentation. 5. Click **Finish**. @@ -61,7 +69,7 @@ Then, you need to create an endpoint corresponding to each remote machine you wa - **Host**: enter the host name or IP address of the remote machine. Optionally include the port. - **Maximum concurrent connections**: select a value or use `-1` to disable the limitation - **Property mappings**: select either the property mapping that you previously created, or use one of the default RAC property mappings - - **Advanced settings _(optional)_**: define other connection settings to be used. For more information, refer to the [Connection settings](./index.md#connection-settings) documentation + - **Advanced settings _(optional)_**: define other connection settings to be used. For more information, refer to the [Connection settings](./index.mdx#connection-settings) documentation 5. Click **Create**. diff --git a/website/docs/add-secure-apps/providers/rac/index.md b/website/docs/add-secure-apps/providers/rac/index.mdx similarity index 94% rename from website/docs/add-secure-apps/providers/rac/index.md rename to website/docs/add-secure-apps/providers/rac/index.mdx index b5605c2dd9..51cb6a2967 100644 --- a/website/docs/add-secure-apps/providers/rac/index.md +++ b/website/docs/add-secure-apps/providers/rac/index.mdx @@ -6,7 +6,7 @@ sidebar_label: "RAC (Remote Access Control) Provider" The RAC provider allows users to access remote Windows, macOS, and Linux machines via [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol)/[SSH](https://en.wikipedia.org/wiki/Secure_Shell)/[VNC](https://en.wikipedia.org/wiki/Virtual_Network_Computing). Just like other providers in authentik, the RAC provider is associated with an application that appears on a user's **Application Dashboard** page. -For instructions on creating a RAC provider, refer to the [Create a Remote Access Control (RAC) provider](./create-rac-provider.md) documentation. Alternatively, watch our ["Remote Access Control (RAC) in authentik" video on YouTube](https://www.youtube.com/watch?v=9wahIBRV6Ts). +For instructions on creating a RAC provider, refer to the [Create a Remote Access Control (RAC) provider](./create-rac-provider.mdx) documentation. Alternatively, watch our ["Remote Access Control (RAC) in authentik" video on YouTube](https://www.youtube.com/watch?v=9wahIBRV6Ts). ## RAC components @@ -82,7 +82,7 @@ RAC connection settings can be set via several methods and are all merged togeth 5. RAC Endpoint property mapping settings 6. The `connection_settings` object in the flow plan -For examples of how to configure connection settings, see the [RAC SSH public key authentication](./rac-public-key.md) and [RAC Credentials Prompt](./rac_credentials_prompt.md) documentation. +For examples of how to configure connection settings, see the [RAC SSH public key authentication](./rac-public-key.mdx) and [RAC Credentials Prompt](./rac_credentials_prompt.mdx) documentation. ## Capabilities diff --git a/website/docs/add-secure-apps/providers/rac/rac-public-key.md b/website/docs/add-secure-apps/providers/rac/rac-public-key.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/rac/rac-public-key.md rename to website/docs/add-secure-apps/providers/rac/rac-public-key.mdx diff --git a/website/docs/add-secure-apps/providers/rac/rac_credentials_prompt.md b/website/docs/add-secure-apps/providers/rac/rac_credentials_prompt.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/rac/rac_credentials_prompt.md rename to website/docs/add-secure-apps/providers/rac/rac_credentials_prompt.mdx diff --git a/website/docs/add-secure-apps/providers/radius/index.mdx b/website/docs/add-secure-apps/providers/radius/index.mdx index e4e8b55aaf..e87222e972 100644 --- a/website/docs/add-secure-apps/providers/radius/index.mdx +++ b/website/docs/add-secure-apps/providers/radius/index.mdx @@ -20,9 +20,9 @@ Authentication requests against the Radius Server use a flow in the background. The following stages are supported: - - [Identification](../../flows-stages/stages/identification/index.md) - - [Password](../../flows-stages/stages/password/index.md) - - [Authenticator validation](../../flows-stages/stages/authenticator_validate/index.md) + - [Identification](../../flows-stages/stages/identification/index.mdx) + - [Password](../../flows-stages/stages/password/index.mdx) + - [Authenticator validation](../../flows-stages/stages/authenticator_validate/index.mdx) :::info Authenticator validation currently only supports DUO, TOTP, and static authenticator. @@ -32,10 +32,10 @@ The following stages are supported: SMS-based authenticators are not supported because they require a code to be sent from authentik, which is not possible during the bind. -- [User Logout](../../flows-stages/stages/user_logout/index.md) -- [User Login](../../flows-stages/stages/user_login/index.md) -- [Deny](../../flows-stages/stages/deny/index.md) -- [Mutual TLS stage](../../flows-stages/stages/mtls/index.md) +- [User Logout](../../flows-stages/stages/user_logout/index.mdx) +- [User Login](../../flows-stages/stages/user_login/index.mdx) +- [Deny](../../flows-stages/stages/deny/index.mdx) +- [Mutual TLS stage](../../flows-stages/stages/mtls/index.mdx) ### Protocol support @@ -55,7 +55,7 @@ authentik supports EAP with TLS as the inner protocol, between the application a #### EAP-TLS -Create an authentication flow with a [Mutual TLS stage](../../flows-stages/stages/mtls/index.md) as its first stage. This stage should be configured to use your CA's certificate. Afterwards a server certificate needs to be selected in the RADIUS provider (which serves as an outpost). Then, configure your RADIUS provider to use this authentication flow to enable EAP-TLS authentication. After the certificate and the authentication flow are configured in the provider, authentication via EAP-TLS is possible. +Create an authentication flow with a [Mutual TLS stage](../../flows-stages/stages/mtls/index.mdx) as its first stage. This stage should be configured to use your CA's certificate. Afterwards a server certificate needs to be selected in the RADIUS provider (which serves as an outpost). Then, configure your RADIUS provider to use this authentication flow to enable EAP-TLS authentication. After the certificate and the authentication flow are configured in the provider, authentication via EAP-TLS is possible. For certificates, ensure that you use a client certificate and a server certificate that are created by a certificate authority, not a self-generated certificate. diff --git a/website/docs/add-secure-apps/providers/saml/create-saml-provider.md b/website/docs/add-secure-apps/providers/saml/create-saml-provider.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/saml/create-saml-provider.md rename to website/docs/add-secure-apps/providers/saml/create-saml-provider.mdx diff --git a/website/docs/add-secure-apps/providers/saml/index.md b/website/docs/add-secure-apps/providers/saml/index.mdx similarity index 95% rename from website/docs/add-secure-apps/providers/saml/index.md rename to website/docs/add-secure-apps/providers/saml/index.mdx index 0f5e0d71dc..93ec5ee7e5 100644 --- a/website/docs/add-secure-apps/providers/saml/index.md +++ b/website/docs/add-secure-apps/providers/saml/index.mdx @@ -4,9 +4,9 @@ sidebar_position: 10 sidebar_label: "SAML Provider" --- -The SAML provider allows you to integrate with Service Providers using the SAML2 protocol. It supports [importing and exporting SAML metadata](#saml-metadata), [signed requests](#certificates) and uses [property mappings](../property-mappings/index.md#saml-property-mappings) to align, or "map", Service Provider and authentik attributes. +The SAML provider allows you to integrate with Service Providers using the SAML2 protocol. It supports [importing and exporting SAML metadata](#saml-metadata), [signed requests](#certificates) and uses [property mappings](../property-mappings/index.mdx#saml-property-mappings) to align, or "map", Service Provider and authentik attributes. -Refer to our documentation to learn how to [create a SAML provider](./create-saml-provider.md). +Refer to our documentation to learn how to [create a SAML provider](./create-saml-provider.mdx). ## SAML bindings and endpoints @@ -32,11 +32,11 @@ SAML Metadata ensures that SAML single sign-on works reliably by exchanging and ### Import SP SAML metadata -You can [import SP SAML metadata](./create-saml-provider.md#create-a-saml-provider-from-sp-metadata-import-sp-metadata) to automatically configure a SAML provider based on the requirements of an SP. +You can [import SP SAML metadata](./create-saml-provider.mdx#create-a-saml-provider-from-sp-metadata-import-sp-metadata) to automatically configure a SAML provider based on the requirements of an SP. ### Export authentik SAML metadata -You can [export SAML metadata from an authentik SAML provider](./create-saml-provider.md#export-authentik-saml-provider-metadata) to an SP to automatically provide important endpoint and certificate information to the SP. +You can [export SAML metadata from an authentik SAML provider](./create-saml-provider.mdx#export-authentik-saml-provider-metadata) to an SP to automatically provide important endpoint and certificate information to the SP. ## EntityID/Issuer override diff --git a/website/docs/add-secure-apps/providers/saml/saml_single_logout.md b/website/docs/add-secure-apps/providers/saml/saml_single_logout.mdx similarity index 90% rename from website/docs/add-secure-apps/providers/saml/saml_single_logout.md rename to website/docs/add-secure-apps/providers/saml/saml_single_logout.mdx index 022ca1a0fe..fcdc589103 100644 --- a/website/docs/add-secure-apps/providers/saml/saml_single_logout.md +++ b/website/docs/add-secure-apps/providers/saml/saml_single_logout.mdx @@ -3,7 +3,7 @@ title: SAML Single Logout authentik_version: "2025.10.0" --- -[Single Logout (SLO)](../single-logout/index.md) allows authentik to log out users from all configured providers simultaneously when they sign out of authentik. For SAML providers, this requires your service provider to support Single Logout via a Single Logout Service URL. Check your provider's documentation to confirm Single Logout support. +[Single Logout (SLO)](../single-logout/index.mdx) allows authentik to log out users from all configured providers simultaneously when they sign out of authentik. For SAML providers, this requires your service provider to support Single Logout via a Single Logout Service URL. Check your provider's documentation to confirm Single Logout support. ## Configure your SAML provider @@ -31,7 +31,7 @@ Back-channel logout ensures users are logged out even when their session is term SAML Service Providers can initiate logout by sending a SAML logout request to authentik. By default, only that Service Provider's session is ended while the authentik session remains active and the user stays logged in to other applications. -For instructions on how to trigger full Single Logout when a user logs out from a Service Provider, see [Enable full Single Logout for RP-initiated logout](../single-logout/index.md#enable-full-single-logout-for-rp-initiated-logout). +For instructions on how to trigger full Single Logout when a user logs out from a Service Provider, see [Enable full Single Logout for RP-initiated logout](../single-logout/index.mdx#enable-full-single-logout-for-rp-initiated-logout). ## How SAML Single Logout Works @@ -78,6 +78,6 @@ These session records are used to generate proper SAML logout requests with the ## Resources -- [Single Logout (SLO) Overview](../single-logout/index.md) -- [User Logout Stage](../../flows-stages/stages/user_logout/index.md) +- [Single Logout (SLO) Overview](../single-logout/index.mdx) +- [User Logout Stage](../../flows-stages/stages/user_logout/index.mdx) - [SAML Profiles 2.0 Specification](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf) diff --git a/website/docs/add-secure-apps/providers/scim/create-scim-provider.md b/website/docs/add-secure-apps/providers/scim/create-scim-provider.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/scim/create-scim-provider.md rename to website/docs/add-secure-apps/providers/scim/create-scim-provider.mdx diff --git a/website/docs/add-secure-apps/providers/scim/index.md b/website/docs/add-secure-apps/providers/scim/index.mdx similarity index 99% rename from website/docs/add-secure-apps/providers/scim/index.md rename to website/docs/add-secure-apps/providers/scim/index.mdx index d8845c9c7c..e774582ded 100644 --- a/website/docs/add-secure-apps/providers/scim/index.md +++ b/website/docs/add-secure-apps/providers/scim/index.mdx @@ -10,7 +10,7 @@ A SCIM provider requires a SCIM base URL for the endpoint and an authentication SCIM providers in authentik always serve as [backchannel providers](../../applications/manage_apps.mdx#backchannel-providers), which are used in addition to the main provider that supplies SSO authentication. A backchannel provider is used for an application that requires backend authentication, directory synchronization, or other additional authentication needs. -For instructions on creating a SCIM provider, refer to the [Create a SCIM provider](./create-scim-provider.md) documentation. +For instructions on creating a SCIM provider, refer to the [Create a SCIM provider](./create-scim-provider.mdx) documentation. ## Authentication modes diff --git a/website/docs/add-secure-apps/providers/single-logout/index.md b/website/docs/add-secure-apps/providers/single-logout/index.mdx similarity index 96% rename from website/docs/add-secure-apps/providers/single-logout/index.md rename to website/docs/add-secure-apps/providers/single-logout/index.mdx index dc70d3f8a8..d3d42392d4 100644 --- a/website/docs/add-secure-apps/providers/single-logout/index.md +++ b/website/docs/add-secure-apps/providers/single-logout/index.mdx @@ -17,7 +17,7 @@ Check with your service provider to see if they support SAML Single Logout or OI Single Logout behavior depends on where the user initiates logout: -- **Logout from authentik**: When a user logs out directly from authentik, the `default-invalidation-flow` runs. This flow includes a [User Logout stage](../../flows-stages/stages/user_logout/index.md) that ends the user's authentik session and triggers Single Logout for all connected applications. +- **Logout from authentik**: When a user logs out directly from authentik, the `default-invalidation-flow` runs. This flow includes a [User Logout stage](../../flows-stages/stages/user_logout/index.mdx) that ends the user's authentik session and triggers Single Logout for all connected applications. - **Logout from an application**: When a user logs out from an OIDC or SAML application, the `default-provider-invalidation-flow` runs. By default, this flow does **not** include a User Logout stage, so only that application's session is ended while the user's authentik session and other application sessions remain active. @@ -96,7 +96,7 @@ If you need different logout behaviors for different applications, you can creat 1. Create a new flow with the **Invalidation** designation. 2. Add stages as needed: - - Include a [User Logout stage](../../flows-stages/stages/user_logout/index.md) if you want full Single Logout. + - Include a [User Logout stage](../../flows-stages/stages/user_logout/index.mdx) if you want full Single Logout. - Omit the User Logout stage if you only want to end the specific application session. 3. When configuring a provider, select your custom flow in the **Invalidation Flow** field. @@ -108,7 +108,7 @@ Enabling single logout requires configuring logout endpoints on your SAML or OID ### SAML Providers -See the [SAML Single Logout documentation](../saml/saml_single_logout.md) for detailed instructions. You will need to: +See the [SAML Single Logout documentation](../saml/saml_single_logout.mdx) for detailed instructions. You will need to: 1. Configure the **SLS URL** (Single Logout Service URL) - the provider's logout endpoint 2. Select the **SLS Binding** (Redirect or POST) @@ -143,9 +143,9 @@ These requests are processed asynchronously to avoid blocking administrative ope ## Resources -- [SAML Single Logout](../saml/saml_single_logout.md) +- [SAML Single Logout](../saml/saml_single_logout.mdx) - [OIDC Front-channel and Back-channel Logout](../oauth2/frontchannel_and_backchannel_logout.mdx) -- [User Logout Stage](../../flows-stages/stages/user_logout/index.md) +- [User Logout Stage](../../flows-stages/stages/user_logout/index.mdx) - [SAML Profiles 2.0 Specification](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf) - [OpenID Connect Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html) - [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html) diff --git a/website/docs/add-secure-apps/providers/ssf/create-ssf-provider.md b/website/docs/add-secure-apps/providers/ssf/create-ssf-provider.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/ssf/create-ssf-provider.md rename to website/docs/add-secure-apps/providers/ssf/create-ssf-provider.mdx diff --git a/website/docs/add-secure-apps/providers/ssf/index.md b/website/docs/add-secure-apps/providers/ssf/index.mdx similarity index 99% rename from website/docs/add-secure-apps/providers/ssf/index.md rename to website/docs/add-secure-apps/providers/ssf/index.mdx index 2edd6236b7..1f4fb99bb5 100644 --- a/website/docs/add-secure-apps/providers/ssf/index.md +++ b/website/docs/add-secure-apps/providers/ssf/index.mdx @@ -15,7 +15,7 @@ The authentik SSF provider allows OIDC applications to subscribe to certain type Events in authentik that are tracked via SSF include when an MFA device is added or removed, logouts, sessions being revoked by Admin or user clicking logout, or credentials changed. -Refer to our documentation to learn how to [create a SSF provider](./create-ssf-provider.md). +Refer to our documentation to learn how to [create a SSF provider](./create-ssf-provider.mdx). ## Example use cases diff --git a/website/docs/add-secure-apps/providers/wsfed/create-wsfed-provider.md b/website/docs/add-secure-apps/providers/wsfed/create-wsfed-provider.mdx similarity index 100% rename from website/docs/add-secure-apps/providers/wsfed/create-wsfed-provider.md rename to website/docs/add-secure-apps/providers/wsfed/create-wsfed-provider.mdx diff --git a/website/docs/add-secure-apps/providers/wsfed/index.md b/website/docs/add-secure-apps/providers/wsfed/index.mdx similarity index 92% rename from website/docs/add-secure-apps/providers/wsfed/index.md rename to website/docs/add-secure-apps/providers/wsfed/index.mdx index 788d404393..f43c6d4ef0 100644 --- a/website/docs/add-secure-apps/providers/wsfed/index.md +++ b/website/docs/add-secure-apps/providers/wsfed/index.mdx @@ -36,20 +36,20 @@ _Bindings_ define how an Identity Provider (IdP) and the WS-Federation STS (Secu Using metadata ensures that WS-Federation single sign-on works reliably by exchanging and maintaining identity and connection information. WS-Federation metadata is an XML document that defines how IdPs and SPs securely interact for authentication. It includes information such as endpoints, bindings, certificates, and unique identifiers. The metadata is what you provide the application to configure it for authenticating with authentik. -You can [export WS-Federation metadata](./create-wsfed-provider.md#export-authentik-ws-federation-provider-metadata) from an authentik WS-Federation provider to an STS to automatically provide important endpoint and certificate information to the SP. +You can [export WS-Federation metadata](./create-wsfed-provider.mdx#export-authentik-ws-federation-provider-metadata) from an authentik WS-Federation provider to an STS to automatically provide important endpoint and certificate information to the SP. ## Certificates The certificates used with WS-Federation to sign Request Security Token Response (RSTR), which contains the assertion, are the same certificates that are used by SAML. -For details, refer to our [SAML certificates documentation](../saml/index.md#certificates). +For details, refer to our [SAML certificates documentation](../saml/index.mdx#certificates). ## WS-Federation property mappings Property mappings are used during the authentication process to align, or "map", user attributes values between the SP and STS (Security Token Service), the latter being the equivalent of SAML's IdP. -The same property mappings that are used in WS-Federation are used in SAML. For details, refer to our [SAML property mapping documentation](../saml/index.md#certificates). +The same property mappings that are used in WS-Federation are used in SAML. For details, refer to our [SAML property mapping documentation](../saml/index.mdx#certificates). ## Attributes for WS-Federation -WS-Federation and SAML also share the use of the [NameID](../saml/index.md#nameid) and the [AuthnContextClassRef](../saml/index.md#authncontextclassref) attributes. +WS-Federation and SAML also share the use of the [NameID](../saml/index.mdx#nameid) and the [AuthnContextClassRef](../saml/index.mdx#authncontextclassref) attributes. diff --git a/website/docs/core/architecture.md b/website/docs/core/architecture.mdx similarity index 83% rename from website/docs/core/architecture.md rename to website/docs/core/architecture.mdx index a74271e7b3..ded70b0e05 100644 --- a/website/docs/core/architecture.md +++ b/website/docs/core/architecture.mdx @@ -23,11 +23,11 @@ The core sub-component handles most of authentik's logic, such as API requests, #### Embedded outpost -Similar to [other outposts](../add-secure-apps/outposts/index.mdx), this outpost allows using [Proxy providers](../add-secure-apps/providers/proxy/index.md) without deploying a separate outpost. +Similar to [other outposts](../add-secure-apps/outposts/index.mdx), this outpost allows using [Proxy providers](../add-secure-apps/providers/proxy/index.mdx) without deploying a separate outpost. #### Persistence -- `/data` is used to store uploaded files (icons, flow backgrounds, etc.) and CSV reports. If not mounted, authentik will allow you to use external URLs for icons and other media fields instead of uploading files. See [Files](../customize/files.md) and [File picker values](../customize/file-picker.md) for more information. +- `/data` is used to store uploaded files (icons, flow backgrounds, etc.) and CSV reports. If not mounted, authentik will allow you to use external URLs for icons and other media fields instead of uploading files. See [Files](../customize/files.mdx) and [File picker values](../customize/file-picker.mdx) for more information. ### Worker @@ -35,8 +35,8 @@ This container executes background tasks, such as sending emails, the event noti #### Persistence -- `/certs` is used for authentik to import external certs, which in most cases shouldn't be used for SAML, but if you use authentik without a reverse proxy, this can be used, for example, for the [Let's Encrypt integration](../sys-mgmt/certificates.md#lets-encrypt-integration). -- `/templates` is used for [custom email templates](../add-secure-apps/flows-stages/stages/email/index.md#custom-templates), and as with the others is fully optional. +- `/certs` is used for authentik to import external certs, which in most cases shouldn't be used for SAML, but if you use authentik without a reverse proxy, this can be used, for example, for the [Let's Encrypt integration](../sys-mgmt/certificates.mdx#lets-encrypt-integration). +- `/templates` is used for [custom email templates](../add-secure-apps/flows-stages/stages/email/index.mdx#custom-templates), and as with the others is fully optional. ### PostgreSQL diff --git a/website/docs/customize/blueprints/index.mdx b/website/docs/customize/blueprints/index.mdx index 6dea0f3f0c..79ef242d3c 100644 --- a/website/docs/customize/blueprints/index.mdx +++ b/website/docs/customize/blueprints/index.mdx @@ -16,7 +16,7 @@ To _apply_ a blueprint means that the content in the blueprint file is instantia - as a _blueprint instance_ (a new instance of any authentik configuration, which you can then further customize) - as an _imported flow_ (to add a new flow, or to revert to the default, out-of-box flow) -To learn how to apply, create, modify, and manage blueprints, refer to [Working with blueprints](./working_with_blueprints.md). +To learn how to apply, create, modify, and manage blueprints, refer to [Working with blueprints](./working_with_blueprints.mdx). ### Blueprint instance @@ -33,7 +33,7 @@ You can apply an example flow by clicking **Import** on either the **Flows** pag This YAML file is validated and applied directly after being uploaded or selected from an available local path, but is not monitored further, nor is it automatically applied on startup like blueprint instances. :::info -Be aware that if you [modify and save](../../add-secure-apps/flows-stages/flow/#flow-configuration-options) an existing default flow, what you get is a merged version of the two: the _original flow_ (which is based on the blueprint) _plus any changes you made to the flow_. If you want to revert any modifications that you made to the default flow and get a fresh start with the original default flow, you have to _first_ delete the modified flow, and _then_ [apply the flow's blueprint](./working_with_blueprints.md#import-and-apply-a-blueprint) again. +Be aware that if you [modify and save](../../add-secure-apps/flows-stages/flow/#flow-configuration-options) an existing default flow, what you get is a merged version of the two: the _original flow_ (which is based on the blueprint) _plus any changes you made to the flow_. If you want to revert any modifications that you made to the default flow and get a fresh start with the original default flow, you have to _first_ delete the modified flow, and _then_ [apply the flow's blueprint](./working_with_blueprints.mdx#import-and-apply-a-blueprint) again. ::: :::warning Flow imports diff --git a/website/docs/customize/blueprints/v1/example.md b/website/docs/customize/blueprints/v1/example.mdx similarity index 100% rename from website/docs/customize/blueprints/v1/example.md rename to website/docs/customize/blueprints/v1/example.mdx diff --git a/website/docs/customize/blueprints/v1/meta.md b/website/docs/customize/blueprints/v1/meta.mdx similarity index 100% rename from website/docs/customize/blueprints/v1/meta.md rename to website/docs/customize/blueprints/v1/meta.mdx diff --git a/website/docs/customize/blueprints/v1/structure.md b/website/docs/customize/blueprints/v1/structure.mdx similarity index 100% rename from website/docs/customize/blueprints/v1/structure.md rename to website/docs/customize/blueprints/v1/structure.mdx diff --git a/website/docs/customize/blueprints/v1/tags.mdx b/website/docs/customize/blueprints/v1/tags.mdx index 6cc7c35dba..3c5b5ce6b7 100644 --- a/website/docs/customize/blueprints/v1/tags.mdx +++ b/website/docs/customize/blueprints/v1/tags.mdx @@ -193,7 +193,7 @@ Requires at least one argument after the mode selection. If only a single argument is provided, its boolean representation will be returned for all normal modes and its negated boolean representation will be returned for all negated modes. -Normally, it should be used to define complex conditions for use with an `!If` tag or for the `conditions` attribute of a blueprint entry (see [the blueprint file structure](./structure.md)). However, this is essentially just a boolean evaluator so it can be used everywhere a boolean representation is required. +Normally, it should be used to define complex conditions for use with an `!If` tag or for the `conditions` attribute of a blueprint entry (see [the blueprint file structure](./structure.mdx)). However, this is essentially just a boolean evaluator so it can be used everywhere a boolean representation is required. #### `!Enumerate`, `!Index` and `!Value` diff --git a/website/docs/customize/blueprints/working_with_blueprints.md b/website/docs/customize/blueprints/working_with_blueprints.mdx similarity index 97% rename from website/docs/customize/blueprints/working_with_blueprints.md rename to website/docs/customize/blueprints/working_with_blueprints.mdx index 88b5c6cc69..ee3b3cbcec 100644 --- a/website/docs/customize/blueprints/working_with_blueprints.md +++ b/website/docs/customize/blueprints/working_with_blueprints.mdx @@ -34,7 +34,7 @@ You can import and apply a blueprint from either the **Flows** page or the **Blu 2. Navigate to **Flows and Stages > Flows**, then click **Import**. 3. Choose how to import the blueprint: - **File upload**: upload a `.yaml` file from your local file system. Typically this is a downloaded example flow or a file you [exported](./export.mdx). - - **Local path**: select one of the blueprints available on the authentik server, such as a bundled [example flow](../../add-secure-apps/flows-stages/flow/examples/flows.md). + - **Local path**: select one of the blueprints available on the authentik server, such as a bundled [example flow](../../add-secure-apps/flows-stages/flow/examples/flows.mdx). 4. Click **Import**. #### Blueprints page @@ -54,7 +54,7 @@ You can import and apply a blueprint from either the **Flows** page or the **Blu ### Download an example flow, upload it, and apply it -1. Download one of the [example flows](../../add-secure-apps/flows-stages/flow/examples/flows.md). +1. Download one of the [example flows](../../add-secure-apps/flows-stages/flow/examples/flows.mdx). 2. Navigate to **Customization** > **Blueprints** and click **Import**. 3. Choose **File upload**, select the downloaded `.yaml` file, and click **Import**. diff --git a/website/docs/customize/branding/custom-css.mdx b/website/docs/customize/branding/custom-css.mdx index 4fbf9c4ff5..8ef6d3cea3 100644 --- a/website/docs/customize/branding/custom-css.mdx +++ b/website/docs/customize/branding/custom-css.mdx @@ -189,7 +189,7 @@ A preference for reduced motion doesn't necessarily mean eliminating all motion. ### Localization (`html[lang]`) -The authentik interface supports [multiple languages and regional settings](../../developer-docs/translation.md). Depending on the detected locale and your instance's localization settings, the interface may adjust text direction (left-to-right or right-to-left), date formats, and other locale-specific elements. +The authentik interface supports [multiple languages and regional settings](../../developer-docs/translation.mdx). Depending on the detected locale and your instance's localization settings, the interface may adjust text direction (left-to-right or right-to-left), date formats, and other locale-specific elements. Your custom CSS can accommodate these variations using the `[lang]` attribute selector: diff --git a/website/docs/customize/branding/index.md b/website/docs/customize/branding/index.mdx similarity index 88% rename from website/docs/customize/branding/index.md rename to website/docs/customize/branding/index.mdx index 14714fd112..147d7e2c86 100644 --- a/website/docs/customize/branding/index.md +++ b/website/docs/customize/branding/index.mdx @@ -21,10 +21,10 @@ The brand settings define the visual identity of the brand, including: - **Branding title**: Displayed in the browser tab (document title) and throughout the UI. - **Logo**: Displayed in the upper-left corner. - **Favicon**: Shown on the browser tab. -- **Default flow background** :ak-version[2025.4]: Default background image for the flow executor. See [Flow configuration options](../../add-secure-apps/flows-stages/flow/index.md#flow-configuration-options) to override this image on a per-flow basis. +- **Default flow background** :ak-version[2025.4]: Default background image for the flow executor. See [Flow configuration options](../../add-secure-apps/flows-stages/flow/index.mdx#flow-configuration-options) to override this image on a per-flow basis. - **Custom CSS** :ak-version[2025.4]: Add custom CSS to further customize the look of authentik. See [Custom CSS documentation](./custom-css.mdx) for more information. -Logo, favicon, and default flow background use the shared file picker. See [File picker values](../../customize/file-picker.md). +Logo, favicon, and default flow background use the shared file picker. See [File picker values](../../customize/file-picker.mdx). ### External user settings @@ -36,10 +36,10 @@ You can configure authentik to redirect external users to a default application ### Default flows -You can explicitly select, in your instance's Brand settings, the _default flows_ to use for the current brand. You can optionally configure these default flows ([learn more about each default flow](../../add-secure-apps/flows-stages/flow/default-flows.md)): +You can explicitly select, in your instance's Brand settings, the _default flows_ to use for the current brand. You can optionally configure these default flows ([learn more about each default flow](../../add-secure-apps/flows-stages/flow/default-flows.mdx)): - **Authentication** flow: the flow used to authenticate users. If left empty, the first applicable flow sorted by the slug is used. -- **User switch flow**: the authentication flow used when [switching between users](../../users-sources/user/user-switching.md) signed in on the same browser. If left empty, user switching is disabled. To reuse the default authentication flow for switching, select it here explicitly. +- **User switch flow**: the authentication flow used when [switching between users](../../users-sources/user/user-switching.mdx) signed in on the same browser. If left empty, user switching is disabled. To reuse the default authentication flow for switching, select it here explicitly. - **Invalidation Flow**: for typical use cases, select the `default-invalidation-flow` (Logout) flow. This flow logs the user out of authentik when the application session ends (user logs out of the app). - **Recovery flow**: if set, the user can access an option to recover their login credentials. - **Unenrollment flow**: if set, users are able to unenroll themselves using this flow. If no flow is set, option is not shown. @@ -62,7 +62,7 @@ The **Web Certificate** option can be used to configure which certificate authen ### Client Certificates:ak-version[2025.4] -When using the [Mutual TLS Stage](../../add-secure-apps/flows-stages/stages/mtls/index.md) and accessing authentik directly, this setting specifies which certificate authorities are trusted to issue client certificates. +When using the [Mutual TLS Stage](../../add-secure-apps/flows-stages/stages/mtls/index.mdx) and accessing authentik directly, this setting specifies which certificate authorities are trusted to issue client certificates. ### Attributes diff --git a/website/docs/customize/file-picker.md b/website/docs/customize/file-picker.mdx similarity index 100% rename from website/docs/customize/file-picker.md rename to website/docs/customize/file-picker.mdx diff --git a/website/docs/customize/files.md b/website/docs/customize/files.mdx similarity index 91% rename from website/docs/customize/files.md rename to website/docs/customize/files.mdx index 0484d65993..78ebd8cc56 100644 --- a/website/docs/customize/files.md +++ b/website/docs/customize/files.mdx @@ -2,11 +2,11 @@ title: Files --- -Image files are used in authentik to add icons to new applications or sources, and to define the ["branded" look](../customize/branding/index.md#branding-settings) of the authentik interface, with your company's logo and title, a favicon, or a background image for the flows. +Image files are used in authentik to add icons to new applications or sources, and to define the ["branded" look](../customize/branding/index.mdx#branding-settings) of the authentik interface, with your company's logo and title, a favicon, or a background image for the flows. -authentik provides a centralized file management system for storing and organizing these files. Files can be uploaded and managed from **Customization** > **Files** in the Admin interface. By default, files are stored on disk in the `/data` directory, but [S3 storage](../sys-mgmt/ops/storage-s3/index.md) can also be configured. +authentik provides a centralized file management system for storing and organizing these files. Files can be uploaded and managed from **Customization** > **Files** in the Admin interface. By default, files are stored on disk in the `/data` directory, but [S3 storage](../sys-mgmt/ops/storage-s3/index.mdx) can also be configured. -If file uploads are missing or unavailable after an upgrade, see [Errors when uploading icons](../troubleshooting/image_upload.md). +If file uploads are missing or unavailable after an upgrade, see [Errors when uploading icons](../troubleshooting/image_upload.mdx). ## Upload and manage files @@ -20,7 +20,7 @@ To upload and use image files, follow these steps: :::info Accepted values in picker fields Fields such as brand logos, favicons, flow backgrounds, application icons, and source icons all use the same file picker. Those fields can accept uploaded files, built-in static assets, external URLs, Font Awesome icons, and theme-aware paths using `%(theme)s`. -See [File picker values](./file-picker.md) for the full list of supported values and path rules. +See [File picker values](./file-picker.mdx) for the full list of supported values and path rules. ::: ## Technical deep dive diff --git a/website/docs/customize/index.md b/website/docs/customize/index.mdx similarity index 100% rename from website/docs/customize/index.md rename to website/docs/customize/index.mdx diff --git a/website/docs/customize/interfaces/_global/global.mdx b/website/docs/customize/interfaces/_global/global.mdx index eba4d587c1..90c68140cd 100644 --- a/website/docs/customize/interfaces/_global/global.mdx +++ b/website/docs/customize/interfaces/_global/global.mdx @@ -8,4 +8,4 @@ To customize the following brand settings, log in to the Admin interface and nav - Default flow background image - Custom CSS -For more details, see the [Brand settings](../../../customize/branding/index.md#branding-settings) documentation. +For more details, see the [Brand settings](../../../customize/branding/index.mdx#branding-settings) documentation. diff --git a/website/docs/customize/interfaces/admin/index.mdx b/website/docs/customize/interfaces/admin/index.mdx index 04701c3a60..f84b6badeb 100644 --- a/website/docs/customize/interfaces/admin/index.mdx +++ b/website/docs/customize/interfaces/admin/index.mdx @@ -3,7 +3,7 @@ title: Customize the Admin interface sidebar_label: Admin interface --- -The Admin interface can be customized using attributes configured in [Brands](../../../customize/branding/index.md). +The Admin interface can be customized using attributes configured in [Brands](../../../customize/branding/index.mdx). To add, remove, or modify attributes for a brand, log in to the Admin interface and navigate to **System > Brands > Other global settings > Attributes**. diff --git a/website/docs/customize/interfaces/flow/index.mdx b/website/docs/customize/interfaces/flow/index.mdx index b3635efef1..7b8dde830f 100644 --- a/website/docs/customize/interfaces/flow/index.mdx +++ b/website/docs/customize/interfaces/flow/index.mdx @@ -3,7 +3,7 @@ title: Customize a flow sidebar_label: Flow interface --- -Typically, settings for flows are defined as defaults in the [Brand settings](../../../customize/branding/index.md). However, it’s important to note that some flows are executed before the specific user is authenticated and thus before authentik can determine which user is viewing the flow (for example, the `default-authentication-flow`!). Consequently, using default settings for all flows ensures a more consistent user experience. +Typically, settings for flows are defined as defaults in the [Brand settings](../../../customize/branding/index.mdx). However, it’s important to note that some flows are executed before the specific user is authenticated and thus before authentik can determine which user is viewing the flow (for example, the `default-authentication-flow`!). Consequently, using default settings for all flows ensures a more consistent user experience. Two settings that you can configure per flow are the _background image_ for the flow, and the _layout_. @@ -11,8 +11,8 @@ Two settings that you can configure per flow are the _background image_ for the You can define a: -- Default background image for all flows, set in the instance's [brand](../../../customize/branding/index.md) -- A background image for [one or more specific flows](../../../add-secure-apps/flows-stages/flow/index.md#flow-configuration-options) (overrides the default) +- Default background image for all flows, set in the instance's [brand](../../../customize/branding/index.mdx) +- A background image for [one or more specific flows](../../../add-secure-apps/flows-stages/flow/index.mdx#flow-configuration-options) (overrides the default) ## Set the layout for a flow diff --git a/website/docs/customize/interfaces/user/index.mdx b/website/docs/customize/interfaces/user/index.mdx index 8b0e2a7f55..887ce446d8 100644 --- a/website/docs/customize/interfaces/user/index.mdx +++ b/website/docs/customize/interfaces/user/index.mdx @@ -3,7 +3,7 @@ title: Customize the User interface sidebar_label: User interface --- -The User interface can be customized using attributes configured in [Brands](../../../customize/branding/index.md). +The User interface can be customized using attributes configured in [Brands](../../../customize/branding/index.mdx). To add, remove, or modify attributes for a brand, log in as an administrator and navigate to **System > Brands > Other global settings > Attributes**. diff --git a/website/docs/customize/policies/bindings.md b/website/docs/customize/policies/bindings.mdx similarity index 88% rename from website/docs/customize/policies/bindings.md rename to website/docs/customize/policies/bindings.mdx index 57580362b4..4614fa9cf1 100644 --- a/website/docs/customize/policies/bindings.md +++ b/website/docs/customize/policies/bindings.mdx @@ -6,26 +6,26 @@ tags: - access-control --- -This page covers policy bindings: where they apply, how authentik evaluates them, and which options affect the result. For the broader binding model, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.md). For step-by-step instructions, see [Working with policies](./working_with_policies.md). +This page covers policy bindings: where they apply, how authentik evaluates them, and which options affect the result. For the broader binding model, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.mdx). For step-by-step instructions, see [Working with policies](./working_with_policies.mdx). ## Where policies can be bound :::info Stage bindings -In authentik, a stage is attached to a flow through a stage binding. When you attach a policy to a stage inside a flow, you are binding the policy to that stage binding, not directly to the stage definition itself. To learn more, see [Bindings](../../add-secure-apps/bindings-overview/index.md). +In authentik, a stage is attached to a flow through a stage binding. When you attach a policy to a stage inside a flow, you are binding the policy to that stage binding, not directly to the stage definition itself. To learn more, see [Bindings](../../add-secure-apps/bindings-overview/index.mdx). ::: -| Binding target | What it controls | How to configure it | -| -------------- | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | -| Flow | Whether the user can start or continue using the flow | [Bind a policy to a flow](./working_with_policies.md#bind-a-policy-to-a-flow) | -| Stage binding | Whether a specific stage runs in that flow | [Bind a policy to a stage binding](./working_with_policies.md#bind-a-policy-to-a-stage-binding) | -| Application | Whether the user can access the application | [Bind a policy to an application](./working_with_policies.md#bind-a-policy-to-an-application) | -| Source | Whether the source can be used for login or enrollment | [Bind a policy to a source](./working_with_policies.md#bind-a-policy-to-a-source) | +| Binding target | What it controls | How to configure it | +| -------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------ | +| Flow | Whether the user can start or continue using the flow | [Bind a policy to a flow](./working_with_policies.mdx#bind-a-policy-to-a-flow) | +| Stage binding | Whether a specific stage runs in that flow | [Bind a policy to a stage binding](./working_with_policies.mdx#bind-a-policy-to-a-stage-binding) | +| Application | Whether the user can access the application | [Bind a policy to an application](./working_with_policies.mdx#bind-a-policy-to-an-application) | +| Source | Whether the source can be used for login or enrollment | [Bind a policy to a source](./working_with_policies.mdx#bind-a-policy-to-a-source) | In the same binding UI, you can also bind a user or group directly. These bindings are simple membership checks and are useful when you want a direct allow or deny rule without creating a separate policy object. ## Validate prompt data with policies -Some stages also have their own policy hooks. The most common example is the [Prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.md), which supports **Validation Policies**. +Some stages also have their own policy hooks. The most common example is the [Prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.mdx), which supports **Validation Policies**. Use prompt-stage validation policies when the decision depends on data the user has just entered, such as: @@ -34,7 +34,7 @@ Use prompt-stage validation policies when the decision depends on data the user - matching two prompt fields - validating an email domain during enrollment -Prompt-stage validation is often the right place for [Password](./types/password.md), [Password Uniqueness](./types/password-uniqueness.md), and [Expression](./types/expression/index.mdx) policies. +Prompt-stage validation is often the right place for [Password](./types/password.mdx), [Password Uniqueness](./types/password-uniqueness.mdx), and [Expression](./types/expression/index.mdx) policies. ## How authentik evaluates policies diff --git a/website/docs/customize/policies/index.md b/website/docs/customize/policies/index.md deleted file mode 100644 index 652414d4c8..0000000000 --- a/website/docs/customize/policies/index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Policies -tags: - - policy - - security - - access-control -sidebar_position: 1 ---- - -Policies are reusable checks in authentik. They let you control whether a user can access an application, whether a stage in a flow should run, whether a source can be used, or whether data entered in a prompt stage is valid. - -If you are new to policies, start here: - -- [Working with policies](./working_with_policies.md) shows how to create a policy and bind it to a flow, stage, application, or source. -- [Policy bindings and evaluation](./bindings.md) explains where policies are attached and how authentik combines the results. -- [Types of policies in authentik](./types/index.mdx) groups the built-in policy types by use case. -- [Expression policies](./types/expression/index.mdx) covers Python-based policies for custom logic. - -## How policies fit together - -Every policy setup has three parts: - -1. A **policy** defines a single check, such as "is the client in an allowed country?" or "did the user enter an acceptable password?" -2. A **binding** decides where that policy applies, such as a flow, stage binding, application, or source. -3. The **target object** combines all of its bindings using either `Any` or `All` mode. - -You can also bind a **user** or **group** directly in the same places where you bind policies. Those direct bindings are evaluated like simple allow or deny checks and do not require writing a policy. - -## Choose a policy type - -Use the built-in policy types when they already match what you need. Reach for an expression policy when the built-in types are too limited. - -| Policy type | Use it when | Notes | -| ----------------------------------------------------- | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | -| [Event Matcher](./types/event-matcher.md) | You want to react to specific authentik events, usually for notifications or automations. | Matches event action, app, model, client IP, and [AKQL queries](../../sys-mgmt/akql.mdx#use-akql-in-an-event-matcher-policy). | -| [Expression](./types/expression/index.mdx) | You need custom logic that is not covered by a more specialized policy type. | Most flexible option. Runs Python and can inspect flow context, prompt data, user data, request metadata, and more. | -| [GeoIP](./types/geoip.md) | You want to allow or deny requests based on country, ASN, or travel patterns. | Can also check recent login distance and impossible-travel scenarios. | -| [Password](./types/password.md) | You want to validate password complexity, HIBP exposure, or zxcvbn strength. | Commonly attached to a prompt stage's **Validation Policies**. | -| [Password Expiry](./types/password-expiry.md) | You want to expire passwords after a fixed number of days. | Can either deny login or mark the password unusable so the user must update it. | -| [Password Uniqueness](./types/password-uniqueness.md) | You want to prevent password reuse. | Enterprise feature. | -| [Reputation](./types/reputation.md) | You want to react to failed logins or suspicious sign-in activity. | Useful for showing CAPTCHA or another challenge only to low-reputation requests. | - -## Deprecated policy types - -### Have I Been Pwned policy - -The standalone Have I Been Pwned policy is deprecated. Use the [Password Policy](./types/password.md) instead, which includes the same HIBP check. diff --git a/website/docs/customize/policies/index.mdx b/website/docs/customize/policies/index.mdx new file mode 100644 index 0000000000..9f11cc6642 --- /dev/null +++ b/website/docs/customize/policies/index.mdx @@ -0,0 +1,47 @@ +--- +title: Policies +tags: + - policy + - security + - access-control +sidebar_position: 1 +--- + +Policies are reusable checks in authentik. They let you control whether a user can access an application, whether a stage in a flow should run, whether a source can be used, or whether data entered in a prompt stage is valid. + +If you are new to policies, start here: + +- [Working with policies](./working_with_policies.mdx) shows how to create a policy and bind it to a flow, stage, application, or source. +- [Policy bindings and evaluation](./bindings.mdx) explains where policies are attached and how authentik combines the results. +- [Types of policies in authentik](./types/index.mdx) groups the built-in policy types by use case. +- [Expression policies](./types/expression/index.mdx) covers Python-based policies for custom logic. + +## How policies fit together + +Every policy setup has three parts: + +1. A **policy** defines a single check, such as "is the client in an allowed country?" or "did the user enter an acceptable password?" +2. A **binding** decides where that policy applies, such as a flow, stage binding, application, or source. +3. The **target object** combines all of its bindings using either `Any` or `All` mode. + +You can also bind a **user** or **group** directly in the same places where you bind policies. Those direct bindings are evaluated like simple allow or deny checks and do not require writing a policy. + +## Choose a policy type + +Use the built-in policy types when they already match what you need. Reach for an expression policy when the built-in types are too limited. + +| Policy type | Use it when | Notes | +| ------------------------------------------------------ | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | +| [Event Matcher](./types/event-matcher.mdx) | You want to react to specific authentik events, usually for notifications or automations. | Matches event action, app, model, client IP, and [AKQL queries](../../sys-mgmt/akql.mdx#use-akql-in-an-event-matcher-policy). | +| [Expression](./types/expression/index.mdx) | You need custom logic that is not covered by a more specialized policy type. | Most flexible option. Runs Python and can inspect flow context, prompt data, user data, request metadata, and more. | +| [GeoIP](./types/geoip.mdx) | You want to allow or deny requests based on country, ASN, or travel patterns. | Can also check recent login distance and impossible-travel scenarios. | +| [Password](./types/password.mdx) | You want to validate password complexity, HIBP exposure, or zxcvbn strength. | Commonly attached to a prompt stage's **Validation Policies**. | +| [Password Expiry](./types/password-expiry.mdx) | You want to expire passwords after a fixed number of days. | Can either deny login or mark the password unusable so the user must update it. | +| [Password Uniqueness](./types/password-uniqueness.mdx) | You want to prevent password reuse. | Enterprise feature. | +| [Reputation](./types/reputation.mdx) | You want to react to failed logins or suspicious sign-in activity. | Useful for showing CAPTCHA or another challenge only to low-reputation requests. | + +## Deprecated policy types + +### Have I Been Pwned policy + +The standalone Have I Been Pwned policy is deprecated. Use the [Password Policy](./types/password.mdx) instead, which includes the same HIBP check. diff --git a/website/docs/customize/policies/types/event-matcher.md b/website/docs/customize/policies/types/event-matcher.mdx similarity index 96% rename from website/docs/customize/policies/types/event-matcher.md rename to website/docs/customize/policies/types/event-matcher.mdx index c8528931ae..1dca8649bd 100644 --- a/website/docs/customize/policies/types/event-matcher.md +++ b/website/docs/customize/policies/types/event-matcher.mdx @@ -8,7 +8,7 @@ tags: Use an Event Matcher policy when you want to match authentik events with built-in fields or an [AKQL query](../../../sys-mgmt/akql.mdx#use-akql-in-an-event-matcher-policy). -This policy is most commonly used with [Notification Rules](../../../sys-mgmt/events/notifications.md). +This policy is most commonly used with [Notification Rules](../../../sys-mgmt/events/notifications.mdx). ## When to use it @@ -51,7 +51,7 @@ This policy is useful only when an event object is present in the policy context To send notifications for a subset of authentik events: 1. Create an Event Matcher policy. -2. Create or edit a [Notification Rule](../../../sys-mgmt/events/notifications.md). +2. Create or edit a [Notification Rule](../../../sys-mgmt/events/notifications.mdx). 3. Bind the policy to that notification rule. Be aware that an event has to match all configured fields in the policy, otherwise the notification rule will not trigger. diff --git a/website/docs/customize/policies/types/expression/index.mdx b/website/docs/customize/policies/types/expression/index.mdx index 7a9f8f5bd6..93fa08dc26 100644 --- a/website/docs/customize/policies/types/expression/index.mdx +++ b/website/docs/customize/policies/types/expression/index.mdx @@ -15,7 +15,7 @@ They are commonly used to: - enforce organization-specific access rules - make decisions based on request metadata, GeoIP, ASN, or flow context -For general policy concepts such as bindings, ordering, `Any` vs `All`, and where policies are attached, see [Policy bindings and evaluation](../../bindings.md). +For general policy concepts such as bindings, ordering, `Any` vs `All`, and where policies are attached, see [Policy bindings and evaluation](../../bindings.mdx). :::warning Privileged Feature Expression policies execute server-side Python inside authentik. Treat the ability to create or edit them as a highly privileged permission. @@ -24,9 +24,9 @@ Expression policies execute server-side Python inside authentik. Treat the abili ## Start here - [Expression reference](./reference.mdx) covers return values, helper functions, variables, and flow context. -- [Managing flow context keys](./managing_flow_context_keys.md) shows how to change flow behavior. -- [Switch which source is used based on email address](./source_switch.md) shows a common routing pattern. -- [Ensure unique email addresses](./unique_email.md) and [Allow only specific email domains](./whitelist_email.md) cover prompt-data validation. +- [Managing flow context keys](./managing_flow_context_keys.mdx) shows how to change flow behavior. +- [Switch which source is used based on email address](./source_switch.mdx) shows a common routing pattern. +- [Ensure unique email addresses](./unique_email.mdx) and [Allow only specific email domains](./whitelist_email.mdx) cover prompt-data validation. ## A simple example @@ -58,7 +58,7 @@ instead of relying on `request.user`. ### Prompt data lives in `context['prompt_data']` -If you are validating values entered in a [Prompt stage](../../../../add-secure-apps/flows-stages/stages/prompt/index.md), read them from `context["prompt_data"]`: +If you are validating values entered in a [Prompt stage](../../../../add-secure-apps/flows-stages/stages/prompt/index.mdx), read them from `context["prompt_data"]`: ```python email = context["prompt_data"]["email"] @@ -68,16 +68,16 @@ email = context["prompt_data"]["email"] When an expression runs inside a flow, you can inspect and update flow state through `context["flow_plan"]` and `context["flow_plan"].context`. This is powerful, but it also means your expression can change how the rest of the flow behaves. -For examples, see [Managing flow context keys](./managing_flow_context_keys.md) and [Switch which source is used based on email address](./source_switch.md). +For examples, see [Managing flow context keys](./managing_flow_context_keys.mdx) and [Switch which source is used based on email address](./source_switch.mdx). ## Sample expression policies The following examples document common uses: -- [Switch which source is used based on email address](./source_switch.md) -- [Managing flow context keys](./managing_flow_context_keys.md) -- [Ensure unique email addresses](./unique_email.md) -- [Allow only specific email domains](./whitelist_email.md) +- [Switch which source is used based on email address](./source_switch.mdx) +- [Managing flow context keys](./managing_flow_context_keys.mdx) +- [Ensure unique email addresses](./unique_email.mdx) +- [Allow only specific email domains](./whitelist_email.mdx) ### `auth_method` and `auth_method_args` @@ -140,4 +140,4 @@ For `ldap`, `context["auth_method_args"]` contains information about the source } ``` -For simple country or ASN checks, a [GeoIP policy](../geoip.md) is usually easier to manage than a custom expression. For flow manipulation, see the example pages above. +For simple country or ASN checks, a [GeoIP policy](../geoip.mdx) is usually easier to manage than a custom expression. For flow manipulation, see the example pages above. diff --git a/website/docs/customize/policies/types/expression/managing_flow_context_keys.md b/website/docs/customize/policies/types/expression/managing_flow_context_keys.mdx similarity index 79% rename from website/docs/customize/policies/types/expression/managing_flow_context_keys.md rename to website/docs/customize/policies/types/expression/managing_flow_context_keys.mdx index bcb4baf587..997556ac19 100644 --- a/website/docs/customize/policies/types/expression/managing_flow_context_keys.md +++ b/website/docs/customize/policies/types/expression/managing_flow_context_keys.mdx @@ -6,11 +6,11 @@ tags: - flows --- -[Flow context](../../../../add-secure-apps/flows-stages/flow/context/index.mdx) can be read and updated from an [Expression policy](./index.mdx) through `context["flow_plan"].context`. For more information about the active plan, see [Flow Planner](../../../../add-secure-apps/flows-stages/flow/planner.md). +[Flow context](../../../../add-secure-apps/flows-stages/flow/context/index.mdx) can be read and updated from an [Expression policy](./index.mdx) through `context["flow_plan"].context`. For more information about the active plan, see [Flow Planner](../../../../add-secure-apps/flows-stages/flow/planner.mdx). This is useful when you want to influence later stages in the same flow, such as changing a redirect target or passing data to another stage. -For `redirect_stage_target`, use the format `ak-flow://{slug}` when you want the [Redirect stage](../../../../add-secure-apps/flows-stages/stages/redirect/index.md) to redirect to another flow. See [`redirect_stage_target`](../../../../add-secure-apps/flows-stages/flow/context/index.mdx#redirect_stage_target-string) for the full behavior. +For `redirect_stage_target`, use the format `ak-flow://{slug}` when you want the [Redirect stage](../../../../add-secure-apps/flows-stages/stages/redirect/index.mdx) to redirect to another flow. See [`redirect_stage_target`](../../../../add-secure-apps/flows-stages/flow/context/index.mdx#redirect_stage_target-string) for the full behavior. ## Set a flow-context key diff --git a/website/docs/customize/policies/types/expression/reference.mdx b/website/docs/customize/policies/types/expression/reference.mdx index f56ea0a5bb..d881267ebd 100644 --- a/website/docs/customize/policies/types/expression/reference.mdx +++ b/website/docs/customize/policies/types/expression/reference.mdx @@ -8,7 +8,7 @@ tags: --- import Functions from "../../../../expressions/reference/_functions.mdx"; -import Objects from "../../../../expressions/reference/_objects.md"; +import Objects from "../../../../expressions/reference/_objects.mdx"; This page documents the expression policy execution environment in authentik. @@ -92,7 +92,7 @@ return context["geoip"]["continent"] == "EU" ``` :::info Prefer GeoIP Policy -For simple country matching, prefer a [GeoIP policy](../geoip.md). +For simple country matching, prefer a [GeoIP policy](../geoip.mdx). ::: ### `asn` @@ -110,7 +110,7 @@ return context["asn"]["asn"] == 6939 ``` :::info Prefer GeoIP Policy -For simple ASN matching, prefer a [GeoIP policy](../geoip.md). +For simple ASN matching, prefer a [GeoIP policy](../geoip.mdx). ::: ### `ak_client_ip` diff --git a/website/docs/customize/policies/types/expression/source_switch.md b/website/docs/customize/policies/types/expression/source_switch.mdx similarity index 86% rename from website/docs/customize/policies/types/expression/source_switch.md rename to website/docs/customize/policies/types/expression/source_switch.mdx index eef70ea629..e77867928b 100644 --- a/website/docs/customize/policies/types/expression/source_switch.md +++ b/website/docs/customize/policies/types/expression/source_switch.mdx @@ -12,7 +12,7 @@ This is useful when different email domains should authenticate against differen ## Create the policy -[Create an expression policy](../../working_with_policies.md#create-a-policy) that: +[Create an expression policy](../../working_with_policies.mdx#create-a-policy) that: 1. maps email domains to source slugs 2. reads the identifier collected earlier in the flow @@ -20,9 +20,9 @@ This is useful when different email domains should authenticate against differen ## Where to bind it -Bind the expression to the stage binding immediately after the [Identification stage](../../../../add-secure-apps/flows-stages/stages/identification/index.md), or after whichever stage first collects the identifier you want to inspect. +Bind the expression to the stage binding immediately after the [Identification stage](../../../../add-secure-apps/flows-stages/stages/identification/index.mdx), or after whichever stage first collects the identifier you want to inspect. -For more background on binding policies to stages, see [Working with policies](../../working_with_policies.md#bind-a-policy-to-a-stage-binding). +For more background on binding policies to stages, see [Working with policies](../../working_with_policies.mdx#bind-a-policy-to-a-stage-binding). ## Example expression diff --git a/website/docs/customize/policies/types/expression/unique_email.md b/website/docs/customize/policies/types/expression/unique_email.mdx similarity index 84% rename from website/docs/customize/policies/types/expression/unique_email.md rename to website/docs/customize/policies/types/expression/unique_email.mdx index c04c722aa8..803bebc1b4 100644 --- a/website/docs/customize/policies/types/expression/unique_email.md +++ b/website/docs/customize/policies/types/expression/unique_email.mdx @@ -8,7 +8,7 @@ tags: By default, authentik does not require email addresses to be unique. If you want to enforce uniqueness, use an [expression policy](./index.mdx) during enrollment or profile-edit flows. -Bind the policy before the [User write stage](../../../../add-secure-apps/flows-stages/stages/user_write/index.md), or attach it directly to the [Prompt stage](../../../../add-secure-apps/flows-stages/stages/prompt/index.md) that collects the email address. +Bind the policy before the [User write stage](../../../../add-secure-apps/flows-stages/stages/user_write/index.mdx), or attach it directly to the [Prompt stage](../../../../add-secure-apps/flows-stages/stages/prompt/index.mdx) that collects the email address. ## Example expression diff --git a/website/docs/customize/policies/types/expression/whitelist_email.md b/website/docs/customize/policies/types/expression/whitelist_email.mdx similarity index 100% rename from website/docs/customize/policies/types/expression/whitelist_email.md rename to website/docs/customize/policies/types/expression/whitelist_email.mdx diff --git a/website/docs/customize/policies/types/geoip.md b/website/docs/customize/policies/types/geoip.mdx similarity index 100% rename from website/docs/customize/policies/types/geoip.md rename to website/docs/customize/policies/types/geoip.mdx diff --git a/website/docs/customize/policies/types/password-expiry.md b/website/docs/customize/policies/types/password-expiry.mdx similarity index 95% rename from website/docs/customize/policies/types/password-expiry.md rename to website/docs/customize/policies/types/password-expiry.mdx index 4e5fb6b9b2..61ad0ee6f5 100644 --- a/website/docs/customize/policies/types/password-expiry.md +++ b/website/docs/customize/policies/types/password-expiry.mdx @@ -34,4 +34,4 @@ When the configured limit is exceeded, the policy fails. Depending on the policy Password Expiry policies are usually used together with a password change or recovery flow so users have a clear path to set a new password after expiry. -If you also need password-history enforcement, combine this policy with [Password Uniqueness Policy](./password-uniqueness.md). +If you also need password-history enforcement, combine this policy with [Password Uniqueness Policy](./password-uniqueness.mdx). diff --git a/website/docs/customize/policies/types/password-uniqueness.md b/website/docs/customize/policies/types/password-uniqueness.mdx similarity index 89% rename from website/docs/customize/policies/types/password-uniqueness.md rename to website/docs/customize/policies/types/password-uniqueness.mdx index 0c279e3111..d902bbd1e6 100644 --- a/website/docs/customize/policies/types/password-uniqueness.md +++ b/website/docs/customize/policies/types/password-uniqueness.mdx @@ -11,7 +11,7 @@ authentik_enterprise: true The Password Uniqueness policy is an enterprise policy that prevents users from reusing previously used passwords. -In most deployments, you attach it to a [Prompt stage](../../../add-secure-apps/flows-stages/stages/prompt/index.md) through that stage's **Validation Policies** so authentik can validate the new password at the moment it is entered. +In most deployments, you attach it to a [Prompt stage](../../../add-secure-apps/flows-stages/stages/prompt/index.mdx) through that stage's **Validation Policies** so authentik can validate the new password at the moment it is entered. ## How it works @@ -35,8 +35,8 @@ Use Password Uniqueness when you need password-history enforcement, such as: For broader password controls, combine it with: -- [Password Policy](./password.md) for complexity, HIBP, and zxcvbn checks -- [Password Expiry Policy](./password-expiry.md) if you also require password rotation +- [Password Policy](./password.mdx) for complexity, HIBP, and zxcvbn checks +- [Password Expiry Policy](./password-expiry.mdx) if you also require password rotation ## Create the policy diff --git a/website/docs/customize/policies/types/password.md b/website/docs/customize/policies/types/password.mdx similarity index 90% rename from website/docs/customize/policies/types/password.md rename to website/docs/customize/policies/types/password.mdx index 62695dbd64..dafde364cd 100644 --- a/website/docs/customize/policies/types/password.md +++ b/website/docs/customize/policies/types/password.mdx @@ -8,7 +8,7 @@ tags: Use a Password policy when you want to validate a password entered in a prompt stage. -This policy is most often attached to a [Prompt stage](../../../add-secure-apps/flows-stages/stages/prompt/index.md) through that stage's **Validation Policies**. +This policy is most often attached to a [Prompt stage](../../../add-secure-apps/flows-stages/stages/prompt/index.mdx) through that stage's **Validation Policies**. ## What it can enforce @@ -23,7 +23,7 @@ A Password policy can enforce: The policy reads the configured password field from prompt data, so the field key in the policy must match the password field used by your prompt stage. :::warning Password Guidance -By default, authentik's Password policy aligns with [NIST password guidance](https://pages.nist.gov/800-63-4/sp800-63b.html#password). Be careful when tightening or weakening those defaults. For broader guidance, see [Hardening authentik](../../../security/security-hardening.md#password-policy). +By default, authentik's Password policy aligns with [NIST password guidance](https://pages.nist.gov/800-63-4/sp800-63b.html#password). Be careful when tightening or weakening those defaults. For broader guidance, see [Hardening authentik](../../../security/security-hardening.mdx#password-policy). ::: ## Have I Been Pwned checks @@ -54,4 +54,4 @@ This is commonly used in: - password reset flows - password change flows -If you also want to prevent password reuse, combine this policy with [Password Uniqueness Policy](./password-uniqueness.md). +If you also want to prevent password reuse, combine this policy with [Password Uniqueness Policy](./password-uniqueness.mdx). diff --git a/website/docs/customize/policies/types/reputation.md b/website/docs/customize/policies/types/reputation.mdx similarity index 94% rename from website/docs/customize/policies/types/reputation.md rename to website/docs/customize/policies/types/reputation.mdx index bd267025ef..d8a3fb5953 100644 --- a/website/docs/customize/policies/types/reputation.md +++ b/website/docs/customize/policies/types/reputation.mdx @@ -39,10 +39,10 @@ The threshold defaults to a low score, so the policy is naturally suited to "tri ## Use it on stage bindings -When you use a Reputation policy on a flow stage binding, configure the stage binding to **Evaluate when stage is run** so authentik can use the latest request context. For more information, see [Planning and stage policies](../../../add-secure-apps/flows-stages/flow/planner.md#planning-and-stage-policies). +When you use a Reputation policy on a flow stage binding, configure the stage binding to **Evaluate when stage is run** so authentik can use the latest request context. For more information, see [Planning and stage policies](../../../add-secure-apps/flows-stages/flow/planner.mdx#planning-and-stage-policies). This is especially important when the policy should react to the current login attempt rather than only to the initial planned flow state. ## Related settings -System-wide reputation limits and expiry are documented in [Settings](../../../sys-mgmt/settings.md). +System-wide reputation limits and expiry are documented in [Settings](../../../sys-mgmt/settings.mdx). diff --git a/website/docs/customize/policies/working_with_policies.md b/website/docs/customize/policies/working_with_policies.mdx similarity index 87% rename from website/docs/customize/policies/working_with_policies.md rename to website/docs/customize/policies/working_with_policies.mdx index f409dcf435..e59ff1dccc 100644 --- a/website/docs/customize/policies/working_with_policies.md +++ b/website/docs/customize/policies/working_with_policies.mdx @@ -6,7 +6,7 @@ tags: - how-to --- -For an overview of policies, refer to our documentation on [Policies](./index.md). +For an overview of policies, refer to our documentation on [Policies](./index.mdx). authentik provides several [built-in policy types](./types/index.mdx), which can be configured for your specific needs. We also document several useful [expression policy examples](./types/expression/index.mdx#sample-expression-policies). @@ -14,7 +14,7 @@ authentik provides several [built-in policy types](./types/index.mdx), which can You can add expressions to built-in policies to further customize them. ::: -To learn more, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.md) and [bind a policy to a new application when the application is created](../../add-secure-apps/applications/manage_apps.mdx#create-an-application-and-provider-pair). +To learn more, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.mdx) and [bind a policy to a new application when the application is created](../../add-secure-apps/applications/manage_apps.mdx#create-an-application-and-provider-pair). ## Create a policy @@ -33,12 +33,12 @@ If you are not sure which policy type to choose, see [Types of policies in authe After creating the policy, you can bind it to either a: -- [Flow](../../add-secure-apps/flows-stages/flow/index.md) -- [Stage binding](../../add-secure-apps/flows-stages/stages/index.md#stage-bindings) -- [Application](../../add-secure-apps/applications/index.md) -- [Source](../../users-sources/sources/index.md) +- [Flow](../../add-secure-apps/flows-stages/flow/index.mdx) +- [Stage binding](../../add-secure-apps/flows-stages/stages/index.mdx#stage-bindings) +- [Application](../../add-secure-apps/applications/index.mdx) +- [Source](../../users-sources/sources/index.mdx) -For background about policy bindings, stage bindings, and why policies on stages are bound to flow-stage bindings, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.md). +For background about policy bindings, stage bindings, and why policies on stages are bound to flow-stage bindings, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.mdx). ### Bind a policy to a flow @@ -65,7 +65,7 @@ When you bind a policy to a stage binding, this task is done per flow, and does 5. Click the arrow (**>**) beside the name of the stage to which you want to bind a policy. The details for that stage are displayed. 6. Either create and bind a new policy, or bind an existing policy, group, or user. -If the policy depends on request data that is only known after the user has interacted with the flow, configure the stage binding to **Evaluate when stage is run**. For more information, see [Planning and stage policies](../../add-secure-apps/flows-stages/flow/planner.md#planning-and-stage-policies). +If the policy depends on request data that is only known after the user has interacted with the flow, configure the stage binding to **Evaluate when stage is run**. For more information, see [Planning and stage policies](../../add-secure-apps/flows-stages/flow/planner.mdx#planning-and-stage-policies). ### Bind a policy to an application @@ -87,4 +87,4 @@ These bindings control which users or groups can access a source. 4. Click the **Policy Bindings** tab at the top of the page. 5. Either create and bind a new policy, or bind an existing policy, group, or user. -For background on policy ordering, engine mode, and binding options, see [Policy bindings and evaluation](./bindings.md). +For background on policy ordering, engine mode, and binding options, see [Policy bindings and evaluation](./bindings.mdx). diff --git a/website/docs/developer-docs/contributing.md b/website/docs/developer-docs/contributing.mdx similarity index 96% rename from website/docs/developer-docs/contributing.md rename to website/docs/developer-docs/contributing.mdx index 6acd8a312a..70087ef781 100644 --- a/website/docs/developer-docs/contributing.md +++ b/website/docs/developer-docs/contributing.mdx @@ -125,7 +125,7 @@ This is documented in the [developer docs](./setup/frontend-dev-environment.mdx) Contributions to the technical documentation are greatly appreciated. Open a PR if you have improvements to make or new content to add. If you have questions or suggestions about the documentation, open an Issue. No contribution is too small. -Please be sure to refer to our [Style Guide](../developer-docs/docs/style-guide.mdx) for the docs, and use a [template](./docs/templates/index.md) to make it easier for you. The style guidelines are also used for any Integrations documentation, and we have a template for Integrations as well, in our [GitHub repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.md`. +Please be sure to refer to our [Style Guide](../developer-docs/docs/style-guide.mdx) for the docs, and use a [template](./docs/templates/index.mdx) to make it easier for you. The style guidelines are also used for any Integrations documentation, and we have a template for Integrations as well, in our [GitHub repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.mdx`. ### Pull requests @@ -216,4 +216,4 @@ Refer to the full [Style Guide](../developer-docs/docs/style-guide.mdx) for deta - We use **bold** text to name UI components, and _italic_ text for variables. -- Use [MDX](https://mdxjs.com/) only when the page requires components such as tabs or action buttons. Use Markdown for ordinary prose and formatting. +- Documentation pages are `.mdx`. Ordinary Markdown prose works as usual; add components such as tabs when the page needs them. diff --git a/website/docs/developer-docs/docs/style-guide.mdx b/website/docs/developer-docs/docs/style-guide.mdx index a5cbfbfe82..c159a7f5fe 100644 --- a/website/docs/developer-docs/docs/style-guide.mdx +++ b/website/docs/developer-docs/docs/style-guide.mdx @@ -4,7 +4,7 @@ title: Style guide This style guide helps keep authentik documentation consistent, clear, and easy to follow. It standardizes phrasing, formatting, tone, and structure. -We appreciate all contributions to our documentation — whether it's fixing a typo, adding new content, or writing an entirely new topic. To help us review and merge your contributions more efficiently, please follow our [writing documentation](./writing-documentation.md) guidelines. If you notice any inconsistencies, feel free to open an [Issue](https://github.com/goauthentik/authentik/issues) or submit a [Pull Request](https://github.com/goauthentik/authentik/pulls) to fix them. +We appreciate all contributions to our documentation — whether it's fixing a typo, adding new content, or writing an entirely new topic. To help us review and merge your contributions more efficiently, please follow our [writing documentation](./writing-documentation.mdx) guidelines. If you notice any inconsistencies, feel free to open an [Issue](https://github.com/goauthentik/authentik/issues) or submit a [Pull Request](https://github.com/goauthentik/authentik/pulls) to fix them. - [General style guidelines](#general-style-guidelines) - [Terminology](#terminology) @@ -44,13 +44,13 @@ Always include cross-references to related content. If a concept is referenced e Use relative paths when linking to other documentation files in this repository. Relative paths make links portable across documentation deployments, but they do not update automatically when files move. Use an absolute URL for resources outside this repository. -### Markdown file type +### File type -The standard file type for documentation is `.md`. Use `.mdx` only if React components, such as interactive elements, are required. +The standard file type for documentation is `.mdx`. ### OS-agnostic, clarify where needed -Try to write procedural (How To) docs generically enough that it does not endorse or force a specific operating system. If it is necessary to specify a specific OS be sure to label it clearly. Consider using tabs (with MDX) to show the different OSes. +Try to write procedural (How To) docs generically enough that it does not endorse or force a specific operating system. If it is necessary to specify a specific OS be sure to label it clearly. Consider using tabs to show the different OSes. --- diff --git a/website/docs/developer-docs/docs/templates/combo.md b/website/docs/developer-docs/docs/templates/combo.mdx similarity index 76% rename from website/docs/developer-docs/docs/templates/combo.md rename to website/docs/developer-docs/docs/templates/combo.mdx index 3db8472392..864803fa25 100644 --- a/website/docs/developer-docs/docs/templates/combo.md +++ b/website/docs/developer-docs/docs/templates/combo.mdx @@ -3,13 +3,13 @@ title: "Combination topic (most common)" --- :::info How to use this template -Start with the markdown version of the template, either by copying the [`combo.tmpl.md`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: +Start with the MDX template, either by copying the [`combo.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: ```shell -wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/combo.tmpl.md +wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/combo.tmpl.mdx ``` -Edit your markdown file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. +Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. ::: For a combo topic, the title is typically the name of the feature ("Branding" or "Remote Access Control"). diff --git a/website/docs/developer-docs/docs/templates/combo.tmpl.md b/website/docs/developer-docs/docs/templates/combo.tmpl.mdx similarity index 97% rename from website/docs/developer-docs/docs/templates/combo.tmpl.md rename to website/docs/developer-docs/docs/templates/combo.tmpl.mdx index b9034067aa..20b9b32233 100644 --- a/website/docs/developer-docs/docs/templates/combo.tmpl.md +++ b/website/docs/developer-docs/docs/templates/combo.tmpl.mdx @@ -1,5 +1,5 @@ --- -title: "Markdown template: combo" +title: "MDX template: combo" --- Add a brief description of the feature or functionality. diff --git a/website/docs/developer-docs/docs/templates/conceptual.md b/website/docs/developer-docs/docs/templates/conceptual.mdx similarity index 72% rename from website/docs/developer-docs/docs/templates/conceptual.md rename to website/docs/developer-docs/docs/templates/conceptual.mdx index c7bd98f16e..185e4ac2c0 100644 --- a/website/docs/developer-docs/docs/templates/conceptual.md +++ b/website/docs/developer-docs/docs/templates/conceptual.mdx @@ -3,13 +3,13 @@ title: "Conceptual topic" --- :::info How to use this template -Start with the markdown version of the template, either by copying the [`conceptual.tmpl.md`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: +Start with the MDX template, either by copying the [`conceptual.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: ```shell -wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/conceptual.tmpl.md +wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/conceptual.tmpl.mdx ``` -Edit your markdown file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. +Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. ::: Use a title that focuses on the feature, component, or technology you are writing about... for example, "About authentik policies" or "Understanding outposts". For conceptual docs, the verb in the title should indicate a concept, such as "About" or "Overview" or "Understanding", followed by the noun (the component or object you are writing about). diff --git a/website/docs/developer-docs/docs/templates/conceptual.tmpl.md b/website/docs/developer-docs/docs/templates/conceptual.tmpl.mdx similarity index 92% rename from website/docs/developer-docs/docs/templates/conceptual.tmpl.md rename to website/docs/developer-docs/docs/templates/conceptual.tmpl.mdx index 0fccf56e1b..12ca413d65 100644 --- a/website/docs/developer-docs/docs/templates/conceptual.tmpl.md +++ b/website/docs/developer-docs/docs/templates/conceptual.tmpl.mdx @@ -1,5 +1,5 @@ --- -title: "Markdown template: conceptual" +title: "MDX template: conceptual" --- Write a few sentences introducing the feature/component/technology. diff --git a/website/docs/developer-docs/docs/templates/index.md b/website/docs/developer-docs/docs/templates/index.md deleted file mode 100644 index c3d93adc2e..0000000000 --- a/website/docs/developer-docs/docs/templates/index.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: "Templates" ---- - -In technical documentation, there are document "types" (similar to how there are data types). We have templates for the different types, to make it super-easy to divide longer topics into separate pages (one for each content type) if needed. And templates in general make it easy for whomever wants to contribute some documentation! - -The most common types are: - -- [**Combo**](./combo.md): For most topics (unless they are very large and complex), we can combine the procedural and conceptual information into a single document. A handy guideline to follow is: "If the actual 1., 2., 3. steps are buried at the bottom, and a reader has to scroll multiple times to find them, then the combo approach is _not_ the right one. Use separate topics.". - -- [**Procedural**](./procedural.md): these are How To docs, the HOW information, with step-by-step instructions for accomplishing a task. This is what most people are looking for when they open the docs... and best practice is to separate the procedural docs from long, lengthy conceptual or reference docs. - -- [**Conceptual**](./conceptual.md): these docs provide the WHY information, and explain when to use a feature (or when not to!), and general concepts behind the feature or functionality. - -- [**Reference**](./reference.md): this is typically tables or lists of reference information, such as configuration values, or functions, or most commonly APIs. - -### Add a new integration - -To add documentation for a new integration (with support level Community or Vendor), please use the integration templates [`service.md`](https://github.com/goauthentik/authentik/blob/main/website/integrations/template/service.md) from our GitHub repo. You can download the template using the following command: - -```shell -wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/integrations/template/service.md -``` diff --git a/website/docs/developer-docs/docs/templates/index.mdx b/website/docs/developer-docs/docs/templates/index.mdx new file mode 100644 index 0000000000..6cc0645d59 --- /dev/null +++ b/website/docs/developer-docs/docs/templates/index.mdx @@ -0,0 +1,23 @@ +--- +title: "Templates" +--- + +In technical documentation, there are document "types" (similar to how there are data types). We have templates for the different types, to make it super-easy to divide longer topics into separate pages (one for each content type) if needed. And templates in general make it easy for whomever wants to contribute some documentation! + +The most common types are: + +- [**Combo**](./combo.mdx): For most topics (unless they are very large and complex), we can combine the procedural and conceptual information into a single document. A handy guideline to follow is: "If the actual 1., 2., 3. steps are buried at the bottom, and a reader has to scroll multiple times to find them, then the combo approach is _not_ the right one. Use separate topics.". + +- [**Procedural**](./procedural.mdx): these are How To docs, the HOW information, with step-by-step instructions for accomplishing a task. This is what most people are looking for when they open the docs... and best practice is to separate the procedural docs from long, lengthy conceptual or reference docs. + +- [**Conceptual**](./conceptual.mdx): these docs provide the WHY information, and explain when to use a feature (or when not to!), and general concepts behind the feature or functionality. + +- [**Reference**](./reference.mdx): this is typically tables or lists of reference information, such as configuration values, or functions, or most commonly APIs. + +### Add a new integration + +To add documentation for a new integration (with support level Community or Vendor), please use the integration templates [`service.mdx`](https://github.com/goauthentik/authentik/blob/main/website/integrations/template/service.mdx) from our GitHub repo. You can download the template using the following command: + +```shell +wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/integrations/template/service.mdx +``` diff --git a/website/docs/developer-docs/docs/templates/procedural.md b/website/docs/developer-docs/docs/templates/procedural.mdx similarity index 69% rename from website/docs/developer-docs/docs/templates/procedural.md rename to website/docs/developer-docs/docs/templates/procedural.mdx index 032ad28166..76a55f8350 100644 --- a/website/docs/developer-docs/docs/templates/procedural.md +++ b/website/docs/developer-docs/docs/templates/procedural.mdx @@ -3,18 +3,18 @@ title: "Procedural topic" --- :::info How to use this template -Start with the markdown version of the template, either by copying the [`procedural.tmpl.md`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: +Start with the MDX template, either by copying the [`procedural.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: ```shell -wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/procedural.tmpl.md +wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/procedural.tmpl.mdx ``` -Edit your markdown file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. +Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. ::: For a procedural topic, use a title that focuses on the task, such as "Add a new group" or "Edit user profiles." Include an imperative verb and the object being changed. Use the imperative form (`Add`), not a gerund (`Adding`). -In this first section, right after the title, write one or two sentences about the task. Keep it brief; if it goes on too long, then create a separate conceptual topic, in a separate `.md` file. We don't want readers to have to scroll through paragraphs of conceptual info before they get to Step 1. +In this first section, right after the title, write one or two sentences about the task. Keep it brief; if it goes on too long, then create a separate conceptual topic, in a separate `.mdx` file. We don't want readers to have to scroll through paragraphs of conceptual info before they get to Step 1. ## Prerequisites (optional section) diff --git a/website/docs/developer-docs/docs/templates/procedural.tmpl.md b/website/docs/developer-docs/docs/templates/procedural.tmpl.mdx similarity index 94% rename from website/docs/developer-docs/docs/templates/procedural.tmpl.md rename to website/docs/developer-docs/docs/templates/procedural.tmpl.mdx index e376011dd9..c5752403e1 100644 --- a/website/docs/developer-docs/docs/templates/procedural.tmpl.md +++ b/website/docs/developer-docs/docs/templates/procedural.tmpl.mdx @@ -1,5 +1,5 @@ --- -title: "Markdown template: procedural" +title: "MDX template: procedural" --- Add a brief description of the feature or functionality. diff --git a/website/docs/developer-docs/docs/templates/reference.md b/website/docs/developer-docs/docs/templates/reference.mdx similarity index 62% rename from website/docs/developer-docs/docs/templates/reference.md rename to website/docs/developer-docs/docs/templates/reference.mdx index 5665b62800..5ab8e0d486 100644 --- a/website/docs/developer-docs/docs/templates/reference.md +++ b/website/docs/developer-docs/docs/templates/reference.mdx @@ -3,13 +3,13 @@ title: "Reference topic" --- :::info How to use this template -Start with the markdown version of the template, either by copying the [`reference.tmpl.md`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: +Start with the MDX template, either by copying the [`reference.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command: ```shell -wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/reference.tmpl.md +wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/reference.tmpl.mdx ``` -Edit your markdown file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. +Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules. ::: Create a title that specifies the component you are documenting. For example, "Group attributes". diff --git a/website/docs/developer-docs/docs/templates/reference.tmpl.md b/website/docs/developer-docs/docs/templates/reference.tmpl.mdx similarity index 93% rename from website/docs/developer-docs/docs/templates/reference.tmpl.md rename to website/docs/developer-docs/docs/templates/reference.tmpl.mdx index fde679a842..f1c0d63256 100644 --- a/website/docs/developer-docs/docs/templates/reference.tmpl.md +++ b/website/docs/developer-docs/docs/templates/reference.tmpl.mdx @@ -1,5 +1,5 @@ --- -title: "Markdown template: reference" +title: "MDX template: reference" --- Write a few sentences introducing the feature/component/technology, and state that this page contains reference materials. diff --git a/website/docs/developer-docs/docs/theming/index.mdx b/website/docs/developer-docs/docs/theming/index.mdx index 8bf53d2ed5..88fcf9a984 100644 --- a/website/docs/developer-docs/docs/theming/index.mdx +++ b/website/docs/developer-docs/docs/theming/index.mdx @@ -18,7 +18,7 @@ import { :::info Advanced -This section is intended for developers of authentik's documentation site. If you are looking to customize the theming of your own authentik instance, please refer to the [branding](../../../customize/branding/index.md) documentation. +This section is intended for developers of authentik's documentation site. If you are looking to customize the theming of your own authentik instance, please refer to the [branding](../../../customize/branding/index.mdx) documentation. ::: diff --git a/website/docs/developer-docs/docs/writing-documentation.md b/website/docs/developer-docs/docs/writing-documentation.mdx similarity index 96% rename from website/docs/developer-docs/docs/writing-documentation.md rename to website/docs/developer-docs/docs/writing-documentation.mdx index f93d7a6593..9057464ba4 100644 --- a/website/docs/developer-docs/docs/writing-documentation.md +++ b/website/docs/developer-docs/docs/writing-documentation.mdx @@ -28,7 +28,7 @@ Adhering to the following guidelines will help us get your PRs merged more easil - Please refer to our [Style Guide](./style-guide.mdx) for authentik documentation. Here you will learn important guidelines about not capitalizing authentik, how we format our titles and headers, and much more. - Remember to use our templates when possible; they are already set up to follow our style guidelines, they make it a lot easier for you (no blank page frights!), and they keep the documentation structure and headings consistent. - - [docs templates](./templates/index.md) + - [docs templates](./templates/index.mdx) - [integration guide template](https://integrations.goauthentik.io/applications#add-a-new-application) ## Set up a docs development environment @@ -97,13 +97,13 @@ This command formats, lints, and builds the technical documentation. Run it befo make docs-watch ``` -Starts a local development server for the documentation site and opens a preview in your browser. This command will automatically rebuild your local documentation site in real time, as you write or make changes to the Markdown files in the `website/docs` directory. +Starts a local development server for the documentation site and opens a preview in your browser. This command will automatically rebuild your local documentation site in real time, as you write or make changes to the MDX files in the `website/docs` directory. ## Write or modify integration guides In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines about our integration guides (https://integrations.goauthentik.io/). -- For new integration documentation, please use the Integrations template in our [GitHub repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.md`. +- For new integration documentation, please use the Integrations template in our [GitHub repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.mdx`. - For placeholder domains, use `authentik.company` and `.company`, where `` identifies the application. Use hyphens between words inside DNS-label placeholders because underscores are not valid in these host-label examples; use underscores for other multiword placeholders. @@ -129,7 +129,7 @@ This command formats, lints, and builds the integration documentation. Run it be make integrations-watch ``` -Starts a local development server for the integrations site and opens a preview in your browser. This command will automatically rebuild your local integrations site in real time, as you write or make changes to the Markdown files in the `website/integrations` directory. +Starts a local development server for the integrations site and opens a preview in your browser. This command will automatically rebuild your local integrations site in real time, as you write or make changes to the MDX files in the `website/integrations` directory. ## Developing the glossary @@ -177,7 +177,7 @@ sidebar_custom_props: ## Page routing and URLs -Every documentation page you see on our website starts as a simple Markdown file in our repository. When you create or edit these files, our build system automatically transforms them into web pages with predictable URLs. +Every documentation page you see on our website starts as an MDX file in our repository. When you create or edit these files, our build system automatically transforms them into web pages with predictable URLs. ### Convert file paths to URLs @@ -275,6 +275,6 @@ Remember, [Cool URIs don't change!](https://www.w3.org/Provider/Style/URI) Moving a documentation page to a new location requires updating a `sidebar.mjs` and `_redirects` file. 1. Take note of the page's current URL path in the browser's address bar. -2. Move the Markdown file to the new location. +2. Move the MDX file to the new location. 3. Add a new redirect rule to the `_redirects` file in the respective [documentation directory](#redirects). 4. Update the `sidebar.mjs` file in the respective [documentation directory](#redirects). diff --git a/website/docs/developer-docs/frontend/cascade-layers.md b/website/docs/developer-docs/frontend/cascade-layers.mdx similarity index 100% rename from website/docs/developer-docs/frontend/cascade-layers.md rename to website/docs/developer-docs/frontend/cascade-layers.mdx diff --git a/website/docs/developer-docs/frontend/css-architecture.md b/website/docs/developer-docs/frontend/css-architecture.mdx similarity index 99% rename from website/docs/developer-docs/frontend/css-architecture.md rename to website/docs/developer-docs/frontend/css-architecture.mdx index 079e78a575..245e3aa540 100644 --- a/website/docs/developer-docs/frontend/css-architecture.md +++ b/website/docs/developer-docs/frontend/css-architecture.mdx @@ -11,7 +11,7 @@ authentik's UI is a customized PatternFly 4 system wrapped in Lit web components - **`@goauthentik/theme`** owns the design tokens. Token modules are written in TypeScript, compiled by [Styleframe](https://styleframe.dev), and emitted as CSS custom properties plus a [DTCG](https://www.designtokens.org/) document. - **`@goauthentik/fonts`** ships every typeface and its `@font-face` rules, separately from the tokens because they change on a different cadence. `faces.css` holds the RedHat brand text faces; `icons.css` holds the `pficon` and Font Awesome faces the PatternFly icon classes render glyphs from. - **`web/src/styles/global/theme/token-bridge.css`** maps the semantic tokens onto the PatternFly variables that existing component CSS already reads. -- **`web/src/styles/`** assembles all of it into the three document bundles and the two per-shadow-root sheets. See [Cascade layers](./cascade-layers.md). +- **`web/src/styles/`** assembles all of it into the three document bundles and the two per-shadow-root sheets. See [Cascade layers](./cascade-layers.mdx). - **`web/src/elements/Base.ts`** adopts the shared sheets into every component's shadow root; `web/src/common/stylesheets.ts` centralizes `CSSStyleSheet` creation. ## Token tiers diff --git a/website/docs/developer-docs/hackathon/index.md b/website/docs/developer-docs/hackathon/index.mdx similarity index 100% rename from website/docs/developer-docs/hackathon/index.md rename to website/docs/developer-docs/hackathon/index.mdx diff --git a/website/docs/developer-docs/setup/debugging.md b/website/docs/developer-docs/setup/debugging.mdx similarity index 98% rename from website/docs/developer-docs/setup/debugging.md rename to website/docs/developer-docs/setup/debugging.mdx index a321a2124d..4cef835c6d 100644 --- a/website/docs/developer-docs/setup/debugging.md +++ b/website/docs/developer-docs/setup/debugging.mdx @@ -2,7 +2,7 @@ title: Debugging authentik --- -This page describes how to debug different components of an authentik instance, running either in production or in a development setup. To learn more about the structure of authentik, refer to our [architecture documentation](../../core/architecture.md). +This page describes how to debug different components of an authentik instance, running either in production or in a development setup. To learn more about the structure of authentik, refer to our [architecture documentation](../../core/architecture.mdx). ## authentik Server & Worker (Python) diff --git a/website/docs/developer-docs/translation.md b/website/docs/developer-docs/translation.mdx similarity index 96% rename from website/docs/developer-docs/translation.md rename to website/docs/developer-docs/translation.mdx index c658c5483e..2918bc78e9 100644 --- a/website/docs/developer-docs/translation.md +++ b/website/docs/developer-docs/translation.mdx @@ -7,7 +7,7 @@ Translations in authentik are handled in two places. Most of the text is defined The frontend uses [@lit/localize](https://lit.dev/docs/localization/overview/), and the backend uses the built-in Django translation tools. :::info -Please review the [Writing documentation](./docs/writing-documentation.md) guidelines as they apply to documentation too. +Please review the [Writing documentation](./docs/writing-documentation.mdx) guidelines as they apply to documentation too. ::: ## Online translation diff --git a/website/docs/endpoint-devices/authentik-agent/agent-deployment/automated.mdx b/website/docs/endpoint-devices/authentik-agent/agent-deployment/automated.mdx index c542ebab14..33f5d69ce8 100644 --- a/website/docs/endpoint-devices/authentik-agent/agent-deployment/automated.mdx +++ b/website/docs/endpoint-devices/authentik-agent/agent-deployment/automated.mdx @@ -9,7 +9,7 @@ The authentik Agent can be deployed at scale to multiple devices via Mobile Devi ## Prerequisites -You must [configure your authentik deployment](../configuration.md) to support the authentik Agent. +You must [configure your authentik deployment](../configuration.mdx) to support the authentik Agent. ## Create an enrollment token @@ -17,7 +17,7 @@ If you have already created an enrollment token, skip to the next section. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik Agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik Agent. 4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings: - **Token name**: provide a descriptive name for the token - **Device group _(optional)_**: select a device access group for the device to be added to after completing enrollment @@ -28,7 +28,7 @@ If you have already created an enrollment token, skip to the next section. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik Agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik Agent. 4. Under **Setup**, select the enrollment token that you wish to use for enrolling devices. 5. Click **Windows** and then click either **Download** or **Copy** to obtain your SyncML MDM configuration snippet. @@ -43,7 +43,7 @@ The following two registry keys (`REG_SZ`) are added by the configuration snippe 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik Agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik Agent. 4. Under **Setup**, select the enrollment token that you wish to use for enrolling devices. 5. Click **macOS** and then click either **Download** or **Copy** to obtain your MDM policy. diff --git a/website/docs/endpoint-devices/authentik-agent/agent-deployment/index.mdx b/website/docs/endpoint-devices/authentik-agent/agent-deployment/index.mdx index 053d2572a5..0da4ac427d 100644 --- a/website/docs/endpoint-devices/authentik-agent/agent-deployment/index.mdx +++ b/website/docs/endpoint-devices/authentik-agent/agent-deployment/index.mdx @@ -6,7 +6,7 @@ authentik_version: "2025.12.0" import DocCardList from "@theme/DocCardList"; -You can deploy the authentik Agent on [Linux](./linux.mdx), [macOS](./macos.md), and [Windows](./windows.md) devices. +You can deploy the authentik Agent on [Linux](./linux.mdx), [macOS](./macos.mdx), and [Windows](./windows.mdx) devices. Documentation for large-scale deployments using [Mobile Device Management (MDM) and automated](./automated.mdx) tools is also available. diff --git a/website/docs/endpoint-devices/authentik-agent/agent-deployment/linux.mdx b/website/docs/endpoint-devices/authentik-agent/agent-deployment/linux.mdx index d56a72877a..0b9a00187c 100644 --- a/website/docs/endpoint-devices/authentik-agent/agent-deployment/linux.mdx +++ b/website/docs/endpoint-devices/authentik-agent/agent-deployment/linux.mdx @@ -16,7 +16,7 @@ import Tabs from "@theme/Tabs"; ## Prerequisites -You must [configure your authentik deployment](../configuration.md) to support the authentik Agent. +You must [configure your authentik deployment](../configuration.mdx) to support the authentik Agent. ## Create an enrollment token @@ -24,7 +24,7 @@ If you already have an enrollment token, skip to [Install the authentik Agent on 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent. 4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings: - **Token name**: Provide a descriptive name for the token. - **Device group _(optional)_**: Select a device access group to add the device to after enrollment. @@ -136,7 +136,7 @@ sudo ak-sysd domains join --authentik-url https://authentik.co - `https://authentik.company` is the fully qualified domain name of the authentik deployment. 2. Enter your [enrollment token](#create-an-enrollment-token) when prompted. -3. After you enter the token, authentik enrolls the device. The device appears on the [Devices page](../../manage-devices.mdx) after it [checks in](../../device-compliance/device-reporting.md). +3. After you enter the token, authentik enrolls the device. The device appears on the [Devices page](../../manage-devices.mdx) after it [checks in](../../device-compliance/device-reporting.mdx). ### Configure device login on non-Debian systems diff --git a/website/docs/endpoint-devices/authentik-agent/agent-deployment/macos.md b/website/docs/endpoint-devices/authentik-agent/agent-deployment/macos.mdx similarity index 94% rename from website/docs/endpoint-devices/authentik-agent/agent-deployment/macos.md rename to website/docs/endpoint-devices/authentik-agent/agent-deployment/macos.mdx index f2abceedd2..15f6ac1b43 100644 --- a/website/docs/endpoint-devices/authentik-agent/agent-deployment/macos.md +++ b/website/docs/endpoint-devices/authentik-agent/agent-deployment/macos.mdx @@ -13,7 +13,7 @@ authentik_version: "2025.12.0" ## Prerequisites -You must [configure your authentik deployment](../configuration.md) to support the authentik Agent. +You must [configure your authentik deployment](../configuration.mdx) to support the authentik Agent. ## Create an enrollment token @@ -21,7 +21,7 @@ If you already have an enrollment token, skip to the [next section](#install-the 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent. 4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings: - **Token name**: Provide a descriptive name for the token. - **Device group _(optional)_**: Select a device access group to add the device to after enrollment. @@ -41,7 +41,7 @@ The Agent requires a serial number be presented by macOS. Some hypervisors don't 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent. 4. Under **Setup**, click **macOS** to download the authentik Agent installer. 5. After the download completes, attempt to install the package. Default Apple security settings should block the installation. - This can be avoided by Option + Right Clicking the package and clicking **Open**. @@ -64,7 +64,7 @@ sudo "/Applications/authentik Agent.app/Contents/MacOS/ak-sysd" domains join **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent. 4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings: - **Token name**: Provide a descriptive name for the token. - **Device group _(optional)_**: Select a device access group to add the device to after enrollment. @@ -56,7 +56,7 @@ It's recommended to deploy the Agent via [MDM or automation tools](./automated.m 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors**. -3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.md) to support the authentik agent. +3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent. 4. Under **Setup**, click **Windows** to download the authentik Agent installer. 5. After the download completes, install the MSI file. 6. _(Optional)_ During installation, select [Windows Credential Provider](#windows-credential-provider) if you want to log in to the Windows device using authentik credentials. @@ -78,7 +78,7 @@ Joining the device to an authentik domain is what enrolls it with your authentik - `https://authentik.company` is the fully qualified domain name of the authentik deployment. 2. Enter your [enrollment token](#create-an-enrollment-token) when prompted. -3. After you enter the token, authentik enrolls the device. The device appears on the [Devices page](../../manage-devices.mdx) after it [checks in](../../device-compliance/device-reporting.md). +3. After you enter the token, authentik enrolls the device. The device appears on the [Devices page](../../manage-devices.mdx) after it [checks in](../../device-compliance/device-reporting.mdx). ## Enable SSH client authentication and CLI application authentication diff --git a/website/docs/endpoint-devices/authentik-agent/configuration.md b/website/docs/endpoint-devices/authentik-agent/configuration.mdx similarity index 94% rename from website/docs/endpoint-devices/authentik-agent/configuration.md rename to website/docs/endpoint-devices/authentik-agent/configuration.mdx index bd84682291..d95dfae69d 100644 --- a/website/docs/endpoint-devices/authentik-agent/configuration.md +++ b/website/docs/endpoint-devices/authentik-agent/configuration.mdx @@ -8,7 +8,7 @@ sidebar_position: 1 Before deploying the authentik Agent, configure your authentik deployment. This involves: -- Create and apply an OAuth [Device code flow](../../add-secure-apps/providers/oauth2/device_code.md) +- Create and apply an OAuth [Device code flow](../../add-secure-apps/providers/oauth2/device_code.mdx) - Creating an OAuth application and provider - Creating a [Connector](../device-compliance/connectors/index.mdx) @@ -44,13 +44,13 @@ The authentik Agent requires an OAuth application/provider pair to handle authen - Select any available signing key. - Under **Advanced protocol settings**: - In addition to the three default **Selected Scopes**, add the `authentik default OAuth Mapping: OpenID 'offline_access'` and `authentik default OAuth Mapping: authentik API access` scopes. - - **Configure Bindings** _(optional)_: you can create a [binding](../../add-secure-apps/bindings-overview/index.md) (policy, group, or user) to manage access to the application. + - **Configure Bindings** _(optional)_: you can create a [binding](../../add-secure-apps/bindings-overview/index.mdx) (policy, group, or user) to manage access to the application. 3. Click **Submit** to save the new application and provider. ## Create the authentik Agent connector -The authentik Agent [Connector](../device-compliance/connectors/authentik-agent.md) allows device information to be reported to authentik. +The authentik Agent [Connector](../device-compliance/connectors/authentik-agent.mdx) allows device information to be reported to authentik. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**. diff --git a/website/docs/endpoint-devices/authentik-agent/development.md b/website/docs/endpoint-devices/authentik-agent/development.mdx similarity index 100% rename from website/docs/endpoint-devices/authentik-agent/development.md rename to website/docs/endpoint-devices/authentik-agent/development.mdx diff --git a/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/aws.mdx b/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/aws.mdx index 81a7944e64..7f9936a5b0 100644 --- a/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/aws.mdx +++ b/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/aws.mdx @@ -26,7 +26,7 @@ To support the integration of authentik Agent with AWS CLI, you need to create a - Set the **Client ID** to `authentik-aws-cli`. - Select any available signing key. - Under **Machine-to-Machine authentication settings** add the `authentik-cli` provider as a **Federated OIDC Provider**. - - **Configure Bindings** _(optional)_: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.md) (policy, group, or user) to manage access to the application. + - **Configure Bindings** _(optional)_: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.mdx) (policy, group, or user) to manage access to the application. 3. Click **Submit** to save the new application and provider. diff --git a/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/index.mdx b/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/index.mdx index b9ec501a78..09282eef7a 100644 --- a/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/index.mdx +++ b/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/index.mdx @@ -11,7 +11,7 @@ The authentik Agent can authenticate to CLI applications such as [`aws`](./aws.m ## How CLI authentication works -First, `authentik-agent` and `authentik-cli` request an authentik token from the [authentik-cli OAuth Provider](../../configuration.md#create-an-application-and-provider-in-authentik-for-cli) and exchange it for a token from the specified Kubernetes or AWS provider. +First, `authentik-agent` and `authentik-cli` request an authentik token from the [authentik-cli OAuth Provider](../../configuration.mdx#create-an-application-and-provider-in-authentik-for-cli) and exchange it for a token from the specified Kubernetes or AWS provider. This token is cached until expiration. This improves performance by eliminating repeated token requests. diff --git a/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/k8s.mdx b/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/k8s.mdx index 73ce330605..b70751c5b6 100644 --- a/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/k8s.mdx +++ b/website/docs/endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/k8s.mdx @@ -26,7 +26,7 @@ To support the integration of authentik Agent with `kubectl`, you need to create - Set the **Client ID** to `kubernetes-cluster`. - Select any available signing key. - Under **Machine-to-Machine authentication settings** add the `authentik-cli` provider as a **Federated OIDC Provider**. - - **Configure Bindings** _(optional)_: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.md) (policy, group, or user) to manage access to the application. + - **Configure Bindings** _(optional)_: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.mdx) (policy, group, or user) to manage access to the application. 3. Click **Submit** to save the new application and provider. diff --git a/website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.md b/website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.mdx similarity index 100% rename from website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.md rename to website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.mdx diff --git a/website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/windows.md b/website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/windows.mdx similarity index 98% rename from website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/windows.md rename to website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/windows.mdx index f2538fc08a..9182b9c301 100644 --- a/website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/windows.md +++ b/website/docs/endpoint-devices/authentik-agent/device-authentication/local-device-login/windows.mdx @@ -23,7 +23,7 @@ Currently, only local login is supported; RDP login is not yet available and is ## Prerequisites -- The authentik Agent (including the WCP component) deployed on the Windows device. See [Deploy the authentik Agent on Windows](../../agent-deployment/windows.md) for more details. +- The authentik Agent (including the WCP component) deployed on the Windows device. See [Deploy the authentik Agent on Windows](../../agent-deployment/windows.mdx) for more details. - A **[device access group](../device-access-groups.mdx)** configured with the appropriate user or group bindings. Without this group, all login attempts are denied. See [Configure device access](#configure-device-access). ## How it works diff --git a/website/docs/endpoint-devices/authentik-agent/release-notes/template.md b/website/docs/endpoint-devices/authentik-agent/release-notes/template.mdx similarity index 100% rename from website/docs/endpoint-devices/authentik-agent/release-notes/template.md rename to website/docs/endpoint-devices/authentik-agent/release-notes/template.mdx diff --git a/website/docs/endpoint-devices/authentik-agent/release-notes/v0.35.md b/website/docs/endpoint-devices/authentik-agent/release-notes/v0.35.mdx similarity index 100% rename from website/docs/endpoint-devices/authentik-agent/release-notes/v0.35.md rename to website/docs/endpoint-devices/authentik-agent/release-notes/v0.35.mdx diff --git a/website/docs/endpoint-devices/authentik-agent/release-notes/v0.40.md b/website/docs/endpoint-devices/authentik-agent/release-notes/v0.40.mdx similarity index 100% rename from website/docs/endpoint-devices/authentik-agent/release-notes/v0.40.md rename to website/docs/endpoint-devices/authentik-agent/release-notes/v0.40.mdx diff --git a/website/docs/endpoint-devices/device-compliance/browser-extension.mdx b/website/docs/endpoint-devices/device-compliance/browser-extension.mdx index 287194d944..c49c08f31d 100644 --- a/website/docs/endpoint-devices/device-compliance/browser-extension.mdx +++ b/website/docs/endpoint-devices/device-compliance/browser-extension.mdx @@ -10,7 +10,7 @@ import Tabs from "@theme/Tabs"; The authentik Endpoint SSO browser extension is required for device compliance functionality, and is currently available via the Chrome Web Store, the Firefox Add-ons site, and the Edge Add-ons site. -The browser extension connects to the [authentik Agent](../authentik-agent/index.mdx). It supplies [device facts](./device-reporting.md#device-facts) that [stages](../../add-secure-apps/flows-stages/stages/index.md) and [policies](../../customize/policies/index.md) can use during execution of authentik [flows](../../add-secure-apps/flows-stages/flow/index.md). This enables device compliance functionality such as limiting access to applications based on operating system. See [device compliance policy](./device-compliance-policy.md) for more details. +The browser extension connects to the [authentik Agent](../authentik-agent/index.mdx). It supplies [device facts](./device-reporting.mdx#device-facts) that [stages](../../add-secure-apps/flows-stages/stages/index.mdx) and [policies](../../customize/policies/index.mdx) can use during execution of authentik [flows](../../add-secure-apps/flows-stages/flow/index.mdx). This enables device compliance functionality such as limiting access to applications based on operating system. See [device compliance policy](./device-compliance-policy.mdx) for more details. ## Deploy the authentik browser extension diff --git a/website/docs/endpoint-devices/device-compliance/configuration.md b/website/docs/endpoint-devices/device-compliance/configuration.mdx similarity index 84% rename from website/docs/endpoint-devices/device-compliance/configuration.md rename to website/docs/endpoint-devices/device-compliance/configuration.mdx index aaeef4ef98..6a94c94fad 100644 --- a/website/docs/endpoint-devices/device-compliance/configuration.md +++ b/website/docs/endpoint-devices/device-compliance/configuration.mdx @@ -10,7 +10,7 @@ sidebar_position: 0 Device compliance functionality requires the following: -- [Configure authentik to support the authentik Agent](../authentik-agent/configuration.md). +- [Configure authentik to support the authentik Agent](../authentik-agent/configuration.mdx). - [Deploy the authentik Agent on the device](../authentik-agent/agent-deployment/index.mdx). - [Deploy the authentik browser extension on the endpoint device](./browser-extension.mdx). @@ -20,4 +20,4 @@ Verify that the endpoint device is reporting its facts on the [Devices](../manag ## Use device compliance -Now that the endpoint device is configured, you can create [device compliance policies](./device-compliance-policy.md) to control access to applications and more. +Now that the endpoint device is configured, you can create [device compliance policies](./device-compliance-policy.mdx) to control access to applications and more. diff --git a/website/docs/endpoint-devices/device-compliance/connectors/authentik-agent.md b/website/docs/endpoint-devices/device-compliance/connectors/authentik-agent.mdx similarity index 85% rename from website/docs/endpoint-devices/device-compliance/connectors/authentik-agent.md rename to website/docs/endpoint-devices/device-compliance/connectors/authentik-agent.mdx index 034095c7e3..497a0c034c 100644 --- a/website/docs/endpoint-devices/device-compliance/connectors/authentik-agent.md +++ b/website/docs/endpoint-devices/device-compliance/connectors/authentik-agent.mdx @@ -25,7 +25,7 @@ Follow these instructions to configure the authentik Agent connector: ## Configure Challenge Key -The Agent connector requires a **Challenge Key** (certificate keypair) to be configured when using the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.md). This keypair is used to sign challenges sent to the [browser extension](../browser-extension.mdx) for device verification. +The Agent connector requires a **Challenge Key** (certificate keypair) to be configured when using the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). This keypair is used to sign challenges sent to the [browser extension](../browser-extension.mdx) for device verification. Without a **Challenge Key** configured, the Endpoint Stage will silently skip device verification. @@ -36,4 +36,4 @@ To configure a **Challenge Key**: 3. Set the **Challenge Key** field to your certificate keypair. 4. Click **Update**. -After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.md). Refer to [Device compliance policy](../device-compliance-policy.md) for more information on using device facts from the connector in a flow. +After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). Refer to [Device compliance policy](../device-compliance-policy.mdx) for more information on using device facts from the connector in a flow. diff --git a/website/docs/endpoint-devices/device-compliance/connectors/fleetdm.md b/website/docs/endpoint-devices/device-compliance/connectors/fleetdm.mdx similarity index 92% rename from website/docs/endpoint-devices/device-compliance/connectors/fleetdm.md rename to website/docs/endpoint-devices/device-compliance/connectors/fleetdm.mdx index 13231d173b..b88df98a43 100644 --- a/website/docs/endpoint-devices/device-compliance/connectors/fleetdm.md +++ b/website/docs/endpoint-devices/device-compliance/connectors/fleetdm.mdx @@ -37,4 +37,4 @@ Follow these instructions to configure the Fleet connector in authentik: The **Map teams to device access group** setting does not detect changes to a device's group membership in Fleet. If the device's groups change, manually configure a [device access group](../../authentik-agent/device-authentication/device-access-groups.mdx). ::: -After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.md). Refer to [Fleet conditional access](../fleet-conditional-access.md) and [Device compliance policy](../device-compliance-policy.md) for more information on using device facts from the connector in a flow. +After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). Refer to [Fleet conditional access](../fleet-conditional-access.mdx) and [Device compliance policy](../device-compliance-policy.mdx) for more information on using device facts from the connector in a flow. diff --git a/website/docs/endpoint-devices/device-compliance/connectors/google-chrome.md b/website/docs/endpoint-devices/device-compliance/connectors/google-chrome.mdx similarity index 96% rename from website/docs/endpoint-devices/device-compliance/connectors/google-chrome.md rename to website/docs/endpoint-devices/device-compliance/connectors/google-chrome.mdx index aaa768e1e2..3092054f2a 100644 --- a/website/docs/endpoint-devices/device-compliance/connectors/google-chrome.md +++ b/website/docs/endpoint-devices/device-compliance/connectors/google-chrome.mdx @@ -73,4 +73,4 @@ For detailed instructions, refer to Google documentation. 4. Click **Finish**. -After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.md). Refer to [Device compliance policy](../device-compliance-policy.md) for more information on using device facts from the connector in a flow. +After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). Refer to [Device compliance policy](../device-compliance-policy.mdx) for more information on using device facts from the connector in a flow. diff --git a/website/docs/endpoint-devices/device-compliance/connectors/index.mdx b/website/docs/endpoint-devices/device-compliance/connectors/index.mdx index 462d1f14fc..7164aa6fc9 100644 --- a/website/docs/endpoint-devices/device-compliance/connectors/index.mdx +++ b/website/docs/endpoint-devices/device-compliance/connectors/index.mdx @@ -11,8 +11,8 @@ Connectors allow device information to be reported to authentik. Connectors for The following connectors are currently available: -- [authentik Agent connector](./authentik-agent.md): Integrates with the [authentik Agent](../../authentik-agent/index.mdx) -- [Fleet connector](./fleetdm.md): Integrates with [Fleet](https://fleetdm.com/) device management +- [authentik Agent connector](./authentik-agent.mdx): Integrates with the [authentik Agent](../../authentik-agent/index.mdx) +- [Fleet connector](./fleetdm.mdx): Integrates with [Fleet](https://fleetdm.com/) device management Connectors are in development for Entra, Intune, Cloudflare WARP and other services. @@ -22,7 +22,7 @@ Use the following instructions to manage your connectors: ### Add a connector -For more specific instructions on adding a connector refer to the [authentik Agent connector](./authentik-agent.md) or [Fleet connector](./fleetdm.md) documentation. +For more specific instructions on adding a connector refer to the [authentik Agent connector](./authentik-agent.mdx) or [Fleet connector](./fleetdm.mdx) documentation. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Endpoint Devices** > **Connectors** and click **Create**. diff --git a/website/docs/endpoint-devices/device-compliance/device-compliance-policy.md b/website/docs/endpoint-devices/device-compliance/device-compliance-policy.mdx similarity index 84% rename from website/docs/endpoint-devices/device-compliance/device-compliance-policy.md rename to website/docs/endpoint-devices/device-compliance/device-compliance-policy.mdx index 4adc7507eb..afec94a2b1 100644 --- a/website/docs/endpoint-devices/device-compliance/device-compliance-policy.md +++ b/website/docs/endpoint-devices/device-compliance/device-compliance-policy.mdx @@ -13,11 +13,11 @@ Device compliance policies are currently in development and inaccessible. Howeve ## Prerequisites -You must have [configured compliance](./configuration.md) in authentik and on the endpoint device ([Linux](../../authentik-agent/agent-deployment/linux/#join-the-device-to-an-authentik-domain), [Windows](../../authentik-agent/agent-deployment/windows/#join-the-device-to-an-authentik-domain), [macOS](../../authentik-agent/agent-deployment/macos/#join-the-device-to-an-authentik-domain)). +You must have [configured compliance](./configuration.mdx) in authentik and on the endpoint device ([Linux](../../authentik-agent/agent-deployment/linux/#join-the-device-to-an-authentik-domain), [Windows](../../authentik-agent/agent-deployment/windows/#join-the-device-to-an-authentik-domain), [macOS](../../authentik-agent/agent-deployment/macos/#join-the-device-to-an-authentik-domain)). ## Access device facts within a flow -To access device facts within a flow, the flow must include an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.md). The Endpoint stage fetches device facts via a configured [Connector](./connectors/index.mdx) and adds them to the [Flow context](../../add-secure-apps/flows-stages/flow/context/index.mdx). +To access device facts within a flow, the flow must include an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). The Endpoint stage fetches device facts via a configured [Connector](./connectors/index.mdx) and adds them to the [Flow context](../../add-secure-apps/flows-stages/flow/context/index.mdx). The following example shows how to use these facts within an expression policy. @@ -35,7 +35,7 @@ The following are examples of how device compliance can currently be implemented ### Only allow authentication via endpoint devices -If your goal is to only allow authentication via endpoint devices, this is achievable by adding an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.md) to your authentication flow. +If your goal is to only allow authentication via endpoint devices, this is achievable by adding an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx) to your authentication flow. #### Create an Endpoint stage @@ -53,7 +53,7 @@ If your goal is to only allow authentication via endpoint devices, this is achie ### Only allow authentication via a specific type of endpoint device -If your goal is to only allow authentication via a specific type of endpoint device, this is achievable by adding an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.md) and a [Deny stage](../../add-secure-apps/flows-stages/stages/deny/index.md) to your authentication flow. +If your goal is to only allow authentication via a specific type of endpoint device, this is achievable by adding an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx) and a [Deny stage](../../add-secure-apps/flows-stages/stages/deny/index.mdx) to your authentication flow. The following example allows authentication only through Apple devices. diff --git a/website/docs/endpoint-devices/device-compliance/device-reporting.md b/website/docs/endpoint-devices/device-compliance/device-reporting.mdx similarity index 90% rename from website/docs/endpoint-devices/device-compliance/device-reporting.md rename to website/docs/endpoint-devices/device-compliance/device-reporting.mdx index 3419edf0bb..876fc958fc 100644 --- a/website/docs/endpoint-devices/device-compliance/device-reporting.md +++ b/website/docs/endpoint-devices/device-compliance/device-reporting.mdx @@ -15,13 +15,13 @@ authentik_version: "2025.12.0" sidebar_position: 3 --- -Endpoint devices registered with authentik through a [connector](./connectors/index.mdx), such as the [authentik Agent](./connectors/authentik-agent.md) connector, regularly [check in](#device-check-in) with authentik and report their [device facts](#device-facts). +Endpoint devices registered with authentik through a [connector](./connectors/index.mdx), such as the [authentik Agent](./connectors/authentik-agent.mdx) connector, regularly [check in](#device-check-in) with authentik and report their [device facts](#device-facts). -These facts are shown on the [Devices](../manage-devices.mdx) page and are also accessible to policies and can be used to make policy decisions. See [Device Compliance Policy](./device-compliance-policy.md) for more details. +These facts are shown on the [Devices](../manage-devices.mdx) page and are also accessible to policies and can be used to make policy decisions. See [Device Compliance Policy](./device-compliance-policy.mdx) for more details. ## Device check-in -When a device registered with authentik reports its [device facts](#device-facts), this is called a device check-in. These check-ins occur on a regular configurable schedule and can also be set to occur whenever a device is associated with an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.md). +When a device registered with authentik reports its [device facts](#device-facts), this is called a device check-in. These check-ins occur on a regular configurable schedule and can also be set to occur whenever a device is associated with an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). ## Device facts diff --git a/website/docs/endpoint-devices/device-compliance/fleet-conditional-access.md b/website/docs/endpoint-devices/device-compliance/fleet-conditional-access.mdx similarity index 92% rename from website/docs/endpoint-devices/device-compliance/fleet-conditional-access.md rename to website/docs/endpoint-devices/device-compliance/fleet-conditional-access.mdx index e0e7b7cbd3..041a243cca 100644 --- a/website/docs/endpoint-devices/device-compliance/fleet-conditional-access.md +++ b/website/docs/endpoint-devices/device-compliance/fleet-conditional-access.mdx @@ -12,8 +12,8 @@ authentik automatically retrieves the Conditional Access Root CA certificate fro ## Prerequisites -- You must have [configured compliance](./configuration.md) in authentik -- The [Fleet connector](./connectors/fleetdm.md) must be configured in authentik +- You must have [configured compliance](./configuration.mdx) in authentik +- The [Fleet connector](./connectors/fleetdm.mdx) must be configured in authentik - Conditional access Root CA Certificate must be pulled from Fleet via the Fleet connector. This is an automatic process - A Fleet Enterprise license is required @@ -34,7 +34,7 @@ This configuration applies to a specific flow, such as an authentication flow. ### Bind Endpoint stage to flow -The flow must have an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.md) bound to it. +The flow must have an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx) bound to it. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Flows and Stages > Flows**. diff --git a/website/docs/endpoint-devices/index.mdx b/website/docs/endpoint-devices/index.mdx index 213970800f..3a5fd9233a 100644 --- a/website/docs/endpoint-devices/index.mdx +++ b/website/docs/endpoint-devices/index.mdx @@ -51,7 +51,7 @@ Meanwhile, Device Compliance allows administrators to make informed decisions ab | [**Device compliance**](./device-compliance/index.mdx) | Open source | Open source | Open source | Available for early preview. | | **Advanced device compliance** | :ak-enterprise | :ak-enterprise | :ak-enterprise | In development. | | [**authentik Agent**](./authentik-agent/index.mdx) | Open source | Open source | Open source | Available for early preview. | -| [**Fleet Connector** ](./device-compliance/connectors/fleetdm.md) | :ak-enterprise | :ak-enterprise | :ak-enterprise | Available for early preview. | +| [**Fleet Connector** ](./device-compliance/connectors/fleetdm.mdx) | :ak-enterprise | :ak-enterprise | :ak-enterprise | Available for early preview. | | **Other Connectors** (Entra, Intune, Cloudflare WARP etc) | :ak-enterprise | :ak-enterprise | :ak-enterprise | In development. | ## How to provide feedback and report bugs diff --git a/website/docs/endpoint-devices/manage-devices.mdx b/website/docs/endpoint-devices/manage-devices.mdx index f58880b455..a925d2d1c8 100644 --- a/website/docs/endpoint-devices/manage-devices.mdx +++ b/website/docs/endpoint-devices/manage-devices.mdx @@ -6,7 +6,7 @@ authentik_version: "2025.12.0" sidebar_position: 2 --- -The Devices page provides a list of all endpoint devices registered with your authentik deployment. Refer to [Device reporting](./device-compliance/device-reporting.md) for more details on how [device facts](./device-compliance/device-reporting.md#device-facts) are reported to authentik. +The Devices page provides a list of all endpoint devices registered with your authentik deployment. Refer to [Device reporting](./device-compliance/device-reporting.mdx) for more details on how [device facts](./device-compliance/device-reporting.mdx#device-facts) are reported to authentik. Select an endpoint device to view detailed information about it. @@ -26,7 +26,7 @@ The overview contains: - **Device details**: The device name, hostname, serial number, operating system, firewall status, and device access group. - **Hardware**: The manufacturer, model, CPU, memory, disk encryption status, primary disk size, and primary disk usage. -- **Connections**: The enabled [connectors](./device-compliance/connectors/index.mdx) and the time of the last [check-in](./device-compliance/device-reporting.md#device-check-in). +- **Connections**: The enabled [connectors](./device-compliance/connectors/index.mdx) and the time of the last [check-in](./device-compliance/device-reporting.mdx#device-check-in). - **Users/Groups**: The users and groups that can access the device, as controlled by [device access groups](./authentik-agent/device-authentication/device-access-groups.mdx). ### Processes diff --git a/website/docs/enterprise/enterprise-features.md b/website/docs/enterprise/enterprise-features.mdx similarity index 64% rename from website/docs/enterprise/enterprise-features.md rename to website/docs/enterprise/enterprise-features.mdx index e4dbe7cfa0..160106ff50 100644 --- a/website/docs/enterprise/enterprise-features.md +++ b/website/docs/enterprise/enterprise-features.mdx @@ -25,31 +25,31 @@ See the [pricing page](https://goauthentik.io/pricing/) for current plan details ### Identity and provisioning -- [Google Workspace integration](../add-secure-apps/providers/gws/index.md) synchronizes users and groups from authentik to Google Workspace. -- [Microsoft Entra ID integration](../add-secure-apps/providers/entra/index.md) synchronizes users and groups from authentik to Microsoft Entra ID. -- [External OAuth and SAML sources](../add-secure-apps/flows-stages/stages/source/index.md) embed an external identity provider in a flow for migration or additional verification. For example, dynamically redirect users to authenticate against Entra ID or GWS before continuing with a flow. -- The [Shared Signals Framework provider](../add-secure-apps/providers/ssf/index.md) sends security events to subscribed applications, including Apple Business Manager. -- [OAuth authentication for SCIM](../add-secure-apps/providers/scim/index.md#oauth-token) uses short-lived OAuth tokens instead of a static token for SCIM provisioning. -- The [WS-Federation provider](../add-secure-apps/providers/wsfed/index.md) connects applications that use WS-Federation to authentik for single sign-on. +- [Google Workspace integration](../add-secure-apps/providers/gws/index.mdx) synchronizes users and groups from authentik to Google Workspace. +- [Microsoft Entra ID integration](../add-secure-apps/providers/entra/index.mdx) synchronizes users and groups from authentik to Microsoft Entra ID. +- [External OAuth and SAML sources](../add-secure-apps/flows-stages/stages/source/index.mdx) embed an external identity provider in a flow for migration or additional verification. For example, dynamically redirect users to authenticate against Entra ID or GWS before continuing with a flow. +- The [Shared Signals Framework provider](../add-secure-apps/providers/ssf/index.mdx) sends security events to subscribed applications, including Apple Business Manager. +- [OAuth authentication for SCIM](../add-secure-apps/providers/scim/index.mdx#oauth-token) uses short-lived OAuth tokens instead of a static token for SCIM provisioning. +- The [WS-Federation provider](../add-secure-apps/providers/wsfed/index.mdx) connects applications that use WS-Federation to authentik for single sign-on. ### Authentication and network access -- [Password history compliance](../customize/policies/types/password-uniqueness.md) prevents users from reusing previous passwords. -- [Client certificate authentication](../add-secure-apps/flows-stages/stages/mtls/index.md) authenticates or enrolls users with client certificates from devices, smart cards, PIV cards, or hardware tokens. +- [Password history compliance](../customize/policies/types/password-uniqueness.mdx) prevents users from reusing previous passwords. +- [Client certificate authentication](../add-secure-apps/flows-stages/stages/mtls/index.mdx) authenticates or enrolls users with client certificates from devices, smart cards, PIV cards, or hardware tokens. - [RADIUS EAP-TLS](../add-secure-apps/providers/radius/index.mdx#eap) authenticates network clients with EAP-TLS and client certificates. -- [Account Lockdown](../security/account-lockdown.md) immediately secures a compromised account by disabling it, revoking its tokens, ending its sessions, and recording the action in the audit log. +- [Account Lockdown](../security/account-lockdown.mdx) immediately secures a compromised account by disabling it, revoking its tokens, ending its sessions, and recording the action in the audit log. ### Audit and reporting - [Enhanced audit logging](../sys-mgmt/events/logging-events.mdx#enhanced-audit-logging) records detailed object changes and shows before-and-after values for compliance review. - [Event maps and charts](../sys-mgmt/events/logging-events.mdx#viewing-events-in-maps-and-charts) visualize recent events by location, type, and volume. -- [CSV data exports](../sys-mgmt/data-exports.md) export user and event data for analysis, reporting, or backup. -- [Object Lifecycle Management](../sys-mgmt/object-lifecycle-management.md) schedules periodic reviews of applications, groups, and roles, assigns reviewers, and tracks overdue reviews. This feature is in preview. +- [CSV data exports](../sys-mgmt/data-exports.mdx) export user and event data for analysis, reporting, or backup. +- [Object Lifecycle Management](../sys-mgmt/object-lifecycle-management.mdx) schedules periodic reviews of applications, groups, and roles, assigns reviewers, and tracks overdue reviews. This feature is in preview. ### Device security -- The [Fleet connector](../endpoint-devices/device-compliance/connectors/fleetdm.md) uses device information from Fleet in device-aware access decisions. -- The [Google Chrome connector](../endpoint-devices/device-compliance/connectors/google-chrome.md) uses Chrome Enterprise Device Trust signals in device-aware access decisions. +- The [Fleet connector](../endpoint-devices/device-compliance/connectors/fleetdm.mdx) uses device information from Fleet in device-aware access decisions. +- The [Google Chrome connector](../endpoint-devices/device-compliance/connectors/google-chrome.mdx) uses Chrome Enterprise Device Trust signals in device-aware access decisions. - [Local device login](../endpoint-devices/authentik-agent/device-authentication/local-device-login/index.mdx) enables users to sign in to Windows and Linux devices with authentik credentials. This feature is in preview. - Advanced device compliance adds device facts and integrations to device-aware access decisions. This feature is in development; see the [Endpoint Devices feature overview](../endpoint-devices/index.mdx#features-overview). diff --git a/website/docs/enterprise/enterprise-support.md b/website/docs/enterprise/enterprise-support.mdx similarity index 100% rename from website/docs/enterprise/enterprise-support.md rename to website/docs/enterprise/enterprise-support.mdx diff --git a/website/docs/enterprise/get-started.md b/website/docs/enterprise/get-started.mdx similarity index 81% rename from website/docs/enterprise/get-started.md rename to website/docs/enterprise/get-started.mdx index d3ddd7e910..fa72c92642 100644 --- a/website/docs/enterprise/get-started.md +++ b/website/docs/enterprise/get-started.mdx @@ -24,13 +24,13 @@ Each authentik installation has a unique Install ID that binds a license to that 2. Navigate to **Enterprise** > **Licenses**. 3. Copy the value under **Your Install ID**. -In a [multi-tenant deployment](../sys-mgmt/tenancy.md), each tenant has its own Install ID and requires its own license. +In a [multi-tenant deployment](../sys-mgmt/tenancy.mdx), each tenant has its own Install ID and requires its own license. ## 2. Obtain a license key You can purchase a license from the **Your Install ID** card in the Admin interface or directly from the [Customer Portal](https://customers.goauthentik.io/). -When you purchase a license, provide the Install ID and the required internal and external user capacity. For the complete purchase workflow, see [Purchase a license](./manage-enterprise.md#purchase-a-license). +When you purchase a license, provide the Install ID and the required internal and external user capacity. For the complete purchase workflow, see [Purchase a license](./manage-enterprise.mdx#purchase-a-license). To request a trial or discuss an Enterprise Plus agreement, contact [hello@goauthentik.io](mailto:hello@goauthentik.io). @@ -43,10 +43,10 @@ To request a trial or discuss an Enterprise Plus agreement, contact [hello@goaut The **Licenses** page displays the installed license, its internal and external user capacity, and its expiry date. The **Current license status** card displays the combined status and capacity of all active licenses for the installation. -If authentik rejects the key, verify that you copied the complete key and that its Install ID matches the current installation. Contact [Enterprise support](./enterprise-support.md) if a valid key still cannot be installed. +If authentik rejects the key, verify that you copied the complete key and that its Install ID matches the current installation. Contact [Enterprise support](./enterprise-support.mdx) if a valid key still cannot be installed. ## Next steps -- Review the [Enterprise features](./enterprise-features.md) and configure the features that you need in the standard authentik documentation. -- Learn how authentik [counts licensed users](./manage-enterprise.md#about-users-and-licenses). +- Review the [Enterprise features](./enterprise-features.mdx) and configure the features that you need in the standard authentik documentation. +- Learn how authentik [counts licensed users](./manage-enterprise.mdx#about-users-and-licenses). - Configure additional Customer Portal users to avoid relying on a single account for license access. diff --git a/website/docs/enterprise/index.mdx b/website/docs/enterprise/index.mdx index d35ca39322..7eff71943c 100644 --- a/website/docs/enterprise/index.mdx +++ b/website/docs/enterprise/index.mdx @@ -18,9 +18,9 @@ authentik Enterprise licenses provide additional features and commercial support Refer to our Enterprise documentation for further information: -- [Compare Enterprise features](./enterprise-features.md) across both plans. -- [Get started with authentik Enterprise](./get-started.md) on a new or existing authentik installation. -- [Manage Enterprise licensing](./manage-enterprise.md) to control organization access, purchase and manage licenses, and manage billing. -- [Enterprise support](./enterprise-support.md) to open and track support tickets. +- [Compare Enterprise features](./enterprise-features.mdx) across both plans. +- [Get started with authentik Enterprise](./get-started.mdx) on a new or existing authentik installation. +- [Manage Enterprise licensing](./manage-enterprise.mdx) to control organization access, purchase and manage licenses, and manage billing. +- [Enterprise support](./enterprise-support.mdx) to open and track support tickets. After you install a license, use the standard authentik documentation to configure the features that you need. diff --git a/website/docs/enterprise/manage-enterprise.md b/website/docs/enterprise/manage-enterprise.mdx similarity index 95% rename from website/docs/enterprise/manage-enterprise.md rename to website/docs/enterprise/manage-enterprise.mdx index d920dc8e4b..c55a04ebba 100644 --- a/website/docs/enterprise/manage-enterprise.md +++ b/website/docs/enterprise/manage-enterprise.mdx @@ -38,7 +38,7 @@ To remove a member, open the organization, find the person under **Membership**, ## Purchase a license -Before purchasing a license, copy the authentik installation's [Install ID](./get-started.md#1-copy-the-install-id). +Before purchasing a license, copy the authentik installation's [Install ID](./get-started.mdx#1-copy-the-install-id). 1. Log in to the [Customer Portal](https://customers.goauthentik.io/) and select the organization that will own the license. 2. Click **Purchase license**. @@ -48,7 +48,7 @@ Before purchasing a license, copy the authentik installation's [Install ID](./ge 6. Click **Continue**. 7. Enter the payment details, then click **Pay and subscribe**. -After the payment is validated, the license appears on the organization page. Click **Details** next to the license to copy its key, then [install the license key](./get-started.md#3-install-the-license-key) in authentik. +After the payment is validated, the license appears on the organization page. Click **Details** next to the license to copy its key, then [install the license key](./get-started.mdx#3-install-the-license-key) in authentik. For a trial, Enterprise Plus, invoice billing, or a custom purchase, contact [hello@goauthentik.io](mailto:hello@goauthentik.io). @@ -63,7 +63,7 @@ In the Admin interface, navigate to **Enterprise** > **Licenses** to view: - The combined expiry, status, and user capacity of installed licenses. - The name, capacity, and expiry date of each license. -To install the first license, follow [Get started with authentik Enterprise](./get-started.md). +To install the first license, follow [Get started with authentik Enterprise](./get-started.mdx). ### Update a license key @@ -87,13 +87,13 @@ authentik counts active internal and external users separately. Disabled users, - An **internal user** can access the authentik application dashboard and user settings. Employees and other members of your organization are typically internal users. - An **external user** cannot access the application dashboard or user settings. Customers, partners, volunteers, and contractors who use authentik only to access another application can be external users. -You configure a user's type on the user account. To send external users directly to an application after authentication, configure the brand's [default application](../customize/branding/index.md#external-user-settings). +You configure a user's type on the user account. To send external users directly to an application after authentication, configure the brand's [default application](../customize/branding/index.mdx#external-user-settings). The license status becomes invalid if either user type exceeds its licensed capacity. Unused internal capacity does not cover excess external users, and unused external capacity does not cover excess internal users. ### Expand license capacity -To add capacity, either [purchase another license](#purchase-a-license) for the same Install ID or [open a support ticket](./enterprise-support.md) to change an existing subscription. Multiple active licenses add together, but their billing and renewal dates can differ. +To add capacity, either [purchase another license](#purchase-a-license) for the same Install ID or [open a support ticket](./enterprise-support.mdx) to change an existing subscription. Multiple active licenses add together, but their billing and renewal dates can differ. Use the forecasts on **Enterprise** > **Licenses** as planning estimates. Before purchasing, compare the proposed capacity with the current counts for both user types. diff --git a/website/docs/expressions/reference/_objects.md b/website/docs/expressions/reference/_objects.mdx similarity index 100% rename from website/docs/expressions/reference/_objects.md rename to website/docs/expressions/reference/_objects.mdx diff --git a/website/docs/expressions/reference/_user.md b/website/docs/expressions/reference/_user.mdx similarity index 100% rename from website/docs/expressions/reference/_user.md rename to website/docs/expressions/reference/_user.mdx diff --git a/website/docs/index.mdx b/website/docs/index.mdx index c999326215..54a56fdbf4 100755 --- a/website/docs/index.mdx +++ b/website/docs/index.mdx @@ -16,7 +16,7 @@ We offer two versions of authentik: the forever-free open source project upon wh The authentik product provides the following consoles: -- **Flow interface**: [_Flows_](./add-secure-apps/flows-stages/flow/index.md) are the steps by which the various _Stages_ of a login and authentication process occur. A stage represents a single verification or logic step in the sign-on process. authentik allows for the customization and exact definition of these flows. +- **Flow interface**: [_Flows_](./add-secure-apps/flows-stages/flow/index.mdx) are the steps by which the various _Stages_ of a login and authentication process occur. A stage represents a single verification or logic step in the sign-on process. authentik allows for the customization and exact definition of these flows. - **User interface**: this console view in authentik displays all of the applications and integrations in which you have implemented authentik. Click on the app that you want to access to open it, or drill down to edit its configuration in the admin interface. @@ -66,6 +66,6 @@ Our tech docs cover the typical topics, from installation to configuration, addi ## Installation -Refer to the installation steps for either [Docker Compose](./install-config/install/docker-compose.mdx) or [Kubernetes](./install-config/install/kubernetes.md). +Refer to the installation steps for either [Docker Compose](./install-config/install/docker-compose.mdx) or [Kubernetes](./install-config/install/kubernetes.mdx). For more information about configuration, beta versions, and additional installation options, see our main [Installation](./install-config/index.mdx) section. diff --git a/website/docs/install-config/air-gapped.mdx b/website/docs/install-config/air-gapped.mdx index 944f6f978a..1db9668151 100644 --- a/website/docs/install-config/air-gapped.mdx +++ b/website/docs/install-config/air-gapped.mdx @@ -15,7 +15,7 @@ By default, authentik creates outbound connections to the following URLs: - https://secure.gravatar.com: Avatars for users - https://authentik.error-reporting.a7k.io: Error reporting -The [events map](../sys-mgmt/events/index.md#event-map) ships with a bundled basemap and makes no outbound connections. If a custom basemap is configured under **System** > **Brands** (**Map tiles**), the browser loads tiles from the configured URL — in an air-gapped environment, point it at an internally reachable tile source or leave it empty to keep the bundled default. +The [events map](../sys-mgmt/events/index.mdx#event-map) ships with a bundled basemap and makes no outbound connections. If a custom basemap is configured under **System** > **Brands** (**Map tiles**), the browser loads tiles from the configured URL — in an air-gapped environment, point it at an internally reachable tile source or leave it empty to keep the bundled default. ## Configuration @@ -57,7 +57,7 @@ Afterwards, run the upgrade commands from the latest release notes. -Additionally, adjust the following [System settings](../sys-mgmt/settings.md): +Additionally, adjust the following [System settings](../sys-mgmt/settings.mdx): - **Avatars**: By default this setting connects to [Gravatar](https://secure.gravatar.com/). To avoid outgoing connections, set this to a combination of other options, such as `initials`. diff --git a/website/docs/install-config/configuration/configuration.mdx b/website/docs/install-config/configuration/configuration.mdx index ecc7d62c02..191953eec0 100644 --- a/website/docs/install-config/configuration/configuration.mdx +++ b/website/docs/install-config/configuration/configuration.mdx @@ -74,7 +74,7 @@ Use the settings in this section to configure: - connection behavior and pooler compatibility - optional read replicas -For more information, see the PostgreSQL upgrade guides for [Docker Compose](../../troubleshooting/postgres/upgrade_docker.md) and [Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.md). For backup guidance, see [Backup and restore](../../sys-mgmt/ops/backup-restore.md). +For more information, see the PostgreSQL upgrade guides for [Docker Compose](../../troubleshooting/postgres/upgrade_docker.mdx) and [Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.mdx). For backup guidance, see [Backup and restore](../../sys-mgmt/ops/backup-restore.mdx). ### Connection settings @@ -441,7 +441,7 @@ Defaults to `0.0.0.0:9900`. ##### `AUTHENTIK_LISTEN__DEBUG_PY` -Base listening address:port for the Python debugging server, see [Debugging](../../developer-docs/setup/debugging.md). +Base listening address:port for the Python debugging server, see [Debugging](../../developer-docs/setup/debugging.mdx). Applies to the Server and the Worker. The Server listens on this exact port; each Worker process listens on a successive port (`9902`, `9903`, …). @@ -483,7 +483,7 @@ Defaults to `minutes=15`. ### S3 storage backend settings -For more information on S3 storage, see [S3-compatible storage](../../sys-mgmt/ops/storage-s3/index.md). +For more information on S3 storage, see [S3-compatible storage](../../sys-mgmt/ops/storage-s3/index.mdx). #### `AUTHENTIK_STORAGE__S3__REGION` @@ -687,7 +687,7 @@ Disable the inbuilt update-checker. Defaults to `false`. The `AUTHENTIK_EMAIL` settings are used to configure SMTP email delivery from authentik. -These global email settings are used for administrator notifications, release and configuration alerts, [notification rules](../../sys-mgmt/events/notifications.md), and any [Email stage](../../add-secure-apps/flows-stages/stages/email/) configured to use global settings. +These global email settings are used for administrator notifications, release and configuration alerts, [notification rules](../../sys-mgmt/events/notifications.mdx), and any [Email stage](../../add-secure-apps/flows-stages/stages/email/) configured to use global settings. For complete setup examples, testing instructions, and TLS guidance, see the [Email configuration guide](../email.mdx). @@ -799,13 +799,13 @@ If you are running a version earlier than 2025.4, you can configure if the sessi ### `AUTHENTIK_SESSIONS__UNAUTHENTICATED_AGE`:ak-version[2025.4] -Configure how long unauthenticated sessions last for. Does not impact how long authenticated sessions are valid for. See the [user login stage](../../add-secure-apps/flows-stages/stages/user_login/index.md) for session validity. +Configure how long unauthenticated sessions last for. Does not impact how long authenticated sessions are valid for. See the [user login stage](../../add-secure-apps/flows-stages/stages/user_login/index.mdx) for session validity. Defaults to `days=1`. ### `AUTHENTIK_SESSIONS__USER_SWITCHING_AGE`:ak-version[2026.8] -Configure how long the browser cookie that groups sessions for [user account switching](../../users-sources/user/user-switching.md) lasts. This setting does not change the validity of the grouped sessions. +Configure how long the browser cookie that groups sessions for [user account switching](../../users-sources/user/user-switching.mdx) lasts. This setting does not change the validity of the grouped sessions. Defaults to `days=365`. @@ -843,7 +843,7 @@ Defaults to `/`. The base URL under which this authentik instance is reachable, for example `https://authentik.company`. -This option is a bootstrap value. On first start, authentik copies it into the **Base URL** [system setting](../../sys-mgmt/settings.md) when that setting has not been configured yet. It never overwrites a Base URL that was already set through the Admin interface or API, and when it is empty authentik falls back to the host configured on the embedded outpost. Once the system setting holds a value, this option is no longer consulted, so it does not need to remain in your environment configuration. +This option is a bootstrap value. On first start, authentik copies it into the **Base URL** [system setting](../../sys-mgmt/settings.mdx) when that setting has not been configured yet. It never overwrites a Base URL that was already set through the Admin interface or API, and when it is empty authentik falls back to the host configured on the embedded outpost. Once the system setting holds a value, this option is no longer consulted, so it does not need to remain in your environment configuration. Any trailing slash is removed, so `https://authentik.company` and `https://authentik.company/` are equivalent. @@ -885,7 +885,7 @@ Defaults to `false`. ## System settings -Additional [system settings](../../sys-mgmt/settings.md) are configurable using the Admin interface, under **System** > **Settings** or using the API. +Additional [system settings](../../sys-mgmt/settings.mdx) are configurable using the Admin interface, under **System** > **Settings** or using the API. ## Custom python settings diff --git a/website/docs/install-config/email.mdx b/website/docs/install-config/email.mdx index 74f859d369..8014992fe6 100644 --- a/website/docs/install-config/email.mdx +++ b/website/docs/install-config/email.mdx @@ -8,7 +8,7 @@ import Tabs from "@theme/Tabs"; This page covers both configuring authentik to send email and testing that email delivery is working. -Global email settings are used for administrator notifications, release and configuration alerts, [notification rules](../sys-mgmt/events/notifications.md), and any [Email stage](../../add-secure-apps/flows-stages/stages/email/) configured to use global settings. +Global email settings are used for administrator notifications, release and configuration alerts, [notification rules](../sys-mgmt/events/notifications.mdx), and any [Email stage](../../add-secure-apps/flows-stages/stages/email/) configured to use global settings. Email stages can be configured to use their own stage-specific SMTP settings if you need them to send mail through a different server than the one used by the rest of authentik. diff --git a/website/docs/install-config/first-steps/index.mdx b/website/docs/install-config/first-steps/index.mdx index 83ead52aad..944233c43e 100644 --- a/website/docs/install-config/first-steps/index.mdx +++ b/website/docs/install-config/first-steps/index.mdx @@ -29,20 +29,20 @@ architecture-beta The following tutorial assumes that you have already: -1. Installed authentik on either [Docker Compose](../../install-config/install/docker-compose.mdx#install-and-start-authentik), [Kubernetes](../../install-config/install/kubernetes.md#install-authentik-helm-chart), or [AWS CloudFormation](../../install-config/install/aws.md) and confirmed that the server, worker, and the PostgreSQL database are started and running. +1. Installed authentik on either [Docker Compose](../../install-config/install/docker-compose.mdx#install-and-start-authentik), [Kubernetes](../../install-config/install/kubernetes.mdx#install-authentik-helm-chart), or [AWS CloudFormation](../../install-config/install/aws.mdx) and confirmed that the server, worker, and the PostgreSQL database are started and running. -2. Opened authentik in your browser to the `initial-setup` flow and added credentials for a default Admin account. ([Docker](../../install-config/install/docker-compose.mdx#access-authentik), [Kubernetes](../../install-config/install/kubernetes.md#access-authentik)), or [AWS CloudFormation](../../install-config/install/aws.md#access-authentik-from-aws-cloudformation). +2. Opened authentik in your browser to the `initial-setup` flow and added credentials for a default Admin account. ([Docker](../../install-config/install/docker-compose.mdx#access-authentik), [Kubernetes](../../install-config/install/kubernetes.mdx#access-authentik)), or [AWS CloudFormation](../../install-config/install/aws.mdx#access-authentik-from-aws-cloudformation). :::info Initial setup in browser -You will get a `Not Found` error if the initial setup URL doesn't include the forward slash `/` at the very end of the URL. Also verify that the authentik server, worker, and PostgreSQL database are running and healthy. Review additional tips in our [troubleshooting docs](../../troubleshooting/login.md#cant-access-initial-setup-flow-during-installation-steps). +You will get a `Not Found` error if the initial setup URL doesn't include the forward slash `/` at the very end of the URL. Also verify that the authentik server, worker, and PostgreSQL database are running and healthy. Review additional tips in our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps). ::: Other optional pre-installation configurations that you might have already completed include: - [Configured your global email settings](../email/#configure-global-email-settings). - [Configured your PostgreSQL settings](../configuration/configuration.mdx#postgresql-settings) (read-replica, connections, etc.). -- Configured a [reverse proxy](../reverse-proxy.md). -- Configured your [media storage settings](../../install-config/configuration/configuration.mdx#media-storage-settings) or optionally [S3 file storage](../../sys-mgmt/ops/storage-s3/index.md). +- Configured a [reverse proxy](../reverse-proxy.mdx). +- Configured your [media storage settings](../../install-config/configuration/configuration.mdx#media-storage-settings) or optionally [S3 file storage](../../sys-mgmt/ops/storage-s3/index.mdx). - Added additional [custom configurations environment variables](../configuration/#set-your-environment-variables). - [Verified](../configuration/#verify-your-configuration-settings) your configuration settings. @@ -52,7 +52,7 @@ Now that you have your authentik instance installed and configured with the requ :::tip Security Best Practice -In a production environment, best practice is to first [create a group](../../users-sources/groups/manage_groups.mdx#create-a-group), then [create the user(s)](../../users-sources/user/user_basic_operations.md#create-a-user), and then add the application. Then you can configure the application to have a [binding](../../add-secure-apps/bindings-overview/work-with-bindings.md) to a specific group or user. The binding controls access to the application and whether it is displayed on a user's Application Dashboard page. +In a production environment, best practice is to first [create a group](../../users-sources/groups/manage_groups.mdx#create-a-group), then [create the user(s)](../../users-sources/user/user_basic_operations.mdx#create-a-user), and then add the application. Then you can configure the application to have a [binding](../../add-secure-apps/bindings-overview/work-with-bindings.mdx) to a specific group or user. The binding controls access to the application and whether it is displayed on a user's Application Dashboard page. ::: @@ -84,19 +84,19 @@ Every application that you add to authentik requires a provider, which is used t - **Group**: select an optional group for the application; groups are used to visually separate applications. For example, you can choose to group applications that you use for coding from those you use for internal communication. - **Policy engine mode**: select **Any** for this tutorial. The mode determines how authentik combines binding results. - TIP: in authentik, - [policies](../../customize/policies/bindings.md) are used in authentik to fine-tune access - to applications, flows, stages, and many other authentik components. You do not need to - use a policy for every application. The **Any** policy engine mode grants access when at - least one binding passes, or when no bindings are configured. The **All** mode requires - every binding on the application to pass. + [policies](../../customize/policies/bindings.mdx) are used in authentik to fine-tune + access to applications, flows, stages, and many other authentik components. You do not + need to use a policy for every application. The **Any** policy engine mode grants access + when at least one binding passes, or when no bindings are configured. The **All** mode + requires every binding on the application to pass. - **UI Settings**: optional UI settings that are displayed about the application, including the launch URL, and three settings to display extra information about the application on the **Application Dashboard** page: an optional icon, the publisher of the application, and a brief description. - **Choose a Provider Type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: - **Name**: Provide a name (or accept the auto-provided name). - **Authorization flow**: Select the default `implicit` authorization flow to use for this provider. - TIP: The authorization - [flow](../../add-secure-apps/flows-stages/flow/index.md) is where the various steps, or - [_stages_](../../add-secure-apps/flows-stages/stages/index.md) of authorization are + [flow](../../add-secure-apps/flows-stages/flow/index.mdx) is where the various steps, or + [_stages_](../../add-secure-apps/flows-stages/stages/index.mdx) of authorization are defined and executed. The defined set of stages construct the workflows of authentication, authorization, etc. - **Protocol settings**: provide the following required configurations: @@ -113,12 +113,12 @@ Every application that you add to authentik requires a provider, which is used t - TIP: authentik generates a key that you can use, called the `authentik Self-signed Certificate`, if you do not have a specific signing key for an application. -- **Configure Bindings** _(optional)_: for this tutorial, skip this step because you do not yet have a user. Later, after you create your first user, you can [create a binding](../../add-secure-apps/bindings-overview/work-with-bindings.md) to manage access to the application and its display on a user's **Application Dashboard** page. +- **Configure Bindings** _(optional)_: for this tutorial, skip this step because you do not yet have a user. Later, after you create your first user, you can [create a binding](../../add-secure-apps/bindings-overview/work-with-bindings.mdx) to manage access to the application and its display on a user's **Application Dashboard** page. - TIP: By creating a binding between an application and a specific user, you are ensuring that the application is accessible only to that user and any other users or groups for whom you created a binding. Learn more about how bindings are used - in authentik in our [Bindings overview](../../add-secure-apps/bindings-overview/index.md). For - any fields not mentioned above, you can leave the default value. + in authentik in our [Bindings overview](../../add-secure-apps/bindings-overview/index.mdx). + For any fields not mentioned above, you can leave the default value. **C.** Click **Create Application** to save the new application and provider. @@ -169,7 +169,7 @@ Now that you can access the authentik Admin interface, and you have added an app - **Username**: This value must be unique across all users. - **Display Name** (_optional_): The display name of the user. - - **Email** (_optional_): The email address of the user. Email addresses are used in [email stages](../../add-secure-apps/flows-stages/stages/email/index.md), as an alternative method to log in, by services to request an email address, and if configured, to receive [notifications](../../sys-mgmt/events/notifications.md). + - **Email** (_optional_): The email address of the user. Email addresses are used in [email stages](../../add-secure-apps/flows-stages/stages/email/index.mdx), as an alternative method to log in, by services to request an email address, and if configured, to receive [notifications](../../sys-mgmt/events/notifications.mdx). - **Active** (_optional_): Define if the newly created user account is active. Selected by default. - **Path**: The path where the user will be created. By default the new user is created in the `users` folder, but you can change that later by editing the user. - TIP: Paths are directories that are used to organize your @@ -180,7 +180,7 @@ Now that you can access the authentik Admin interface, and you have added an app C. Click **Create**. -For more information refer to our [documentation on managing users](../../users-sources/user/user_basic_operations.md#create-a-user). +For more information refer to our [documentation on managing users](../../users-sources/user/user_basic_operations.mdx#create-a-user). ### 2. Verify that the new user was created @@ -190,15 +190,15 @@ For more information refer to our [documentation on managing users](../../users- Now that you have added your first application, and a new user, here are some typical next steps: -- Assign your new user to appropriate [groups](../../users-sources/user/user_basic_operations.md#add-a-user-to-a-group) and [roles](../../users-sources/user/user_basic_operations.md#add-a-user-to-a-role). +- Assign your new user to appropriate [groups](../../users-sources/user/user_basic_operations.mdx#add-a-user-to-a-group) and [roles](../../users-sources/user/user_basic_operations.mdx#add-a-user-to-a-role). - [Restrict access](../../add-secure-apps/applications/manage_apps.mdx#use-bindings-to-control-access) to an application. See more below about [using bindings to restrict access](#using-bindings-to-allow-or-restrict-access-to-applications). - Learn more about [Role Based Access Control (RBAC) in authentik](../../users-sources/access-control/index.mdx). -- Configure federated or external [sources](../../users-sources/sources/index.md) (an existing source of user credentials and other user data). +- Configure federated or external [sources](../../users-sources/sources/index.mdx) (an existing source of user credentials and other user data). - Set up MFA -- Define [property mappings](../../add-secure-apps/providers/property-mappings/index.md). -- Create a [custom flow](../../add-secure-apps/flows-stages/flow/index.md#). -- [Get started with authentik Enterprise](../../enterprise/get-started.md) -- [Create a policy](../../customize/policies/index.md) to control access, force MFA use, etc. +- Define [property mappings](../../add-secure-apps/providers/property-mappings/index.mdx). +- Create a [custom flow](../../add-secure-apps/flows-stages/flow/index.mdx#). +- [Get started with authentik Enterprise](../../enterprise/get-started.mdx) +- [Create a policy](../../customize/policies/index.mdx) to control access, force MFA use, etc. ## Things to know and troubleshooting tips @@ -210,7 +210,7 @@ Especially when you are just starting out with authentik, we recommend that you ### Reverse proxy -Typically authentik is set up with a reverse proxy in front of it. If you already have a reverse proxy that you are using to handle your incoming network traffic, you can simply use that same reverse proxy for authentik, by adding a few configuration values. For more details see the [Reverse proxy guide](../reverse-proxy.md). +Typically authentik is set up with a reverse proxy in front of it. If you already have a reverse proxy that you are using to handle your incoming network traffic, you can simply use that same reverse proxy for authentik, by adding a few configuration values. For more details see the [Reverse proxy guide](../reverse-proxy.mdx). ### The `latest` tag is deprecated @@ -219,7 +219,7 @@ Instead, use a specific version tag for authentik instances' container images, s ### Use bindings to allow or restrict access to applications {#using-bindings-to-allow-or-restrict-access-to-applications} -If you do not define any [bindings](../../add-secure-apps/bindings-overview/index.md), all users have access to the application. To control access, you can [create a binding](../../add-secure-apps/bindings-overview/work-with-bindings.md). For more information, see [policy-driven authorization](../../add-secure-apps/applications/manage_apps.mdx#policy-driven-authorization) and [hiding an application](../../add-secure-apps/applications/manage_apps.mdx#hide-applications). +If you do not define any [bindings](../../add-secure-apps/bindings-overview/index.mdx), all users have access to the application. To control access, you can [create a binding](../../add-secure-apps/bindings-overview/work-with-bindings.mdx). For more information, see [policy-driven authorization](../../add-secure-apps/applications/manage_apps.mdx#policy-driven-authorization) and [hiding an application](../../add-secure-apps/applications/manage_apps.mdx#hide-applications). ### Upgrades diff --git a/website/docs/install-config/high-availability.mdx b/website/docs/install-config/high-availability.mdx index 802de1b697..15834df44f 100644 --- a/website/docs/install-config/high-availability.mdx +++ b/website/docs/install-config/high-availability.mdx @@ -41,7 +41,7 @@ The components of an active-passive authentik deployment include: - **Shared Database**: Both instances connect to the same PostgreSQL database which ensures data consistency. Because authentik is stateless, there are no data conflicts. - **Load Balancer**: A load balancer monitors the active instance's health. Upon detecting failure, it promotes the passive instance to active by redirecting all traffic to it. This failover can be triggered automatically or manually, depending on your failover strategy. When the original active authentik instance is restored, it can either remain passive or be promoted back to active (failback). -For more information on monitoring the health of an authentik instance, refer to the [Monitoring documentation](../sys-mgmt/ops/monitoring.md). +For more information on monitoring the health of an authentik instance, refer to the [Monitoring documentation](../sys-mgmt/ops/monitoring.mdx). The following diagram shows a typical active-passive configuration: diff --git a/website/docs/install-config/index.mdx b/website/docs/install-config/index.mdx index 7fbd9f23cb..d72f5e7d7e 100644 --- a/website/docs/install-config/index.mdx +++ b/website/docs/install-config/index.mdx @@ -6,7 +6,7 @@ sidebar_position: 0 Everything you need to get authentik up and running! -The installation process is the same for the open-source edition and [authentik Enterprise](../enterprise/index.mdx). To enable Enterprise features, [get started with authentik Enterprise](../enterprise/get-started.md) after installing authentik. +The installation process is the same for the open-source edition and [authentik Enterprise](../enterprise/index.mdx). To enable Enterprise features, [get started with authentik Enterprise](../enterprise/get-started.mdx) after installing authentik. For information about upgrading to a new version, refer to the Upgrade section in the relevant [Release Notes](../releases) and to our [Upgrade authentik](./upgrade.mdx) documentation. diff --git a/website/docs/install-config/install/aws.md b/website/docs/install-config/install/aws.mdx similarity index 94% rename from website/docs/install-config/install/aws.md rename to website/docs/install-config/install/aws.mdx index 86eaca4484..5310c6cc88 100644 --- a/website/docs/install-config/install/aws.md +++ b/website/docs/install-config/install/aws.mdx @@ -36,9 +36,9 @@ To start the initial setup, navigate to `http://`. You are then prompted to set a password for the `akadmin` user (the default user). :::info Issues with initial setup -If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.md#cant-access-initial-setup-flow-during-installation-steps). +If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps). ::: ### Further customization -If you require further customization, we recommend you install authentik via [Docker Compose](./docker-compose.mdx) or [Kubernetes](./kubernetes.md). +If you require further customization, we recommend you install authentik via [Docker Compose](./docker-compose.mdx) or [Kubernetes](./kubernetes.mdx). diff --git a/website/docs/install-config/install/docker-compose.mdx b/website/docs/install-config/install/docker-compose.mdx index c4e1469e26..2575037636 100644 --- a/website/docs/install-config/install/docker-compose.mdx +++ b/website/docs/install-config/install/docker-compose.mdx @@ -67,7 +67,7 @@ To enable error reporting, run the following command: echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env ``` -For an explanation about what each service in the Docker Compose file does, see [Architecture](../../core/architecture.md). +For an explanation about what each service in the Docker Compose file does, see [Architecture](../../core/architecture.mdx). ## Configure custom ports @@ -88,15 +88,15 @@ By default, the authentik Docker Compose file mounts the Docker socket to the au - /var/run/docker.sock:/var/run/docker.sock ``` -This is used for [automatic deployment and management of authentik Outposts](../../add-secure-apps/outposts/integrations/docker.md). +This is used for [automatic deployment and management of authentik Outposts](../../add-secure-apps/outposts/integrations/docker.mdx). -Mounting the Docker socket to a container comes with some inherent security risks. To reduce these risks, you can use a [Docker Socket Proxy](../../add-secure-apps/outposts/integrations/docker.md#docker-socket-proxy) as an additional layer of protection. +Mounting the Docker socket to a container comes with some inherent security risks. To reduce these risks, you can use a [Docker Socket Proxy](../../add-secure-apps/outposts/integrations/docker.mdx#docker-socket-proxy) as an additional layer of protection. -Alternatively, you can remove this mount and instead [manually deploy and manage outposts](../../add-secure-apps/outposts/manual-deploy-docker-compose.md). +Alternatively, you can remove this mount and instead [manually deploy and manage outposts](../../add-secure-apps/outposts/manual-deploy-docker-compose.mdx). ## Email configuration (optional but recommended) -It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by [Email stages](../../add-secure-apps/flows-stages/stages/email/index.md) to send verification/recovery emails. +It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by [Email stages](../../add-secure-apps/flows-stages/stages/email/index.mdx) to send verification/recovery emails. For more information, refer to our [Email configuration](../email.mdx) documentation. @@ -122,7 +122,7 @@ To start the initial setup, navigate to `http://:9 You are then prompted to set a password for the `akadmin` user (the default user). :::info Issues with initial setup -If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.md#cant-access-initial-setup-flow-during-installation-steps). +If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps). ::: ## First steps in authentik diff --git a/website/docs/install-config/install/kubernetes.md b/website/docs/install-config/install/kubernetes.mdx similarity index 89% rename from website/docs/install-config/install/kubernetes.md rename to website/docs/install-config/install/kubernetes.mdx index d31042e655..f7f13b6d86 100644 --- a/website/docs/install-config/install/kubernetes.md +++ b/website/docs/install-config/install/kubernetes.mdx @@ -18,7 +18,15 @@ You can also [view a video walk-through](https://www.youtube.com/watch?v=O1qUbrk View our video about installing authentik on Kubernetes. - + ## Generate passwords @@ -92,7 +100,7 @@ After you provision PostgreSQL externally, configure authentik to use it with th ## Email configuration (optional but recommended) -It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by [Email stages](../../add-secure-apps/flows-stages/stages/email/index.md) to send verification/recovery emails. +It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by [Email stages](../../add-secure-apps/flows-stages/stages/email/index.mdx) to send verification/recovery emails. For more information, refer to our [Email configuration](../email.mdx) documentation. @@ -115,7 +123,7 @@ To start the initial setup, navigate to `http://:9 You are then prompted to set a password for the `akadmin` user (the default user). :::info Issues with initial setup -If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.md#cant-access-initial-setup-flow-during-installation-steps). +If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps). ::: ## First steps in authentik diff --git a/website/docs/install-config/reverse-proxy.md b/website/docs/install-config/reverse-proxy.mdx similarity index 99% rename from website/docs/install-config/reverse-proxy.md rename to website/docs/install-config/reverse-proxy.mdx index 05e1c27cf1..cd803f793f 100644 --- a/website/docs/install-config/reverse-proxy.md +++ b/website/docs/install-config/reverse-proxy.mdx @@ -111,6 +111,6 @@ server { ## Troubleshooting -- CSRF errors when saving objects are usually caused by incorrect `Host` or `Origin` handling. See [Troubleshooting CSRF Errors](../troubleshooting/csrf.md). +- CSRF errors when saving objects are usually caused by incorrect `Host` or `Origin` handling. See [Troubleshooting CSRF Errors](../troubleshooting/csrf.mdx). - Incorrect client IP addresses usually mean the proxy IP is not covered by `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`. - Broken outpost or proxy provider communication often means the WebSocket upgrade headers are missing or the proxy is not using HTTP/1.1 or newer. diff --git a/website/docs/install-config/upgrade.mdx b/website/docs/install-config/upgrade.mdx index 4d01549e33..9e30062eb2 100644 --- a/website/docs/install-config/upgrade.mdx +++ b/website/docs/install-config/upgrade.mdx @@ -7,7 +7,7 @@ Upgrading to the latest version of authentik, whether a new major release or a p ## Get notified about new releases -Once an hour, authentik checks for a newer stable release and creates an [`update_available`](../sys-mgmt/events/event-actions.md#update_available) event when it finds one. The built-in `default-notify-update` [notification rule](../sys-mgmt/events/notifications.md) sends that event to the **authentik Admins** group through two default [transports](../sys-mgmt/events/transports.md): `default-local-transport`, which shows a notification in the Admin interface, and `default-email-transport`, which emails the group once [global email settings](./email.mdx) are configured. To deliver release notifications somewhere else, such as a chat channel, add a webhook transport to that rule. +Once an hour, authentik checks for a newer stable release and creates an [`update_available`](../sys-mgmt/events/event-actions.mdx#update_available) event when it finds one. The built-in `default-notify-update` [notification rule](../sys-mgmt/events/notifications.mdx) sends that event to the **authentik Admins** group through two default [transports](../sys-mgmt/events/transports.mdx): `default-local-transport`, which shows a notification in the Admin interface, and `default-email-transport`, which emails the group once [global email settings](./email.mdx) are configured. To deliver release notifications somewhere else, such as a chat channel, add a webhook transport to that rule. The check is an outbound connection to `version.goauthentik.io`, so it does not run when [`AUTHENTIK_DISABLE_UPDATE_CHECK`](./configuration/configuration.mdx#authentik_disable_update_check) is set, which [air-gapped deployments](./air-gapped.mdx) are expected to do. @@ -26,7 +26,7 @@ authentik does not support downgrading. Make sure to back up your database in ca **Preview the release notes**: Be sure to carefully read the [Release Notes](../../releases/) for the specific version to which you plan to upgrade. The release might have special requirements or actions, or contain breaking changes. -**Database backup**: Before upgrading, make a backup of your PostgreSQL database. For general guidance, see [Backup and restore](../sys-mgmt/ops/backup-restore.md). For deployment-specific PostgreSQL guides, refer to the relevant guide for your deployment method ([Docker Compose](../troubleshooting/postgres/upgrade_docker.md) or [Kubernetes](../troubleshooting/postgres/upgrade_kubernetes.md)). +**Database backup**: Before upgrading, make a backup of your PostgreSQL database. For general guidance, see [Backup and restore](../sys-mgmt/ops/backup-restore.mdx). For deployment-specific PostgreSQL guides, refer to the relevant guide for your deployment method ([Docker Compose](../troubleshooting/postgres/upgrade_docker.mdx) or [Kubernetes](../troubleshooting/postgres/upgrade_kubernetes.mdx)). **Upgrade sequence**: Upgrades must follow the sequence of major releases; **do not skip** directly from an older major version to the most recent version. @@ -36,7 +36,7 @@ Always upgrade to the latest minor version (`.x`) within each `major.minor` vers 2. Then to the latest `2025.4.x`. 3. Finally to the latest `2025.6.x`. -**Outposts**: The version of the authentik server and all authentik outposts must match. Ensure that all [outposts are upgraded](../add-secure-apps/outposts/upgrading.md) at the same time as the core authentik instance. +**Outposts**: The version of the authentik server and all authentik outposts must match. Ensure that all [outposts are upgraded](../add-secure-apps/outposts/upgrading.mdx) at the same time as the core authentik instance. **Air-gapped environments**: Before upgrading an air-gapped deployment, mirror the target release's required images and artifacts. For details, see [Air-gapped environments](./air-gapped.mdx#upgrades). @@ -82,7 +82,7 @@ import Tabs from "@theme/Tabs"; ## Upgrade any outposts -Be sure to also [upgrade any outposts](../add-secure-apps/outposts/upgrading.md) when you upgrade your authentik instance. +Be sure to also [upgrade any outposts](../add-secure-apps/outposts/upgrading.mdx) when you upgrade your authentik instance. ## Verify your upgrade diff --git a/website/docs/releases/2021/v2021.1.md b/website/docs/releases/2021/v2021.1.mdx similarity index 93% rename from website/docs/releases/2021/v2021.1.md rename to website/docs/releases/2021/v2021.1.mdx index 7a154a9945..f28ef80149 100644 --- a/website/docs/releases/2021/v2021.1.md +++ b/website/docs/releases/2021/v2021.1.mdx @@ -8,13 +8,13 @@ slug: "/releases/2021.1" - New versioning schema (year.month.release) - Add global email settings - In previous versions, you had to configure email connection details per [Email Stage](../../add-secure-apps/flows-stages/stages/email/index.md). Now, you can (and should) configure global settings. + In previous versions, you had to configure email connection details per [Email Stage](../../add-secure-apps/flows-stages/stages/email/index.mdx). Now, you can (and should) configure global settings. - This is documented under the [Docker Compose](../../install-config/install/docker-compose.mdx) and [Kubernetes](../../install-config/install/kubernetes.md) sections. + This is documented under the [Docker Compose](../../install-config/install/docker-compose.mdx) and [Kubernetes](../../install-config/install/kubernetes.mdx) sections. - New notification system - More info can be found under [Notifications](../../sys-mgmt/events/notifications.md) and [Transports](../../sys-mgmt/events/transports.md). + More info can be found under [Notifications](../../sys-mgmt/events/notifications.mdx) and [Transports](../../sys-mgmt/events/transports.mdx). During the update, some default rules will be created. These rules notify you about policy exceptions, configuration errors and updates. diff --git a/website/docs/releases/2021/v2021.10.md b/website/docs/releases/2021/v2021.10.mdx similarity index 100% rename from website/docs/releases/2021/v2021.10.md rename to website/docs/releases/2021/v2021.10.mdx diff --git a/website/docs/releases/2021/v2021.12.md b/website/docs/releases/2021/v2021.12.mdx similarity index 100% rename from website/docs/releases/2021/v2021.12.md rename to website/docs/releases/2021/v2021.12.mdx diff --git a/website/docs/releases/2021/v2021.2.md b/website/docs/releases/2021/v2021.2.mdx similarity index 100% rename from website/docs/releases/2021/v2021.2.md rename to website/docs/releases/2021/v2021.2.mdx diff --git a/website/docs/releases/2021/v2021.3.md b/website/docs/releases/2021/v2021.3.mdx similarity index 100% rename from website/docs/releases/2021/v2021.3.md rename to website/docs/releases/2021/v2021.3.mdx diff --git a/website/docs/releases/2021/v2021.4.md b/website/docs/releases/2021/v2021.4.mdx similarity index 100% rename from website/docs/releases/2021/v2021.4.md rename to website/docs/releases/2021/v2021.4.mdx diff --git a/website/docs/releases/2021/v2021.5.md b/website/docs/releases/2021/v2021.5.mdx similarity index 100% rename from website/docs/releases/2021/v2021.5.md rename to website/docs/releases/2021/v2021.5.mdx diff --git a/website/docs/releases/2021/v2021.6.md b/website/docs/releases/2021/v2021.6.mdx similarity index 100% rename from website/docs/releases/2021/v2021.6.md rename to website/docs/releases/2021/v2021.6.mdx diff --git a/website/docs/releases/2021/v2021.7.md b/website/docs/releases/2021/v2021.7.mdx similarity index 100% rename from website/docs/releases/2021/v2021.7.md rename to website/docs/releases/2021/v2021.7.mdx diff --git a/website/docs/releases/2021/v2021.8.md b/website/docs/releases/2021/v2021.8.mdx similarity index 100% rename from website/docs/releases/2021/v2021.8.md rename to website/docs/releases/2021/v2021.8.mdx diff --git a/website/docs/releases/2021/v2021.9.md b/website/docs/releases/2021/v2021.9.mdx similarity index 100% rename from website/docs/releases/2021/v2021.9.md rename to website/docs/releases/2021/v2021.9.mdx diff --git a/website/docs/releases/2022/v2022.1.md b/website/docs/releases/2022/v2022.1.mdx similarity index 100% rename from website/docs/releases/2022/v2022.1.md rename to website/docs/releases/2022/v2022.1.mdx diff --git a/website/docs/releases/2022/v2022.10.md b/website/docs/releases/2022/v2022.10.mdx similarity index 99% rename from website/docs/releases/2022/v2022.10.md rename to website/docs/releases/2022/v2022.10.mdx index c47771412d..d30857b2d7 100644 --- a/website/docs/releases/2022/v2022.10.md +++ b/website/docs/releases/2022/v2022.10.mdx @@ -13,7 +13,7 @@ slug: "/releases/2022.10" - Support for OAuth2 Device flow - See more in the OAuth2 provider docs [here](../../add-secure-apps/providers/oauth2/device_code.md). This flow allows users to authenticate on devices that have limited input possibilities and or no browser access. + See more in the OAuth2 provider docs [here](../../add-secure-apps/providers/oauth2/device_code.mdx). This flow allows users to authenticate on devices that have limited input possibilities and or no browser access. - Customizable payload for SMS Authenticator stage when using Generic provider. - Revamped SAML Source @@ -3405,7 +3405,7 @@ Changed response : **200 OK** ## Fixed in 2022.10.2 -- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.md), Reported by [@sdimovv](https://github.com/sdimovv) +- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.mdx), Reported by [@sdimovv](https://github.com/sdimovv) ## Fixed in 2022.10.3 @@ -3413,8 +3413,8 @@ Changed response : **200 OK** ## Fixed in 2022.10.4 -- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.md), Reported by [@DreamingRaven](https://github.com/DreamingRaven) -- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.md), Reported by [@fuomag9](https://github.com/fuomag9) +- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.mdx), Reported by [@DreamingRaven](https://github.com/DreamingRaven) +- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.mdx), Reported by [@fuomag9](https://github.com/fuomag9) ## Upgrading diff --git a/website/docs/releases/2022/v2022.11.md b/website/docs/releases/2022/v2022.11.mdx similarity index 99% rename from website/docs/releases/2022/v2022.11.md rename to website/docs/releases/2022/v2022.11.mdx index 678dc45c73..7ac0138238 100644 --- a/website/docs/releases/2022/v2022.11.md +++ b/website/docs/releases/2022/v2022.11.mdx @@ -73,7 +73,7 @@ image: ## Fixed in 2022.11.2 -- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.md), Reported by [@sdimovv](https://github.com/sdimovv) +- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.mdx), Reported by [@sdimovv](https://github.com/sdimovv) ## Fixed in 2022.11.3 @@ -81,8 +81,8 @@ image: ## Fixed in 2022.11.4 -- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.md), Reported by [@DreamingRaven](https://github.com/DreamingRaven) -- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.md), Reported by [@fuomag9](https://github.com/fuomag9) +- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.mdx), Reported by [@DreamingRaven](https://github.com/DreamingRaven) +- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.mdx), Reported by [@fuomag9](https://github.com/fuomag9) ## API Changes diff --git a/website/docs/releases/2022/v2022.12.md b/website/docs/releases/2022/v2022.12.mdx similarity index 99% rename from website/docs/releases/2022/v2022.12.md rename to website/docs/releases/2022/v2022.12.mdx index a54285e404..8c6c9b8e19 100644 --- a/website/docs/releases/2022/v2022.12.md +++ b/website/docs/releases/2022/v2022.12.mdx @@ -168,7 +168,7 @@ image: ## Fixed in 2022.12.3 -- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9) +- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.mdx), Reported by [@fuomag9](https://github.com/fuomag9) ## API Changes diff --git a/website/docs/releases/2022/v2022.2.md b/website/docs/releases/2022/v2022.2.mdx similarity index 100% rename from website/docs/releases/2022/v2022.2.md rename to website/docs/releases/2022/v2022.2.mdx diff --git a/website/docs/releases/2022/v2022.3.md b/website/docs/releases/2022/v2022.3.mdx similarity index 100% rename from website/docs/releases/2022/v2022.3.md rename to website/docs/releases/2022/v2022.3.mdx diff --git a/website/docs/releases/2022/v2022.4.md b/website/docs/releases/2022/v2022.4.mdx similarity index 100% rename from website/docs/releases/2022/v2022.4.md rename to website/docs/releases/2022/v2022.4.mdx diff --git a/website/docs/releases/2022/v2022.5.md b/website/docs/releases/2022/v2022.5.mdx similarity index 95% rename from website/docs/releases/2022/v2022.5.md rename to website/docs/releases/2022/v2022.5.mdx index 58780016b6..cc5436167b 100644 --- a/website/docs/releases/2022/v2022.5.md +++ b/website/docs/releases/2022/v2022.5.mdx @@ -7,7 +7,7 @@ slug: "/releases/2022.5" - Twitter Source has been migrated to OAuth2 - This requires some reconfiguration on both Twitter's and authentik's side. Check out the new Twitter integration docs [here](../../users-sources/sources/social-logins/twitter/index.md). + This requires some reconfiguration on both Twitter's and authentik's side. Check out the new Twitter integration docs [here](../../users-sources/sources/social-logins/twitter/index.mdx). - OAuth Provider: Redirect URIs are now checked using regular expressions @@ -19,12 +19,12 @@ slug: "/releases/2022.5" Instead of always executing the configured flow when a new Bind request is received, the provider can now be configured to cache the session from the initial flow execution, and directly validate credentials in the outpost. This drastically improves the bind performance. - See [LDAP provider](../../add-secure-apps/providers/ldap/index.md#cached-bind) + See [LDAP provider](../../add-secure-apps/providers/ldap/index.mdx#cached-bind) - OAuth2: Add support for `form_post` response mode - Don't prompt users for MFA when they've authenticated themselves within a time period - You can now configure any [Authenticator Validation Stage](../../add-secure-apps/flows-stages/stages/authenticator_validate/index.md) stage to not ask for MFA validation if the user has previously authenticated themselves with an MFA device (of any of the selected classes) in the `Last validation threshold`. + You can now configure any [Authenticator Validation Stage](../../add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx) stage to not ask for MFA validation if the user has previously authenticated themselves with an MFA device (of any of the selected classes) in the `Last validation threshold`. - Optimize bundling of web assets diff --git a/website/docs/releases/2022/v2022.6.md b/website/docs/releases/2022/v2022.6.mdx similarity index 100% rename from website/docs/releases/2022/v2022.6.md rename to website/docs/releases/2022/v2022.6.mdx diff --git a/website/docs/releases/2022/v2022.7.md b/website/docs/releases/2022/v2022.7.mdx similarity index 100% rename from website/docs/releases/2022/v2022.7.md rename to website/docs/releases/2022/v2022.7.mdx diff --git a/website/docs/releases/2022/v2022.8.md b/website/docs/releases/2022/v2022.8.mdx similarity index 100% rename from website/docs/releases/2022/v2022.8.md rename to website/docs/releases/2022/v2022.8.mdx diff --git a/website/docs/releases/2022/v2022.9.md b/website/docs/releases/2022/v2022.9.mdx similarity index 99% rename from website/docs/releases/2022/v2022.9.md rename to website/docs/releases/2022/v2022.9.mdx index 0f17a6a409..4a35f19557 100644 --- a/website/docs/releases/2022/v2022.9.md +++ b/website/docs/releases/2022/v2022.9.mdx @@ -15,7 +15,7 @@ slug: "/releases/2022.9" - Duo Admin API integration - When using a Duo MFA, Duo Access or Duo Beyond plan, authentik can now automatically import devices from Duo into authentik. More info [here](../../add-secure-apps/flows-stages/stages/authenticator_duo/index.md). + When using a Duo MFA, Duo Access or Duo Beyond plan, authentik can now automatically import devices from Duo into authentik. More info [here](../../add-secure-apps/flows-stages/stages/authenticator_duo/index.mdx). ## API Changes diff --git a/website/docs/releases/2023/v2023.1.md b/website/docs/releases/2023/v2023.1.mdx similarity index 99% rename from website/docs/releases/2023/v2023.1.md rename to website/docs/releases/2023/v2023.1.mdx index 3fffb6773e..0434ce8e7e 100644 --- a/website/docs/releases/2023/v2023.1.md +++ b/website/docs/releases/2023/v2023.1.mdx @@ -121,7 +121,7 @@ image: ## Fixed in 2023.1.3 -- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9) +- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.mdx), Reported by [@fuomag9](https://github.com/fuomag9) ## API Changes diff --git a/website/docs/releases/2023/v2023.10.md b/website/docs/releases/2023/v2023.10.mdx similarity index 99% rename from website/docs/releases/2023/v2023.10.md rename to website/docs/releases/2023/v2023.10.mdx index f6cd200d3d..d22cdbeedc 100644 --- a/website/docs/releases/2023/v2023.10.md +++ b/website/docs/releases/2023/v2023.10.mdx @@ -127,7 +127,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2023.10 ## Fixed in 2023.10.2 -- \*: fix [CVE-2023-46249](../../security/cves/CVE-2023-46249.md), reported by [@devSparkle](https://github.com/devSparkle) +- \*: fix [CVE-2023-46249](../../security/cves/CVE-2023-46249.mdx), reported by [@devSparkle](https://github.com/devSparkle) - blueprints: fix entries with state: absent not being deleted if their serializer has errors (#7345) - crypto: fix race conditions when creating self-signed certificates on startup (#7344) - lifecycle: rework otp_merge migration (#7359) @@ -161,7 +161,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2023.10 - providers/proxy: Fix duplicate cookies when using file system store. (cherry-pick #7541) (#7544) - providers/scim: fix missing schemas attribute for User and Group (cherry-pick #7477) (#7596) - root: specify node and python versions in respective config files, deduplicate in CI (#7620) -- security: fix [CVE-2023-48228](../../security/cves/CVE-2023-48228.md), Reported by [@Sapd](https://github.com/Sapd) (#7666) +- security: fix [CVE-2023-48228](../../security/cves/CVE-2023-48228.mdx), Reported by [@Sapd](https://github.com/Sapd) (#7666) - stages/email: use uuid for email confirmation token instead of username (cherry-pick #7581) (#7584) - web/admin: fix admins not able to delete MFA devices (#7660) @@ -186,7 +186,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2023.10 - core: fix PropertyMapping context not being available in request context - outposts: disable deployment and secret reconciler for embedded outpost in code instead of in config (cherry-pick #8021) (#8024) - outposts: fix Outpost reconcile not re-assigning managed attribute (cherry-pick #8014) (#8020) -- providers/oauth2: fix [CVE-2024-21637](../../security/cves/CVE-2024-21637.md), Reported by [@lauritzh](https://github.com/lauritzh) (#8104) +- providers/oauth2: fix [CVE-2024-21637](../../security/cves/CVE-2024-21637.mdx), Reported by [@lauritzh](https://github.com/lauritzh) (#8104) - providers/oauth2: remember session_id from initial token (cherry-pick #7976) (#7977) - providers/proxy: use access token (cherry-pick #8022) (#8023) - rbac: fix error when looking up permissions for now uninstalled apps (cherry-pick #8068) (#8070) @@ -195,7 +195,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2023.10 ## Fixed in 2023.10.7 -- providers/oauth2: fix [CVE-2024-23647](../../security/cves/CVE-2024-23647.md) (cherry-pick #8345) (#8347) +- providers/oauth2: fix [CVE-2024-23647](../../security/cves/CVE-2024-23647.mdx) (cherry-pick #8345) (#8347) - rbac: fix invitations listing with restricted permissions (cherry-pick #8227) (#8229) - root: fix listen trusted_proxy_cidrs config loading from environment (#8075) - root: fix redis config not being updated to match previous change diff --git a/website/docs/releases/2023/v2023.2.md b/website/docs/releases/2023/v2023.2.mdx similarity index 99% rename from website/docs/releases/2023/v2023.2.md rename to website/docs/releases/2023/v2023.2.mdx index 3f389c71f8..7a7ed11128 100644 --- a/website/docs/releases/2023/v2023.2.md +++ b/website/docs/releases/2023/v2023.2.mdx @@ -21,7 +21,7 @@ slug: "/releases/2023.2" - Generated avatars, multiple avatar modes - authentik now supports multiple avatar modes, and will use the next configured mode when a mode doesn't have an avatar. For example, the new default configuration attempts to use gravatar, but if the user's email does not have a gravatar setup, it will instead use the new generated avatars. See [Configuration](../../sys-mgmt/settings.md#avatars) + authentik now supports multiple avatar modes, and will use the next configured mode when a mode doesn't have an avatar. For example, the new default configuration attempts to use gravatar, but if the user's email does not have a gravatar setup, it will instead use the new generated avatars. See [Configuration](../../sys-mgmt/settings.mdx#avatars) ## Upgrading @@ -109,7 +109,7 @@ image: ## Fixed in 2023.2.3 -- \*: fix [CVE-2023-26481.md](../../security/cves/CVE-2023-26481.md), Reported by [@fuomag9](https://github.com/fuomag9) +- \*: fix [CVE-2023-26481.md](../../security/cves/CVE-2023-26481.mdx), Reported by [@fuomag9](https://github.com/fuomag9) ## API Changes diff --git a/website/docs/releases/2023/v2023.3.md b/website/docs/releases/2023/v2023.3.mdx similarity index 99% rename from website/docs/releases/2023/v2023.3.md rename to website/docs/releases/2023/v2023.3.mdx index de3b59944e..11890908f9 100644 --- a/website/docs/releases/2023/v2023.3.md +++ b/website/docs/releases/2023/v2023.3.mdx @@ -13,7 +13,7 @@ slug: "/releases/2023.3" authentik can now provision users into other IT systems via the SCIM (System for Cross-domain Identity Management) protocol. The provider synchronizes Users, Groups and the user membership. Objects are synced both when they are saved and based on a pre-defined schedule in the background. - Documentation: [SCIM Provider](../../add-secure-apps/providers/scim/index.md) + Documentation: [SCIM Provider](../../add-secure-apps/providers/scim/index.mdx) - Theming improvements - The custom.css file is now loaded in ShadowDOMs, allowing for much greater customization, as previously it was only possible to style elements outside of the ShadowDOM. See docs for the [User interface](../../customize/interfaces/user/index.mdx) and [Admin interface](../../customize/interfaces/admin/index.mdx). diff --git a/website/docs/releases/2023/v2023.4.md b/website/docs/releases/2023/v2023.4.mdx similarity index 99% rename from website/docs/releases/2023/v2023.4.md rename to website/docs/releases/2023/v2023.4.mdx index d338319f70..e68215fa68 100644 --- a/website/docs/releases/2023/v2023.4.md +++ b/website/docs/releases/2023/v2023.4.mdx @@ -21,7 +21,7 @@ slug: "/releases/2023.4" authentik now supports the [RADIUS protocol](https://en.wikipedia.org/wiki/RADIUS) for authentication, allowing for the integration of a wider variety of systems such as VPN software, network switches/routers, and others. - The RADIUS provider also uses a flow to authenticate users, and supports the same stages as the [LDAP Provider](../../add-secure-apps/providers/ldap/index.md). + The RADIUS provider also uses a flow to authenticate users, and supports the same stages as the [LDAP Provider](../../add-secure-apps/providers/ldap/index.mdx). Documentation: [RADIUS Provider](../../add-secure-apps/providers/radius/index.mdx) @@ -35,11 +35,11 @@ slug: "/releases/2023.4" - "Stay logged in" prompt - In the [User login stage](../../add-secure-apps/flows-stages/stages/user_login/index.md), an admin can use the new "Stay Logged In" option to add additional minutes or hours to the defined `session duration` value. When this "Stay Logged In" offset time is configured, the user logging in is presented with a prompt asking if they want to extend their session. + In the [User login stage](../../add-secure-apps/flows-stages/stages/user_login/index.mdx), an admin can use the new "Stay Logged In" option to add additional minutes or hours to the defined `session duration` value. When this "Stay Logged In" offset time is configured, the user logging in is presented with a prompt asking if they want to extend their session. - Prompt preview - When creating a single prompt for use with a [Prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.md), a live preview of the prompt is now shown. This makes it easier to test how a prompt will behave, and also shows what data it will send, and how it will be available in the flow context. + When creating a single prompt for use with a [Prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.mdx), a live preview of the prompt is now shown. This makes it easier to test how a prompt will behave, and also shows what data it will send, and how it will be available in the flow context. ## Upgrading @@ -109,11 +109,11 @@ image: ## Fixed in 2023.4.2 -- security: Address pen-test findings from the [2023-06 Cure53 Code audit](../../security/audits-and-certs/2023-06-cure53.md) +- security: Address pen-test findings from the [2023-06 Cure53 Code audit](../../security/audits-and-certs/2023-06-cure53.mdx) ## Fixed in 2023.4.3 -- \*: fix [CVE-2023-36456](../../security/cves/CVE-2023-36456.md), Reported by [@thijsa](https://github.com/thijsa) +- \*: fix [CVE-2023-36456](../../security/cves/CVE-2023-36456.mdx), Reported by [@thijsa](https://github.com/thijsa) ## API Changes diff --git a/website/docs/releases/2023/v2023.5.md b/website/docs/releases/2023/v2023.5.mdx similarity index 99% rename from website/docs/releases/2023/v2023.5.md rename to website/docs/releases/2023/v2023.5.mdx index 083e38831d..5eea44081b 100644 --- a/website/docs/releases/2023/v2023.5.md +++ b/website/docs/releases/2023/v2023.5.mdx @@ -23,7 +23,7 @@ slug: "/releases/2023.5" - Backchannel providers - Backchannel providers can augment the functionality of applications by using additional protocols. The main provider of an application provides the SSO protocol that is used for logging into the application. Then, additional backchannel providers can be used for protocols such as [SCIM](../../add-secure-apps/providers/scim/index.md) and [LDAP](../../add-secure-apps/providers/ldap/index.md) to provide directory syncing. + Backchannel providers can augment the functionality of applications by using additional protocols. The main provider of an application provides the SSO protocol that is used for logging into the application. Then, additional backchannel providers can be used for protocols such as [SCIM](../../add-secure-apps/providers/scim/index.mdx) and [LDAP](../../add-secure-apps/providers/ldap/index.mdx) to provide directory syncing. Access restrictions that are configured on an application apply to all of its backchannel providers. @@ -146,15 +146,15 @@ image: ## Fixed in 2023.5.4 -- security: Address pen-test findings from the [2023-06 Cure53 Code audit](../../security/audits-and-certs/2023-06-cure53.md) +- security: Address pen-test findings from the [2023-06 Cure53 Code audit](../../security/audits-and-certs/2023-06-cure53.mdx) ## Fixed in 2023.5.5 -- \*: fix [CVE-2023-36456](../../security/cves/CVE-2023-36456.md), Reported by [@thijsa](https://github.com/thijsa) +- \*: fix [CVE-2023-36456](../../security/cves/CVE-2023-36456.mdx), Reported by [@thijsa](https://github.com/thijsa) ## Fixed in 2023.5.6 -- \*: fix [CVE-2023-39522](../../security/cves/CVE-2023-39522.md), Reported by [@markrassamni](https://github.com/markrassamni) +- \*: fix [CVE-2023-39522](../../security/cves/CVE-2023-39522.mdx), Reported by [@markrassamni](https://github.com/markrassamni) ## API Changes diff --git a/website/docs/releases/2023/v2023.6.md b/website/docs/releases/2023/v2023.6.mdx similarity index 99% rename from website/docs/releases/2023/v2023.6.md rename to website/docs/releases/2023/v2023.6.mdx index d27323b452..e36b01d52a 100644 --- a/website/docs/releases/2023/v2023.6.md +++ b/website/docs/releases/2023/v2023.6.mdx @@ -9,7 +9,7 @@ slug: "/releases/2023.6" - LDAP StartTLS support - authentik's [LDAP Provider](../../add-secure-apps/providers/ldap/index.md) now supports StartTLS in addition to supporting SSL. The StartTLS is a more modern method of encrypting LDAP traffic. With this added support, the LDAP [Outpost](../../add-secure-apps/outposts/index.mdx) can now support multiple certificates. + authentik's [LDAP Provider](../../add-secure-apps/providers/ldap/index.mdx) now supports StartTLS in addition to supporting SSL. The StartTLS is a more modern method of encrypting LDAP traffic. With this added support, the LDAP [Outpost](../../add-secure-apps/outposts/index.mdx) can now support multiple certificates. - LDAP Schema improvements @@ -90,7 +90,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2023.6 ## Fixed in 2023.6.2 -- \*: fix [CVE-2023-39522](../../security/cves/CVE-2023-39522.md), Reported by [@markrassamni](https://github.com/markrassamni) +- \*: fix [CVE-2023-39522](../../security/cves/CVE-2023-39522.mdx), Reported by [@markrassamni](https://github.com/markrassamni) ## API Changes diff --git a/website/docs/releases/2023/v2023.8.md b/website/docs/releases/2023/v2023.8.mdx similarity index 98% rename from website/docs/releases/2023/v2023.8.md rename to website/docs/releases/2023/v2023.8.mdx index 6dd8f8208c..584189df86 100644 --- a/website/docs/releases/2023/v2023.8.md +++ b/website/docs/releases/2023/v2023.8.mdx @@ -7,11 +7,11 @@ slug: "/releases/2023.8" - Removal of PostgreSQL 11 support - As announced in the [2023.5](./v2023.5.md) release notes (and postponed by a release), this release requires PostgreSQL 12 or newer. This is due to a changed requirement in a framework we use, Django. + As announced in the [2023.5](./v2023.5.mdx) release notes (and postponed by a release), this release requires PostgreSQL 12 or newer. This is due to a changed requirement in a framework we use, Django. This does not affect docker-compose installations (as these already ship with PostgreSQL 12), however it is still recommended to upgrade to a newer version when convenient. - For Kubernetes install, a manual one-time migration has to be done: [Upgrading PostgreSQL on Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.md) + For Kubernetes install, a manual one-time migration has to be done: [Upgrading PostgreSQL on Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.mdx) - Changed nested Group membership behavior @@ -33,7 +33,7 @@ slug: "/releases/2023.8" ## Upgrading -This release changes the PostgreSQL dependency to require Version 12 or later, which only affects Kubernetes installs. See [here](../../troubleshooting/postgres/upgrade_kubernetes.md) for more info on upgrading. +This release changes the PostgreSQL dependency to require Version 12 or later, which only affects Kubernetes installs. See [here](../../troubleshooting/postgres/upgrade_kubernetes.mdx) for more info on upgrading. ### docker-compose @@ -157,19 +157,19 @@ image: ## Fixed in 2023.8.4 -- security: fix [CVE-2023-46249](../../security/cves/CVE-2023-46249.md), Reported by [@devSparkle](https://github.com/devSparkle) +- security: fix [CVE-2023-46249](../../security/cves/CVE-2023-46249.mdx), Reported by [@devSparkle](https://github.com/devSparkle) ## Fixed in 2023.8.5 -- security: fix [CVE-2023-48228](../../security/cves/CVE-2023-48228.md), Reported by [@Sapd](https://github.com/Sapd) (#7666) +- security: fix [CVE-2023-48228](../../security/cves/CVE-2023-48228.mdx), Reported by [@Sapd](https://github.com/Sapd) (#7666) ## Fixed in 2023.8.6 -- providers/oauth2: fix [CVE-2024-21637](../../security/cves/CVE-2024-21637.md), Reported by [@lauritzh](https://github.com/lauritzh) (#8104) +- providers/oauth2: fix [CVE-2024-21637](../../security/cves/CVE-2024-21637.mdx), Reported by [@lauritzh](https://github.com/lauritzh) (#8104) ## Fixed in 2023.8.7 -- providers/oauth2: fix [CVE-2024-23647](../../security/cves/CVE-2024-23647.md) (cherry-pick #8345) (#8347) +- providers/oauth2: fix [CVE-2024-23647](../../security/cves/CVE-2024-23647.mdx) (cherry-pick #8345) (#8347) ## API Changes diff --git a/website/docs/releases/2024/v2024.10.md b/website/docs/releases/2024/v2024.10.mdx similarity index 99% rename from website/docs/releases/2024/v2024.10.md rename to website/docs/releases/2024/v2024.10.mdx index d37d8c1fe9..70120ac528 100644 --- a/website/docs/releases/2024/v2024.10.md +++ b/website/docs/releases/2024/v2024.10.mdx @@ -166,9 +166,9 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.10 - rbac: fix incorrect object_description for object-level permissions (cherry-pick #12029) (#12043) - root: check remote IP for proxy protocol same as HTTP/etc (cherry-pick #12094) (#12097) - root: fix activation of locale not being scoped (cherry-pick #12091) (#12096) -- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.md), reported by [@matt1097](https://github.com/matt1097) (#12117) -- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.md), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113) -- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.md), reported by [@mgerstner](https://github.com/mgerstner) (#12115) +- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.mdx), reported by [@matt1097](https://github.com/matt1097) (#12117) +- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.mdx), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113) +- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.mdx), reported by [@mgerstner](https://github.com/mgerstner) (#12115) - web/admin: better footer links (#12004) - web/flows: fix invisible captcha call (cherry-pick #12048) (#12049) - website/docs: add CSP to hardening (cherry-pick #11970) (#12116) diff --git a/website/docs/releases/2024/v2024.12.md b/website/docs/releases/2024/v2024.12.mdx similarity index 99% rename from website/docs/releases/2024/v2024.12.md rename to website/docs/releases/2024/v2024.12.mdx index 15fabaea24..b27fe1b8b1 100644 --- a/website/docs/releases/2024/v2024.12.md +++ b/website/docs/releases/2024/v2024.12.mdx @@ -42,7 +42,7 @@ slug: "/releases/2024.12" - **CloudFormation** :ak-preview - Deploy authentik in your own AWS environment with one click using our new [AWS CloudFormation template](../../install-config/install/aws.md). + Deploy authentik in your own AWS environment with one click using our new [AWS CloudFormation template](../../install-config/install/aws.mdx). - **OAuth2 provider federation** diff --git a/website/docs/releases/2024/v2024.2.md b/website/docs/releases/2024/v2024.2.mdx similarity index 99% rename from website/docs/releases/2024/v2024.2.md rename to website/docs/releases/2024/v2024.2.mdx index 1602ad2409..abe417bc0a 100644 --- a/website/docs/releases/2024/v2024.2.md +++ b/website/docs/releases/2024/v2024.2.mdx @@ -25,7 +25,7 @@ slug: /releases/2024.2 Blueprints using `authentik_tenants.tenant` will need to be changed to use `authentik_brands.brand`. - For more information, refer to the [documentation for _brands_](../../customize/branding/index.md). + For more information, refer to the [documentation for _brands_](../../customize/branding/index.mdx). Also, **the event retention settings configured in brands (previously tenants, see above) have been removed and are now a system setting**, managed in the Admin interface or via the API (see below). @@ -112,11 +112,11 @@ slug: /releases/2024.2 Sessions for any users can now be bound to a specific geolocation (Continent, Country, City) or network (Autonomous System, subnet, IP address). If the session is accessed from a location/network that is different than that from which it was initially created, the session will be terminated. - Configuration steps are available [here](../../add-secure-apps/flows-stages/stages/user_login/index.md#configuration-options). + Configuration steps are available [here](../../add-secure-apps/flows-stages/stages/user_login/index.mdx#configuration-options). - **S3 file storage** - Media files can be stored on S3. Follow the [setup guide](../../sys-mgmt/ops/storage-s3/index.md) to get started. + Media files can be stored on S3. Follow the [setup guide](../../sys-mgmt/ops/storage-s3/index.mdx) to get started. - **_Pretend user exists_ option for Identification stage** @@ -164,7 +164,7 @@ slug: /releases/2024.2 - **LDAP source: new command to check connectivity** - Examples on how to use are available [here](../../troubleshooting/ldap_source.md). + Examples on how to use are available [here](../../troubleshooting/ldap_source.mdx). --- @@ -347,8 +347,8 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.2 ## Fixed in 2024.2.4 -- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.md), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10238) -- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.md), reported by Stefan Zwanenburg (cherry-pick #10229) (#10235) +- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10238) +- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.mdx), reported by Stefan Zwanenburg (cherry-pick #10229) (#10235) ## API Changes diff --git a/website/docs/releases/2024/v2024.4.md b/website/docs/releases/2024/v2024.4.mdx similarity index 99% rename from website/docs/releases/2024/v2024.4.md rename to website/docs/releases/2024/v2024.4.mdx index 1af33bddeb..5443895193 100644 --- a/website/docs/releases/2024/v2024.4.md +++ b/website/docs/releases/2024/v2024.4.mdx @@ -30,19 +30,19 @@ slug: /releases/2024.4 The source stage allows for an inclusion of a source as part of a flow. This can be used to link a user to a source as part of their authentication/enrollment, or it can be used as an external multi-factor to provide device health attestation for example. - For details refer to [Source stage](../../add-secure-apps/flows-stages/stages/source/index.md) + For details refer to [Source stage](../../add-secure-apps/flows-stages/stages/source/index.mdx) - **SCIM Source** :ak-preview Provision users and groups in authentik using an SCIM API. - For details refer to [SCIM Source](../../users-sources/sources/protocols/scim/index.md) + For details refer to [SCIM Source](../../users-sources/sources/protocols/scim/index.mdx) - **Configurable WebAuthn device restrictions** Configure which types of WebAuthn devices can be used to enroll and validate for different authorization levels. - For details refer to [WebAuthn authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.md) + For details refer to [WebAuthn authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx) - **Revamped UI for log messages** @@ -56,7 +56,7 @@ slug: /releases/2024.4 When authentik is configured to federate with an LDAP source, upon authentication, authentik hashed the password and stored it in its own database. This allows authentication to function when LDAP is unreachable. Admins can now configure this behavior for when this is not desirable. - For details refer to [LDAP Source](../../users-sources/sources/protocols/ldap/index.md) + For details refer to [LDAP Source](../../users-sources/sources/protocols/ldap/index.mdx) - **Configurable app password token expiring** @@ -237,14 +237,14 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.4 ## Fixed in 2024.4.3 - core: fix source flow_manager not always appending save stage (cherry-pick #9659) (#9662) -- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.md), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10236) -- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.md), reported by Stefan Zwanenburg (cherry-pick #10229) (#10233) +- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10236) +- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.mdx), reported by Stefan Zwanenburg (cherry-pick #10229) (#10233) - sources/saml: fix FlowPlanner error due to pickle (cherry-pick #9708) (#9709) - web: fix value handling inside controlled components (cherry-pick #9648) (#9685) ## Fixed in 2024.4.4 -- security: fix [CVE-2024-42490](../../security/cves/CVE-2024-42490.md), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #11022) #11024 +- security: fix [CVE-2024-42490](../../security/cves/CVE-2024-42490.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #11022) #11024 ## API Changes diff --git a/website/docs/releases/2024/v2024.6.md b/website/docs/releases/2024/v2024.6.mdx similarity index 98% rename from website/docs/releases/2024/v2024.6.md rename to website/docs/releases/2024/v2024.6.mdx index 0902433651..bf34b54b1e 100644 --- a/website/docs/releases/2024/v2024.6.md +++ b/website/docs/releases/2024/v2024.6.mdx @@ -17,7 +17,7 @@ With this release, authentik now requires PostgreSQL version 14 or later. We rec The provided Helm chart defaults to PostgreSQL 15. If you are using the Helm chart with the default values, no action is required. -The provided Compose file was updated with PostgreSQL 16. You can follow the procedure [here](../../troubleshooting/postgres/upgrade_docker.md) to upgrade. +The provided Compose file was updated with PostgreSQL 16. You can follow the procedure [here](../../troubleshooting/postgres/upgrade_docker.mdx) to upgrade. ### Group names unicity @@ -33,13 +33,13 @@ The `context["geoip"]` and `context["asn"]` objects available in expression poli With the Google Workspace provider, authentik serves as the single source of truth for all users and groups, when using Google products like Gmail. - For details refer to the [Google Workspace Provider documentation](../../add-secure-apps/providers/gws/index.md) + For details refer to the [Google Workspace Provider documentation](../../add-secure-apps/providers/gws/index.mdx) - **Microsoft Entra ID Provider** :ak-enterprise :ak-preview With the Microsoft Entra ID provider, authentik serves as the single source of truth for all users and groups. Configuring Entra ID as a provider allows for auto-discovery of user and group accounts, on-going synchronization of user data such as email address, name, and status, and integrated data mapping of field names and values. - For details refer to the [Microsoft Entra ID documentation](../../add-secure-apps/providers/entra/index.md) + For details refer to the [Microsoft Entra ID documentation](../../add-secure-apps/providers/entra/index.mdx) - **Read-replica DB support** @@ -51,7 +51,7 @@ The `context["geoip"]` and `context["asn"]` objects available in expression poli Thresholds can now be configured on the CAPTCHA stage to customize its result. Additionally, the stage can be configured to continue the flow if the CAPTCHA score is outside of those thresholds for further decision making via expression policies. - For details refer to the [CAPTCHA stage](../../add-secure-apps/flows-stages/stages/captcha/index.md) + For details refer to the [CAPTCHA stage](../../add-secure-apps/flows-stages/stages/captcha/index.mdx) - **Optimize sync and property mapping execution** @@ -65,11 +65,11 @@ The `context["geoip"]` and `context["asn"]` objects available in expression poli - **Reworked proxy provider redirect** - Following-up on a [highly requested issue](https://github.com/goauthentik/authentik/issues/6886), we've reworked our [Proxy provider](../../add-secure-apps/providers/proxy/index.md) to avoid invalid user-facing redirects. + Following-up on a [highly requested issue](https://github.com/goauthentik/authentik/issues/6886), we've reworked our [Proxy provider](../../add-secure-apps/providers/proxy/index.mdx) to avoid invalid user-facing redirects. ## Upgrading -With this release, authentik now requires PostgreSQL version 14 or later. We recommend upgrading to the latest version if needed. Follow the instructions [here](../../troubleshooting/postgres/upgrade_docker.md) if you need to upgrade PostgreSQL with docker-compose. +With this release, authentik now requires PostgreSQL version 14 or later. We recommend upgrading to the latest version if needed. Follow the instructions [here](../../troubleshooting/postgres/upgrade_docker.mdx) if you need to upgrade PostgreSQL with docker-compose. ### Docker Compose @@ -151,8 +151,8 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.6 - root: handle asgi exception (#10085) - root: include task_id in events and logs (#9749) - root: use custom model serializer that saves m2m without bulk (cherry-pick #10139) (#10151) -- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.md), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10237) -- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.md), reported by Stefan Zwanenburg (cherry-pick #10229) (#10234) +- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10237) +- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.mdx), reported by Stefan Zwanenburg (cherry-pick #10229) (#10234) - sources/oauth: ensure all UI sources return a valid source (#9401) - sources/oauth: fix OAuth Client sending token request incorrectly (#9474) - sources/oauth: modernizes discord icon (#9817) @@ -233,12 +233,12 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.6 ## Fixed in 2024.6.4 -- security: fix [CVE-2024-42490](../../security/cves/CVE-2024-42490.md), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #11022) #11025 +- security: fix [CVE-2024-42490](../../security/cves/CVE-2024-42490.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #11022) #11025 ## Fixed in 2024.6.5 -- security: fix [CVE-2024-47070](../../security/cves/CVE-2024-47070.md), reported by [@efpi-bot](https://github.com/efpi-bot) from [LogicalTrust](https://logicaltrust.net/en/) (cherry-pick #11536) (#11540) -- security: fix [CVE-2024-47077](../../security/cves/CVE-2024-47077.md), reported by [@quentinmit](https://github.com/quentinmit) (cherry-pick #11535) (#11538) +- security: fix [CVE-2024-47070](../../security/cves/CVE-2024-47070.mdx), reported by [@efpi-bot](https://github.com/efpi-bot) from [LogicalTrust](https://logicaltrust.net/en/) (cherry-pick #11536) (#11540) +- security: fix [CVE-2024-47077](../../security/cves/CVE-2024-47077.mdx), reported by [@quentinmit](https://github.com/quentinmit) (cherry-pick #11535) (#11538) ## API Changes diff --git a/website/docs/releases/2024/v2024.8.md b/website/docs/releases/2024/v2024.8.mdx similarity index 99% rename from website/docs/releases/2024/v2024.8.md rename to website/docs/releases/2024/v2024.8.mdx index b55de98993..f639eb14a5 100644 --- a/website/docs/releases/2024/v2024.8.md +++ b/website/docs/releases/2024/v2024.8.mdx @@ -64,7 +64,7 @@ slug: "/releases/2024.8" - **Changes to the external user type** - Since the introduction of user types with [2023.8](../2023/v2023.8.md), the main difference between internal and external users has mostly been relevant when using the [Enterprise](../../enterprise/index.mdx) version of authentik. + Since the introduction of user types with [2023.8](../2023/v2023.8.mdx), the main difference between internal and external users has mostly been relevant when using the [Enterprise](../../enterprise/index.mdx) version of authentik. With this release, authentik improves support for B2C use-cases, which external users are intended for. It is now possible to configure a default application. External users _not_ attempting to access a specific application will always be redirected to this default application. @@ -81,7 +81,7 @@ slug: "/releases/2024.8" - **Source property mappings for SCIM, OAuth, SAML and Plex sources** - All source types now support property mappings to customize how authentik should interpret the data the source provides. In addition to that, it is also now possible to sync groups and group membership from sources that provide group information. See [Property Mappings](../../users-sources/sources/property-mappings/index.md). + All source types now support property mappings to customize how authentik should interpret the data the source provides. In addition to that, it is also now possible to sync groups and group membership from sources that provide group information. See [Property Mappings](../../users-sources/sources/property-mappings/index.mdx). - **RADIUS provider custom attribute support** @@ -89,11 +89,11 @@ slug: "/releases/2024.8" - **SAML encryption support** - It is now possible to configure SAML sources and providers to decrypt and validate encrypted assertions. This can be configured by creating a [Certificate-keypair](../../sys-mgmt/certificates.md) and selecting it in the SAML source or provider. + It is now possible to configure SAML sources and providers to decrypt and validate encrypted assertions. This can be configured by creating a [Certificate-keypair](../../sys-mgmt/certificates.mdx) and selecting it in the SAML source or provider. - **GeoIP Policy** - With the new [GeoIP Policy](../../customize/policies/types/geoip.md) it is possible to grant/deny access based on Country and ASN, without having to write an expression policy. + With the new [GeoIP Policy](../../customize/policies/types/geoip.mdx) it is possible to grant/deny access based on Country and ASN, without having to write an expression policy. - **Simplification of LDAP Provider permissions** @@ -109,7 +109,7 @@ slug: "/releases/2024.8" - **WebFinger support** - With the addition of the [default application](../../customize/branding/index.md#external-user-settings) setting, when the default application uses an OIDC provider, a WebFinger endpoint is available now. + With the addition of the [default application](../../customize/branding/index.mdx#external-user-settings) setting, when the default application uses an OIDC provider, a WebFinger endpoint is available now. ## Upgrading @@ -279,8 +279,8 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.8 - events: always use expiry from current tenant for events, not only when creating from HTTP request (cherry-pick #11415) (#11416) - providers/proxy: fix traefik label generation (cherry-pick #11460) (#11480) -- security: [CVE-2024-47070](../../security/cves/CVE-2024-47070.md), reported by [@efpi-bot](https://github.com/efpi-bot) from [LogicalTrust](https://logicaltrust.net/en/) (cherry-pick #11536) (#11539) -- security: [CVE-2024-47077](../../security/cves/CVE-2024-47077.md), reported by [@quentinmit](https://github.com/quentinmit) (cherry-pick #11535) (#11537) +- security: [CVE-2024-47070](../../security/cves/CVE-2024-47070.mdx), reported by [@efpi-bot](https://github.com/efpi-bot) from [LogicalTrust](https://logicaltrust.net/en/) (cherry-pick #11536) (#11539) +- security: [CVE-2024-47077](../../security/cves/CVE-2024-47077.mdx), reported by [@quentinmit](https://github.com/quentinmit) (cherry-pick #11535) (#11537) - sources/ldap: fix mapping check, fix debug endpoint (cherry-pick #11442) (#11498) - sources/ldap: fix ms_ad userAccountControl not checking for lockout (cherry-pick #11532) (#11534) - web: Fix missing integrity fields in package-lock.json (#11509) @@ -302,9 +302,9 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.8 ## Fixed in 2024.8.5 -- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.md), reported by [@matt1097](https://github.com/matt1097) (#12114) -- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.md), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113) -- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.md), reported by [@mgerstner](https://github.com/mgerstner) (#12115) +- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.mdx), reported by [@matt1097](https://github.com/matt1097) (#12114) +- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.mdx), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113) +- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.mdx), reported by [@mgerstner](https://github.com/mgerstner) (#12115) - web/admin: better footer links (#12004) - web: bump API Client version (#12118) diff --git a/website/docs/releases/2025/v2025.10.md b/website/docs/releases/2025/v2025.10.mdx similarity index 99% rename from website/docs/releases/2025/v2025.10.md rename to website/docs/releases/2025/v2025.10.mdx index 4cd9d3810b..cb661807dd 100644 --- a/website/docs/releases/2025/v2025.10.md +++ b/website/docs/releases/2025/v2025.10.mdx @@ -37,11 +37,11 @@ SCIM providers can now use OAuth sources to authenticate to SCIM endpoints. This This is supported by applications such as Slack and Salesforce. -See [SCIM Provider documentation](../../add-secure-apps/providers/scim/index.md) for more details. +See [SCIM Provider documentation](../../add-secure-apps/providers/scim/index.mdx) for more details. ### RADIUS EAP-TLS support :ak-enterprise -The RADIUS outpost can now support EAP-TLS which allows for client authentication using certificates with the [Mutual TLS stage](../../add-secure-apps/flows-stages/stages/mtls/index.md). +The RADIUS outpost can now support EAP-TLS which allows for client authentication using certificates with the [Mutual TLS stage](../../add-secure-apps/flows-stages/stages/mtls/index.mdx). See [RADIUS Provider documentation](../../add-secure-apps/providers/radius/index.mdx). @@ -49,13 +49,13 @@ See [RADIUS Provider documentation](../../add-secure-apps/providers/radius/index In [2025.8](v2025.8.mdx) we've introduced support for back-channel logout in the OAuth2 Provider. This release adds support for front-channel logout in the OAuth2 Provider and both back- and front-channel logout support in the SAML Provider. -See [OAuth2 Provider documentation](../../add-secure-apps/providers/oauth2/index.mdx) and [SAML Provider documentation](../../add-secure-apps/providers/saml/index.md). +See [OAuth2 Provider documentation](../../add-secure-apps/providers/oauth2/index.mdx) and [SAML Provider documentation](../../add-secure-apps/providers/saml/index.mdx). ### Telegram source Being one of the most upvoted GitHub issues, we've finally done it. Telegram can now be used as a federated identity provider in authentik. This allows users to authenticate with their Telegram credentials. -See [Telegram Source documentation](../../users-sources/sources/social-logins/telegram/index.md). +See [Telegram Source documentation](../../users-sources/sources/social-logins/telegram/index.mdx). ### Refined flow and user library @@ -71,7 +71,7 @@ The user library has improved scaling and makes better use of space with a highe - Add `ak_send_email`: Allow for easier sending of emails in expressions; see [ak_send_email](../../customize/policies/types/expression/reference.mdx). - Change recovery token duration: When using `ak create_recovery_key`, the duration is now set in minutes instead of years. - Add OIDC `ui_locales` support: The OAuth2 provider now accepts `ui_locales` to set the locale of authentik. -- Add support for separate labels and values in prompt choice inputs, see [Prompt stage documentation](../../add-secure-apps/flows-stages/stages/prompt/index.md); thanks to @ErikAhlund! +- Add support for separate labels and values in prompt choice inputs, see [Prompt stage documentation](../../add-secure-apps/flows-stages/stages/prompt/index.mdx); thanks to @ErikAhlund! ## New integration guides @@ -435,9 +435,9 @@ If you had persistence for Redis configured, you can delete the PVC and PV after - providers/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.10) (#19982) - recovery: consume token in transaction (cherry-pick #19967 to version-2025.10) (#19981) - root: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10) (#19933) -- security: [CVE-2026-25227](../../security/cves/CVE-2026-25227.md) (#20227) -- security: [CVE-2026-25748](../../security/cves/CVE-2026-25748.md) (#20228) -- security: [CVE-2026-25922](../../security/cves/CVE-2026-25922.md) (#20229) +- security: [CVE-2026-25227](../../security/cves/CVE-2026-25227.mdx) (#20227) +- security: [CVE-2026-25748](../../security/cves/CVE-2026-25748.mdx) (#20228) +- security: [CVE-2026-25922](../../security/cves/CVE-2026-25922.mdx) (#20229) - web/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10) (#18988) - web/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10) (#19292) - web/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10) (#18986) diff --git a/website/docs/releases/2025/v2025.12.md b/website/docs/releases/2025/v2025.12.mdx similarity index 99% rename from website/docs/releases/2025/v2025.12.md rename to website/docs/releases/2025/v2025.12.mdx index 187ac34a44..202ea847a9 100644 --- a/website/docs/releases/2025/v2025.12.md +++ b/website/docs/releases/2025/v2025.12.mdx @@ -84,7 +84,7 @@ Currently, only the authentik Agent connector is supported. Connectors to fetch authentik now allows you to export user and event data in CSV format for backup or analysis purposes. The exported content matches that returned by the API endpoints for the respective object types. You can access past data exports from **System Management** > **Data Exports**, where you can view the query used for each export, search by data type and user, download completed exports, and delete exports you no longer need. -See [Data Exports documentation](../../sys-mgmt/data-exports.md) for more details. +See [Data Exports documentation](../../sys-mgmt/data-exports.mdx) for more details. ### Passkey Autofill (WebAuthn Conditional UI) @@ -104,7 +104,7 @@ If you currently have user permissions defined, they will be migrated to the rol authentik now provides a centralized file management system for storing and organizing image files used throughout the platform. This includes application icons, source icons, and branding assets such as logos, favicons, and flow background images. Files can be uploaded and managed from **Customization** > **Files** in the Admin interface. By default, files are stored on disk, but S3 storage can also be configured. -See [Files documentation](../../customize/files.md) for more details. +See [Files documentation](../../customize/files.mdx) for more details. ### UI improvements on mobile and tablet devices diff --git a/website/docs/releases/2025/v2025.2.md b/website/docs/releases/2025/v2025.2.mdx similarity index 99% rename from website/docs/releases/2025/v2025.2.md rename to website/docs/releases/2025/v2025.2.mdx index 938211b824..9e073c4d12 100644 --- a/website/docs/releases/2025/v2025.2.md +++ b/website/docs/releases/2025/v2025.2.mdx @@ -31,7 +31,7 @@ slug: "/releases/2025.2" - **SSF Provider** :ak-enterprise :ak-preview - [Shared Signals Framework](../../add-secure-apps/providers/ssf/index.md) allows applications to register a stream with authentik through which they can receive events from authentik, such as when a session is revoked or a credential is added, changed, or deleted, and execute actions based on these events. + [Shared Signals Framework](../../add-secure-apps/providers/ssf/index.mdx) allows applications to register a stream with authentik through which they can receive events from authentik, such as when a session is revoked or a credential is added, changed, or deleted, and execute actions based on these events. Using an SSF provider as a backchannel provider allows admins to integrate authentik with Apple Business Manager for federated Apple IDs. @@ -43,13 +43,13 @@ slug: "/releases/2025.2" Add the ability to check for the distance a user has moved compared to a previous login, and add the option to check impossible travel distances based on client IP. - These options can be used to detect and prevent access from potentially stolen authentik sessions or stolen devices. Refer to our [documentation](../../customize/policies/types/geoip.md). + These options can be used to detect and prevent access from potentially stolen authentik sessions or stolen devices. Refer to our [documentation](../../customize/policies/types/geoip.mdx). - **Email OTP Authenticator Setup Stage** Admins now have the ability to configure the option for users to use their email address as an authenticator. Users that already have an email address set on their account will be able to use that address to receive one-time-passwords. It is also possible to configure authentik to allow users to add additional email addresses as authenticators. - See [Email Authenticator Setup Stage](../../add-secure-apps/flows-stages/stages/authenticator_email/index.md). + See [Email Authenticator Setup Stage](../../add-secure-apps/flows-stages/stages/authenticator_email/index.mdx). - **Application Wizard is the default way to create applications** @@ -61,7 +61,7 @@ slug: "/releases/2025.2" - **Improved debugging experience** - For people developing authentik or building very complex, custom integrations, how to configure debugging in authentik is documented [here](../../developer-docs/setup/debugging.md). + For people developing authentik or building very complex, custom integrations, how to configure debugging in authentik is documented [here](../../developer-docs/setup/debugging.mdx). ## Upgrading diff --git a/website/docs/releases/2025/v2025.4.md b/website/docs/releases/2025/v2025.4.mdx similarity index 99% rename from website/docs/releases/2025/v2025.4.md rename to website/docs/releases/2025/v2025.4.mdx index 19b552ccb8..ca76228407 100644 --- a/website/docs/releases/2025/v2025.4.md +++ b/website/docs/releases/2025/v2025.4.mdx @@ -38,7 +38,7 @@ For this release: For the next release: - The Redis chart will be upgraded to the latest version again. -- The PostgreSQL chart will be upgraded to the latest version again, and the image will no longer be pinned, which will bring it to PostgreSQL major version `17`. This will require following PostgreSQL major upgrade steps, for which we provide [documentation](../../troubleshooting/postgres/upgrade_kubernetes.md). +- The PostgreSQL chart will be upgraded to the latest version again, and the image will no longer be pinned, which will bring it to PostgreSQL major version `17`. This will require following PostgreSQL major upgrade steps, for which we provide [documentation](../../troubleshooting/postgres/upgrade_kubernetes.mdx). For subsequent releases: @@ -55,7 +55,7 @@ Previously, sessions were stored by default in the cache. Now, they are stored i ## New features -- **Remember me**: Users can now choose to skip entering their usernames after their first login on the same device. This feature is optional and admins can enable it in the [Identification stage](../../add-secure-apps/flows-stages/stages/identification/index.md). +- **Remember me**: Users can now choose to skip entering their usernames after their first login on the same device. This feature is optional and admins can enable it in the [Identification stage](../../add-secure-apps/flows-stages/stages/identification/index.mdx). - **RBAC: Initial Permissions** @@ -67,15 +67,15 @@ Previously, sessions were stored by default in the cache. Now, they are stored i -- **Password History Policy**: See [description](#highlights) under Highlights. Refer to our [documentation](../../customize/policies/types/password-uniqueness.md). +- **Password History Policy**: See [description](#highlights) under Highlights. Refer to our [documentation](../../customize/policies/types/password-uniqueness.mdx). -- **Improve membership resolution for the LDAP Source**: See [description](#highlights) under Highlights. Refer to our [documentation](../../users-sources/sources/directory-sync/active-directory/index.md). +- **Improve membership resolution for the LDAP Source**: See [description](#highlights) under Highlights. Refer to our [documentation](../../users-sources/sources/directory-sync/active-directory/index.mdx). - **Provider Sync Dry Run**: See [description](#highlights) under Highlights. - **Gateway API support** :ak-preview - For Kubernetes users, authentik now supports the Gateway API. The Helm chart supports HTTPRoute. The Kubernetes outpost integrations supports creating HTTPRoute objects for Proxy providers. Refer to our [documentation](../../add-secure-apps/outposts/integrations/kubernetes.md). + For Kubernetes users, authentik now supports the Gateway API. The Helm chart supports HTTPRoute. The Kubernetes outpost integrations supports creating HTTPRoute objects for Proxy providers. Refer to our [documentation](../../add-secure-apps/outposts/integrations/kubernetes.mdx). ## New integration guides diff --git a/website/docs/releases/2025/v2025.6.md b/website/docs/releases/2025/v2025.6.mdx similarity index 99% rename from website/docs/releases/2025/v2025.6.md rename to website/docs/releases/2025/v2025.6.mdx index 15ba5de8b9..8570413903 100644 --- a/website/docs/releases/2025/v2025.6.md +++ b/website/docs/releases/2025/v2025.6.mdx @@ -14,7 +14,7 @@ slug: "/releases/2025.6" ## Breaking changes - **Helm chart dependencies upgrades**: - - The PostgreSQL chart has been updated to version 16.7.4. The PostgreSQL image is no longer pinned in authentik's default values and has been upgraded from version 15 to 17. Follow our [PostgreSQL upgrade instructions](../../troubleshooting/postgres/upgrade_kubernetes.md) to update to the latest PostgreSQL version. + - The PostgreSQL chart has been updated to version 16.7.4. The PostgreSQL image is no longer pinned in authentik's default values and has been upgraded from version 15 to 17. Follow our [PostgreSQL upgrade instructions](../../troubleshooting/postgres/upgrade_kubernetes.mdx) to update to the latest PostgreSQL version. - The Redis chart has been updated to version 21.1.6. There are no breaking changes and Redis has been upgraded from version 7 to 8. - **Deprecated and frozen `:latest` container image tag after 2025.2** @@ -25,9 +25,9 @@ slug: "/releases/2025.6" ## New features and improvements -- **mTLS stage**: :ak-enterprise The Mutual TLS stage enables authentik to use client certificates to enroll and authenticate users. These certificates can be local to the device or available via PIV Smart Cards, Yubikeys, etc. For environments where certificates are already rolled out, this can make authentication a lot more seamless. Refer to our [technical documentation](../../add-secure-apps/flows-stages/stages/mtls/index.md) for more information. +- **mTLS stage**: :ak-enterprise The Mutual TLS stage enables authentik to use client certificates to enroll and authenticate users. These certificates can be local to the device or available via PIV Smart Cards, Yubikeys, etc. For environments where certificates are already rolled out, this can make authentication a lot more seamless. Refer to our [technical documentation](../../add-secure-apps/flows-stages/stages/mtls/index.mdx) for more information. - **Email verification compatibility with link scanners**: We have improved compatibility for environments with automated scanning software that inadvertently invalidated one-time links sent by authentik. -- **LDAP source sync forward deletions**: With this option enabled, users or groups created in authentik via LDAP sources will also be removed from authentik if they are deleted from the LDAP source. For more information, please refer to our [LDAP source documentation](../../users-sources/sources/protocols/ldap/index.md). +- **LDAP source sync forward deletions**: With this option enabled, users or groups created in authentik via LDAP sources will also be removed from authentik if they are deleted from the LDAP source. For more information, please refer to our [LDAP source documentation](../../users-sources/sources/protocols/ldap/index.mdx). - **Provider sync performance**: We have implemented parallel scheduling for outgoing syncs to provide faster synchronization. - **Branding**: Custom branding should now be more consistent on initial load, without flickering. - **Remote Access Control (RAC) improved [documentation](https://docs.goauthentik.io/docs/add-secure-apps/providers/rac/)**: Added content about how to authenticate using a public key and improved the wording and formatting throughout the topic. diff --git a/website/docs/releases/2025/v2025.8.mdx b/website/docs/releases/2025/v2025.8.mdx index 8e46890eb6..a584d2b65d 100644 --- a/website/docs/releases/2025/v2025.8.mdx +++ b/website/docs/releases/2025/v2025.8.mdx @@ -19,7 +19,7 @@ slug: "/releases/2025.8" ### Worker and background tasks revamped -The authentik [worker](../../sys-mgmt/ops/worker.md) and [background tasks](../../sys-mgmt/background-tasks.md) have been reworked for better observability of tasks, and better configurability of scheduled tasks. +The authentik [worker](../../sys-mgmt/ops/worker.mdx) and [background tasks](../../sys-mgmt/background-tasks.mdx) have been reworked for better observability of tasks, and better configurability of scheduled tasks. This rework also allowed us to not depend on Redis for background tasks. However, we replaced the engine used to manage these tasks, and as such, don't have a seamless migration path. @@ -130,7 +130,7 @@ Due to [Bitnami upcoming changes](https://github.com/bitnami/containers/issues/8 Redis has also been updated from 8.0 to 8.2. -From this point on, we recommend using the bundled PostgreSQL dependency for demonstration and test purposes only. See our [installation documentation](../../install-config/install/kubernetes.md) for alternatives to run PostgreSQL in a production environment. +From this point on, we recommend using the bundled PostgreSQL dependency for demonstration and test purposes only. See our [installation documentation](../../install-config/install/kubernetes.mdx) for alternatives to run PostgreSQL in a production environment. ## New features and improvements @@ -139,7 +139,7 @@ From this point on, we recommend using the bundled PostgreSQL dependency for dem - LDAP connections are now terminated upon session deletion in authentik. - **Accessibility improvements**: Better screen reader support within the admin interface for navigation, forms, and wizard elements. -- **Send event notifications to associated user**: Configure notification rules to send the event notification to the user associated to the event. Read more in our [notifications documentation](../../sys-mgmt/events/notifications.md). +- **Send event notifications to associated user**: Configure notification rules to send the event notification to the user associated to the event. Read more in our [notifications documentation](../../sys-mgmt/events/notifications.mdx). - **Policy bindings performance improvements**: Policy bindings evaluation avoids forking new processes for user and group policy bindings. - **SCIM Source patch support**: Add full patch support for all properties of users and groups. - **Secret inputs in the admin interface are now hidden by default**. @@ -435,9 +435,9 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.8 ## Fixed in 2025.8.6 - root: update client-go generation (cherry-pick #19762 and #19906 to version-2025.8) (#19934) -- security: [CVE-2026-25227](../../security/cves/CVE-2026-25227.md) (#20233) -- security: [CVE-2026-25748](../../security/cves/CVE-2026-25748.md) (#20234) -- security: [CVE-2026-25922](../../security/cves/CVE-2026-25922.md) (#20235) +- security: [CVE-2026-25227](../../security/cves/CVE-2026-25227.mdx) (#20233) +- security: [CVE-2026-25748](../../security/cves/CVE-2026-25748.mdx) (#20234) +- security: [CVE-2026-25922](../../security/cves/CVE-2026-25922.mdx) (#20235) ## API Changes diff --git a/website/docs/releases/2026/v2026.11.md b/website/docs/releases/2026/v2026.11.mdx similarity index 100% rename from website/docs/releases/2026/v2026.11.md rename to website/docs/releases/2026/v2026.11.mdx diff --git a/website/docs/releases/2026/v2026.2.md b/website/docs/releases/2026/v2026.2.mdx similarity index 99% rename from website/docs/releases/2026/v2026.2.md rename to website/docs/releases/2026/v2026.2.mdx index 247f751cc0..86822e5c9a 100644 --- a/website/docs/releases/2026/v2026.2.md +++ b/website/docs/releases/2026/v2026.2.mdx @@ -27,19 +27,19 @@ Users will now be filtered based on the policies bound to the application the SC ### Object lifecycle management :ak-enterprise :ak-preview -[Object Lifecycle Management](../../sys-mgmt/object-lifecycle-management.md) allows Admins to schedule and track periodic reviews for Applications, Groups, and Roles. Reviewing access privileges to specific applications is an important best practice, as is reviewing other settings such as your branding settings, group and role membership, application entitlements, and current policy bindings. +[Object Lifecycle Management](../../sys-mgmt/object-lifecycle-management.mdx) allows Admins to schedule and track periodic reviews for Applications, Groups, and Roles. Reviewing access privileges to specific applications is an important best practice, as is reviewing other settings such as your branding settings, group and role membership, application entitlements, and current policy bindings. ### WS-Federation :ak-enterprise We now have a provider to integrate authentik with applications and service providers that use the [WS-Fed protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adfsod/204de335-ea34-4f9b-ae73-8b7d4c8152d1). WS-Federation is an XML-based identity federation protocol that uses token exchange for federated Single Sign-On (SSO) and IdP authentication, specifically for Windows applications such as Sharepoint. Note that we only support the SAML2 token type within WS-Federation providers, and that using the WS-Fed provider with Entra ID is not supported because Entra ID requires a SAML 1.0 token. -For details refer to our [WS-Federation provider documentation](../../add-secure-apps/providers/wsfed/index.md). +For details refer to our [WS-Federation provider documentation](../../add-secure-apps/providers/wsfed/index.mdx). ### Endpoints and authentik agent :ak-enterprise -Endpoints now has a [Fleet connector](../../endpoint-devices/device-compliance/connectors/fleetdm.md) integration. You can now pull device facts and signals data from [Fleet](https://fleetdm.com/) into authentik to implement Conditional Access rules. +Endpoints now has a [Fleet connector](../../endpoint-devices/device-compliance/connectors/fleetdm.mdx) integration. You can now pull device facts and signals data from [Fleet](https://fleetdm.com/) into authentik to implement Conditional Access rules. -[Local Device Login](../../endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.md) now works on Linux too and also supports webauthn/FIDO2. +[Local Device Login](../../endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.mdx) now works on Linux too and also supports webauthn/FIDO2. ### Certificate builder diff --git a/website/docs/releases/2026/v2026.5.md b/website/docs/releases/2026/v2026.5.mdx similarity index 99% rename from website/docs/releases/2026/v2026.5.md rename to website/docs/releases/2026/v2026.5.mdx index 9361b39710..df62574b84 100644 --- a/website/docs/releases/2026/v2026.5.md +++ b/website/docs/releases/2026/v2026.5.mdx @@ -29,15 +29,15 @@ Account Lockdown gives administrators and users a panic button to secure an acco A lockdown can deactivate the account, invalidate the local authentik password, terminate active sessions, revoke API/app/recovery/verification/OAuth tokens and grants, and record the reason in the audit log. authentik includes a packaged blueprint with warnings, reason collection, and completion messages so teams can get started quickly and customize the experience where needed. -For setup details, refer to the [Account Lockdown documentation](../../security/account-lockdown.md). +For setup details, refer to the [Account Lockdown documentation](../../security/account-lockdown.mdx). ### Conditional access :ak-enterprise We've added two new connectors that verify device compliance and let you use them as a signal in conditional access flows. -**Fleet**: authentik can now verify user devices based on their Fleet certificates without requiring the authentik agent, using the Fleet Connector together with an mTLS stage. For details, refer to the [Fleet Conditional Access documentation](../../endpoint-devices/device-compliance/fleet-conditional-access.md). +**Fleet**: authentik can now verify user devices based on their Fleet certificates without requiring the authentik agent, using the Fleet Connector together with an mTLS stage. For details, refer to the [Fleet Conditional Access documentation](../../endpoint-devices/device-compliance/fleet-conditional-access.mdx). -**Google Chrome**: authentik now includes a [Google Device Trust connector](../../endpoint-devices/device-compliance/connectors/google-chrome.md) that integrates with Chrome Enterprise Device Trust via the Chrome Verified Access API. This lets authentik validate that a user's Chrome browser or ChromeOS device is compliant — for example, running an up-to-date version with security patches applied. The connector is especially useful for BYOD environments and remote workforces where device compliance can't be assumed. +**Google Chrome**: authentik now includes a [Google Device Trust connector](../../endpoint-devices/device-compliance/connectors/google-chrome.mdx) that integrates with Chrome Enterprise Device Trust via the Chrome Verified Access API. This lets authentik validate that a user's Chrome browser or ChromeOS device is compliant — for example, running an up-to-date version with security patches applied. The connector is especially useful for BYOD environments and remote workforces where device compliance can't be assumed. ### Tap-to-login Secure Enclave support :ak-enterprise @@ -45,7 +45,7 @@ We've added two new connectors that verify device compliance and let you use the ### 2FA attempt throttling -The [Authenticator Validation stage](../../add-secure-apps/flows-stages/stages/authenticator_validate/index.md) can now throttle repeated failed attempts for email and SMS OTP devices, extending the same brute-force protection already available for TOTP and static authenticators. Admins can tune throttling behavior to slow down repeated guessing attempts without changing the user's login flow. +The [Authenticator Validation stage](../../add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx) can now throttle repeated failed attempts for email and SMS OTP devices, extending the same brute-force protection already available for TOTP and static authenticators. Admins can tune throttling behavior to slow down repeated guessing attempts without changing the user's login flow. ### Import hashed passwords diff --git a/website/docs/releases/2026/v2026.8.md b/website/docs/releases/2026/v2026.8.mdx similarity index 98% rename from website/docs/releases/2026/v2026.8.md rename to website/docs/releases/2026/v2026.8.mdx index 237cf272ac..9197a2b4cf 100644 --- a/website/docs/releases/2026/v2026.8.md +++ b/website/docs/releases/2026/v2026.8.mdx @@ -31,7 +31,7 @@ echo "$PASSWORD" | docker compose run --rm server hash_password ### "Prevent duplicate device" in WebAuthn setup stage removed -The **Prevent duplicate devices** option of the [WebAuthn authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.md) has been removed. It compared attestation certificates, which manufacturers deliberately share across entire production batches, so it rejected legitimate enrollments of a second security key bought at the same time as the first. The option was disabled by default in 2026.5.4 and is now gone; no configuration is required to replace it, and no action is needed when upgrading. +The **Prevent duplicate devices** option of the [WebAuthn authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx) has been removed. It compared attestation certificates, which manufacturers deliberately share across entire production batches, so it rejected legitimate enrollments of a second security key bought at the same time as the first. The option was disabled by default in 2026.5.4 and is now gone; no configuration is required to replace it, and no action is needed when upgrading. ## New features and improvements @@ -47,19 +47,19 @@ For more details, refer to the [access requests documentation](../../add-secure- authentik now supports "Agent" service accounts that act on behalf of a parent user when accessing the authentik API. Agents are designed for automation, integrations, and other machine identities that need delegated access while preserving a clear link to the user they represent. Administrators can control how agents inherit policy access, set expiration rules, manage them through the API, and trace their activity through audit events. Users can optionally create agent accounts via the user interface. -For more details, refer to the [agent accounts documentation](../../users-sources/user/account-types/agent-accounts.md). +For more details, refer to the [agent accounts documentation](../../users-sources/user/account-types/agent-accounts.mdx). ### User switching Users can now keep multiple authentik accounts signed in within the same browser and switch between them from the account menu in the User interface. They can also add another account without signing out of their current accounts. -Administrators enable the feature by selecting a **User switch flow** for the brand. Because this is a normal authentik flow, policies can control whether a switch requires a password, MFA, or a shorter verification process. Successful switches are recorded in the event log. For configuration details, refer to the [user switching documentation](../../users-sources/user/user-switching.md). +Administrators enable the feature by selecting a **User switch flow** for the brand. Because this is a normal authentik flow, policies can control whether a switch requires a password, MFA, or a shorter verification process. Successful switches are recorded in the event log. For configuration details, refer to the [user switching documentation](../../users-sources/user/user-switching.mdx). ### Scheduled user offboarding :ak-enterprise Administrators can schedule a user for deactivation or deletion at a specific date and time, with the option to revoke the user's sessions and tokens. -Scheduled offboardings can be reviewed or canceled before they run. authentik retries failed actions and records the result in the event log, providing a clear history of who scheduled the offboarding and which actions were selected. For more details, refer to the [user offboarding documentation](../../sys-mgmt/user-offboarding.md). +Scheduled offboardings can be reviewed or canceled before they run. authentik retries failed actions and records the result in the event log, providing a clear history of who scheduled the offboarding and which actions were selected. For more details, refer to the [user offboarding documentation](../../sys-mgmt/user-offboarding.mdx). ### Object attributes @@ -73,7 +73,7 @@ authentik also includes definitions for common identity, contact, address, Unix, The events map now uses a basemap bundled with authentik and does not make external requests by default, making it suitable for air-gapped and restricted-network deployments. Nearby events are grouped together, with columns showing the event volume and the types of events recorded in each area. -Users can select an area to filter the event list, and each brand can use the bundled map or configure a self-hosted map under **Map tiles**. For more details, refer to the [events documentation](../../sys-mgmt/events/index.md). +Users can select an area to filter the event list, and each brand can use the bundled map or configure a self-hosted map under **Map tiles**. For more details, refer to the [events documentation](../../sys-mgmt/events/index.mdx). ### OAuth 2.0 and OpenID Connect @@ -83,7 +83,7 @@ As of 2026.8, authentik is officially **OpenID Certified™** by the OpenID Foun #### Token exchange -[OAuth 2.0 token exchange](../../add-secure-apps/providers/oauth2/token_exchange.md) allows applications to exchange a token from a trusted provider or source for an authentik access token representing the same user. This makes it easier for connected services to act on a user's behalf without sharing the original token between services. +[OAuth 2.0 token exchange](../../add-secure-apps/providers/oauth2/token_exchange.mdx) allows applications to exchange a token from a trusted provider or source for an authentik access token representing the same user. This makes it easier for connected services to act on a user's behalf without sharing the original token between services. Token exchange is disabled by default and can be enabled under the provider's **Grant Types** setting. Trusted providers and sources are configured using the existing JWT federation settings. @@ -91,7 +91,7 @@ Token exchange is disabled by default and can be enabled under the provider's ** authentik now supports RFC 8693 delegation. Clients can supply an authentik Actor token using `actor_token` and `actor_token_type` to receive a token that identifies both the user and the Actor acting on the user's behalf through the `act` claim. This enables services and agents to preserve user context while making delegated requests. -For more information, refer to the [OBO documentation](../../add-secure-apps/providers/oauth2/token_exchange.md#exchange-a-token-on-behalf-of-a-user-obo). +For more information, refer to the [OBO documentation](../../add-secure-apps/providers/oauth2/token_exchange.mdx#exchange-a-token-on-behalf-of-a-user-obo). #### Dynamic client registration @@ -105,15 +105,15 @@ OpenID Connect providers can now issue key-bound ID tokens. These tokens require ### Nested LDAP group synchronization -LDAP sources can now preserve the source directory's nested group hierarchy in authentik. Enable **Sync Group Parents** to create parent relationships between synchronized groups. For configuration details, refer to the [LDAP source documentation](../../users-sources/sources/protocols/ldap/index.md#additional-settings). +LDAP sources can now preserve the source directory's nested group hierarchy in authentik. Enable **Sync Group Parents** to create parent relationships between synchronized groups. For configuration details, refer to the [LDAP source documentation](../../users-sources/sources/protocols/ldap/index.mdx#additional-settings). ### Expiring policy bindings -[Policy, group, and user bindings](../../customize/policies/bindings.md) can now have an expiration date and time. An expired binding no longer grants access or contributes a successful policy result, which makes temporary application, flow, and stage access possible without requiring an administrator to remove the binding later. +[Policy, group, and user bindings](../../customize/policies/bindings.mdx) can now have an expiration date and time. An expired binding no longer grants access or contributes a successful policy result, which makes temporary application, flow, and stage access possible without requiring an administrator to remove the binding later. ### Base URL system setting -authentik now has a **Base URL** [system setting](../../sys-mgmt/settings.md) that records the external URL where the instance is available. It can be configured under **System** > **Settings**, through the API, or with [`AUTHENTIK_WEB__BASE_URL`](../../install-config/configuration/configuration.mdx#authentik_web__base_url) during installation. +authentik now has a **Base URL** [system setting](../../sys-mgmt/settings.mdx) that records the external URL where the instance is available. It can be configured under **System** > **Settings**, through the API, or with [`AUTHENTIK_WEB__BASE_URL`](../../install-config/configuration/configuration.mdx#authentik_web__base_url) during installation. Enter only the scheme and host, even if authentik is served under a subpath. This setting will become required starting with authentik 2026.11, so we recommend configuring it now. @@ -135,7 +135,7 @@ A task can log an error and still finish, for example a sync that failed for a s - **Application Dashboard**: Users can switch between the existing card grid and a new compact list view. The selected view is remembered in the browser. - **AKQL**: Queries against JSON fields now match numeric and Boolean values in addition to strings. -- **CAPTCHA providers**: The [Captcha stage](../../add-secure-apps/flows-stages/stages/captcha/index.md) now supports JSON verification requests and the self-hostable Cap CAPTCHA provider. +- **CAPTCHA providers**: The [Captcha stage](../../add-secure-apps/flows-stages/stages/captcha/index.mdx) now supports JSON verification requests and the self-hostable Cap CAPTCHA provider. - **GitLab SCIM**: SCIM providers now include a compatibility mode for GitLab. - **OAuth and OpenID Connect**: Providers can sign with Ed448 keys, OAuth sources can store longer authorization URLs, and Twitter sources can retrieve a user's email address. - **SAML providers**: Authentication requests that set `ForceAuthn` now require fresh authentication. diff --git a/website/docs/releases/_template.md b/website/docs/releases/_template.mdx similarity index 100% rename from website/docs/releases/_template.md rename to website/docs/releases/_template.mdx diff --git a/website/docs/releases/old/v0.10.md b/website/docs/releases/old/v0.10.mdx similarity index 97% rename from website/docs/releases/old/v0.10.md rename to website/docs/releases/old/v0.10.mdx index 5994a66ee8..5a44ab7840 100644 --- a/website/docs/releases/old/v0.10.md +++ b/website/docs/releases/old/v0.10.mdx @@ -13,7 +13,7 @@ This update brings a lot of big features, such as: Due to this new OAuth2 Provider, the Application Gateway Provider, now simply called "Proxy Provider" has been revamped as well. The new authentik Proxy integrates more tightly with authentik via the new Outposts system. The new proxy also supports multiple applications per proxy instance, can configure TLS based on authentik Keypairs, and more. - See [Proxy](../../add-secure-apps/providers/proxy/index.md) + See [Proxy](../../add-secure-apps/providers/proxy/index.mdx) - Outpost System diff --git a/website/docs/releases/old/v0.11.md b/website/docs/releases/old/v0.11.mdx similarity index 100% rename from website/docs/releases/old/v0.11.md rename to website/docs/releases/old/v0.11.mdx diff --git a/website/docs/releases/old/v0.12.md b/website/docs/releases/old/v0.12.mdx similarity index 100% rename from website/docs/releases/old/v0.12.md rename to website/docs/releases/old/v0.12.mdx diff --git a/website/docs/releases/old/v0.13.md b/website/docs/releases/old/v0.13.mdx similarity index 100% rename from website/docs/releases/old/v0.13.md rename to website/docs/releases/old/v0.13.mdx diff --git a/website/docs/releases/old/v0.14.md b/website/docs/releases/old/v0.14.mdx similarity index 100% rename from website/docs/releases/old/v0.14.md rename to website/docs/releases/old/v0.14.mdx diff --git a/website/docs/releases/old/v0.9.md b/website/docs/releases/old/v0.9.mdx similarity index 100% rename from website/docs/releases/old/v0.9.md rename to website/docs/releases/old/v0.9.mdx diff --git a/website/docs/security/account-lockdown.md b/website/docs/security/account-lockdown.mdx similarity index 98% rename from website/docs/security/account-lockdown.md rename to website/docs/security/account-lockdown.mdx index 3208692f3c..77eedbd18f 100644 --- a/website/docs/security/account-lockdown.md +++ b/website/docs/security/account-lockdown.mdx @@ -24,7 +24,7 @@ Account Lockdown cannot be triggered on the anonymous user or internal service a ## Prerequisites 1. A **Lockdown Flow** must be configured on your Brand (**System** > **Brands**) -2. The flow must contain an [Account Lockdown Stage](../add-secure-apps/flows-stages/stages/account_lockdown/index.md) (Enterprise) +2. The flow must contain an [Account Lockdown Stage](../add-secure-apps/flows-stages/stages/account_lockdown/index.mdx) (Enterprise) 3. For self-service lockdown, configure a **Completion flow** on the stage ## Use the packaged lockdown blueprint @@ -72,7 +72,7 @@ Alternatively, use this { // When the section has a root index doc, make the category label link to it // (clicking the section navigates to its Overview page). The doc also renders // as the first child, labelled "Overview" via its frontmatter. - const hasIndex = ["index.md", "index.mdx"].some((file) => - fs.existsSync(path.join(__dirname, dirName, file)), - ); + const hasIndex = fs.existsSync(path.join(__dirname, dirName, "index.mdx")); if (hasIndex) { sidebarCategory.link = { diff --git a/website/docs/sys-mgmt/akql.mdx b/website/docs/sys-mgmt/akql.mdx index a725a92be1..8c4e39e6b2 100644 --- a/website/docs/sys-mgmt/akql.mdx +++ b/website/docs/sys-mgmt/akql.mdx @@ -15,9 +15,9 @@ AKQL is built on [DjangoQL](https://github.com/ivelum/djangoql). AKQL is available on lists and fields backed by the query language: - **Events** > **Logs**: See [Logging events](./events/logging-events.mdx#advanced-queries). -- **Directory** > **Users**: See [Manage users](../users-sources/user/user_basic_operations.md#advanced-queries). +- **Directory** > **Users**: See [Manage users](../users-sources/user/user_basic_operations.mdx#advanced-queries). - **Directory** > **Groups**: See [Manage groups](../users-sources/groups/manage_groups.mdx#advanced-queries). -- **Event Matcher policies**: the **Query** field on an [Event Matcher policy](../customize/policies/types/event-matcher.md#what-it-matches). +- **Event Matcher policies**: the **Query** field on an [Event Matcher policy](../customize/policies/types/event-matcher.mdx#what-it-matches). - **REST API list endpoints**: the `search` query parameter on endpoints that return an AKQL autocomplete schema. See [Use AKQL through the API](#use-akql-through-the-api). Each area exposes its own searchable fields. See [Searchable fields](#searchable-fields). @@ -177,21 +177,21 @@ The fields available to AKQL are specific to each list. Available in **Events** > **Logs** and in the **Query** field on Event Matcher policies. -| Field | Type | Description | -| ------------------ | --------- | ------------------------------------------------------------------------------------ | -| `action` | Choice | The [event action](./events/event-actions.md), such as `login`. | -| `event_uuid` | String | The event's unique identifier. | -| `app` | String | The application or authentik component that emitted the event. | -| `client_ip` | String | The client IP address associated with the event. | -| `user.pk` | Integer | The acting user's primary key. | -| `user.username` | String | The acting user's username. | -| `user.email` | String | The acting user's email address. | -| `brand.pk` | String | The primary key of the [brand](../customize/branding/index.md) active for the event. | -| `brand.app` | String | The brand's app label. | -| `brand.name` | String | The brand's name. | -| `brand.model_name` | String | The brand's model name. | -| `context.*` | JSON | Arbitrary event context. | -| `created` | Date/time | When the event occurred. | +| Field | Type | Description | +| ------------------ | --------- | ------------------------------------------------------------------------------------- | +| `action` | Choice | The [event action](./events/event-actions.mdx), such as `login`. | +| `event_uuid` | String | The event's unique identifier. | +| `app` | String | The application or authentik component that emitted the event. | +| `client_ip` | String | The client IP address associated with the event. | +| `user.pk` | Integer | The acting user's primary key. | +| `user.username` | String | The acting user's username. | +| `user.email` | String | The acting user's email address. | +| `brand.pk` | String | The primary key of the [brand](../customize/branding/index.mdx) active for the event. | +| `brand.app` | String | The brand's app label. | +| `brand.name` | String | The brand's name. | +| `brand.model_name` | String | The brand's model name. | +| `context.*` | JSON | Arbitrary event context. | +| `created` | Date/time | When the event occurred. | Common event context paths include: @@ -281,7 +281,7 @@ The response pagination object includes an `autocomplete` field that describes t ## Use AKQL in an Event Matcher policy -Use the **Query** field on an [Event Matcher policy](../customize/policies/types/event-matcher.md) to match events with AKQL. +Use the **Query** field on an [Event Matcher policy](../customize/policies/types/event-matcher.mdx) to match events with AKQL. 1. In the Admin interface, navigate to **Customization** > **Policies**. 2. Create or edit an **Event Matcher Policy**. diff --git a/website/docs/sys-mgmt/background-tasks.md b/website/docs/sys-mgmt/background-tasks.mdx similarity index 96% rename from website/docs/sys-mgmt/background-tasks.md rename to website/docs/sys-mgmt/background-tasks.mdx index 21600bb26f..2b3ec35e27 100644 --- a/website/docs/sys-mgmt/background-tasks.md +++ b/website/docs/sys-mgmt/background-tasks.mdx @@ -3,7 +3,7 @@ title: Background tasks slug: /background-tasks --- -authentik uses background tasks to run various operations independently and asynchronously, separated from the continuous web requests processed for general user interaction. These background tasks are run by the [worker](./ops/worker.md). +authentik uses background tasks to run various operations independently and asynchronously, separated from the continuous web requests processed for general user interaction. These background tasks are run by the [worker](./ops/worker.mdx). ## What are background tasks used for? @@ -13,14 +13,14 @@ Here is a non-exhaustive list of what background tasks are used for: - Housekeeping: clean up old objects, check for updates, etc. - Blueprints: import and apply [Blueprints](../customize/blueprints/index.mdx) - Synchronization: sync users to and from authentik, from sources and to providers. This is used by: - - [SCIM Provider](../add-secure-apps/providers/scim/index.md) - - [Google Workspace Provider](../add-secure-apps/providers/gws/index.md) - - [Microsoft Entra Provider](../add-secure-apps/providers/entra/index.md) - - [SSF Provider](../add-secure-apps/providers/ssf/index.md) - - [Kerberos Source](../users-sources/sources/protocols/kerberos/index.md) - - [LDAP Source](../users-sources/sources/protocols/ldap/index.md) -- Enterprise [license management](../enterprise/manage-enterprise.md#license-management) -- Event Notifications: send [Notifications](./events/notifications.md) when events are created + - [SCIM Provider](../add-secure-apps/providers/scim/index.mdx) + - [Google Workspace Provider](../add-secure-apps/providers/gws/index.mdx) + - [Microsoft Entra Provider](../add-secure-apps/providers/entra/index.mdx) + - [SSF Provider](../add-secure-apps/providers/ssf/index.mdx) + - [Kerberos Source](../users-sources/sources/protocols/kerberos/index.mdx) + - [LDAP Source](../users-sources/sources/protocols/ldap/index.mdx) +- Enterprise [license management](../enterprise/manage-enterprise.mdx#license-management) +- Event Notifications: send [Notifications](./events/notifications.mdx) when events are created - Emails: send emails when triggered by one of the email stages or otherwise ## Schedules diff --git a/website/docs/sys-mgmt/certificates.md b/website/docs/sys-mgmt/certificates.mdx similarity index 100% rename from website/docs/sys-mgmt/certificates.md rename to website/docs/sys-mgmt/certificates.mdx diff --git a/website/docs/sys-mgmt/data-exports.md b/website/docs/sys-mgmt/data-exports.mdx similarity index 70% rename from website/docs/sys-mgmt/data-exports.md rename to website/docs/sys-mgmt/data-exports.mdx index 7c725bd2d8..834a2dfa10 100644 --- a/website/docs/sys-mgmt/data-exports.md +++ b/website/docs/sys-mgmt/data-exports.mdx @@ -8,10 +8,10 @@ authentik enterprise allows you to export user and event data in CSV format for The content included in a data export matches that returned by the API endpoints for the respective object types. -For detailed instructions on exporting users and events, see [Export users](../users-sources/user/user_basic_operations.md#export-users-) and [Export events](events/logging-events.mdx#export-events) respectively. +For detailed instructions on exporting users and events, see [Export users](../users-sources/user/user_basic_operations.mdx#export-users-) and [Export events](events/logging-events.mdx#export-events) respectively. You can access past data exports from the **Events** > **Data Exports** page. On this page you can view the query used for a specific export, search exports by data type and user, download completed exports and delete exports that you no longer need. ## Permissions -Creating or viewing a data export requires [view permission](../users-sources/access-control/permissions.md) on the object type being exported in addition to the respective permission for data exports. +Creating or viewing a data export requires [view permission](../users-sources/access-control/permissions.mdx) on the object type being exported in addition to the respective permission for data exports. diff --git a/website/docs/sys-mgmt/events/event-actions.md b/website/docs/sys-mgmt/events/event-actions.mdx similarity index 99% rename from website/docs/sys-mgmt/events/event-actions.md rename to website/docs/sys-mgmt/events/event-actions.mdx index 4ba469b4d1..3d2db7e1b2 100644 --- a/website/docs/sys-mgmt/events/event-actions.md +++ b/website/docs/sys-mgmt/events/event-actions.mdx @@ -2,7 +2,7 @@ title: Event actions --- -Whenever any of the following actions occur, an event is created. Actions are used to define [Notification Rules](notifications.md). +Whenever any of the following actions occur, an event is created. Actions are used to define [Notification Rules](notifications.mdx). ### `login` diff --git a/website/docs/sys-mgmt/events/index.md b/website/docs/sys-mgmt/events/index.mdx similarity index 96% rename from website/docs/sys-mgmt/events/index.md rename to website/docs/sys-mgmt/events/index.mdx index 83fb180dc9..2b9c9a1098 100644 --- a/website/docs/sys-mgmt/events/index.md +++ b/website/docs/sys-mgmt/events/index.mdx @@ -8,7 +8,7 @@ Certain information is stripped from events to ensure that no passwords or other ## About notifications -Events can be used to define [notification rules](notifications.md), with specified [transport options](transports.md) of either local (shown in the authentik UI), email, or webhook. +Events can be used to define [notification rules](notifications.mdx), with specified [transport options](transports.mdx) of either local (shown in the authentik UI), email, or webhook. ## About logging diff --git a/website/docs/sys-mgmt/events/logging-events.mdx b/website/docs/sys-mgmt/events/logging-events.mdx index 9f6041d43a..45f313bba0 100644 --- a/website/docs/sys-mgmt/events/logging-events.mdx +++ b/website/docs/sys-mgmt/events/logging-events.mdx @@ -4,7 +4,7 @@ title: Logging events Logs are a vital tool for system diagnostics, event auditing, user management, reporting, and more. They capture detailed information about each event including the client's IP address, the user involved, the date and time, and the specific action taken. -Event logging in authentik is highly configurable. You can set the [retention period](./index.md#event-retention-and-forwarding) for storing and displaying events, specify which events should trigger a [notification](./notifications.md), and access low-level details about when and where each event occurred. +Event logging in authentik is highly configurable. You can set the [retention period](./index.mdx#event-retention-and-forwarding) for storing and displaying events, specify which events should trigger a [notification](./notifications.mdx), and access low-level details about when and where each event occurred. ## Troubleshooting with event logs diff --git a/website/docs/sys-mgmt/events/notification_rule_expression_policies.mdx b/website/docs/sys-mgmt/events/notification_rule_expression_policies.mdx index f8e6585ccb..a8abea2efb 100644 --- a/website/docs/sys-mgmt/events/notification_rule_expression_policies.mdx +++ b/website/docs/sys-mgmt/events/notification_rule_expression_policies.mdx @@ -3,7 +3,7 @@ title: Notification Rule Expression Policies sidebar_label: Expression Policies --- -[Notification rules](./notifications.md) with [bound expression policies](./notifications.md#3-create-a-notification-rule-and-bind-it-to-the-policy) can match event context, update related objects, and send custom messages. The following examples show common event-driven automation patterns. +[Notification rules](./notifications.mdx) with [bound expression policies](./notifications.mdx#3-create-a-notification-rule-and-bind-it-to-the-policy) can match event context, update related objects, and send custom messages. The following examples show common event-driven automation patterns. ## Send a welcome email to newly created users @@ -11,7 +11,7 @@ This expression policy sends a welcome email to a user when their account is cre ### Prerequisites -authentik must be able to send email before you can use `ak_send_email`. Either configure the [global email settings](../../install-config/email.mdx), or set up an [Email stage](../../add-secure-apps/flows-stages/stages/email/index.md) and pass it to `ak_send_email` with the `stage` argument to use that stage's connection settings. +authentik must be able to send email before you can use `ak_send_email`. Either configure the [global email settings](../../install-config/email.mdx), or set up an [Email stage](../../add-secure-apps/flows-stages/stages/email/index.mdx) and pass it to `ak_send_email` with the `stage` argument to use that stage's connection settings. ### Create the expression policy @@ -78,16 +78,16 @@ The policy only runs when it is bound to a notification rule that triggers on th 7. Click **Create or bind...**. Under **Bind Existing...**, select **Bind an existing policy**. 8. In the **Create Binding** modal, select the `send-welcome-email` policy, and then click **Create**. -This pattern does not require a destination group or transport on the rule. As noted in [Notification Rules](./notifications.md#3-create-a-notification-rule-and-bind-it-to-the-policy), bound policies are executed even when no destination is selected. Because this policy returns `False`, authentik does not create a notification object. The email is sent entirely by the `ak_send_email` call inside the policy. +This pattern does not require a destination group or transport on the rule. As noted in [Notification Rules](./notifications.mdx#3-create-a-notification-rule-and-bind-it-to-the-policy), bound policies are executed even when no destination is selected. Because this policy returns `False`, authentik does not create a notification object. The email is sent entirely by the `ak_send_email` call inside the policy. Matching on `model_created` ensures that the email is only sent when the account is first created. Other changes to the user, such as a password reset, are recorded as `model_updated` and do not trigger this policy. -To send a richer, branded message instead of plain text, replace the `body` argument with a `template` argument pointing to a [custom email template](../../add-secure-apps/flows-stages/stages/email/index.md#custom-templates), and pass any values the template needs through the `context` argument. See the [`ak_send_email` reference](../../customize/policies/types/expression/reference.mdx) for all available parameters. +To send a richer, branded message instead of plain text, replace the `body` argument with a `template` argument pointing to a [custom email template](../../add-secure-apps/flows-stages/stages/email/index.mdx#custom-templates), and pass any values the template needs through the `context` argument. See the [`ak_send_email` reference](../../customize/policies/types/expression/reference.mdx) for all available parameters. :::info To let the new user set their own password, point `login_url` at your recovery flow, for example `https://authentik.company/if/flow/default-recovery-flow/`. Replace `default-recovery-flow` with the slug of the flow you want to use. The user can then enter their email address and receive a password setup link. The flow must exist for the URL to work. -For the built-in ways to send a set-password link, see [User credentials recovery](../../users-sources/user/user_basic_operations.md#user-credentials-recovery). +For the built-in ways to send a set-password link, see [User credentials recovery](../../users-sources/user/user_basic_operations.mdx#user-credentials-recovery). ::: ## Trigger alert when user logs in from unknown device diff --git a/website/docs/sys-mgmt/events/notifications.md b/website/docs/sys-mgmt/events/notifications.mdx similarity index 85% rename from website/docs/sys-mgmt/events/notifications.md rename to website/docs/sys-mgmt/events/notifications.mdx index 6b37a048e1..b14f783499 100644 --- a/website/docs/sys-mgmt/events/notifications.md +++ b/website/docs/sys-mgmt/events/notifications.mdx @@ -19,7 +19,7 @@ To receive notifications about events, follow this workflow: ## 1. Create a notification transport -A notification transport determines how authentik delivers notifications to users. Supported delivery methods are local notifications in the authentik UI, email, and webhook. To create a notification transport, see [Create a notification transport](./transports.md#create-a-notification-transport). +A notification transport determines how authentik delivers notifications to users. Supported delivery methods are local notifications in the authentik UI, email, and webhook. To create a notification transport, see [Create a notification transport](./transports.mdx#create-a-notification-transport). ## 2. Create a policy @@ -27,7 +27,7 @@ Create a policy that defines which events trigger a notification. For simple con ### Event Matcher policy -For simple event matching, create and configure an [Event Matcher policy](../../customize/policies/types/event-matcher.md) to define which events trigger a notification. Use the policy's [AKQL query](../akql.mdx#use-akql-in-an-event-matcher-policy) when you need to match event context fields such as `context.geo.country` or `context.authorized_application.name`. +For simple event matching, create and configure an [Event Matcher policy](../../customize/policies/types/event-matcher.mdx) to define which events trigger a notification. Use the policy's [AKQL query](../akql.mdx#use-akql-in-an-event-matcher-policy) when you need to match event context fields such as `context.geo.country` or `context.authorized_application.name`. An event must match all configured fields in the policy. Otherwise, the notification rule does not trigger. @@ -55,7 +55,7 @@ After you create the policies to match the relevant events, create a notificatio 3. Define the rule configuration, and then click **Create Notification Rule** or **Update** to save the settings. - Policies are executed regardless of whether a destination is selected. Notifications are only created when a destination group is selected or **Send notification to event user** is enabled. -- Select which [notification transport](./transports.md) authentik uses to send the notification. Two notification transports are created by default: +- Select which [notification transport](./transports.mdx) authentik uses to send the notification. Two notification transports are created by default: - `default-email-transport`: Delivers notifications via email using the [global email configuration](../../install-config/install/docker-compose.mdx#email-configuration-optional-but-recommended). - `default-local-transport`: Delivers notifications within the authentik UI. diff --git a/website/docs/sys-mgmt/events/transports.md b/website/docs/sys-mgmt/events/transports.mdx similarity index 98% rename from website/docs/sys-mgmt/events/transports.md rename to website/docs/sys-mgmt/events/transports.mdx index e6a14aba7d..63151c8262 100644 --- a/website/docs/sys-mgmt/events/transports.md +++ b/website/docs/sys-mgmt/events/transports.mdx @@ -3,7 +3,7 @@ title: Notification Transports sidebar_label: Notification Transports --- -To receive notifications about events, first [create a notification transport](#create-a-notification-transport), and then define a notification rule with a bound policy. For more information, see the [workflow overview](./notifications.md#workflow-overview). +To receive notifications about events, first [create a notification transport](#create-a-notification-transport), and then define a notification rule with a bound policy. For more information, see the [workflow overview](./notifications.mdx#workflow-overview). ## Notification transport modes diff --git a/website/docs/sys-mgmt/object-lifecycle-management.md b/website/docs/sys-mgmt/object-lifecycle-management.mdx similarity index 100% rename from website/docs/sys-mgmt/object-lifecycle-management.md rename to website/docs/sys-mgmt/object-lifecycle-management.mdx diff --git a/website/docs/sys-mgmt/ops/backup-restore.md b/website/docs/sys-mgmt/ops/backup-restore.mdx similarity index 98% rename from website/docs/sys-mgmt/ops/backup-restore.md rename to website/docs/sys-mgmt/ops/backup-restore.mdx index 3f1a2d9484..8ab1fad08b 100644 --- a/website/docs/sys-mgmt/ops/backup-restore.md +++ b/website/docs/sys-mgmt/ops/backup-restore.mdx @@ -25,8 +25,8 @@ The PostgreSQL database is the most important part of an authentik backup. Witho For deployment-specific PostgreSQL upgrade guides, see: -- [Upgrade PostgreSQL on Docker Compose](../../troubleshooting/postgres/upgrade_docker.md) -- [Upgrading PostgreSQL on Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.md) +- [Upgrade PostgreSQL on Docker Compose](../../troubleshooting/postgres/upgrade_docker.mdx) +- [Upgrading PostgreSQL on Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.mdx) For PostgreSQL connection settings, TLS, replicas, and pooler compatibility, see the [PostgreSQL configuration reference](../../install-config/configuration/configuration.mdx#postgresql-settings). diff --git a/website/docs/sys-mgmt/ops/geoip.mdx b/website/docs/sys-mgmt/ops/geoip.mdx index 8fd84a238b..aeb76787f3 100644 --- a/website/docs/sys-mgmt/ops/geoip.mdx +++ b/website/docs/sys-mgmt/ops/geoip.mdx @@ -1,6 +1,6 @@ # GeoIP -authentik supports GeoIP to add additional information to login/authorization/enrollment requests. Additionally, a [GeoIP Policy](../../customize/policies/types/geoip.md) can be used to make policy decisions based on the lookup result. +authentik supports GeoIP to add additional information to login/authorization/enrollment requests. Additionally, a [GeoIP Policy](../../customize/policies/types/geoip.mdx) can be used to make policy decisions based on the lookup result. ### Configuration diff --git a/website/docs/sys-mgmt/ops/monitoring.md b/website/docs/sys-mgmt/ops/monitoring.mdx similarity index 100% rename from website/docs/sys-mgmt/ops/monitoring.md rename to website/docs/sys-mgmt/ops/monitoring.mdx diff --git a/website/docs/sys-mgmt/ops/storage-s3/index.md b/website/docs/sys-mgmt/ops/storage-s3/index.mdx similarity index 98% rename from website/docs/sys-mgmt/ops/storage-s3/index.md rename to website/docs/sys-mgmt/ops/storage-s3/index.mdx index 7c407f31da..4a7a370aa0 100644 --- a/website/docs/sys-mgmt/ops/storage-s3/index.md +++ b/website/docs/sys-mgmt/ops/storage-s3/index.mdx @@ -6,7 +6,7 @@ sidebar_position: 1 authentik can store uploaded files in Amazon S3 or an S3-compatible object storage service instead of storing them on the local filesystem in `/data`. -This guide covers the settings, permissions, and migration steps that are common to S3 storage. For service-specific endpoints and authentication details, see [S3-compatible storage providers](./providers.md). +This guide covers the settings, permissions, and migration steps that are common to S3 storage. For service-specific endpoints and authentication details, see [S3-compatible storage providers](./providers.mdx). For the full list of storage configuration options, see the [configuration reference](../../../install-config/configuration/configuration.mdx#s3-storage-backend-settings). @@ -105,7 +105,7 @@ For other S3-compatible services, also configure the service endpoint: AUTHENTIK_STORAGE__S3__ENDPOINT= ``` -The [provider reference](./providers.md) lists service-specific endpoint and region values. +The [provider reference](./providers.mdx) lists service-specific endpoint and region values. ### Configure a public S3 hostname diff --git a/website/docs/sys-mgmt/ops/storage-s3/providers.md b/website/docs/sys-mgmt/ops/storage-s3/providers.mdx similarity index 97% rename from website/docs/sys-mgmt/ops/storage-s3/providers.md rename to website/docs/sys-mgmt/ops/storage-s3/providers.mdx index d6154a3c04..36d8e77705 100644 --- a/website/docs/sys-mgmt/ops/storage-s3/providers.md +++ b/website/docs/sys-mgmt/ops/storage-s3/providers.mdx @@ -4,7 +4,7 @@ sidebar_label: Providers sidebar_position: 2 --- -Configure the shared settings in [S3-compatible storage](./index.md), then use the section for your storage service to set its endpoint and authentication options. +Configure the shared settings in [S3-compatible storage](./index.mdx), then use the section for your storage service to set its endpoint and authentication options. The authentik project does not test releases against every service listed on this page. S3 implementations differ, so verify uploads, downloads, deletes, and generated file URLs with your selected service before using it in production. diff --git a/website/docs/sys-mgmt/ops/worker.md b/website/docs/sys-mgmt/ops/worker.mdx similarity index 94% rename from website/docs/sys-mgmt/ops/worker.md rename to website/docs/sys-mgmt/ops/worker.mdx index e3499c62b5..e8d6a95937 100644 --- a/website/docs/sys-mgmt/ops/worker.md +++ b/website/docs/sys-mgmt/ops/worker.mdx @@ -3,7 +3,7 @@ title: Worker slug: /worker --- -The authentik worker runs [background tasks](../background-tasks.md). The worker also watches for [blueprints](../../customize/blueprints/index.mdx#as-a-local-file) and [certificates](../certificates.md#external-certificates) that are added to the file system. It runs in a separate container from the server to handle these tasks. +The authentik worker runs [background tasks](../background-tasks.mdx). The worker also watches for [blueprints](../../customize/blueprints/index.mdx#as-a-local-file) and [certificates](../certificates.mdx#external-certificates) that are added to the file system. It runs in a separate container from the server to handle these tasks. ## How it works @@ -47,4 +47,4 @@ This means that in this scenario, the maximum number of concurrent tasks will be The workers expose metrics about their operation on [`AUTHENTIK_LISTEN__METRICS`](../../install-config/configuration/configuration.mdx#authentik_listen__metrics). Those metrics allow monitoring of the number of pending, failed and successful tasks. They also provide insights about tasks durations. -The worker also has an available healthcheck endpoint. See [Monitoring](./monitoring.md#worker-monitoring) for details. +The worker also has an available healthcheck endpoint. See [Monitoring](./monitoring.mdx#worker-monitoring) for details. diff --git a/website/docs/sys-mgmt/settings.md b/website/docs/sys-mgmt/settings.mdx similarity index 91% rename from website/docs/sys-mgmt/settings.md rename to website/docs/sys-mgmt/settings.mdx index 8e231686b9..937d4243a5 100644 --- a/website/docs/sys-mgmt/settings.md +++ b/website/docs/sys-mgmt/settings.mdx @@ -52,15 +52,15 @@ Enable the ability for users to change their usernames, defaults to `false`. ### Event retention -Configure how long [Events](./events/index.md) are retained for within authentik. Default value is `days=365`. When forwarding events to an external application, this value can be decreased. When changing this value, only new events are affected. +Configure how long [Events](./events/index.mdx) are retained for within authentik. Default value is `days=365`. When forwarding events to an external application, this value can be decreased. When changing this value, only new events are affected. ### Reputation: lower limit -Configure a lower limit for [Reputation Policy](../customize/policies/types/reputation.md). Defaults to `-5`. +Configure a lower limit for [Reputation Policy](../customize/policies/types/reputation.mdx). Defaults to `-5`. ### Reputation: upper limit -Configure an upper limit for [Reputation Policy](../customize/policies/types/reputation.md). Defaults to `5`. +Configure an upper limit for [Reputation Policy](../customize/policies/types/reputation.mdx). Defaults to `5`. ### Footer links @@ -68,7 +68,7 @@ This option allows you to add linked text (footer links) on the bottom of flow p The URL is limited to web and email addresses. If the name is left blank, the URL will be shown. -This is a global setting. All flow pages that are rendered by the [Flow Executor](../add-secure-apps/flows-stages/flow/executors/if-flow.md) will display the footer links. +This is a global setting. All flow pages that are rendered by the [Flow Executor](../add-secure-apps/flows-stages/flow/executors/if-flow.mdx) will display the footer links. ### GDPR compliance diff --git a/website/docs/sys-mgmt/tenancy.md b/website/docs/sys-mgmt/tenancy.mdx similarity index 97% rename from website/docs/sys-mgmt/tenancy.md rename to website/docs/sys-mgmt/tenancy.mdx index 85b91aaedc..02ab96d37c 100644 --- a/website/docs/sys-mgmt/tenancy.md +++ b/website/docs/sys-mgmt/tenancy.mdx @@ -8,7 +8,7 @@ This feature is in alpha. Use at your own risk. ::: :::info -This feature is available from 2024.2 and is not to be confused with [brands](../customize/branding/index.md), which were previously called tenants. +This feature is available from 2024.2 and is not to be confused with [brands](../customize/branding/index.mdx), which were previously called tenants. ::: ## About tenants @@ -29,7 +29,7 @@ For each additional tenant (beyond the default one), one or more licenses are re A single tenant and its corresponding installation can have multiple license keys. For example, a company might purchase one license for 50 users, and then later in the same year need to buy another license for 50 more users, due to company growth. Both licenses are associated to the one installation, the one tenant. -Learn more in [Manage Enterprise licensing](../enterprise/manage-enterprise.md#license-management). +Learn more in [Manage Enterprise licensing](../enterprise/manage-enterprise.mdx#license-management). ### Important considerations diff --git a/website/docs/sys-mgmt/user-offboarding.md b/website/docs/sys-mgmt/user-offboarding.mdx similarity index 95% rename from website/docs/sys-mgmt/user-offboarding.md rename to website/docs/sys-mgmt/user-offboarding.mdx index 30ec3c1cdc..a0e08cb33f 100644 --- a/website/docs/sys-mgmt/user-offboarding.md +++ b/website/docs/sys-mgmt/user-offboarding.mdx @@ -51,7 +51,7 @@ The **Events** > **Offboardings** page shows pending offboardings by default. Di authentik checks for due offboardings every five minutes. The action normally starts within five minutes after the scheduled time, but a task backlog can delay it further. If an attempt fails, authentik retries the complete offboarding action. After five failed attempts, the offboarding is marked **Failed** and is not retried again. -After an offboarding completes, authentik writes a **User Offboarded** event to the [events log](./events/index.md). The event identifies the administrator who scheduled the offboarding, the selected action, and whether session and token revocation were enabled. +After an offboarding completes, authentik writes a **User Offboarded** event to the [events log](./events/index.mdx). The event identifies the administrator who scheduled the offboarding, the selected action, and whether session and token revocation were enabled. :::note A successful **Delete** action removes the offboarding record with the user account. The **User Offboarded** event remains in the audit log. diff --git a/website/docs/troubleshooting/access.md b/website/docs/troubleshooting/access.mdx similarity index 100% rename from website/docs/troubleshooting/access.md rename to website/docs/troubleshooting/access.mdx diff --git a/website/docs/troubleshooting/csrf.md b/website/docs/troubleshooting/csrf.mdx similarity index 93% rename from website/docs/troubleshooting/csrf.md rename to website/docs/troubleshooting/csrf.mdx index 6ed2a2dab7..fa55d68e01 100644 --- a/website/docs/troubleshooting/csrf.md +++ b/website/docs/troubleshooting/csrf.mdx @@ -4,7 +4,7 @@ title: Troubleshooting CSRF Errors With some proxy setups, you might run into CSRF errors when attempting to create/save objects in authentik. This is usually caused by either the _Origin_ or _Host_ header being incorrect. -If authentik is running behind a reverse proxy, review the [Reverse proxy](../install-config/reverse-proxy.md) guide as well. +If authentik is running behind a reverse proxy, review the [Reverse proxy](../install-config/reverse-proxy.mdx) guide as well. Open the system info API endpoint of your authentik instance by going to *https://authentik.company/api/v3/admin/system/*. Take note of the value of _HTTP_HOST_, make sure it matches the domain you're accessing authentik at, and make sure it does _not_ include any port numbers. diff --git a/website/docs/troubleshooting/emails.md b/website/docs/troubleshooting/emails.mdx similarity index 100% rename from website/docs/troubleshooting/emails.md rename to website/docs/troubleshooting/emails.mdx diff --git a/website/docs/troubleshooting/image_upload.md b/website/docs/troubleshooting/image_upload.mdx similarity index 100% rename from website/docs/troubleshooting/image_upload.md rename to website/docs/troubleshooting/image_upload.mdx diff --git a/website/docs/troubleshooting/ldap_source.md b/website/docs/troubleshooting/ldap_source.mdx similarity index 100% rename from website/docs/troubleshooting/ldap_source.md rename to website/docs/troubleshooting/ldap_source.mdx diff --git a/website/docs/troubleshooting/login.md b/website/docs/troubleshooting/login.mdx similarity index 100% rename from website/docs/troubleshooting/login.md rename to website/docs/troubleshooting/login.mdx diff --git a/website/docs/troubleshooting/logs/outpost_logs.mdx b/website/docs/troubleshooting/logs/outpost_logs.mdx index 1aca01d83d..6d3ef305de 100644 --- a/website/docs/troubleshooting/logs/outpost_logs.mdx +++ b/website/docs/troubleshooting/logs/outpost_logs.mdx @@ -34,7 +34,7 @@ The outpost will be redeployed with the new log level. -Outpost can be manually deployed via [Docker Compose](../../add-secure-apps/outposts/manual-deploy-docker-compose.md) or [Kubernetes](../../add-secure-apps/outposts/manual-deploy-kubernetes.md). +Outpost can be manually deployed via [Docker Compose](../../add-secure-apps/outposts/manual-deploy-docker-compose.mdx) or [Kubernetes](../../add-secure-apps/outposts/manual-deploy-kubernetes.mdx). In each case, you need to add the following environment variable to the outpost container: @@ -84,7 +84,7 @@ After troubleshooting, reduce the log level from `trace` to avoid exposing sensi -Outpost can be manually deployed via [Docker Compose](../../add-secure-apps/outposts/manual-deploy-docker-compose.md) or [Kubernetes](../../add-secure-apps/outposts/manual-deploy-kubernetes.md). +Outpost can be manually deployed via [Docker Compose](../../add-secure-apps/outposts/manual-deploy-docker-compose.mdx) or [Kubernetes](../../add-secure-apps/outposts/manual-deploy-kubernetes.mdx). In each case, you need to add the following environment variable to the outpost container: diff --git a/website/docs/troubleshooting/missing_admin_group.md b/website/docs/troubleshooting/missing_admin_group.mdx similarity index 100% rename from website/docs/troubleshooting/missing_admin_group.md rename to website/docs/troubleshooting/missing_admin_group.mdx diff --git a/website/docs/troubleshooting/missing_permission.md b/website/docs/troubleshooting/missing_permission.mdx similarity index 100% rename from website/docs/troubleshooting/missing_permission.md rename to website/docs/troubleshooting/missing_permission.mdx diff --git a/website/docs/troubleshooting/postgres/upgrade_docker.md b/website/docs/troubleshooting/postgres/upgrade_docker.mdx similarity index 98% rename from website/docs/troubleshooting/postgres/upgrade_docker.md rename to website/docs/troubleshooting/postgres/upgrade_docker.mdx index a153c4d1e2..b130415887 100644 --- a/website/docs/troubleshooting/postgres/upgrade_docker.md +++ b/website/docs/troubleshooting/postgres/upgrade_docker.mdx @@ -13,7 +13,7 @@ It assumes the PostgreSQL service is named `postgresql` and the authentik databa - a copy of the existing PostgreSQL data directory or volume - the newly initialized PostgreSQL data directory - Expect downtime while the database is exported, recreated, and restored. -- Review the [Backup and restore](../../sys-mgmt/ops/backup-restore.md) guidance before proceeding. +- Review the [Backup and restore](../../sys-mgmt/ops/backup-restore.mdx) guidance before proceeding. ## 1. Create a logical backup diff --git a/website/docs/troubleshooting/postgres/upgrade_kubernetes.md b/website/docs/troubleshooting/postgres/upgrade_kubernetes.mdx similarity index 99% rename from website/docs/troubleshooting/postgres/upgrade_kubernetes.md rename to website/docs/troubleshooting/postgres/upgrade_kubernetes.mdx index 28c9c726a9..9daf9048bf 100644 --- a/website/docs/troubleshooting/postgres/upgrade_kubernetes.md +++ b/website/docs/troubleshooting/postgres/upgrade_kubernetes.mdx @@ -15,7 +15,7 @@ For this guide, we assume the PostgreSQL pod is named `authentik-postgresql-0`, - enough storage for a SQL dump and a copy of the old database files - a maintenance window long enough to export and restore the database -Review [Backup and restore](../../sys-mgmt/ops/backup-restore.md) before proceeding. +Review [Backup and restore](../../sys-mgmt/ops/backup-restore.mdx) before proceeding. ## Upgrade process diff --git a/website/docs/users-sources/access-control/index.mdx b/website/docs/users-sources/access-control/index.mdx index c827db9e3f..6195fb80fc 100644 --- a/website/docs/users-sources/access-control/index.mdx +++ b/website/docs/users-sources/access-control/index.mdx @@ -5,7 +5,7 @@ sidebar_position: 4 import DocCardList from "@theme/DocCardList"; -To comply with important regulations such as PCI-DSS, HIPAA, SOC 2, and GDPR, it's necessary to have the ability to control which users have access to specific areas of the system, what [permissions](./permissions.md) they have globally and on certain objects, and a way to monitor [events](../../sys-mgmt/events/index.md) related to user activity. +To comply with important regulations such as PCI-DSS, HIPAA, SOC 2, and GDPR, it's necessary to have the ability to control which users have access to specific areas of the system, what [permissions](./permissions.mdx) they have globally and on certain objects, and a way to monitor [events](../../sys-mgmt/events/index.mdx) related to user activity. In authentik, we provide role-based access control (RBAC), an industry standard for managing access control. By carefully designing roles with appropriate permissions, and then assigning those roles to groups, RBAC provides a fine-tuned approach to controlling user access. diff --git a/website/docs/users-sources/access-control/initial_permissions.mdx b/website/docs/users-sources/access-control/initial_permissions.mdx index fa7d850ae2..791c4292b1 100644 --- a/website/docs/users-sources/access-control/initial_permissions.mdx +++ b/website/docs/users-sources/access-control/initial_permissions.mdx @@ -6,7 +6,7 @@ authentik_preview: true sidebar_position: 2 --- -Initial permissions automatically assigns [object-level permissions](./permissions.md#object-permissions) between a newly created object and its creator. +Initial permissions automatically assigns [object-level permissions](./permissions.mdx#object-permissions) between a newly created object and its creator. The purpose of initial permissions is to assign a specific role a set of pre-selected permissions that are required for users of that role to accomplish their tasks. @@ -14,7 +14,7 @@ An authentik administrator creates an initial permissions object (a set of selec ## Common use cases -Imagine you have a new team tasked with creating [flows](../../add-secure-apps/flows-stages/flow/index.md) and [stages](../../add-secure-apps/flows-stages/stages/index.md). These team members need the ability to view and manage all the flow and stage objects created by other team members. However, they should not have permissions to perform any other actions within the Admin interface. +Imagine you have a new team tasked with creating [flows](../../add-secure-apps/flows-stages/flow/index.mdx) and [stages](../../add-secure-apps/flows-stages/stages/index.mdx). These team members need the ability to view and manage all the flow and stage objects created by other team members. However, they should not have permissions to perform any other actions within the Admin interface. In the example use case above, the specific objects that the users create and manage could be any object. For example, you might have a team responsible for creating new users and managing those user objects, but any other user object. @@ -41,11 +41,11 @@ To create a new set of initial permissions and apply them to a role, follow thes 1. Log in to authentik as an administrator and open the authentik Admin interface. -2. [Create a new role](../roles/manage_roles.md): navigate to **Directory** > **Roles** and click **Create**. +2. [Create a new role](../roles/manage_roles.mdx): navigate to **Directory** > **Roles** and click **Create**. 3. [Create a new group](../groups/manage_groups.mdx): navigate to **Directory** > **Groups** and click **Create**. After creating the group: - [assign the new role to the group](../groups/manage_groups.mdx#assign-a-role-to-a-group) - - [add any members](../user/user_basic_operations.md#add-a-user-to-a-group) that require the initial permissions. You can add already existing users, or [create new users](../user/user_basic_operations.md#create-a-user). + - [add any members](../user/user_basic_operations.mdx#add-a-user-to-a-group) that require the initial permissions. You can add already existing users, or [create new users](../user/user_basic_operations.mdx#create-a-user). 4. Create an initial permissions object: navigate to **Directory** > **Initial Permissions** and click **Create**. Configure the following settings: - **Name**: Provide a descriptive name for the new initial permissions object. @@ -54,6 +54,6 @@ To create a new set of initial permissions and apply them to a role, follow thes - **Permissions**: select all permissions to add to the initial permissions object. -5. To ensure that the role to which you assign the initial permissions _also_ has access to the Admin interface, check to see if the users also need [the global permission `Can access admin interface`](./manage_permissions.md#assign-can-access-admin-interface-permissions). Furthermore, verify that the user(s) has the global permissions to add specific objects. +5. To ensure that the role to which you assign the initial permissions _also_ has access to the Admin interface, check to see if the users also need [the global permission `Can access admin interface`](./manage_permissions.mdx#assign-can-access-admin-interface-permissions). Furthermore, verify that the user(s) has the global permissions to add specific objects. 6. Optionally, create new users and add them to the group. Each new user added to the group will automatically have the set of permissions included within the initial permissions object. diff --git a/website/docs/users-sources/access-control/manage_permissions.md b/website/docs/users-sources/access-control/manage_permissions.mdx similarity index 99% rename from website/docs/users-sources/access-control/manage_permissions.md rename to website/docs/users-sources/access-control/manage_permissions.mdx index 0c8c88128c..0512018bfd 100644 --- a/website/docs/users-sources/access-control/manage_permissions.md +++ b/website/docs/users-sources/access-control/manage_permissions.mdx @@ -4,7 +4,7 @@ description: "Learn how to use global and object permissions in authentik." sidebar_position: 1 --- -For instructions on viewing and managing permissions, see the following topics. To learn more about the concepts and fundamentals of authentik permissions, refer to [About Permissions](./permissions.md). +For instructions on viewing and managing permissions, see the following topics. To learn more about the concepts and fundamentals of authentik permissions, refer to [About Permissions](./permissions.mdx). To learn about using Initial Permissions, a pre-defined set of permissions, refer to our [documentation](./initial_permissions.mdx). diff --git a/website/docs/users-sources/access-control/permissions.md b/website/docs/users-sources/access-control/permissions.mdx similarity index 82% rename from website/docs/users-sources/access-control/permissions.md rename to website/docs/users-sources/access-control/permissions.mdx index f0b886a46e..b4e6cc6344 100644 --- a/website/docs/users-sources/access-control/permissions.md +++ b/website/docs/users-sources/access-control/permissions.mdx @@ -7,14 +7,14 @@ sidebar_position: 0 Permissions are the central, lowest-level components in all access control systems. They are assigned (or removed) to define exactly WHO can do WHAT to WHICH part of the overall software system. :::info -Note that global and object permissions only apply to objects within authentik, and not to who can access certain applications (which are access-controlled using [policies](../../customize/policies/index.md)). +Note that global and object permissions only apply to objects within authentik, and not to who can access certain applications (which are access-controlled using [policies](../../customize/policies/index.mdx)). ::: -For instructions to add, remove, and manage permissions, refer to [Manage Permissions](./manage_permissions.md). +For instructions to add, remove, and manage permissions, refer to [Manage Permissions](./manage_permissions.mdx). ## Fundamentals of authentik permissions -A [role](../roles/index.md) is a collection of permissions. A user or a group can be assigned to any number of roles. A user has a certain permission if they have a role that also has that permission, or if they are part of a group (either directly or indirectly) that has a role which has that permission. +A [role](../roles/index.mdx) is a collection of permissions. A user or a group can be assigned to any number of roles. A user has a certain permission if they have a role that also has that permission, or if they are part of a group (either directly or indirectly) that has a role which has that permission. - Example 1 (no group): Judith has the role "RADIUS", which has every permission for RADIUS providers and property mappings. With this role, Judith has permission to add/view/change/delete RADIUS providers or RADIUS property mappings. - Example 2 (direct group): Marie is part of the group "Auditors". That group has the role "Event Log manager", which in turn has the permissions "Can view Event", "Can change Event", and "Can delete Event". Thus, Marie has permissions to view, change, or delete Events. @@ -33,11 +33,11 @@ Additionally, authentik employs _initial permissions_ to streamline the process ### Global permissions -Global permissions define coarse-grained access control. For example, a role with a global permission of "Can change Flow" can change any [flow](../../add-secure-apps/flows-stages/flow/index.md). Some permissions only make sense as global permissions, e.g. the permission to add a specific object type or whether a user [`Can access admin interface`](./manage_permissions.md#assign-can-access-admin-interface-permissions). +Global permissions define coarse-grained access control. For example, a role with a global permission of "Can change Flow" can change any [flow](../../add-secure-apps/flows-stages/flow/index.mdx). Some permissions only make sense as global permissions, e.g. the permission to add a specific object type or whether a user [`Can access admin interface`](./manage_permissions.mdx#assign-can-access-admin-interface-permissions). ### Object permissions -An object permission grants permission (via a role) on a single, specific object (e.g. a [user](../user/index.mdx), a [group](../groups/index.mdx), a [role](../roles/index.md), a [flow](../../add-secure-apps/flows-stages/flow/index.md), etc.) instead of all objects of a specific type. +An object permission grants permission (via a role) on a single, specific object (e.g. a [user](../user/index.mdx), a [group](../groups/index.mdx), a [role](../roles/index.mdx), a [flow](../../add-secure-apps/flows-stages/flow/index.mdx), etc.) instead of all objects of a specific type. For example, a role with the object permission to change only the Default Authentication flow will not be able to change any other flow. diff --git a/website/docs/users-sources/groups/group_ref.md b/website/docs/users-sources/groups/group_ref.mdx similarity index 100% rename from website/docs/users-sources/groups/group_ref.md rename to website/docs/users-sources/groups/group_ref.mdx diff --git a/website/docs/users-sources/groups/index.mdx b/website/docs/users-sources/groups/index.mdx index e917f999a3..41f50c0aab 100644 --- a/website/docs/users-sources/groups/index.mdx +++ b/website/docs/users-sources/groups/index.mdx @@ -14,4 +14,4 @@ When you bind a group to an application or flow, any members of any child group ## Attributes -Attributes of groups are recursively merged, for all groups the user is a member of. For more information, see [Group properties and attributes](./group_ref.md). +Attributes of groups are recursively merged, for all groups the user is a member of. For more information, see [Group properties and attributes](./group_ref.mdx). diff --git a/website/docs/users-sources/groups/manage_groups.mdx b/website/docs/users-sources/groups/manage_groups.mdx index ba16b1f9b1..cc9ebce52b 100644 --- a/website/docs/users-sources/groups/manage_groups.mdx +++ b/website/docs/users-sources/groups/manage_groups.mdx @@ -3,7 +3,7 @@ title: Manage groups description: "Learn how to work with groups in authentik." --- -A group is a collection of users. Refer to the following sections to learn how to create and manage groups, assign users and roles to groups, and how [permissions](../access-control/manage_permissions.md) work on a group level. +A group is a collection of users. Refer to the following sections to learn how to create and manage groups, assign users and roles to groups, and how [permissions](../access-control/manage_permissions.mdx) work on a group level. ## Create a group @@ -37,7 +37,7 @@ To edit the group's name, parent groups, whether the group grants superuser perm Starting with authentik version 2025.2, the permission to change super-user status has been separated from the permission required to change the group. Now, the `Enable superuser status` and `Disable superuser status` permissions are explicitly required to enable and disable the super-user status. -To [add or remove users](../user/user_basic_operations.md#add-a-user-to-a-group) from the group, or to manage permissions assigned to the group, click on the name of the group to go to the group's detail page and then click on the **Permissions** tab. +To [add or remove users](../user/user_basic_operations.mdx#add-a-user-to-a-group) from the group, or to manage permissions assigned to the group, click on the name of the group to go to the group's detail page and then click on the **Permissions** tab. ## Delete a group @@ -49,7 +49,7 @@ To delete a group, follow these steps: ## Assign a role to a group -You can assign a role to a group, and then all users in the group inherit the permissions assigned to that role. For instructions and more information, see [Assign a role to a group](../roles/manage_roles.md#assign-a-role-to-a-group). +You can assign a role to a group, and then all users in the group inherit the permissions assigned to that role. For instructions and more information, see [Assign a role to a group](../roles/manage_roles.mdx#assign-a-role-to-a-group). :::info Roles are inherited through group hierarchy. If a parent group has a role assigned, all child groups (and their users) automatically inherit that role's permissions. You can view both directly assigned and inherited roles on a group's detail page under the **Roles** tab. @@ -72,4 +72,4 @@ To give a specific role or user the ability to manage group members, the followi In addition, the permission "Can view User" needs to be assigned, either globally or on specific users that should be manageable. -These permissions can be assigned to a [Role](../roles/index.md). +These permissions can be assigned to a [Role](../roles/index.mdx). diff --git a/website/docs/users-sources/roles/index.md b/website/docs/users-sources/roles/index.mdx similarity index 89% rename from website/docs/users-sources/roles/index.md rename to website/docs/users-sources/roles/index.mdx index ef1bdb077a..23226a3596 100644 --- a/website/docs/users-sources/roles/index.md +++ b/website/docs/users-sources/roles/index.mdx @@ -13,9 +13,9 @@ Roles are also inherited through group hierarchy. When a role is assigned to a p For example, let's take a look at the following scenario: -> You need to add 5 new users, all new hires, to authentik, your identity management system. These users will be the first team members on the brand new Security team, so they will need some high-level permissions, with object permissions to create and remove other users, revoke permissions, and send recovery emails. They will also need [global permissions](../access-control/permissions.md#fundamentals-of-authentik-permissions) to control access to flows and stages. +> You need to add 5 new users, all new hires, to authentik, your identity management system. These users will be the first team members on the brand new Security team, so they will need some high-level permissions, with object permissions to create and remove other users, revoke permissions, and send recovery emails. They will also need [global permissions](../access-control/permissions.mdx#fundamentals-of-authentik-permissions) to control access to flows and stages. -The easiest workflow for setting up these new users involves [creating a role](./manage_roles.md#create-a-role) specifically for their type of work, and then [assigning that role to a group](./manage_roles.md#assign-a-role-to-a-group) to which all of the users belong. +The easiest workflow for setting up these new users involves [creating a role](./manage_roles.mdx#create-a-role) specifically for their type of work, and then [assigning that role to a group](./manage_roles.mdx#assign-a-role-to-a-group) to which all of the users belong. ## View roles for users and groups diff --git a/website/docs/users-sources/roles/manage_roles.md b/website/docs/users-sources/roles/manage_roles.mdx similarity index 90% rename from website/docs/users-sources/roles/manage_roles.md rename to website/docs/users-sources/roles/manage_roles.mdx index 684ae11d91..b4719652a9 100644 --- a/website/docs/users-sources/roles/manage_roles.md +++ b/website/docs/users-sources/roles/manage_roles.mdx @@ -15,7 +15,7 @@ To create a new role, follow these steps: 1. In the Admin interface, navigate to **Directory > Roles**. 2. Click **New Role**, enter the name of the role, and then click **Create Role** to save. -3. Next, [assign permissions for the role](../access-control/manage_permissions.md#assign-or-remove-permissions-for-a-specific-role). +3. Next, [assign permissions for the role](../access-control/manage_permissions.mdx#assign-or-remove-permissions-for-a-specific-role). ## Modify a role @@ -23,7 +23,7 @@ To modify a role, follow these steps: - To edit the name of the role, click the Edit icon beside the role's name. -- To modify the permissions that are assigned for the role, click the role's name to go to the role's detail page. There you can add or remove permissions. For more information, refer to ["Assign or remove permissions for a specific role"](../access-control/manage_permissions.md#assign-or-remove-permissions-for-a-specific-role). +- To modify the permissions that are assigned for the role, click the role's name to go to the role's detail page. There you can add or remove permissions. For more information, refer to ["Assign or remove permissions for a specific role"](../access-control/manage_permissions.mdx#assign-or-remove-permissions-for-a-specific-role). ## Delete a role @@ -43,4 +43,4 @@ To delete a role, follow these steps: ## Assign a role to a user -See [add user to a role](../user/user_basic_operations.md#add-a-user-to-a-role). +See [add user to a role](../user/user_basic_operations.mdx#add-a-user-to-a-role). diff --git a/website/docs/users-sources/sources/directory-sync/active-directory/index.md b/website/docs/users-sources/sources/directory-sync/active-directory/index.mdx similarity index 100% rename from website/docs/users-sources/sources/directory-sync/active-directory/index.md rename to website/docs/users-sources/sources/directory-sync/active-directory/index.mdx diff --git a/website/docs/users-sources/sources/directory-sync/freeipa/index.md b/website/docs/users-sources/sources/directory-sync/freeipa/index.mdx similarity index 100% rename from website/docs/users-sources/sources/directory-sync/freeipa/index.md rename to website/docs/users-sources/sources/directory-sync/freeipa/index.mdx diff --git a/website/docs/users-sources/sources/index.md b/website/docs/users-sources/sources/index.mdx similarity index 79% rename from website/docs/users-sources/sources/index.md rename to website/docs/users-sources/sources/index.mdx index 81cc9d66d2..108e4a1d9e 100644 --- a/website/docs/users-sources/sources/index.md +++ b/website/docs/users-sources/sources/index.mdx @@ -10,14 +10,14 @@ Sources allow you to connect authentik to an external user directory. Sources ca Sources are in the following general categories: -- **Protocols** ([Kerberos](./protocols/kerberos/index.md), [LDAP](./protocols/ldap/index.md), [OAuth](./protocols/oauth/index.mdx), [SAML](./protocols/saml/index.md), and [SCIM](./protocols/scim/index.md)) -- [**Property mappings**](./property-mappings/index.md) or how to import data from a source +- **Protocols** ([Kerberos](./protocols/kerberos/index.mdx), [LDAP](./protocols/ldap/index.mdx), [OAuth](./protocols/oauth/index.mdx), [SAML](./protocols/saml/index.mdx), and [SCIM](./protocols/scim/index.mdx)) +- [**Property mappings**](./property-mappings/index.mdx) or how to import data from a source - **Directory synchronization** (Active Directory, FreeIPA) - **Social logins** (Apple, Discord, Twitch, Twitter, and many others) For instructions to add a specific source, refer to the documentation links in the left navigation pane. -Several source types also expose an **Icon** field that uses the shared file picker. See [File picker values](../../customize/file-picker.md). +Several source types also expose an **Icon** field that uses the shared file picker. See [File picker values](../../customize/file-picker.mdx). ## Add sources to default login page @@ -34,4 +34,4 @@ To show sources on the default login screen, add them to the flow. The process b You can bind a policy to a source to control whether or not the users from the source can access an application. -For instructions, refer to [Bind a policy to a source](../../customize/policies/working_with_policies.md#bind-a-policy-to-a-source). +For instructions, refer to [Bind a policy to a source](../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-source). diff --git a/website/docs/users-sources/sources/property-mappings/expressions.md b/website/docs/users-sources/sources/property-mappings/expressions.mdx similarity index 99% rename from website/docs/users-sources/sources/property-mappings/expressions.md rename to website/docs/users-sources/sources/property-mappings/expressions.mdx index 8a72930a2b..06553d65b8 100644 --- a/website/docs/users-sources/sources/property-mappings/expressions.md +++ b/website/docs/users-sources/sources/property-mappings/expressions.mdx @@ -10,7 +10,7 @@ The property mapping should return a value that is expected by the source. Retur - `properties`: A Python dictionary containing the result of the previously run property mappings, plus the initial data computed by the source. - `request`: The current request. This can be `None` if there is no contextual request. See the [Django documentation](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects). -import Objects from "../../../expressions/reference/\_objects.md"; +import Objects from "../../../expressions/reference/\_objects.mdx"; diff --git a/website/docs/users-sources/sources/property-mappings/index.md b/website/docs/users-sources/sources/property-mappings/index.mdx similarity index 88% rename from website/docs/users-sources/sources/property-mappings/index.md rename to website/docs/users-sources/sources/property-mappings/index.mdx index d34719034c..9567d134de 100644 --- a/website/docs/users-sources/sources/property-mappings/index.md +++ b/website/docs/users-sources/sources/property-mappings/index.mdx @@ -7,10 +7,10 @@ Source property mappings allow you to modify or gather extra information from so This page is an overview of how property mappings work. For information about a specific protocol, refer to the protocol page: - [Kerberos](../protocols/kerberos/#kerberos-source-property-mappings) -- [LDAP](../protocols/ldap/index.md#ldap-source-property-mappings) +- [LDAP](../protocols/ldap/index.mdx#ldap-source-property-mappings) - [OAuth](../protocols/oauth/index.mdx#oauth-source-property-mappings) -- [SAML](../protocols/saml/index.md#saml-source-property-mappings) -- [SCIM](../protocols/scim/index.md#scim-source-property-mappings) +- [SAML](../protocols/saml/index.mdx#saml-source-property-mappings) +- [SCIM](../protocols/scim/index.mdx#scim-source-property-mappings) ## Create a custom source property mapping @@ -36,11 +36,11 @@ return { } ``` -You can see that the expression returns a Python dictionary. The dictionary keys must match [User properties](../../user/user_ref.mdx#object-properties) or [Group properties](../../groups/group_ref.md#object-properties). Note that for users, `groups` and `group_attributes` cannot be set. +You can see that the expression returns a Python dictionary. The dictionary keys must match [User properties](../../user/user_ref.mdx#object-properties) or [Group properties](../../groups/group_ref.mdx#object-properties). Note that for users, `groups` and `group_attributes` cannot be set. -See each source documentation for a reference of the available data. See the authentik [expressions documentation](./expressions.md) for available data and functions. +See each source documentation for a reference of the available data. See the authentik [expressions documentation](./expressions.mdx) for available data and functions. -Note that the [`list_flatten`](./expressions.md#list_flattenvalue-listany--any---optionalany) method is applied for all top-level properties, but not for attributes: +Note that the [`list_flatten`](./expressions.mdx#list_flattenvalue-listany--any---optionalany) method is applied for all top-level properties, but not for attributes: ```python return { diff --git a/website/docs/users-sources/sources/protocols/kerberos/browser.md b/website/docs/users-sources/sources/protocols/kerberos/browser.mdx similarity index 100% rename from website/docs/users-sources/sources/protocols/kerberos/browser.md rename to website/docs/users-sources/sources/protocols/kerberos/browser.mdx diff --git a/website/docs/users-sources/sources/protocols/kerberos/index.md b/website/docs/users-sources/sources/protocols/kerberos/index.mdx similarity index 94% rename from website/docs/users-sources/sources/protocols/kerberos/index.md rename to website/docs/users-sources/sources/protocols/kerberos/index.mdx index 315c19da0e..d84ef6ce8e 100644 --- a/website/docs/users-sources/sources/protocols/kerberos/index.md +++ b/website/docs/users-sources/sources/protocols/kerberos/index.mdx @@ -19,7 +19,7 @@ There are three ways to use the Kerberos source: - As a password backend, where users can log in to authentik with their Kerberos password. - As a directory source, where users are synced from the KDC. -- With SPNEGO, where users can log in to authentik with their [browser](./browser.md) and their Kerberos credentials. +- With SPNEGO, where users can log in to authentik with their [browser](./browser.mdx) and their Kerberos credentials. You can choose to use one or more of those methods. @@ -29,12 +29,12 @@ In the authentik Admin interface, under **Directory** > **Federation and Social - Name: a value of your choosing. This name is shown to users if you use the SPNEGO login method. - Slug: `kerberos` -- Icon: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.md). +- Icon: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx). - Realm: `REALM.COMPANY` - Kerberos 5 configuration: If you need to override the default Kerberos configuration, you can do it here. See [man krb5.conf(5)](https://web.mit.edu/kerberos/krb5-latest/doc/admin/conf_files/krb5_conf.html) for the expected format. - User matching mode: define how Kerberos users get matched to authentik users. - Group matching mode: define how Kerberos groups (specified via property mappings) get matched to authentik groups. -- User property mappings and group property mappings: see [Source property mappings](../../property-mappings/index.md) and the section below for details. +- User property mappings and group property mappings: see [Source property mappings](../../property-mappings/index.mdx) and the section below for details. ## Password backend @@ -86,7 +86,7 @@ If you do not wish to use a keytab, you can also configure authentik to use an e You can also override the SPNEGO server name if needed. -You might need to configure your web browser to allow SPNEGO. Check out [our documentation](./browser.md) on how to do so. You can now log in to authentik using SPNEGO. +You might need to configure your web browser to allow SPNEGO. Check out [our documentation](./browser.mdx) on how to do so. You can now log in to authentik using SPNEGO. ### Custom server name @@ -103,7 +103,7 @@ There are some extra settings you can configure: ## Kerberos source property mappings -See the [overview](../../property-mappings/index.md) for information on how property mappings work with external sources. +See the [overview](../../property-mappings/index.mdx) for information on how property mappings work with external sources. By default, authentik ships with [pre-configured mappings](#built-in-property-mappings) for the most common Kerberos setups. These mappings can be found on the Kerberos Source Configuration page in the Admin interface. diff --git a/website/docs/users-sources/sources/protocols/ldap/index.md b/website/docs/users-sources/sources/protocols/ldap/index.mdx similarity index 97% rename from website/docs/users-sources/sources/protocols/ldap/index.md rename to website/docs/users-sources/sources/protocols/ldap/index.mdx index df51e4312e..0533d350dd 100644 --- a/website/docs/users-sources/sources/protocols/ldap/index.md +++ b/website/docs/users-sources/sources/protocols/ldap/index.mdx @@ -5,9 +5,9 @@ title: LDAP source Sources allow you to connect authentik to an existing user directory. This source allows you to import users and groups from an LDAP server. :::info -For Active Directory, follow the [Active Directory integration](../../directory-sync/active-directory/index.md). +For Active Directory, follow the [Active Directory integration](../../directory-sync/active-directory/index.mdx). -For FreeIPA, follow the [FreeIPA integration](../../directory-sync/freeipa/index.md). +For FreeIPA, follow the [FreeIPA integration](../../directory-sync/freeipa/index.mdx). ::: ## Configuration options for LDAP sources @@ -63,7 +63,7 @@ If the LDAP server rejects the TLS handshake, verify that **Server URI**, **Enab ## LDAP source property mappings -See the [overview](../../property-mappings/index.md) for information on how property mappings work. +See the [overview](../../property-mappings/index.mdx) for information on how property mappings work. By default, authentik ships with [pre-configured mappings](#built-in-property-mappings) for the most common LDAP setups. These mappings can be found on the LDAP Source Configuration page in the Admin interface. @@ -154,4 +154,4 @@ Be aware of the following security considerations when turning on this functiona ## Troubleshooting -To troubleshoot LDAP sources and their synchronization, see [LDAP Troubleshooting](../../../../troubleshooting/ldap_source.md). +To troubleshoot LDAP sources and their synchronization, see [LDAP Troubleshooting](../../../../troubleshooting/ldap_source.mdx). diff --git a/website/docs/users-sources/sources/protocols/oauth/index.mdx b/website/docs/users-sources/sources/protocols/oauth/index.mdx index aa5b948218..5f494731d4 100644 --- a/website/docs/users-sources/sources/protocols/oauth/index.mdx +++ b/website/docs/users-sources/sources/protocols/oauth/index.mdx @@ -5,7 +5,7 @@ title: OAuth source This source allows users to enroll themselves with an external OAuth-based identity provider. The generic provider expects the endpoint to return OpenID Connect-compatible information. Vendor-specific implementations have their own OAuth source. - Policies: Allow/Forbid users from linking their accounts with this provider. -- Icon: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.md). +- Icon: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx). - Request Token URL: This field is used for OAuth v1 implementations and will be provided by the provider. - Authorization URL: This value will be provided by the provider. - Access Token URL: This value will be provided by the provider. @@ -35,7 +35,7 @@ If the OAuth authentication was started from within an authentik flow and the us ## OAuth source property mappings -See the [overview](../../property-mappings/index.md) for information on how property mappings work. +See the [overview](../../property-mappings/index.mdx) for information on how property mappings work. ### Expression data diff --git a/website/docs/users-sources/sources/protocols/saml/index.md b/website/docs/users-sources/sources/protocols/saml/index.mdx similarity index 96% rename from website/docs/users-sources/sources/protocols/saml/index.md rename to website/docs/users-sources/sources/protocols/saml/index.mdx index 9fb4b2fdd0..050163ee8c 100644 --- a/website/docs/users-sources/sources/protocols/saml/index.md +++ b/website/docs/users-sources/sources/protocols/saml/index.mdx @@ -2,7 +2,7 @@ title: SAML source --- -This source allows authentik to act as a SAML service provider. Like the [SAML provider](../../../../add-secure-apps/providers/saml/index.md), it supports signed requests. Vendor-specific documentation is available in the integrations section. +This source allows authentik to act as a SAML service provider. Like the [SAML provider](../../../../add-secure-apps/providers/saml/index.mdx), it supports signed requests. Vendor-specific documentation is available in the integrations section. ## Terminology @@ -23,7 +23,7 @@ If you have the provider metadata, you can extract the values that you need from | -------------------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | Company SAML | The name of the authentication source | | Slug | company-saml | The slug used in URLs for the source | -| Icon | `branding/company-icon.svg` | Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.md). | +| Icon | `branding/company-icon.svg` | Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx). | | SSO URL | https://saml.company/login/saml | The SingleSignOnService URL for the IdP. This value can be found in the metadata or IdP documentation. There can be different URLs for different binding types, such as HTTP-Redirect and HTTP-POST. Use the URL for the binding type that you choose below. | | SLO URL | https://saml.company/logout/saml | The URL that is called when a user logs out of authentik. This can be used to automatically log the user out of the SAML IdP after logging out of authentik. Not all IdPs support or require this behavior. | | Binding Type | HTTP-POST | How authentik communicates with the SSO URL (302 redirect or POST request). This will depend on what the provider supports. | @@ -85,11 +85,11 @@ This depends on the software that you use for your IdP. On the **Metadata** tab ## SAML source property mappings -See the [overview](../../property-mappings/index.md) for information on how property mappings work. +See the [overview](../../property-mappings/index.mdx) for information on how property mappings work. SAML source property mappings customize the user and group properties created from a SAML assertion. authentik parses the assertion's `AttributeStatement` into the `properties` dictionary before custom mappings run, using each SAML attribute's `Name` as the dictionary key. Custom mappings can then translate those SAML attribute names to authentik user fields such as `username`, `email`, `name`, and `attributes`. -Property mappings do not change the internal SAML source connection identifier, which is based on the assertion's NameID. To persist mapped user fields, ensure the source flow that runs for the user includes a [User Write stage](../../../../add-secure-apps/flows-stages/stages/user_write/index.md) before the user login stage. For existing users, this is the source's authentication flow; for new users, this is the source's enrollment flow. +Property mappings do not change the internal SAML source connection identifier, which is based on the assertion's NameID. To persist mapped user fields, ensure the source flow that runs for the user includes a [User Write stage](../../../../add-secure-apps/flows-stages/stages/user_write/index.mdx) before the user login stage. For existing users, this is the source's authentication flow; for new users, this is the source's enrollment flow. ### Expression data diff --git a/website/docs/users-sources/sources/protocols/scim/index.md b/website/docs/users-sources/sources/protocols/scim/index.mdx similarity index 97% rename from website/docs/users-sources/sources/protocols/scim/index.md rename to website/docs/users-sources/sources/protocols/scim/index.mdx index 2741e7ff2c..7cbae8b6eb 100644 --- a/website/docs/users-sources/sources/protocols/scim/index.md +++ b/website/docs/users-sources/sources/protocols/scim/index.mdx @@ -59,7 +59,7 @@ Fresh installs create a superuser group named **`authentik Admins`** (`is_superu ## SCIM source property mappings -See the [overview](../../property-mappings/index.md) for information on how property mappings work. +See the [overview](../../property-mappings/index.mdx) for information on how property mappings work. ### Expression data diff --git a/website/docs/users-sources/sources/social-logins/apple/index.md b/website/docs/users-sources/sources/social-logins/apple/index.mdx similarity index 97% rename from website/docs/users-sources/sources/social-logins/apple/index.md rename to website/docs/users-sources/sources/social-logins/apple/index.mdx index 6e2e1eff8f..b1a547ff67 100644 --- a/website/docs/users-sources/sources/social-logins/apple/index.md +++ b/website/docs/users-sources/sources/social-logins/apple/index.mdx @@ -72,7 +72,7 @@ To support the integration of Apple with authentik, you need to create an Apple 3. Click **Save**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -81,4 +81,4 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. diff --git a/website/docs/users-sources/sources/social-logins/cas/index.md b/website/docs/users-sources/sources/social-logins/cas/index.mdx similarity index 99% rename from website/docs/users-sources/sources/social-logins/cas/index.md rename to website/docs/users-sources/sources/social-logins/cas/index.mdx index 086d2490d9..1c1baacdd8 100644 --- a/website/docs/users-sources/sources/social-logins/cas/index.md +++ b/website/docs/users-sources/sources/social-logins/cas/index.mdx @@ -111,7 +111,7 @@ To support the integration of CAS with authentik, you need to create an OpenID C authentik reads the authorization, token, user info, and JWKS URLs from the well-known URL, so you do not need to enter them individually. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise diff --git a/website/docs/users-sources/sources/social-logins/discord/index.md b/website/docs/users-sources/sources/social-logins/discord/index.mdx similarity index 99% rename from website/docs/users-sources/sources/social-logins/discord/index.md rename to website/docs/users-sources/sources/social-logins/discord/index.mdx index 12cdf82d71..67491bf51a 100644 --- a/website/docs/users-sources/sources/social-logins/discord/index.md +++ b/website/docs/users-sources/sources/social-logins/discord/index.mdx @@ -40,7 +40,7 @@ To integrate Discord with authentik, create an OAuth application in the Discord 3. Click **Save**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -67,7 +67,7 @@ Ensure that the Discord OAuth source in **Federation and Social login** has the ::: :::info Avatar Setting -To use the created avatar attribute in authentik you need to set the [authentik avatar configuration](../../../../sys-mgmt/settings.md#avatars). +To use the created avatar attribute in authentik you need to set the [authentik avatar configuration](../../../../sys-mgmt/settings.mdx#avatars). ::: 1. Log in to authentik as an administrator and open the authentik Admin interface. diff --git a/website/docs/users-sources/sources/social-logins/entra-id/index.mdx b/website/docs/users-sources/sources/social-logins/entra-id/index.mdx index f31e339737..44f18ba240 100644 --- a/website/docs/users-sources/sources/social-logins/entra-id/index.mdx +++ b/website/docs/users-sources/sources/social-logins/entra-id/index.mdx @@ -9,7 +9,7 @@ tags: - oauth --- -There are several ways that Entra ID can be integrated with authentik to allow for user and group provisioning and authentication with Entra ID user credentials. If you are instead looking to authenticate to Entra ID with authentik credentials, refer to our [Microsoft 365 SAML](/integrations/platforms/microsoft-saml/index.md) or [Microsoft 365 WS-Federation](/integrations/platforms/microsoft-ws-federation/index.md) integrations guides. +There are several ways that Entra ID can be integrated with authentik to allow for user and group provisioning and authentication with Entra ID user credentials. If you are instead looking to authenticate to Entra ID with authentik credentials, refer to our [Microsoft 365 SAML](/integrations/platforms/microsoft-saml/index.mdx) or [Microsoft 365 WS-Federation](/integrations/platforms/microsoft-ws-federation/index.mdx) integrations guides. ## OAuth diff --git a/website/docs/users-sources/sources/social-logins/entra-id/oauth/index.mdx b/website/docs/users-sources/sources/social-logins/entra-id/oauth/index.mdx index 1740ca882a..61cd750a0c 100644 --- a/website/docs/users-sources/sources/social-logins/entra-id/oauth/index.mdx +++ b/website/docs/users-sources/sources/social-logins/entra-id/oauth/index.mdx @@ -84,7 +84,7 @@ For organizations with larger numbers of users and groups, we recommend using th ::: :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -112,7 +112,7 @@ The JWT returned from the request above can be used in authentik and exchanged f ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/facebook/index.md b/website/docs/users-sources/sources/social-logins/facebook/index.mdx similarity index 97% rename from website/docs/users-sources/sources/social-logins/facebook/index.md rename to website/docs/users-sources/sources/social-logins/facebook/index.mdx index 233e1a2819..0412933f40 100644 --- a/website/docs/users-sources/sources/social-logins/facebook/index.md +++ b/website/docs/users-sources/sources/social-logins/facebook/index.mdx @@ -59,7 +59,7 @@ To support the integration of Facebook with authentik, you need to create a Face 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -68,7 +68,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/github/index.mdx b/website/docs/users-sources/sources/social-logins/github/index.mdx index 057e2bd895..252fd01334 100644 --- a/website/docs/users-sources/sources/social-logins/github/index.mdx +++ b/website/docs/users-sources/sources/social-logins/github/index.mdx @@ -43,7 +43,7 @@ To support the integration of GitHub with authentik, you need to create a GitHub 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -118,6 +118,6 @@ If a user is not a member of the chosen organization, they will see this message ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/gitlab/index.mdx b/website/docs/users-sources/sources/social-logins/gitlab/index.mdx index 2a1035d8d1..f18be0d188 100644 --- a/website/docs/users-sources/sources/social-logins/gitlab/index.mdx +++ b/website/docs/users-sources/sources/social-logins/gitlab/index.mdx @@ -54,7 +54,7 @@ To support the integration of GitLab with authentik, you need to create a GitLab 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -63,7 +63,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/google/cloud/index.md b/website/docs/users-sources/sources/social-logins/google/cloud/index.mdx similarity index 97% rename from website/docs/users-sources/sources/social-logins/google/cloud/index.md rename to website/docs/users-sources/sources/social-logins/google/cloud/index.mdx index ba6ab217b6..05ba322a4d 100644 --- a/website/docs/users-sources/sources/social-logins/google/cloud/index.md +++ b/website/docs/users-sources/sources/social-logins/google/cloud/index.mdx @@ -76,7 +76,7 @@ To support the integration of Google with authentik, you need to create a Google 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -113,4 +113,4 @@ return False If using the default enrollment flow the policy should be bound to the **default-source-enrollment-prompt** stage. Ensure that the policy comes before **default-source-enrollment-if-username**. ::: -Afterward, any new logins will automatically use the user's Google email address as their username. This can be combined with disallowing users from changing their usernames; see [Configuration](../../../../../sys-mgmt/settings.md#allow-users-to-change-username). +Afterward, any new logins will automatically use the user's Google email address as their username. This can be combined with disallowing users from changing their usernames; see [Configuration](../../../../../sys-mgmt/settings.mdx#allow-users-to-change-username). diff --git a/website/docs/users-sources/sources/social-logins/google/index.mdx b/website/docs/users-sources/sources/social-logins/google/index.mdx index 1427212ff0..af8b96c50e 100644 --- a/website/docs/users-sources/sources/social-logins/google/index.mdx +++ b/website/docs/users-sources/sources/social-logins/google/index.mdx @@ -22,10 +22,10 @@ For more information, see the [Google Workspace Integration](/integrations/cloud Google Cloud Identity Platform provides OAuth 2.0 as a federated identity provider. This configuration guide shows how to set up OAuth 2.0 as the authentication method between Google and authentik. -[Configure Google Cloud with authentik](./cloud/index.md) +[Configure Google Cloud with authentik](./cloud/index.mdx) ## Google Workspace (SAML) Google Workspace (formerly G Suite) allows users to authenticate to applications using their company email addresses. This configuration guide shows how to set up Security Assertion Markup Language (SAML) as the authentication method between Google Workspace and authentik. -[Configure Google Workspace with authentik](./workspace/index.md) +[Configure Google Workspace with authentik](./workspace/index.mdx) diff --git a/website/docs/users-sources/sources/social-logins/google/workspace/index.md b/website/docs/users-sources/sources/social-logins/google/workspace/index.mdx similarity index 98% rename from website/docs/users-sources/sources/social-logins/google/workspace/index.md rename to website/docs/users-sources/sources/social-logins/google/workspace/index.mdx index 3148562e0d..1534c51e66 100644 --- a/website/docs/users-sources/sources/social-logins/google/workspace/index.md +++ b/website/docs/users-sources/sources/social-logins/google/workspace/index.mdx @@ -123,7 +123,7 @@ authentik acts as both a service provider (SP) to Google and an identity provide 4. Click **Finish**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise diff --git a/website/docs/users-sources/sources/social-logins/jumpcloud/index.mdx b/website/docs/users-sources/sources/social-logins/jumpcloud/index.mdx index 6bf5684e4e..088f201fcd 100644 --- a/website/docs/users-sources/sources/social-logins/jumpcloud/index.mdx +++ b/website/docs/users-sources/sources/social-logins/jumpcloud/index.mdx @@ -148,12 +148,12 @@ To support the integration of JumpCloud with authentik, create a JumpCloud OpenI :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/keycloak/index.md b/website/docs/users-sources/sources/social-logins/keycloak/index.mdx similarity index 98% rename from website/docs/users-sources/sources/social-logins/keycloak/index.md rename to website/docs/users-sources/sources/social-logins/keycloak/index.mdx index e8423b19b0..8dd21ae7e2 100644 --- a/website/docs/users-sources/sources/social-logins/keycloak/index.md +++ b/website/docs/users-sources/sources/social-logins/keycloak/index.mdx @@ -105,7 +105,7 @@ Before configuring either service, you need to export the signing certificates f 3. Click **Finish**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise diff --git a/website/docs/users-sources/sources/social-logins/mailcow/index.md b/website/docs/users-sources/sources/social-logins/mailcow/index.mdx similarity index 96% rename from website/docs/users-sources/sources/social-logins/mailcow/index.md rename to website/docs/users-sources/sources/social-logins/mailcow/index.mdx index f7f7d2d878..3a85d56713 100644 --- a/website/docs/users-sources/sources/social-logins/mailcow/index.md +++ b/website/docs/users-sources/sources/social-logins/mailcow/index.mdx @@ -41,7 +41,7 @@ To integrate Mailcow with authentik, create an OAuth application in Mailcow. 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -50,4 +50,4 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. diff --git a/website/docs/users-sources/sources/social-logins/okta/index.md b/website/docs/users-sources/sources/social-logins/okta/index.mdx similarity index 97% rename from website/docs/users-sources/sources/social-logins/okta/index.md rename to website/docs/users-sources/sources/social-logins/okta/index.mdx index cfdf31feb9..8877a2e1af 100644 --- a/website/docs/users-sources/sources/social-logins/okta/index.md +++ b/website/docs/users-sources/sources/social-logins/okta/index.mdx @@ -50,7 +50,7 @@ To support the integration of Okta with authentik, you need to create an Okta OA 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -59,7 +59,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/plex/index.md b/website/docs/users-sources/sources/social-logins/plex/index.mdx similarity index 91% rename from website/docs/users-sources/sources/social-logins/plex/index.md rename to website/docs/users-sources/sources/social-logins/plex/index.mdx index 3f6a00c4e9..66aee21ce7 100644 --- a/website/docs/users-sources/sources/social-logins/plex/index.md +++ b/website/docs/users-sources/sources/social-logins/plex/index.mdx @@ -20,7 +20,7 @@ To support the integration of Plex with authentik, you need to create a Plex sou 2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings: - **Select type**: select **Plex Source** as the source type. - **Create Plex Source**: provide a name, a slug, and set the following required configurations: - - **Icon**: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.md). + - **Icon**: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx). - **Protocol settings** - **Client ID**: Set a unique Client ID or leave the generated ID - Click **Load servers** to log in to Plex and pick the authorized Plex servers for "allowed users". @@ -28,7 +28,7 @@ To support the integration of Plex with authentik, you need to create a Plex sou 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -37,4 +37,4 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. diff --git a/website/docs/users-sources/sources/social-logins/shibboleth/index.md b/website/docs/users-sources/sources/social-logins/shibboleth/index.mdx similarity index 97% rename from website/docs/users-sources/sources/social-logins/shibboleth/index.md rename to website/docs/users-sources/sources/social-logins/shibboleth/index.mdx index 73156fb1bf..63476646a5 100644 --- a/website/docs/users-sources/sources/social-logins/shibboleth/index.md +++ b/website/docs/users-sources/sources/social-logins/shibboleth/index.mdx @@ -40,7 +40,7 @@ To integrate Shibboleth with authentik, create a SAML source in authentik. 4. Click **Finish**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -67,7 +67,7 @@ To integrate Shibboleth with authentik, add authentik as a service provider in y ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/telegram/index.md b/website/docs/users-sources/sources/social-logins/telegram/index.mdx similarity index 92% rename from website/docs/users-sources/sources/social-logins/telegram/index.md rename to website/docs/users-sources/sources/social-logins/telegram/index.mdx index 4d20ced4aa..48af7c0c47 100644 --- a/website/docs/users-sources/sources/social-logins/telegram/index.md +++ b/website/docs/users-sources/sources/social-logins/telegram/index.mdx @@ -37,12 +37,12 @@ After the bot is configured, create a source in authentik. 3. Click **Save**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: ## Telegram source property mappings -[Property mappings](../../property-mappings/index.md) can be used to map Telegram user properties to authentik user properties. +[Property mappings](../../property-mappings/index.mdx) can be used to map Telegram user properties to authentik user properties. ### Expression data diff --git a/website/docs/users-sources/sources/social-logins/twitch/index.md b/website/docs/users-sources/sources/social-logins/twitch/index.mdx similarity index 96% rename from website/docs/users-sources/sources/social-logins/twitch/index.md rename to website/docs/users-sources/sources/social-logins/twitch/index.mdx index f34a0dbbb8..3ea9bb47e4 100644 --- a/website/docs/users-sources/sources/social-logins/twitch/index.md +++ b/website/docs/users-sources/sources/social-logins/twitch/index.mdx @@ -45,7 +45,7 @@ To support the integration of Twitch with authentik, create a Twitch OAuth sourc 3. Click **Finish** to save your settings. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -54,7 +54,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/twitter/index.md b/website/docs/users-sources/sources/social-logins/twitter/index.mdx similarity index 96% rename from website/docs/users-sources/sources/social-logins/twitter/index.md rename to website/docs/users-sources/sources/social-logins/twitter/index.mdx index 2989cf772c..44964a6168 100644 --- a/website/docs/users-sources/sources/social-logins/twitter/index.md +++ b/website/docs/users-sources/sources/social-logins/twitter/index.mdx @@ -47,7 +47,7 @@ To support the integration of X with authentik, you need to create a Twitter OAu 3. Click **Finish**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -56,7 +56,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. ## Resources diff --git a/website/docs/users-sources/sources/social-logins/wechat/index.md b/website/docs/users-sources/sources/social-logins/wechat/index.mdx similarity index 97% rename from website/docs/users-sources/sources/social-logins/wechat/index.md rename to website/docs/users-sources/sources/social-logins/wechat/index.mdx index 8c86063366..964949a867 100644 --- a/website/docs/users-sources/sources/social-logins/wechat/index.md +++ b/website/docs/users-sources/sources/social-logins/wechat/index.mdx @@ -43,7 +43,7 @@ To support the integration of WeChat with authentik, you need to create a WeChat 3. Click **Finish**. :::info Display new source on login screen -For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.md#add-sources-to-default-login-page). +For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page). ::: :::info Embed new source in flow :ak-enterprise @@ -52,7 +52,7 @@ For instructions on embedding the new source within a flow, such as an authoriza ## Source property mappings -Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.md) for more information. +Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information. The following data is retrieved from WeChat and mapped to the user's attributes in authentik: diff --git a/website/docs/users-sources/user/account-types/agent-accounts.md b/website/docs/users-sources/user/account-types/agent-accounts.mdx similarity index 97% rename from website/docs/users-sources/user/account-types/agent-accounts.md rename to website/docs/users-sources/user/account-types/agent-accounts.mdx index cdf5fda3e3..a7aeac7d9c 100644 --- a/website/docs/users-sources/user/account-types/agent-accounts.md +++ b/website/docs/users-sources/user/account-types/agent-accounts.mdx @@ -7,7 +7,7 @@ authentik_version: "2026.8" Agent accounts are service accounts that act on behalf of a parent user when calling the authentik API. Use them for automation, integrations, and other machine identities that need delegated access. -For an overview of all account types, see [Account types](./index.mdx). For general information about service accounts, see [Service accounts](./service-accounts.md). +For an overview of all account types, see [Account types](./index.mdx). For general information about service accounts, see [Service accounts](./service-accounts.mdx). :::info Agent accounts vs the authentik Agent Agent accounts are separate from the authentik Agent. The authentik Agent is a deployable component on Windows, Linux, and macOS devices for device integration with authentik. For more information, see [authentik Agent](../../../endpoint-devices/authentik-agent/index.mdx). @@ -177,7 +177,7 @@ Agent accounts start with no special access beyond their ability to authenticate - Configure policies. - Use the agent's policy behavior to inherit access from its parent. -For more information, see [Manage permissions](../../access-control/manage_permissions.md). +For more information, see [Manage permissions](../../access-control/manage_permissions.mdx). ## Authenticate with an agent token @@ -217,7 +217,7 @@ The agent's expiration and the token's expiration are separate: - The API token created for an agent always expires using the default token duration. - On expiry the token is deleted and not rotated unlike the other service account tokens. -Agent tokens are managed in the same token system as other authentik tokens. See [Service accounts](./service-accounts.md) for general token-management information. +Agent tokens are managed in the same token system as other authentik tokens. See [Service accounts](./service-accounts.mdx) for general token-management information. Users with the `Can view token` permission can retrieve their agents' tokens from the **Agents** page by clicking the **Copy token** icon next to the agent. @@ -263,7 +263,7 @@ Agent audit data identifies: Service accounts without a parent user are attributed to themselves. -Review [Events](../../../sys-mgmt/events/index.md) when investigating agent activity or validating that an integration has the expected access. +Review [Events](../../../sys-mgmt/events/index.mdx) when investigating agent activity or validating that an integration has the expected access. ## Troubleshooting diff --git a/website/docs/users-sources/user/account-types/external-users.md b/website/docs/users-sources/user/account-types/external-users.mdx similarity index 78% rename from website/docs/users-sources/user/account-types/external-users.md rename to website/docs/users-sources/user/account-types/external-users.mdx index 08aff06860..b52a09c6b7 100644 --- a/website/docs/users-sources/user/account-types/external-users.md +++ b/website/docs/users-sources/user/account-types/external-users.mdx @@ -9,13 +9,13 @@ External users cannot access the application dashboard. They therefore do not ha For an overview of all account types, see [Account types](./index.mdx). -For information on creating and managing external users, see [Managing users](../user_basic_operations.md). +For information on creating and managing external users, see [Managing users](../user_basic_operations.mdx). ## Application access External users typically authenticate to a single default application. After successful authentication, authentik redirects them to the application configured for the authentication request or to the brand's default application. -Configure a default application for [brands](../../../customize/branding/index.md#external-user-settings) used by external users. Without a default application, an external user who signs in without requesting a specific application receives an access-denied page. +Configure a default application for [brands](../../../customize/branding/index.mdx#external-user-settings) used by external users. Without a default application, an external user who signs in without requesting a specific application receives an access-denied page. ## Access user settings @@ -32,4 +32,4 @@ Use an external user account for: - Users who need access to a single application. - Users who should not see the application dashboard or other available applications. -Use an [internal user](./internal-users.md) when someone needs access to the application dashboard to launch multiple applications or manage their user settings from the user interface. +Use an [internal user](./internal-users.mdx) when someone needs access to the application dashboard to launch multiple applications or manage their user settings from the user interface. diff --git a/website/docs/users-sources/user/account-types/index.mdx b/website/docs/users-sources/user/account-types/index.mdx index bfb78d389d..d2d1b3db11 100644 --- a/website/docs/users-sources/user/account-types/index.mdx +++ b/website/docs/users-sources/user/account-types/index.mdx @@ -8,19 +8,19 @@ authentik supports several account types that represent people and machine ident The available account types are: -- [**Internal users**](./internal-users.md): human users whose accounts are created and managed in authentik. -- [**External users**](./external-users.md): human users who typically authenticate to a single application and cannot access the authentik application dashboard. -- [**Service accounts**](./service-accounts.md): non-human identities created by an administrator for integrations and automation. -- [**Internal service accounts**](./service-accounts.md): non-human identities created and managed by authentik for internal components. They can not be created by administrators. -- [**Agent accounts**](./agent-accounts.md): non-human identities that act on behalf of a parent user. +- [**Internal users**](./internal-users.mdx): human users whose accounts are created and managed in authentik. +- [**External users**](./external-users.mdx): human users who typically authenticate to a single application and cannot access the authentik application dashboard. +- [**Service accounts**](./service-accounts.mdx): non-human identities created by an administrator for integrations and automation. +- [**Internal service accounts**](./service-accounts.mdx): non-human identities created and managed by authentik for internal components. They can not be created by administrators. +- [**Agent accounts**](./agent-accounts.mdx): non-human identities that act on behalf of a parent user. ## Choose an account type Use the following table to choose an account type: -| Requirement | Account type | -| -------------------------------------------------------------------------- | ---------------------------------------- | -| A user that needs access to the application dashboard | [Internal user](./internal-users.md) | -| A user that does not need access to the application dashboard | [External user](./external-users.md) | -| An administrator needs a machine identity for an integration or automation | [Service account](./service-accounts.md) | -| An integration needs to act on behalf of a specific user | [Agent account](./agent-accounts.md) | +| Requirement | Account type | +| -------------------------------------------------------------------------- | ----------------------------------------- | +| A user that needs access to the application dashboard | [Internal user](./internal-users.mdx) | +| A user that does not need access to the application dashboard | [External user](./external-users.mdx) | +| An administrator needs a machine identity for an integration or automation | [Service account](./service-accounts.mdx) | +| An integration needs to act on behalf of a specific user | [Agent account](./agent-accounts.mdx) | diff --git a/website/docs/users-sources/user/account-types/internal-users.md b/website/docs/users-sources/user/account-types/internal-users.mdx similarity index 88% rename from website/docs/users-sources/user/account-types/internal-users.md rename to website/docs/users-sources/user/account-types/internal-users.mdx index aea8cb6b2f..c2c733aeda 100644 --- a/website/docs/users-sources/user/account-types/internal-users.md +++ b/website/docs/users-sources/user/account-types/internal-users.mdx @@ -7,7 +7,7 @@ Internal users are accounts for people who need the authentik application dashbo An internal user can sign in to the authentik application dashboard and launch any application available to them. They can also open their user settings from the authentik -For an overview of all account types, see [Account types](./index.mdx). For information on creating and managing internal users, see [Managing users](../user_basic_operations.md). +For an overview of all account types, see [Account types](./index.mdx). For information on creating and managing internal users, see [Managing users](../user_basic_operations.mdx). ## Application dashboard @@ -38,4 +38,4 @@ Use an internal user account for: - Users who need to access user settings through the authentik user interface. - Administrators and other users who need to manage authentik, subject to their permissions. -Use an [external user](./external-users.md) when the user typically authenticates to a single application and does not need the application dashboard. +Use an [external user](./external-users.mdx) when the user typically authenticates to a single application and does not need the application dashboard. diff --git a/website/docs/users-sources/user/account-types/service-accounts.md b/website/docs/users-sources/user/account-types/service-accounts.mdx similarity index 98% rename from website/docs/users-sources/user/account-types/service-accounts.md rename to website/docs/users-sources/user/account-types/service-accounts.mdx index ebc8c36490..c953f0fc31 100644 --- a/website/docs/users-sources/user/account-types/service-accounts.md +++ b/website/docs/users-sources/user/account-types/service-accounts.mdx @@ -15,7 +15,7 @@ authentik has three service account types: - **User-created service accounts**: accounts created by administrators for external systems or automation. These accounts appear under **Directory** > **Users** with the `Service account` user type. - **Internal service accounts**: accounts created and managed by authentik for internal components, such as outpost communication. These accounts cannot be created manually, converted to another user type, or edited like regular users. -- **Agent accounts**: accounts that act on behalf of a parent user. See [Agent accounts](./agent-accounts.md). +- **Agent accounts**: accounts that act on behalf of a parent user. See [Agent accounts](./agent-accounts.mdx). ## How service accounts work @@ -115,7 +115,7 @@ You can grant access in the same ways as regular users: - Grant object permissions directly to the service account when access should not be shared with other accounts. - Use application [bindings](../../../add-secure-apps/applications/manage_apps.mdx#use-bindings-to-control-access) or policies to restrict which applications the service account can access. -For more information about assigning permissions, see [Manage permissions](../../access-control/manage_permissions.md). +For more information about assigning permissions, see [Manage permissions](../../access-control/manage_permissions.mdx). ### Example: LDAP search account diff --git a/website/docs/users-sources/user/index.mdx b/website/docs/users-sources/user/index.mdx index 63c84f45da..35f0d07e82 100644 --- a/website/docs/users-sources/user/index.mdx +++ b/website/docs/users-sources/user/index.mdx @@ -8,7 +8,7 @@ import DocCardList from "@theme/DocCardList"; In authentik you can create and manage users with fine-tuned access control, session and event details, group membership, role assignment, super-user rights, impersonation, and password management and recovery. -To learn more about Enterprise licenses with internal and external users, refer to [Manage Enterprise licensing](../../enterprise/manage-enterprise.md#about-users-and-licenses). +To learn more about Enterprise licenses with internal and external users, refer to [Manage Enterprise licensing](../../enterprise/manage-enterprise.mdx#about-users-and-licenses). To learn more about working with users in authentik, refer to the following topics: diff --git a/website/docs/users-sources/user/invitations.md b/website/docs/users-sources/user/invitations.mdx similarity index 99% rename from website/docs/users-sources/user/invitations.md rename to website/docs/users-sources/user/invitations.mdx index 1afaeb4039..15b4e65c8c 100644 --- a/website/docs/users-sources/user/invitations.md +++ b/website/docs/users-sources/user/invitations.mdx @@ -47,7 +47,7 @@ The invitation wizard, available from the **Directory** > **Invitations** page i - **Name**: provide a slug-style name for your invitation object (lowercase letters, numbers, and hyphens only). - **Expires**: select a date and time for when the invitation should expire. Defaults to 48 hours from now. - **Flow**: read-only; reflects the flow chosen in the previous step. -- **Custom attributes**: (_optional_) YAML or JSON that is loaded into the flow's `prompt_data` context to pre-fill user information. Field keys must match the keys configured in the flow's [prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.md). See the [example custom attributes](#step-3-create-the-invitation-object) below for sample payloads. +- **Custom attributes**: (_optional_) YAML or JSON that is loaded into the flow's `prompt_data` context to pre-fill user information. Field keys must match the keys configured in the flow's [prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.mdx). See the [example custom attributes](#step-3-create-the-invitation-object) below for sample payloads. - **Single use**: when enabled, the invitation is deleted after the first successful enrollment. Click **Next** to create the invitation. If you chose **with New Enrollment Flow and Invitation Stage...**, the supporting blueprint is imported at this point as well. @@ -158,7 +158,7 @@ Configure the following settings: :::info - The field keys (e.g., `email`, `name`) must match the field keys configured in your flow's [prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.md). + The field keys (e.g., `email`, `name`) must match the field keys configured in your flow's [prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.mdx). ::: - **Single use**: Specify whether the invitation should expire after a single use. diff --git a/website/docs/users-sources/user/password_reset_on_login.mdx b/website/docs/users-sources/user/password_reset_on_login.mdx index 74d2f4e2e8..59292db4c5 100644 --- a/website/docs/users-sources/user/password_reset_on_login.mdx +++ b/website/docs/users-sources/user/password_reset_on_login.mdx @@ -63,7 +63,7 @@ You'll need to create two stages; a _Prompt stage_ to prompt the user to enter a - _(Optional but recommended)_ Select `default-password-change-policy`. :::tip -Optionally, you can create and add a text field to the prompt stage to inform users that they are required to reset their password. For more details on configuring this, refer to the [Prompt Stage documentation](../../add-secure-apps/flows-stages/stages/prompt/index.md). +Optionally, you can create and add a text field to the prompt stage to inform users that they are required to reset their password. For more details on configuring this, refer to the [Prompt Stage documentation](../../add-secure-apps/flows-stages/stages/prompt/index.mdx). ::: 5. Click **Next** to create the stage and then configure the following settings for the binding: diff --git a/website/docs/users-sources/user/user-interface.mdx b/website/docs/users-sources/user/user-interface.mdx index 304ab585ad..00c5eb51dd 100644 --- a/website/docs/users-sources/user/user-interface.mdx +++ b/website/docs/users-sources/user/user-interface.mdx @@ -4,7 +4,7 @@ sidebar_label: User interface sidebar_position: 5 --- -End-users who are accessing their applications via authentik typically only access the User interface, not the Admin interface. (There are exceptions; some end-users have [permissions to also access the Admin interface](../../users-sources/access-control/manage_permissions.md#assign-can-access-admin-interface-permissions), while some end-users never go to the User interface, but rather [log directly into their application](/customize/branding/index.md#external-user-settings) using authentik behind the scenes.) +End-users who are accessing their applications via authentik typically only access the User interface, not the Admin interface. (There are exceptions; some end-users have [permissions to also access the Admin interface](../../users-sources/access-control/manage_permissions.mdx#assign-can-access-admin-interface-permissions), while some end-users never go to the User interface, but rather [log directly into their application](/customize/branding/index.mdx#external-user-settings) using authentik behind the scenes.) Conversely, administrators for an authentik instance work primarily in the Admin interface; that is where administrators add applications, create new users and groups, manage system settings, and more. @@ -22,11 +22,11 @@ To view your own settings click the gear icon in the upper right. The following This section of the User interface displays (and allows you to edit if you have the requisite permissions) the fields below. Note that these are the options available in a default authentik instance; administrators can customize which options show up here. -- **Username**: the username is the unique identifier associated with the user, and is required for logging in. This value can only be edited by the user if the [global System settings](../../sys-mgmt/settings.md#allow-users-to-change-username) are configured to allow all users to change their username, or if the attribute [`goauthentik.io/user/can-change-username`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-username) has been added to the **Attributes** field for a specific user (overriding the global System setting). -- **Name**: a display name, or nickname, for the user. Similar to the username, this value can be set globally in [System settings](../../sys-mgmt/settings.md#allow-users-to-change-name), or per user with the attribute [`goauthentik.io/user/can-change-name`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-name). -- **Email**: the email address for the user. This value also can be set globally in [System settings](../../sys-mgmt/settings.md#allow-users-to-change-email), or if the attribute [`goauthentik.io/user/can-change-email`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-email) has been added to the **Attributes** field for a specific user (overriding the global System setting). +- **Username**: the username is the unique identifier associated with the user, and is required for logging in. This value can only be edited by the user if the [global System settings](../../sys-mgmt/settings.mdx#allow-users-to-change-username) are configured to allow all users to change their username, or if the attribute [`goauthentik.io/user/can-change-username`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-username) has been added to the **Attributes** field for a specific user (overriding the global System setting). +- **Name**: a display name, or nickname, for the user. Similar to the username, this value can be set globally in [System settings](../../sys-mgmt/settings.mdx#allow-users-to-change-name), or per user with the attribute [`goauthentik.io/user/can-change-name`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-name). +- **Email**: the email address for the user. This value also can be set globally in [System settings](../../sys-mgmt/settings.mdx#allow-users-to-change-email), or if the attribute [`goauthentik.io/user/can-change-email`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-email) has been added to the **Attributes** field for a specific user (overriding the global System setting). - **Locale**: override any global locale settings and either choose a specific language or select **Auto-detect**, which relies on the user's browser local settings. -- **Change your password**: if a user has the [permission to update their password](../user/user_basic_operations.md#reset-a-password), they can do so here. +- **Change your password**: if a user has the [permission to update their password](../user/user_basic_operations.mdx#reset-a-password), they can do so here. ### Sessions @@ -38,7 +38,7 @@ You can view applications to which you gave consent to allow authentik to share When an administrator adds this stage to an authorization flow, the user logging in is presented with a pop-up confirmation page asking if they agree to allow the application to directly request their account data (typically profile and email address) from the source. The user clicks **Continue** to give consent. -For more information refer to our documentation on the [Consent stage](../../add-secure-apps/flows-stages/stages/consent/index.md). +For more information refer to our documentation on the [Consent stage](../../add-secure-apps/flows-stages/stages/consent/index.mdx). ### Credentials @@ -50,12 +50,12 @@ This is where users can add and configure MFA devices for accessing authentik. T - **Static tokens**: authentik generates 6 single-use tokens. - **TOTP Device**: using your preferred authenticator, scan the QR code, enter the code from the authenticator into the authentik prompt, and then click **Continue**. For authenticators that do not support QR scanning, you can copy the secret and paste it into your authenticator. -- **WebAuthn device**: this option uses the [WebAuthn/FIDO2/Passkeys Authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.md) to allow the user to create a passkey for the device. +- **WebAuthn device**: this option uses the [WebAuthn/FIDO2/Passkeys Authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx) to allow the user to create a passkey for the device. -An authentik administrator can add additional MFA options for users, such as [Email](../../add-secure-apps/flows-stages/stages/authenticator_email/index.md), [SMS](../../add-secure-apps/flows-stages/stages/authenticator_sms/index.md), or [Duo](../../add-secure-apps/flows-stages/stages/authenticator_duo/index.md), by adding the stage for that authentication method to the flow. +An authentik administrator can add additional MFA options for users, such as [Email](../../add-secure-apps/flows-stages/stages/authenticator_email/index.mdx), [SMS](../../add-secure-apps/flows-stages/stages/authenticator_sms/index.mdx), or [Duo](../../add-secure-apps/flows-stages/stages/authenticator_duo/index.mdx), by adding the stage for that authentication method to the flow. :::info LDAP providers and MFA -Because LDAP does not natively support OTP, authentik supports [appending the OTP code to the password](../../add-secure-apps/providers/ldap/index.md#code-based-mfa-support) for situations where the protocol is LDAP and they are required to use MFA. If enabled, the user can enter the authenticator's code as part of the bind/authentication password, separated by a semicolon. For example, for the password `example-password` and the MFA code `123456`, the input in the password field must be `example-password;123456`. +Because LDAP does not natively support OTP, authentik supports [appending the OTP code to the password](../../add-secure-apps/providers/ldap/index.mdx#code-based-mfa-support) for situations where the protocol is LDAP and they are required to use MFA. If enabled, the user can enter the authenticator's code as part of the bind/authentication password, separated by a semicolon. For example, for the password `example-password` and the MFA code `123456`, the input in the password field must be `example-password;123456`. ::: #### Tokens and app passwords @@ -65,4 +65,4 @@ Because LDAP does not natively support OTP, authentik supports [appending the OT ### Connected services -If an authentik administrator adds a [source](../sources/index.md) to the instance, such as GitHub, Discord, Google Workspace or Microsoft Entra ID, then users will see a list of those sources here and can choose to log in (**Connect**) using credentials from that source, or **Disconnect** form the service. Note that SCIM and LDAP sources are not displayed. +If an authentik administrator adds a [source](../sources/index.mdx) to the instance, such as GitHub, Discord, Google Workspace or Microsoft Entra ID, then users will see a list of those sources here and can choose to log in (**Connect**) using credentials from that source, or **Disconnect** form the service. Note that SCIM and LDAP sources are not displayed. diff --git a/website/docs/users-sources/user/user-switching.md b/website/docs/users-sources/user/user-switching.mdx similarity index 100% rename from website/docs/users-sources/user/user-switching.md rename to website/docs/users-sources/user/user-switching.mdx diff --git a/website/docs/users-sources/user/user_basic_operations.md b/website/docs/users-sources/user/user_basic_operations.mdx similarity index 90% rename from website/docs/users-sources/user/user_basic_operations.md rename to website/docs/users-sources/user/user_basic_operations.mdx index 59c789f402..f621c8b478 100644 --- a/website/docs/users-sources/user/user_basic_operations.md +++ b/website/docs/users-sources/user/user_basic_operations.mdx @@ -5,12 +5,12 @@ sidebar_position: 3 Use these procedures to create, modify, deactivate, delete, and recover users. -[Policies](../../customize/policies/index.md) can be used to further manage how users are authenticated. For example, by default authentik does not require email addresses be unique, but you can use a policy to [enforce unique email addresses](../../customize/policies/types/expression/unique_email.md). +[Policies](../../customize/policies/index.mdx) can be used to further manage how users are authenticated. For example, by default authentik does not require email addresses be unique, but you can use a policy to [enforce unique email addresses](../../customize/policies/types/expression/unique_email.mdx). ## Create a user :::note Automated user creation -If you want to automate user creation, you can do that either by [invitations](./invitations.md), [`user_write` stage](../../add-secure-apps/flows-stages/stages/user_write/index.md), or [using the API](/api/reference/core-users-create). +If you want to automate user creation, you can do that either by [invitations](./invitations.mdx), [`user_write` stage](../../add-secure-apps/flows-stages/stages/user_write/index.mdx), or [using the API](/api/reference/core-users-create). ::: 1. In the Admin interface of your authentik instance, select **Directory** > **Users** in the left menu. @@ -63,7 +63,7 @@ To modify a user object, go to **Directory** > **Users**, and click the edit ico You cannot directly grant a user any permissions. Instead, either assign the user to a role with the appropriate permissions, or add a user to a group that has the appropriate permissions (via the group's role/roles). -On the flipside, to grant permissions on a user object to a role, review ["Manage permissions"](../access-control/manage_permissions.md#assign-or-remove-permissions-for-a-specific-role). +On the flipside, to grant permissions on a user object to a role, review ["Manage permissions"](../access-control/manage_permissions.mdx#assign-or-remove-permissions-for-a-specific-role). ## Add a user to a group @@ -100,7 +100,7 @@ If the user only needs their password reset, see these [instructions](#reset-a-p ### Configure a recovery flow -To get started, you can [import](../../add-secure-apps/flows-stages/flow/index.md#import-or-export-a-flow) this example flow: [Recovery with email verification flow](../../add-secure-apps/flows-stages/flow/examples/flows.md#recovery-with-email-and-mfa-verification) +To get started, you can [import](../../add-secure-apps/flows-stages/flow/index.mdx#import-or-export-a-flow) this example flow: [Recovery with email verification flow](../../add-secure-apps/flows-stages/flow/examples/flows.mdx#recovery-with-email-and-mfa-verification) Then, set this as the default recovery flow for the active brand: @@ -125,7 +125,7 @@ A dialog displays the recovery link. Copy the link and send it to the user. ### 2. Email a recovery link :::info Email stage required -This option is only available if the recovery flow has an [Email Stage](../../add-secure-apps/flows-stages/stages/email/index.md) bound to it. The example recovery flow includes an email stage. +This option is only available if the recovery flow has an [Email Stage](../../add-secure-apps/flows-stages/stages/email/index.mdx) bound to it. The example recovery flow includes an email stage. ::: You can email a password-reset link to the user. This option requires [configured email](../../install-config/email.mdx) and an email address on the user account. @@ -134,7 +134,7 @@ You can email a password-reset link to the user. This option requires [configure 2. Click the name of the user to display the full User details page. 3. To send the email to the user, click **Email recovery link**. -If the user does not receive the email, check if the mail server parameters [are properly configured](../../troubleshooting/emails.md). +If the user does not receive the email, check if the mail server parameters [are properly configured](../../troubleshooting/emails.mdx). ## Reset a password @@ -181,9 +181,9 @@ An administrator can impersonate a user, temporarily assuming that user's identi 4. At the prompt, provide a reason why you are impersonating this user, and then click **Impersonate**. :::info -An administrator can globally enable or disable impersonation in the [system settings](../../sys-mgmt/settings.md#impersonation). By default, this option is enabled, meaning all users can be impersonated. +An administrator can globally enable or disable impersonation in the [system settings](../../sys-mgmt/settings.mdx#impersonation). By default, this option is enabled, meaning all users can be impersonated. -An administrator can also require a reason for impersonation in the [system settings](../../sys-mgmt/settings.md#require-reason-for-impersonation). +An administrator can also require a reason for impersonation in the [system settings](../../sys-mgmt/settings.mdx#require-reason-for-impersonation). ::: ## Export users :ak-enterprise diff --git a/website/docs/users-sources/user/user_ref.mdx b/website/docs/users-sources/user/user_ref.mdx index 6cb0f4b708..f680567bda 100644 --- a/website/docs/users-sources/user/user_ref.mdx +++ b/website/docs/users-sources/user/user_ref.mdx @@ -92,7 +92,7 @@ Format is string of format `days=10;hours=1;minute=3;seconds=5`. ### `goauthentik.io/user/debug`: -See [Troubleshooting access problems](../../troubleshooting/access.md), when set, the user gets a more detailed explanation of access decisions. +See [Troubleshooting access problems](../../troubleshooting/access.mdx), when set, the user gets a more detailed explanation of access decisions. ### `additionalHeaders`: diff --git a/website/integrations/applications.mdx b/website/integrations/applications.mdx index e57de749ab..2c1aa0cb0e 100644 --- a/website/integrations/applications.mdx +++ b/website/integrations/applications.mdx @@ -25,8 +25,8 @@ All documented app integrations will have one of these badges: -To add documentation for a new application (with support level Community or Vendor), please use the integration template [`service.md`](https://github.com/goauthentik/authentik/blob/main/website/integrations/template/service.md) file from our GitHub repo. You can download the template file using the following command: +To add documentation for a new application (with support level Community or Vendor), please use the integration template [`service.mdx`](https://github.com/goauthentik/authentik/blob/main/website/integrations/template/service.mdx) file from our GitHub repo. You can download the template file using the following command: ```shell -wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/integrations/template/service.md +wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/integrations/template/service.mdx ``` diff --git a/website/integrations/chat-communication-collaboration/affine/index.md b/website/integrations/chat-communication-collaboration/affine/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/affine/index.md rename to website/integrations/chat-communication-collaboration/affine/index.mdx diff --git a/website/integrations/chat-communication-collaboration/espo-crm/index.md b/website/integrations/chat-communication-collaboration/espo-crm/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/espo-crm/index.md rename to website/integrations/chat-communication-collaboration/espo-crm/index.mdx diff --git a/website/integrations/chat-communication-collaboration/grommunio/index.md b/website/integrations/chat-communication-collaboration/grommunio/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/grommunio/index.md rename to website/integrations/chat-communication-collaboration/grommunio/index.mdx diff --git a/website/integrations/chat-communication-collaboration/hedgedoc/index.md b/website/integrations/chat-communication-collaboration/hedgedoc/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/hedgedoc/index.md rename to website/integrations/chat-communication-collaboration/hedgedoc/index.mdx diff --git a/website/integrations/chat-communication-collaboration/joplin/index.md b/website/integrations/chat-communication-collaboration/joplin/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/joplin/index.md rename to website/integrations/chat-communication-collaboration/joplin/index.mdx diff --git a/website/integrations/chat-communication-collaboration/kanboard/index.md b/website/integrations/chat-communication-collaboration/kanboard/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/kanboard/index.md rename to website/integrations/chat-communication-collaboration/kanboard/index.mdx diff --git a/website/integrations/chat-communication-collaboration/kimai/index.md b/website/integrations/chat-communication-collaboration/kimai/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/kimai/index.md rename to website/integrations/chat-communication-collaboration/kimai/index.mdx diff --git a/website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.md b/website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.md rename to website/integrations/chat-communication-collaboration/mailcow-logs-viewer/index.mdx diff --git a/website/integrations/chat-communication-collaboration/mailcow/index.md b/website/integrations/chat-communication-collaboration/mailcow/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/mailcow/index.md rename to website/integrations/chat-communication-collaboration/mailcow/index.mdx diff --git a/website/integrations/chat-communication-collaboration/mastodon/index.md b/website/integrations/chat-communication-collaboration/mastodon/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/mastodon/index.md rename to website/integrations/chat-communication-collaboration/mastodon/index.mdx diff --git a/website/integrations/chat-communication-collaboration/matrix-synapse/index.md b/website/integrations/chat-communication-collaboration/matrix-synapse/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/matrix-synapse/index.md rename to website/integrations/chat-communication-collaboration/matrix-synapse/index.mdx diff --git a/website/integrations/chat-communication-collaboration/mautic/index.md b/website/integrations/chat-communication-collaboration/mautic/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/mautic/index.md rename to website/integrations/chat-communication-collaboration/mautic/index.mdx diff --git a/website/integrations/chat-communication-collaboration/mobilizon/index.md b/website/integrations/chat-communication-collaboration/mobilizon/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/mobilizon/index.md rename to website/integrations/chat-communication-collaboration/mobilizon/index.mdx diff --git a/website/integrations/chat-communication-collaboration/onlyoffice/index.md b/website/integrations/chat-communication-collaboration/onlyoffice/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/onlyoffice/index.md rename to website/integrations/chat-communication-collaboration/onlyoffice/index.mdx diff --git a/website/integrations/chat-communication-collaboration/openproject/index.md b/website/integrations/chat-communication-collaboration/openproject/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/openproject/index.md rename to website/integrations/chat-communication-collaboration/openproject/index.mdx diff --git a/website/integrations/chat-communication-collaboration/owncloud/index.md b/website/integrations/chat-communication-collaboration/owncloud/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/owncloud/index.md rename to website/integrations/chat-communication-collaboration/owncloud/index.mdx diff --git a/website/integrations/chat-communication-collaboration/placetel/index.md b/website/integrations/chat-communication-collaboration/placetel/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/placetel/index.md rename to website/integrations/chat-communication-collaboration/placetel/index.mdx diff --git a/website/integrations/chat-communication-collaboration/rocketchat/index.md b/website/integrations/chat-communication-collaboration/rocketchat/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/rocketchat/index.md rename to website/integrations/chat-communication-collaboration/rocketchat/index.mdx diff --git a/website/integrations/chat-communication-collaboration/roundcube/index.md b/website/integrations/chat-communication-collaboration/roundcube/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/roundcube/index.md rename to website/integrations/chat-communication-collaboration/roundcube/index.mdx diff --git a/website/integrations/chat-communication-collaboration/seatable/index.md b/website/integrations/chat-communication-collaboration/seatable/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/seatable/index.md rename to website/integrations/chat-communication-collaboration/seatable/index.mdx diff --git a/website/integrations/chat-communication-collaboration/sharepoint-se/index.md b/website/integrations/chat-communication-collaboration/sharepoint-se/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/sharepoint-se/index.md rename to website/integrations/chat-communication-collaboration/sharepoint-se/index.mdx diff --git a/website/integrations/chat-communication-collaboration/thelounge/index.md b/website/integrations/chat-communication-collaboration/thelounge/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/thelounge/index.md rename to website/integrations/chat-communication-collaboration/thelounge/index.mdx diff --git a/website/integrations/chat-communication-collaboration/writefreely/index.md b/website/integrations/chat-communication-collaboration/writefreely/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/writefreely/index.md rename to website/integrations/chat-communication-collaboration/writefreely/index.mdx diff --git a/website/integrations/chat-communication-collaboration/zoom/index.md b/website/integrations/chat-communication-collaboration/zoom/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/zoom/index.md rename to website/integrations/chat-communication-collaboration/zoom/index.mdx diff --git a/website/integrations/chat-communication-collaboration/zulip/index.md b/website/integrations/chat-communication-collaboration/zulip/index.mdx similarity index 100% rename from website/integrations/chat-communication-collaboration/zulip/index.md rename to website/integrations/chat-communication-collaboration/zulip/index.mdx diff --git a/website/integrations/cloud-providers/digitalocean/index.md b/website/integrations/cloud-providers/digitalocean/index.mdx similarity index 100% rename from website/integrations/cloud-providers/digitalocean/index.md rename to website/integrations/cloud-providers/digitalocean/index.mdx diff --git a/website/integrations/cloud-providers/google/index.md b/website/integrations/cloud-providers/google/index.mdx similarity index 100% rename from website/integrations/cloud-providers/google/index.md rename to website/integrations/cloud-providers/google/index.mdx diff --git a/website/integrations/cloud-providers/hashicorp-cloud/index.md b/website/integrations/cloud-providers/hashicorp-cloud/index.mdx similarity index 100% rename from website/integrations/cloud-providers/hashicorp-cloud/index.md rename to website/integrations/cloud-providers/hashicorp-cloud/index.mdx diff --git a/website/integrations/cloud-providers/oracle-cloud/index.md b/website/integrations/cloud-providers/oracle-cloud/index.mdx similarity index 100% rename from website/integrations/cloud-providers/oracle-cloud/index.md rename to website/integrations/cloud-providers/oracle-cloud/index.mdx diff --git a/website/integrations/cloud-providers/ovhcloud/index.md b/website/integrations/cloud-providers/ovhcloud/index.mdx similarity index 100% rename from website/integrations/cloud-providers/ovhcloud/index.md rename to website/integrations/cloud-providers/ovhcloud/index.mdx diff --git a/website/integrations/dashboards/dashy/index.md b/website/integrations/dashboards/dashy/index.mdx similarity index 100% rename from website/integrations/dashboards/dashy/index.md rename to website/integrations/dashboards/dashy/index.mdx diff --git a/website/integrations/dashboards/excalidash/index.mdx b/website/integrations/dashboards/excalidash/index.mdx index 57f829b7c6..4bdb9c898d 100644 --- a/website/integrations/dashboards/excalidash/index.mdx +++ b/website/integrations/dashboards/excalidash/index.mdx @@ -31,7 +31,7 @@ To support the integration of ExcaliDash with authentik, you need to create an e ### Create an email verification scope mapping in authentik -ExcaliDash requires verified email addresses unless email verification is disabled in ExcaliDash. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for ExcaliDash to allow authentication while keeping email verification enabled. +ExcaliDash requires verified email addresses unless email verification is disabled in ExcaliDash. As of [authentik 2025.10](/docs/releases/2025/v2025.10.mdx#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for ExcaliDash to allow authentication while keeping email verification enabled. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. diff --git a/website/integrations/dashboards/homarr/index.md b/website/integrations/dashboards/homarr/index.mdx similarity index 100% rename from website/integrations/dashboards/homarr/index.md rename to website/integrations/dashboards/homarr/index.mdx diff --git a/website/integrations/dashboards/linkwarden/index.md b/website/integrations/dashboards/linkwarden/index.mdx similarity index 100% rename from website/integrations/dashboards/linkwarden/index.md rename to website/integrations/dashboards/linkwarden/index.mdx diff --git a/website/integrations/dashboards/organizr/index.md b/website/integrations/dashboards/organizr/index.mdx similarity index 100% rename from website/integrations/dashboards/organizr/index.md rename to website/integrations/dashboards/organizr/index.mdx diff --git a/website/integrations/development/coder/index.md b/website/integrations/development/coder/index.mdx similarity index 100% rename from website/integrations/development/coder/index.md rename to website/integrations/development/coder/index.mdx diff --git a/website/integrations/development/forgejo/index.md b/website/integrations/development/forgejo/index.mdx similarity index 100% rename from website/integrations/development/forgejo/index.md rename to website/integrations/development/forgejo/index.mdx diff --git a/website/integrations/development/frappe/index.md b/website/integrations/development/frappe/index.mdx similarity index 100% rename from website/integrations/development/frappe/index.md rename to website/integrations/development/frappe/index.mdx diff --git a/website/integrations/development/ghec/index.md b/website/integrations/development/ghec/index.mdx similarity index 100% rename from website/integrations/development/ghec/index.md rename to website/integrations/development/ghec/index.mdx diff --git a/website/integrations/development/ghes/index.md b/website/integrations/development/ghes/index.mdx similarity index 100% rename from website/integrations/development/ghes/index.md rename to website/integrations/development/ghes/index.mdx diff --git a/website/integrations/development/gitea/index.md b/website/integrations/development/gitea/index.mdx similarity index 100% rename from website/integrations/development/gitea/index.md rename to website/integrations/development/gitea/index.mdx diff --git a/website/integrations/development/gravitee/index.md b/website/integrations/development/gravitee/index.mdx similarity index 100% rename from website/integrations/development/gravitee/index.md rename to website/integrations/development/gravitee/index.mdx diff --git a/website/integrations/development/jenkins/index.md b/website/integrations/development/jenkins/index.mdx similarity index 100% rename from website/integrations/development/jenkins/index.md rename to website/integrations/development/jenkins/index.mdx diff --git a/website/integrations/development/node-red/index.md b/website/integrations/development/node-red/index.mdx similarity index 100% rename from website/integrations/development/node-red/index.md rename to website/integrations/development/node-red/index.mdx diff --git a/website/integrations/device-management/apple/index.md b/website/integrations/device-management/apple/index.mdx similarity index 100% rename from website/integrations/device-management/apple/index.md rename to website/integrations/device-management/apple/index.mdx diff --git a/website/integrations/device-management/fleet/index.md b/website/integrations/device-management/fleet/index.mdx similarity index 100% rename from website/integrations/device-management/fleet/index.md rename to website/integrations/device-management/fleet/index.mdx diff --git a/website/integrations/device-management/meshcentral/index.md b/website/integrations/device-management/meshcentral/index.mdx similarity index 100% rename from website/integrations/device-management/meshcentral/index.md rename to website/integrations/device-management/meshcentral/index.mdx diff --git a/website/integrations/device-management/omnissa-workspace-one-access/index.md b/website/integrations/device-management/omnissa-workspace-one-access/index.mdx similarity index 100% rename from website/integrations/device-management/omnissa-workspace-one-access/index.md rename to website/integrations/device-management/omnissa-workspace-one-access/index.mdx diff --git a/website/integrations/documentation/dokuwiki/index.md b/website/integrations/documentation/dokuwiki/index.mdx similarity index 100% rename from website/integrations/documentation/dokuwiki/index.md rename to website/integrations/documentation/dokuwiki/index.mdx diff --git a/website/integrations/documentation/glpi/index.md b/website/integrations/documentation/glpi/index.mdx similarity index 100% rename from website/integrations/documentation/glpi/index.md rename to website/integrations/documentation/glpi/index.mdx diff --git a/website/integrations/documentation/karakeep/index.md b/website/integrations/documentation/karakeep/index.mdx similarity index 100% rename from website/integrations/documentation/karakeep/index.md rename to website/integrations/documentation/karakeep/index.mdx diff --git a/website/integrations/documentation/kitchenowl/index.md b/website/integrations/documentation/kitchenowl/index.mdx similarity index 100% rename from website/integrations/documentation/kitchenowl/index.md rename to website/integrations/documentation/kitchenowl/index.mdx diff --git a/website/integrations/documentation/mealie/index.md b/website/integrations/documentation/mealie/index.mdx similarity index 100% rename from website/integrations/documentation/mealie/index.md rename to website/integrations/documentation/mealie/index.mdx diff --git a/website/integrations/documentation/netbox/index.md b/website/integrations/documentation/netbox/index.mdx similarity index 100% rename from website/integrations/documentation/netbox/index.md rename to website/integrations/documentation/netbox/index.mdx diff --git a/website/integrations/documentation/notion/index.md b/website/integrations/documentation/notion/index.mdx similarity index 100% rename from website/integrations/documentation/notion/index.md rename to website/integrations/documentation/notion/index.mdx diff --git a/website/integrations/documentation/outline/index.md b/website/integrations/documentation/outline/index.mdx similarity index 95% rename from website/integrations/documentation/outline/index.md rename to website/integrations/documentation/outline/index.mdx index 15a967a60e..3eb81bf8b8 100644 --- a/website/integrations/documentation/outline/index.md +++ b/website/integrations/documentation/outline/index.mdx @@ -31,7 +31,7 @@ To support the integration of Outline with authentik, you need to create a scope ### Create an email verification scope mapping -Outline requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Outline to allow authentication. +Outline requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.mdx#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Outline to allow authentication. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. diff --git a/website/integrations/documentation/paperless-ng/index.md b/website/integrations/documentation/paperless-ng/index.mdx similarity index 100% rename from website/integrations/documentation/paperless-ng/index.md rename to website/integrations/documentation/paperless-ng/index.mdx diff --git a/website/integrations/documentation/snipe-it/index.md b/website/integrations/documentation/snipe-it/index.mdx similarity index 100% rename from website/integrations/documentation/snipe-it/index.md rename to website/integrations/documentation/snipe-it/index.mdx diff --git a/website/integrations/documentation/tandoor/index.md b/website/integrations/documentation/tandoor/index.mdx similarity index 100% rename from website/integrations/documentation/tandoor/index.md rename to website/integrations/documentation/tandoor/index.mdx diff --git a/website/integrations/documentation/wiki-js/index.md b/website/integrations/documentation/wiki-js/index.mdx similarity index 100% rename from website/integrations/documentation/wiki-js/index.md rename to website/integrations/documentation/wiki-js/index.mdx diff --git a/website/integrations/documentation/youtrack/index.md b/website/integrations/documentation/youtrack/index.mdx similarity index 100% rename from website/integrations/documentation/youtrack/index.md rename to website/integrations/documentation/youtrack/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/arcane/index.md b/website/integrations/hypervisors-orchestrators/arcane/index.mdx similarity index 100% rename from website/integrations/hypervisors-orchestrators/arcane/index.md rename to website/integrations/hypervisors-orchestrators/arcane/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/portainer/index.md b/website/integrations/hypervisors-orchestrators/portainer/index.mdx similarity index 100% rename from website/integrations/hypervisors-orchestrators/portainer/index.md rename to website/integrations/hypervisors-orchestrators/portainer/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/proxmox-ve/index.md b/website/integrations/hypervisors-orchestrators/proxmox-ve/index.mdx similarity index 100% rename from website/integrations/hypervisors-orchestrators/proxmox-ve/index.md rename to website/integrations/hypervisors-orchestrators/proxmox-ve/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/rancher/index.md b/website/integrations/hypervisors-orchestrators/rancher/index.mdx similarity index 100% rename from website/integrations/hypervisors-orchestrators/rancher/index.md rename to website/integrations/hypervisors-orchestrators/rancher/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.md b/website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.mdx similarity index 100% rename from website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.md rename to website/integrations/hypervisors-orchestrators/vmware-cloud-director/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/vmware-vcenter/index.md b/website/integrations/hypervisors-orchestrators/vmware-vcenter/index.mdx similarity index 100% rename from website/integrations/hypervisors-orchestrators/vmware-vcenter/index.md rename to website/integrations/hypervisors-orchestrators/vmware-vcenter/index.mdx diff --git a/website/integrations/hypervisors-orchestrators/xen-orchestra/index.md b/website/integrations/hypervisors-orchestrators/xen-orchestra/index.mdx similarity index 100% rename from website/integrations/hypervisors-orchestrators/xen-orchestra/index.md rename to website/integrations/hypervisors-orchestrators/xen-orchestra/index.mdx diff --git a/website/integrations/infrastructure/argocd/index.md b/website/integrations/infrastructure/argocd/index.mdx similarity index 100% rename from website/integrations/infrastructure/argocd/index.md rename to website/integrations/infrastructure/argocd/index.mdx diff --git a/website/integrations/infrastructure/atlantis/index.md b/website/integrations/infrastructure/atlantis/index.mdx similarity index 100% rename from website/integrations/infrastructure/atlantis/index.md rename to website/integrations/infrastructure/atlantis/index.mdx diff --git a/website/integrations/infrastructure/awx-tower/index.md b/website/integrations/infrastructure/awx-tower/index.mdx similarity index 100% rename from website/integrations/infrastructure/awx-tower/index.md rename to website/integrations/infrastructure/awx-tower/index.mdx diff --git a/website/integrations/infrastructure/harbor/index.md b/website/integrations/infrastructure/harbor/index.mdx similarity index 100% rename from website/integrations/infrastructure/harbor/index.md rename to website/integrations/infrastructure/harbor/index.mdx diff --git a/website/integrations/infrastructure/iis/index.md b/website/integrations/infrastructure/iis/index.mdx similarity index 100% rename from website/integrations/infrastructure/iis/index.md rename to website/integrations/infrastructure/iis/index.mdx diff --git a/website/integrations/infrastructure/nexterm/index.md b/website/integrations/infrastructure/nexterm/index.mdx similarity index 100% rename from website/integrations/infrastructure/nexterm/index.md rename to website/integrations/infrastructure/nexterm/index.mdx diff --git a/website/integrations/infrastructure/omni/index.md b/website/integrations/infrastructure/omni/index.mdx similarity index 100% rename from website/integrations/infrastructure/omni/index.md rename to website/integrations/infrastructure/omni/index.mdx diff --git a/website/integrations/infrastructure/osticket/index.md b/website/integrations/infrastructure/osticket/index.mdx similarity index 100% rename from website/integrations/infrastructure/osticket/index.md rename to website/integrations/infrastructure/osticket/index.mdx diff --git a/website/integrations/infrastructure/pgadmin/index.md b/website/integrations/infrastructure/pgadmin/index.mdx similarity index 100% rename from website/integrations/infrastructure/pgadmin/index.md rename to website/integrations/infrastructure/pgadmin/index.mdx diff --git a/website/integrations/infrastructure/phpipam/index.md b/website/integrations/infrastructure/phpipam/index.mdx similarity index 100% rename from website/integrations/infrastructure/phpipam/index.md rename to website/integrations/infrastructure/phpipam/index.mdx diff --git a/website/integrations/infrastructure/plesk/index.md b/website/integrations/infrastructure/plesk/index.mdx similarity index 100% rename from website/integrations/infrastructure/plesk/index.md rename to website/integrations/infrastructure/plesk/index.mdx diff --git a/website/integrations/infrastructure/powerdns-admin/index.md b/website/integrations/infrastructure/powerdns-admin/index.mdx similarity index 100% rename from website/integrations/infrastructure/powerdns-admin/index.md rename to website/integrations/infrastructure/powerdns-admin/index.mdx diff --git a/website/integrations/infrastructure/proftpd/index.md b/website/integrations/infrastructure/proftpd/index.mdx similarity index 100% rename from website/integrations/infrastructure/proftpd/index.md rename to website/integrations/infrastructure/proftpd/index.mdx diff --git a/website/integrations/infrastructure/qnap-nas/index.md b/website/integrations/infrastructure/qnap-nas/index.mdx similarity index 100% rename from website/integrations/infrastructure/qnap-nas/index.md rename to website/integrations/infrastructure/qnap-nas/index.mdx diff --git a/website/integrations/infrastructure/sssd/index.md b/website/integrations/infrastructure/sssd/index.mdx similarity index 100% rename from website/integrations/infrastructure/sssd/index.md rename to website/integrations/infrastructure/sssd/index.mdx diff --git a/website/integrations/infrastructure/synology-dsm/index.md b/website/integrations/infrastructure/synology-dsm/index.mdx similarity index 100% rename from website/integrations/infrastructure/synology-dsm/index.md rename to website/integrations/infrastructure/synology-dsm/index.mdx diff --git a/website/integrations/infrastructure/terraform-cloud/index.md b/website/integrations/infrastructure/terraform-cloud/index.mdx similarity index 100% rename from website/integrations/infrastructure/terraform-cloud/index.md rename to website/integrations/infrastructure/terraform-cloud/index.mdx diff --git a/website/integrations/infrastructure/terrakube/index.md b/website/integrations/infrastructure/terrakube/index.mdx similarity index 100% rename from website/integrations/infrastructure/terrakube/index.md rename to website/integrations/infrastructure/terrakube/index.mdx diff --git a/website/integrations/infrastructure/truecommand/index.md b/website/integrations/infrastructure/truecommand/index.mdx similarity index 100% rename from website/integrations/infrastructure/truecommand/index.md rename to website/integrations/infrastructure/truecommand/index.mdx diff --git a/website/integrations/infrastructure/veeam-backup-replication/index.md b/website/integrations/infrastructure/veeam-backup-replication/index.mdx similarity index 100% rename from website/integrations/infrastructure/veeam-backup-replication/index.md rename to website/integrations/infrastructure/veeam-backup-replication/index.mdx diff --git a/website/integrations/infrastructure/veeam-enterprise-manager/index.md b/website/integrations/infrastructure/veeam-enterprise-manager/index.mdx similarity index 100% rename from website/integrations/infrastructure/veeam-enterprise-manager/index.md rename to website/integrations/infrastructure/veeam-enterprise-manager/index.mdx diff --git a/website/integrations/infrastructure/zammad/index.md b/website/integrations/infrastructure/zammad/index.mdx similarity index 100% rename from website/integrations/infrastructure/zammad/index.md rename to website/integrations/infrastructure/zammad/index.mdx diff --git a/website/integrations/infrastructure/zot/index.md b/website/integrations/infrastructure/zot/index.mdx similarity index 100% rename from website/integrations/infrastructure/zot/index.md rename to website/integrations/infrastructure/zot/index.mdx diff --git a/website/integrations/media/audiobookshelf/index.md b/website/integrations/media/audiobookshelf/index.mdx similarity index 100% rename from website/integrations/media/audiobookshelf/index.md rename to website/integrations/media/audiobookshelf/index.mdx diff --git a/website/integrations/media/calibre-web/index.md b/website/integrations/media/calibre-web/index.mdx similarity index 100% rename from website/integrations/media/calibre-web/index.md rename to website/integrations/media/calibre-web/index.mdx diff --git a/website/integrations/media/emby/index.md b/website/integrations/media/emby/index.mdx similarity index 100% rename from website/integrations/media/emby/index.md rename to website/integrations/media/emby/index.mdx diff --git a/website/integrations/media/immich/index.md b/website/integrations/media/immich/index.mdx similarity index 100% rename from website/integrations/media/immich/index.md rename to website/integrations/media/immich/index.mdx diff --git a/website/integrations/media/jellyfin/index.md b/website/integrations/media/jellyfin/index.mdx similarity index 100% rename from website/integrations/media/jellyfin/index.md rename to website/integrations/media/jellyfin/index.mdx diff --git a/website/integrations/media/kavita/index.md b/website/integrations/media/kavita/index.mdx similarity index 100% rename from website/integrations/media/kavita/index.md rename to website/integrations/media/kavita/index.mdx diff --git a/website/integrations/media/komga/index.md b/website/integrations/media/komga/index.mdx similarity index 96% rename from website/integrations/media/komga/index.md rename to website/integrations/media/komga/index.mdx index bddaa1724b..74c86f73ec 100644 --- a/website/integrations/media/komga/index.md +++ b/website/integrations/media/komga/index.mdx @@ -31,7 +31,7 @@ To support the integration of Komga with authentik, you need to create an applic ### Create an email verification scope mapping -Komga requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings) the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Komga to allow authentication. +Komga requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.mdx#default-oauth-scope-mappings) the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Komga to allow authentication. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. diff --git a/website/integrations/media/maintainerr/index.md b/website/integrations/media/maintainerr/index.mdx similarity index 100% rename from website/integrations/media/maintainerr/index.md rename to website/integrations/media/maintainerr/index.mdx diff --git a/website/integrations/media/miniflux/index.md b/website/integrations/media/miniflux/index.mdx similarity index 100% rename from website/integrations/media/miniflux/index.md rename to website/integrations/media/miniflux/index.mdx diff --git a/website/integrations/media/photoprism/index.md b/website/integrations/media/photoprism/index.mdx similarity index 100% rename from website/integrations/media/photoprism/index.md rename to website/integrations/media/photoprism/index.mdx diff --git a/website/integrations/media/seafile/index.md b/website/integrations/media/seafile/index.mdx similarity index 100% rename from website/integrations/media/seafile/index.md rename to website/integrations/media/seafile/index.mdx diff --git a/website/integrations/media/seerr/index.md b/website/integrations/media/seerr/index.mdx similarity index 100% rename from website/integrations/media/seerr/index.md rename to website/integrations/media/seerr/index.mdx diff --git a/website/integrations/media/sonarr/index.md b/website/integrations/media/sonarr/index.mdx similarity index 100% rename from website/integrations/media/sonarr/index.md rename to website/integrations/media/sonarr/index.mdx diff --git a/website/integrations/media/tautulli/index.md b/website/integrations/media/tautulli/index.mdx similarity index 100% rename from website/integrations/media/tautulli/index.md rename to website/integrations/media/tautulli/index.mdx diff --git a/website/integrations/miscellaneous/home-assistant/index.md b/website/integrations/miscellaneous/home-assistant/index.mdx similarity index 100% rename from website/integrations/miscellaneous/home-assistant/index.md rename to website/integrations/miscellaneous/home-assistant/index.mdx diff --git a/website/integrations/miscellaneous/open-webui/index.md b/website/integrations/miscellaneous/open-webui/index.mdx similarity index 100% rename from website/integrations/miscellaneous/open-webui/index.md rename to website/integrations/miscellaneous/open-webui/index.mdx diff --git a/website/integrations/miscellaneous/zipline/index.md b/website/integrations/miscellaneous/zipline/index.mdx similarity index 100% rename from website/integrations/miscellaneous/zipline/index.md rename to website/integrations/miscellaneous/zipline/index.mdx diff --git a/website/integrations/monitoring/beszel/index.mdx b/website/integrations/monitoring/beszel/index.mdx index c53745cb5d..09e06d95fd 100644 --- a/website/integrations/monitoring/beszel/index.mdx +++ b/website/integrations/monitoring/beszel/index.mdx @@ -31,7 +31,7 @@ To support the integration of Beszel with authentik, you need to create an email ### Create an email verification scope mapping in authentik -Beszel requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Beszel to allow authentication. +Beszel requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.mdx#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Beszel to allow authentication. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. @@ -53,7 +53,7 @@ Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#emai 3. Click **Submit** to save the new application and provider. :::info PocketBase backend -Beszel uses PocketBase as its server backend. When you install Beszel, PocketBase is included as part of Beszel, so you do not need to separately [integrate PocketBase](../../platforms/pocketbase/index.md). +Beszel uses PocketBase as its server backend. When you install Beszel, PocketBase is included as part of Beszel, so you do not need to separately [integrate PocketBase](../../platforms/pocketbase/index.mdx). ::: ## Beszel configuration diff --git a/website/integrations/monitoring/dozzle/index.md b/website/integrations/monitoring/dozzle/index.mdx similarity index 100% rename from website/integrations/monitoring/dozzle/index.md rename to website/integrations/monitoring/dozzle/index.mdx diff --git a/website/integrations/monitoring/fortianalyzer/index.md b/website/integrations/monitoring/fortianalyzer/index.mdx similarity index 100% rename from website/integrations/monitoring/fortianalyzer/index.md rename to website/integrations/monitoring/fortianalyzer/index.mdx diff --git a/website/integrations/monitoring/glitchtip/index.md b/website/integrations/monitoring/glitchtip/index.mdx similarity index 100% rename from website/integrations/monitoring/glitchtip/index.md rename to website/integrations/monitoring/glitchtip/index.mdx diff --git a/website/integrations/monitoring/icinga/index.md b/website/integrations/monitoring/icinga/index.mdx similarity index 100% rename from website/integrations/monitoring/icinga/index.md rename to website/integrations/monitoring/icinga/index.mdx diff --git a/website/integrations/monitoring/observium/index.md b/website/integrations/monitoring/observium/index.mdx similarity index 100% rename from website/integrations/monitoring/observium/index.md rename to website/integrations/monitoring/observium/index.mdx diff --git a/website/integrations/monitoring/oneuptime/index.md b/website/integrations/monitoring/oneuptime/index.mdx similarity index 100% rename from website/integrations/monitoring/oneuptime/index.md rename to website/integrations/monitoring/oneuptime/index.mdx diff --git a/website/integrations/monitoring/posthog/index.md b/website/integrations/monitoring/posthog/index.mdx similarity index 100% rename from website/integrations/monitoring/posthog/index.md rename to website/integrations/monitoring/posthog/index.mdx diff --git a/website/integrations/monitoring/pulse/index.md b/website/integrations/monitoring/pulse/index.mdx similarity index 100% rename from website/integrations/monitoring/pulse/index.md rename to website/integrations/monitoring/pulse/index.mdx diff --git a/website/integrations/monitoring/sentry/index.md b/website/integrations/monitoring/sentry/index.mdx similarity index 100% rename from website/integrations/monitoring/sentry/index.md rename to website/integrations/monitoring/sentry/index.mdx diff --git a/website/integrations/monitoring/ubuntu-landscape/index.md b/website/integrations/monitoring/ubuntu-landscape/index.mdx similarity index 100% rename from website/integrations/monitoring/ubuntu-landscape/index.md rename to website/integrations/monitoring/ubuntu-landscape/index.mdx diff --git a/website/integrations/monitoring/uptime-kuma/index.md b/website/integrations/monitoring/uptime-kuma/index.mdx similarity index 100% rename from website/integrations/monitoring/uptime-kuma/index.md rename to website/integrations/monitoring/uptime-kuma/index.mdx diff --git a/website/integrations/monitoring/whats-up-docker/index.md b/website/integrations/monitoring/whats-up-docker/index.mdx similarity index 100% rename from website/integrations/monitoring/whats-up-docker/index.md rename to website/integrations/monitoring/whats-up-docker/index.mdx diff --git a/website/integrations/monitoring/zabbix/index.md b/website/integrations/monitoring/zabbix/index.mdx similarity index 100% rename from website/integrations/monitoring/zabbix/index.md rename to website/integrations/monitoring/zabbix/index.mdx diff --git a/website/integrations/networking/aruba-orchestrator/index.md b/website/integrations/networking/aruba-orchestrator/index.mdx similarity index 100% rename from website/integrations/networking/aruba-orchestrator/index.md rename to website/integrations/networking/aruba-orchestrator/index.mdx diff --git a/website/integrations/networking/cisco-fmc/index.md b/website/integrations/networking/cisco-fmc/index.mdx similarity index 100% rename from website/integrations/networking/cisco-fmc/index.md rename to website/integrations/networking/cisco-fmc/index.mdx diff --git a/website/integrations/networking/firezone/index.md b/website/integrations/networking/firezone/index.mdx similarity index 100% rename from website/integrations/networking/firezone/index.md rename to website/integrations/networking/firezone/index.mdx diff --git a/website/integrations/networking/fortigate-admin/index.md b/website/integrations/networking/fortigate-admin/index.mdx similarity index 100% rename from website/integrations/networking/fortigate-admin/index.md rename to website/integrations/networking/fortigate-admin/index.mdx diff --git a/website/integrations/networking/fortigate-ssl/index.md b/website/integrations/networking/fortigate-ssl/index.mdx similarity index 100% rename from website/integrations/networking/fortigate-ssl/index.md rename to website/integrations/networking/fortigate-ssl/index.mdx diff --git a/website/integrations/networking/fortimanager/index.md b/website/integrations/networking/fortimanager/index.mdx similarity index 100% rename from website/integrations/networking/fortimanager/index.md rename to website/integrations/networking/fortimanager/index.mdx diff --git a/website/integrations/networking/globalprotect/index.md b/website/integrations/networking/globalprotect/index.mdx similarity index 100% rename from website/integrations/networking/globalprotect/index.md rename to website/integrations/networking/globalprotect/index.mdx diff --git a/website/integrations/networking/gravity/index.md b/website/integrations/networking/gravity/index.mdx similarity index 100% rename from website/integrations/networking/gravity/index.md rename to website/integrations/networking/gravity/index.mdx diff --git a/website/integrations/networking/headscale/index.md b/website/integrations/networking/headscale/index.mdx similarity index 100% rename from website/integrations/networking/headscale/index.md rename to website/integrations/networking/headscale/index.mdx diff --git a/website/integrations/networking/hoop.dev/index.md b/website/integrations/networking/hoop.dev/index.mdx similarity index 100% rename from website/integrations/networking/hoop.dev/index.md rename to website/integrations/networking/hoop.dev/index.mdx diff --git a/website/integrations/networking/opnsense/index.md b/website/integrations/networking/opnsense/index.mdx similarity index 100% rename from website/integrations/networking/opnsense/index.md rename to website/integrations/networking/opnsense/index.mdx diff --git a/website/integrations/networking/pfsense/index.md b/website/integrations/networking/pfsense/index.mdx similarity index 100% rename from website/integrations/networking/pfsense/index.md rename to website/integrations/networking/pfsense/index.mdx diff --git a/website/integrations/networking/tailscale/index.md b/website/integrations/networking/tailscale/index.mdx similarity index 100% rename from website/integrations/networking/tailscale/index.md rename to website/integrations/networking/tailscale/index.mdx diff --git a/website/integrations/networking/technitium/index.md b/website/integrations/networking/technitium/index.mdx similarity index 100% rename from website/integrations/networking/technitium/index.md rename to website/integrations/networking/technitium/index.mdx diff --git a/website/integrations/platforms/box/index.md b/website/integrations/platforms/box/index.mdx similarity index 100% rename from website/integrations/platforms/box/index.md rename to website/integrations/platforms/box/index.mdx diff --git a/website/integrations/platforms/budibase/index.md b/website/integrations/platforms/budibase/index.mdx similarity index 100% rename from website/integrations/platforms/budibase/index.md rename to website/integrations/platforms/budibase/index.mdx diff --git a/website/integrations/platforms/cloudflare/index.md b/website/integrations/platforms/cloudflare/index.mdx similarity index 97% rename from website/integrations/platforms/cloudflare/index.md rename to website/integrations/platforms/cloudflare/index.mdx index 2469d65661..5b2441b915 100644 --- a/website/integrations/platforms/cloudflare/index.md +++ b/website/integrations/platforms/cloudflare/index.mdx @@ -25,9 +25,9 @@ To proceed, you need: - A Cloudflare account where you are a **Super Administrator**. - A Cloudflare Zero Trust organization. - Control over DNS for `company.com`, because Cloudflare requires a TXT record to verify the email domain before Dashboard SSO can be enabled. -- A working Cloudflare Access identity provider that uses authentik. If this is not already configured, follow the [Cloudflare Access integration guide](../../security/cloudflare-access/index.md) first. +- A working Cloudflare Access identity provider that uses authentik. If this is not already configured, follow the [Cloudflare Access integration guide](../../security/cloudflare-access/index.mdx) first. -This guide configures SSO for the Cloudflare Dashboard. To protect applications with Cloudflare Access, use the [Cloudflare Access integration guide](../../security/cloudflare-access/index.md) instead. +This guide configures SSO for the Cloudflare Dashboard. To protect applications with Cloudflare Access, use the [Cloudflare Access integration guide](../../security/cloudflare-access/index.mdx) instead. :::warning Cloudflare Dashboard SSO scope Cloudflare Dashboard SSO applies to every Cloudflare user with the configured email domain, including users who already exist in Cloudflare. Cloudflare does not support plus-addressed user emails, such as `user+cloudflare@company.com`, with Dashboard SSO. diff --git a/website/integrations/platforms/drupal/index.md b/website/integrations/platforms/drupal/index.mdx similarity index 100% rename from website/integrations/platforms/drupal/index.md rename to website/integrations/platforms/drupal/index.mdx diff --git a/website/integrations/platforms/hubspot/index.md b/website/integrations/platforms/hubspot/index.mdx similarity index 100% rename from website/integrations/platforms/hubspot/index.md rename to website/integrations/platforms/hubspot/index.mdx diff --git a/website/integrations/platforms/microsoft-saml/index.md b/website/integrations/platforms/microsoft-saml/index.mdx similarity index 100% rename from website/integrations/platforms/microsoft-saml/index.md rename to website/integrations/platforms/microsoft-saml/index.mdx diff --git a/website/integrations/platforms/microsoft-ws-federation/index.md b/website/integrations/platforms/microsoft-ws-federation/index.mdx similarity index 100% rename from website/integrations/platforms/microsoft-ws-federation/index.md rename to website/integrations/platforms/microsoft-ws-federation/index.mdx diff --git a/website/integrations/platforms/personio/index.md b/website/integrations/platforms/personio/index.mdx similarity index 100% rename from website/integrations/platforms/personio/index.md rename to website/integrations/platforms/personio/index.mdx diff --git a/website/integrations/platforms/pocketbase/index.md b/website/integrations/platforms/pocketbase/index.mdx similarity index 100% rename from website/integrations/platforms/pocketbase/index.md rename to website/integrations/platforms/pocketbase/index.mdx diff --git a/website/integrations/platforms/productive/index.md b/website/integrations/platforms/productive/index.mdx similarity index 100% rename from website/integrations/platforms/productive/index.md rename to website/integrations/platforms/productive/index.mdx diff --git a/website/integrations/platforms/salesforce/index.md b/website/integrations/platforms/salesforce/index.mdx similarity index 100% rename from website/integrations/platforms/salesforce/index.md rename to website/integrations/platforms/salesforce/index.mdx diff --git a/website/integrations/platforms/wordpress/index.md b/website/integrations/platforms/wordpress/index.mdx similarity index 100% rename from website/integrations/platforms/wordpress/index.md rename to website/integrations/platforms/wordpress/index.mdx diff --git a/website/integrations/security/cloudflare-access/index.md b/website/integrations/security/cloudflare-access/index.mdx similarity index 97% rename from website/integrations/security/cloudflare-access/index.md rename to website/integrations/security/cloudflare-access/index.mdx index 61e736c569..dbbf39321b 100644 --- a/website/integrations/security/cloudflare-access/index.md +++ b/website/integrations/security/cloudflare-access/index.mdx @@ -26,7 +26,7 @@ This documentation lists only the settings that you need to change from their de ::: :::info Cloudflare Dashboard SSO -Looking to integrate authentik with your Cloudflare Dashboard? See our [integration guide](../../platforms/cloudflare/index.md) for more information. +Looking to integrate authentik with your Cloudflare Dashboard? See our [integration guide](../../platforms/cloudflare/index.mdx) for more information. ::: ## authentik configuration diff --git a/website/integrations/security/hashicorp-vault/index.md b/website/integrations/security/hashicorp-vault/index.mdx similarity index 100% rename from website/integrations/security/hashicorp-vault/index.md rename to website/integrations/security/hashicorp-vault/index.mdx diff --git a/website/integrations/security/knocknoc/index.md b/website/integrations/security/knocknoc/index.mdx similarity index 100% rename from website/integrations/security/knocknoc/index.md rename to website/integrations/security/knocknoc/index.mdx diff --git a/website/integrations/security/knowbe4/index.md b/website/integrations/security/knowbe4/index.mdx similarity index 100% rename from website/integrations/security/knowbe4/index.md rename to website/integrations/security/knowbe4/index.mdx diff --git a/website/integrations/security/macmon-nac/index.md b/website/integrations/security/macmon-nac/index.mdx similarity index 100% rename from website/integrations/security/macmon-nac/index.md rename to website/integrations/security/macmon-nac/index.mdx diff --git a/website/integrations/security/semgrep/index.md b/website/integrations/security/semgrep/index.mdx similarity index 100% rename from website/integrations/security/semgrep/index.md rename to website/integrations/security/semgrep/index.mdx diff --git a/website/integrations/security/vaultwarden/index.md b/website/integrations/security/vaultwarden/index.mdx similarity index 100% rename from website/integrations/security/vaultwarden/index.md rename to website/integrations/security/vaultwarden/index.mdx diff --git a/website/integrations/template/service.md b/website/integrations/template/service.mdx similarity index 94% rename from website/integrations/template/service.md rename to website/integrations/template/service.mdx index 67c4650e7c..43df556317 100644 --- a/website/integrations/template/service.md +++ b/website/integrations/template/service.mdx @@ -32,10 +32,10 @@ _Any specific info about this integration can go here._ 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - - _If there are any specific settings required, list them here. Refer to the [ownCloud integration documentation](https://github.com/goauthentik/authentik/blob/main/website/integrations/chat-communication-collaboration/owncloud/index.md) for a complex requirements example._ + - _If there are any specific settings required, list them here. Refer to the [ownCloud integration documentation](https://github.com/goauthentik/authentik/blob/main/website/integrations/chat-communication-collaboration/owncloud/index.mdx) for a complex requirements example._ - **Choose a Provider type**: _If there is a specific provider type required, state that here._ - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - - _If there are any specific settings required, list them here. Refer to the [ownCloud integration documentation](https://github.com/goauthentik/authentik/blob/main/website/integrations/chat-communication-collaboration/owncloud/index.md) for a complex requirements example._ + - _If there are any specific settings required, list them here. Refer to the [ownCloud integration documentation](https://github.com/goauthentik/authentik/blob/main/website/integrations/chat-communication-collaboration/owncloud/index.mdx) for a complex requirements example._ - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider.