goauthentik / goauthentik/authentik

How to abort flow when a policy in a stage fails?

Open
#17,354 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 4h
Merged PRs (30d)
634

Description

Describe your question/
Is it possible to completely abort a flow when a single policy in one of the stages fails?

Relevant info
I have flows with multiple stages and i'm already using deny stages with policies to have some kind of control. each stage is responsible for retrieving or evaluating a specific thing e.g. an invitation flow i'm currently working on:

  • invitation accept stage
  • prompt stage for pre-enroll: get or create existing user via policy and then prompt enrollment type
    HOWTO: abort flow on error (e.g. necessary attributes missing or user creation problem)
  • deny stage: deny if the user is already active
  • redirect stage: check set enroll type & redirect to next flow according to enroll type
  • deny stage: deny if no enroll type matched

I know that i can add a check in the deny stage after the HOWTO question to deny the user but that means i need to basically add deny stages everywhere and execute similar checks everywhere (e.g. the get or create user code that i need in the prompt stage already did make sure that i have a user or error out).

Is it somehow possible (e.g. programatically; setting next stage or something) to abort the flow execution?

Note:
Every stage and flow binding is already set to 'failure result' 'dont pass' and 'policy engine mode' to 'all'; i also don't want to retry or restart the flow. In a nutshell I think I would like to have a dynamically inserted deny stage?

Version and Deployment (please complete the following information):

  • authentik version: 2025.8.4
  • Deployment: docker-compose

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the flow execution, stage failure handling, and policy evaluation behavior described in the issue. Reproduce the multi-stage invitation flow with a failing policy and verify whether execution can stop without retrying or restarting. Done should be a documented, tested way to abort dynamically, or a clear explanation of the supported alternative.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker-compose, python
Domain
authentication, authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.