authentik.stages.identification.models

  1"""identification stage models"""
  2
  3from django.contrib.postgres.fields import ArrayField
  4from django.db import models
  5from django.utils.translation import gettext_lazy as _
  6from django.views import View
  7from rest_framework.serializers import BaseSerializer
  8
  9from authentik.core.models import Source
 10from authentik.flows.models import Flow, Stage
 11from authentik.stages.authenticator_validate.models import AuthenticatorValidateStage
 12from authentik.stages.captcha.models import CaptchaStage
 13from authentik.stages.password.models import PasswordStage
 14
 15
 16class UserFields(models.TextChoices):
 17    """Fields which the user can identify themselves with"""
 18
 19    E_MAIL = "email"
 20    USERNAME = "username"
 21    UPN = "upn"
 22
 23
 24class IdentificationStage(Stage):
 25    """Identify the user for authentication."""
 26
 27    user_fields = ArrayField(
 28        models.CharField(max_length=100, choices=UserFields.choices),
 29        blank=True,
 30        help_text=_(
 31            "Fields of the user object to match against. (Hold shift to select multiple options)"
 32        ),
 33    )
 34
 35    password_stage = models.ForeignKey(
 36        PasswordStage,
 37        null=True,
 38        default=None,
 39        on_delete=models.SET_NULL,
 40        help_text=_(
 41            (
 42                "When set, shows a password field, instead of showing the "
 43                "password field as separate step."
 44            ),
 45        ),
 46    )
 47
 48    captcha_stage = models.ForeignKey(
 49        CaptchaStage,
 50        null=True,
 51        default=None,
 52        on_delete=models.SET_NULL,
 53        help_text=_(
 54            (
 55                "When set, adds functionality exactly like a Captcha stage, but baked into the "
 56                "Identification stage."
 57            ),
 58        ),
 59    )
 60
 61    webauthn_stage = models.ForeignKey(
 62        AuthenticatorValidateStage,
 63        null=True,
 64        default=None,
 65        on_delete=models.SET_NULL,
 66        help_text=_(
 67            (
 68                "When set, and conditional WebAuthn is available, allow the user to use their "
 69                "passkey as a first factor."
 70            ),
 71        ),
 72    )
 73
 74    case_insensitive_matching = models.BooleanField(
 75        default=True,
 76        help_text=_("When enabled, user fields are matched regardless of their casing."),
 77    )
 78    show_matched_user = models.BooleanField(
 79        default=True,
 80        help_text=_(
 81            "When a valid username/email has been entered, and this option is enabled, "
 82            "the user's username and avatar will be shown. Otherwise, the text that the user "
 83            "entered will be shown"
 84        ),
 85    )
 86    pretend_user_exists = models.BooleanField(
 87        default=True,
 88        help_text=_(
 89            "When enabled, the stage will succeed and continue even when incorrect user info "
 90            "is entered."
 91        ),
 92    )
 93    enable_remember_me = models.BooleanField(
 94        default=False,
 95        help_text=_(
 96            "Show the user the 'Remember me on this device' toggle, allowing repeat "
 97            "users to skip straight to entering their password."
 98        ),
 99    )
100    enrollment_flow = models.ForeignKey(
101        Flow,
102        on_delete=models.SET_DEFAULT,
103        null=True,
104        blank=True,
105        related_name="+",
106        default=None,
107        help_text=_("Optional enrollment flow, which is linked at the bottom of the page."),
108    )
109    recovery_flow = models.ForeignKey(
110        Flow,
111        on_delete=models.SET_DEFAULT,
112        null=True,
113        blank=True,
114        related_name="+",
115        default=None,
116        help_text=_("Optional recovery flow, which is linked at the bottom of the page."),
117    )
118    passwordless_flow = models.ForeignKey(
119        Flow,
120        on_delete=models.SET_DEFAULT,
121        null=True,
122        blank=True,
123        related_name="+",
124        default=None,
125        help_text=_("Optional passwordless flow, which is linked at the bottom of the page."),
126    )
127
128    sources = models.ManyToManyField(
129        Source, default=list, help_text=_("Specify which sources should be shown."), blank=True
130    )
131    show_source_labels = models.BooleanField(default=False)
132
133    @property
134    def serializer(self) -> type[BaseSerializer]:
135        from authentik.stages.identification.api import IdentificationStageSerializer
136
137        return IdentificationStageSerializer
138
139    @property
140    def view(self) -> type[View]:
141        from authentik.stages.identification.stage import IdentificationStageView
142
143        return IdentificationStageView
144
145    @property
146    def component(self) -> str:
147        return "ak-stage-identification-form"
148
149    class Meta:
150        verbose_name = _("Identification Stage")
151        verbose_name_plural = _("Identification Stages")