Github/authentik
1
0
Fork 0
mirror of https://github.com/goauthentik/authentik.git synced 2026-08-30 18:51:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

docs

Browse Source
This commit is contained in:
Dominic R
2026-08-19 23:54:14 -04:00
parent 19d1a1e473
commit 7412ddcdad
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
website/docs/customize/blueprints/v1/models.mdx
View File

@@ -47,9 +47,9 @@ For example:
### `password_hash`
In blueprints, a user's password can also be set using the `password_hash` field. The value must be a valid Django password hash, such as one generated with the `hash_password` management command.
In blueprints, a user's password can also be set using the `password_hash` field. authentik stores the value as supplied and does not apply the import policy used by bootstrap and the API. Use a Django password hash that this instance can verify, such as one from `hash_password`.
Use `password_hash` when you need to import or bootstrap an existing hash without exposing the raw password to authentik. Enter the password when prompted to generate the hash:
Use `password_hash` when you need to import an existing hash without exposing the raw password to authentik. Enter the password when prompted:
```bash
docker compose run --rm server hash_password
@@ -76,7 +76,7 @@ For example:
`password` and `password_hash` are mutually exclusive; setting both on the same user causes blueprint validation to fail.
`password_hash` follows the [hashed-password import behavior](../../../install-config/automated-install.mdx#authentik_bootstrap_password_hash): it updates only authentik's local password verifier and does not propagate to LDAP or Kerberos integrations.
`password_hash` updates only authentik's local password verifier and does not propagate to LDAP or Kerberos integrations. See [hashed-password imports](../../../install-config/automated-install.mdx#authentik_bootstrap_password_hash).
### `permissions`

8
website/docs/install-config/automated-install.mdx
View File

@@ -13,7 +13,9 @@ These can't be defined using the file-based syntax (`file://`), so you can't pas
Configure the default password for the `akadmin` user using a pre-hashed Django password value. Only read on the first startup.
This stores the hash directly as authentik's local password verifier. Because authentik never sees the raw password, hashed-password imports do not propagate the password to LDAP or Kerberos integrations, even when password writeback is enabled. authentik validates imported hashes before storing them and rejects malformed values.
This stores the hash directly as authentik's local password verifier. Because authentik never sees the raw password, hashed-password imports do not propagate the password to LDAP or Kerberos integrations, even when password writeback is enabled.
The hash must use `pbkdf2_sha256`, `argon2`, `bcrypt_sha256`, or `scrypt`, with current [work factors](https://docs.djangoproject.com/en/stable/topics/auth/passwords/#increasing-the-work-factor) and [salt entropy](https://docs.djangoproject.com/en/stable/topics/auth/passwords/#increasing-the-salt-entropy). `hash_password` produces a hash that meets these requirements. Existing stored hashes, including `pbkdf2_sha1`, continue to verify.
To generate a hash, run this command before your initial deployment and enter the password when prompted:
@@ -70,7 +72,9 @@ Setting both `AUTHENTIK_BOOTSTRAP_PASSWORD` and `AUTHENTIK_BOOTSTRAP_PASSWORD_HA
For post-install automation, hashed passwords can also be set via blueprints with the `password_hash` user attribute, or via the `/api/v3/core/users/<id>/set_password_hash/` API endpoint with the hash provided in the `password` field. The API endpoint requires the `authentik_core.reset_user_password` permission and can target regular users or service accounts.
These paths share the same validation and local-verifier-only behavior as `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.
The API uses the same import policy as `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`. Set `override` to `true` to import another valid Django hash. Bootstrap has no override. Blueprints store `password_hash` as supplied, without that policy.
All hashed-password import paths update only authentik's local password verifier.
### `AUTHENTIK_BOOTSTRAP_TOKEN`