Username Prefilled with Invitation Token

[quick lagoon]

Hi!

So I tried to add invitation stage on federated enrollment.

The flow is something like this:

On first order, I have prompt stage, with one optional text prompt with field key "token" as mentioned in https://goauthentik.io/docs/flow/stages/invitation/

On the second order I have the invitation stage. Then on the 3rd order I have prompt stage which one of them is text prompt with field key "username".

The weird thing is, when I filled the invitation prompt with correct token, then It will use the invitation, but the username prompt is prefilled with the token just like on the image.

Any idea what's wrong here?

[zealous coral]

what are the settings for the username prompt?

[zealous coral]

and I'm assuming your invitation didn't have any data set it in the attributes field?

[quick lagoon]

I do have attributes inside the invitations, a custom "eligible_email" array to be used by policy to deny registration if "email" not in "eligible_email"

[zealous coral]

but no username attribute in there I assume

since the username prompt should only be pre-filled by the username attribute in the invitation

hmmm

[quick lagoon]

Yes, currently there's only an eligible_email attribute there

I planned to add groups too, but still dunno how to do that.

[quick lagoon]

But shouldn't it just fall back to the previous value if not configured by the invitation?

[zealous coral]

Yeah in your case it should result in username being empty

You can try using the flow inspector

[quick lagoon]

It won't load (denied) since it's federated (there's is_sso policy)

[quick lagoon]

Btw, i do have a policy like the one on https://goauthentik.io/integrations/sources/google/#username-mapping, bound to the prompt that contains the username field. But it doesn't work.

It works when I refresh the page tho

The policy (username mapping from email policy) fills the username field after refresh, but not on the first load.

[quick lagoon]

As a workaround, I bind an expression policy bellow on the user write stage to be run before the write

username = context["prompt_data"]["username"].replace('-', '')
invitation_pk = str(context["invitation"].invite_uuid).replace('-', '')

if username == invitation_pk:
  email = context["prompt_data"]["email"]
  # Set username to email without domain
  context["prompt_data"]["username"] = email.split("@")[0]

return True

[quick lagoon]

@zealous coral So, is this the intended behaviour, or this is something that considered as bug and requre a fix?

[zealous coral]

I haven’t gotten around to looking into this more, please create an issue on GitHub so I don’t loose track of it