Authentik 2025.10.3: Email Verification in OIDC Enrollment

This guide is checked against the Authentik 2025.10.3 enrollment-with-email-verification blueprint used by the deployed Oracle stack. The key setting is that users must remain inactive until they confirm their email.

Symptoms

A user registers through an email-verification enrollment flow, clicks the confirmation link, and then cannot sign in or continue to the OIDC application. Seeing Authentik’s login screen after confirmation does not by itself prove that OIDC failed: the flow must complete user login, and the original application authorization request may need to be resumed or started again if it has expired.

Check the user and stage settings

In the 2025.10.3 bundled blueprint, the User Write stage creates the account as inactive. The Email stage activates it only after a valid confirmation link is opened. If User Write creates active accounts before verification, the email stage is not enforcing a verification gate.

# User Write stage settings
create_users_as_inactive: true
user_creation_mode: always_create

# Email stage setting
activate_user_on_success: true

These are configuration fragments, not a complete importable blueprint. Preserve your own flow IDs, prompt fields, email settings, bindings, groups, and policies.

Check the enrollment stage order

The bundled 2025.10.3 example binds stages in this order:

1. Credential prompt — order 10
2. Name and email prompt — order 11
3. User Write — order 20
4. Email verification — order 30
5. User Login — order 100

Export or back up your existing flow before changing it. Compare it with the official Authentik 2025.10.3 email-verification blueprint; do not import a generic replacement over customized flows without reviewing the changes.

Test the complete sign-up and OIDC path

1. Use a test account and start enrollment from the application.
2. Confirm the new user is inactive before opening the email link.
3. Open the confirmation link and confirm the Email stage succeeds and the user becomes active.
4. Confirm the User Login stage creates an Authentik session.
5. Return to the application and verify that its OIDC callback completes. If the original authorization request has expired, start sign-in again from the application.

If the account remains inactive, check the Email stage result, its activation setting, and the flow execution in Authentik. If the account is active but the app does not receive an OIDC callback, inspect the application’s authorization flow and the active browser request separately; changing enrollment stage order alone does not prove that an OIDC request was preserved.

Version references

• Bundled 2025.10.3 blueprint — stage settings and binding order.
• Authentik 2025.10 email configuration — global and per-stage email setup.
• Authentik example flows — enrollment verification and flow import guidance.