stages/authenticator_webauthn: add MDS support

[BeryJu]

Details

Use FIDO Alliances' MDS database to allow restricting which WebAuthn devices may be used.

Also adds some slight QOL improvements like defaulting the webauthn device name to the MDS aaguid description

TODO:

• GH workflow to automate fetching the MDS database once a month (or every 2 weeks or so)
• Add tests for enrolling different device types

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated
• The documentation has been formatted (make website)

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	adeb8ea
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/660eae19a130790008a4a977
😎 Deploy Preview	https://deploy-preview-9114--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[netlify]

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	adeb8ea
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/660eae1931e795000807599e
😎 Deploy Preview	https://deploy-preview-9114--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-adeb8ea4c5165969cea8ebb615bf1b4f19a63b27
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-adeb8ea4c5165969cea8ebb615bf1b4f19a63b27-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-adeb8ea4c5165969cea8ebb615bf1b4f19a63b27

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-adeb8ea4c5165969cea8ebb615bf1b4f19a63b27-arm64

Afterwards, run the upgrade commands from the latest release notes.