version: 1
metadata:
  name: Xiteng - Passkey passwordless login
entries:
  - model: authentik_stages_identification.identificationstage
    state: present
    identifiers:
      name: default-authentication-identification
    attrs:
      user_fields:
        - email
        - username
      password_stage: null
      captcha_stage: null
      webauthn_stage: !Find [authentik_stages_authenticator_validate.authenticatorvalidatestage, [name, default-authentication-mfa-validation]]
      case_insensitive_matching: true
      show_matched_user: true
      pretend_user_exists: true
      enable_remember_me: false
      enrollment_flow: null
      recovery_flow: null
      passwordless_flow: null
      show_source_labels: false

  # Authentik 2026.5 ships the password/MFA skip policies in its default
  # authentication blueprint. Remove the temporary local copies if present.
  - model: authentik_policies_expression.expressionpolicy
    state: absent
    identifiers:
      name: xiteng-authentication-password-optional

  - model: authentik_policies_expression.expressionpolicy
    state: absent
    identifiers:
      name: xiteng-authentication-mfa-after-passkey