Skip to content

sources/saml: truncate transient username longer than 150 chars#19930

Merged
gergosimonyi merged 5 commits intomainfrom
username-hash
Feb 6, 2026
Merged

sources/saml: truncate transient username longer than 150 chars#19930
gergosimonyi merged 5 commits intomainfrom
username-hash

Conversation

@PeshekDotDev
Copy link
Contributor

@PeshekDotDev PeshekDotDev commented Feb 2, 2026

Details

Closes #18177

Checklist

  • Local tests pass (ak test authentik/)
  • The code has been formatted (make lint-fix)

If an API change has been made

  • The API schema has been updated (make gen-build)

If changes to the frontend have been made

  • The code has been formatted (make web)

If applicable

  • The documentation has been updated
  • The documentation has been formatted (make docs)

@PeshekDotDev PeshekDotDev self-assigned this Feb 2, 2026
@PeshekDotDev PeshekDotDev requested a review from a team as a code owner February 2, 2026 07:01
@netlify
Copy link

netlify bot commented Feb 2, 2026 •
edited
Loading

✅ Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit 78adb94
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/6985225015b9470008719f10
😎 Deploy Preview https://deploy-preview-19930--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@codecov
Copy link

codecov bot commented Feb 2, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.25%. Comparing base (524ab27) to head (fdb69e9).
⚠️ Report is 24 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #19930      +/-   ##
==========================================
+ Coverage   93.23%   93.25%   +0.02%     
==========================================
  Files         968      968              
  Lines       53565    53583      +18     
==========================================
+ Hits        49941    49969      +28     
+ Misses       3624     3614      -10
Flag Coverage Δ
conformance 37.95% <33.33%> (-0.02%) ⬇️
e2e 43.94% <66.66%> (-0.01%) ⬇️
integration 22.71% <33.33%> (-0.01%) ⬇️
unit 91.40% <100.00%> (+<0.01%) ⬆️
unit-migrate 91.43% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@github-actions
Copy link
Contributor

github-actions bot commented Feb 2, 2026 •
edited
Loading

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-fdb69e90641771a3024d42affedc3f5a4085102e
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-fdb69e90641771a3024d42affedc3f5a4085102e

Afterwards, run the upgrade commands from the latest release notes.

@PeshekDotDev PeshekDotDev moved this from Todo to Needs review in authentik Core Feb 5, 2026
@BeryJu BeryJu changed the title sources/saml: hash a username longer than 150 chars sources/saml: truncate transient username longer than 150 chars Feb 5, 2026
@BeryJu
add const for username length, always use same format
fdb69e9 
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
@github-project-automation github-project-automation bot moved this from Needs review to In Progress in authentik Core Feb 5, 2026
@netlify
Copy link

netlify bot commented Feb 5, 2026

✅ Deploy Preview for authentik-integrations ready!

Name Link
🔨 Latest commit fdb69e9
🔍 Latest deploy log https://app.netlify.com/projects/authentik-integrations/deploys/69852ccce9891200086616dc
😎 Deploy Preview https://deploy-preview-19930--authentik-integrations.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify
Copy link

netlify bot commented Feb 5, 2026

✅ Deploy Preview for authentik-storybook ready!

Name Link
🔨 Latest commit fdb69e9
🔍 Latest deploy log https://app.netlify.com/projects/authentik-storybook/deploys/69852cccf42fcf00085bb5c9
😎 Deploy Preview https://deploy-preview-19930--authentik-storybook.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@gergosimonyi gergosimonyi merged commit 9457982 into main Feb 6, 2026
102 checks passed
@gergosimonyi gergosimonyi deleted the username-hash branch February 6, 2026 17:17
@github-project-automation github-project-automation bot moved this from In Progress to Done in authentik Core Feb 6, 2026
atereshkin pushed a commit to atereshkin/authentik that referenced this pull request Feb 9, 2026
@PeshekDotDev @BeryJu @atereshkin
sources/saml: truncate transient username longer than 150 chars (goau…
654177c 
…thentik#19930)

* sources/saml: hash a username longer than 150 chars

* rework

* reword

* add const for username length, always use same format

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
kensternberg-authentik added a commit that referenced this pull request Feb 9, 2026
@kensternberg-authentik
Merge branch 'main' into bug/admin/source-forms-not-rendering
d5ccc8b 
* main: (108 commits)
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  web/i18n: Fix Japanese and Korean font overrides. (#19994)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 9, 2026
@kensternberg-authentik
Merge branch 'main' into web/flow/tablize-token-component-relationship
5656014 
* main: (34 commits)
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  web/i18n: Fix Japanese and Korean font overrides. (#19994)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 9, 2026
@kensternberg-authentik
Merge branch 'web/flow/tablize-token-component-relationship' into web…
e9d272b 
…/flow/one-true-api

* web/flow/tablize-token-component-relationship: (84 commits)
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  web/i18n: Fix Japanese and Korean font overrides. (#19994)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 9, 2026
@kensternberg-authentik
Merge branch 'web/flow/one-true-api' into web/flow/extract-flow-inspe…
72eb401 
…ctor

* web/flow/one-true-api: (84 commits)
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  web/i18n: Fix Japanese and Korean font overrides. (#19994)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 9, 2026
@kensternberg-authentik
Merge branch 'main' into web/maintenance/no-unknown-attributes-2
34245ad 
* main: (293 commits)
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  web/i18n: Fix Japanese and Korean font overrides. (#19994)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 9, 2026
@kensternberg-authentik
Merge branch 'main' into bug/web/sfe/polyfill-for-object-assign
3bb3770 
* main: (83 commits)
  web/admin: source forms not rendering (#19887)
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 12, 2026
@kensternberg-authentik
Merge branch 'web/flow/extract-flow-inspector' into web/flow/move-dia…
53e37a1 
…logs-into-the-light

* web/flow/extract-flow-inspector: (85 commits)
  Prettier is still having opinions.
  tasks: add queued tasks metrics (#20118)
  website/docs: endpoint devices: add fleet connector doc (#20086)
  tasks/middlewares: call monitoring_set upon metrics request (#20117)
  core: bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 (#20102)
  core: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#20103)
  core: bump gunicorn from 25.0.1 to 25.0.3 (#20104)
  ci: bump int128/docker-manifest-create-action from 2.13.0 to 2.14.0 (#20105)
  ci: bump astral-sh/setup-uv from 7.2.1 to 7.3.0 in /.github/actions/setup (#20106)
  web: bump the swc group across 2 directories with 1 update (#20108)
  web: bump playwright from 1.58.1 to 1.58.2 in /web (#20109)
  web: bump @playwright/test from 1.58.1 to 1.58.2 in /web (#20110)
  web: bump @types/node from 25.2.1 to 25.2.2 in /web (#20111)
  web: bump knip from 5.83.0 to 5.83.1 in /web (#20112)
  web: bump type-fest from 5.4.3 to 5.4.4 in /web (#20113)
  sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
  website/docs: generate CVE sidebar (#20098)
  providers/saml: move sp acs binding down in form (#20039)
  sources/saml: truncate transient username longer than 150 chars (#19930)
  web: Fix locale selector in compatibility mode. (#19946)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BeryJu BeryJu BeryJu approved these changes

Assignees

@PeshekDotDev PeshekDotDev

Labels

None yet

Projects

authentik Core
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Sources SAML: 405 error when Transient NameID length is more than 150.

3 participants

@PeshekDotDev @BeryJu @gergosimonyi