✅ Deploy Preview for authentik-docs canceled.

✅ Deploy Preview for authentik-integrations canceled.

✅ Deploy Preview for authentik-storybook canceled.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.16%. Comparing base (071305d) to head (9ea8ba6).
⚠️ Report is 543 commits behind head on main.

@@            Coverage Diff             @@
##             main   #15572      +/-   ##
==========================================
+ Coverage   93.15%   93.16%   +0.01%     
==========================================
  Files         831      831              
  Lines       44135    44185      +50     
==========================================
+ Hits        41115    41166      +51     
+ Misses       3020     3019       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

I'd strongly prefer to not include something like this, even with the additional permission required, this still makes it quite easy to shoot yourself in the foot. We could add an endpoint that requires admin auth to validate an individual user's password instead?

We could add an endpoint that requires admin auth to validate an individual user's password instead?

Whilst interesting too, the goal was rather for the other IDP to synchronize user data completely in order for it to operate independently of Authentik and merely connect occasionally to pull/push changed data.

How about shielding this "feature" behind a very explicit config:

• AUTHENTIK_I_KNOW_WHAT_IM_DOING_IS_GONNA_BE_DANGEROUS_YES_SHOW_ME_THE_PW_HASH=1

By default is deactivated, so it's harder to shoot yourself in the foot, and if you get to that point you must know what you're doing.

the goal was rather for the other IDP to synchronize user data completely in order for it to operate independently of Authentik and merely connect occasionally to pull/push changed data.

Generally when talking about two-way synchronization across multiple IdPs, this would already be supported by various enterprise features (e.g. source stage) rather than as a typical homelab use case.

We read https://docs.goauthentik.io/docs/add-secure-apps/flows-stages/stages/source/ but it is by our understanding not suitable to sync complete user information (including passphrase hashes) out of Authentik to a secondary IDP.