Skip to main content


The property mapping should return a value that is expected by the Provider/Source. Supported types are documented in the individual Provider/Source. Returning None is always accepted and would simply skip the mapping for which None was returned.

Available Functions

regex_match(value: Any, regex: str) -> bool

Check if value matches Regular Expression regex.


return regex_match(request.user.username, '.*admin.*')

regex_replace(value: Any, regex: str, repl: str) -> str

Replace anything matching regex within value with repl and return it.


user_email_local = regex_replace(, '(.+)@.+', '')

list_flatten(value: list[Any] | Any) -> Optional[Any]

Flatten a list by either returning its first element, None if the list is empty, or the passed in object if its not a list.


user = list_flatten(["foo"])
# user = "foo"

ak_is_group_member(user: User, **group_filters) -> bool

Check if user is member of a group matching **group_filters.


return ak_is_group_member(request.user, name="test_group")

ak_user_by(**filters) -> Optional[User]

Fetch a user matching **filters.

Returns "None" if no user was found, otherwise User


other_user = ak_user_by(username="other_user")

ak_user_has_authenticator(user: User, device_type: Optional[str] = None) -> bool (2021.9+)


Only available in property mappings with authentik 2022.9 and newer

Check if a user has any authenticator devices. Only fully validated devices are counted.

Optionally, you can filter a specific device type. The following options are valid:

  • totp
  • duo
  • static
  • webauthn


return ak_user_has_authenticator(request.user)

ak_create_event(action: str, **kwargs) -> None


Requires authentik 2022.9

Create a new event with the action set to action. Any additional key-word parameters will be saved in the event context. Additionally, context will be set to the context in which this function is called.

Before saving, any data-structure which are not representable in JSON are flattened, and credentials are removed.

The event is saved automatically


ak_create_event("my_custom_event", foo=request.user)

Comparing IP Addresses

To compare IP Addresses or check if an IP Address is within a given subnet, you can use the functions ip_address('') and ip_network(''). With these objects you can do arithmetic operations.

You can also check if an IP Address is within a subnet by writing the following:

ip_address('') in ip_network('')
# evaluates to True


  • ak_logger: structlog BoundLogger. See (structlog documentation)


    ak_logger.debug("This is a test message")
    ak_logger.warning("This will be logged with a warning level")"Passing structured data", request=request)
  • requests: requests Session object. See (request documentation)

  • user: The current user. This may be None if there is no contextual user. See (User)


return {
"custom_attribute": request.user.attributes.get("custom_attribute", "default"),
  • request: The current request. This may be None if there is no contextual request. See (Django documentation)
  • Other arbitrary arguments given by the provider, this is documented on the Provider/Source.