# Post-migration — encourage WebAuthn / TOTP before disabling legacy IdP
version: 1
metadata:
  name: Ulti post-migration security
  labels:
    blueprints.goauthentik.io/instantiate: "true"
entries:
  - model: authentik_flows.flow
    id: ulti-post-migration-flow
    identifiers:
      slug: ulti-post-migration-security
    attrs:
      name: UltiSuite — Sécuriser votre compte
      title: Sécuriser votre compte UltiSuite
      designation: stage_configuration
      authentication: require_authenticated

  - model: authentik_stages_prompt.prompt
    id: ulti-post-mig-info
    identifiers:
      name: ulti-post-migration-info
    attrs:
      field_key: info
      label: Information
      type: static
      required: false
      initial_value: >
        Votre migration est en cours ou terminée. Enregistrez une clé de sécurité (WebAuthn)
        ou une application TOTP pour vous connecter sans dépendre de Google Workspace ou Microsoft 365.
      initial_value_expression: false
      placeholder_expression: false
      order: 0

  - model: authentik_stages_prompt.promptstage
    id: ulti-post-mig-prompt
    identifiers:
      name: ulti-post-migration-prompt
    attrs:
      fields:
        - !KeyOf ulti-post-mig-info

  - model: authentik_stages_authenticator_webauthn.authenticatorwebauthnstage
    id: ulti-post-mig-webauthn
    identifiers:
      name: ulti-post-migration-webauthn
    attrs:
      user_verification: preferred
      device_type_restrictions: no_restrictions

  - model: authentik_stages_authenticator_totp.authenticatortotpstage
    id: ulti-post-mig-totp
    identifiers:
      name: ulti-post-migration-totp

  - model: authentik_stages_user_login.userloginstage
    id: ulti-post-mig-done
    identifiers:
      name: ulti-post-migration-done

  - model: authentik_flows.flowstagebinding
    identifiers:
      target: !KeyOf ulti-post-migration-flow
      stage: !KeyOf ulti-post-mig-prompt
      order: 10

  - model: authentik_flows.flowstagebinding
    identifiers:
      target: !KeyOf ulti-post-migration-flow
      stage: !KeyOf ulti-post-mig-webauthn
      order: 20

  - model: authentik_flows.flowstagebinding
    identifiers:
      target: !KeyOf ulti-post-migration-flow
      stage: !KeyOf ulti-post-mig-totp
      order: 30

  - model: authentik_flows.flowstagebinding
    identifiers:
      target: !KeyOf ulti-post-migration-flow
      stage: !KeyOf ulti-post-mig-done
      order: 100