Autofill does not detect Authentik login fields (inputs inside shadow DOM)

[arclabch]

Summary

The Proton Pass browser extension does not detect the username or password input fields on an Authentik (goauthentik.io) login page. No autofill dropdown appears, the fields are not highlighted, and no credentials are offered. The same login page is detected and autofilled correctly by 1Password and Bitwarden, so the form itself is fillable — Proton Pass's field detector is the outlier.

This may be related to #450 (autofill not working on elements inside the shadow DOM).

Environment

• Proton Pass extension: v1.37.2
• Browser: Brave (Chromium). Almost certainly affects all Chromium builds; Is it expected for proton pass autofill not to work on elements inside the shadow dom? #450 reports the same shadow-DOM detection failure on Firefox, so this is likely engine-independent.
• OS: Linux
• Target app: Authentik, current stable (2026.5.x)

Steps to reproduce (no private infrastructure required)

Authentik has no public hosted demo, but the official one-command Docker Compose quickstart stands up an instance in a few minutes:

wget https://docs.goauthentik.io/compose.yml
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
docker compose pull
docker compose up -d

(Docs: https://docs.goauthentik.io/install-config/install/docker-compose/)

1. Open http://<host>:9000, set the akadmin password when prompted.
2. Log out, then navigate to the login flow: http://<host>:9000/if/flow/default-authentication-flow/
3. With Proton Pass installed and a credential saved for the host, click into the username field.

Expected

Proton Pass detects the username field, highlights it, and offers the saved credential — as 1Password and Bitwarden do on the identical page.

Actual

Proton Pass does not detect the username or password field. No highlight, no autofill dropdown, no credential offered.

Root cause

Authentik renders its login flow as LitElement web components, and the actual inputs live inside shadow roots:

• Identifier stage: <input name="uidField" autocomplete="username"> inside the identification stage's shadow root.
• Password stage: <input name="password" autocomplete="current-password"> inside the password stage's shadow root.

Proton Pass does not appear to pierce these shadow roots (or not deeply enough), so it never sees the fields. 1Password and Bitwarden traverse shadow DOM and fill the same page successfully.

Key diagnostic detail: Authentik can also render username + password as a single combined form on one page (rather than the two-step identifier → password flow). We tested that configuration, and Proton Pass still fails to detect the fields. This isolates the cause to shadow-DOM piercing, not the two-step split or the non-standard name="uidField". Shadow-DOM traversal in the detector is the fix.

Why this is on the Proton Pass side

Authentik has declined to change its markup — they will not restructure the web components or rename uidField (goauthentik/authentik #13716 and #8568, both closed as not-planned; #8568 was reproduced on Chromium/Linux). Since 1Password and Bitwarden already fill this exact page, the gap is solvable in Proton Pass's field detector by traversing open shadow roots.

References

• Proton Pass shadow-DOM autofill: ProtonMail/WebClients Is it expected for proton pass autofill not to work on elements inside the shadow dom? #450
• Authentik markup, wontfix: goauthentik/authentik #13716
• Authentik markup, wontfix (reproduced on Chromium/Linux): goauthentik/authentik #8568