LoginSign Up
← Back to all sparks
A

authentik

INFRA · APIS
Velocity5.0

Open-source identity provider and single sign-on platform

goauthentik.io ↗

Seven release candidates in eight days, and rc7 quietly carries the endpoint agent.

identity-providerrelease-candidatesenterprise-agentsoauth2endpoint-identityrelease-engineering
◆Current state
authentik is deep in the 2026.8.0 release-candidate train — seven RCs, six of them fired on a single day in early August and rc7 a week later. Most of the train is CI plumbing, docs, and cherry-picked fixes, but rc7 is an order of magnitude larger and lands substantive work: an Actors primitive in core, an enterprise Agent that requires a domain join and its own API scope, OAuth2 token exchange delegation, and a CAS source integration.
◆Where it's heading
Two threads run through the branch. The identity surface keeps broadening at the protocol edge — CAS sources, WS-Fed, token exchange delegation, GitGuardian — while the enterprise tier grows an endpoint story with Agents and Actors, pushing authentik past browser-mediated SSO toward machine and device identity. The heavy CI investment across the RCs (test job split into ten, attestation and metadata fixes, release-branch validation) reads as release engineering being hardened ahead of a major.
◆Prediction
2026.8.0 GA is the next step, and it is where the Agents and Actors work becomes a real story rather than a cherry-pick line. Expect the RC train to close out with fix-only candidates.

◆Recent moves

  1. 8d ago

    authentik 2026.8.0-rc7 lands Actors, enterprise Agents, and CAS sources

    By far the largest candidate in the train, and the one carrying the 2026.8 headline work: an Actors primitive in core with expiring tokens, an enterprise Agent gated on domain join, OAuth2 token exchange delegation, and a CAS source integration, alongside dozens of fixes. It is the endpoint-identity thread from the trajectory arriving in the branch — still behind an RC tag, so the directional moment is GA, not this build.

    View source ↗
  2. 15d ago

    Release 2026.8.0-rc6

    Two changes: a flaky throttling test in authenticator validation and a Sentry release CI permission. Pure release-engineering upkeep on the way to GA.

    View source ↗
  3. 15d ago

    Release 2026.8.0-rc5

    A single fix to image attestation in the release publish pipeline. Nothing user-visible; part of the CI hardening running through this train.

    View source ↗
  4. 15d ago

    Release 2026.8.0-rc4

    Docs sidebar ordering plus a release-metadata parsing fix. Another candidate spent entirely on publishing mechanics.

    View source ↗
  5. 15d ago

    Release 2026.8.0-rc3

    Outgoing sync discovery can now be deactivated, with the rest going to CI branch validation, release naming, and a loading-state icon fix. The one functional change is a narrow operator toggle.

    View source ↗
  6. 15d ago

    Release 2026.8.0-rc2

    The substantive candidate of the early batch: air-gapped maps merge, SCIM outgoing discovery reworked with pageSize, and a request body size limit. Air-gapped support and SCIM paging both matter to the self-hosted enterprise deployments this branch is aimed at.

    View source ↗