goauthentik / goauthentik/authentik
OAuth2 source enrollment never resumes previous flow
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Describe the bug
I want to allow users to enroll exclusively through invite links that identify them through an external OAuth2 identity provider. This is no longer possible after #12872. I had previously been unwittingly leveraging that bug to get around this.
I have been entirely unsuccessful in getting an enrollment flow to create a new user and return them to the invitation flow. Including nothing but a User Write stage in the enrollment flow, the user will, at best, be enrolled according to that stage and promptly logged in without returning to the invitation flow. This would be acceptable if it were possible to include an Invitation stage at the beginning of the enrollment flow. Unfortunately, invitation context isn't preserved here. Because the invitation flow is never resumed, my only choice here is to allow anybody to enroll from the authentication page and manually approve and assign groups to everyone.
### How to reproduce
Forgive me, I am expending the rest of that which I have not lost to fatigue to report this. Hopefully my goal statement is enough to lead you directly to what needs fixing.
### Expected behavior
I'd like to use either the Identification or Source stages to gather a user's identity from an external identity provider and use that to enroll them according to the rest of the flow. Or, at the very least, only permit enrollment through an invitation.
### Screenshots
_No response_
### Additional context
On top of that, an empty enrollment flow seems to generate a missing key exception at [authentik/core/sources/stage.py](https://github.com/goauthentik/authentik/blob/a07e820bce512f54dcedaaa2f4abd3aa68ea62b1/authentik/core/sources/stage.py#L22).
### Deployment Method
Docker
### Version
2025.10.2
### Relevant log output
```shell
```
Contributor guide
Assessment
This issue has not been assessed yet.