tenants: fix base URL validation rejecting internal hostnames - #25560
tenants: fix base URL validation rejecting internal hostnames#25560emilburzo wants to merge 6 commits into
Conversation
emilburzo
added
the
backport/version-2026.8
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR addresses overly strict base URL validation in authentik tenants, which was rejecting valid internal hostnames (e.g. https://auth.svr001) during initial setup and when saving system settings (Issue #25546).
Changes:
- Relax base URL validation by replacing strict URLField/URLValidator behavior with a custom
validate_base_urlhelper and a DRFBaseURLField. - Update the OOBE (initial setup) flow validation to use the shared tenant base URL validation helper.
- Regenerate the OpenAPI schema so
base_urlis no longer emitted asformat: uri, and add/extend tests covering internal hostnames and backfill behavior.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| schema.yml | Removes format: uri for base_url so clients/UIs don’t apply overly strict “URI format” validation. |
| blueprints/default/flow-oobe.yaml | Switches OOBE base URL validation to normalize_base_url + validate_base_url. |
| authentik/tenants/utils.py | Adds validate_base_url helper (and related imports) to centralize base URL validation. |
| authentik/tenants/api/settings.py | Adds BaseURLField and uses it in the settings serializer to relax DRF validation and normalize input. |
| authentik/tenants/apps.py | Ensures reconciliation/backfill validates a candidate base URL and discards invalid values safely. |
| authentik/tenants/tests/test_validate_base_url.py | Adds unit tests for the new helper and expected accepted/rejected patterns. |
| authentik/tenants/tests/test_base_url_settings.py | Adds API tests confirming internal hostnames are accepted and settings remain saveable. |
| authentik/tenants/tests/test_base_url_backfill.py | Adds backfill test ensuring invalid outpost host values are discarded and warnings are logged. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #25560 +/- ##
==========================================
+ Coverage 91.67% 91.69% +0.02%
==========================================
Files 1151 1152 +1
Lines 73416 73503 +87
Branches 4054 4054
==========================================
+ Hits 67301 67396 +95
+ Misses 6073 6065 -8
Partials 42 42
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
|
authentik PR Installation instructions Instructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-e3a5185cf13171c2e2f7cdabe3a3e100ac105760
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-e3a5185cf13171c2e2f7cdabe3a3e100ac105760Afterwards, run the upgrade commands from the latest release notes. |
| base_url = CharField( | ||
| required=False, | ||
| allow_blank=True, | ||
| max_length=200, | ||
| help_text=Tenant._meta.get_field("base_url").help_text, | ||
| validators=[BASE_URL_VALIDATOR], | ||
| ) |
There was a problem hiding this comment.
The validator should be set on the model field instead, which allows you to remove this, and a bunch more of the validation code that you added on this PR
There was a problem hiding this comment.
I did try that, but because the model field is models.URLField, I could not get rid of the URLValidator. it seems validators = [...] only appends to the list of validators, it doesn't replace it
There was a problem hiding this comment.
Ah yeah, I forgot about that. In that case, change the model field to become:
base_url = models.TextField(validators=[DomainlessURLValidator(...)])
There was a problem hiding this comment.
that introduces a migration though, right? do we want that? since this needs to be backported to .8
There was a problem hiding this comment.
That's fine for this. It will change the column type from varchar(200) to text which is painless in postgres. Especially for a table with 1 row
There was a problem hiding this comment.
I went with models.CharField and max length 200 instead, so that there's no DDL change at all.
Why: concerned about upgrades/downgrades and any surprises with the data during conversions.
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Fixes #25546