Password manager support: Proton Pass does not recognize user/pass fields

[sargunv]

Describe the bug

Proton Pass (password manager) does not recognize the username and password fields. I tried with compatibility mode on and with it off.

To Reproduce

Steps to reproduce the behavior:

1. Install Proton Pass and set up a login record
2. Go to a login page with the default authentication flow
3. Note no autofill appears
4. Enable compatibility mode on the flow
5. Note no autofill appears still

Expected behavior

The password manager should work, the same as it does across the web.

Version and Deployment:

• authentik version: 2025.2.3
• Deployment: docker-compose

[dominic-r]

It works with 1Password and Bitwarden. Might this just be an issue on Proton's side?

[sargunv]

Perhaps, but Proton Pass works well with just about every other login page I've encountered, as well as with other on-prem authentication solutions like Authelia.

I guess that Authentik is doing something uncommon with its login fields that Proton Pass doesn't recognize but 1Password does.

Unsure which side, if any, would be considered a bug. But given the importance of password managers for security, I'll likely have to reverse my attempted migration to Authentik because of it.

(Should probably be reported on the Proton Pass side as well, as similarly it could be a blocker for somebody else onboarding to Proton Pass if they already rely on Authentik)

[dominic-r]

We'll still try to investigate and see if this issue can be resolved. Thanks for making us aware!

[dominic-r]

On our side, we emailed ProtonPass to see what can be done

[sargunv]

thank you!

[dewi-tik]

ProtonPass have replicated the issue and their development team are investigating. We'll provide an update as soon as we hear back from them.

[authentik-automation]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[wasdennnoch]

Has there been a reply from the ProtonPass team yet?

[dewi-tik]

Has there been a reply from the ProtonPass team yet?

Nothing so far I'm afraid. It's possible that other reports might help them prioritize this issue, however I also don't want them to be bombarded with tickets.

[sargunv]

Perhaps there's something unusual about how Authentik's login fields are tagged, vs other sites?

For a password field on a product I work on, Proton Pass was identifying our field as a "change password" field instead of a "current password" field, on a page where you input password to change MFA settings. I was able to fix this by just updating the label from "Password" to "Current Password" to make it more clear it's not changing the password, but verifying the existing one.

Looking at Proton Pass source code, it seems to take into account all sorts of signals, not just the canonical autocomplete field, but also the name, id, label, and other text on the page, and feed that into some algorithm that then decides what kind of field it thinks it is.

Here's GitHub's, for comparison (works well with Proton Pass):

Username

<label for="login_field">Username or email address</label>
<input type="text" name="login" id="login_field" class="form-control input-block js-login-field" autocapitalize="off" autocorrect="off" autocomplete="username" autofocus="autofocus" required="required">

Password

<label for="password">Password</label>
<input type="password" name="password" id="password" class="form-control form-control input-block js-password-field" autocomplete="current-password" required="required">

I can't compare to Authentik's because I've since migrated away from Authentik due to this issue.

[sargunv]

Oh, there's a public instance of authentik (support portal) I can look at. Here's the corresponding html from Authentik. The autocomplete attributes are correct, but the rest is much less straightforward.

In particular, name="uidField" instead of a simpler name="login" maybe is confusing for Proton Pass, or the more convoluted label.

Most likely an issue on Proton Pass's end, but still if it can be worked around here, I'd recommend it.

Email

<ak-form-element required="" class="pf-c-form__group style-scope ak-stage-identification" label="Email" theme="light"><!----><div class="pf-c-form__group style-scope ak-form-element">
  <label class="pf-c-form__label style-scope ak-form-element">
      <span class="pf-c-form__label-text style-scope ak-form-element"><!--?lit$532982953$-->Email</span>
      <!--?lit$532982953$--><span class="pf-c-form__label-required style-scope ak-form-element" aria-hidden="true">*</span>
  </label>
  
      <input name="uidField" autofocus="" autocomplete="username" spellcheck="false" class="pf-c-form-control style-scope ak-stage-identification" required="" aria-invalid="false" type="email" placeholder="Email" value="" style="">
      <!--?lit$532982953$-->
  
  <!--?lit$532982953$-->
</div></ak-form-element>

Password

<ak-flow-input-password inputid="ak-stage-identification-password" required="" class="pf-c-form__group style-scope ak-stage-identification" label="Password" prefill=""><!----> <ak-form-element required="" class="pf-c-form__group style-scope ak-stage-identification" label="Password" theme="light"><!----><div class="pf-c-form__group style-scope ak-form-element">
  <label class="pf-c-form__label style-scope ak-form-element">
      <span class="pf-c-form__label-text style-scope ak-form-element"><!--?lit$532982953$-->Password</span>
      <!--?lit$532982953$--><span class="pf-c-form__label-required style-scope ak-form-element" aria-hidden="true">*</span>
  </label>
  
  <div class="pf-c-form__group-control style-scope ak-stage-identification">
      <div class="pf-c-input-group style-scope ak-stage-identification">
          <input autocomplete="current-password" required="" aria-invalid="false" type="password" id="ak-stage-password-input" name="password" placeholder="Please enter your password" class="pf-c-form-control pf-m-icon style-scope ak-stage-identification" value="" style="">

          <!--?lit$532982953$-->
      </div>

      <!--?lit$532982953$-->
  </div>

  <!--?lit$532982953$-->
</div></ak-form-element></ak-flow-input-password>