blueprints: add default Password policy #11793

gergosimonyi · 2024-10-24T11:19:10Z

Details

REPLACE ME

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make website)

netlify · 2024-10-24T11:19:26Z

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	`41f7ba5`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/672e39aebe0e74000801d476

netlify · 2024-10-24T11:19:26Z

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	`41f7ba5`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/672e39aeda99d50008ff9fe2

codecov · 2024-10-24T11:26:38Z

Codecov Report

Attention: Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 92.64%. Comparing base (31014ba) to head (41f7ba5).
Report is 80 commits behind head on main.

Files with missing lines	Patch %	Lines
authentik/policies/password/models.py	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #11793      +/-   ##
==========================================
+ Coverage   92.56%   92.64%   +0.08%     
==========================================
  Files         760      761       +1     
  Lines       37792    37820      +28     
==========================================
+ Hits        34982    35039      +57     
+ Misses       2810     2781      -29

Flag	Coverage Δ
e2e	`49.31% <40.00%> (+0.17%)`	⬆️
integration	`24.91% <0.00%> (-0.02%)`	⬇️
unit	`90.15% <80.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

BeryJu · 2024-10-24T11:34:18Z

blueprints/default/flow-password-change.yaml

@@ -11,6 +11,15 @@ entries:
    slug: default-password-change
  model: authentik_flows.flow
  id: flow
+- attrs:
+    check_have_i_been_pwned: true


as much as I would like to enable this by default, we probably shouldn't enable this by default for airgapped instance

Fair enough. I was going by NIST's

verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords

but on second thought, I agree, defaulting to HIBP is a step too far.

Perhaps we can do something about that later. I'll remove for now and add it to the hardening docs.

we can set check_zxcvbn to true which includes a blocklist

That seems to work okay. Added.

I didn't add zxcvbn initially because I felt it was too much restriction (based on NIST). However, a score of 2 seems like it effectively adds the blocklist and some variations, but not much more.

github-actions · 2024-10-24T11:58:09Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-41f7ba56deb002ea84e3421170d547ad0f748452
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-41f7ba56deb002ea84e3421170d547ad0f748452-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-41f7ba56deb002ea84e3421170d547ad0f748452

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-41f7ba56deb002ea84e3421170d547ad0f748452-arm64

Afterwards, run the upgrade commands from the latest release notes.

website/docs/customize/policies/index.md

tanberry

Thanks for your time explaining the compliance, @gergosimonyi

This change complies with the minimal compositional requirements by NIST SP 800-63 Digital Identity Guidelines. See https://pages.nist.gov/800-63-4/sp800-63b.html#password More work is needed to comply with other parts of the Guidelines, specifically > If the chosen password is found on the blocklist, the CSP or verifier > [...] SHALL provide the reason for rejection. and > Verifiers SHALL offer guidance to the subscriber to assist the user in > choosing a strong password. This is particularly important following > the rejection of a password on the blocklist as it discourages trivial > modification of listed weak passwords.

…n policy Signed-off-by: Jens Langhammer <jens@goauthentik.io>

website/docs/security/security-hardening.md

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu · 2024-11-11T12:31:40Z

/cherry-pick version-2024.10

* add password policy to default password change flow This change complies with the minimal compositional requirements by NIST SP 800-63 Digital Identity Guidelines. See https://pages.nist.gov/800-63-4/sp800-63b.html#password More work is needed to comply with other parts of the Guidelines, specifically > If the chosen password is found on the blocklist, the CSP or verifier > [...] SHALL provide the reason for rejection. and > Verifiers SHALL offer guidance to the subscriber to assist the user in > choosing a strong password. This is particularly important following > the rejection of a password on the blocklist as it discourages trivial > modification of listed weak passwords. * add docs for default Password policy * remove HIBP from default Password policy * add zxcvbn to default Password policy * add fallback password error message to password policy, fix validation policy Signed-off-by: Jens Langhammer <jens@goauthentik.io> * reword docs Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> * add HIBP caveat Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> * separate policy into separate blueprint Signed-off-by: Jens Langhammer <jens@goauthentik.io> * use password policy for oobe flow Signed-off-by: Jens Langhammer <jens@goauthentik.io> * kiss Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>

blueprints: add default Password policy (#11793) * add password policy to default password change flow This change complies with the minimal compositional requirements by NIST SP 800-63 Digital Identity Guidelines. See https://pages.nist.gov/800-63-4/sp800-63b.html#password More work is needed to comply with other parts of the Guidelines, specifically > If the chosen password is found on the blocklist, the CSP or verifier > [...] SHALL provide the reason for rejection. and > Verifiers SHALL offer guidance to the subscriber to assist the user in > choosing a strong password. This is particularly important following > the rejection of a password on the blocklist as it discourages trivial > modification of listed weak passwords. * add docs for default Password policy * remove HIBP from default Password policy * add zxcvbn to default Password policy * add fallback password error message to password policy, fix validation policy * reword docs * add HIBP caveat * separate policy into separate blueprint * use password policy for oobe flow * kiss --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>

* main: (21 commits) web: bump API Client version (#11997) sources/kerberos: use new python-kadmin implementation (#11932) core: add ability to provide reason for impersonation (#11951) website/integrations: update vcenter integration docs (#11768) core, web: update translations (#11995) website: bump postcss from 8.4.48 to 8.4.49 in /website (#11996) web: bump API Client version (#11992) blueprints: add default Password policy (#11793) stages/captcha: Run interactive captcha in Frame (#11857) core, web: update translations (#11979) core: bump packaging from 24.1 to 24.2 (#11985) core: bump ruff from 0.7.2 to 0.7.3 (#11986) core: bump msgraph-sdk from 1.11.0 to 1.12.0 (#11987) website: bump the docusaurus group in /website with 9 updates (#11988) website: bump postcss from 8.4.47 to 8.4.48 in /website (#11989) stages/password: use recovery flow from brand (#11953) core: bump golang.org/x/sync from 0.8.0 to 0.9.0 (#11962) web: bump cookie, swagger-client and express in /web (#11966) core, web: update translations (#11959) core: bump debugpy from 1.8.7 to 1.8.8 (#11961) ...

* main: (55 commits) web: bump API Client version (#11997) sources/kerberos: use new python-kadmin implementation (#11932) core: add ability to provide reason for impersonation (#11951) website/integrations: update vcenter integration docs (#11768) core, web: update translations (#11995) website: bump postcss from 8.4.48 to 8.4.49 in /website (#11996) web: bump API Client version (#11992) blueprints: add default Password policy (#11793) stages/captcha: Run interactive captcha in Frame (#11857) core, web: update translations (#11979) core: bump packaging from 24.1 to 24.2 (#11985) core: bump ruff from 0.7.2 to 0.7.3 (#11986) core: bump msgraph-sdk from 1.11.0 to 1.12.0 (#11987) website: bump the docusaurus group in /website with 9 updates (#11988) website: bump postcss from 8.4.47 to 8.4.48 in /website (#11989) stages/password: use recovery flow from brand (#11953) core: bump golang.org/x/sync from 0.8.0 to 0.9.0 (#11962) web: bump cookie, swagger-client and express in /web (#11966) core, web: update translations (#11959) core: bump debugpy from 1.8.7 to 1.8.8 (#11961) ...

BeryJu reviewed Oct 24, 2024

View reviewed changes

gergosimonyi marked this pull request as ready for review October 25, 2024 06:13

gergosimonyi requested review from a team as code owners October 25, 2024 06:13

tanberry reviewed Oct 25, 2024

View reviewed changes

website/docs/customize/policies/index.md Outdated Show resolved Hide resolved

tanberry approved these changes Oct 25, 2024

View reviewed changes

gergosimonyi and others added 5 commits October 25, 2024 16:49

add docs for default Password policy

115c29f

remove HIBP from default Password policy

7586fda

add zxcvbn to default Password policy

2942225

add fallback password error message to password policy, fix validatio…

9065277

…n policy Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu force-pushed the blueprints/harden-default-password-policies branch from 8413025 to 9065277 Compare October 25, 2024 15:11

BeryJu reviewed Oct 25, 2024

View reviewed changes

website/docs/security/security-hardening.md Outdated Show resolved Hide resolved

gergosimonyi and others added 5 commits October 30, 2024 14:11

reword docs

c2b91f5

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

add HIBP caveat

9154062

Co-authored-by: Jens L. <jens@goauthentik.io> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

separate policy into separate blueprint

711d224

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

use password policy for oobe flow

fac4735

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

kiss

41f7ba5

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu merged commit 6b15562 into main Nov 11, 2024
64 of 65 checks passed

BeryJu deleted the blueprints/harden-default-password-policies branch November 11, 2024 12:31

gcp-cherry-pick-bot bot mentioned this pull request Nov 11, 2024

blueprints: add default Password policy (cherry-pick #11793) #11993

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

blueprints: add default Password policy #11793

blueprints: add default Password policy #11793

gergosimonyi commented Oct 24, 2024

netlify bot commented Oct 24, 2024 •

edited

Loading

netlify bot commented Oct 24, 2024 •

edited

Loading

codecov bot commented Oct 24, 2024 •

edited

Loading

BeryJu Oct 24, 2024

gergosimonyi Oct 24, 2024

BeryJu Oct 24, 2024

gergosimonyi Oct 25, 2024

github-actions bot commented Oct 24, 2024 •

edited

Loading

tanberry left a comment

BeryJu commented Nov 11, 2024

blueprints: add default Password policy #11793

blueprints: add default Password policy #11793

Conversation

gergosimonyi commented Oct 24, 2024

Details

Checklist

netlify bot commented Oct 24, 2024 • edited Loading

✅ Deploy Preview for authentik-storybook canceled.

netlify bot commented Oct 24, 2024 • edited Loading

✅ Deploy Preview for authentik-docs canceled.

codecov bot commented Oct 24, 2024 • edited Loading

Codecov Report

BeryJu Oct 24, 2024

Choose a reason for hiding this comment

gergosimonyi Oct 24, 2024

Choose a reason for hiding this comment

BeryJu Oct 24, 2024

Choose a reason for hiding this comment

gergosimonyi Oct 25, 2024

Choose a reason for hiding this comment

github-actions bot commented Oct 24, 2024 • edited Loading

tanberry left a comment

Choose a reason for hiding this comment

BeryJu commented Nov 11, 2024

netlify bot commented Oct 24, 2024 •

edited

Loading

netlify bot commented Oct 24, 2024 •

edited

Loading

codecov bot commented Oct 24, 2024 •

edited

Loading

github-actions bot commented Oct 24, 2024 •

edited

Loading