goauthentik / goauthentik/authentik
Show password hashes on User List API
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Is your feature request related to a problem? Please describe.**
We're running authentik in conjunction with another subordinated identification system that wants to validate user password on their side.
However the password is not shown in the API endpoint /core/users/ response.
**Describe the solution you'd like**
A switch like `include_groups` that will signal authentik to return the password hashes stored in the DB out of the API. Probably also a designated permission so the passwords are only exposed to a user with the specific permission.
**Describe alternatives you've considered**
We have an implementation in #15572 *
Besides implementing it ourselves we were (ab-)using LDAP as a "bus" for transmitting password information across systems, due to our design we want to avoid (ab-)using LDAP for this purpose.
**Additional context**
Firefox screenshot of the API Response:
Contributor guide
Assessment
This issue has not been assessed yet.