Headline Changes
-
LDAP Provider
This feature is still in technical preview, so please report any Bugs you run into on GitHub
You can now configure an LDAP Provider for applications that don't support any newer protocols or require LDAP.
All users and groups in authentik's database are searchable. Currently, there is a limited support for filters (you can only search for objectClass), but this will be expanded in further releases.
Binding against the LDAP Server uses a flow in the background. This allows you to use the same policies and flows as you do for web-based logins. The only limitation is that currently only identification and password stages are supported, due to how LDAP works.
-
Compatibility with forwardAuth/auth_request
The authentik proxy is now compatible with forwardAuth (traefik) / auth_request (nginx). All that is required is the latest version of the outpost,
and the correct config from here. -
Docker images for ARM
Docker images are now built for amd64, arm64, arm v7 and arm v8.
-
Reduced setup complexity
The authentik server now requires less containers. The static container (as well as the traefik when using docker-compose) are no longer required. As the first stage of a migration to Golang instead of Python, authentik now runs behind an in-container reverse proxy, which hosts the static files.
-
New Plex authentication source
The plex source (previously a provider for the OAuth Source) has been rewritten to a dedicated Source.
You can now limit access to authentik based on which servers a Plex user is member of.
-
Configurable source behaviour
You can now configure how a source behaves after the user has authenticated themselves to the source. Previously, authentik always checked the unique identifier from the source, enrolled the user when the identifier didn't exist and authenticated the user otherwise.
Now you can configure how the matching should be done:
- Identifier: Keeps the old behaviour, can lead to duplicate user accounts
- Email (link): If a user with the same Email address exists, they are linked. Can have security implications when a source doesn't validate email addresses.
- Email (deny): Deny the flow if the Email address is already used.
- Username (link): If a user with the same username address exists, they are linked. Can have security implications when a username is used with another source.
- Username (deny): Deny the flow if the username address is already used.