Skip to main content

Integrate with Weblate

Support level: Community

What is Weblate?​

Weblate is a copylefted libre software web-based continuous localization system, used by over 2500 libre projects and companies in more than 165 countries.

-- https://weblate.org/

Preparation​

The following placeholders are used in this guide:

  • weblate.company is the FQDN of the Weblate installation.
  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

authentik configuration​

SAML provider changes in authentik 2026.5

authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/

Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.

To support the integration of Weblate with authentik, you need to create SAML property mappings and an application/provider pair in authentik.

Create property mappings​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Customization > Property Mappings and click Create.
  3. Create the following SAML Provider Property Mappings:

    • Name: Weblate full name

      • SAML Attribute Name: urn:oid:2.5.4.3

      • Expression:

        return request.user.name

    • Name: Weblate username

      • SAML Attribute Name: urn:oid:0.9.2342.19200300.100.1.1

      • Expression:

        return request.user.username

    • Name: Weblate email

      • SAML Attribute Name: urn:oid:0.9.2342.19200300.100.1.3

      • Expression:

        return request.user.email

Create an application and provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the Slug value because it will be required later.
    • Choose a Provider type: select SAML Provider as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Set the ACS URL to https://weblate.company/accounts/complete/saml/.
      • Set the Audience to https://weblate.company/accounts/metadata/saml/.
      • Under Advanced protocol settings:
        • Select an available Signing Certificate.
        • Add the property mappings that you created in the previous section to Property mappings.
        • Set Default relay state to weblate.
        • Set Service Provider Binding to Post.
        • Set Default NameID Policy to Persistent.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

  3. Click Submit to save the new application and provider.

  4. Open the provider that you created, expand Related objects, and copy the signing certificate from Download signing certificate. You will use the certificate value when configuring Weblate.

Weblate configuration​

The SAML identity provider in Weblate must be named weblate.

Configure a Docker installation​

If you run Weblate with Docker, set the following environment variables:

.env
WEBLATE_ENABLE_HTTPS=1
WEBLATE_SAML_IDP_ENTITY_ID=https://authentik.company/application/saml/<application_slug>/metadata/
WEBLATE_SAML_IDP_URL=https://authentik.company/application/saml/<application_slug>/
WEBLATE_SAML_IDP_X509CERT=<signing_certificate>

To require users to authenticate with SAML, also set the following environment variables:

.env
WEBLATE_REGISTRATION_OPEN=0
WEBLATE_REGISTRATION_ALLOW_BACKENDS=saml
WEBLATE_REQUIRE_LOGIN=1
WEBLATE_NO_EMAIL_AUTH=1

Set WEBLATE_SAML_IDP_X509CERT to the certificate body from the authentik signing certificate. Remove the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

Configure a non-container installation​

For a non-container installation, install Weblate with the saml extra, create a SAML certificate and private key for Weblate, add the SAML authentication backend, and configure the authentik identity provider in your Weblate settings.

settings.py
ENABLE_HTTPS = True

AUTHENTICATION_BACKENDS = (
    "social_core.backends.email.EmailAuth",
    "social_core.backends.saml.SAMLAuth",
    "weblate.accounts.auth.WeblateUserBackend",
)

SOCIAL_AUTH_SAML_SP_PUBLIC_CERT = """
<weblate_saml_public_certificate>
"""
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY = """
<weblate_saml_private_key>
"""

SOCIAL_AUTH_SAML_ENABLED_IDPS = {
    "weblate": {
        "entity_id": "https://authentik.company/application/saml/<application_slug>/metadata/",
        "url": "https://authentik.company/application/saml/<application_slug>/",
        "x509cert": "<signing_certificate>",
    },
}

To require users to authenticate with SAML, disable open registration, allow SAML-created accounts, require login, and remove social_core.backends.email.EmailAuth from AUTHENTICATION_BACKENDS.

Configuration verification​

To confirm that authentik is properly configured with Weblate, log out of Weblate and open the integration. You should be redirected to authentik and returned to Weblate after authentication.

Resources​