* packages/fonts: add @goauthentik/fonts package
Extract the bundled web fonts out of web/ into a dedicated
@goauthentik/fonts workspace package: the RedHat variable faces, the
PatternFly pficon icon face, and the FontAwesome Free solid face, each
with its upstream license recorded under licenses/.
web/ now pulls the faces and icons from the package's
@goauthentik/fonts/faces.css and @goauthentik/fonts/icons.css entry
points instead of the old #fonts/* import and the inlined pficon.scss
vendor sheet.
Anchor esbuild's [dir] at the monorepo root via outbase so assets pulled
from the out-of-web package no longer resolve to a "_.._" segment, which
Go's //go:embed silently drops from the embedded outpost build.
Co-Authored-By: Ken Sternberg <ken@goauthentik.io>
* packages/theme: add @goauthentik/theme design-system package
Add @goauthentik/theme, which defines authentik's design tokens (color,
typography, fonts, spacing, shape, shadow, motion, z-index) in TypeScript
and builds them into CSS via styleframe.
Token names carry a distinct separator per category so the token type is
recoverable from the name alone. That is worth the verbosity: it keeps
the DX legible and leaves room for automatic theme management and future
tooling built on top of the token set.
Co-Authored-By: Ken Sternberg <ken@goauthentik.io>
* web/theme: add a demo page for the theme tokens
Add a self-contained demo page, built by build-demo.mjs, that renders
every theme token — colors, typography, spacing, shape, shadow, motion —
so the design system can be eyeballed in isolation while it evolves.
Co-Authored-By: Ken Sternberg <ken@goauthentik.io>
* Heal lockfile.
* Fix spelling.
* Fix grouping.
---------
Co-authored-by: Ken Sternberg <ken@goauthentik.io>
* providers/scim: accept a service provider that reports bulk as unsupported
RFC 7644 Section 5 defines the bulk limits alongside bulk support, so a
provider answering `"bulk": {"supported": false}` and nothing else is
conforming. Requiring maxOperations made that response fail validation,
and get_service_provider_config() fell back to a configuration reporting
patch and filter as unsupported no matter what the provider advertised.
The effect shows up far from the parse. SCIMGroupClient.update() takes
its PUT branch instead of PATCH, and SCIMUserClient.create() skips the
409 recovery guarded by filter.supported, so an object that already
exists remotely can never be adopted and the create retries forever.
0 is what ServiceProviderConfiguration.default() already passes, and
_patch_chunked() already reads anything below 1 as no declared limit.
* fix incorrect test
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: YEONGCHANG YUN <2026stobleague@gmail.com>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
* providers/oauth2: send back-channel logout requests when a user is deactivated
* prevent deleting access tokens until deactivated user is logged out
* update tests
* improve tests
* update tests
* only skip deleting backchannel logout tokens
Two SAML and LDAP source fields were renamed in 2026.8 and some guides
still name the old labels.
The SAML source field is now Issuer override, and it defaults to the
metadata URL, so setting it to that value is optional rather than a
required step. The canonical SAML source page was already updated; the
Google Workspace, Keycloak, and Shibboleth guides were not.
The LDAP source field is now Additional Parent Group. That rename came
from the same change that added Sync Group Parents, which the LDAP page
did pick up on the line directly above.
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
Bolded references to UI elements are meant to help a reader find a
control on screen, so they should reproduce the on-screen string exactly.
Across the docs, 86 distinct labels differed from the product only in
capitalization, in both directions.
Adds the rule to the style guide, since it did not previously say
anything about case for UI references, and corrects the existing
occurrences against the current forms.
Occurrences that refer to a third-party console rather than authentik are
deliberately left alone.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The CONN_OPTIONS family was deprecated in 2026.5 but the configuration
reference still documented all four members as ordinary settings. The
Deprecated Settings section only covers USE_PGBOUNCER and USE_PGPOOL.
Also documents AUTHENTIK_LISTEN__RADIUS, which the RADIUS outpost reads
but which was missing from the listen settings, and narrows the scope of
AUTHENTIK_LISTEN__DEBUG. Since the server and proxy outpost were
rewritten in Rust, only the LDAP, RADIUS, and RAC outposts still serve
the Go debug listener.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The shipped proxy outpost is the Rust binary, so unauthenticated path and
URL patterns are compiled by the Rust regex crate rather than Go's parser.
Also documents that a pattern which fails to compile is skipped with a
warning instead of raising an error, since that means a typo quietly
leaves a path authenticated.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* providers/scim: mark the fallback service provider config as a fallback
* providers/scim: fix group member removals without PATCH support
* providers/scim: build the group update payload once
* website/docs: document the hexworld event map
* website/docs: drop the OSM tile server from the air-gapped outbound list
The events map no longer reaches tile.openstreetmap.org — the bundled
basemap makes no outbound connections. Note the one way it can reach out
again: a custom basemap configured on a brand.
---------
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
* website: use $host instead of $http_host for proxy provider redirects.
The Proxy Provider nginx recipes set the upstream Host header from
$host but built X-Original-URL and the sign-in redirect (rd=) from
$http_host, the raw client-supplied Host header. authentik's outpost
parses that value directly (getNginxForwardUrl), so an unvalidated
Host header flows into its own redirect construction. Use $host
consistently, matching what the same files already do for Host.
X-Forwarded-Host in the ingress-nginx snippet is left as $http_host;
that's a different, informational header, not authentik's own
redirect construction.
* Update to deal with non-standard ports
* WIP
---------
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Dominic Roy <dominic@goauthentik.io>
