authentik.enterprise.stages.mtls.models

 1from django.db import models
 2from django.utils.translation import gettext_lazy as _
 3from rest_framework.serializers import Serializer
 4
 5from authentik.crypto.models import CertificateKeyPair
 6from authentik.endpoints.models import StageMode
 7from authentik.flows.models import Stage
 8from authentik.flows.stage import StageView
 9
10
11class CertAttributes(models.TextChoices):
12    """Certificate attribute used for user matching"""
13
14    SUBJECT = "subject"
15    COMMON_NAME = "common_name"
16    EMAIL = "email"
17
18
19class UserAttributes(models.TextChoices):
20    """User attribute for user matching"""
21
22    USERNAME = "username"
23    EMAIL = "email"
24
25
26class MutualTLSStage(Stage):
27    """Authenticate/enroll users using a client-certificate."""
28
29    mode = models.TextField(choices=StageMode.choices)
30
31    certificate_authorities = models.ManyToManyField(
32        CertificateKeyPair,
33        default=None,
34        blank=True,
35        help_text=_(
36            "Configure certificate authorities to validate the certificate against. "
37            "This option has a higher priority than the `client_certificate` option on `Brand`."
38        ),
39    )
40
41    cert_attribute = models.TextField(choices=CertAttributes.choices)
42    user_attribute = models.TextField(choices=UserAttributes.choices)
43
44    @property
45    def view(self) -> type[StageView]:
46        from authentik.enterprise.stages.mtls.stage import MTLSStageView
47
48        return MTLSStageView
49
50    @property
51    def serializer(self) -> type[Serializer]:
52        from authentik.enterprise.stages.mtls.api import MutualTLSStageSerializer
53
54        return MutualTLSStageSerializer
55
56    @property
57    def component(self) -> str:
58        return "ak-stage-mtls-form"
59
60    class Meta:
61        verbose_name = _("Mutual TLS Stage")
62        verbose_name_plural = _("Mutual TLS Stages")
63        permissions = [
64            ("pass_outpost_certificate", _("Permissions to pass Certificates for outposts.")),
65        ]