rbac: clean up roles and permissions by gergosimonyi · Pull Request #19588 · goauthentik/authentik

gergosimonyi · 2026-01-19T23:26:30Z

This was purposefully not included in 2025.12 to split the changes up.

The main content of this patch is in the migrations. Everything else follows more or less automatically.

netlify · 2026-01-19T23:27:35Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`9424a05`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/697b96c760882300081131d2
😎 Deploy Preview	https://deploy-preview-19588--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-01-19T23:28:34Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`9424a05`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/697b96c7063f230008af8585
😎 Deploy Preview	https://deploy-preview-19588--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-01-19T23:28:39Z

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	`9424a05`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/697b96c70a77b80008b7c0e3
😎 Deploy Preview	https://deploy-preview-19588--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

gergosimonyi · 2026-01-19T23:31:06Z

blueprints/schema.json

-                        "Heimdal",
-                        "other"


This change (and its analogue over at schema.yml) was automatically included when I ran make gen. I'll leave it in.

codecov · 2026-01-19T23:34:05Z

Codecov Report

❌ Patch coverage is 88.67925% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.26%. Comparing base (387a3ef) to head (9424a05).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
authentik/outposts/models.py	0.00%	3 Missing ⚠️
authentik/providers/ldap/models.py	0.00%	3 Missing ⚠️
authentik/providers/radius/models.py	0.00%	3 Missing ⚠️
...ik/enterprise/providers/google_workspace/models.py	0.00%	1 Missing ⚠️
...tik/enterprise/providers/microsoft_entra/models.py	0.00%	1 Missing ⚠️
authentik/rbac/api/roles.py	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #19588      +/-   ##
==========================================
+ Coverage   93.19%   93.26%   +0.06%     
==========================================
  Files         968      968              
  Lines       53307    53331      +24     
==========================================
+ Hits        49682    49738      +56     
+ Misses       3625     3593      -32

Flag	Coverage Δ
conformance	`38.07% <16.03%> (-0.02%)`	⬇️
e2e	`44.08% <30.18%> (+1.05%)`	⬆️
integration	`22.92% <13.20%> (-0.01%)`	⬇️
unit	`91.41% <87.73%> (+<0.01%)`	⬆️
unit-migrate	`91.43% <87.73%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

This was purposefully not included in `2025.12` to split the changes up. The main content of this patch is in the migrations. Everything else follows more or less automatically.

github-actions · 2026-01-20T00:11:07Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-9424a051a2c2d5e770b9930516bafad1ee8e29d4
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-9424a051a2c2d5e770b9930516bafad1ee8e29d4

Afterwards, run the upgrade commands from the latest release notes.

BeryJu · 2026-01-20T00:27:00Z

authentik/core/models.py

-    ak_groups = models.ManyToManyField("Group", related_name="users")
+    groups = models.ManyToManyField("Group", related_name="users")


We might want some sort of proxy for the old field as its probably used in policies quite frequently, something that'll log an event when used.

I thought this deserved its own EventAction, see 6fc2469 for my first pass on implementing this.

BeryJu · 2026-01-20T17:38:05Z

authentik/events/models.py

    SYSTEM_EXCEPTION = "system_exception"

    CONFIGURATION_ERROR = "configuration_error"
+    DEPRECATION_USED = "deprecation_used"


Suggested change

DEPRECATION_USED = "deprecation_used"

CONFIGURATION_WARNING = "configuration_warning"

Should make it a bit more re-usable for other things

dominic-r

lgtm for docs

website/docs/releases/2026/v2026.2.md

BeryJu

Looks good, added one small comment to the release notes to tell people the old one is deprecated but will still work.

One other thing I suggest for this is splitting out the changes to integrations since those are not deployed from the version branch and as such will go live as soon as this is merged, so we should separate that and only merge it once this is out. (Or maybe even later since .ak_groups will still work)

Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

These will be included in a separate PR once this is released.

* main: (52 commits) website: QL Search keyboard interactions docs, examples. (#16259) website/integrations: immich: add signing algorithm (#19187) website/docs: endpoint devices: add version command (#19767) common: introduce common (#19852) web: bump @sentry/browser from 10.37.0 to 10.38.0 in /web in the sentry group across 1 directory (#19871) core: bump debugpy from 1.8.19 to 1.8.20 (#19872) ci: bump actions/cache from 5.0.2 to 5.0.3 (#19873) web: bump chromedriver from 144.0.1 to 145.0.0 in /web (#19874) web: Captcha Refinements, Part 2 (#19757) root: assign cherry-pick PRs to original author (#19858) web: Lit Development Mode, performance fixes. (#19825) web: Fix development theme overrides (#19826) website/docs: add tip for recovering from accidental main branch work (#19865) web: bump API Client version (#19857) rbac: clean up roles and permissions (#19588) web: bump API Client version (#19851) website/docs: add more info to entra id scim doc (#19849) sources/oauth: Fix an issue where wechat may crash duing login. (#18973) providers/scim: fix email validation mismatch (#19848) providers/scim: modify user- and group syncing behavior (#13947) ...

gergosimonyi commented Jan 19, 2026

View reviewed changes

gergosimonyi added 2 commits January 20, 2026 00:39

clean up roles and permissions

ab8054f

This was purposefully not included in `2025.12` to split the changes up. The main content of this patch is in the migrations. Everything else follows more or less automatically.

add breaking change warning to release notes

605edab

gergosimonyi force-pushed the rbac/clean-up-roles-and-permissions branch from 9d3270b to 605edab Compare January 19, 2026 23:40

gergosimonyi marked this pull request as ready for review January 20, 2026 00:17

gergosimonyi requested review from a team as code owners January 20, 2026 00:17

BeryJu reviewed Jan 20, 2026

View reviewed changes

gergosimonyi added 2 commits January 20, 2026 15:45

add ak_groups --> groups deprecated proxy

6fc2469

fixup! add ak_groups --> groups deprecated proxy

c2bedd7

BeryJu reviewed Jan 20, 2026

View reviewed changes

gergosimonyi added 5 commits January 20, 2026 19:01

fixup! add ak_groups --> groups deprecated proxy

c46ff3b

Merge branch 'main' into rbac/clean-up-roles-and-permissions

a314c8c

fixup! add ak_groups --> groups deprecated proxy

2319d62

add configuration warning to default notifications blueprint

92d5816

add rudimentary tests for User.ak_groups

40eb8f5

dominic-r approved these changes Jan 23, 2026

View reviewed changes

gergosimonyi added 2 commits January 23, 2026 20:49

remove no longer used permissions

03f9623

Merge branch 'main' into rbac/clean-up-roles-and-permissions

03ad6a2

BeryJu reviewed Jan 23, 2026

View reviewed changes

website/docs/releases/2026/v2026.2.md Outdated Show resolved Hide resolved

BeryJu approved these changes Jan 23, 2026

View reviewed changes

gergosimonyi and others added 3 commits January 23, 2026 20:59

clarify deprecation

aae9802

Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

Merge branch 'main' into rbac/clean-up-roles-and-permissions

1f9ea7b

remove integration changes

9424a05

These will be included in a separate PR once this is released.

BeryJu merged commit 1b96539 into main Jan 29, 2026
101 of 102 checks passed

BeryJu deleted the rbac/clean-up-roles-and-permissions branch January 29, 2026 18:12

BeryJu mentioned this pull request Jan 29, 2026

providers/scim: add configuration warning for migration #19859

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

rbac: clean up roles and permissions#19588

rbac: clean up roles and permissions#19588
BeryJu merged 14 commits intomainfrom
rbac/clean-up-roles-and-permissions

gergosimonyi commented Jan 19, 2026

Uh oh!

netlify bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

netlify bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

netlify bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

gergosimonyi Jan 19, 2026

Uh oh!

codecov bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

BeryJu Jan 20, 2026

Uh oh!

gergosimonyi Jan 20, 2026 •

edited

Loading

Uh oh!

BeryJu Jan 20, 2026

Uh oh!

dominic-r left a comment

Uh oh!

Uh oh!

BeryJu left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		ak_groups = models.ManyToManyField("Group", related_name="users")
		groups = models.ManyToManyField("Group", related_name="users")

	DEPRECATION_USED = "deprecation_used"
	CONFIGURATION_WARNING = "configuration_warning"

Uh oh!

Conversation

gergosimonyi commented Jan 19, 2026

Uh oh!

netlify bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

netlify bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs ready!

Uh oh!

netlify bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-integrations ready!

Uh oh!

gergosimonyi Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BeryJu Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

gergosimonyi Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BeryJu Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

dominic-r left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BeryJu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Jan 19, 2026 •

edited

Loading

netlify bot commented Jan 19, 2026 •

edited

Loading

netlify bot commented Jan 19, 2026 •

edited

Loading

codecov bot commented Jan 19, 2026 •

edited

Loading

github-actions bot commented Jan 20, 2026 •

edited

Loading

gergosimonyi Jan 20, 2026 •

edited

Loading