authentik/website/docs/releases/v2021.6.md

---
title: Release 2021.6
slug: "2021.6"
---

## Headline Changes

- Duo two-factor support

    You can now add the new `authenticator_duo` stage to configure Duo authenticators. Duo has also been added as device class to the `authenticator_validation` stage.

    Currently, only Duo push notifications are supported. Because no additional input is required, Duo also works with the LDAP Outpost.

- Multi-tenancy

    This version adds soft multi-tenancy. This means you can configure different branding settings and different default flows per domain.

    This also changes how a default flow is determined. Previously, for defaults flow, authentik would pick the first flow that

        - matches the required designation
        - comes first sorted by slug
        - is allowed by policies

    Now, authentik first checks if the current tenant has a default flow configured for the selected designation. If not, it behaves the same as before, meaning that if you want to select a default flow based on policy, you can just leave the tenant default empty.

- Domain-level authorization with proxy providers

    Instead of simply being able to toggle between forward auth and proxy mode, you can now enable forward auth for an entire domain. This has the downside that you can't do per-application authorization, but also simplifies configuration as you don't have to create each application in authentik.

- API Schema now uses OpenAPI v3

    The API endpoints are mostly the same, however all the clients are now built from an OpenAPI v3 schema. You can retrieve the schema from `authentik.company.tld/api/v2beta/schema/`

- On Kubernetes installs without a /media PVC, you can now set URLs instead of uploading files.
- Expanded prometheus metrics for PolicyEngine and FlowPlanner

## Minor changes

- You can now specify which sources should be shown on an Identification stage.
- Add UI for the reputation of IPs and usernames for reputation policies.
- Fix proxy outpost not being able to redeem tokens when using with an un-trusted SSL Certificate
- Add UI to check access of any application for any user

## Fixed in 2021.6.1-rc5

- flows: fix configuration URL being set when no flow is configure
- stages/authenticator_totp: set TOTP issuer based on slug'd tenant title
- stages/authenticator_webauthn: use tenant title as RP_NAME
- stages/identification: add UPN
- stages/password: add constants for password backends
- web: fix flow download link

## Fixed in 2021.6.1-rc6

- ci: build and push stable tag when rc not in release name
- core: delete real session when AuthenticatedSession is deleted
- core: fix impersonation not working with inactive users
- core: fix upload api not checking clear properly
- core: revert check_access API to get to prevent CSRF errors
- events: add tenant to event
- events: catch unhandled exceptions from request as event, add button to open github issue
- flows: fix error clearing flow background when no files have been uploaded
- outpost: fix syntax error when creating an outpost with connection
- outposts: fix integrity error with tokens
- outposts/ldap: improve responses for unsuccessful binds
- policies/reputation: fix race condition in tests
- provider/proxy: mark forward_auth flag as deprecated
- providers/saml: improve error handling for signature errors
- root: fix build_hash being set incorrectly for tagged versions
- sources/saml: check sessions before deleting user
- stages/authenticator_duo: don't create default duo stage
- stages/authenticator_validate: add tests for authenticator validation
- stages/identification: fix challenges not being annotated correctly and API client not loading data correctly
- web: add capabilities to sentry event
- web: migrate banner to sidebar
- web/admin: fix user enable/disable modal not matching other modals
- web/admin: select service connection by default when only one exists
- web/flows: fix expiry not shown on consent stage when loading
- web/flows: fix IdentificationStage's label not matching fields
- web/flows: improve display of allowed fields for identification stage
- website/docs: add docs for outpost configuration

## Fixed in 2021.6.1

- core: fix error getting stages when enrollment flow isn't set
- core: fix error when creating AuthenticatedSession without key
- flows: fix error when stage has incorrect type
- providers/saml: add support for NameID type unspecified
- providers/saml: fix error when getting transient user identifier
- providers/saml: fix NameIDPolicy not being parsed correctly
- recovery: fix error when creating multiple keys for the same user
- stages/authenticator_duo: fix error when enrolling an existing user
- stages/authenticator_duo: make Duo-admin viewset writeable
- website/docs: remove migrate command

## Fixed in 2021.6.2

- core: add support for custom urls for avatars
- core: deepmerge user.group_attributes, use group_attributes for user settings
- core: fix PropertyMapping's globals not matching Expression policy
- core: remove default flow background from default css, set static in base_full and dynamically in if/flow
- crypto: catch error when loading private key
- flows: make flow plan cache timeout configurable
- outposts: fix port and inner_port being mixed on docker controller
- outposts/proxy: fix additionalHeaders not being set properly
- policies: don't use policy cache when checking application access
- policies: make policy result cache timeout configurable
- root: allow loading local /static files without debug flag
- root: make general cache timeouts configurable
- root: remove old traefik labels
- root: save temporary database dump in /tmp
- root: set outposts.docker_image_base to gh-master for tests
- stages/authenticator_validate: fix error when using not_configured_action=configure
- tenants: fix tenant not being queried correctly when using accessing over a child domain
- web/admin: fix tenant's default flag not being saved
- web/admin: handle elements in slot=form not being forms
- web/admin: sort inputs on authenticator validation stage form

## Fixed in 2021.6.3

- api: use partition instead of split for token
- core: fix flow background not correctly loading on initial draw
- events: add ability to create events via API
- events: ignore notification non-existent in transport
- events: only create SYSTEM_EXCEPTION event when error would've been sent to sentry
- expressions: fix regex_match result being inverted
- flows: add FlowStageBinding to flow plan instead of just stage
- flows: add invalid_response_action to configure how the FlowExecutor should handle invalid responses
- flows: handle possible errors with FlowPlans received from cache
- outposts: check docker container ports match
- outposts/ldap: fixed IsActive and IsSuperuser returning swapped incorrect values (#1078)
- providers/oauth2: fix exp of JWT when not using seconds
- sources/ldap: improve error handling when checking for password complexity on non-ad setups
- stages/authenticator_duo: fix component not being set in API
- stages/prompt: ensure hidden and static fields keep the value they had set
- stages/user_write: add flag to create new users as inactive
- tenants: include all default flows in current_tenant
- web/admin: fix deletion of authenticator not reloading the state correctly
- web/admin: fix only recovery flows being selectable for unenrollment flow in tenant form
- web/admin: fix text color on pf-c-card

## Fixed in 2021.6.4

- crypto: show both sha1 and sha256 fingerprints
- flows: handle old cached flow plans better
- outposts/ldap: add support for boolean fields in ldap
- outposts/proxy: always redirect to session-end interface on sign_out
- providers/oauth2: add revoked field, create suspicious event when previous token is used
- providers/oauth2: deepmerge claims
- providers/oauth2: fix CORS headers not being set for unsuccessful requests
- providers/oauth2: use self.expires for exp field instead of calculating it again
- sources/oauth: create configuration error event when profile can't be parsed as json
- stages/user_write: add wrapper for post to user_write
- web/admin: fix ModelForm not re-loading after being reset
- web/admin: show oauth2 token revoked status

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.6 from [here](https://raw.githubusercontent.com/goauthentik/authentik/version-2021.6/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Upgrade to the latest chart version to get the new images.