goauthentik / goauthentik/authentik

Implemeting the password expirey policy on user login flow

Open
#14,165 7 comments 2 reactions 0 assignees View on GitHub
question
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### **Describe your question**
I wonder how to apply the password expiry policy on the default-authentication-flow flow
#### **In my setup, I have 2 flows**
1. default-authentication-flow with stages
- default-authentication-identification with password stage embeded in it (the username and password fields are shown on the same page)
- Google reCaptcha
- default-authentication-mfa-validation
- default-source-authentication-login
2. Recovery with stages
- recovery-identification-authentication
- recovery-email
- default-password-change-prompt
- default-password-change-write

#### The target
when the end user enter that default-authentication-identification stage where he has to enter his username and password, if the password was expired i want the user to be redirected to the recovery flow
#### Steps implemented
- I have created a policy password-expiry of type Password Expiry Policy
- I have created both flows default-authentication-flow, Recovery with stages

### **Version and Deployment**
- authentik version: 2025.2.2
- Deployment: helm

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the configured default-authentication-flow, its default-authentication-identification password stage, and the Recovery flow with its password-change stages. Determine whether the password-expiry policy can trigger the requested transition; done means an expired password during login reliably sends the user into Recovery.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.