providers/saml: auto pull signature algorithm options#17614
Merged
PeshekDotDev merged 1 commit intomainfrom Feb 3, 2026
Merged
providers/saml: auto pull signature algorithm options#17614PeshekDotDev merged 1 commit intomainfrom
PeshekDotDev merged 1 commit intomainfrom
Conversation
✅ Deploy Preview for authentik-docs canceled.
|
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #17614 +/- ##
==========================================
+ Coverage 93.21% 93.26% +0.05%
==========================================
Files 968 968
Lines 53418 53430 +12
==========================================
+ Hits 49793 49833 +40
+ Misses 3625 3597 -28
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Contributor
|
authentik PR Installation instructions Instructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-09a8ff0836cef8d776913cd444dd7dd9165e3f10
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-09a8ff0836cef8d776913cd444dd7dd9165e3f10Afterwards, run the upgrade commands from the latest release notes. |
dd6674f to
11c97df
Compare
a7a90e7 to
fa3e520
Compare
1762fe6 to
44670e2
Compare
44670e2 to
24dc523
Compare
BeryJu
reviewed
Dec 30, 2025
|
|
||
| def test_create_validate_unsupported_key_type(self): | ||
| """Test validation rejects unsupported key types (Ed25519)""" | ||
| from authentik.crypto.models import CertificateKeyPair |
BeryJu
reviewed
Dec 30, 2025
| # Create an Ed25519 certificate | ||
| ed25519_cert = CertificateKeyPair.objects.create( | ||
| name=generate_id(), | ||
| certificate_data=load_fixture("fixtures/ed25519-cert.pem"), |
Member
There was a problem hiding this comment.
should be able to generate, with create_test_cert
Contributor
Author
There was a problem hiding this comment.
I had to make some updates to the certificate generator to support this. I had to change the default format we generate in, so let me know if that's problematic
BeryJu
reviewed
Dec 30, 2025
Comment on lines
+103
to
+107
| self.assertIn("signing_kp", loads(response.content)) | ||
| self.assertIn( | ||
| "Only RSA, EC, and DSA key types are supported", | ||
| loads(response.content)["signing_kp"][0], | ||
| ) |
BeryJu
reviewed
Dec 30, 2025
| .certificate=${provider.signingKp} | ||
| @input=${setHasSigningKp} | ||
| singleton | ||
| .allowedKeyTypes=${[KeyTypeEnum.Rsa, KeyTypeEnum.Ec, KeyTypeEnum.Dsa]} |
Member
There was a problem hiding this comment.
maybe put the allowed key types as a constant?
Contributor
Author
There was a problem hiding this comment.
I added it to the options, good call
Contributor
Author
|
Because we want to be able to test the functionality of incorrect certs, we need the cert builder to support ed25519. So we need PR #19465 to merge, then update this PR and merge it |
BeryJu
approved these changes
Feb 3, 2026
db1c875 to
09a8ff0
Compare
kensternberg-authentik
added a commit
that referenced
this pull request
Feb 4, 2026
* main: (26 commits) providers/saml: auto pull signature algorithm options (#17614) core, web: bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in /packages/prettier-config (#19990) web: bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in /web (#19989) stages/authenticator_webauthn: fix double JSON encoding of webauthn options (#19952) core: bump django from 5.2.10 to 5.2.11 (#19988) ci: allow setting assignee to fail (#19985) root: revert enterprise loading behaviour (#19485) web/flows: update flow background (#19974) providers/oauth2: use compare_digest for client_secret comparison (#19979) recovery: consume token in transaction (#19967) core: ask for token duration on recovery link/email by admin (#19875) core: bump aws-cdk-lib from 2.236.0 to 2.237.0 (#19958) web: bump the storybook group across 1 directory with 5 updates (#19960) core: bump library/nginx from `c881927` to `7fe5dda` in /website (#19961) core: bump gunicorn from 25.0.0 to 25.0.1 (#19959) core: bump goauthentik.io/api/v3 to 3.2026.2.0-rc1-1770129730 (#19973) lifecycle: bump shm size (#19369) crypto: Add ED25519 and ED448 support to the certificate builder (#19465) web/admin: Register stage elements. Fix linter warnings (#19948) web: bump knip from 5.82.1 to 5.83.0 in /web (#19962) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
In order to receive space, one must sacrifice it.
This PR shall clean up the form, giving us room for new life and features
Closes #19139
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make docs)