Authentik App Initial Config Password

Apps and Virtualization
1

In TNS version 25.04.1, and Authentik app version 2025.6.3, there is no option for a bootstrap password setting field, and environmental fields are offered. I’ve set two environmental fields: AUTHENTIK_BOOTSTRAP_PASSWORD, and AUTHENTIK_DEFAULT_PASSWORD to my desired login password, but both fail, disallowing access to the server UI. How do I set the initial server UI password?

2

There is no default password; you set up the admin password at first login. To do that, you need to browse to http://ip:port/if/flow/initial-setup/, where ip:port represents the IP and port used by your Authentik installation.

3

Thanks for the reply. Now that URL for initial setup is not indicated as an option for first login in the “Application Info” or “Notes” tiles, and it should be. So whomever is setting up this app needs to do that as an initial link for setup. Sometimes it’s hard to state the obvious.

4

That would be good, to be sure, but users need to get accustomed to checking the docs for the software they’re installing–that’s where I got that URL.

5

Agreed on checking the Docs, which is what I did, but that link information didn’t come up on a quick look and I just didn’t feel like digging any deeper at that moment just to get initial access.

It’s always easy to just say dig into the Docs for the information you need and that’s true, but why not just state it in the install notes like all the others?

6

You can always PR the information yourself on the TrueNAS GitHub (GitHub - truenas/apps). With the community apps, there’s little to no documentation, so basically, if the person who provides the app doesn’t document this on top of doing the work for adding the app to the catalog, then the community or someone else has to step

7

Any idea how to tackle: “Flow does not apply to current user.” shown after hitting that initial-setup flow (server logs show: “event”: “f(exec): Flow not applicable to current user”, “exc”: “FlowNonApplicableException()”, “flow_slug”: “initial-setup”)?
Per Automated install | authentik one should be able to automate the akadmin credentials with the 3 variables set, but whether with or without them in the additional environment variables, for me the initial-setup returns the same error and the default flow of default-authentication-flow does not recognise akadmin user (it’s hanging on username input, not progressing further).
Going with I can't log in to authentik | authentik steps to reset the password for the akadmin user yields “CommandError: aborted” without any change to the UI accessibility in my instance…

8

Not to my knowledge. I uninstalled the application.

9

TLDR;

Secret nor db password shall not contain special chars e.g. !@#%^&*
Use

  • echo "$(openssl rand -base64 36 | tr -dc 'a-zA-Z0-9' | tr -d '\n')" for db password
  • echo "$(openssl rand -base64 60 | tr -dc 'a-zA-Z0-9' | tr -d '\n')" for secret

But this does not help

Details

I had a similar issue. I found this github issue with helpful information:

Seems like is does not like special chars in the secret key: Request has been Denied. Flow does not apply to current user. What am I missing!? · Issue #8127 · goauthentik/authentik · GitHub

Seems like the docs should be updated from this

to this

10

As a workaround use this to reset admin password: I can't log in to authentik | authentik

E.g. use web shell (System->Shell) and sudo -i to work as root.

# 1. Find compose file 
$ docker ps
# Get id of one random authentik container
$ docker inspect 3cb04306f22c | grep compose
>                "com.docker.compose.config-hash": >"7e16237e5f163a450a9b631e177dfccfbfe3d1ac3e0e9fe57f8a520349c43feb",
>                "com.docker.compose.container-number": "1",
>                "com.docker.compose.depends_on": >"permissions:service_completed_successfully:false,postgres:service_healthy:false",
>                "com.docker.compose.image": >"sha256:a3390134336c8649e95b5efc209b139022320c6c441191f53d557a1a8f0fffae",
>                "com.docker.compose.oneoff": "False",
>                "com.docker.compose.project": "rendered",
>                "com.docker.compose.project.config_files": "/mnt/.ix-apps/app_configs/authentik/>versions/1.1.3/templates/rendered/docker-compose.yaml",
>               "com.docker.compose.project.working_dir": "/mnt/.ix-apps/app_configs/authentik/>versions/1.1.3/templates/rendered",
>                "com.docker.compose.service": "authentik-server",
>                "com.docker.compose.version": "2.38.1",
# We need the rendered compose file 
cd /mnt/.ix-apps/app_configs/authentik/>versions/1.1.3/templates/rendered/docker-compose.yaml

# Run change password command. Note the changed name compared to authentic docs
docker compose exec authentik-server ak changepassword akadmin

You will get a prompt to enter a new password. This one can use to login to the admin panel via https page