Directory Sync : authentik integration

go.mod

@@ -155,6 +155,7 @@ require (
 	github.com/vanng822/css v1.0.1 // indirect
 	github.com/vanng822/go-premailer v1.33.0 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect
+	goauthentik.io/api/v3 v3.2026020.16 // indirect
 )
 
 require (

go.sum

@@ -867,6 +867,8 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s=
 go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+goauthentik.io/api/v3 v3.2026020.16 h1:sEqcVRXYSJTYaSdU5PzSEdFUWDqCONm5BeL62F5k+58=
+goauthentik.io/api/v3 v3.2026020.16/go.mod h1:82lqAz4jxzl6Cg0YDbhNtvvTG2rm6605ZhdJFnbbsl8=
 gocloud.dev v0.45.0 h1:WknIK8IbRdmynDvara3Q7G6wQhmEiOGwpgJufbM39sY=
 gocloud.dev v0.45.0/go.mod h1:0kXKmkCLG6d31N7NyLZWzt7jDSQura9zD/mWgiB6THI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

internal/integrations/definitions/authentik/builder.go

@@ -0,0 +1,93 @@
+package authentik
+
+import (
+	"github.com/theopenlane/core/internal/ent/integrationgenerated"
+	"github.com/theopenlane/core/internal/integrations/providerkit"
+	"github.com/theopenlane/core/internal/integrations/registry"
+	"github.com/theopenlane/core/internal/integrations/types"
+)
+
+// Builder returns the Authentik definition builder
+func Builder() registry.Builder {
+	return registry.Builder(func() (types.Definition, error) {
+		return types.Definition{
+			DefinitionSpec: types.DefinitionSpec{
+				ID:          definitionID.ID(),
+				Family:      "Authentik",
+				DisplayName: "Authentik",
+				Description: "Collect Authentik directory users, groups, and memberships for identity posture and access governance.",
+				Category:    "identity",
+				DocsURL:     "https://docs.theopenlane.io/docs/platform/integrations/authentik/overview",
+				Tags:        []string{"directory"},
+				Active:      false,
+				Visible:     false,
+			},
+			UserInput: &types.UserInputRegistration{
+				Schema: providerkit.SchemaFrom[UserInput](),
+			},
+			CredentialRegistrations: []types.CredentialRegistration{
+				{
+					Ref:         authentikCredential.ID(),
+					Name:        "Authentik Credential",
+					Description: "API token used to access Authentik instance data.",
+					Schema:      authentikCredentialSchema,
+				},
+			},
+			Connections: []types.ConnectionRegistration{
+				{
+					CredentialRef:       authentikCredential.ID(),
+					Name:                "Authentik API Token",
+					Description:         "Configure Authentik access using an API token from your instance.",
+					CredentialRefs:      []types.CredentialSlotID{authentikCredential.ID()},
+					ClientRefs:          []types.ClientID{authentikClient.ID()},
+					ValidationOperation: healthCheckOperation.Name(),
+					Integration:         integration.Registration(),
+					Disconnect: &types.DisconnectRegistration{
+						CredentialRef: authentikCredential.ID(),
+						Description:   "Removes the stored API token from Openlane. If the token is no longer needed, revoke it in your Authentik admin panel under Directory > Tokens.",
+					},
+				},
+			},
+			Clients: []types.ClientRegistration{
+				{
+					Ref:            authentikClient.ID(),
+					CredentialRefs: []types.CredentialSlotID{authentikCredential.ID()},
+					Description:    "Authentik API client",
+					Build:          Client{}.Build,
+				},
+			},
+			Operations: []types.OperationRegistration{
+				{
+					Name:         healthCheckOperation.Name(),
+					Description:  "Call Authentik API to verify token and instance connectivity",
+					Topic:        definitionID.OperationTopic(healthCheckOperation.Name()),
+					ClientRef:    authentikClient.ID(),
+					Policy:       types.ExecutionPolicy{Inline: true},
+					ConfigSchema: healthCheckSchema,
+					Handle:       HealthCheck{}.Handle(),
+				},
+				{
+					Name:         directorySyncOperation.Name(),
+					Description:  "Collect Authentik directory users, groups, and memberships as directory accounts",
+					Topic:        definitionID.OperationTopic(directorySyncOperation.Name()),
+					ClientRef:    authentikClient.ID(),
+					ConfigSchema: directorySyncSchema,
+					Policy:       types.ExecutionPolicy{Reconcile: true},
+					Ingest: []types.IngestContract{
+						{
+							Schema: integrationgenerated.IntegrationMappingSchemaDirectoryAccount,
+						},
+						{
+							Schema: integrationgenerated.IntegrationMappingSchemaDirectoryGroup,
+						},
+						{
+							Schema: integrationgenerated.IntegrationMappingSchemaDirectoryMembership,
+						},
+					},
+					IngestHandle: DirectorySync{}.IngestHandle(),
+				},
+			},
+			Mappings: authentikMappings(),
+		}, nil
+	})
+}

internal/integrations/definitions/authentik/client.go

@@ -0,0 +1,75 @@
+package authentik
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	authentikSDK "goauthentik.io/api/v3"
+
+	"github.com/theopenlane/core/internal/integrations/types"
+)
+
+const (
+	// authentikRequestTimeout is the per-request timeout for Authentik API calls
+	authentikRequestTimeout = 30 * time.Second
+)
+
+// Client builds Authentik API clients for one installation
+type Client struct{}
+
+// Build constructs the Authentik API client for one installation
+func (Client) Build(_ context.Context, req types.ClientBuildRequest) (any, error) {
+	cred, err := resolveCredential(req.Credentials)
+	if err != nil {
+		return nil, err
+	}
+
+	if cred.Token == "" {
+		return nil, ErrAPITokenMissing
+	}
+
+	if cred.BaseURL == "" {
+		return nil, ErrBaseURLMissing
+	}
+
+	cfg := authentikSDK.NewConfiguration()
+	cfg.Host = extractHost(cred.BaseURL)
+	cfg.Scheme = extractScheme(cred.BaseURL)
+	cfg.HTTPClient = &http.Client{Timeout: authentikRequestTimeout}
+	cfg.AddDefaultHeader("Authorization", "Bearer "+cred.Token)
+
+	return authentikSDK.NewAPIClient(cfg), nil
+}
+
+// resolveCredential extracts the CredentialSchema from the provided credential bindings
+func resolveCredential(bindings types.CredentialBindings) (CredentialSchema, error) {
+	cred, ok, err := authentikCredential.Resolve(bindings)
+	if err != nil {
+		return CredentialSchema{}, ErrCredentialDecode
+	}
+
+	if !ok {
+		return CredentialSchema{}, ErrCredentialDecode
+	}
+
+	return cred, nil
+}
+
+// extractHost extracts the host from a base URL
+func extractHost(baseURL string) string {
+	host := strings.TrimPrefix(baseURL, "https://")
+	host = strings.TrimPrefix(host, "http://")
+
+	return strings.TrimRight(host, "/")
+}
+
+// extractScheme extracts the scheme from a base URL
+func extractScheme(baseURL string) string {
+	if strings.HasPrefix(baseURL, "https://") {
+		return "https"
+	}
+
+	return "http"
+}

internal/integrations/definitions/authentik/doc.go

@@ -0,0 +1,4 @@
+// Package authentik provides an integration definition for Authentik,
+// an open-source identity provider. It supports directory sync of users,
+// groups, and memberships via the Authentik REST API using API token authentication.
+package authentik

internal/integrations/definitions/authentik/errors.go

@@ -0,0 +1,30 @@
+package authentik
+
+import "errors"
+
+var (
+	// ErrAPITokenMissing indicates the API token is missing from the credential
+	ErrAPITokenMissing = errors.New("authentik: api token missing")
+	// ErrBaseURLMissing indicates the Authentik base URL is missing from the credential
+	ErrBaseURLMissing = errors.New("authentik: base url missing")
+	// ErrClientType indicates the provided client is not the expected authentik client type
+	ErrClientType = errors.New("authentik: unexpected client type")
+	// ErrClientConfigInvalid indicates the Authentik client configuration is invalid
+	ErrClientConfigInvalid = errors.New("authentik: client config invalid")
+	// ErrCredentialEncode indicates the credential could not be serialized
+	ErrCredentialEncode = errors.New("authentik: credential encode failed")
+	// ErrCredentialDecode indicates the credential could not be deserialized
+	ErrCredentialDecode = errors.New("authentik: credential decode failed")
+	// ErrHealthCheckFailed indicates the health check request failed
+	ErrHealthCheckFailed = errors.New("authentik: health check failed")
+	// ErrDirectoryUsersFetchFailed indicates the users listing failed
+	ErrDirectoryUsersFetchFailed = errors.New("authentik: directory users fetch failed")
+	// ErrDirectoryGroupsFetchFailed indicates the groups listing failed
+	ErrDirectoryGroupsFetchFailed = errors.New("authentik: directory groups fetch failed")
+	// ErrDirectoryGroupMembersFetchFailed indicates the group members listing failed
+	ErrDirectoryGroupMembersFetchFailed = errors.New("authentik: directory group members fetch failed")
+	// ErrPayloadEncode indicates a provider payload could not be serialized
+	ErrPayloadEncode = errors.New("authentik: payload encode failed")
+	// ErrResultEncode indicates an operation result could not be serialized
+	ErrResultEncode = errors.New("authentik: result encode failed")
+)

internal/integrations/definitions/authentik/installation.go

@@ -0,0 +1,38 @@
+package authentik
+
+import (
+	"context"
+
+	"github.com/theopenlane/core/internal/integrations/types"
+	authentikSDK "goauthentik.io/api/v3"
+)
+
+// resolveInstallationMetadata derives Authentik instance metadata from the persisted credential
+func resolveInstallationMetadata(ctx context.Context, req types.InstallationRequest) (InstallationMetadata, bool, error) {
+	cred, err := resolveCredential(req.Credentials)
+	if err != nil {
+		return InstallationMetadata{}, false, ErrCredentialDecode
+	}
+
+	if cred.Token == "" || cred.BaseURL == "" {
+		return InstallationMetadata{}, false, nil
+	}
+
+	client, err := Client{}.Build(ctx, types.ClientBuildRequest{Credentials: req.Credentials})
+	if err != nil {
+		return InstallationMetadata{}, false, err
+	}
+
+	apiClient := client.(*authentikSDK.APIClient)
+
+	info, _, err := apiClient.AdminApi.AdminSystemRetrieve(ctx).Execute()
+	if err != nil {
+		return InstallationMetadata{}, false, ErrHealthCheckFailed
+	}
+
+	return InstallationMetadata{
+		Brand:   info.GetBrand(),
+		Host:    info.GetHttpHost(),
+		BaseURL: cred.BaseURL,
+	}, true, nil
+}

internal/integrations/definitions/authentik/mappings.go

@@ -0,0 +1,66 @@
+package authentik
+
+import (
+	"github.com/theopenlane/core/internal/ent/integrationgenerated"
+	"github.com/theopenlane/core/internal/integrations/providerkit"
+	"github.com/theopenlane/core/internal/integrations/types"
+)
+
+// mapExprDirectoryAccount is the CEL mapping expression for Authentik user payloads mapped to DirectoryAccount
+var mapExprDirectoryAccount = providerkit.CelMapExpr([]providerkit.CelMapEntry{
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountExternalID, Expr: `'pk' in payload ? string(payload.pk) : ""`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountCanonicalEmail, Expr: `'email' in payload && payload.email != null && payload.email != "" ? payload.email : ""`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountDisplayName, Expr: `'name' in payload && payload.name != null && payload.name != "" ? payload.name : ('username' in payload ? payload.username : "")`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountStatus, Expr: `dyn('is_active' in payload ? (payload.is_active ? "ACTIVE" : "INACTIVE") : "INACTIVE")`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountAccountType, Expr: `'type' in payload && payload.type != null ? payload.type : ""`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountAddedAt, Expr: `'date_joined' in payload && payload.date_joined != null ? payload.date_joined : null`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountLastSeenAt, Expr: `'last_login' in payload && payload.last_login != null ? payload.last_login : null`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountObservedAt, Expr: `'last_updated' in payload && payload.last_updated != null ? payload.last_updated : null`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountMetadata, Expr: `'attributes' in payload ? payload.attributes : {}`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryAccountProfile, Expr: "payload"},
+})
+
+// mapExprDirectoryGroup is the CEL mapping expression for Authentik group payloads mapped to DirectoryGroup
+var mapExprDirectoryGroup = providerkit.CelMapExpr([]providerkit.CelMapEntry{
+	{Key: integrationgenerated.IntegrationMappingDirectoryGroupExternalID, Expr: `'pk' in payload ? payload.pk : ""`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryGroupDisplayName, Expr: `'name' in payload && payload.name != null ? payload.name : ""`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryGroupClassification, Expr: `dyn('is_superuser' in payload && payload.is_superuser ? "ADMIN" : "TEAM")`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryGroupStatus, Expr: `dyn("ACTIVE")`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryGroupMetadata, Expr: `'attributes' in payload ? payload.attributes : {}`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryGroupProfile, Expr: "payload"},
+})
+
+// mapExprDirectoryMembership is the CEL mapping expression for Authentik membership payloads mapped to DirectoryMembership
+var mapExprDirectoryMembership = providerkit.CelMapExpr([]providerkit.CelMapEntry{
+	{Key: integrationgenerated.IntegrationMappingDirectoryMembershipDirectoryAccountID, Expr: `'pk' in payload ? string(payload.pk) : ""`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryMembershipDirectoryGroupID, Expr: `resource != "" ? resource : ""`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryMembershipRole, Expr: `dyn("MEMBER")`},
+	{Key: integrationgenerated.IntegrationMappingDirectoryMembershipMetadata, Expr: "payload"},
+})
+
+// authentikMappings returns the built-in Authentik ingest mappings
+func authentikMappings() []types.MappingRegistration {
+	return []types.MappingRegistration{
+		{
+			Schema: integrationgenerated.IntegrationMappingSchemaDirectoryAccount,
+			Spec: types.MappingOverride{
+				FilterExpr: "true",
+				MapExpr:    mapExprDirectoryAccount,
+			},
+		},
+		{
+			Schema: integrationgenerated.IntegrationMappingSchemaDirectoryGroup,
+			Spec: types.MappingOverride{
+				FilterExpr: "true",
+				MapExpr:    mapExprDirectoryGroup,
+			},
+		},
+		{
+			Schema: integrationgenerated.IntegrationMappingSchemaDirectoryMembership,
+			Spec: types.MappingOverride{
+				FilterExpr: "true",
+				MapExpr:    mapExprDirectoryMembership,
+			},
+		},
+	}
+}

internal/integrations/definitions/authentik/mappings_test.go

@@ -0,0 +1,26 @@
+package authentik
+
+import (
+	"testing"
+
+	"gotest.tools/v3/assert"
+
+	"github.com/theopenlane/core/internal/integrations/providerkit"
+)
+
+func TestMappingExpressionsValid(t *testing.T) {
+	for _, m := range authentikMappings() {
+		name := m.Schema
+		if m.Variant != "" {
+			name += "/" + m.Variant
+		}
+
+		t.Run(name+"/filter", func(t *testing.T) {
+			assert.NilError(t, providerkit.ValidateExpr(m.Spec.FilterExpr))
+		})
+
+		t.Run(name+"/map", func(t *testing.T) {
+			assert.NilError(t, providerkit.ValidateExpr(m.Spec.MapExpr))
+		})
+	}
+}