goauthentik / goauthentik/authentik
Implemeting the password expirey policy on user login flow
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### **Describe your question**
I wonder how to apply the password expiry policy on the default-authentication-flow flow
#### **In my setup, I have 2 flows**
1. default-authentication-flow with stages
- default-authentication-identification with password stage embeded in it (the username and password fields are shown on the same page)
- Google reCaptcha
- default-authentication-mfa-validation
- default-source-authentication-login
2. Recovery with stages
- recovery-identification-authentication
- recovery-email
- default-password-change-prompt
- default-password-change-write
#### The target
when the end user enter that default-authentication-identification stage where he has to enter his username and password, if the password was expired i want the user to be redirected to the recovery flow
#### Steps implemented
- I have created a policy password-expiry of type Password Expiry Policy
- I have created both flows default-authentication-flow, Recovery with stages
### **Version and Deployment**
- authentik version: 2025.2.2
- Deployment: helm
Contributor guide
Research direction
Start by reviewing the configured default-authentication-flow, its default-authentication-identification password stage, and the Recovery flow with its password-change stages. Determine whether the password-expiry policy can trigger the requested transition; done means an expired password during login reliably sends the user into Recovery.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100