providers/oauth2: evaluate property mappings in client credentials JWT flow#20979
Merged
BeryJu merged 4 commits intogoauthentik:mainfrom Mar 18, 2026
Merged
Conversation
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
BeryJu
approved these changes
Mar 18, 2026
Member
BeryJu
left a comment
There was a problem hiding this comment.
Looks good, made a couple small changes:
- Always top level imports unless they're needed inline to avoid circular imports
- clamp the username at its max length (technically an unrelated change)
- keep the original test case and change your modification into a new test case
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #20979 +/- ##
==========================================
- Coverage 93.49% 93.44% -0.06%
==========================================
Files 993 993
Lines 56126 56146 +20
==========================================
- Hits 52477 52467 -10
- Misses 3649 3679 +30
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
rissson
reviewed
Mar 18, 2026
rissson
approved these changes
Mar 18, 2026
kensternberg-authentik
added a commit
that referenced
this pull request
Mar 18, 2026
* main: (21 commits) providers/oauth2: evaluate property mappings in client credentials JWT flow (#20979) core: bump ujson from 5.11.0 to 5.12.0 (#20980) website: bump the build group in /website with 3 updates (#20963) core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1773774443 (#20955) ci: bump calibreapp/image-actions from d9c8ee5c3dc52ae4622c82ead88d658f4b16b65f to 03c976c29803442fc4040a9de5509669e7759b81 (#20970) core: bump library/golang from `9c51d8b` to `96b2878` in /lifecycle/container (#20972) core: bump library/node from `407d745` to `394048f` in /website (#20973) core: bump library/nginx from `bc45d24` to `dec7a90` in /website (#20974) core: bump github.com/go-ldap/ldap/v3 from 3.4.12 to 3.4.13 (#20962) core: bump google-api-python-client from 2.192.0 to 2.193.0 (#20964) web: bump @sentry/browser from 10.43.0 to 10.44.0 in /web in the sentry group across 1 directory (#20965) core: bump django-tenants from 3.10.0 to 3.10.1 (#20966) core: bump coverage[toml] from 7.13.4 to 7.13.5 (#20967) core: bump goauthentik/fips-debian from `e06f0fe` to `a613b75` in /lifecycle/container (#20968) core: bump sentry-sdk from 2.54.0 to 2.55.0 (#20969) core: bump goauthentik/fips-python from `08bc05d` to `ec5c4cd` in /lifecycle/container (#20971) web: Fix admin table horizontal scrolling (#20960) core: bump pyasn1 from 0.6.2 to 0.6.3 (#20956) tasks: fix workers API URL missing trailing / (#20954) web: Supply our font and color choices to rapidoc. (#20775) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
Currently, the
client_credentialsflow using JWT assertions bypasses property mappings, hardcoding the generated user's attributes based solely on thesubclaim and application name.This PR updates
__create_user_from_jwtto leverage the coreSourceMapperengine. It now properly evaluates configured user property mappings and applies them to the generated service account, aligning this flow's behavior with standard Authentik logins.SourceMapper().build_object_properties().closes #18767
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make docs)