From bd92f9ab5075d38957c49f5919195fa475a6a7b1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 26 Nov 2024 14:10:50 +0100
Subject: [PATCH 1/7] core: Bump selenium from 4.26.1 to 4.27.0 (#12192)

Bumps [selenium](https://github.com/SeleniumHQ/Selenium) from 4.26.1 to 4.27.0.
- [Release notes](https://github.com/SeleniumHQ/Selenium/releases)
- [Commits](https://github.com/SeleniumHQ/Selenium/commits/selenium-4.27.0)

---
updated-dependencies:
- dependency-name: selenium
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 poetry.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index f0a71d66e594..543cd70cfdbe 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -4535,13 +4535,13 @@ django-query = ["django (>=3.2)"]
 
 [[package]]
 name = "selenium"
-version = "4.26.1"
+version = "4.27.0"
 description = "Official Python bindings for Selenium WebDriver"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "selenium-4.26.1-py3-none-any.whl", hash = "sha256:1db3f3a0cd5bb07624fa8a3905a6fdde1595a42185a0617077c361dc53d104fb"},
-    {file = "selenium-4.26.1.tar.gz", hash = "sha256:7640f3f08ae7f4e450f895678e8a10a55eb4e4ca18311ed675ecc4684b96b683"},
+    {file = "selenium-4.27.0-py3-none-any.whl", hash = "sha256:70ff70cc8d08f19bda0e89d6a521c0f1c3ae648088c34dcf9fa177f1374c3b5f"},
+    {file = "selenium-4.27.0.tar.gz", hash = "sha256:e8850834c482dc93d92060586139cf8ff8be6c6f0e93db640fa65358548f426b"},
 ]
 
 [package.dependencies]

From 48ddbc428371ef5ad37447d6b511a1b560652cc6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 26 Nov 2024 14:11:02 +0100
Subject: [PATCH 2/7] core: Bump msgraph-sdk from 1.12.0 to 1.13.0 (#12191)

Bumps [msgraph-sdk](https://github.com/microsoftgraph/msgraph-sdk-python) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/microsoftgraph/msgraph-sdk-python/releases)
- [Changelog](https://github.com/microsoftgraph/msgraph-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/microsoftgraph/msgraph-sdk-python/compare/v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: msgraph-sdk
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 poetry.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index 543cd70cfdbe..17ab3629e4a0 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -2962,13 +2962,13 @@ dev = ["bumpver", "isort", "mypy", "pylint", "pytest", "yapf"]
 
 [[package]]
 name = "msgraph-sdk"
-version = "1.12.0"
+version = "1.13.0"
 description = "The Microsoft Graph Python SDK"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "msgraph_sdk-1.12.0-py3-none-any.whl", hash = "sha256:ac298b546b240391b0e407379d039db32862a56d6fe15cf7c5f7e77631fc6771"},
-    {file = "msgraph_sdk-1.12.0.tar.gz", hash = "sha256:fbb5a8a9f6eed89b496f207eb35b6b4cfc7fefa75608aeef07477a3b2276d4fa"},
+    {file = "msgraph_sdk-1.13.0-py3-none-any.whl", hash = "sha256:7a170b46c287cfdd4edfe7ddfbce74c86e8c661901a61bec8cfa9190b72f79b3"},
+    {file = "msgraph_sdk-1.13.0.tar.gz", hash = "sha256:15ee4e812903c7fac5d828fe5f66f36ee42081b3a998ecd23b4a73c115683ce1"},
 ]
 
 [package.dependencies]

From 4444779fcbaabd1edd4e32a72f75af16c67655bd Mon Sep 17 00:00:00 2001
From: "authentik-automation[bot]"
 <135050075+authentik-automation[bot]@users.noreply.github.com>
Date: Tue, 26 Nov 2024 14:11:12 +0100
Subject: [PATCH 3/7] core, web: update translations (#12190)

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: rissson <18313093+rissson@users.noreply.github.com>
---
 locale/de/LC_MESSAGES/django.mo | Bin 82891 -> 83271 bytes
 locale/en/LC_MESSAGES/django.po |  22 +++++++++++-----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/locale/de/LC_MESSAGES/django.mo b/locale/de/LC_MESSAGES/django.mo
index 05e1d2e6590c608fff4efb88aa7247f594aba967..7e9dd76c2f5768dd5442d2d2366546496ea659da 100644
GIT binary patch
delta 16086
zcmZYF2Yim#|NrspMq;Z-%pf-^)rb&#L_~~)+PhX05)vaJgPJ#5n<{D)Rih|cd(XCN
z)&A1jtx>x4ORd`dz25gZ`TzU){jNt(p67hdxvuM6XI%H4)Uk;^ho|^>ek_z@j>B;|
zo8y$kheaIcOm@dPUP)2MDOlfePNE;i;Wc~@8%8?LG(3o<v0Vel>57AK2p-1{*eJ?z
zQgA*Ja&k6woNgF{wDUO2$#4y)M6~0C<J%aBQ!xTpVNU!R3*sH@jW01j#y4`D?wE=J
zcpNL>b@anLjg2Ky=ZD#H11!S*owj6rs7S&nOu^x}9;;zU6E$?4o~S3w#Flsm3t`=+
zj^mFlF)zlW9$+Bm!^s$jbFnA>jb*V@jN=sM{?0Hmy1@(#!j-5eIfNS8%QpTDb;A;|
z=7yC}PuLI(V|&zflCcbq!JN1Z!*C6%V;7OZaUP*(BAGhP%muzi4bgejjebR4;5jlF
zPWI-G!}L3`_!>??wVR6?fz?<F_o5G8Mqj*+J@8j7flc2s4;ud#<3EeQSOUc`poMv&
zN~oSTK#f2*d;^DLIb4R`5kj4J8MPK3Vgby?{HWd!H8R2279&s{_yD!oSGQ#RbCWql
zKsPvzHSr1N$I7kDoYqGM!D)tSHyd-{ZY+Rbp>A{vH4?WlA3jB`8Q<3Cx}$I;<t<pm
z#e(;=F^evi?j=((8QBod1Jqim(asEYM^uLru>hu{7UwvuirX+3{)TJ}=RRsz)o4$`
z46Kc7uruDoTIi|Qf#D&Oj=I1C)X*)*iMRuGgQ$*Xaiyc`r=XtfQ`Arv>BLsUYN%Zh
ziEm?boP(dCMx-ux*Mr1h7483yWOTs^SQr<gKW@b0cn~#bKcN=WGvuC*tBYBjolzt5
z4(bLes1A&<<%yV`@<*t}IUlvAwqYLa|L@7@glo3qj<<ps-PZ++Sj$<fpe|G&wJW+|
zd0c{8oQF`W|98}N@1d^q0*hhpt|nd<%W{7wjEuHjThyDZ7rul0u^t9>GgHtFYf}CI
z^~49U5S~MA$6v56{*CppDi>2c1$F(=SQ%%a9$-Ius*|}&rXm(%lUBn>tc_`?Cs~U{
za3gA}j-clHDr!o8MW)xei&`s9dzvR6hMLL==!XkXi~0-HR3Goj`0K(q2xthOVkr#b
z@x!n_mc#+5p_`2A=rU}IC-F@z9B1D74UmQHBw;-6!4ND>K@ZdnwQa|tMs8xf$MkRk
z0X@+=)ST_aAUue#<1MU(d3u>4j7D`h4c#~&GjJzX!m!?KRqT%H;5Vp|yn|Z2_faDf
z>q#(k)D<<S{ZNZ#7;0)Jpq_X)vR#~CumTq2>Kf{Xs3FckP0b`*{=}9yqPF)T%!z;6
z`bW0jle>@EW~EV2TpQik1<T+tEQ<@VH10#SyNV_7CHi2ozUI8rsPh`2rZOINo(DCR
zi*0<jDSMoYHt-mIX%LWP8U|uf%C)U+P^&lzwYrBPv*&EZMp%Q_r-pVIvJRb7m<ucQ
zGb2+IwdmeLHi#3CeRYMsWVC3?_ootv;SxNER5^VHm?u4h;gs)S1uQ+#bTkGdC?{Y!
zT#CHjor9=FRyf5h-U_Hi*bp_v!?B^BU?Ld}=~2`PzoDM=g*AVwSuCYdb6f@UU=vik
zHnu(<^HNSnjid)(!wKldxu~hxjymrmdJ2&FolF;eikhQ#gLpq<DmKOK$j)?Lq2{#5
zU^Ay9FhAu5sOx-=>cDo?bq=7~Uqe0dE6j;`)69APX^g+-qznPgRW0N{CyE~<a5JW3
zWqxeL<)|m?$X?S(bVr>(*p?@vI=TqE<8z#iT{6v=(>tgUh#6u&_LGM&{(7;b6VNK1
zhMJ1C=*DBH6Yij%q`*+KTSBoq<)+vYM_^Gridvl4(T%0vH7}q@EJ!)oIvk5rp6Vg<
z2ALJs6Sl!4EJWOQm|1MaQQIsUHBzytk!Xt=+AipaiKz32ViBBz>ey1$RP98yKa6@H
z&p9%B^82=d-*EFn3Bmy4)vU3oq3(gYa60P3Q!uZKS28xIypDO>i%(G<+CI{B=qN^0
zzJeVvXq5L&>Txp2_!IaHb;BLl3Qu4aEIHbI%(ld;lxLw9<w4X1^D%|t*c$8OSlod7
zaSsj}W8Mpu#+t?V9+n_J6$7>ZSCY|?euE|P7;1=qMeXNDSPYAgGf!R>^<>TPHSC63
z{r#=OZG19TC;l;p;7N?ar>K#v`yO(Crwy4v?1L3?9QMF<sG-jHzFE!XP$M)3b%8mk
zj;uv(yS=CfIEtn4HtIogj5mwX5A~o`QER6jdh`U*Wb_2>P&bH2-Czi+ei~}=EV8aa
zwcCN}zzNhM{t1II=LGvHh@q6bqdGVleQ^$|V~Zv*{<`pL0(voQM{Se+s0*LQYIp<H
z!6Fk)hsvWb<r=6Fi$HZK3DxmYs2j{iU4Mx!uS1Q@ZY+%#Co=wO@WfX5PBKIEI_ec$
z$y(dm2sI+D(2YH@40=!<Uy54Hn@}A(WaF1n_ql`GHP4V&gj2{f+05}2)QL+`Prem(
z!NazE!TLLDF}^@{l2dq!*&Va2=TRe2a;ka3R7H(k3oMV_Fb9rBAM{KhlZ(tWR1fE%
zhGsbi;Wwzoc>{H!SExmnf0~)o5LCG)YG~VIJ{*j?-e^>ZrlA(|GSqc;VqWg=93i6%
zoI_pUFU*IpO*cI)iJI#&)(Y0jn3H%-%#M+$^P^D@5QmyV4{{@CijB|3#+0{WPVN6^
zWZoo@?E~|9ABy=Y&qMWe1!~B*pgM8_^#VDEyc(Rl$ZR-+XPCwM9Nm;Fe`q?;26cWn
z?1>quj-EyR{^|ThMpMvWCclbfENW4WL-qVK)S}yfI`J#i2>poa=pR@CpQ47i>@2el
z>tF%OakvOmQB#?3wt0{W=y4OMOhz|sgSucE>claq8_lrsMHozZ4VJ?*SP&nfM$q>o
zQ(pzu(axyVo{75tbktO@$2ai!M~uG~*+T-Fvw%6~iL0S*+yMQs1s1}dsMR|d)qV)-
z{5hzR+KM{wYt$5-L`~UmsI_trtK$=_i<Raw{?TNT=9)QMi|X-ltc*XSdKxg#w2Q!}
zls$L|hs`%1R#6|DDVTu=i0{B^IC6p6W*bl)*@iuEFZyGkXQ6pfRJJz8!c@GCVVH{Q
z$YNVQi5lvc*b?7hVxuq<H6`1y30}go=>EifwQGc}C@(^F><?6XPtamBq>WHR7mHd0
z9Z^Hy8#VNqsG**OZu}fI_eW9fE?MuO+P}h*==Z5v3t<>YxdkeoWXc|AybUZxU2q@j
zf~QdX^g3$s1TQfcinaDZ#otFw(MnXuPhtRG!DjdurenROW(3xw-h8jHlJ<X&W#-eW
zDyjo<I2Z?`_U%oqi7&7?R$FeiV@p)I2kOa&qPF2|)OGft=J*6^@m<Gc{0#?S`_K3Q
z<NnT9WVHVuV_EzM%VF6S=0;6XPt*yuHu|G(FxJ-3vgKu{>ukmd+=Kn`DXz!Fm3+;^
z!mG^RfO37#{8xAJ#ANzWF=w?IB4-VsV3b>99n7}Y{K^!88kzan5c7OtzKXTLk15Z_
zNm%JizLelLY>d6unXh20P#t@T^|0=G#{XS1L+D-{-o?JyW&;ZmcVGy*Hku(0MGbkZ
zwHIn+Mq&`o#HzRvOXJU|smadMl))g>lr}^k?7E5ZS0IjnP8fzca6V?oPjDn7v=kRo
zF1^M44z~+OQ+|L{IcZzX4a#pbBN>BJiEqL#7`fg2)qEamL;`o1&;K|NnOOubU=;S>
zX@>j@)Ec;rIw8+4vxr)wALY*YHYQ^sJb=2<54K!+xB0tYG-|uOi#l%(s{Ja|;`Hny
zQ<Tg})R5f9ckm9*#uj_bi{=^@ryRDIcLBy?f82+<V8}jm!TOk+a$5|<ZkQK`;!u1K
z<MBCG<Ni*M{bmYgVhJkNpyvD_s$=(1bC>HYvpYgiH*ATT`#4+9MD31ASOgbi72Jy2
zez&m>{ukfC3SVm%cvx&?_|N&AA3@mf8}p=7Q03217x)%C;&E(=We=F`IS4hhW6&RG
zp&M7CM)WZ1-G2hPopTPuvBS5#)D)ONhK25YiRG~8K{IsYP(59Y74Q(o;9abUwGNq)
z>1`d4dIPS)0=N}5qTgD7!ZgayP-|k~VLGH6P9dW?TZavC2R6WGSP<(TG2dj~!e*2^
zVIy3EIq+xHRQ!gz@GI1f1CN@yuZdGAM`IH_fz#3dI|ihIi|zHD`E%LzV>~StF~`jt
z>Ne_0BTty2?T6~nXw;C;Ky_p(HpW}%iy<e?i!2<IDUZS0_&cgyxl`tk*GZ=s|6T-s
zBJc)ApEj@1eyG)+j;nDxYVp)MW1e&{YOzhgk8u&cjy3;d7H2oqT1deZ9EY3nFU*fC
z&Kfs+$V3zP8a0GD&Y24rN3H(KsE)*-wo^Rn2}fZEd>?b-MfAh#SP&mzUd-{m`B*QA
z*(sMoO?eqqhdoWm<RQ}!bwZ|XFxJLbU_Rm-tb48BVKDLY*a2T*4Q&5|`QkDe)zKZO
z^Y^2k{5WcjTtYhPasDRbCXnmA8M-%dDCG!z7q_71uF?f#AB>{>De6Mk(2XxqHz<A4
zEV58+N;wU4<4)9r9zb>UBv#ah%yG%A>ME#JKirmgVGGJRE}J#c7Ryuaia|IA3*Zve
zh1X*|?!vlQ@`@SJ&RB$UZ|iWZPI)GJfB!#ZE3RNIDjuM2RPn0$!(>~mKzRk0!IM}S
z?_m<Ue>7iUCZpopaWejb{c!M4=GX8m7)3evH699^qbGn&YclF#0_sUdpw_|!)FPRM
zVYnSNLbp-dF8I2cl71LMc{wh^lc*8sf5Ytil~|i{_)YUh?1zIW54y?t>&Dj!_~R4Q
zD$e(_S;eI>igIO)#6hSVtw+5VE@3G8-ZJM`Lp@N8EqAx&L0Faec+`~bu=R&;dCUoy
z2^6Q|9=b8lZ8Ovru^i==SRMysS)6Cxg*xvl`r_Z{##g9zLBE(Ut<e}nISxzW7%YvS
zcx+&g4P3;WR6If5(D~Ig3`SkB32LO0up5rV4R`??<K*AW$MQ)`qg?lQvv|M6!j!k6
zM*KKtpywu;(PX;(VLtcIV^7Mp?wCKH&BgJQ+y80akQY&F!1Z4<qzzF|lz}lg6V>sH
zn27(NZk%}6d?t**YLw@qcmID!MkijzN?7im8M3xmlyWL+PA8%+v<QpgCe*$@hOgoG
zSP*Za7Vl%sgW3Kv_4zTFaw)8Ujj^Ei|3ESY2#iKO>2%bb``<U84YjZb<pr3IPp}jY
zcwpvq3g)N026dess16)PP1#v|9Uo&p418$TN(C&){hi8Wv^b(L7slZnOvc&x4=%yk
zk62h({jq6R?Qb(O5vY-Ai&~6*aVU<(S@;ys;j||#T#SEeI`kAh>QU)uW=JcdI?@>3
zn1FhM@u(;G+}58!O~Ieo41J%Qe=*Sp{V5;A7WfnD{LmL>t+d8K%HyyoE`GuIze#2r
zfogaSn_$38)37V*$%bH4oQ6Jl7B#mQQM=`5)ZE`et?rko8w4<18j(=cjhkX2?1h@5
z%vX%R=6WoF^0)#uBF8WQFIfM?l9aRkV+=ywC<1k(_L$&e>!B9&X~*SU!D23#_l5Qd
zb>p1bT;2yMfn6xad&q>7*@YUqJE$8w*<H?9D2%mm9%^JxVROZExV%FjXI*1`h@Gg9
z^l>@YaSk%g&QM>M6OV&)y1XNH7E4g}TqdI@dyHCq{<&P<xh{zsiH2AaTcL(<IO@c?
zsE%$#b^H)&L@uFr!(XV~@DFN@6v*xJZo4knk@8q%<UG!KGU~ux)FR85$L0MyemJI4
zPDL%E8#n-c_`eOhaT;oEOtj@sP;<Ho)qWr9de>18;+xOqU2FcRcJ<Nw|Nonj(Gzq)
z%~29+(Tu>-ILFp+LEZ3(E&qt>$bD<h{4Vboi;`HAcstZun2dGs3~JHlEnx0f1Pgfx
zgxElR)D7CAde|2=l<C+O$D)SxEb5JS1J&+6M&c_}hw8s(Y=?UCzNqVD*z!2kqMv~t
zt@_Qj;v(u5c^kDB@)tBcE@CZX4MlaJ7OH&=>Xn*e<MU7>x(d~y-Kdd0jed9&^`MUm
zx;)MYWb*o%#kBynh_;~`oIu^^ru6~p!r2SCyf2`l_z~qQ*clIEcP!;^t}`6nlxN!V
zCag#KDC#}p6X0=qKezJ+m>w2F4OMy6;;Dvu!Y-)Q@3Hj@ZFx0n3J#(c-5Jz*4^cy3
zys)`mFe+Xhb-lN3e2j;TF7N^B0t-+L_o6Ov19RYA^u>qP=hkfeD<ZuCb7OY&L(Oer
z)OG5h7F|!&eUef4$;5W(nNLO+_yeor100RPMP1%k>I&4{Z9{F-qo|JDMm@=&xCR4?
zxt#5|AER+-aZ|qw)q(4%&x|`b2z^Sp^c$DQ8A2w5z+zMn{R7P#E(j}8?uY8YeAISa
zi>2^8RQq31BlQp?&{fjq{az4>H7LiTcFkx!gwrtuJCxEQXa9M~R3tD7Lvaggm0q_#
zKz+FQls1d82x>nEqqbcfYUn>j4f%4cf=5t8{S<lAIVFS4h*U?l>xSXl|6|CgN1IR`
zxr*vQZnrTIH3F4T+bIgQCOV=n)D^XjJ*W{`ff|vGsBO6qHO0T6zA@cJb^IxM>XWHm
z#%!A*s0*FNAT>Y@Y4NgVDmtOw<?mwy7vJ-dx3*K@b@NUyR^Du{6#S8PYp@kg4mR8E
z0&4C2h>G6|X8&tHSAWAiS**1OYX7I97Ud*tg1fN=x+<8CwZegvr=s4FPf;WI)|)Qx
zU&n@`rt}Ps#aB2S$Ap;AnCBrLGgoygnm1lQ)Lf;bJ_DxO@(R@I-HT=L2h=uuf|`<&
zp{B#(sB(-gcSkMSG<4%k)Z*QQ8sXC(8@Oi!1uB^fg`wVrjj<heL(TO%)S^0zS~HJP
zQ&uL-to9gG2S%aR!Ypi$i*Y&L$3&c4**vi41sSbopDHfzFOLmSi!BwW;5gL2&mV5u
zg`l1w0ktc}q3UO&Mq~rl!gHu6&sWvFvMZt%VFR3uF*r^8{|uSx1bS984Q8XBY$0kc
z51~E-?xWU9w(4etil90WirOvpQT44+Pu?5#6)P2I;1RrnU1~5DEZQ11wHDZaoocz9
zg#^x^K8yy|ae05Oet`vuC)PDXm{HFxq9dq9)I7rF#Nk2giox|=&bK($+BDMag1l^%
z2E>2I1PqBXQ!oQtaDV3!nfVyq(0t>$j1wuhigtPbrSlJ{5vtqBW&WQKs=OGrNYA3?
z{7+k-t+C7d>v=fpLn{-t*k+>E%0|?bokx!knTKRFSI<z3tauaif{DcJlp7%f;cO#q
zB(d$Cxv1l|!F$1bHm~9ThqQ-OIvan=BhAqTI5KcJ<==1`_xJwUO}%7#97fvPb2a2O
z?LGAF)-lAEkKwnZI$UHB@kKW7CeNGN;k%3X-wu6)XKABjG<iOkya%rk$3?nE@_zsO
zl13{i)Ub`U_y$m3VcL6t{=v@<#B`iQebV{iCAG8XsqO^j7o-U`c82^E(m3iqKph)w
z-6`_*JQPyBVe@0O&F@8R6CI~$qm^BSr1hdhpN#)L-r?fqNDm3Je7tYP_2i>TEHCFX
zT!UH1yJSA5?CENI^MO?js{Je9jYdoUbt12B?~#OMNHuNSQusRMMBGUF!p7I*4dTsg
zc{BMu<adz<W#f775je;tw~+XxbXt*gyhVc}YDhT+c~g6j7;H%H2V0&--M6Go#6BT*
z7K2c)>;0rt<QwBm{GQ}p$uNU+yyKaZ;9}BJZ@~Nls;W+u-zCl$BIhvqL!_Og_b5-o
z*{I_IsVwDQq#`7}Y;=4=dY`h3bea5o)Q8$4)sfe6Uh_Yf3l+y(=!*~Sg|(-3@P7F}
zM^1Zztcs4bIc*D%a5?o)h`CXpBP&raslWf%wLE&0JtMs&Mcc|48rP$&V-vB%B)v*?
z=yQ7#=`B(;?Xr^wQ$H2U5X(AJi1FFvv>@p?fEl#;!j|=6R9^Ex$6NjXe_SKGm4-Uz
z(fFA?VFGR-_8Mu2jeSJ^Iq6;6Hy|w|ZK3XGV(*Z$jyG+l9rc~Ff|#4{AI>F$Ejg(_
zffM8%(mc{HWE<f{>K@x0_E)_<a*(f1inn!xiSM_0HF=M^_pmW0<3(&ks;Nqj-n5;f
z`Oi8|6W~qjWFvJaWl*8lazD~}+h`kc9e-j3P9XhG(zl=C#KvG1t~n2N{7fvA^bN6W
z_Fe;smmpt=<l$4*d$i|g2Ld13^6TVp5bKCZq=}^Nq+f|`Mjg*>+dcRbDTH`m(tk{~
z(}!3t%KYZ;Jr<DPLh3_FUus%w{+rp#iUhh)IUU_LmX1Ry>qwyPFgC%F*qhXlypCf^
z<cHbvWc;0TSKG4M{6o2_E#FbVdocgw?9H-53(5ROYCyV3x<qP5`u7n_VX+N##LHZx
zE}pbEXoXwtb$by1it?Mbt`Bafu03fO_xBzP__?0I1>_r<_c&>AR#X0ujm_lbZp2%Y
zu8=+_-hg!7)*m6p_ZIJO!8^#;AU~FK_!j3qp767u?Z`4>o&x+hLtqFM0pwfa4$AM7
zk3=6*II+2?qo={StMkYYB>o-w?f4btF!JX}Sw|(}Ur;DYY#jM9q))Rdz3*QNKahIa
z;87a*k^e5M%!!+b@iozjz^lZEppJd^M)%2=BgQu~@6ir_C9SjNVz&LqIG7YfN+-3<
zre)6&PN6cXGbb!3ttHK(tm8HO7B>(phfQ%MDVX?D%7Nr{Ji@}nw$6@^@b_er>tSnt
zqV_w=11Z-g#Z%5}>w?MOBDJT!JYK-&sG}lz9ePQ`VJ%Vzl8y=_U#_v1x-Rxwiti@h
zQ{Ss}Od(As@Yq{2Ki0x=d%`I4CrEcmy@;LTVmWXYslL5ARnCVtKOX-}U1O4tRR(7t
zcB3vo-Xx{zz4{f6RuSB38>?*(%1cN!iS@*Mq`z$aZ1OtBlbU*S=Enl+D^OS4)+^eG
z*ncq}J|OKSy-#^HDX-e;`M)83O~r>e3aevND*wh%l8zdroTT0Vy7*_b?Ml*7pVXVW
z1e~P+$6p2~oHm_EV@NxR@yn+(g0@j4@A!`-^9D&r7-=)fpYjnJrYXn~L>fyPMLaiY
zv~9neSY7g|q$u)V+xT_zk)*1mJ;Z**eq3(`sXQr^*tD#D6+`81f;#k@Le^27*ku}K
z#}@>flRt`2N#{s!lk$;j5id-e56BlJ?WNp;REG45vW_+6vyT6epHKU-n*X8{zNRJ_
zZxYNp;>fqPCoLiPB`MaH@7Q*Ah?OPjI6z%4llA^?zLYi_ZM$R~YR@f+2T99l>!b0%
zLgfY0Rol2Al_BIaNef9+X_MVvSgfPI1=jvoEQ$Qbw)_tDhitwL=f6(A1SvOZ4QUXu
ztizLNb3OzEIdNiE4Sr8q$8>wb9LnEQK4{Ayp)ciXq;;fywtWurS;rr=IZb>U=}&^6
zVk)r|@=vw@_Y+947mUSH_RPvSiSkTbNjgvdbJ}Jd${w=k`QzIJUg1aB8gr5AlRl$d
z3&)dIk(!fqyyexq{uyE$JZ|coNXh}agFR+r809z{YeRV`Z8EVhrrUOJlOIO<fp+~-
z$8qxcNoOf9wC5}SCgq79ew45cM_T8rmZJcTJK<vd9Cs<m;rFkLq>*1l`jT^hwC5*U
zM_Ak9eNshIeo`UQr;=+0|3YRu7bu824v^w0_r;gQ29S61%x+uXfAiIdY*ll`r>751
zO-l&d{C!HlzzBDI!ocK|<n)ZR_>9!FbazIodr(^HkmQ6!cf30-F+M#t#oZ@0&7C}O
zP+}T|_>AO~zEowVC#G$#IpzDp<=g|}d-qRwQ#~*_Jw2KBT%$LqW+b{t3`|W(958CL
z?~>R;Wg8`>ai8S)6nE$3-bn-FQ&QX!y@!U^sU05Gci_8W35k)L-`SK}KX1Cbjp<`X
z*yaOw1Il)2`0p+zrnuuX`_QF?#I%%9cVco1k(jj1lmvHt%J9s-iM<jDXAX3ya}#&`
zfOIu+M<=FaW(-eE<J@#_qwQz?Tw#GV{$IRLV$y&NcS3R^P16#4CuJn}%}nVVn)L+k
V;hAopKO=F#fW(w-m0ZV){14DD&J+Lu

delta 15752
zcmZwOcX$=W+s5%Zgb*MQNJ0`qO9&+NlF)naz4u;}UP4zmAiW7BAiW9-NJm5vK{`kg
zK|n#O(nJvH{8V_q_nE=VKi<8r$>(`yXLo03X7`*#JUY$)#AJW()sU3)4BL+>jLC*S
zhZ}Rk&zL2JRBOz!^2VIT<JcJ&R4`^dzQP$ex}q^TFl{Ac+G0K&h7+(k{)PRqab;r&
z%|2|0Z;*Cg)2@m!oWq>Ocnq#;OjfLhT+?*I09=9@aW!_s9he>?s~OWC^I#^NfO&Bt
z2IB$e52)jByZi-)bA6Mhx-tIjh{nnohokTvEQU9cK{4Sq?41?D2IQ+T1RrB4`qwlj
z5F=4H5R2)s3U<bZ*bz5l3<lLQCXDNwcmiFZ7Di!5)SZk$4Q;Zk--f#2S=0q@q3-Y%
zhGAfBd!C$_le{zrU|TGVT~QsIgWSB?h~CKre-h{fBkR~9nuWU13e*X<BZFYRLZ;oA
zy2fOHil}xCQ61`n*>NcPV=|_~h1daCU>1Chy3xpbjDHeAnR>=##*?T!x`pcL3)BdN
z)@Ob(0drwn^o<bexMb8?*nmN}+wDJ&y0NR+1fQZhP?Pz~hFuzH{t3oVp$kmGlDGxa
z;~fmdXUNSPPea?T9;PHuL|t$M>OzxIBe4|I;Z|goo4u&>mS|+m``8!5J;vPg5>%!_
z-RlKakO#qhh8m&=sG&~Z)OIL429X!QVptXvus^28mB@o()}x-P2Ur3NHe)?tS8Rog
zu@rir5X2D_;9=DXnxclb9cpb1!~}eaTBHS9*!@*ech(9ul&3K*-bantb8LetS{gGC
z+oMM0F=}MrU{O8)>FJIxSP{dp8HQpnjKtBXIh&7KOxuuin_Z~InW42EkqFcU;!qtZ
z=JHDDM_wPbI2)tZRDVpX=YJ-F4p`uJtoH3N<{;{Xr=6FbcTp#LhI%SOxy@K?jar;z
zP^*6x>bz@F=lL8n<9=6v31hgvxlN!qQ<}E+O_l{akq^gmco8)Pq3!G<s)<?yqcH?$
zpw`H8EQ_159RB9&<9I#l{3Wpn)<WIDaP$@@m`6|mzr|ws97|(<9$MW=Hw?#KsHqx@
zn(KL}DOrI`r}-4s(buRuj_+uvvLXhPH$^S#?x?Ar(2?=ii5F3!A>4}D@gf$+XP6Ch
zGaMSaDyWXO#hN$?^WiDXi!YG%Y@$2!Y~v8jj~7rk<e^fJZCTXFRqEokJ#0#a?x-hf
z&IVx=j>g=$6ieX&)DZp;)#3bIxfnLaAvg#N;ce`JnY!5yjzW#(YSiLgj~Wr<?QZ8T
z1U08I=o>oJ)Ko;>aU$}#nB}NDJ%bwRSE#3@AXn4WR7T}3T;2=yc#lCnEo<EVjc&hp
zKS3lrE}-uC5k_Oip7ui|9%IOxVGbOIYBvwF;12Z1GZ>8*Feko1O=aXe_PA20scea=
zPqew$%yAW)Fcmva+8yQ`Mvy;prheD1;%L<Bjz?zC^uucS05!Dnyhd4nW-_M6Td0wF
zh+1@hz3mr}NPI_U7)qc;a|P>Rd>>Xcjz+3Xj=uIzr(!($YRrolP<QkO%VV~F_W5sv
zjmSr%7TGD(;=PVqgs(6iCiG`P>kcXrXh_GQ4p@nLUO#spM%}>$OpEtj{d3eJ3K(D)
zZ6s<0V=)63#Aqy!nvxEv^LjA|XQQ_@!EyrK$xEz-VFT^s)d6_|&1%$~`3<sjnG@5K
zS4N$vAqHXx)OmWL+D}5=>1qtXt*GO6p{C;KAjV&FbcKq+cpKltHYAC79=Bp065ZKf
zsF6r9#GW7ml@~&Fv?{j8m6(jLk(Z}Q8fr)20j43(Fw9O#<S@oxt2%)SO+gck#zCkd
zOG4er=cuRTEEdP#u>s~BZWrkQ)S{e>(RdK^<FBY8&oII*UetNwF%Q=Bx**XtSd3Z&
z8&HdEAL{YCiyEnisF8Sq8rs(wjDaKVaoI7PyeLLsE!2>ALbdOQx}j018}}}74R&HE
z6^Ahs{^Wd!zQ<;iJ#i%J#6>aCV@z$VOWvG$`x=*{I@IBP+o1timHY#2j)$=bW*P0f
zp4ZeR&;>hULrlb?cmS*86HLI;W9*{rgF4|hjK^nK0rN1GTd)W2!SJ#6eQ*x7`0|aj
zk8wO^C9jXE_58m}kd2B#s3H0gbKzpljQdbS`XlPj{=f|A`M|FJU}rR{z6ffKR6?zR
zAy^rgqek+&^Eqba`X=3Y`;O0x9mt!bF1QWb<8jmo#Z9m$D2M7u6VzkZ4Rr$pFgwmb
z-N<^3#+|6O^CN2Q+(32oE_(I+z9i5E0w&rEWJ5JbKrNoC&c^7QDpUs&QLA_&#^FXR
zgg;<GOfkuJun6kH<xm}~iaKwjNsPbdrUMmvOnRVBJPeEB6jTTIpgME{Q{iPSfHzSc
z3Yu&?o(pw>GN=pGba`{s$aKLRsNZ_Df7xWlUpqEXp&|Mf^@=^`yz0D%>cCTs#*|a+
z`ym$9@mi>-r!}fWeO>)H)P<5zPt6J(j$fkhG4)Qh2i8K}c{|hz`?-9Kb2e%*uEO{6
zE3A&Cr`bCnjgjQZs1e(UvA73Q;!X6&JD3_DpgQJ#PM{%4Io-YibD<uOYN!)+LM^WT
z7>LtdJ|8u5pQDESEb4^UP^<g_>JI&8*z;t;K=OR3^OZo3_nM{z>8Kcp>gj0I9Dm@P
z>YR-M)XzshT#o9%$EX|Fk7@Bb>O%Kj{R`Ach0nCdx5Iqo-LSWw|Ct2osd$OH<5VBo
zp$<cJq%dZ|63C-(8Y81`&Y~7+`&o8P%tm!!D{89tU`ITU>S*!V_A{d?Y6@0h89o2&
z2y)^tsGj@Jv5PGjbzn|Rhm}wrt&e%JEoz9zV;nBRAl#2j@C<4y`z6^MnTpZmvr*UE
zie8=Y9DxqJfx6HmRQ*4w69*>SH(~;2ByWit!go;n=b$?JC2EylKwaP=YOXWRweN{S
z7)9O!HDyERGXA>bxm4)FD=-*0VhHX-t%<X!11_RY@Emnq_&j@D3~Gvspr))YYOOTE
z;@Aeu;)hrjk7G2Z`-t&Zj|+WdKb2}=9`d26hD-4kUdJPNX}<lCTDibZ!6Q6KedI#B
z7OtQkv*1OxBN5nvJO_s2`<Mx5JJ)y#!l>Adh4Bm)!8a~1ve*uFM{Gd-6s(LFFc(HJ
z(KWCf#^5+?jjORC{)5G^{!-h1ENVnoqek4jjzDw$1#0LIp@#kfYN+pFG^SZ*=RQBG
zT{&k1RQpbt4F_X(oP}9&qpLse^4l&?vD|k)uZbei35%kh)2gV&GZ}TFb<U%%{uZjk
z0W0iKhG8A@{FsPCP<MV8H5H{++7G1)&OWF`yb$&M)2t`Z^O|jy`x_1FRoWLb;3SuS
zgu0_GsK@Ul>O{{_bDQd8yXdlDFY*}di!-nUzCu0sMONFXDvi0gzG+9G3wcqCV-{*n
ztVUg6x7&Zh<(E+>`W?&TGwg#2YxvzCm*Hb<_=){nPnA!33Ow8~_NM;yT025z)^W{k
zR7@c#gXPxSUyX+1AoB0A3Re5fe)XD&EO2uYr(n+w{Gkf}!0Nboqy5Tt9o4atn>Z&X
z;t1S~oiQ)Hd<Um)X8dat{7FTAEW5=HaSzlKjB_qVjm!>=!f!DFf5RM@eXBjLJmw^C
zjhfO?s5Ox6@`b4O+b|`5zm@U#Be+0CABN}>@?@Es+wJdaH*pMk*3UTz7ojfDV22&b
z0XUuf66&$*`Gx)K_&(H#RNHAk@26lAx%tvQzR9Q&|G`U;iy&y1Js<%C$cJMvda(`8
z!4SNUy3lKvx7uwNS8vqgw*qzC*Qoa2p%&*&)Qj#pYD9v*vVUXpW+F(YVhA?C)O+mE
zx5T031F;X@MxC(f*Y<=xFb(-g%!=bN5SQa{{0zHbuD$jJG!ZkC@4_s27MXIdc|f3^
zW!`6pwkXDsH$`1=C~EGfxO^#wk#E6pJc32>3TotnzOh3aj(Nx%V=Eki`|%7$VG>EC
zp8stGsyK-{!SC1tpQ1*j?g9IFE<g?KTGWv4#%Mf^8qz;dA3o2J)0)3A9^XG`KP5LI
z>(!h`P5GoljGP*-Cs0q1U|xKPwJ_qa{g&GabCOSYZp8HD-(e75K@I8e&Hz5C29w8N
zHk^mL;5O8hUBD`M9lezZVvgDuO;=1yo``jD3|7Nqm=e<+vr`d_I&mE8!qrf7-w~%_
zZ>)jOa3+>J&X*StAG_FtJk1GSQaIoQ1EskMI%)5;Cu(SuFe83~8uFc}jvUA8nEsR<
z>ZaI`ybbokwOATMPTO|%a2WY)?1};3*^%yzsmYVRWBelt7E`efcVHRpbjIH4Leyg0
zgbVQy=EjcS+r>E^)!~n@Kd#5^7<txC(JAL;tV;bo)M74p&Yri5mq4q(6{;fxP><78
zOoeN(Ic~rJ^!#8)Bn@UH&x#uQf|w3VqaW5l&3PSEhx?(XHVM^!soU>e=XRVzo#033
zE$3s5qy7yx$GG$Mh4UU3Cf|zc=ylZbcQ8FZMXiw(7i>qPFq*t5hF}vMt_P(%!3ZjT
zM$KJ|i`EaZGWk)|iBkV)PY{c`Kuy#lYmPN>5vIW#s5`xnCGa^Gz=A*7Mco>;=vVo2
z=Km%^eKojb7sW`7CI0}Ua4iPmG1Q4KVi&xLWwH8YJEUF=C!g+Ig~iEtVHiGi^(lY0
ze@o7av0UFYBWQ*rF)yCNocJ7zVCF0QkpgRDA>4|pzlKvW!&UoXv=9rDr@UrIE*|yR
z4#rG49M!=Ys2lkhy;=;L2((CcqvrG)R>Gj`_OWY-rOA^pKc2uP_#8C?$v5nCe;U=U
z%}x78Ou~WW3s4tM^NW32qA{4f_%F=AR&h-#Dq}0Ghzn2`x`>*)6u;U#D~zG!?NE0#
zz~vKMz5o-b--w#B>u&!aZol6x`;=wIX!a-E^4g(pMnx_vhGHx(#2DP?yor(I{<rOF
zkHTp3I8?h@m>qj#6i&fxxE6EZVVD2va?c(6I7fR4biur+h7D0C?1#G3+1L(O;}$e`
z?VD{Y_91<agR$#9yLiu|7TZ<SkUzyC82Fq0A~O~{k-x!?=<Rgh{<&-~PNd?!-|Z{X
z^T4iwe5fJqg}S39SPOTdI_`OB-|2Z!7oLe(@MA27dr?#T7<HWAA9fMfLq^PNMiNA@
zV?Jt5H)CczglX^!X23hB6TQGdO#R5N;!LRhQ5c6sFfX>mjOfK6oQ=A{<*2ES{ZpR_
z%zqt%4peNwL`?hG&gB@?TrR=%xCeEjZ&4li2{l!>FgK=tV&8y;Fco=OR0pb{&eIfA
z<6xYJ?_o06H^EQ&-iB-NHP(D)8`gMkN2DQYXuF{n;Yb{g$(V$JFZd#f%Wys>zO)?*
zd}TXS6g8q1P#tNB(Krmfx`X)yx`W-W!8OzYZ?Fz#{-6C95nVBq{0i!g`6uf5ihtQP
z(gm}U&&3Gbg8A?m7Q@F_1LOX-?fU-B`0LK5P*D??p+DZjw0Iu_@HuKIUt>6C_{Ux#
z4kO7cVpeR8AvgpzMUzo;os6-#6Vu@p)LQ%PAI4w78!ED4CdOaJqb}4CbtgTryN5qc
zp;qzDH+*1We&g}I$pSnc--RPlH&PH=V<N`mNz}-_MqMu?g~#`|q&!}NQdF!%4b2U#
zi+TJ!zM&uN+~Z7@(&PJ2t&Q;p?LI|j$xQY4_&$`zr}Fql>=tIB{sHQSQU`c^i!T;6
z)rC<b;cZ4xfS@yK2xp)UT#M@IK~&FwM2*PrsHed%wa51~1f$kSH0rVIjV&-4HFEb*
z9q^>F7tVnd$gAOCJ^$kfw1}Q!UyMj=FFXOYHWs>kGipu`q1vB8-N_Twon+>}Mrg6c
zqS`e=t)X_P8|aBz8>3KbW+vv)^Z%)9a0GS1OD=ze8iADQtdUrPyfBu;?x?k}7|Y-<
zs0(IKZ!ee^b;0s3Z-hF3H&h2lVtTG`CK5EkWYi1h7V3@m6xA?gkjM9_m=V>XM$Yc2
zJ0FRfl1VO~i(2(7QLFy2tG|zWL%u}4h@vuhj8{F*OCXCmE22732X#Oj)ZC7B_3KbW
zx(n5zQ>Z(=iNW{`b*BLtJ?2Bqj#^tAP;2NIYX7y29<T30&#2G^{e$g^!%#1vd^i`Y
zVtc%ZIzjOekM9ju50&@DayTCK{@919@Gz=lCs8AG4Yg(-pl&QA)N6ZICe$`)f$C{D
z)X;lTi)}jUz)h$jKZiQubyxoob;8h0w!SRt_}ZxBo1=~&jyiq`ro?q#0`+v0bBA*e
z>dki${qO{8PQOE)=m~1dGKbj<<w9Mk2sXv0sN>gQ0&c`Hcpdd7?Zm%6(#UuR66pCH
zkLt(@)SY~a>+v-1#E}sm-)}JSneF}|s17VfP1Pqj5cgpoEE?(Yeer0G8i`X_7k|P+
zm^+KF1N{A;AO{saFgs2_9k2>DRGY9oeuZi9CF(Iuk<~serSS-PEzFNW+3e~rg9XT|
zVnOVWTAYiW8!@Av|9u2nd}mP4@pY_-S+d)qZ-W~04p<aFKn?YF)En*sYQ!F*+J)t?
z@BFf;4)sNKWIn0`2c73JM9=>n0zF3mLoJF7QT9ZcP|t4})QEIKjYuEV<2V8}$171I
zvkukq?WkAmW7JbqG}@kLCPryLYDCYWS96gur+tT4#7cb1O+ntq=2(n<m!HjLAFsT*
zJ?1LyyJJJF7Hc23B-GkjfT~}PdOtiw-B^k^YXs`KFNj){RpWU6^{F?Miu(8!s%NS5
zcuYU6fqFA;M-8EWUXSmuVezOrosQ%1OB{t|^VvJ!ftso(s5f2i{C27eq2B#9T;3_a
z*RI~-RODpGY}8}64b}4ts2<;Uxu<~5!%>U2AVy<7)Z*=n8scd#U+?l`sPo)Ky|7-R
z9@8*yK|9y)q88Om)S}sfn)}PBj(7^$H4u)?$Ybzh9ELqGOJRGbV^NEEDi*<msOS6%
zPQz41?BhNM)y}(#Ks~>UdNHIbY8ynLMxr?C3rcI$9nVJ1?Pm17pl~Yr37ml~;yu3K
zdT*lkM<m!Aib73cUDVSy3^|Y2Od`<GEJAf)3+gf1ZyT6%sMUW5^_A)g&cgb|Jif1B
zKO+m->?&^8z@-u%vzWX^N&DgRXDN^Gx972?d0$X}4>f`>%V_QJ{M9dO4?K;X*-@vQ
z$M=s$*5e^^|MJ#vQLBGe1)dV@U(sW_<0jM;g!1TU5s$<LcmxMyr^+7Rzoa~i-N@Tk
zu_Lq>3v+$*#8t#pwX3rgYR(5?VVs23a0lwc=@n{`g;ld_qy%OoZ-@Rk0yR}*P%osV
zsQ1bN^uwdbK$u@B-m^rXQHGFwpMoE3o3I&0^FCQE*>u5=s9WfA)ukj)=ki_Tdx`(X
zsjhAo=A<Oh?*H3Xr_lJbaYN>J*FrtLL_VA{kn-QHiOb)k@<Za0l(Ce<<i)wjJYubp
z*|^(XbUqfObf!Kh)?nYC#PzWk?;kUp#KVquI0(ODM-j|R(e^8OW#ad+w5wwcnl!}U
zxcnr(r0yMjif^~p#Lr1?QYKJ(z1`vTdO4sOjdGzjexowE$XRRVQ&*?@FDWg^|3`ft
z;-BzqinhA0-Ef;4kJ?bTpL{qT#|6~g!Y7oPuKj1|eZ-E26m3nhire{@t1IPl+rs|L
z$i6|8UhF%J@l@-r*2W#vh*&SNuP7I&d!KgOh&NHLP|~_~gkJNxOWL{%O(1VcJe9JA
z7R&HDb>}EO$@$`AHd0rScra@Fj=Ewt^!+?ceIj+ok;mP)Ey9sR+mMe1vz2|7-1;+(
zsAx$UNQ1Ptz3=Cb{QQ!7ZOtj|+y!g9x)s!Qq-Z-sIYRw1%4K36caze!)BZq?J>&8z
z<U=WC`TX&{4kx)2CzBs#$0AB)%G+%tL3-Nc!I`uvMEnrDQnan7yrk5l%yZ`=^!+1q
z>Dy@gh1;h$U`KK<Z%yMzd6$as*twGuO8J9aFA=@L*0BF9R?~jsMX2o*Wh`-1%0c4s
z?9<l3V(yXamAjJtx2fY(`rmD{jqLOPZ!JM0g;%z3JHpQwHuQZqtm8zZDI?f_0k!SI
z-^qJZN|Jx;>UqhTr7jM~L>KFr{p{oIZqB9P`U|K?;dYkAR^-d^H{3y^HE!Qs;{3#E
zsGp4|$sZ6;A$|wX<8<mGC^LyisSs=Xiug5gJT4_aje5m@qx(NZqOA+|a0g6suD~=d
zwypR!L|&JY&sD4>en!!U(0V*X(YL6^sI7oIzv3|BC$7E=dPh^agrF(*!9K2WKUC-R
z{{`vexHeY6zLeJ#ZAq4Ye})o`aaknRb#XDy+n9K*JNH6dOWg^+fBOFOslGgFdt)(I
z*g2F^j{E?P$74})zN45`#MRx2DqsfczHrB7#qE><)V<xlaq)S)=PKLcZSs#b{|{V)
zYgB$foQ0DnVKzz~%2LXB>PE1?C`I3JL#Qi(+LloEx(>}D9zgkr{o0!2cleht<D;9r
zB4r=>T#k9l^-Xqn@DIc%T*IyStBV6TAeOR<@-yXq>KC|UJ|^Eyeg_*-cb)h$@!Kts
z_#*ZFsL16iGm>{A{u;fD`Jt^p4ZFHn`FTne>i(c?rfA#D{y1!){6B4*6TeGcXG(i^
z-JztT^rt>MYI|%kHEDA|$Foh+68nH)EM*;)lTq6-4xB~VMtQr{d>bI&EzOs1Uw(J8
z`_$)laX$7HA+Le!a3A%%DUT_|sGEk>sQ1(ScOq#|xk^PLincj4+CkYv+yUQiQ7+C#
z#Ziv=h|-667rx!P(MG>?gi@FLZ6%KTPn$t+>oxy#+3_I;bKo@T8h+|*LtOy-8c-Tj
z){y^q%R{@?)W^8?-Q7;AOm^z3V-u1`*n;vmbtSZu&D)ctAi-3MA0?~X@tZqYq|5!;
zx1YESYTN4e@3g7!*SK25EvQdV2_tTc-8rU%Ya2`4kaC8iZH2!7&9Jfg7MHN&tlQa=
z{6`L4jn61sTs@&VsUL3p!kv6M`6X9(4&S5warPA;)~D<S@{7br@B_+GO0>TJz1>n%
zQJmx$jSmvvATCWQNIr&q6D}kF1hr+w7#o^;#8rta(yk2UT}mcOg4-WLJd3zG?IMWB
z;9T+xx_&YhQ>d6v2_&yYo{Bgd#-X+yl*}%kNc;<NZ#+iX;OcK+VUFoaT~%D{>Pdau
zOn#Q3ZX)Gl;!3pf79#2H8qTM3D3#yiU5d7z<l4Tc%?~b~hQr)3{q635e@<rKXJmUR
z^Zu>n1w{Lh|Ktj%YyLZPz#ezvYwn~?*jd2EpR+H6+h2jYTdqD5`%*^Hwj{p7pC~c3
z?LnF2+6^TB&>bJZ{sWXK_MOJln*YMCVFxNcrL=L434Pl{@;FK?*;>jF+NUMYg4_So
z_9A%+%0BAK(yl(XqV%TJC$Gf5=ad}e+71%`sg;?Nq`j-`M!w3$TZlhr-!RG^;!`T@
z+lb|HG>*Wp*+0@9^AB+z7ZaL##Di(~b{j`tl2X*Q@lGJ<NXbE?R5*;1nbzg73qGXW
zXI~Kc42nM`9VLSLFzQoK-cV9gYEze)eeH-_QQo1vplEv^*Xwx9VyjHF-v8P<vEy5I
z{6LvO`N&txM=AB%ex@v^{_S>^IEW-YB`;;Q+qcj)xJmwri~ma%l0%enlxWUf*i`0k
zy(HTDQc;To7ZZQtE<6O2D9P02#tmx7c7k}NFWMedAu?fmnE{=%ZofM1WZ3qzE2@PA
zSLxehM3?^Edkl_laPW(+y@n=kFSUI@h3$JDrHR>@J=Bvw>-;k%JehXRDeU<o{Qm$*
CmrOqZ

diff --git a/locale/en/LC_MESSAGES/django.po b/locale/en/LC_MESSAGES/django.po
index 8024002f37f1..78992a196c82 100644
--- a/locale/en/LC_MESSAGES/django.po
+++ b/locale/en/LC_MESSAGES/django.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-11-24 00:10+0000\n"
+"POT-Creation-Date: 2024-11-26 00:09+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -73,8 +73,8 @@ msgid "authentik Export - {date}"
 msgstr ""
 
 #: authentik/blueprints/v1/tasks.py authentik/crypto/tasks.py
-#, python-format
-msgid "Successfully imported %(count)d files."
+#, python-brace-format
+msgid "Successfully imported {count} files."
 msgstr ""
 
 #: authentik/brands/models.py
@@ -856,13 +856,13 @@ msgid "Starting full provider sync"
 msgstr ""
 
 #: authentik/lib/sync/outgoing/tasks.py
-#, python-format
-msgid "Syncing page %(page)d of users"
+#, python-brace-format
+msgid "Syncing page {page} of users"
 msgstr ""
 
 #: authentik/lib/sync/outgoing/tasks.py
-#, python-format
-msgid "Syncing page %(page)d of groups"
+#, python-brace-format
+msgid "Syncing page {page} of groups"
 msgstr ""
 
 #: authentik/lib/sync/outgoing/tasks.py
@@ -1012,8 +1012,8 @@ msgid "Event Matcher Policies"
 msgstr ""
 
 #: authentik/policies/expiry/models.py
-#, python-format
-msgid "Password expired %(days)d days ago. Please update your password."
+#, python-brace-format
+msgid "Password expired {days} days ago. Please update your password."
 msgstr ""
 
 #: authentik/policies/expiry/models.py
@@ -1140,8 +1140,8 @@ msgid "Invalid password."
 msgstr ""
 
 #: authentik/policies/password/models.py
-#, python-format
-msgid "Password exists on %(count)d online lists."
+#, python-brace-format
+msgid "Password exists on {count} online lists."
 msgstr ""
 
 #: authentik/policies/password/models.py

From ee15dbf671ad4ad08e4fafe8ee8fd96710257c64 Mon Sep 17 00:00:00 2001
From: Ken Sternberg
 <133134217+kensternberg-authentik@users.noreply.github.com>
Date: Tue, 26 Nov 2024 05:11:38 -0800
Subject: [PATCH 4/7] docs: fix contribution link (#12189)

* web: Add InvalidationFlow to Radius Provider dialogues

## What

- Bugfix: adds the InvalidationFlow to the Radius Provider dialogues
  - Repairs: `{"invalidation_flow":["This field is required."]}` message, which was *not* propagated
    to the Notification.
- Nitpick: Pretties `?foo=${true}` expressions: `s/\?([^=]+)=\$\{true\}/\1/`

## Note

Yes, I know I'm going to have to do more magic when we harmonize the forms, and no, I didn't add the
Property Mappings to the wizard, and yes, I know I'm going to have pain with the *new* version of
the wizard. But this is a serious bug; you can't make Radius servers with *either* of the current
dialogues at the moment.

* docs: fix link from project root to the Contributing documentation in our product.
---
 CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 594bf7b05860..afab0618ad8b 120000
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1 +1 @@
-website/developer-docs/index.md
\ No newline at end of file
+website/docs/developer-docs/index.md
\ No newline at end of file

From 5e72ec9c0c9d826c048627180d96a3e94df7bedd Mon Sep 17 00:00:00 2001
From: "Jens L." <jens@goauthentik.io>
Date: Tue, 26 Nov 2024 15:38:23 +0100
Subject: [PATCH 5/7] root: support running authentik in subpath (#8675)

* initial subpath support

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* make outpost compatible

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix static files somewhat

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix web interface

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix most static stuff

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix most web links

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix websocket

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix URL for static files

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* format web

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* add root redirect for subpath

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* update docs

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* set cookie path

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* Update internal/config/struct.go

Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
Signed-off-by: Jens L. <jens@beryju.org>

* fix sfe

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* bump required version

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix flow background

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix lint and some more links

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* format

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix impersonate

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Signed-off-by: Jens L. <jens@beryju.org>
Signed-off-by: Jens L. <jens@goauthentik.io>
Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
---
 authentik/brands/api.py                       |  4 +-
 authentik/brands/models.py                    | 13 ++++
 authentik/core/templates/base/header_js.html  |  3 +
 authentik/core/templates/base/skeleton.html   |  4 +-
 authentik/core/templates/login/base_full.html |  6 +-
 authentik/core/views/interface.py             |  2 +
 .../providers/rac/templates/if/rac.html       |  4 +-
 authentik/flows/models.py                     |  9 ++-
 authentik/flows/templates/if/flow-sfe.html    |  4 +-
 authentik/lib/default.yml                     |  1 +
 authentik/lib/sentry.py                       |  3 +-
 authentik/root/settings.py                    |  4 +-
 authentik/root/urls.py                        |  9 ++-
 authentik/root/websocket.py                   | 14 +++-
 cmd/server/healthcheck.go                     |  2 +-
 cmd/server/server.go                          |  2 +-
 internal/config/struct.go                     |  5 ++
 internal/outpost/ak/api.go                    | 17 +++--
 internal/outpost/ak/api_ws.go                 |  5 +-
 internal/web/metrics.go                       |  2 +-
 internal/web/proxy.go                         | 10 ++-
 internal/web/static.go                        | 72 +++++++++++++------
 internal/web/web.go                           | 39 +++++-----
 web/packages/sfe/src/index.ts                 |  5 +-
 web/src/admin/AdminInterface/AdminSidebar.ts  |  3 +-
 web/src/admin/users/UserImpersonateForm.ts    |  3 +-
 web/src/common/api/config.ts                  |  2 +-
 web/src/common/global.ts                      |  6 ++
 web/src/common/ws.ts                          |  6 +-
 .../enterprise/EnterpriseStatusBanner.ts      |  5 +-
 web/src/elements/notifications/APIDrawer.ts   |  5 +-
 .../notifications/NotificationDrawer.ts       |  3 +-
 web/src/elements/sidebar/SidebarUser.ts       | 13 +++-
 web/src/flow/FlowExecutor.ts                  |  1 +
 web/src/flow/FlowInspector.ts                 |  6 +-
 web/src/flow/providers/SessionEnd.ts          |  5 +-
 web/src/user/LibraryApplication/index.ts      |  4 +-
 .../ak-library-application-empty-list.ts      |  4 +-
 web/src/user/UserInterface.ts                 |  5 +-
 .../details/UserSettingsFlowExecutor.ts       |  6 +-
 .../details/stages/prompt/PromptStage.ts      |  4 +-
 .../configuration/configuration.mdx           | 10 +++
 website/docs/install-config/reverse-proxy.md  |  2 +
 43 files changed, 236 insertions(+), 96 deletions(-)

diff --git a/authentik/brands/api.py b/authentik/brands/api.py
index 2f0486a688ed..5f730e040380 100644
--- a/authentik/brands/api.py
+++ b/authentik/brands/api.py
@@ -84,8 +84,8 @@ class CurrentBrandSerializer(PassiveSerializer):
 
     matched_domain = CharField(source="domain")
     branding_title = CharField()
-    branding_logo = CharField()
-    branding_favicon = CharField()
+    branding_logo = CharField(source="branding_logo_url")
+    branding_favicon = CharField(source="branding_favicon_url")
     ui_footer_links = ListField(
         child=FooterLinkSerializer(),
         read_only=True,
diff --git a/authentik/brands/models.py b/authentik/brands/models.py
index 3a7bc775cf55..12e975b1de1e 100644
--- a/authentik/brands/models.py
+++ b/authentik/brands/models.py
@@ -10,6 +10,7 @@
 
 from authentik.crypto.models import CertificateKeyPair
 from authentik.flows.models import Flow
+from authentik.lib.config import CONFIG
 from authentik.lib.models import SerializerModel
 
 LOGGER = get_logger()
@@ -71,6 +72,18 @@ class Brand(SerializerModel):
     )
     attributes = models.JSONField(default=dict, blank=True)
 
+    def branding_logo_url(self) -> str:
+        """Get branding_logo with the correct prefix"""
+        if self.branding_logo.startswith("/static"):
+            return CONFIG.get("web.path", "/")[:-1] + self.branding_logo
+        return self.branding_logo
+
+    def branding_favicon_url(self) -> str:
+        """Get branding_favicon with the correct prefix"""
+        if self.branding_favicon.startswith("/static"):
+            return CONFIG.get("web.path", "/")[:-1] + self.branding_favicon
+        return self.branding_favicon
+
     @property
     def serializer(self) -> Serializer:
         from authentik.brands.api import BrandSerializer
diff --git a/authentik/core/templates/base/header_js.html b/authentik/core/templates/base/header_js.html
index 4e1b53c2fa73..944bf587edbc 100644
--- a/authentik/core/templates/base/header_js.html
+++ b/authentik/core/templates/base/header_js.html
@@ -9,6 +9,9 @@
         versionFamily: "{{ version_family }}",
         versionSubdomain: "{{ version_subdomain }}",
         build: "{{ build }}",
+        api: {
+            base: "{{ base_url }}",
+        },
     };
     window.addEventListener("DOMContentLoaded", function () {
         {% for message in messages %}
diff --git a/authentik/core/templates/base/skeleton.html b/authentik/core/templates/base/skeleton.html
index 074fcc15561a..e2f063b071b7 100644
--- a/authentik/core/templates/base/skeleton.html
+++ b/authentik/core/templates/base/skeleton.html
@@ -9,8 +9,8 @@
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
         <title>{% block title %}{% trans title|default:brand.branding_title %}{% endblock %}</title>
-        <link rel="icon" href="{{ brand.branding_favicon }}">
-        <link rel="shortcut icon" href="{{ brand.branding_favicon }}">
+        <link rel="icon" href="{{ brand.branding_favicon_url }}">
+        <link rel="shortcut icon" href="{{ brand.branding_favicon_url }}">
         {% block head_before %}
         {% endblock %}
         <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">
diff --git a/authentik/core/templates/login/base_full.html b/authentik/core/templates/login/base_full.html
index 483bae724567..cbab6c2ed529 100644
--- a/authentik/core/templates/login/base_full.html
+++ b/authentik/core/templates/login/base_full.html
@@ -4,7 +4,7 @@
 {% load i18n %}
 
 {% block head_before %}
-<link rel="prefetch" href="/static/dist/assets/images/flow_background.jpg" />
+<link rel="prefetch" href="{% static 'dist/assets/images/flow_background.jpg' %}" />
 <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}">
 <link rel="stylesheet" type="text/css" href="{% static 'dist/theme-dark.css' %}" media="(prefers-color-scheme: dark)">
 {% include "base/header_js.html" %}
@@ -13,7 +13,7 @@
 {% block head %}
 <style>
 :root {
-    --ak-flow-background: url("/static/dist/assets/images/flow_background.jpg");
+    --ak-flow-background: url("{% static 'dist/assets/images/flow_background.jpg' %}");
     --pf-c-background-image--BackgroundImage: var(--ak-flow-background);
     --pf-c-background-image--BackgroundImage-2x: var(--ak-flow-background);
     --pf-c-background-image--BackgroundImage--sm: var(--ak-flow-background);
@@ -50,7 +50,7 @@
     <div class="ak-login-container">
         <main class="pf-c-login__main">
             <div class="pf-c-login__main-header pf-c-brand ak-brand">
-                <img src="{{ brand.branding_logo }}" alt="authentik Logo" />
+                <img src="{{ brand.branding_logo_url }}" alt="authentik Logo" />
             </div>
             <header class="pf-c-login__main-header">
                 <h1 class="pf-c-title pf-m-3xl">
diff --git a/authentik/core/views/interface.py b/authentik/core/views/interface.py
index 4a7d06b7722d..20fddf860651 100644
--- a/authentik/core/views/interface.py
+++ b/authentik/core/views/interface.py
@@ -16,6 +16,7 @@
 from authentik.brands.api import CurrentBrandSerializer
 from authentik.brands.models import Brand
 from authentik.core.models import UserTypes
+from authentik.lib.config import CONFIG
 from authentik.policies.denied import AccessDeniedResponse
 
 
@@ -51,6 +52,7 @@ def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
         kwargs["version_subdomain"] = f"version-{LOCAL_VERSION.major}-{LOCAL_VERSION.minor}"
         kwargs["build"] = get_build_hash()
         kwargs["url_kwargs"] = self.kwargs
+        kwargs["base_url"] = self.request.build_absolute_uri(CONFIG.get("web.path", "/"))
         return super().get_context_data(**kwargs)
 
 
diff --git a/authentik/enterprise/providers/rac/templates/if/rac.html b/authentik/enterprise/providers/rac/templates/if/rac.html
index fde3f30ad8f3..156d96085e42 100644
--- a/authentik/enterprise/providers/rac/templates/if/rac.html
+++ b/authentik/enterprise/providers/rac/templates/if/rac.html
@@ -6,8 +6,8 @@
 <script src="{% versioned_script 'dist/enterprise/rac/index-%v.js' %}" type="module"></script>
 <meta name="theme-color" content="#18191a" media="(prefers-color-scheme: dark)">
 <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
-<link rel="icon" href="{{ tenant.branding_favicon }}">
-<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
+<link rel="icon" href="{{ tenant.branding_favicon_url }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon_url }}">
 {% include "base/header_js.html" %}
 {% endblock %}
 
diff --git a/authentik/flows/models.py b/authentik/flows/models.py
index d871aab5ecf9..622fdff4e3f5 100644
--- a/authentik/flows/models.py
+++ b/authentik/flows/models.py
@@ -14,6 +14,7 @@
 from authentik.core.models import Token
 from authentik.core.types import UserSettingSerializer
 from authentik.flows.challenge import FlowLayout
+from authentik.lib.config import CONFIG
 from authentik.lib.models import InheritanceForeignKey, SerializerModel
 from authentik.lib.utils.reflection import class_to_path
 from authentik.policies.models import PolicyBindingModel
@@ -177,9 +178,13 @@ def background_url(self) -> str:
         """Get the URL to the background image. If the name is /static or starts with http
         it is returned as-is"""
         if not self.background:
-            return "/static/dist/assets/images/flow_background.jpg"
-        if self.background.name.startswith("http") or self.background.name.startswith("/static"):
+            return (
+                CONFIG.get("web.path", "/")[:-1] + "/static/dist/assets/images/flow_background.jpg"
+            )
+        if self.background.name.startswith("http"):
             return self.background.name
+        if self.background.name.startswith("/static"):
+            return CONFIG.get("web.path", "/")[:-1] + self.background.name
         return self.background.url
 
     stages = models.ManyToManyField(Stage, through="FlowStageBinding", blank=True)
diff --git a/authentik/flows/templates/if/flow-sfe.html b/authentik/flows/templates/if/flow-sfe.html
index b664fa8efa04..abea71934b4d 100644
--- a/authentik/flows/templates/if/flow-sfe.html
+++ b/authentik/flows/templates/if/flow-sfe.html
@@ -9,8 +9,8 @@
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
         <title>{% block title %}{% trans title|default:brand.branding_title %}{% endblock %}</title>
-        <link rel="icon" href="{{ brand.branding_favicon }}">
-        <link rel="shortcut icon" href="{{ brand.branding_favicon }}">
+        <link rel="icon" href="{{ brand.branding_favicon_url }}">
+        <link rel="shortcut icon" href="{{ brand.branding_favicon_url }}">
         {% block head_before %}
         {% endblock %}
         <link rel="stylesheet" type="text/css" href="{% static 'dist/sfe/bootstrap.min.css' %}">
diff --git a/authentik/lib/default.yml b/authentik/lib/default.yml
index 9d6d0dff1a36..9a8289a0dfc0 100644
--- a/authentik/lib/default.yml
+++ b/authentik/lib/default.yml
@@ -135,6 +135,7 @@ web:
   # No default here as it's set dynamically
   # workers: 2
   threads: 4
+  path: /
 
 worker:
   concurrency: 2
diff --git a/authentik/lib/sentry.py b/authentik/lib/sentry.py
index 9027d06e6292..9f6793df4a9e 100644
--- a/authentik/lib/sentry.py
+++ b/authentik/lib/sentry.py
@@ -36,6 +36,7 @@
 from authentik.lib.utils.reflection import get_env
 
 LOGGER = get_logger()
+_root_path = CONFIG.get("web.path", "/")
 
 
 class SentryIgnoredException(Exception):
@@ -90,7 +91,7 @@ def traces_sampler(sampling_context: dict) -> float:
     path = sampling_context.get("asgi_scope", {}).get("path", "")
     _type = sampling_context.get("asgi_scope", {}).get("type", "")
     # Ignore all healthcheck routes
-    if path.startswith("/-/health") or path.startswith("/-/metrics"):
+    if path.startswith(f"{_root_path}-/health") or path.startswith(f"{_root_path}-/metrics"):
         return 0
     if _type == "websocket":
         return 0
diff --git a/authentik/root/settings.py b/authentik/root/settings.py
index afc5dccfa8f5..266085c150d2 100644
--- a/authentik/root/settings.py
+++ b/authentik/root/settings.py
@@ -32,6 +32,8 @@
 # Custom user model
 AUTH_USER_MODEL = "authentik_core.User"
 
+CSRF_COOKIE_PATH = LANGUAGE_COOKIE_PATH = SESSION_COOKIE_PATH = CONFIG.get("web.path", "/")
+
 CSRF_COOKIE_NAME = "authentik_csrf"
 CSRF_HEADER_NAME = "HTTP_X_AUTHENTIK_CSRF"
 LANGUAGE_COOKIE_NAME = "authentik_language"
@@ -427,7 +429,7 @@
 # https://docs.djangoproject.com/en/2.1/howto/static-files/
 
 STATICFILES_DIRS = [BASE_DIR / Path("web")]
-STATIC_URL = "/static/"
+STATIC_URL = CONFIG.get("web.path", "/") + "static/"
 
 STORAGES = {
     "staticfiles": {
diff --git a/authentik/root/urls.py b/authentik/root/urls.py
index 1b03051fddd6..b12eb83168da 100644
--- a/authentik/root/urls.py
+++ b/authentik/root/urls.py
@@ -4,6 +4,7 @@
 from structlog.stdlib import get_logger
 
 from authentik.core.views import error
+from authentik.lib.config import CONFIG
 from authentik.lib.utils.reflection import get_apps
 from authentik.root.monitoring import LiveView, MetricsView, ReadyView
 
@@ -14,7 +15,7 @@
 handler404 = error.NotFoundView.as_view()
 handler500 = error.ServerErrorView.as_view()
 
-urlpatterns = []
+_urlpatterns = []
 
 for _authentik_app in get_apps():
     mountpoints = None
@@ -35,7 +36,7 @@
                 namespace=namespace,
             ),
         )
-        urlpatterns.append(_path)
+        _urlpatterns.append(_path)
         LOGGER.debug(
             "Mounted URLs",
             app_name=_authentik_app.name,
@@ -43,8 +44,10 @@
             namespace=namespace,
         )
 
-urlpatterns += [
+_urlpatterns += [
     path("-/metrics/", MetricsView.as_view(), name="metrics"),
     path("-/health/live/", LiveView.as_view(), name="health-live"),
     path("-/health/ready/", ReadyView.as_view(), name="health-ready"),
 ]
+
+urlpatterns = [path(CONFIG.get("web.path", "/")[1:], include(_urlpatterns))]
diff --git a/authentik/root/websocket.py b/authentik/root/websocket.py
index 560a39c07d02..70fec2055fa0 100644
--- a/authentik/root/websocket.py
+++ b/authentik/root/websocket.py
@@ -2,13 +2,16 @@
 
 from importlib import import_module
 
+from channels.routing import URLRouter
+from django.urls import path
 from structlog.stdlib import get_logger
 
+from authentik.lib.config import CONFIG
 from authentik.lib.utils.reflection import get_apps
 
 LOGGER = get_logger()
 
-websocket_urlpatterns = []
+_websocket_urlpatterns = []
 for _authentik_app in get_apps():
     try:
         api_urls = import_module(f"{_authentik_app.name}.urls")
@@ -17,8 +20,15 @@
     if not hasattr(api_urls, "websocket_urlpatterns"):
         continue
     urls: list = api_urls.websocket_urlpatterns
-    websocket_urlpatterns.extend(urls)
+    _websocket_urlpatterns.extend(urls)
     LOGGER.debug(
         "Mounted Websocket URLs",
         app_name=_authentik_app.name,
     )
+
+websocket_urlpatterns = [
+    path(
+        CONFIG.get("web.path", "/")[1:],
+        URLRouter(_websocket_urlpatterns),
+    ),
+]
diff --git a/cmd/server/healthcheck.go b/cmd/server/healthcheck.go
index d37cfb483eb4..0f0ccec02929 100644
--- a/cmd/server/healthcheck.go
+++ b/cmd/server/healthcheck.go
@@ -47,7 +47,7 @@ func checkServer() int {
 	h := &http.Client{
 		Transport: web.NewUserAgentTransport("goauthentik.io/healthcheck", http.DefaultTransport),
 	}
-	url := fmt.Sprintf("http://%s/-/health/live/", config.Get().Listen.HTTP)
+	url := fmt.Sprintf("http://%s%s-/health/live/", config.Get().Listen.HTTP, config.Get().Web.Path)
 	res, err := h.Head(url)
 	if err != nil {
 		log.WithError(err).Warning("failed to send healthcheck request")
diff --git a/cmd/server/server.go b/cmd/server/server.go
index 9324c984de46..a09451d1258f 100644
--- a/cmd/server/server.go
+++ b/cmd/server/server.go
@@ -61,7 +61,7 @@ var rootCmd = &cobra.Command{
 		ex := common.Init()
 		defer common.Defer()
 
-		u, err := url.Parse(fmt.Sprintf("http://%s", config.Get().Listen.HTTP))
+		u, err := url.Parse(fmt.Sprintf("http://%s%s", config.Get().Listen.HTTP, config.Get().Web.Path))
 		if err != nil {
 			panic(err)
 		}
diff --git a/internal/config/struct.go b/internal/config/struct.go
index 17dd3ba246d4..a9252ec4e3ba 100644
--- a/internal/config/struct.go
+++ b/internal/config/struct.go
@@ -14,6 +14,7 @@ type Config struct {
 	// Config for both core and outposts
 	Debug  bool         `yaml:"debug" env:"AUTHENTIK_DEBUG, overwrite"`
 	Listen ListenConfig `yaml:"listen" env:", prefix=AUTHENTIK_LISTEN__"`
+	Web    WebConfig    `yaml:"web" env:", prefix=AUTHENTIK_WEB__"`
 
 	// Outpost specific config
 	// These are only relevant for proxy/ldap outposts, and cannot be set via YAML
@@ -72,3 +73,7 @@ type OutpostConfig struct {
 	Discover               bool   `yaml:"discover" env:"DISCOVER, overwrite"`
 	DisableEmbeddedOutpost bool   `yaml:"disable_embedded_outpost" env:"DISABLE_EMBEDDED_OUTPOST, overwrite"`
 }
+
+type WebConfig struct {
+	Path string `yaml:"path" env:"PATH, overwrite"`
+}
diff --git a/internal/outpost/ak/api.go b/internal/outpost/ak/api.go
index 2def0642731b..fd8050042a0d 100644
--- a/internal/outpost/ak/api.go
+++ b/internal/outpost/ak/api.go
@@ -56,10 +56,10 @@ type APIController struct {
 func NewAPIController(akURL url.URL, token string) *APIController {
 	rsp := sentry.StartSpan(context.Background(), "authentik.outposts.init")
 
-	config := api.NewConfiguration()
-	config.Host = akURL.Host
-	config.Scheme = akURL.Scheme
-	config.HTTPClient = &http.Client{
+	apiConfig := api.NewConfiguration()
+	apiConfig.Host = akURL.Host
+	apiConfig.Scheme = akURL.Scheme
+	apiConfig.HTTPClient = &http.Client{
 		Transport: web.NewUserAgentTransport(
 			constants.OutpostUserAgent(),
 			web.NewTracingTransport(
@@ -68,10 +68,15 @@ func NewAPIController(akURL url.URL, token string) *APIController {
 			),
 		),
 	}
-	config.AddDefaultHeader("Authorization", fmt.Sprintf("Bearer %s", token))
+	apiConfig.Servers = api.ServerConfigurations{
+		{
+			URL: fmt.Sprintf("%sapi/v3", akURL.Path),
+		},
+	}
+	apiConfig.AddDefaultHeader("Authorization", fmt.Sprintf("Bearer %s", token))
 
 	// create the API client, with the transport
-	apiClient := api.NewAPIClient(config)
+	apiClient := api.NewAPIClient(apiConfig)
 
 	log := log.WithField("logger", "authentik.outpost.ak-api-controller")
 
diff --git a/internal/outpost/ak/api_ws.go b/internal/outpost/ak/api_ws.go
index cda7bd03d2b0..3b450736e645 100644
--- a/internal/outpost/ak/api_ws.go
+++ b/internal/outpost/ak/api_ws.go
@@ -17,7 +17,7 @@ import (
 )
 
 func (ac *APIController) initWS(akURL url.URL, outpostUUID string) error {
-	pathTemplate := "%s://%s/ws/outpost/%s/?%s"
+	pathTemplate := "%s://%s%sws/outpost/%s/?%s"
 	query := akURL.Query()
 	query.Set("instance_uuid", ac.instanceUUID.String())
 	scheme := strings.ReplaceAll(akURL.Scheme, "http", "ws")
@@ -37,7 +37,7 @@ func (ac *APIController) initWS(akURL url.URL, outpostUUID string) error {
 		},
 	}
 
-	ws, _, err := dialer.Dial(fmt.Sprintf(pathTemplate, scheme, akURL.Host, outpostUUID, akURL.Query().Encode()), header)
+	ws, _, err := dialer.Dial(fmt.Sprintf(pathTemplate, scheme, akURL.Host, akURL.Path, outpostUUID, akURL.Query().Encode()), header)
 	if err != nil {
 		ac.logger.WithError(err).Warning("failed to connect websocket")
 		return err
@@ -83,6 +83,7 @@ func (ac *APIController) reconnectWS() {
 	u := url.URL{
 		Host:   ac.Client.GetConfig().Host,
 		Scheme: ac.Client.GetConfig().Scheme,
+		Path:   strings.ReplaceAll(ac.Client.GetConfig().Servers[0].URL, "api/v3", ""),
 	}
 	attempt := 1
 	for {
diff --git a/internal/web/metrics.go b/internal/web/metrics.go
index 40d9671f6e25..21778ba99e92 100644
--- a/internal/web/metrics.go
+++ b/internal/web/metrics.go
@@ -46,7 +46,7 @@ func (ws *WebServer) runMetricsServer() {
 		).ServeHTTP(rw, r)
 
 		// Get upstream metrics
-		re, err := http.NewRequest("GET", fmt.Sprintf("%s/-/metrics/", ws.ul.String()), nil)
+		re, err := http.NewRequest("GET", fmt.Sprintf("%s%s-/metrics/", ws.upstreamURL.String(), config.Get().Web.Path), nil)
 		if err != nil {
 			l.WithError(err).Warning("failed to get upstream metrics")
 			return
diff --git a/internal/web/proxy.go b/internal/web/proxy.go
index ccc9bd0eb052..8961fc7d096a 100644
--- a/internal/web/proxy.go
+++ b/internal/web/proxy.go
@@ -9,14 +9,15 @@ import (
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
+	"goauthentik.io/internal/config"
 	"goauthentik.io/internal/utils/sentry"
 )
 
 func (ws *WebServer) configureProxy() {
 	// Reverse proxy to the application server
 	director := func(req *http.Request) {
-		req.URL.Scheme = ws.ul.Scheme
-		req.URL.Host = ws.ul.Host
+		req.URL.Scheme = ws.upstreamURL.Scheme
+		req.URL.Host = ws.upstreamURL.Host
 		if _, ok := req.Header["User-Agent"]; !ok {
 			// explicitly disable User-Agent so it's not set to default value
 			req.Header.Set("User-Agent", "")
@@ -32,7 +33,10 @@ func (ws *WebServer) configureProxy() {
 	}
 	rp.ErrorHandler = ws.proxyErrorHandler
 	rp.ModifyResponse = ws.proxyModifyResponse
-	ws.m.PathPrefix("/").HandlerFunc(sentry.SentryNoSample(func(rw http.ResponseWriter, r *http.Request) {
+	ws.mainRouter.PathPrefix(config.Get().Web.Path).Path("/-/health/live/").HandlerFunc(sentry.SentryNoSample(func(rw http.ResponseWriter, r *http.Request) {
+		rw.WriteHeader(204)
+	}))
+	ws.mainRouter.PathPrefix(config.Get().Web.Path).HandlerFunc(sentry.SentryNoSample(func(rw http.ResponseWriter, r *http.Request) {
 		if !ws.g.IsRunning() {
 			ws.proxyErrorHandler(rw, r, errors.New("authentik starting"))
 			return
diff --git a/internal/web/static.go b/internal/web/static.go
index 650e38b058bb..33a538179a03 100644
--- a/internal/web/static.go
+++ b/internal/web/static.go
@@ -14,46 +14,74 @@ import (
 )
 
 func (ws *WebServer) configureStatic() {
-	staticRouter := ws.lh.NewRoute().Subrouter()
+	// Setup routers
+	staticRouter := ws.loggingRouter.NewRoute().Subrouter()
 	staticRouter.Use(ws.staticHeaderMiddleware)
-	staticRouter.Use(web.DisableIndex)
+	indexLessRouter := staticRouter.NewRoute().Subrouter()
+	// Specifically disable index
+	indexLessRouter.Use(web.DisableIndex)
 
 	distFs := http.FileServer(http.Dir("./web/dist"))
-	authentikHandler := http.StripPrefix("/static/authentik/", http.FileServer(http.Dir("./web/authentik")))
 
-	// Root file paths, from which they should be accessed
-	staticRouter.PathPrefix("/static/dist/").Handler(http.StripPrefix("/static/dist/", distFs))
-	staticRouter.PathPrefix("/static/authentik/").Handler(authentikHandler)
+	pathStripper := func(handler http.Handler, paths ...string) http.Handler {
+		h := handler
+		for _, path := range paths {
+			h = http.StripPrefix(path, h)
+		}
+		return h
+	}
+
+	helpHandler := http.FileServer(http.Dir("./website/help/"))
+
+	indexLessRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/static/dist/").Handler(pathStripper(
+		distFs,
+		"static/dist/",
+		config.Get().Web.Path,
+	))
+	indexLessRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/static/authentik/").Handler(pathStripper(
+		http.FileServer(http.Dir("./web/authentik")),
+		"static/authentik/",
+		config.Get().Web.Path,
+	))
 
-	// Also serve assets folder in specific interfaces since fonts in patternfly are imported
-	// with a relative path
-	staticRouter.PathPrefix("/if/flow/{flow_slug}/assets").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+	indexLessRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/if/flow/{flow_slug}/assets").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
 
-		web.DisableIndex(http.StripPrefix(fmt.Sprintf("/if/flow/%s", vars["flow_slug"]), distFs)).ServeHTTP(rw, r)
+		pathStripper(
+			distFs,
+			"if/flow/"+vars["flow_slug"],
+			config.Get().Web.Path,
+		).ServeHTTP(rw, r)
 	})
-	staticRouter.PathPrefix("/if/admin/assets").Handler(http.StripPrefix("/if/admin", distFs))
-	staticRouter.PathPrefix("/if/user/assets").Handler(http.StripPrefix("/if/user", distFs))
-	staticRouter.PathPrefix("/if/rac/{app_slug}/assets").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+	indexLessRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/if/admin/assets").Handler(http.StripPrefix(fmt.Sprintf("%sif/admin", config.Get().Web.Path), distFs))
+	indexLessRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/if/user/assets").Handler(http.StripPrefix(fmt.Sprintf("%sif/user", config.Get().Web.Path), distFs))
+	indexLessRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/if/rac/{app_slug}/assets").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
 
-		web.DisableIndex(http.StripPrefix(fmt.Sprintf("/if/rac/%s", vars["app_slug"]), distFs)).ServeHTTP(rw, r)
+		pathStripper(
+			distFs,
+			"if/rac/"+vars["app_slug"],
+			config.Get().Web.Path,
+		).ServeHTTP(rw, r)
 	})
 
 	// Media files, if backend is file
 	if config.Get().Storage.Media.Backend == "file" {
 		fsMedia := http.StripPrefix("/media", http.FileServer(http.Dir(config.Get().Storage.Media.File.Path)))
-		staticRouter.PathPrefix("/media/").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		    w.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox")
-		    fsMedia.ServeHTTP(w, r)
+		indexLessRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/media/").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox")
+			fsMedia.ServeHTTP(w, r)
 		})
 	}
 
-	staticRouter.PathPrefix("/if/help/").Handler(http.StripPrefix("/if/help/", http.FileServer(http.Dir("./website/help/"))))
-	staticRouter.PathPrefix("/help").Handler(http.RedirectHandler("/if/help/", http.StatusMovedPermanently))
+	staticRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/if/help/").Handler(pathStripper(
+		helpHandler,
+		config.Get().Web.Path,
+		"/if/help/",
+	))
+	staticRouter.PathPrefix(config.Get().Web.Path).PathPrefix("/help").Handler(http.RedirectHandler(fmt.Sprintf("%sif/help/", config.Get().Web.Path), http.StatusMovedPermanently))
 
-	// Static misc files
-	ws.lh.Path("/robots.txt").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+	staticRouter.PathPrefix(config.Get().Web.Path).Path("/robots.txt").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header()["Content-Type"] = []string{"text/plain"}
 		rw.WriteHeader(200)
 		_, err := rw.Write(staticWeb.RobotsTxt)
@@ -61,7 +89,7 @@ func (ws *WebServer) configureStatic() {
 			ws.log.WithError(err).Warning("failed to write response")
 		}
 	})
-	ws.lh.Path("/.well-known/security.txt").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+	staticRouter.PathPrefix(config.Get().Web.Path).Path("/.well-known/security.txt").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header()["Content-Type"] = []string{"text/plain"}
 		rw.WriteHeader(200)
 		_, err := rw.Write(staticWeb.SecurityTxt)
diff --git a/internal/web/web.go b/internal/web/web.go
index 186dd4ddf018..6729b688e839 100644
--- a/internal/web/web.go
+++ b/internal/web/web.go
@@ -33,13 +33,13 @@ type WebServer struct {
 	ProxyServer *proxyv2.ProxyServer
 	BrandTLS    *brand_tls.Watcher
 
-	g   *gounicorn.GoUnicorn
-	gr  bool
-	m   *mux.Router
-	lh  *mux.Router
-	log *log.Entry
-	uc  *http.Client
-	ul  *url.URL
+	g              *gounicorn.GoUnicorn
+	gunicornReady  bool
+	mainRouter     *mux.Router
+	loggingRouter  *mux.Router
+	log            *log.Entry
+	upstreamClient *http.Client
+	upstreamURL    *url.URL
 }
 
 const UnixSocketName = "authentik-core.sock"
@@ -73,17 +73,22 @@ func NewWebServer() *WebServer {
 	u, _ := url.Parse("http://localhost:8000")
 
 	ws := &WebServer{
-		m:   mainHandler,
-		lh:  loggingHandler,
-		log: l,
-		gr:  true,
-		uc:  upstreamClient,
-		ul:  u,
+		mainRouter:     mainHandler,
+		loggingRouter:  loggingHandler,
+		log:            l,
+		gunicornReady:  true,
+		upstreamClient: upstreamClient,
+		upstreamURL:    u,
 	}
 	ws.configureStatic()
 	ws.configureProxy()
+	// Redirect for sub-folder
+	if sp := config.Get().Web.Path; sp != "/" {
+		ws.mainRouter.Path("/").Handler(http.RedirectHandler(sp, http.StatusFound))
+	}
+	hcUrl := fmt.Sprintf("%s%s-/health/live/", ws.upstreamURL.String(), config.Get().Web.Path)
 	ws.g = gounicorn.New(func() bool {
-		req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/-/health/live/", ws.ul.String()), nil)
+		req, err := http.NewRequest(http.MethodGet, hcUrl, nil)
 		if err != nil {
 			ws.log.WithError(err).Warning("failed to create request for healthcheck")
 			return false
@@ -107,7 +112,7 @@ func (ws *WebServer) Start() {
 
 func (ws *WebServer) attemptStartBackend() {
 	for {
-		if !ws.gr {
+		if !ws.gunicornReady {
 			return
 		}
 		err := ws.g.Start()
@@ -135,7 +140,7 @@ func (ws *WebServer) Core() *gounicorn.GoUnicorn {
 }
 
 func (ws *WebServer) upstreamHttpClient() *http.Client {
-	return ws.uc
+	return ws.upstreamClient
 }
 
 func (ws *WebServer) Shutdown() {
@@ -160,7 +165,7 @@ func (ws *WebServer) listenPlain() {
 
 func (ws *WebServer) serve(listener net.Listener) {
 	srv := &http.Server{
-		Handler: ws.m,
+		Handler: ws.mainRouter,
 	}
 
 	// See https://golang.org/pkg/net/http/#Server.Shutdown
diff --git a/web/packages/sfe/src/index.ts b/web/packages/sfe/src/index.ts
index 4a027bc8fcf7..93620e58edfa 100644
--- a/web/packages/sfe/src/index.ts
+++ b/web/packages/sfe/src/index.ts
@@ -20,6 +20,9 @@ interface GlobalAuthentik {
     brand: {
         branding_logo: string;
     };
+    api: {
+        base: string;
+    };
 }
 
 function ak(): GlobalAuthentik {
@@ -41,7 +44,7 @@ class SimpleFlowExecutor {
     }
 
     get apiURL() {
-        return `/api/v3/flows/executor/${this.flowSlug}/?query=${encodeURIComponent(window.location.search.substring(1))}`;
+        return `${ak().api.base}api/v3/flows/executor/${this.flowSlug}/?query=${encodeURIComponent(window.location.search.substring(1))}`;
     }
 
     start() {
diff --git a/web/src/admin/AdminInterface/AdminSidebar.ts b/web/src/admin/AdminInterface/AdminSidebar.ts
index d2ac78915250..f171c9ce882b 100644
--- a/web/src/admin/AdminInterface/AdminSidebar.ts
+++ b/web/src/admin/AdminInterface/AdminSidebar.ts
@@ -1,5 +1,6 @@
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { EVENT_SIDEBAR_TOGGLE, VERSION } from "@goauthentik/common/constants";
+import { globalAK } from "@goauthentik/common/global";
 import { me } from "@goauthentik/common/users";
 import { AKElement } from "@goauthentik/elements/Base";
 import {
@@ -112,7 +113,7 @@ export class AkAdminSidebar extends WithCapabilitiesConfig(AKElement) {
 
         // prettier-ignore
         const sidebarContent: SidebarEntry[] = [
-            ["/if/user/", msg("User interface"), { "?isAbsoluteLink": true, "?highlight": true }],
+            [`${globalAK().api.base}if/user/`, msg("User interface"), { "?isAbsoluteLink": true, "?highlight": true }],
             [null, msg("Dashboards"), { "?expanded": true }, [
                 ["/administration/overview", msg("Overview")],
                 ["/administration/dashboard/users", msg("User Statistics")],
diff --git a/web/src/admin/users/UserImpersonateForm.ts b/web/src/admin/users/UserImpersonateForm.ts
index 756f1ae7abc8..153a47a039d2 100644
--- a/web/src/admin/users/UserImpersonateForm.ts
+++ b/web/src/admin/users/UserImpersonateForm.ts
@@ -1,4 +1,5 @@
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
+import { globalAK } from "@goauthentik/common/global";
 import "@goauthentik/components/ak-text-input";
 import { Form } from "@goauthentik/elements/forms/Form";
 
@@ -20,7 +21,7 @@ export class UserImpersonateForm extends Form<ImpersonationRequest> {
                 impersonationRequest: data,
             })
             .then(() => {
-                window.location.href = "/";
+                window.location.href = globalAK().api.base;
             });
     }
 
diff --git a/web/src/common/api/config.ts b/web/src/common/api/config.ts
index 52b2f8f55ce4..7464564bd43b 100644
--- a/web/src/common/api/config.ts
+++ b/web/src/common/api/config.ts
@@ -68,7 +68,7 @@ export function getMetaContent(key: string): string {
 }
 
 export const DEFAULT_CONFIG = new Configuration({
-    basePath: (process.env.AK_API_BASE_PATH || window.location.origin) + "/api/v3",
+    basePath: `${globalAK().api.base}api/v3`,
     headers: {
         "sentry-trace": getMetaContent("sentry-trace"),
     },
diff --git a/web/src/common/global.ts b/web/src/common/global.ts
index 990303df0d43..7e6046def236 100644
--- a/web/src/common/global.ts
+++ b/web/src/common/global.ts
@@ -11,6 +11,9 @@ export interface GlobalAuthentik {
     versionFamily: string;
     versionSubdomain: string;
     build: string;
+    api: {
+        base: string;
+    };
 }
 
 export interface AuthentikWindow {
@@ -35,6 +38,9 @@ export function globalAK(): GlobalAuthentik {
             versionFamily: "",
             versionSubdomain: "",
             build: "",
+            api: {
+                base: process.env.AK_API_BASE_PATH || window.location.origin,
+            },
         };
     }
     return ak;
diff --git a/web/src/common/ws.ts b/web/src/common/ws.ts
index 29823d603bcb..8c6c9b26eb21 100644
--- a/web/src/common/ws.ts
+++ b/web/src/common/ws.ts
@@ -1,4 +1,5 @@
 import { EVENT_MESSAGE, EVENT_WS_MESSAGE } from "@goauthentik/common/constants";
+import { globalAK } from "@goauthentik/common/global";
 import { MessageLevel } from "@goauthentik/common/messages";
 
 import { msg } from "@lit/localize";
@@ -21,9 +22,8 @@ export class WebsocketClient {
 
     connect(): void {
         if (navigator.webdriver) return;
-        const wsUrl = `${window.location.protocol.replace("http", "ws")}//${
-            window.location.host
-        }/ws/client/`;
+        const apiURL = new URL(globalAK().api.base);
+        const wsUrl = `${window.location.protocol.replace("http", "ws")}//${apiURL.host}${apiURL.pathname}ws/client/`;
         this.messageSocket = new WebSocket(wsUrl);
         this.messageSocket.addEventListener("open", () => {
             console.debug(`authentik/ws: connected to ${wsUrl}`);
diff --git a/web/src/elements/enterprise/EnterpriseStatusBanner.ts b/web/src/elements/enterprise/EnterpriseStatusBanner.ts
index 34a779db1267..7a7d36208ac7 100644
--- a/web/src/elements/enterprise/EnterpriseStatusBanner.ts
+++ b/web/src/elements/enterprise/EnterpriseStatusBanner.ts
@@ -1,3 +1,4 @@
+import { globalAK } from "@goauthentik/common/global";
 import { AKElement } from "@goauthentik/elements/Base";
 import { WithLicenseSummary } from "@goauthentik/elements/Interface/licenseSummaryProvider";
 
@@ -75,7 +76,9 @@ export class EnterpriseStatusBanner extends WithLicenseSummary(AKElement) {
                 : "pf-m-gold"}"
         >
             ${message}
-            <a href="/if/admin/#/enterprise/licenses"> ${msg("Click here for more info.")} </a>
+            <a href="${globalAK().api.base}if/admin/#/enterprise/licenses"
+                >${msg("Click here for more info.")}</a
+            >
         </div>`;
     }
 
diff --git a/web/src/elements/notifications/APIDrawer.ts b/web/src/elements/notifications/APIDrawer.ts
index 68de3bb57c04..c460a327dc16 100644
--- a/web/src/elements/notifications/APIDrawer.ts
+++ b/web/src/elements/notifications/APIDrawer.ts
@@ -1,5 +1,6 @@
 import { RequestInfo } from "@goauthentik/common/api/middleware";
 import { EVENT_API_DRAWER_TOGGLE, EVENT_REQUEST_POST } from "@goauthentik/common/constants";
+import { globalAK } from "@goauthentik/common/global";
 import { AKElement } from "@goauthentik/elements/Base";
 
 import { msg } from "@lit/localize";
@@ -86,7 +87,9 @@ export class APIDrawer extends AKElement {
                         <h1 class="pf-c-notification-drawer__header-title">
                             ${msg("API Requests")}
                         </h1>
-                        <a href="/api/v3/" target="_blank">${msg("Open API Browser")}</a>
+                        <a href="${globalAK().api.base}api/v3/" target="_blank"
+                            >${msg("Open API Browser")}</a
+                        >
                     </div>
                     <div class="pf-c-notification-drawer__header-action">
                         <div class="pf-c-notification-drawer__header-action-close">
diff --git a/web/src/elements/notifications/NotificationDrawer.ts b/web/src/elements/notifications/NotificationDrawer.ts
index beaae682a685..88c7ad591367 100644
--- a/web/src/elements/notifications/NotificationDrawer.ts
+++ b/web/src/elements/notifications/NotificationDrawer.ts
@@ -1,5 +1,6 @@
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { EVENT_NOTIFICATION_DRAWER_TOGGLE, EVENT_REFRESH } from "@goauthentik/common/constants";
+import { globalAK } from "@goauthentik/common/global";
 import { actionToLabel } from "@goauthentik/common/labels";
 import { MessageLevel } from "@goauthentik/common/messages";
 import { me } from "@goauthentik/common/users";
@@ -100,7 +101,7 @@ export class NotificationDrawer extends AKElement {
                 html`
                     <a
                         class="pf-c-dropdown__toggle pf-m-plain"
-                        href="/if/admin/#/events/log/${item.event?.pk}"
+                        href="${globalAK().api.base}if/admin/#/events/log/${item.event?.pk}"
                     >
                         <pf-tooltip position="top" content=${msg("Show details")}>
                             <i class="fas fa-share-square"></i>
diff --git a/web/src/elements/sidebar/SidebarUser.ts b/web/src/elements/sidebar/SidebarUser.ts
index 4408fc0df711..3f39263129b6 100644
--- a/web/src/elements/sidebar/SidebarUser.ts
+++ b/web/src/elements/sidebar/SidebarUser.ts
@@ -1,3 +1,4 @@
+import { globalAK } from "@goauthentik/common/global";
 import { me } from "@goauthentik/common/users";
 import { AKElement } from "@goauthentik/elements/Base";
 
@@ -35,7 +36,11 @@ export class SidebarUser extends AKElement {
 
     render(): TemplateResult {
         return html`
-            <a href="/if/user/#/settings" class="pf-c-nav__link user-avatar" id="user-settings">
+            <a
+                href="${globalAK().api.base}if/user/#/settings"
+                class="pf-c-nav__link user-avatar"
+                id="user-settings"
+            >
                 ${until(
                     me().then((u) => {
                         return html`<img
@@ -47,7 +52,11 @@ export class SidebarUser extends AKElement {
                     html``,
                 )}
             </a>
-            <a href="/flows/-/default/invalidation/" class="pf-c-nav__link user-logout" id="logout">
+            <a
+                href="${globalAK().api.base}flows/-/default/invalidation/"
+                class="pf-c-nav__link user-logout"
+                id="logout"
+            >
                 <i class="fas fa-sign-out-alt" aria-hidden="true"></i>
             </a>
         `;
diff --git a/web/src/flow/FlowExecutor.ts b/web/src/flow/FlowExecutor.ts
index 72be3ebadfc8..1375e6430c26 100644
--- a/web/src/flow/FlowExecutor.ts
+++ b/web/src/flow/FlowExecutor.ts
@@ -461,6 +461,7 @@ export class FlowExecutor extends Interface implements StageHost {
         await import("@goauthentik/flow/FlowInspector");
         return html`<ak-flow-inspector
             class="pf-c-drawer__panel pf-m-width-33"
+            .flowSlug=${this.flowSlug}
         ></ak-flow-inspector>`;
     }
 
diff --git a/web/src/flow/FlowInspector.ts b/web/src/flow/FlowInspector.ts
index d9a14211348b..8f8ba27f979e 100644
--- a/web/src/flow/FlowInspector.ts
+++ b/web/src/flow/FlowInspector.ts
@@ -19,7 +19,8 @@ import { FlowInspection, FlowsApi, ResponseError, Stage } from "@goauthentik/api
 
 @customElement("ak-flow-inspector")
 export class FlowInspector extends AKElement {
-    flowSlug: string;
+    @property()
+    flowSlug?: string;
 
     @property({ attribute: false })
     state?: FlowInspection;
@@ -55,7 +56,6 @@ export class FlowInspector extends AKElement {
 
     constructor() {
         super();
-        this.flowSlug = window.location.pathname.split("/")[3];
         window.addEventListener(EVENT_FLOW_ADVANCE, this.advanceHandler as EventListener);
     }
 
@@ -67,7 +67,7 @@ export class FlowInspector extends AKElement {
     advanceHandler = (): void => {
         new FlowsApi(DEFAULT_CONFIG)
             .flowsInspectorGet({
-                flowSlug: this.flowSlug,
+                flowSlug: this.flowSlug || "",
             })
             .then((state) => {
                 this.error = undefined;
diff --git a/web/src/flow/providers/SessionEnd.ts b/web/src/flow/providers/SessionEnd.ts
index 4df09411f2a1..3e58d70d0129 100644
--- a/web/src/flow/providers/SessionEnd.ts
+++ b/web/src/flow/providers/SessionEnd.ts
@@ -1,3 +1,4 @@
+import { globalAK } from "@goauthentik/common/global";
 import "@goauthentik/flow/FormStatic";
 import { BaseStage } from "@goauthentik/flow/stages/base";
 
@@ -47,7 +48,9 @@ export class SessionEnd extends BaseStage<SessionEndChallenge, unknown> {
                             str`You've logged out of ${this.challenge.applicationName}. You can go back to the overview to launch another application, or log out of your authentik account.`,
                         )}
                     </p>
-                    <a href="/" class="pf-c-button pf-m-primary"> ${msg("Go back to overview")} </a>
+                    <a href="${globalAK().api.base}" class="pf-c-button pf-m-primary">
+                        ${msg("Go back to overview")}
+                    </a>
                     ${this.challenge.invalidationFlowUrl
                         ? html`
                               <a
diff --git a/web/src/user/LibraryApplication/index.ts b/web/src/user/LibraryApplication/index.ts
index 2a91dc62d525..76d88b79228b 100644
--- a/web/src/user/LibraryApplication/index.ts
+++ b/web/src/user/LibraryApplication/index.ts
@@ -1,4 +1,5 @@
 import { PFSize } from "@goauthentik/common/enums.js";
+import { globalAK } from "@goauthentik/common/global";
 import { truncateWords } from "@goauthentik/common/utils";
 import "@goauthentik/elements/AppIcon";
 import { AKElement, rootInterface } from "@goauthentik/elements/Base";
@@ -77,7 +78,8 @@ export class LibraryApplication extends AKElement {
                 ? html`
                       <a
                           class="pf-c-button pf-m-control pf-m-small pf-m-block"
-                          href="/if/admin/#/core/applications/${application?.slug}"
+                          href="${globalAK().api
+                              .base}if/admin/#/core/applications/${application?.slug}"
                       >
                           <i class="fas fa-edit"></i>&nbsp;${msg("Edit")}
                       </a>
diff --git a/web/src/user/LibraryPage/ak-library-application-empty-list.ts b/web/src/user/LibraryPage/ak-library-application-empty-list.ts
index e364bb3b3dcb..6965d4b91c8f 100644
--- a/web/src/user/LibraryPage/ak-library-application-empty-list.ts
+++ b/web/src/user/LibraryPage/ak-library-application-empty-list.ts
@@ -1,4 +1,4 @@
-import { docLink } from "@goauthentik/common/global";
+import { docLink, globalAK } from "@goauthentik/common/global";
 import { AKElement } from "@goauthentik/elements/Base";
 import { paramURL } from "@goauthentik/elements/router/RouterOutlet";
 
@@ -49,7 +49,7 @@ export class LibraryPageApplicationEmptyList extends AKElement {
                 <a
                     aria-disabled="false"
                     class="cta pf-c-button pf-m-secondary"
-                    href="/if/admin/${href}"
+                    href="${globalAK().api.base}if/admin/${href}"
                     >${msg("Create a new application")}</a
                 >
             </div>
diff --git a/web/src/user/UserInterface.ts b/web/src/user/UserInterface.ts
index 175d7efd5ac2..dca7fcb2966d 100644
--- a/web/src/user/UserInterface.ts
+++ b/web/src/user/UserInterface.ts
@@ -4,6 +4,7 @@ import {
     EVENT_NOTIFICATION_DRAWER_TOGGLE,
     EVENT_WS_MESSAGE,
 } from "@goauthentik/common/constants";
+import { globalAK } from "@goauthentik/common/global";
 import { configureSentry } from "@goauthentik/common/sentry";
 import { UIConfig, UserDisplay } from "@goauthentik/common/ui/config";
 import { me } from "@goauthentik/common/users";
@@ -207,7 +208,7 @@ class UserInterfacePresentation extends AKElement {
                             ${this.renderSettings()}
                             <div class="pf-c-page__header-tools-item">
                                 <a
-                                    href="/flows/-/default/invalidation/"
+                                    href="${globalAK().api.base}flows/-/default/invalidation/"
                                     class="pf-c-button pf-m-plain"
                                 >
                                     <pf-tooltip position="top" content=${msg("Sign out")}>
@@ -349,7 +350,7 @@ class UserInterfacePresentation extends AKElement {
 
         return html`<a
             class="pf-c-button pf-m-secondary pf-m-small pf-u-display-none pf-u-display-block-on-md"
-            href="/if/admin/"
+            href="${globalAK().api.base}if/admin/"
         >
             ${msg("Admin interface")}
         </a>`;
diff --git a/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts b/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts
index f362f3e2fef2..4ad334e59e6b 100644
--- a/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts
+++ b/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts
@@ -1,5 +1,6 @@
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { EVENT_REFRESH } from "@goauthentik/common/constants";
+import { globalAK } from "@goauthentik/common/global";
 import { MessageLevel } from "@goauthentik/common/messages";
 import { refreshMe } from "@goauthentik/common/users";
 import { AKElement } from "@goauthentik/elements/Base";
@@ -173,7 +174,10 @@ export class UserSettingsFlowExecutor
                     `authentik/user/flows: unsupported stage type ${this.challenge.component}`,
                 );
                 return html`
-                    <a href="/if/flow/${this.flowSlug}/" class="pf-c-button pf-m-primary">
+                    <a
+                        href="${globalAK().api.base}if/flow/${this.flowSlug}/"
+                        class="pf-c-button pf-m-primary"
+                    >
                         ${msg("Open settings")}
                     </a>
                 `;
diff --git a/web/src/user/user-settings/details/stages/prompt/PromptStage.ts b/web/src/user/user-settings/details/stages/prompt/PromptStage.ts
index 3511f938d4c1..1c06efb89fba 100644
--- a/web/src/user/user-settings/details/stages/prompt/PromptStage.ts
+++ b/web/src/user/user-settings/details/stages/prompt/PromptStage.ts
@@ -1,3 +1,4 @@
+import { globalAK } from "@goauthentik/common/global";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import { PromptStage } from "@goauthentik/flow/stages/prompt/PromptStage";
 
@@ -50,7 +51,8 @@ export class UserSettingsPromptStage extends PromptStage {
                     ${this.host.brand?.flowUnenrollment
                         ? html` <a
                               class="pf-c-button pf-m-danger"
-                              href="/if/flow/${this.host.brand.flowUnenrollment}/"
+                              href="${globalAK().api.base}if/flow/${this.host.brand
+                                  .flowUnenrollment}/"
                           >
                               ${msg("Delete account")}
                           </a>`
diff --git a/website/docs/install-config/configuration/configuration.mdx b/website/docs/install-config/configuration/configuration.mdx
index 1bf72fa6b800..728bc4e8ea5b 100644
--- a/website/docs/install-config/configuration/configuration.mdx
+++ b/website/docs/install-config/configuration/configuration.mdx
@@ -345,6 +345,16 @@ Configure Celery worker concurrency for authentik worker (see https://docs.celer
 
 Defaults to 2.
 
+### `AUTHENTIK_WEB__PATH`
+
+:::info
+Requires authentik 2024.8
+:::
+
+Configure the path under which authentik is serverd. For example to access authentik under `https://my.domain/authentik/`, set this to `/authentik/`. Value _must_ contain both a leading and trailing slash.
+
+Defaults to `/`.
+
 ## System settings <span class="badge badge--version">authentik 2024.2+</span>
 
 Additional settings are configurable using the Admin interface, under **System** -> **Settings** or using the API.
diff --git a/website/docs/install-config/reverse-proxy.md b/website/docs/install-config/reverse-proxy.md
index 6dd6ecbba7a0..340cf35beecc 100644
--- a/website/docs/install-config/reverse-proxy.md
+++ b/website/docs/install-config/reverse-proxy.md
@@ -51,6 +51,8 @@ server {
     add_header Strict-Transport-Security "max-age=63072000" always;
 
     # Proxy site
+    # Location can be set to a subpath if desired, see documentation linked below:
+    # https://goauthentik.io/docs/installation/configuration#authentik_web__path
     location / {
         proxy_pass https://authentik;
         proxy_http_version 1.1;

From 709e413e4657e1a4ed7244e63c7dfbffddf64427 Mon Sep 17 00:00:00 2001
From: Zuri Klaschka <pklaschka@users.noreply.github.com>
Date: Tue, 26 Nov 2024 16:51:01 +0100
Subject: [PATCH 6/7] website/docs: Fix documentation about attribute merging
 for indirect membership (#12168)

While for role memberships, it is true that they are only applied for _direct_ memberships, this does not appear to be the case for attributes (which is good as this also follows the "Hierarchy" system documented in the same file).

In terms of the implementation, this is the case due to the call to `all_groups()` in https://github.com/goauthentik/authentik/blob/3d5a189fa732ef462dbbd73b88c128ebaf1833f9/authentik/core/models.py#L312-L313, introduced in https://github.com/goauthentik/authentik/pull/6017. Looking through the files in there, it is clear that this line in the documentation is from before that point: https://github.com/goauthentik/authentik/blob/95e60a035df11d6f89db18cba3ae978d13d212b8/website/docs/user-group/group.md?plain=1#L15.

tl;dr: the documentation was correct before #6017, but is now out of date. This change fixes that.

Signed-off-by: Zuri Klaschka <pklaschka@users.noreply.github.com>
---
 website/docs/users-sources/groups/index.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/docs/users-sources/groups/index.mdx b/website/docs/users-sources/groups/index.mdx
index ea934547b143..03ff4a920699 100644
--- a/website/docs/users-sources/groups/index.mdx
+++ b/website/docs/users-sources/groups/index.mdx
@@ -13,4 +13,4 @@ Recursion is limited to 20 levels to prevent deadlocks.
 
 ## Attributes
 
-Attributes of groups are recursively merged, for all groups the user is a _direct_ member of.
+Attributes of groups are recursively merged, for all groups the user is a member of.

From 1daa5315d76ba1243a97ea3290fa728bed025037 Mon Sep 17 00:00:00 2001
From: Zuri Klaschka <pklaschka@users.noreply.github.com>
Date: Tue, 26 Nov 2024 17:23:29 +0100
Subject: [PATCH 7/7] website/docs: Add note about single group per role
 (#12169)

This change adds an admonition to document the fact that every role can only ever be assigned to a single group at the same time. Since this is surprising based on a traditional understanding of role-based models, I've decided to make this a `:::warning`.

I'm undecided on the best place for this information, but for now, decided on putting it into the context of the action that can fail: assigning a role to a group.

While this does not close the issue, it documents this behavior to at least address the "needs documentation" aspect of #10983 .

Signed-off-by: Zuri Klaschka <pklaschka@users.noreply.github.com>
---
 website/docs/users-sources/roles/manage_roles.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/website/docs/users-sources/roles/manage_roles.md b/website/docs/users-sources/roles/manage_roles.md
index 765772a2b6de..2d73cb9406a8 100644
--- a/website/docs/users-sources/roles/manage_roles.md
+++ b/website/docs/users-sources/roles/manage_roles.md
@@ -37,6 +37,10 @@ To delete a role, follow these steps:
 
 In authentik, roles are assigned to [groups](../groups/index.mdx), not to individual users.
 
+:::warning
+In authentik, each role can only be applied to a single group at the moment.
+:::
+
 1.  To assign the role to a group, navigate to **Directory -> Groups**.
 2.  Click the name of the group to which you want to add a role.
 3.  On the group's detail page, on the Overview tab, click **Edit** in the **Group Info** area.