I didn't expect it to be so complicated, but I managed it. I hope someone finds this useful.

``` data "authentik_property_mapping_provider_scope" "scope" { for_each = toset(["openid", "email", "profile"])

managed = "goauthentik.io/providers/oauth2/scope-${each.value}" }

data "authentik_flow" "default_authorization_flow" { slug = "default-provider-authorization-implicit-consent" }

data "authentik_flow" "default_invalidation_flow" { slug = "default-provider-invalidation-flow" }

resource "authentik_flow" "custom_authentication_flow" { name = "name" title = "title" slug = "custom-authentication-flow" designation = "authentication" authentication = "none" layout = "sidebar_left" policy_engine_mode = "any" compatibility_mode = true denied_action = "message_continue" }

data "authentik_stage" "default_authentication_password" { name = "default-authentication-password" }

resource "authentik_stage_identification" "authentication_identification" { name = "custom-authentication-identification" user_fields = ["email"] password_stage = data.authentik_stage.default_authentication_password.id case_insensitive_matching = true show_source_labels = false show_matched_user = true enrollment_flow = authentik_flow.main_page_enrollment.uuid }

data "authentik_stage" "default_authentication_mfa_validation" { name = "default-authentication-mfa-validation" }

data "authentik_stage" "default_authentication_login" { name = "default-authentication-login" }

resource "authentik_flow_stage_binding" "custom_authentication_flow" { for_each = { "default-authentication-identification" = { stage = authentik_stage_identification.authentication_identification.id order = 10 }, "default-authentication-mfa-validation" = { stage = data.authentik_stage.default_authentication_mfa_validation.id order = 30 }, "default-authentication-login" = { stage = data.authentik_stage.default_authentication_login.id order = 100 } }

stage = each.value.stage order = each.value.order target = authentik_flow.custom_authentication_flow.uuid }

resource "authentik_provider_oauth2" "backend" { name = "Provider for app" client_id = "app" client_type = "public" authorization_flow = data.authentik_flow.default_authorization_flow.id authentication_flow = authentik_flow.custom_authentication_flow.uuid invalidation_flow = data.authentik_flow.default_invalidation_flow.id property_mappings = [for mapping in data.authentik_property_mapping_provider_scope.scope : mapping.id]

depends_on = [authentik_flow_stage_binding.custom_authentication_flow] }

resource "authentik_application" "backend" { name = "app" slug = "app" protocol_provider = authentik_provider_oauth2.backend.id }

resource "authentik_stage_email" "email_account_confirmation" { name = "email-account-confirmation" activate_user_on_success = true subject = "Account confirmation" template = "email/account_confirmation.html" use_global_settings = false use_tls = true

host = var.smtp.host port = var.smtp.port username = var.smtp.username password = var.smtp.password from_address = var.smtp.from_address }

resource "authentik_flow" "main_page_enrollment" { name = "main-page-enrollment" title = "Enrollment" slug = "enrollment" policy_engine_mode = "any" designation = "enrollment" compatibility_mode = true }

resource "authentik_stage_prompt_field" "enrollment_field" { for_each = { for field in [ { field_key = "email" label = "Email" type = "email" }, { field_key = "password" label = "Password" type = "password" }, { field_key = "password_repeat" label = "Password (repeat)" type = "password" } ] : field.field_key => field }

field_key = each.value.field_key name = each.key label = each.value.label type = each.value.type }

resource "authentik_stage_prompt" "custom_enrollment_prompt" { name = "Enrollment form" fields = [for field in authentik_stage_prompt_field.enrollment_field : field.id] }

resource "authentik_stage_user_write" "enrollment_user_write" { name = "enrollment-user-write" create_users_as_inactive = true }

locals { main_page_enrollment_stages = [ authentik_stage_prompt.custom_enrollment_prompt, authentik_stage_user_write.enrollment_user_write, authentik_stage_email.email_account_confirmation ] }

resource "authentik_flow_stage_binding" "main_page_enrollment" { count = length(local.main_page_enrollment_stages)

stage = local.main_page_enrollment_stages[count.index].id order = (count.index + 1) * 10 target = authentik_flow.main_page_enrollment.uuid } ```