Overview
Flows are a method of describing a sequence of stages. A stage represents a single verification or logic step. They are used to authenticate users, enroll them, and more.
For example, a standard login flow would consist of the following stages:
- Identification, user identifies themselves via a username or email address
- Password, the user's password is checked against the hash in the database
- Log the user in
Upon flow execution, a plan containing all stages is generated. This means that all attached policies are evaluated upon execution. This behaviour can be altered by enabling the Evaluate when stage is run option on the binding.
The determine which flow should be used, authentik will first check which default authentication flow is configured in the active Brand. If no default is configured there, the policies in all flows with the matching designation are checked, and the first flow with matching policies sorted by slug
will be used.
Permissions
Flows can have policies assigned to them. These policies determine if the current user is allowed to see and use this flow.
Keep in mind that in certain circumstances, policies cannot match against users and groups as there is no authenticated user yet.
Denied action
Configure what happens when access to a flow is denied by a policy. By default, authentik will redirect to a ?next
parameter if set, and otherwise show an error message.
MESSAGE_CONTINUE
: Show a message if no?next
parameter is set, otherwise redirect.MESSAGE
: Always show error message.CONTINUE
: Always redirect, either to?next
if set, otherwise to the default interface.
Designation
Flows are designated for a single purpose. This designation changes when a flow is used. The following designations are available:
Authentication
This is designates a flow to be used for authentication.
The authentication flow should always contain a User Login stage, which attaches the staged user to the current session.
Invalidation
This designates a flow to be used to invalidate a session.
This flow should always contain a User Logout stage, which resets the current session.
Enrollment
This designates a flow for enrollment. This flow can contain any amount of verification stages, such as email or captcha. At the end, to create the user, you can use the user_write stage, which either updates the currently staged user, or if none exists, creates a new one.
Unenrollment
This designates a flow for unenrollment. This flow can contain any amount of verification stages, such as email or captcha. As a final stage, to delete the account, use the user_delete stage.