Github/authentik
1
0
Fork 0
mirror of https://github.com/goauthentik/authentik.git synced 2026-08-30 18:51:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

website/docs: Add docs for user offboarding (#24268)

Browse Source 
* add USER_OFFBOARDED event

* Add UserOffboarding model

* add shared offboard_user service

* add offboarding API and scheduled sweeper

* regenerate schema and TS client

* first pass of offboarding UI

* add initiator for event audit attribution

* refactor ReviewerUser to PartialUser since now that's the way to go

* make it atomic

* prevent 2 workers to offboard an user at the same time

* update migration file

* fix linting

* add missing migration

* add test for prevent self offboard

* Add UserOffboarding.cancel() and log who cancelled

* Add confirmation dialog for cancel offboarding and add IDs to strings

* Reference user_id, not user, to avoid a DB fetch

* update schema and clients

* Add enum overrides for offboarding

* prevent duplicate offboardings and show API errors

* use send_with_options(rel_obj=Schedule…) so executions show under their schedule

* use partial index

* refactor comment

* Add datetime-local fallback

* prevent cancel/excecute race condition, make records inmutable

* add authentik.enterprise.core.revocation for shared functionality

* refactor account lockdown to use shared revocation functionality

* Simplify transaction

* switch to mixin composition for UserOffboardingViewSet

* use new @enterprise_test decorator

* refactor lifecycle app between review and offboarding

* prevent unnecessary redaction of revoke_tokens boolean in the logs

* prevent an user/admin to cancel their own offboarding

* add UI, Events > Offboardings to show pending offboardings

* Add docs for user offboarding

* fix linting

* Cleanup.

* Apply suggestions from code review

Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

* rename scheduled_at and executed_at fields

* update scheduled_at field

* improve help text to be more accurate

* change button color

* switch boilerplate actions for Cancel offboarding

* remove preview banner

* use task.rel_obj, apply code review suggestions

* implement code review suggestions

* Add docs for user offboarding

* fix linting

* Cleanup.

* Apply suggestions from code review

Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

* Regenerate the offboarding client models

* trigger build

---------

Signed-off-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Dominic R <dominic@goauthentik.io>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
This commit is contained in:
Marcelo Elizeche Landó
2026-07-27 19:55:23 -03:00
committed by GitHub
parent 630e9ec47d
commit d7b37a9bee
1 changed files with 67 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
website/docs/sys-mgmt/user-offboarding.md Normal file
View File

@@ -0,0 +1,67 @@
---
title: User offboarding
description: "Schedule the deactivation or deletion of a user, with optional session and token revocation."
sidebar_label: User offboarding
authentik_enterprise: true
authentik_version: "2026.8.0"
authentik_preview: true
---
User offboarding lets you schedule the deactivation or deletion of a user account for a future date and time. You can also revoke the user's sessions and tokens when the offboarding runs.
For example, you can schedule an offboarding as soon as you know an employee's last day instead of relying on an administrator to update the account that day.
## Choose an offboarding action
Each offboarding performs one of the following actions:
- **Deactivate**: Marks the user as inactive so that they can no longer log in. The user account and its data remain in authentik.
- **Delete**: Permanently deletes the user account.
You can apply either action with the following options:
- **Revoke sessions**: Ends the user's active sessions.
- **Revoke tokens**: Revokes the user's tokens and related credentials.
Both options are enabled by default. Leave them enabled to prevent existing sessions or credentials from retaining access after the offboarding runs.
## Schedule a user offboarding
You cannot schedule an offboarding for your own account or for an internal service account. Each user can have only one pending offboarding.
1. In the Admin interface, navigate to **Directory** > **Users**.
2. Select the user, and then click **Schedule Offboarding** in the **Actions** section.
3. Select **Deactivate** or **Delete** for the **Action**.
4. In **Scheduled for**, enter a future date and time.
5. Configure **Revoke sessions** and **Revoke tokens**.
6. Click **Schedule**.
The **Schedule Offboarding** button changes to **Cancel Offboarding**. You can also find the scheduled offboarding under **Events** > **Offboardings**.
## Monitor user offboardings
The **Events** > **Offboardings** page shows pending offboardings by default. Disable **Only show pending offboardings** to include available completed, failed, and canceled records.
| State | Description |
| ------------- | --------------------------------------------------------------------------------------------------- |
| **Pending** | The offboarding is waiting for its scheduled date and time. |
| **Completed** | The offboarding completed successfully. |
| **Failed** | The offboarding did not complete after five attempts. Changes from failed attempts are rolled back. |
| **Canceled** | An administrator canceled the offboarding before it ran. The canceled record remains in the list. |
authentik checks for due offboardings every five minutes. The action normally starts within five minutes after the scheduled time, but a task backlog can delay it further. If an attempt fails, authentik retries the complete offboarding action. After five failed attempts, the offboarding is marked **Failed** and is not retried again.
After an offboarding completes, authentik writes a **User Offboarded** event to the [events log](./events/index.md). The event identifies the administrator who scheduled the offboarding, the selected action, and whether session and token revocation were enabled.
:::note
A successful **Delete** action removes the offboarding record with the user account. The **User Offboarded** event remains in the audit log.
:::
## Cancel a user offboarding
To cancel a pending offboarding, use either of these methods:
- On the user's details page, click **Cancel Offboarding**, review the scheduled action, and confirm the cancellation.
- On the **Events** > **Offboardings** page, select the offboarding, click **Cancel**, and confirm the cancellation.
Canceling changes the offboarding to **Canceled** and allows you to schedule another offboarding for the user. You cannot cancel an offboarding that targets your own account.