blueprints: add default Password policy #11793

gergosimonyi · 2024-10-24T11:19:10Z

Details

REPLACE ME

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make website)

netlify · 2024-10-24T11:19:26Z

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	`fac4735`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/672b8d7f922da30008fbf695

netlify · 2024-10-24T11:19:26Z

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	`fac4735`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/672b8d7f5d3cc000083d6c72

codecov · 2024-10-24T11:26:38Z

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
1592	2	1590	1

View the top 2 failed tests by shortest run time

authentik.blueprints.tests.test_packaged.TestPackaged test_blueprint_blueprints/default/flow-password-change.yaml

Stack Traces | 2.06s run time

self = &lt;unittest.case._Outcome object at 0x7f2b4ab716a0&gt;
test_case = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-password-change.yaml&gt;
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
&gt;           yield

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-password-change.yaml&gt;
result = &lt;TestCaseFunction test_blueprint_blueprints/default/flow-password-change.yaml&gt;

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
&gt;                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:634: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-password-change.yaml&gt;
method = &lt;bound method blueprint_tester.&lt;locals&gt;.tester of &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-password-change.yaml&gt;&gt;

    def _callTestMethod(self, method):
&gt;       if method() is not None:

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:589: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-password-change.yaml&gt;

    def tester(self: TestPackaged):
        base = Path("blueprints/")
        rel_path = Path(file_name).relative_to(base)
        importer = Importer.from_string(BlueprintInstance(path=str(rel_path)).retrieve())
&gt;       self.assertTrue(importer.validate()[0])

.../blueprints/tests/test_packaged.py:30: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-password-change.yaml&gt;
expr = False, msg = 'False is not true'

    def assertTrue(self, expr, msg=None):
        """Check that the expression is true."""
        if not expr:
            msg = self._formatMessage(msg, "%s is not true" % safe_repr(expr))
&gt;           raise self.failureException(msg)
E           AssertionError: False is not true

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:727: AssertionError

authentik.blueprints.tests.test_packaged.TestPackaged test_blueprint_blueprints/default/flow-oobe.yaml

Stack Traces | 2.28s run time

self = &lt;unittest.case._Outcome object at 0x7f2b3395a1e0&gt;
test_case = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-oobe.yaml&gt;
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
&gt;           yield

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-oobe.yaml&gt;
result = &lt;TestCaseFunction test_blueprint_blueprints/default/flow-oobe.yaml&gt;

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
&gt;                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:634: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-oobe.yaml&gt;
method = &lt;bound method blueprint_tester.&lt;locals&gt;.tester of &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-oobe.yaml&gt;&gt;

    def _callTestMethod(self, method):
&gt;       if method() is not None:

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:589: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-oobe.yaml&gt;

    def tester(self: TestPackaged):
        base = Path("blueprints/")
        rel_path = Path(file_name).relative_to(base)
        importer = Importer.from_string(BlueprintInstance(path=str(rel_path)).retrieve())
&gt;       self.assertTrue(importer.validate()[0])

.../blueprints/tests/test_packaged.py:30: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = &lt;authentik.blueprints.tests.test_packaged.TestPackaged testMethod=test_blueprint_blueprints/default/flow-oobe.yaml&gt;
expr = False, msg = 'False is not true'

    def assertTrue(self, expr, msg=None):
        """Check that the expression is true."""
        if not expr:
            msg = self._formatMessage(msg, "%s is not true" % safe_repr(expr))
&gt;           raise self.failureException(msg)
E           AssertionError: False is not true

.../hostedtoolcache/Python/3.12.7............/x64/lib/python3.12/unittest/case.py:727: AssertionError

To view more test analytics, go to the Test Analytics Dashboard
Got feedback? Let us know on Github

BeryJu · 2024-10-24T11:34:18Z

blueprints/default/flow-password-change.yaml

@@ -11,6 +11,15 @@ entries:
    slug: default-password-change
  model: authentik_flows.flow
  id: flow
+- attrs:
+    check_have_i_been_pwned: true


as much as I would like to enable this by default, we probably shouldn't enable this by default for airgapped instance

Fair enough. I was going by NIST's

verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords

but on second thought, I agree, defaulting to HIBP is a step too far.

Perhaps we can do something about that later. I'll remove for now and add it to the hardening docs.

we can set check_zxcvbn to true which includes a blocklist

That seems to work okay. Added.

I didn't add zxcvbn initially because I felt it was too much restriction (based on NIST). However, a score of 2 seems like it effectively adds the blocklist and some variations, but not much more.

github-actions · 2024-10-24T11:58:09Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-c2b91f58dbe0ebcd9c268f30a7d2818e49e335eb
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-c2b91f58dbe0ebcd9c268f30a7d2818e49e335eb-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-c2b91f58dbe0ebcd9c268f30a7d2818e49e335eb

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-c2b91f58dbe0ebcd9c268f30a7d2818e49e335eb-arm64

Afterwards, run the upgrade commands from the latest release notes.

website/docs/customize/policies/index.md

tanberry

Thanks for your time explaining the compliance, @gergosimonyi

This change complies with the minimal compositional requirements by NIST SP 800-63 Digital Identity Guidelines. See https://pages.nist.gov/800-63-4/sp800-63b.html#password More work is needed to comply with other parts of the Guidelines, specifically > If the chosen password is found on the blocklist, the CSP or verifier > [...] SHALL provide the reason for rejection. and > Verifiers SHALL offer guidance to the subscriber to assist the user in > choosing a strong password. This is particularly important following > the rejection of a password on the blocklist as it discourages trivial > modification of listed weak passwords.

…n policy Signed-off-by: Jens Langhammer <[email protected]>

website/docs/security/security-hardening.md

Co-authored-by: Tana M Berry <[email protected]> Signed-off-by: Simonyi Gergő <[email protected]>

Co-authored-by: Jens L. <[email protected]> Signed-off-by: Simonyi Gergő <[email protected]>

Signed-off-by: Jens Langhammer <[email protected]>

BeryJu reviewed Oct 24, 2024

View reviewed changes

gergosimonyi marked this pull request as ready for review October 25, 2024 06:13

gergosimonyi requested review from a team as code owners October 25, 2024 06:13

tanberry reviewed Oct 25, 2024

View reviewed changes

website/docs/customize/policies/index.md Outdated Show resolved Hide resolved

tanberry approved these changes Oct 25, 2024

View reviewed changes

gergosimonyi and others added 5 commits October 25, 2024 16:49

add docs for default Password policy

115c29f

remove HIBP from default Password policy

7586fda

add zxcvbn to default Password policy

2942225

add fallback password error message to password policy, fix validatio…

9065277

…n policy Signed-off-by: Jens Langhammer <[email protected]>

BeryJu force-pushed the blueprints/harden-default-password-policies branch from 8413025 to 9065277 Compare October 25, 2024 15:11

BeryJu reviewed Oct 25, 2024

View reviewed changes

website/docs/security/security-hardening.md Outdated Show resolved Hide resolved

gergosimonyi and others added 4 commits October 30, 2024 14:11

reword docs

c2b91f5

Co-authored-by: Tana M Berry <[email protected]> Signed-off-by: Simonyi Gergő <[email protected]>

add HIBP caveat

9154062

Co-authored-by: Jens L. <[email protected]> Signed-off-by: Simonyi Gergő <[email protected]>

separate policy into separate blueprint

711d224

Signed-off-by: Jens Langhammer <[email protected]>

use password policy for oobe flow

fac4735

Signed-off-by: Jens Langhammer <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

blueprints: add default Password policy #11793

blueprints: add default Password policy #11793

gergosimonyi commented Oct 24, 2024

netlify bot commented Oct 24, 2024 •

edited

Loading

netlify bot commented Oct 24, 2024 •

edited

Loading

codecov bot commented Oct 24, 2024 •

edited

Loading

BeryJu Oct 24, 2024

gergosimonyi Oct 24, 2024

BeryJu Oct 24, 2024

gergosimonyi Oct 25, 2024

github-actions bot commented Oct 24, 2024 •

edited

Loading

tanberry left a comment

blueprints: add default Password policy #11793

Are you sure you want to change the base?

blueprints: add default Password policy #11793

Conversation

gergosimonyi commented Oct 24, 2024

Details

Checklist

netlify bot commented Oct 24, 2024 • edited Loading

✅ Deploy Preview for authentik-storybook canceled.

netlify bot commented Oct 24, 2024 • edited Loading

✅ Deploy Preview for authentik-docs canceled.

codecov bot commented Oct 24, 2024 • edited Loading

❌ 2 Tests Failed:

BeryJu Oct 24, 2024

Choose a reason for hiding this comment

gergosimonyi Oct 24, 2024

Choose a reason for hiding this comment

BeryJu Oct 24, 2024

Choose a reason for hiding this comment

gergosimonyi Oct 25, 2024

Choose a reason for hiding this comment

github-actions bot commented Oct 24, 2024 • edited Loading

tanberry left a comment

Choose a reason for hiding this comment

netlify bot commented Oct 24, 2024 •

edited

Loading

netlify bot commented Oct 24, 2024 •

edited

Loading

codecov bot commented Oct 24, 2024 •

edited

Loading

github-actions bot commented Oct 24, 2024 •

edited

Loading