Authentik LDAP integration and MFA setup

[runleveldev]

Cutover Plan

1. Import existing manager.os.mieweb.org users to auth.os.mieweb.org via the sync-users-to-authentik.sh script
2. Deploy External OIDC authentication (SSO) and remove push-notification 2FA #335
3. Add manager.os.mieweb.org as an application in auth.os.mieweb.org accessible only by internal members of the ldapusers
4. Ensure logins to manager.os.mieweb.org work as expected
5. Deploy redundant Authentik LDAP outposts to the cluster(s)
6. Set the SSSD_* settings in manager
7. Deploy a new container to generate the sssd.conf
8. Copy the updated sssd.conf to all containers and restart sssd

Copilot Summary

This pull request introduces a comprehensive, declarative configuration for deploying authentik as the identity provider for the MIE Opensource platform. It establishes SSO, LDAP, and enforced push-based 2FA for all interactive users, using a set of blueprints that define all flows, stages, and required identities. The changes modularize the configuration, enforce strict import order, and document the deployment and flow logic in detail.

The most important changes are:

Documentation and Structure:

• Added a detailed README.md in the authentik directory, explaining the deployment architecture, flow logic, environment variables, and blueprint import order for reproducible identity provider setup.

Blueprints for Authentication and Enrollment:

• Added blueprints for push-notification (DUO) authenticator setup (10-opensource-authenticator-duo-setup.yaml), LDAP identity group and service account (10-opensource-ldap-identity.yaml), and a shared MFA validation stage (11-opensource-mfa-validation-stage.yaml). These blueprints ensure all interactive flows require push-based 2FA and that only authorized users/groups can bind to LDAP. [1] [2] [3]

Flow and Stage Refactoring:

• Refactored the authentication and enrollment flows to use the shared MFA validation stage, ensuring consistent 2FA enforcement across login, registration, and invitation onboarding. The MFA validation stage is now defined once and referenced by all relevant flows. [1] [2] [3]

Blueprint Organization and Import Order:

• Renamed and reordered blueprint files to enforce correct import dependencies (e.g., 50-opensource-authentication-flow.yaml to 20-opensource-authentication-flow.yaml, 10-flows-enrollment-email-verification.yaml to 12-flows-enrollment-email-verification.yaml). This prevents import errors and makes dependencies explicit. [1] [2] [3] [4]

Configuration Improvements:

• Updated blueprint YAML to use multi-line strings for complex expressions, improved environment variable handling, and added comments clarifying the purpose and dependencies of each stage and flow. [1] [2] [3]

These changes provide a robust, reproducible, and well-documented authentik deployment for the platform, with strong security and clear operational guidance.

TODO

• Add DUO (MIEAuth) setup step to the login flow
• Add invite flow which creates internal users in the ldapusers group
• Create the ldapusers group from a blueprint
• Add manual DUO (MIEAuth) registration flow
• Setup Opensource brand via Blueprint
• Create LDAP bind user which bypasses 2FA
• Create LDAP application + provider which only allows ldapusers to bind to it
• Enforce 2FA at registration time for external email (enrollment-email)
• Automatically sync blueprints

[Copilot]

Pull request overview

Adds a declarative authentik deployment (blueprints + documentation) to provide SSO, LDAP, and enforced MFA for the MIE Opensource platform, and extends the base container/SSSD configuration to support LDAP-based access filtering and SSH public keys sourced from LDAP.

Changes:

• Introduces a set of authentik blueprints to define login/enrollment flows, a shared MFA validation stage, an LDAP provider/application, and a service account + group model for LDAP access control.
• Updates the base image SSSD configuration and docs to support LDAP access filtering and SSH public key retrieval via SSSD/sshd integration.
• Adds operational glue: a seeder to backfill new SSSD env vars and a script to create missing authentik users from the create-a-container API.

Reviewed changes

Copilot reviewed 15 out of 18 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
mie-opensource-landing/docs/admins/ldap-servers.md	Documents new SSSD access provider/filter and additional LDAP/SSSD env vars.
images/base/sssd.conf.template	Adds LDAP access filtering and sshPublicKey mapping for SSSD, plus homedir/shell defaults.
images/base/Dockerfile	Installs sssd-tools and adds sshd drop-in for SSSD authorized keys.
images/base/50-sss-ssh-authorizedkeys.conf	Configures sshd to fetch authorized keys via sss_ssh_authorizedkeys.
create-a-container/seeders/20260604000003-seed-sssd-access-filter-and-user-attrs.js	Backfills new SSSD_* settings keys into default_container_env_vars.
create-a-container/bin/sync-users-to-authentik.sh	Create-only sync of users from create-a-container into authentik via API.
authentik/README.md	End-to-end documentation of blueprint import order, flows, MFA behavior, and LDAP binding model.
authentik/blueprints/40-opensource-ldap.yaml	Defines LDAP provider/application and restricts bind access to ldapusers; grants proxyuser directory search permission.
authentik/blueprints/30-opensource-brand.yaml	Configures default brand and assigns default flows.
authentik/blueprints/30-flow-invitation-enrollment.yaml	Adds invitation-based onboarding flow that assigns ldapusers and enforces MFA setup.
authentik/blueprints/20-opensource-user-settings-flow.yaml	Adds user settings flow with read-only username and SSH key attribute editing.
authentik/blueprints/20-opensource-authentication-flow.yaml	Refactors to reuse shared MFA stage and adds proxyuser 2FA exception behavior.
authentik/blueprints/12-flows-enrollment-email-verification.yaml	Enforces MFA setup after email verification during self-service registration.
authentik/blueprints/11-opensource-mfa-validation-stage.yaml	Introduces shared authenticator validation stage used across flows.
authentik/blueprints/10-opensource-ldap-identity.yaml	Creates ldapusers group and ldap-proxyuser service account.
authentik/blueprints/10-opensource-authenticator-duo-setup.yaml	Adds push-notification authenticator stage + setup flow.

[cmyers-mieweb]

See comment

[Bobzemob]

LGTM