Policy on enrollment no longer working in `2024.4` resulting in `UserSourceConnection has no user.` about authentik HOT 3 CLOSED

The actual bug I can confirm, however this issue is only triggered by having execution logging enabled in the policy. Once that is disabled this error shouldn't happen anymore

from authentik.

Hey @BeryJu 👋

Thanks for the quick response. I totally forgot to mention that detail in my policy, but you're right, I have the logging enabled. I just disabled it and works like you said, so I'm totally fine with that workaround for the time being.

from authentik.

Hey @BeryJu 👋

Maybe you've already taken this into account in #9480, but I just tested that if I add another expression policy (e.g. custom-enrollment-group) with execution logging disabled, and bind the policy to the default-source-enrollment as well, I get both the policy message that user is not allowed to login (from the previous google-email-expression policy), but also again the error UserSourceConnection has no user. probably originating from the new policy.

google-email-expression (existing policy with execution logging disabled)

custom-enrollment-group (new policy with execution logging disabled)

Note: group app-user exists

default-source-enrollment

Response for [email protected] (allowed)

Response for [email protected] (not allowed)

TLDR; I still get the UserSourceConnection has no user. if the execution logging is disabled on new policies added to the enrollment.

• Tried removing the custom-enrollment-group and recreate it; didn't help
• Tried to down/up my stack; didn't help
• Tried Clear cache button on the policies; didn't help

If you have any ideas on why this still happens on newly added policies, please let me know.

Saw in #9480 an image tag ghcr.io/goauthentik/dev-server:gh-a80fe279e7011a58b32d77e51942d385555743d0, so tested it with the additional policy.

Response for [email protected] (allowed)

Response for [email protected] (not allowed)

It now shows flow_plan for some reason. Looking in the UI notification the following message is shown:

Traceback (most recent call last):\n  File \"custom-enrollment-group-v2\", line 6, in <module>\n  File \"custom-enrollment-group-v2\", line 4, in handler\nbuiltins.KeyError: 'flow_plan'"

So apparently now my second expression policy is broken due to the usage of request.context["flow_plan"] ?

from authentik.