Comments (7)
Additional info: Does not matter whether use_global_settings
is true
or false
.
from authentik.
From quickly looking through the code I can see how this would happen if the token expires and is rotated (when the token is rotated we currently default to the default expiry value which is 30 minutes)
from authentik.
While I could be confusing terms, I believe the issue we have found is specifically with token creation during the recovery flows.
In other words:
- No token / active recovery flow exists for the user
- Click create recovery link / send recovery email for the user
- Notice that the new token is created in the
authentik_core_token
table but that it will always have an expiration time 30 minutes in the future regardless of thetoken_expiry
setting. - Validate that after 30 minutes the reset links do not work.
from authentik.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
from authentik.
Still an issue.
from authentik.
I think the problem is that the recovery tokens are created differently from the admin interface/ via the API than they are during flow execution.
The API does not set any expiration time so it will always use the default of 30 minutes.
Maybe the API call should check for an email stage in the recovery flow and use the setting from there?
At least the recovery_email endpoint gets an email stage passed directly and could use the expiry_token value from that.
authentik/authentik/core/api/users.py
Lines 450 to 456 in b0507d2
During flow execution the token is created with the token_expiry setting from the stage.
authentik/authentik/stages/email/stage.py
Lines 83 to 89 in b0507d2
from authentik.
I experienced this via both the links generated from the admin UI and the tokens included in the email link (which I assume are a part of the flow).
Perhaps the flow component has been addressed in a recent release?
from authentik.
Related Issues (20)
- Visual error on application creation with wizard
- Console error when there are no outposts
- Add partial Support for 389-DS
- POST /api/v3/flows/executor/default-authenticator-webauthn-setup/ HOT 1
- AMR MFA field not being sent to OIDC client?
- Blueprint validation failures not returned to web UI
- How to use apache2 auth_openidc? HOT 1
- Redirect failing on initial login HOT 1
- 404 errors for flows on full development environment HOT 1
- authentik Embedded Outpost Proxy Doesn't work when there are many Providers HOT 1
- UI is messed up when forcing light mode with system set to dark mode
- Nextcloud SAML: Found an Attribute element with duplicated Name HOT 1
- What is the TLS version of the OIDC provider of Authentik?
- Authentik occasionally times out HOT 1
- Add documentation surrounding configuring PhotoPrism in Integrations section of website HOT 1
- How about semantic versioning? HOT 1
- No outposts found with given token, ensure the given token corresponds to an authenitk Outpost HOT 2
- Docker Compose Setup Does Not Work on MacOS or Other POSIX OSes
- Application icons disappear after a few weeks
- GET /api/v3/flows/executor/google-enrollment-flow/
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from authentik.