326 lines
8.5 KiB
Django/Jinja
326 lines
8.5 KiB
Django/Jinja
version: 1
|
|
metadata:
|
|
name: enrollment-flow
|
|
entries:
|
|
# --- Brand configuration ---
|
|
- model: authentik_brands.brand
|
|
identifiers:
|
|
domain: authentik-default
|
|
state: present
|
|
attrs:
|
|
branding_title: {{ domain }}
|
|
{% if branding_logo is defined %}
|
|
branding_logo: {{ branding_logo }}
|
|
{% endif %}
|
|
{% if branding_favicon is defined %}
|
|
branding_favicon: {{ branding_favicon }}
|
|
{% endif %}
|
|
|
|
# --- Enrollment flow ---
|
|
- model: authentik_flows.flow
|
|
id: enrollment-flow
|
|
identifiers:
|
|
slug: default-enrollment-flow
|
|
attrs:
|
|
name: Sign Up
|
|
title: Create an account
|
|
designation: enrollment
|
|
authentication: require_unauthenticated
|
|
|
|
# --- Recovery flow ---
|
|
- model: authentik_flows.flow
|
|
id: recovery-flow
|
|
identifiers:
|
|
slug: default-recovery-flow
|
|
attrs:
|
|
name: Password Recovery
|
|
title: Reset your password
|
|
designation: recovery
|
|
authentication: require_unauthenticated
|
|
|
|
# --- Prompt fields ---
|
|
- model: authentik_stages_prompt.prompt
|
|
id: field-email
|
|
identifiers:
|
|
name: enrollment-field-email
|
|
attrs:
|
|
field_key: email
|
|
label: Email
|
|
type: email
|
|
required: true
|
|
placeholder: Email
|
|
placeholder_expression: false
|
|
order: 0
|
|
|
|
- model: authentik_stages_prompt.prompt
|
|
id: field-username
|
|
identifiers:
|
|
name: enrollment-field-username
|
|
attrs:
|
|
field_key: username
|
|
label: Username
|
|
type: username
|
|
required: true
|
|
placeholder: Username
|
|
placeholder_expression: false
|
|
order: 1
|
|
|
|
- model: authentik_stages_prompt.prompt
|
|
id: field-password
|
|
identifiers:
|
|
name: enrollment-field-password
|
|
attrs:
|
|
field_key: password
|
|
label: Password
|
|
type: password
|
|
required: true
|
|
placeholder: Password
|
|
placeholder_expression: false
|
|
order: 2
|
|
|
|
- model: authentik_stages_prompt.prompt
|
|
id: field-password-repeat
|
|
identifiers:
|
|
name: enrollment-field-password-repeat
|
|
attrs:
|
|
field_key: password_repeat
|
|
label: Password (repeat)
|
|
type: password
|
|
required: true
|
|
placeholder: Password (repeat)
|
|
placeholder_expression: false
|
|
order: 3
|
|
|
|
# --- Password policy ---
|
|
- model: authentik_policies_password.passwordpolicy
|
|
id: password-policy
|
|
identifiers:
|
|
name: enrollment-password-policy
|
|
attrs:
|
|
name: enrollment-password-policy
|
|
length_min: 10
|
|
amount_uppercase: 1
|
|
amount_lowercase: 1
|
|
amount_digits: 1
|
|
amount_symbols: 1
|
|
check_static_rules: true
|
|
check_have_i_been_pwned: true
|
|
check_zxcvbn: true
|
|
zxcvbn_score_threshold: 3
|
|
error_message: "Password must be at least 10 characters with uppercase, lowercase, digit, and symbol."
|
|
|
|
# --- Enrollment stages ---
|
|
- model: authentik_stages_prompt.promptstage
|
|
id: enrollment-prompt-stage
|
|
identifiers:
|
|
name: enrollment-prompt
|
|
attrs:
|
|
fields:
|
|
- !KeyOf field-email
|
|
- !KeyOf field-username
|
|
- !KeyOf field-password
|
|
- !KeyOf field-password-repeat
|
|
validation_policies:
|
|
- !KeyOf password-policy
|
|
|
|
- model: authentik_stages_user_write.userwritestage
|
|
id: enrollment-user-write
|
|
identifiers:
|
|
name: enrollment-user-write
|
|
attrs:
|
|
user_creation_mode: always_create
|
|
create_users_as_inactive: true
|
|
|
|
- model: authentik_stages_email.emailstage
|
|
id: enrollment-email-verification
|
|
identifiers:
|
|
name: enrollment-email-verification
|
|
attrs:
|
|
use_global_settings: true
|
|
activate_user_on_success: true
|
|
subject: Verify your email address
|
|
template: email/account-confirmation.html
|
|
|
|
- model: authentik_stages_user_login.userloginstage
|
|
id: enrollment-user-login
|
|
identifiers:
|
|
name: enrollment-user-login
|
|
|
|
# --- Enrollment flow stage bindings ---
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf enrollment-flow
|
|
stage: !KeyOf enrollment-prompt-stage
|
|
order: 10
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf enrollment-flow
|
|
stage: !KeyOf enrollment-user-write
|
|
order: 20
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf enrollment-flow
|
|
stage: !KeyOf enrollment-email-verification
|
|
order: 30
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf enrollment-flow
|
|
stage: !KeyOf enrollment-user-login
|
|
order: 100
|
|
|
|
# --- Recovery stages ---
|
|
- model: authentik_stages_identification.identificationstage
|
|
id: recovery-identification
|
|
identifiers:
|
|
name: recovery-identification
|
|
attrs:
|
|
user_fields:
|
|
- email
|
|
|
|
- model: authentik_stages_email.emailstage
|
|
id: recovery-email
|
|
identifiers:
|
|
name: recovery-email
|
|
attrs:
|
|
use_global_settings: true
|
|
subject: Reset your password
|
|
template: email/password-reset.html
|
|
|
|
- model: authentik_stages_prompt.prompt
|
|
id: field-recovery-password
|
|
identifiers:
|
|
name: recovery-field-password
|
|
attrs:
|
|
field_key: password
|
|
label: New Password
|
|
type: password
|
|
required: true
|
|
placeholder: New Password
|
|
placeholder_expression: false
|
|
order: 0
|
|
|
|
- model: authentik_stages_prompt.prompt
|
|
id: field-recovery-password-repeat
|
|
identifiers:
|
|
name: recovery-field-password-repeat
|
|
attrs:
|
|
field_key: password_repeat
|
|
label: New Password (repeat)
|
|
type: password
|
|
required: true
|
|
placeholder: New Password (repeat)
|
|
placeholder_expression: false
|
|
order: 1
|
|
|
|
- model: authentik_stages_prompt.promptstage
|
|
id: recovery-password-stage
|
|
identifiers:
|
|
name: recovery-password-prompt
|
|
attrs:
|
|
fields:
|
|
- !KeyOf field-recovery-password
|
|
- !KeyOf field-recovery-password-repeat
|
|
validation_policies:
|
|
- !KeyOf password-policy
|
|
|
|
- model: authentik_stages_user_write.userwritestage
|
|
id: recovery-user-write
|
|
identifiers:
|
|
name: recovery-user-write
|
|
attrs:
|
|
user_creation_mode: never_create
|
|
|
|
- model: authentik_stages_user_login.userloginstage
|
|
id: recovery-user-login
|
|
identifiers:
|
|
name: recovery-user-login
|
|
|
|
# --- Recovery flow stage bindings ---
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf recovery-flow
|
|
stage: !KeyOf recovery-identification
|
|
order: 10
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf recovery-flow
|
|
stage: !KeyOf recovery-email
|
|
order: 20
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf recovery-flow
|
|
stage: !KeyOf recovery-password-stage
|
|
order: 30
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf recovery-flow
|
|
stage: !KeyOf recovery-user-write
|
|
order: 40
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf recovery-flow
|
|
stage: !KeyOf recovery-user-login
|
|
order: 100
|
|
|
|
# --- Unenrollment (account deletion) flow ---
|
|
- model: authentik_flows.flow
|
|
id: unenrollment-flow
|
|
identifiers:
|
|
slug: default-unenrollment-flow
|
|
attrs:
|
|
name: Delete Account
|
|
title: Delete your account
|
|
designation: unenrollment
|
|
|
|
- model: authentik_stages_consent.consentstage
|
|
id: unenrollment-consent
|
|
identifiers:
|
|
name: unenrollment-consent
|
|
attrs:
|
|
mode: always_require
|
|
|
|
- model: authentik_stages_user_delete.userdeletestage
|
|
id: unenrollment-user-delete
|
|
identifiers:
|
|
name: unenrollment-user-delete
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf unenrollment-flow
|
|
stage: !KeyOf unenrollment-consent
|
|
order: 10
|
|
|
|
- model: authentik_flows.flowstagebinding
|
|
identifiers:
|
|
target: !KeyOf unenrollment-flow
|
|
stage: !KeyOf unenrollment-user-delete
|
|
order: 20
|
|
|
|
# --- Set recovery and unenrollment flows on brand ---
|
|
- model: authentik_brands.brand
|
|
identifiers:
|
|
domain: authentik-default
|
|
state: present
|
|
attrs:
|
|
flow_recovery: !KeyOf recovery-flow
|
|
flow_unenrollment: !KeyOf unenrollment-flow
|
|
|
|
{% if social_login_sources is not defined or social_login_sources | length == 0 %}
|
|
# --- Bind enrollment flow to the default login identification stage ---
|
|
- model: authentik_stages_identification.identificationstage
|
|
identifiers:
|
|
name: default-authentication-identification
|
|
state: present
|
|
attrs:
|
|
user_fields:
|
|
- email
|
|
- username
|
|
enrollment_flow: !KeyOf enrollment-flow
|
|
{% endif %}
|