diff --git a/authentik/flows/tests/test_executor.py b/authentik/flows/tests/test_executor.py index 58026d1648a9..6b981d66f285 100644 --- a/authentik/flows/tests/test_executor.py +++ b/authentik/flows/tests/test_executor.py @@ -13,6 +13,7 @@ from authentik.core.tests.utils import create_test_flow, create_test_user from authentik.flows.markers import ReevaluateMarker, StageMarker from authentik.flows.models import ( + FlowAuthenticationRequirement, FlowDeniedAction, FlowDesignation, FlowStageBinding, @@ -177,6 +178,25 @@ def test_valid_flow_redirect(self): self.assertEqual(response.status_code, 302) self.assertEqual(response.url, "/unique-string") + @patch( + "authentik.flows.views.executor.to_stage_response", + TO_STAGE_RESPONSE_MOCK, + ) + def test_valid_flow_redirect_authenticated(self): + """Test valid flow with valid redirect destination, authenticated already""" + flow = create_test_flow() + flow.designation = FlowDesignation.AUTHENTICATION + flow.authentication = FlowAuthenticationRequirement.REQUIRE_UNAUTHENTICATED + flow.save() + self.client.force_login(create_test_user()) + + dest = "/unique-string" + url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}) + + response = self.client.get(url + f"?{QS_QUERY}={urlencode({NEXT_ARG_NAME: dest})}") + self.assertEqual(response.status_code, 302) + self.assertEqual(response.url, "/unique-string") + @patch( "authentik.flows.views.executor.to_stage_response", TO_STAGE_RESPONSE_MOCK, diff --git a/authentik/flows/views/executor.py b/authentik/flows/views/executor.py index f3366cc72c0a..aafcd40fadb6 100644 --- a/authentik/flows/views/executor.py +++ b/authentik/flows/views/executor.py @@ -184,6 +184,13 @@ def dispatch(self, request: HttpRequest, flow_slug: str) -> HttpResponse: try: self.plan = self._initiate_plan() except FlowNonApplicableException as exc: + # If we're this flow is for authentication and the user is already authenticated + # continue to the next URL + if ( + self.flow.designation == FlowDesignation.AUTHENTICATION + and self.request.user.is_authenticated + ): + return self._flow_done() self._logger.warning("f(exec): Flow not applicable to current user", exc=exc) return self.handle_invalid_flow(exc) except EmptyFlowException as exc: