authentik.stages.password.models

 1"""password stage models"""
 2
 3from django.contrib.postgres.fields import ArrayField
 4from django.db import models
 5from django.utils.translation import gettext_lazy as _
 6from django.views import View
 7from rest_framework.serializers import BaseSerializer
 8
 9from authentik.core.types import UserSettingSerializer
10from authentik.flows.models import ConfigurableStage, Stage
11from authentik.stages.password import (
12    BACKEND_APP_PASSWORD,
13    BACKEND_INBUILT,
14    BACKEND_KERBEROS,
15    BACKEND_LDAP,
16)
17
18
19def get_authentication_backends():
20    """Return all available authentication backends as tuple set"""
21    return [
22        (
23            BACKEND_INBUILT,
24            _("User database + standard password"),
25        ),
26        (
27            BACKEND_APP_PASSWORD,
28            _("User database + app passwords"),
29        ),
30        (
31            BACKEND_LDAP,
32            _("User database + LDAP password"),
33        ),
34        (
35            BACKEND_KERBEROS,
36            _("User database + Kerberos password"),
37        ),
38    ]
39
40
41class PasswordStage(ConfigurableStage, Stage):
42    """Prompt the user for their password, and validate it against the configured backends."""
43
44    backends = ArrayField(
45        models.TextField(choices=get_authentication_backends()),
46        help_text=_("Selection of backends to test the password against."),
47    )
48    failed_attempts_before_cancel = models.IntegerField(
49        default=5,
50        help_text=_(
51            "How many attempts a user has before the flow is canceled. "
52            "To lock the user out, use a reputation policy and a user_write stage."
53        ),
54    )
55    allow_show_password = models.BooleanField(
56        default=False,
57        help_text=_(
58            "When enabled, provides a 'show password' button with the password input field."
59        ),
60    )
61
62    @property
63    def serializer(self) -> type[BaseSerializer]:
64        from authentik.stages.password.api import PasswordStageSerializer
65
66        return PasswordStageSerializer
67
68    @property
69    def view(self) -> type[View]:
70        from authentik.stages.password.stage import PasswordStageView
71
72        return PasswordStageView
73
74    @property
75    def component(self) -> str:
76        return "ak-stage-password-form"
77
78    def ui_user_settings(self) -> UserSettingSerializer | None:
79        if not self.configure_flow:
80            return None
81        return UserSettingSerializer(
82            data={
83                "title": str(self._meta.verbose_name),
84                "component": "ak-user-settings-password",
85            }
86        )
87
88    class Meta:
89        verbose_name = _("Password Stage")
90        verbose_name_plural = _("Password Stages")