Invitation-only enrollment in authentik
Onboarding contractors, partners or customers by invitation instead of open signup: the invitation stage, single-use and expiring links, prefilled attributes and binding the enrollment flow to policies.
authentik flows and policies
Specific login, enrollment and recovery flows and the policies that decide them, from invitations and password rules to GeoIP, reputation and branding per domain.
Self-service password recovery in authentik
Building a recovery flow that does not let an email link alone take over an account: email verification, MFA before reset, account enumeration settings and recovery for administrators.
Forcing a password reset at next login in authentik
Requiring users to change their password at the next sign-in, for example after a migration or a leak: the documented flow pattern, user attributes and communication.
authentik expression policies in Python
Writing Python expression policies for rules the built-in policies cannot express: available context, group and attribute checks, the 2026.2 change from ak_groups to groups, and locking down who may edit expressions.
GeoIP and impossible travel policies in authentik
Blocking or challenging logins by country, ASN, distance from recent logins or impossible travel: the bundled GeoIP database, updating it, session binding and what breaks if the database is missing.
Reputation policies against password spraying in authentik
Responding to failed logins and suspicious requests with reputation scores: CAPTCHA for low-reputation clients, deny bindings, notifications and tuning to avoid locking out shared IP addresses.
Password complexity, breach checks and expiry in authentik
Setting password rules auditors ask about: length and complexity, Have I Been Pwned and zxcvbn checks, expiry, Enterprise password history, and offline alternatives in air-gapped networks.
CAPTCHA stages in authentik
Adding a CAPTCHA to login or enrollment flows: supported providers including the self-hostable Cap provider added in 2026.8, JSON verification requests, and protecting CAPTCHA settings from tampering.
Branding authentik per domain with brands and custom CSS
Giving each domain or customer its own login look and default flows with brands: logo, favicon, backgrounds, custom CSS from 2025.4, default flows per brand, and external user redirects.
Temporary access with expiring policy bindings in authentik
Granting contractors or incident responders access that ends on its own: binding expiry dates added in 2026.8 for policies, groups and users, and how expired bindings behave.
