From 88516ba2ca816aaf67d64d8cd5b74a713026e2bf Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Sat, 13 Nov 2021 22:33:03 +0100 Subject: [PATCH] core: make defaults for _change_email and _change_username configurable closes #1789 Signed-off-by: Jens Langhammer --- authentik/core/api/users.py | 9 +++++++-- authentik/lib/default.yml | 3 +++ website/docs/installation/configuration.md | 16 ++++++++++++++++ 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/authentik/core/api/users.py b/authentik/core/api/users.py index e6f05a62f..cb09f0f05 100644 --- a/authentik/core/api/users.py +++ b/authentik/core/api/users.py @@ -55,6 +55,7 @@ from authentik.core.models import ( User, ) from authentik.events.models import EventAction +from authentik.lib.config import CONFIG from authentik.stages.email.models import EmailStage from authentik.stages.email.tasks import send_mails from authentik.stages.email.utils import TemplateEmailMessage @@ -125,7 +126,9 @@ class UserSelfSerializer(ModelSerializer): def validate_email(self, email: str): """Check if the user is allowed to change their email""" - if self.instance.group_attributes().get(USER_ATTRIBUTE_CHANGE_EMAIL, True): + if self.instance.group_attributes().get( + USER_ATTRIBUTE_CHANGE_EMAIL, CONFIG.y_bool("default_user_change_email", True) + ): return email if email != self.instance.email: raise ValidationError("Not allowed to change email.") @@ -133,7 +136,9 @@ class UserSelfSerializer(ModelSerializer): def validate_username(self, username: str): """Check if the user is allowed to change their username""" - if self.instance.group_attributes().get(USER_ATTRIBUTE_CHANGE_USERNAME, True): + if self.instance.group_attributes().get( + USER_ATTRIBUTE_CHANGE_USERNAME, CONFIG.y_bool("default_user_change_username", True) + ): return username if username != self.instance.username: raise ValidationError("Not allowed to change username.") diff --git a/authentik/lib/default.yml b/authentik/lib/default.yml index d1488b6aa..e3310b989 100644 --- a/authentik/lib/default.yml +++ b/authentik/lib/default.yml @@ -78,3 +78,6 @@ footer_links: href: https://goauthentik.io/docs/?utm_source=authentik - name: authentik Website href: https://goauthentik.io/?utm_source=authentik + +default_user_change_email: true +default_user_change_username: true diff --git a/website/docs/installation/configuration.md b/website/docs/installation/configuration.md index 30a3c3e8c..bef22847e 100644 --- a/website/docs/installation/configuration.md +++ b/website/docs/installation/configuration.md @@ -149,6 +149,22 @@ Configure how authentik should show avatars for users. Following values can be s - `%(mail_hash)s`: The email address, md5 hashed - `%(upn)s`: The user's UPN, if set (otherwise an empty string) +### AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL + +:::info +Requires authentik 2021.10.5 +::: + +Enable the ability for users to change their Email address, defaults to `true`. + +### AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME + +:::info +Requires authentik 2021.10.5 +::: + +Enable the ability for users to change their Usernames, defaults to `true`. + ## Debugging To check if your config has been applied correctly, you can run the following command to output the full config: