Skip to content

Commit 50d2f69

Browse files
kensternberg-authentikkensternberg-authentik
committed
Merge branch 'main' into dev
* main: website: revise full development environment instructions (#12638) website: bump typescript from 5.7.2 to 5.7.3 in /website (#12620) website: bump aws-cdk from 2.174.1 to 2.175.0 in /website (#12621) ci: bump docker/setup-qemu-action from 3.2.0 to 3.3.0 (#12622) core: bump twilio from 9.4.1 to 9.4.2 (#12623) core: bump python-kadmin-rs from 0.5.2 to 0.5.3 (#12624) core: bump ruff from 0.8.6 to 0.9.0 (#12625) core: bump pydantic from 2.10.4 to 2.10.5 (#12626) core: bump google-api-python-client from 2.157.0 to 2.158.0 (#12628) core: bump goauthentik.io/api/v3 from 3.2024121.3 to 3.2024122.1 (#12629) web: bump API Client version (#12617) release: 2024.12.2 (#12615) website/docs: prepare 2024.12.2 release notes (#12614) providers/saml: fix invalid SAML Response when assertion and response are signed (#12611) core: fix error when creating new user with default path (#12609) rbac: permissions endpoint: allow authenticated users (#12608) website/docs: update customer portal (#12603) website/docs: policy for email whitelist: modernize (#12558)
2 parents 7d972ec + 84de155 commit 50d2f69

File tree

31 files changed

+284
-400
lines changed

31 files changed

+284
-400
lines changed

‎.bumpversion.cfg

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[bumpversion]
2-
current_version = 2024.12.1
2+
current_version = 2024.12.2
33
tag = True
44
commit = True
55
parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?

‎.github/workflows/ci-main.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ jobs:
243243
with:
244244
ref: ${{ github.event.pull_request.head.sha }}
245245
- name: Set up QEMU
246-
uses: docker/setup-qemu-action@v3.2.0
246+
uses: docker/setup-qemu-action@v3.3.0
247247
- name: Set up Docker Buildx
248248
uses: docker/setup-buildx-action@v3
249249
- name: prepare variables

‎.github/workflows/ci-outpost.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ jobs:
8282
with:
8383
ref: ${{ github.event.pull_request.head.sha }}
8484
- name: Set up QEMU
85-
uses: docker/setup-qemu-action@v3.2.0
85+
uses: docker/setup-qemu-action@v3.3.0
8686
- name: Set up Docker Buildx
8787
uses: docker/setup-buildx-action@v3
8888
- name: prepare variables

‎.github/workflows/release-publish.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
steps:
1818
- uses: actions/checkout@v4
1919
- name: Set up QEMU
20-
uses: docker/setup-qemu-action@v3.2.0
20+
uses: docker/setup-qemu-action@v3.3.0
2121
- name: Set up Docker Buildx
2222
uses: docker/setup-buildx-action@v3
2323
- name: prepare variables
@@ -83,7 +83,7 @@ jobs:
8383
with:
8484
go-version-file: "go.mod"
8585
- name: Set up QEMU
86-
uses: docker/setup-qemu-action@v3.2.0
86+
uses: docker/setup-qemu-action@v3.3.0
8787
- name: Set up Docker Buildx
8888
uses: docker/setup-buildx-action@v3
8989
- name: prepare variables

‎authentik/__init__.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
from os import environ
44

5-
__version__ = "2024.12.1"
5+
__version__ = "2024.12.2"
66
ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
77

88

‎authentik/providers/saml/processors/assertion.py

+13-1
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,7 @@ def get_assertion(self) -> Element:
256256
assertion.attrib["IssueInstant"] = self._issue_instant
257257
assertion.append(self.get_issuer())
258258

259-
if self.provider.signing_kp:
259+
if self.provider.signing_kp and self.provider.sign_assertion:
260260
sign_algorithm_transform = SIGN_ALGORITHM_TRANSFORM_MAP.get(
261261
self.provider.signature_algorithm, xmlsec.constants.TransformRsaSha1
262262
)
@@ -295,6 +295,18 @@ def get_response(self) -> Element:
295295

296296
response.append(self.get_issuer())
297297

298+
if self.provider.signing_kp and self.provider.sign_response:
299+
sign_algorithm_transform = SIGN_ALGORITHM_TRANSFORM_MAP.get(
300+
self.provider.signature_algorithm, xmlsec.constants.TransformRsaSha1
301+
)
302+
signature = xmlsec.template.create(
303+
response,
304+
xmlsec.constants.TransformExclC14N,
305+
sign_algorithm_transform,
306+
ns=xmlsec.constants.DSigNs,
307+
)
308+
response.append(signature)
309+
298310
status = SubElement(response, f"{{{NS_SAML_PROTOCOL}}}Status")
299311
status_code = SubElement(status, f"{{{NS_SAML_PROTOCOL}}}StatusCode")
300312
status_code.attrib["Value"] = "urn:oasis:names:tc:SAML:2.0:status:Success"

‎authentik/providers/saml/tests/test_auth_n_request.py

+17
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,25 @@
22

33
from base64 import b64encode
44

5+
from defusedxml.lxml import fromstring
56
from django.http.request import QueryDict
67
from django.test import TestCase
8+
from lxml import etree # nosec
79

810
from authentik.blueprints.tests import apply_blueprint
911
from authentik.core.tests.utils import create_test_admin_user, create_test_cert, create_test_flow
1012
from authentik.crypto.models import CertificateKeyPair
1113
from authentik.events.models import Event, EventAction
1214
from authentik.lib.generators import generate_id
1315
from authentik.lib.tests.utils import get_request
16+
from authentik.lib.xml import lxml_from_string
1417
from authentik.providers.saml.models import SAMLPropertyMapping, SAMLProvider
1518
from authentik.providers.saml.processors.assertion import AssertionProcessor
1619
from authentik.providers.saml.processors.authn_request_parser import AuthNRequestParser
1720
from authentik.sources.saml.exceptions import MismatchedRequestID
1821
from authentik.sources.saml.models import SAMLSource
1922
from authentik.sources.saml.processors.constants import (
23+
NS_MAP,
2024
SAML_BINDING_REDIRECT,
2125
SAML_NAME_ID_FORMAT_EMAIL,
2226
SAML_NAME_ID_FORMAT_UNSPECIFIED,
@@ -185,6 +189,19 @@ def test_request_signed_both(self):
185189
self.assertEqual(response.count(response_proc._assertion_id), 2)
186190
self.assertEqual(response.count(response_proc._response_id), 2)
187191

192+
schema = etree.XMLSchema(
193+
etree.parse("schemas/saml-schema-protocol-2.0.xsd", parser=etree.XMLParser()) # nosec
194+
)
195+
self.assertTrue(schema.validate(lxml_from_string(response)))
196+
197+
response_xml = fromstring(response)
198+
self.assertEqual(
199+
len(response_xml.xpath("//saml:Assertion/ds:Signature", namespaces=NS_MAP)), 1
200+
)
201+
self.assertEqual(
202+
len(response_xml.xpath("//samlp:Response/ds:Signature", namespaces=NS_MAP)), 1
203+
)
204+
188205
# Now parse the response (source)
189206
http_request.POST = QueryDict(mutable=True)
190207
http_request.POST["SAMLResponse"] = b64encode(response.encode()).decode()

‎authentik/rbac/api/rbac.py

+5
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
from django.db.models import QuerySet
66
from django_filters.filters import ModelChoiceFilter
77
from django_filters.filterset import FilterSet
8+
from django_filters.rest_framework import DjangoFilterBackend
89
from rest_framework.exceptions import ValidationError
910
from rest_framework.fields import (
1011
CharField,
@@ -13,6 +14,8 @@
1314
ReadOnlyField,
1415
SerializerMethodField,
1516
)
17+
from rest_framework.filters import OrderingFilter, SearchFilter
18+
from rest_framework.permissions import IsAuthenticated
1619
from rest_framework.viewsets import ReadOnlyModelViewSet
1720

1821
from authentik.core.api.utils import ModelSerializer, PassiveSerializer
@@ -92,7 +95,9 @@ class RBACPermissionViewSet(ReadOnlyModelViewSet):
9295
queryset = Permission.objects.none()
9396
serializer_class = PermissionSerializer
9497
ordering = ["name"]
98+
filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter]
9599
filterset_class = PermissionFilter
100+
permission_classes = [IsAuthenticated]
96101
search_fields = [
97102
"codename",
98103
"content_type__model",

‎blueprints/schema.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"$schema": "http://json-schema.org/draft-07/schema",
33
"$id": "https://goauthentik.io/blueprints/schema.json",
44
"type": "object",
5-
"title": "authentik 2024.12.1 Blueprint schema",
5+
"title": "authentik 2024.12.2 Blueprint schema",
66
"required": [
77
"version",
88
"entries"

‎docker-compose.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ services:
3131
volumes:
3232
- redis:/data
3333
server:
34-
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.1}
34+
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.2}
3535
restart: unless-stopped
3636
command: server
3737
environment:
@@ -54,7 +54,7 @@ services:
5454
redis:
5555
condition: service_healthy
5656
worker:
57-
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.1}
57+
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.2}
5858
restart: unless-stopped
5959
command: worker
6060
environment:

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ require (
2929
github.com/spf13/cobra v1.8.1
3030
github.com/stretchr/testify v1.10.0
3131
github.com/wwt/guac v1.3.2
32-
goauthentik.io/api/v3 v3.2024121.3
32+
goauthentik.io/api/v3 v3.2024122.1
3333
golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab
3434
golang.org/x/oauth2 v0.25.0
3535
golang.org/x/sync v0.10.0

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -299,8 +299,8 @@ go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y
299299
go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
300300
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
301301
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
302-
goauthentik.io/api/v3 v3.2024121.3 h1:0s4a/3ktiGEr0jbIJqm8PNHWhYD8vwuoI8SCQo1ptiI=
303-
goauthentik.io/api/v3 v3.2024121.3/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
302+
goauthentik.io/api/v3 v3.2024122.1 h1:LsGUztpcDrKN2XY+//ITQm9GE0Iplc3wWHQN9QO9fQg=
303+
goauthentik.io/api/v3 v3.2024122.1/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
304304
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
305305
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
306306
golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=

‎internal/constants/constants.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,4 @@ func UserAgent() string {
2929
return fmt.Sprintf("authentik@%s", FullVersion())
3030
}
3131

32-
const VERSION = "2024.12.1"
32+
const VERSION = "2024.12.2"

‎package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"name": "@goauthentik/authentik",
3-
"version": "2024.12.1",
3+
"version": "2024.12.2",
44
"private": true
55
}

0 commit comments

Comments
 (0)