dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(authentik): document the self-serve user-settings flow + password stage

Browse Source 
The default-user-settings-flow was missing a PasswordStage, so users could
edit name/email/locale but not their password. Added a PasswordStage
(InbuiltBackend) bound at order 101. Documented the flow's stage table and
the two ORM gotchas (MTI through model, required backends array).
This commit is contained in:
Frank
2026-09-24 21:16:10 -07:00
parent 201c8437dd
commit 8108dc4254
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Infrastructure/Authentik.md
+28
View File
@@ -272,6 +272,34 @@ Two secrets live in the host `.env` (git-ignored; placeholders in
`dankclaw/authentik/quadlet/`, run `./scripts/deploy.sh dankclaw`. Authentik
migrates the schema on startup.
## Self-serve user-settings flow (password change)
Users change their own account details through the `default-user-settings-flow`
(`https://auth.franksdank.cloud/if/flow/default-user-settings-flow/`) — the
target of the homepage footer's "account" link. It is a `stage_configuration`
designated flow, so it renders every bound `ConfigurableStage` for the logged-in
user.
Stages, in execution order (the `FlowStageBinding.order` field, not the M2M
insertion order):
| order | stage | type | what it does |
|---|---|---|---|
| 20 | `default-user-settings` | `PromptStage` | intro prompt |
| 100 | `default-user-settings-write` | `UserWriteStage` | edit name / email / locale |
| 101 | `default-user-settings-password` | `PasswordStage` | change password (`InbuiltBackend`) |
**The `PasswordStage` was missing until 2026-09-25.** The stock flow only
carried the prompt + `UserWriteStage`, so users could edit name/email/locale
but had no way to change their password. The fix: create a `PasswordStage`
(backend `authentik.core.auth.InbuiltBackend`) and bind it to the flow. Two
ORM gotchas: `Flow.stages.add()` fails on this through model
(`Can't bulk create a multi-table inherited model` — `FlowStageBinding` is
MTI), so create the `FlowStageBinding` row directly with an explicit `order`;
and `PasswordStage` requires the `backends` array (a bare `name` insert hits a
`NOT NULL` violation). Verified via the `FlowPlanner` — the plan now lists all
three stages.
## Outpost claim cache (`proxysession`) — 403 after a group add
The embedded outpost does not re-evaluate group membership per request. Each