Where are the fallback entries coming from?

[Tealk]

I've been analyzing our authentication logs and noticed a significant number of entries labeled as "Brand fallback" and "Default brand". Looking at the activity log, I can see:

• Multiple "Email sent" events marked with Brand fallback
• Several "User was written to" and "Model created" events with Default brand
• All of these entries appear consecutively within the same timeframe

Where are these fallback entries being generated from?

[rissson]

This happens when authentik can't find a matching brand, for instance when there is no HTTP request in the context where the event is created to associate the event to.

If an HTTP request is available, but there is no matching brand and there is no default brand, we also use a dummy fallback brand.

See https://github.com/goauthentik/authentik/blob/main/authentik/brands/utils.py#L17

[Tealk]

Everything works, only in the log I see the entries for mail dispatch.

The API shows the domain correctly:
HTTP_HOST "auth.rollenspiel.monster"

[rissson]

Ah yeah, I see. Then yes, that is expected behaviour.

[Tealk]

Wait, why is it expected that the fallback is used even though there's a brand with the correct domain?

[rissson]

Because the worker cannot know which domain to look up in a task context