login notification

[blackneil]

Hello,

I'm trying to configure a notification rule to send an email to the users at the login, logout and when a login fail.

No issue with the send email but I need to "negate" the result for the login policy and I receive a lot of email "model_updated". No idea why.

Also if someone can provide information to replace the "Context" inside the notification email by the "Event info", that would be greatly appreciated.

Regards
Neil

[dev-rehaann]

Do not negate the login matcher. A negated action=login policy means “every event except login,” so model_updated and many unrelated audit events correctly pass it.

Create three Event Matcher policies with these exact actions and bind all three to one notification rule:

login
logout
login_failed

Notification-rule policies are evaluated in ANY mode, so one matching action is sufficient. For login and logout, enable Send notification to event user. I would put login_failed in a separate rule sent to an admin/security group: failed-login events can belong to AnonymousUser (for example when the supplied username is invalid), so authentik cannot always resolve a real destination user, and emailing on every failure can also become a mail-flood vector.

For the wording: “Event info” is a label in the Admin UI, not a separate email field that can replace “Context.” The stock notification body is generated from Event.summary (action: context). If you need a curated end-user message, use an Expression policy with ak_send_email() and format only fields such as action, time, client IP, and user agent, or configure a custom notification email template. There is no simple Context/Event-info toggle.

References: Event Matcher policy, notification rules, and event actions.

[blackneil]

I come to look my configuration and it's seems to be what you tell.

I'm looking for the Expression policy, thanks !