Login without password prompt, error in default-authentication-flow-password-stage | authentik | Page 1

fringe geode Aug 29, 2023, 9:17 PM

#

Currently it is possible to login as someone on my authentik instance without getting asked for a password. Meaning once you entered the username you are logged in.
When I login, a notification appears:

Traceback (most recent call last):
  File "default-authentication-flow-password-stage", line 6, in <module>
  File "default-authentication-flow-password-stage", line 5, in handler
builtins.KeyError: 'pending_user'

I believe this issue did not exist until I just updated to the latest authentik release from an hour ago (however I could be mistaken, I am basically the only one who uses my authentik instance).

Here is an image of my default-authentication-flow:

#

Here my flow exported

📎 default-authentication-flow.yaml

spring heath Aug 29, 2023, 9:25 PM

#

On this stage binding can you check that these two flags are set as on the screenshot?

fringe geode Aug 29, 2023, 9:27 PM

#

this is currently the case, ill adjust those two checkboxes to what u have

#

(btw a small workaround i found for now was to adjust default-authentication-identification to directly inlcude the password stage, but ill revert this to quickly test what u suggested)

fringe geode Aug 29, 2023, 9:28 PM

#

spring heath On this stage binding can you check that these two flags are set as on the scree...

oh yeah that seems to have fixed it!

spring heath Aug 29, 2023, 9:29 PM

#

https://github.com/goauthentik/authentik/pull/6674

GitHub

blueprints: fix policy exception causing password stage to be skipp...

Details
closes #6673
due to changing defaults, after upgrading from some versions, a new default policy would be run at the wrong time causing it to fail, which would cause the password stage to ge...

fringe geode Aug 29, 2023, 9:30 PM

#

yep perfect seems like its working again. also no exception or any notification appears after a succesful login

spring heath Aug 29, 2023, 9:30 PM

#

looks like a 2023.8.1 is due

fringe geode Aug 29, 2023, 9:30 PM

#

^^" but super quick fix! tysm!

hoary mural Aug 29, 2023, 9:48 PM

#

I also wanted to confirm that I ran into this password issue and the suggested settings from Jens resolved it. I had upgraded from 2023.6.1 to 2023.8.0

fringe geode Aug 29, 2023, 9:50 PM

#

yeah it seems like this issue affects every installation of authentik that was first setup before 2023.3.0 (and doesnt seem to matter what versions were used after that/upgraded to)

agile blade Aug 29, 2023, 11:22 PM

#

really scary bug! I went straight back to 2023.6, but now I don't know which bindings are meant to have which flags, for example is this correct? I'm guessing it is because my mfa isn't being skipped, but now I'm paranoid

#Login without password prompt, error in default-authentication-flow-password-stage