diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml index e94cb1b1b..9571705f6 100644 --- a/.github/FUNDING.yml +++ b/.github/FUNDING.yml @@ -3,7 +3,7 @@ # github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2] # patreon: # Replace with a single Patreon username -open_collective: authelia-sponsors +open_collective: 'authelia-sponsors' # ko_fi: # Replace with a single Ko-fi username # tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel # community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry diff --git a/.github/ISSUE_TEMPLATE/bug-report.yml b/.github/ISSUE_TEMPLATE/bug-report.yml index 5edf31148..aad2618b9 100644 --- a/.github/ISSUE_TEMPLATE/bug-report.yml +++ b/.github/ISSUE_TEMPLATE/bug-report.yml @@ -1,12 +1,12 @@ --- -name: Bug Report -description: Report a bug +name: 'Bug Report' +description: 'Report a bug' labels: - - type/bug/unconfirmed - - status/needs-triage - - priority/4/normal + - 'type/bug/unconfirmed' + - 'status/needs-triage' + - 'priority/4/normal' body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first. @@ -25,160 +25,190 @@ body: - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section. - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section. 7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues. - - type: dropdown - id: version + - type: 'dropdown' + id: 'version' attributes: - label: Version - description: What version(s) of Authelia can you reproduce this bug on? + label: | + Version + description: | + What version(s) of Authelia can you reproduce this bug on? multiple: true options: - - v4.37.5 - - v4.37.4 - - v4.37.3 - - v4.37.2 - - v4.37.1 - - v4.37.0 - - v4.36.9 - - v4.36.8 - - v4.36.7 - - v4.36.6 - - v4.36.5 - - v4.36.4 - - v4.36.3 - - v4.36.2 - - v4.36.1 - - v4.36.0 - - v4.35.6 - - v4.35.5 - - v4.35.4 - - v4.35.3 - - v4.35.2 - - v4.35.1 - - v4.35.0 - - v4.34.6 - - v4.34.5 - - v4.34.4 - - v4.34.3 - - v4.34.2 - - v4.34.1 - - v4.34.0 - - v4.33.2 - - v4.33.1 - - v4.33.0 - - v4.32.2 - - v4.32.1 - - v4.32.0 + - 'v4.37.5' + - 'v4.37.4' + - 'v4.37.3' + - 'v4.37.2' + - 'v4.37.1' + - 'v4.37.0' + - 'v4.36.9' + - 'v4.36.8' + - 'v4.36.7' + - 'v4.36.6' + - 'v4.36.5' + - 'v4.36.4' + - 'v4.36.3' + - 'v4.36.2' + - 'v4.36.1' + - 'v4.36.0' + - 'v4.35.6' + - 'v4.35.5' + - 'v4.35.4' + - 'v4.35.3' + - 'v4.35.2' + - 'v4.35.1' + - 'v4.35.0' + - 'v4.34.6' + - 'v4.34.5' + - 'v4.34.4' + - 'v4.34.3' + - 'v4.34.2' + - 'v4.34.1' + - 'v4.34.0' + - 'v4.33.2' + - 'v4.33.1' + - 'v4.33.0' + - 'v4.32.2' + - 'v4.32.1' + - 'v4.32.0' validations: required: true - - type: dropdown - id: deployment + - type: 'dropdown' + id: 'deployment' attributes: - label: Deployment Method - description: How are you deploying Authelia? + label: | + Deployment Method + description: | + How are you deploying Authelia? options: - - Docker - - Kubernetes - - Bare-metal - - Other + - 'Docker' + - 'Kubernetes' + - 'Bare-metal' + - 'Other' validations: required: true - - type: dropdown - id: proxy + - type: 'dropdown' + id: 'proxy' attributes: - label: Reverse Proxy - description: What reverse proxy are you using? + label: | + Reverse Proxy + description: | + What reverse proxy are you using? options: - - Caddy - - Traefik - - Envoy - - Istio - - NGINX - - SWAG - - NGINX Proxy Manager - - HAProxy + - 'Caddy' + - 'Traefik' + - 'Envoy' + - 'Istio' + - 'NGINX' + - 'SWAG' + - 'NGINX Proxy Manager' + - 'HAProxy' validations: required: true - - type: input - id: proxy-version + - type: 'input' + id: 'proxy-version' attributes: - label: Reverse Proxy Version - description: What is the version of your reverse proxy? - placeholder: x.x.x + label: | + Reverse Proxy Version + description: | + What is the version of your reverse proxy? + placeholder: 'x.x.x' validations: required: false - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the bug. + label: | + Description + description: | + Describe the bug. validations: required: true - - type: textarea - id: reproduction + - type: 'textarea' + id: 'reproduction' attributes: - label: Reproduction - description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. + label: | + Reproduction + description: | + Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. validations: required: true - - type: textarea - id: expectations + - type: 'textarea' + id: 'expectations' attributes: - label: Expectations - description: Describe the desired or expected results. + label: | + Expectations + description: | + Describe the desired or expected results. validations: required: false - - type: textarea - id: configuration + - type: 'textarea' + id: 'configuration' attributes: - label: Configuration (Authelia) - description: Provide a complete configuration file (the template will automatically put this content in a code block). - render: yaml + label: | + Configuration (Authelia) + description: | + Provide a complete configuration file (the template will automatically put this content in a code block). + render: 'yaml' validations: required: false - - type: textarea - id: logs + - type: 'textarea' + id: 'logs' attributes: - label: Logs (Authelia) + label: | + Logs (Authelia) description: | Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide. The template will automatically put this content in a code block so you can just paste it. - render: shell + render: 'shell' validations: required: true - - type: textarea - id: logs-other + - type: 'textarea' + id: 'logs-other' attributes: - label: Logs (Proxy / Application) - description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). - render: shell + label: | + Logs (Proxy / Application) + description: | + Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). + render: 'shell' validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable. + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable. validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following. + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following. options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: This is a bug report and not a support request + - label: | + This is a bug report and not a support request required: true - - label: I have read the security policy and this bug report is not a security issue or security related issue + - label: | + I have read the security policy and this bug report is not a security issue or security related issue required: true - - label: I have either included the complete configuration file or I am sure it's unrelated to the configuration + - label: | + I have either included the complete configuration file or I am sure it's unrelated to the configuration required: true - - label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide + - label: | + I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide required: true - - label: I have checked for related proxy or application logs and included them if available + - label: | + I have checked for related proxy or application logs and included them if available required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 2a89a14ac..1bf5a3b93 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,22 +1,22 @@ --- blank_issues_enabled: false contact_links: - - name: Idea - url: https://github.com/authelia/authelia/discussions/new?category=ideas - about: Submit an Idea for Voting - - name: Question - url: https://github.com/authelia/authelia/discussions/new?category=q-a - about: Ask a Question - - name: Discussion - url: https://github.com/authelia/authelia/discussions/new - about: Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics - - name: Documentation - url: https://www.authelia.com/ - about: Read the Documentation - - name: Matrix - url: https://matrix.to/#/#community:authelia.com - about: Discuss Authelia with the Developers on Matrix which is the preferred method of contact - - name: Discord - url: https://discord.authelia.com - about: Discuss Authelia with the Developers on Discord which is bridged to Matrix + - name: 'Idea' + url: 'https://github.com/authelia/authelia/discussions/new?category=ideas' + about: 'Submit an Idea for Voting' + - name: 'Question' + url: 'https://github.com/authelia/authelia/discussions/new?category=q-a' + about: 'Ask a Question' + - name: 'Discussion' + url: 'https://github.com/authelia/authelia/discussions/new' + about: 'Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics' + - name: 'Documentation' + url: 'https://www.authelia.com/' + about: 'Read the Documentation' + - name: 'Matrix' + url: 'https://matrix.to/#/#community:authelia.com' + about: 'Discuss Authelia with the Developers on Matrix which is the preferred method of contact' + - name: 'Discord' + url: 'https://discord.authelia.com' + about: 'Discuss Authelia with the Developers on Discord which is bridged to Matrix' ... diff --git a/.github/ISSUE_TEMPLATE/feature-request.yml b/.github/ISSUE_TEMPLATE/feature-request.yml index 607f832ff..4cd251a9a 100644 --- a/.github/ISSUE_TEMPLATE/feature-request.yml +++ b/.github/ISSUE_TEMPLATE/feature-request.yml @@ -1,12 +1,12 @@ --- -name: Feature Request -description: Submit a Feature Request +name: 'Feature Request' +description: 'Submit a Feature Request' labels: - - type/feature - - status/needs-design - - priority/4/normal + - 'type/feature' + - 'status/needs-design' + - 'priority/4/normal' body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature. @@ -16,42 +16,54 @@ body: 1. Ensure there are no other similar feature requests. 2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already. 3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist. - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the feature + label: | + Description + description: | + Describe the feature validations: required: true - - type: textarea - id: use-case + - type: 'textarea' + id: 'use-case' attributes: - label: Use Case - description: Provide a use case + label: | + Use Case + description: | + Provide a use case validations: required: true - - type: textarea - id: details + - type: 'textarea' + id: 'details' attributes: - label: Details - description: Describe the feature in detail + label: | + Details + description: | + Describe the feature in detail validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/.yamllint.yml b/.yamllint.yml index 66bafeb8f..c5cb4ee41 100644 --- a/.yamllint.yml +++ b/.yamllint.yml @@ -11,6 +11,7 @@ yaml-files: ignore: | api/openapi.yml docs/pnpm-lock.yaml + docs/node_modules/ internal/configuration/test_resources/config_bad_quoting.yml web/pnpm-lock.yaml web/node_modules/ diff --git a/Dockerfile.coverage b/Dockerfile.coverage index d601b6b40..0b43f5ae3 100644 --- a/Dockerfile.coverage +++ b/Dockerfile.coverage @@ -15,7 +15,7 @@ RUN yarn global add pnpm && \ # ======================================= # ===== Build image for the backend ===== # ======================================= -FROM golang:1.20.3-alpine AS builder-backend +FROM golang:1.20.4-alpine AS builder-backend WORKDIR /go/src/app diff --git a/Dockerfile.dev b/Dockerfile.dev index 88c468673..81d51cc97 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -13,7 +13,7 @@ RUN yarn install --frozen-lockfile && yarn build # ======================================= # ===== Build image for the backend ===== # ======================================= -FROM golang:1.20.3-alpine AS builder-backend +FROM golang:1.20.4-alpine AS builder-backend WORKDIR /go/src/app diff --git a/cmd/authelia-gen/helpers.go b/cmd/authelia-gen/helpers.go index a587b18a5..c244ad06b 100644 --- a/cmd/authelia-gen/helpers.go +++ b/cmd/authelia-gen/helpers.go @@ -62,6 +62,10 @@ var decodedTypes = []reflect.Type{ reflect.TypeOf(url.URL{}), reflect.TypeOf(time.Duration(0)), reflect.TypeOf(schema.Address{}), + reflect.TypeOf(schema.AddressTCP{}), + reflect.TypeOf(schema.AddressUDP{}), + reflect.TypeOf(schema.AddressLDAP{}), + reflect.TypeOf(schema.AddressSMTP{}), reflect.TypeOf(schema.X509CertificateChain{}), reflect.TypeOf(schema.PasswordDigest{}), reflect.TypeOf(rsa.PrivateKey{}), diff --git a/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl b/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl index 7fe279929..7280b9f9d 100644 --- a/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl +++ b/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl @@ -1,12 +1,12 @@ --- -name: Bug Report -description: Report a bug +name: 'Bug Report' +description: 'Report a bug' labels: {{- range .Labels }} - - {{ . }} + - '{{ . }}' {{- end }} body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first. @@ -25,122 +25,152 @@ body: - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section. - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section. 7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues. - - type: dropdown - id: version + - type: 'dropdown' + id: 'version' attributes: - label: Version - description: What version(s) of Authelia can you reproduce this bug on? + label: | + Version + description: | + What version(s) of Authelia can you reproduce this bug on? multiple: true options: {{- range .Versions }} - - {{ . }} + - '{{ . }}' {{- end }} validations: required: true - - type: dropdown - id: deployment + - type: 'dropdown' + id: 'deployment' attributes: - label: Deployment Method - description: How are you deploying Authelia? + label: | + Deployment Method + description: | + How are you deploying Authelia? options: - - Docker - - Kubernetes - - Bare-metal - - Other + - 'Docker' + - 'Kubernetes' + - 'Bare-metal' + - 'Other' validations: required: true - - type: dropdown - id: proxy + - type: 'dropdown' + id: 'proxy' attributes: - label: Reverse Proxy - description: What reverse proxy are you using? + label: | + Reverse Proxy + description: | + What reverse proxy are you using? options: {{- range .Proxies }} - - {{ . }} + - '{{ . }}' {{- end }} validations: required: true - - type: input - id: proxy-version + - type: 'input' + id: 'proxy-version' attributes: - label: Reverse Proxy Version - description: What is the version of your reverse proxy? - placeholder: x.x.x + label: | + Reverse Proxy Version + description: | + What is the version of your reverse proxy? + placeholder: 'x.x.x' validations: required: false - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the bug. + label: | + Description + description: | + Describe the bug. validations: required: true - - type: textarea - id: reproduction + - type: 'textarea' + id: 'reproduction' attributes: - label: Reproduction - description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. + label: | + Reproduction + description: | + Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. validations: required: true - - type: textarea - id: expectations + - type: 'textarea' + id: 'expectations' attributes: - label: Expectations - description: Describe the desired or expected results. + label: | + Expectations + description: | + Describe the desired or expected results. validations: required: false - - type: textarea - id: configuration + - type: 'textarea' + id: 'configuration' attributes: - label: Configuration (Authelia) - description: Provide a complete configuration file (the template will automatically put this content in a code block). - render: yaml + label: | + Configuration (Authelia) + description: | + Provide a complete configuration file (the template will automatically put this content in a code block). + render: 'yaml' validations: required: false - - type: textarea - id: logs + - type: 'textarea' + id: 'logs' attributes: - label: Logs (Authelia) + label: | + Logs (Authelia) description: | Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide. The template will automatically put this content in a code block so you can just paste it. - render: shell + render: 'shell' validations: required: true - - type: textarea - id: logs-other + - type: 'textarea' + id: 'logs-other' attributes: - label: Logs (Proxy / Application) - description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). - render: shell + label: | + Logs (Proxy / Application) + description: | + Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). + render: 'shell' validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable. + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable. validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following. + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following. options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: This is a bug report and not a support request + - label: | + This is a bug report and not a support request required: true - - label: I have read the security policy and this bug report is not a security issue or security related issue + - label: | + I have read the security policy and this bug report is not a security issue or security related issue required: true - - label: I have either included the complete configuration file or I am sure it's unrelated to the configuration + - label: | + I have either included the complete configuration file or I am sure it's unrelated to the configuration required: true - - label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide + - label: | + I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide required: true - - label: I have checked for related proxy or application logs and included them if available + - label: | + I have checked for related proxy or application logs and included them if available required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl b/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl index c9d7ed245..04d733f8d 100644 --- a/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl +++ b/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl @@ -1,12 +1,12 @@ --- -name: Feature Request -description: Submit a Feature Request +name: 'Feature Request' +description: 'Submit a Feature Request' labels: {{- range .Labels }} - - {{ . }} + - '{{ . }}' {{- end }} body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature. @@ -16,42 +16,54 @@ body: 1. Ensure there are no other similar feature requests. 2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already. 3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist. - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the feature + label: | + Description + description: | + Describe the feature validations: required: true - - type: textarea - id: use-case + - type: 'textarea' + id: 'use-case' attributes: - label: Use Case - description: Provide a use case + label: | + Use Case + description: | + Provide a use case validations: required: true - - type: textarea - id: details + - type: 'textarea' + id: 'details' attributes: - label: Details - description: Describe the feature in detail + label: | + Details + description: | + Describe the feature in detail validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/config.template.yml b/config.template.yml index 3bc54dbc5..2319109de 100644 --- a/config.template.yml +++ b/config.template.yml @@ -9,14 +9,14 @@ ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. -# certificates_directory: /config/certificates/ +# certificates_directory: '/config/certificates/' ## The theme to display: light, dark, grey, auto. -theme: light +theme: 'light' ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## set using a secret: https://www.authelia.com/c/secrets -jwt_secret: a_very_important_secret +jwt_secret: 'a_very_important_secret' ## Default redirection URL ## @@ -25,31 +25,32 @@ jwt_secret: a_very_important_secret ## in such a case. ## ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. -default_redirection_url: https://home.example.com/ +default_redirection_url: 'https://home.example.com/' ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been ## disabled. This setting must be a method that is enabled. ## Options are totp, webauthn, mobile_push. -default_2fa_method: "" +default_2fa_method: '' ## ## Server Configuration ## server: - - ## The address to listen on. - host: 0.0.0.0 - - ## The port to listen on. - port: 9091 + ## The address for the Main server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'. + address: 'tcp://:9091' ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. - path: "" + path: '' ## Set the path on disk to Authelia assets. ## Useful to allow overriding of specific static assets. - # asset_path: /config/assets/ + # asset_path: '/config/assets/' ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. @@ -58,10 +59,10 @@ server: ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. tls: ## The path to the DER base64/PEM format private key. - key: "" + key: '' ## The path to the DER base64/PEM format public certificate. - certificate: "" + certificate: '' ## The list of certificates for client authentication. client_certificates: [] @@ -70,7 +71,7 @@ server: headers: ## The CSP Template. Read the docs. - csp_template: "" + csp_template: '' ## Server Buffers configuration. # buffers: @@ -89,14 +90,14 @@ server: ## Server Timeouts configuration. # timeouts: - ## Read timeout. - # read: 6s + ## Read timeout in the duration common syntax. + # read: '6s' - ## Write timeout. - # write: 6s + ## Write timeout in the duration common syntax. + # write: '6s' - ## Idle timeout. - # idle: 30s + ## Idle timeout in the duration common syntax. + # idle: '30s' ## Server Endpoints configuration. ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation. @@ -110,16 +111,16 @@ server: ## Configure the authz endpoints. # authz: # forward-auth: - # implementation: ForwardAuth + # implementation: 'ForwardAuth' # authn_strategies: [] # ext-authz: - # implementation: ExtAuthz + # implementation: 'ExtAuthz' # authn_strategies: [] # auth-request: - # implementation: AuthRequest + # implementation: 'AuthRequest' # authn_strategies: [] # legacy: - # implementation: Legacy + # implementation: 'Legacy' # authn_strategies: [] ## @@ -127,13 +128,13 @@ server: ## log: ## Level of verbosity for logs: info, debug, trace. - level: debug + level: 'debug' ## Format the logs are written as: json, text. - # format: json + # format: 'json' ## File path where the logs will be written. If not set logs are written to stdout. - # file_path: /config/authelia.log + # file_path: '/config/authelia.log' ## Whether to also log to stdout when a log_file_path is defined. # keep_stdout: false @@ -150,8 +151,13 @@ telemetry: ## Enable Metrics. enabled: false - ## The address to listen on for metrics. This should be on a different port to the main server.port value. - address: tcp://0.0.0.0:9959 + ## The address for the Metrics server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'. + address: 'tcp://:9959' ## Metrics Server Buffers configuration. # buffers: @@ -165,14 +171,14 @@ telemetry: ## Metrics Server Timeouts configuration. # timeouts: - ## Read timeout. - # read: 6s + ## Read timeout in the duration common syntax. + # read: '6s' - ## Write timeout. - # write: 6s + ## Write timeout in the duration common syntax. + # write: '6s' - ## Idle timeout. - # idle: 30s + ## Idle timeout in the duration common syntax. + # idle: '30s' ## ## TOTP Configuration @@ -183,12 +189,12 @@ totp: disable: false ## The issuer name displayed in the Authenticator application of your choice. - issuer: authelia.com + issuer: 'authelia.com' ## The TOTP algorithm to use. ## It is CRITICAL you read the documentation before changing this option: ## https://www.authelia.com/c/totp#algorithm - algorithm: sha1 + algorithm: 'sha1' ## The number of digits a user has to input. Must either be 6 or 8. ## Changing this option only affects newly generated TOTP configurations. @@ -217,19 +223,19 @@ webauthn: ## Disable WebAuthn. disable: false - ## Adjust the interaction timeout for WebAuthn dialogues. - timeout: 60s + ## The interaction timeout for WebAuthn dialogues in the duration common syntax. + timeout: '60s' ## The display name the browser should show the user for when using WebAuthn to login/register. - display_name: Authelia + display_name: 'Authelia' ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device. ## Options are none, indirect, direct. - attestation_conveyance_preference: indirect + attestation_conveyance_preference: 'indirect' ## User verification controls if the user must make a gesture or action to confirm they are present. ## Options are required, preferred, discouraged. - user_verification: preferred + user_verification: 'preferred' ## ## Duo Push API Configuration @@ -238,10 +244,10 @@ webauthn: ## "Partner Auth API" in the management panel. # duo_api: # disable: false - # hostname: api-123456789.example.com - # integration_key: ABCDEF + # hostname: 'api-123456789.example.com' + # integration_key: 'ABCDEF' ## Secret can also be set using a secret: https://www.authelia.com/c/secrets - # secret_key: 1234567890abcdefghifjkl + # secret_key: '1234567890abcdefghifjkl' # enable_self_enrollment: false ## @@ -249,14 +255,17 @@ webauthn: ## ## This is used to validate the servers time is accurate enough to validate TOTP. ntp: - ## NTP server address. - address: "time.cloudflare.com:123" + ## The address of the NTP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'. + ## The default scheme is 'udp'. The default port is '123'. + address: 'udp://time.cloudflare.com:123' ## NTP version. version: 4 - ## Maximum allowed time offset between the host and the NTP server. - max_desync: 3s + ## Maximum allowed time offset between the host and the NTP server in the duration common syntax. + max_desync: '3s' ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you ## set this to true, and can operate in a truly offline mode. @@ -282,16 +291,15 @@ authentication_backend: ## External reset password url that redirects the user to an external reset portal. This disables the internal reset ## functionality. - custom_url: "" + custom_url: '' - ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + ## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. - ## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval - refresh_interval: 5m + refresh_interval: '5m' ## ## LDAP (Authentication Provider) @@ -300,6 +308,13 @@ authentication_backend: ## because it allows Authelia to offload the stateful operations ## onto the LDAP service. # ldap: + ## The address of the LDAP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`. + ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'. + ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'. + # address: 'ldaps://127.0.0.1:636' + ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## Acceptable options are as follows: ## - 'activedirectory' - for Microsoft Active Directory. @@ -311,22 +326,18 @@ authentication_backend: ## Depending on the option here certain other values in this section have a default value, notably all of the ## attribute mappings have a default value that this config overrides, you can read more about these default values ## at https://www.authelia.com/c/ldap#defaults - # implementation: custom + # implementation: 'custom' - ## The url to the ldap server. Format: ://
[:]. - ## Scheme can be ldap or ldaps in the format (port optional). - # url: ldap://127.0.0.1 - - ## The dial timeout for LDAP. - # timeout: 5s + ## The dial timeout for LDAP in the duration common syntax. + # timeout: '5s' ## Use StartTLS with the LDAP connection. # start_tls: false # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host portion of the url option. - # server_name: ldap.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'ldap.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -337,10 +348,10 @@ authentication_backend: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -417,7 +428,7 @@ authentication_backend: ## The distinguished name of the container searched for objects in the directory information tree. ## See also: additional_users_dn, additional_groups_dn. - # base_dn: dc=example,dc=com + # base_dn: 'dc=example,dc=com' ## The attribute holding the username of the user. This attribute is used to populate the username in the session ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually @@ -427,11 +438,11 @@ authentication_backend: ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to ## follow https://datatracker.ietf.org/doc/html/rfc2307. - # username_attribute: uid + # username_attribute: 'uid' ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. - # additional_users_dn: ou=users + # additional_users_dn: 'ou=users' ## The users filter used in search queries to find the user profile based on input filled in login form. ## Various placeholders are available in the user filter which you can read about in the documentation which can @@ -445,11 +456,11 @@ authentication_backend: ## ## To allow sign in both with username and email, one can use a filter like ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) - # users_filter: (&({username_attribute}={input})(objectClass=person)) + # users_filter: '(&({username_attribute}={input})(objectClass=person))' ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. - # additional_groups_dn: ou=groups + # additional_groups_dn: 'ou=groups' ## The groups filter used in search queries to find the groups based on relevant authenticated user. ## Various placeholders are available in the groups filter which you can read about in the documentation which can @@ -457,17 +468,17 @@ authentication_backend: ## ## If your groups use the `groupOfUniqueNames` structure use this instead: ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) - # groups_filter: (&(member={dn})(objectClass=groupOfNames)) + # groups_filter: '(&(member={dn})(objectClass=groupOfNames))' ## The attribute holding the name of the group. - # group_name_attribute: cn + # group_name_attribute: 'cn' ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## first one returned by the LDAP server is used. - # mail_attribute: mail + # mail_attribute: 'mail' ## The attribute holding the display name of the user. This will be used to greet an authenticated user. - # display_name_attribute: displayName + # display_name_attribute: 'displayName' ## Follow referrals returned by the server. ## This is especially useful for environments where read-only servers exist. Only implemented for write operations. @@ -476,7 +487,7 @@ authentication_backend: ## The username and password of the admin user. # user: cn=admin,dc=example,dc=com ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## ## File (Authentication Provider) @@ -491,15 +502,15 @@ authentication_backend: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # file: - # path: /config/users_database.yml + # path: '/config/users_database.yml' # watch: false # search: # email: false # case_insensitive: false # password: - # algorithm: argon2 + # algorithm: 'argon2' # argon2: - # variant: argon2id + # variant: 'argon2id' # iterations: 3 # memory: 65536 # parallelism: 4 @@ -512,15 +523,15 @@ authentication_backend: # key_length: 32 # salt_length: 16 # pbkdf2: - # variant: sha512 + # variant: 'sha512' # iterations: 310000 # salt_length: 16 # sha2crypt: - # variant: sha512 + # variant: 'sha512' # iterations: 50000 # salt_length: 16 # bcrypt: - # variant: standard + # variant: 'standard' # cost: 12 ## @@ -604,91 +615,91 @@ privacy_policy: access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. - default_policy: deny + default_policy: 'deny' # networks: - # - name: internal + # - name: 'internal' # networks: - # - 10.10.0.0/16 - # - 192.168.2.0/24 + # - '10.10.0.0/16' + # - '192.168.2.0/24' # - name: VPN - # networks: 10.9.0.0/16 + # networks: '10.9.0.0/16' # rules: ## Rules applied to everyone # - domain: 'public.example.com' - # policy: bypass + # policy: 'bypass' ## Domain Regex examples. Generally we recommend just using a standard domain. # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: # - '^appgroup-.*\.example\.com$' # - '^appgroup2-.*\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^.*\.example\.com$' - # policy: two_factor + # policy: 'two_factor' # - domain: 'secure.example.com' - # policy: one_factor + # policy: 'one_factor' ## Network based rule, if not provided any network matches. # networks: - # - internal - # - VPN - # - 192.168.1.0/24 - # - 10.0.0.1 + # - 'internal' + # - 'VPN' + # - '192.168.1.0/24' + # - '10.0.0.1' # - domain: # - 'secure.example.com' # - 'private.example.com' - # policy: two_factor + # policy: 'two_factor' # - domain: 'singlefactor.example.com' - # policy: one_factor + # policy: 'one_factor' ## Rules applied to 'admins' group # - domain: 'mx2.mail.example.com' # subject: 'group:admins' - # policy: deny + # policy: 'deny' # - domain: '*.example.com' # subject: # - 'group:admins' # - 'group:moderators' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to 'dev' group # - domain: 'dev.example.com' # resources: # - '^/groups/dev/.*$' # subject: 'group:dev' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'john' # - domain: 'dev.example.com' # resources: # - '^/users/john/.*$' # subject: 'user:john' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'harry' # - domain: 'dev.example.com' # resources: # - '^/users/harry/.*$' # subject: 'user:harry' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'bob' # - domain: '*.mail.example.com' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' # - domain: 'dev.example.com' # resources: # - '^/users/bob/.*$' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' ## ## Session Provider Configuration @@ -723,8 +734,7 @@ session: ## Please read https://www.authelia.com/c/session#same_site # same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format + ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -741,30 +751,19 @@ session: ## this value to -1 disables remember me for this session cookie domain. # remember_me: '1M' - ## Cookie Session Domain default 'name' value. The name of the session cookie. + ## Cookie Session Domain default 'name' value. name: 'authelia_session' - ## Cookie Session Domain default 'same_site' value. Sets the Cookie SameSite value. Possible options are none, lax, - ## or strict. Please read https://www.authelia.com/c/session#same_site + ## Cookie Session Domain default 'same_site' value. same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format - ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure - ## because a stolen cookie will last longer giving attackers more time to spy or attack. - - ## Cookie Session Domain default 'inactivity' value. The inactivity time before the session is reset. If expiration is - ## set to 1h, and this is set to 5m, if the user does not select the remember me option their session will get - ## destroyed after 1h, or after 5m since the last time Authelia detected user activity. + ## Cookie Session Domain default 'inactivity' value. inactivity: '5m' - ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is - ## destroyed if remember me IS NOT selected by the user. + ## Cookie Session Domain default 'expiration' value. expiration: '1h' - ## Cookie Session Domain default 'remember_me' value. The time before the cookie expires and the session is destroyed - ## if remember me IS selected by the user. Setting this value to -1 disables remember me for all session cookie - ## domains which do not have a specific 'remember_me' value. + ## Cookie Session Domain default 'remember_me' value. remember_me: '1M' ## @@ -773,16 +772,16 @@ session: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # redis: - # host: 127.0.0.1 + # host: '127.0.0.1' # port: 6379 ## Use a unix socket instead - # host: /var/run/redis/redis.sock + # host: '/var/run/redis/redis.sock' ## Username used for redis authentication. This is optional and a new feature in redis 6.0. - # username: authelia + # username: 'authelia' ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: authelia + # password: 'authelia' ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). # database_index: 0 @@ -797,7 +796,7 @@ session: # tls: ## The server subject name to check the servers certificate against during the validation process. ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: myredis.example.com + # server_name: 'myredis.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -808,10 +807,10 @@ session: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -890,21 +889,21 @@ session: ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). # high_availability: ## Sentinel Name / Master Name. - # sentinel_name: mysentinel + # sentinel_name: 'mysentinel' ## Specific username for Redis Sentinel. The node username and password is configured above. - # sentinel_username: sentinel_specific_user + # sentinel_username: 'sentinel_specific_user' ## Specific password for Redis Sentinel. The node username and password is configured above. - # sentinel_password: sentinel_specific_pass + # sentinel_password: 'sentinel_specific_pass' ## The additional nodes to pre-seed the redis provider with (for sentinel). ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## For high availability to be used you must have either defined; the host above or at least one node below. # nodes: - # - host: sentinel-node1 + # - host: 'sentinel-node1' # port: 6379 - # - host: sentinel-node2 + # - host: 'sentinel-node2' # port: 6379 ## Choose the host with the lowest latency. @@ -922,14 +921,12 @@ regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 - ## The time range during which the user can attempt login before being banned. The user is banned if the - ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - find_time: 2m + ## The time range during which the user can attempt login before being banned in the duration common syntax. The user + ## is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. + find_time: '2m' - ## The length of time before a banned user can login again. Ban Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - ban_time: 5m + ## The length of time before a banned user can login again in the duration common syntax. + ban_time: '5m' ## ## Storage Provider Configuration @@ -939,7 +936,7 @@ regulation: ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use ## the CLI to change this in the database if you want to change it from a previously configured value. - # encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this + # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this' ## ## Local (Storage Provider) @@ -951,25 +948,36 @@ regulation: ## # local: ## Path to the SQLite3 Database. - # path: /config/db.sqlite3 + # path: '/config/db.sqlite3' ## ## MySQL / MariaDB (Storage Provider) ## # mysql: - # host: 127.0.0.1 - # port: 3306 - # database: authelia - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the MySQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'. + # address: 'tcp://127.0.0.1:3306' + + ## The database name to use. + # database: 'authelia' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## MySQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: mysql.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'mysql.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -980,10 +988,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1062,20 +1070,33 @@ regulation: ## PostgreSQL (Storage Provider) ## # postgres: - # host: 127.0.0.1 - # port: 5432 - # database: authelia - # schema: public - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the PostgreSQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'. + # address: 'tcp://127.0.0.1:5432' + + ## The database name to use. + # database: 'authelia' + + ## The schema name to use. + # schema: 'public' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## PostgreSQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: postgres.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'postgres.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1086,10 +1107,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1179,7 +1200,7 @@ notifier: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # filesystem: - # filename: /config/notification.txt + # filename: '/config/notification.txt' ## ## SMTP (Notification Provider) @@ -1192,36 +1213,33 @@ notifier: ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## (configure in tls section) # smtp: - ## The SMTP host to connect to. - # host: 127.0.0.1 + ## The address of the SMTP server to connect to in the address common syntax. + # address: 'smtp://127.0.0.1:25' - ## The port to connect to the SMTP host on. - # port: 1025 - - ## The connection timeout. - # timeout: 5s + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## The username used for SMTP authentication. - # username: test + # username: 'test' ## The password used for SMTP authentication. ## Can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## The sender is used to is used for the MAIL FROM command and the FROM header. ## If this is not defined and the username is an email, we use the username as this value. This can either be just ## an email address or the RFC5322 'Name ' format. - # sender: "Authelia " + # sender: 'Authelia ' ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. - # identifier: localhost + # identifier: 'localhost' ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. - # subject: "[Authelia] {title}" + # subject: '[Authelia] {title}' ## This address is used during the startup check to verify the email configuration is correct. ## It's not important what it is except if your email server only allows local delivery. - # startup_check_address: test@authelia.com + # startup_check_address: 'test@authelia.com' ## By default we require some form of TLS. This disables this check though is not advised. # disable_require_tls: false @@ -1231,8 +1249,8 @@ notifier: # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: smtp.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'smtp.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1243,10 +1261,10 @@ notifier: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1334,7 +1352,7 @@ notifier: # oidc: ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets - # hmac_secret: this_is_a_secret_abc123abc123abc + # hmac_secret: 'this_is_a_secret_abc123abc123abc' ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every @@ -1410,11 +1428,11 @@ notifier: # DO NOT USE== # -----END RSA PRIVATE KEY----- - ## The lifespans configure the expiration for these token types. - # access_token_lifespan: 1h - # authorize_code_lifespan: 1m - # id_token_lifespan: 1h - # refresh_token_lifespan: 90m + ## The lifespans configure the expiration for these token types in the duration common syntax. + # access_token_lifespan: '1h' + # authorize_code_lifespan: '1m' + # id_token_lifespan: '1h' + # refresh_token_lifespan: '90m' ## Enables additional debug messages. # enable_client_debug_messages: false @@ -1424,23 +1442,23 @@ notifier: ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' ## for security reasons. - # enforce_pkce: public_clients_only + # enforce_pkce: 'public_clients_only' ## Cross-Origin Resource Sharing (CORS) settings. # cors: ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. # endpoints: - # - authorization - # - token - # - revocation - # - introspection - # - userinfo + # - 'authorization' + # - 'token' + # - 'revocation' + # - 'introspection' + # - 'userinfo' ## List of allowed origins. ## Any origin with https is permitted unless this option is configured or the ## allowed_origins_from_client_redirect_uris option is enabled. # allowed_origins: - # - https://example.com + # - 'https://example.com' ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, ## provided they have the scheme http or https and do not have the hostname of localhost. @@ -1450,71 +1468,72 @@ notifier: # clients: # - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. - # id: myapp + # id: 'myapp' ## The description to show to users when they end up on the consent screen. Defaults to the ID above. - # description: My Application + # description: 'My Application' ## The client secret is a shared secret between Authelia and the consumer of this client. - # secret: this_is_a_secret + # yamllint disable-line rule:line-length + # secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not ## necessary. Read the documentation for more information. ## The subject identifier must be the host component of a URL, which is a domain name with an optional port. - # sector_identifier: example.com + # sector_identifier: 'example.com' ## Sets the client to public. This should typically not be set, please see the documentation for usage. # public: false ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. # redirect_uris: - # - https://oidc.example.com:8080/oauth2/callback + # - 'https://oidc.example.com:8080/oauth2/callback' ## Audience this client is allowed to request. # audience: [] ## Scopes this client is allowed to request. # scopes: - # - openid - # - groups - # - email - # - profile + # - 'openid' + # - 'groups' + # - 'email' + # - 'profile' ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: - # - code + # - 'code' ## Response Modes configures which response modes this client supports. # response_modes: - # - form_post - # - query + # - 'form_post' + # - 'query' ## Grant Types configures which grants this client can obtain. ## It's not recommended to define this unless you know what you're doing. # grant_types: - # - authorization_code + # - 'authorization_code' ## The permitted client authentication method for the Token Endpoint for this client. - # token_endpoint_auth_method: client_secret_basic + # token_endpoint_auth_method: 'client_secret_basic' ## The policy to require for this client; one_factor or two_factor. - # authorization_policy: two_factor + # authorization_policy: 'two_factor' ## Enforces the use of PKCE for this client when set to true. # enforce_pkce: false ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method. ## Options are 'plain' and 'S256'. - # pkce_challenge_method: S256 + # pkce_challenge_method: 'S256' ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. - # userinfo_signing_algorithm: none + # userinfo_signing_algorithm: 'none' ## The consent mode controls how consent is obtained. - # consent_mode: auto + # consent_mode: 'auto' ## This value controls the duration a consent on this client remains remembered when the consent mode is - ## configured as 'auto' or 'pre-configured'. - # pre_configured_consent_duration: 1w + ## configured as 'auto' or 'pre-configured' in the duration common syntax. + # pre_configured_consent_duration: '1w' ... diff --git a/crowdin.yml b/crowdin.yml index 88613ec99..da43544d1 100644 --- a/crowdin.yml +++ b/crowdin.yml @@ -1,9 +1,9 @@ --- -pull_request_title: "i18n: update translations" -commit_message: "i18n: update translation for %original_file_name% (%language%)" +pull_request_title: 'i18n: update translations' +commit_message: 'i18n: update translation for %original_file_name% (%language%)' append_commit_message: false files: - - source: /internal/server/locales/en/* - translation: /internal/server/locales/%locale%/%original_file_name% + - source: '/internal/server/locales/en/*' + translation: '/internal/server/locales/%locale%/%original_file_name%' skip_untranslated_files: true ... diff --git a/docs/config/next/config.toml b/docs/config/next/config.toml index e0b6dd4bd..f11ccfc89 100644 --- a/docs/config/next/config.toml +++ b/docs/config/next/config.toml @@ -1 +1 @@ -baseurl = "https://authelia-staging.netlify.app/" +baseurl = "https://authelia-next.netlify.app/" diff --git a/docs/content/en/configuration/first-factor/file.md b/docs/content/en/configuration/first-factor/file.md index 856d3da0d..97ec3e23a 100644 --- a/docs/content/en/configuration/first-factor/file.md +++ b/docs/content/en/configuration/first-factor/file.md @@ -16,18 +16,20 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml authentication_backend: file: - path: /config/users.yml + path: '/config/users.yml' watch: false search: email: false case_insensitive: false password: - algorithm: argon2 + algorithm: 'argon2' argon2: - variant: argon2id + variant: 'argon2id' iterations: 3 memory: 65536 parallelism: 4 @@ -40,20 +42,22 @@ authentication_backend: key_length: 32 salt_length: 16 pbkdf2: - variant: sha512 + variant: 'sha512' iterations: 310000 salt_length: 16 sha2crypt: - variant: sha512 + variant: 'sha512' iterations: 50000 salt_length: 16 bcrypt: - variant: standard + variant: 'standard' cost: 12 ``` ## Options +This section describes the individual configuration options. + ### path {{< confkey type="string" required="yes" >}} diff --git a/docs/content/en/configuration/first-factor/introduction.md b/docs/content/en/configuration/first-factor/introduction.md index 4c620e9c7..0a81430a7 100644 --- a/docs/content/en/configuration/first-factor/introduction.md +++ b/docs/content/en/configuration/first-factor/introduction.md @@ -23,6 +23,8 @@ There are two ways to integrate *Authelia* with an authentication backend: ## Configuration +{{< config-alert-example >}} + ```yaml authentication_backend: refresh_interval: 5m @@ -33,10 +35,15 @@ authentication_backend: ## Options +This section describes the individual configuration options. + ### refresh_interval {{< confkey type="duration" default="5m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + This setting controls the interval at which details are refreshed from the backend. Particularly useful for [LDAP](#ldap). diff --git a/docs/content/en/configuration/first-factor/ldap.md b/docs/content/en/configuration/first-factor/ldap.md index 7a0ee0d31..5e6a7815c 100644 --- a/docs/content/en/configuration/first-factor/ldap.md +++ b/docs/content/en/configuration/first-factor/ldap.md @@ -17,18 +17,20 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml authentication_backend: ldap: - implementation: custom - url: ldap://127.0.0.1 - timeout: 5s + address: 'ldap://127.0.0.1' + implementation: 'custom' + timeout: '5s' start_tls: false tls: - server_name: ldap.example.com + server_name: 'ldap.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -96,23 +98,54 @@ authentication_backend: 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. DO NOT USE== -----END RSA PRIVATE KEY----- - base_dn: DC=example,DC=com - additional_users_dn: OU=users - users_filter: (&({username_attribute}={input})(objectClass=person)) - username_attribute: uid - mail_attribute: mail - display_name_attribute: displayName - additional_groups_dn: OU=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn + base_dn: 'DC=example,DC=com' + additional_users_dn: 'OU=users' + users_filter: '(&({username_attribute}={input})(objectClass=person))' + username_attribute: 'uid' + mail_attribute: 'mail' + display_name_attribute: 'displayName' + additional_groups_dn: 'OU=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' permit_referrals: false permit_unauthenticated_bind: false - user: CN=admin,DC=example,DC=com - password: password + user: 'CN=admin,DC=example,DC=com' + password: 'password' ``` ## Options +This section describes the individual configuration options. + +### address + +{{< confkey type="string" required="yes" >}} + +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* + +The LDAP URL which consists of a scheme, hostname, and port. Format is `[://][:]`. The default +scheme is `ldapi` if the path is absolute otherwise it's `ldaps`, and the permitted schemes are `ldap`, `ldaps`, or +`ldapi` (a unix domain socket). + +If the scheme is `ldapi` it must be followed by an absolute path to an existing unix domain socket that the +user/group the Authelia process is running as has the appropriate permissions to access. For example if the socket is +located at `/var/run/slapd.sock` the address should be `ldapi:///var/run/slapd.sock`. + +__Examples:__ + +```yaml +authentication_backend: + ldap: + address: 'ldaps://dc1.example.com' +``` + +```yaml +authentication_backend: + ldap: + address: 'ldap://[fd00:1111:2222:3333::1]' +``` + ### implementation {{< confkey type="string" default="custom" required="no" >}} @@ -121,31 +154,13 @@ Configures the LDAP implementation used by Authelia. See the [Implementation Guide](../../reference/guides/ldap.md#implementation-guide) for information. -### url - -{{< confkey type="string" required="yes" >}} - -The LDAP URL which consists of a scheme, address, and port. Format is `://
:` or -`://
` where scheme is either `ldap` or `ldaps`. - -```yaml -authentication_backend: - ldap: - url: ldaps://dc1.example.com -``` - -If utilising an IPv6 literal address it must be enclosed by square brackets: - -```yaml -authentication_backend: - ldap: - url: ldap://[fd00:1111:2222:3333::1] -``` - ### timeout {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The timeout for dialing an LDAP connection. ### start_tls @@ -158,8 +173,11 @@ URL's are slightly more secure. ### tls -Controls the TLS connection validation process. You can see how to configure the tls -section [here](../prologue/common.md#tls-configuration). +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + +Controls the TLS connection validation parameters for either StartTLS or the TLS socket. ### base_dn diff --git a/docs/content/en/configuration/identity-providers/open-id-connect.md b/docs/content/en/configuration/identity-providers/open-id-connect.md index 83abaa8d7..0b1afe399 100644 --- a/docs/content/en/configuration/identity-providers/open-id-connect.md +++ b/docs/content/en/configuration/identity-providers/open-id-connect.md @@ -28,12 +28,12 @@ More information about the beta can be found in the [roadmap](../../roadmap/acti ## Configuration -The following snippet provides a sample-configuration for the OIDC identity provider explaining each field in detail. +{{< config-alert-example >}} ```yaml identity_providers: oidc: - hmac_secret: this_is_a_secret_abc123abc123abc + hmac_secret: 'this_is_a_secret_abc123abc123abc' issuer_certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -101,52 +101,54 @@ identity_providers: 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. DO NOT USE== -----END RSA PRIVATE KEY----- - access_token_lifespan: 1h - authorize_code_lifespan: 1m - id_token_lifespan: 1h - refresh_token_lifespan: 90m + access_token_lifespan: '1h' + authorize_code_lifespan: '1m' + id_token_lifespan: '1h' + refresh_token_lifespan: '90m' enable_client_debug_messages: false - enforce_pkce: public_clients_only + enforce_pkce: 'public_clients_only' cors: endpoints: - - authorization - - token - - revocation - - introspection + - 'authorization' + - 'token' + - 'revocation' + - 'introspection' allowed_origins: - - https://example.com + - 'https://example.com' allowed_origins_from_client_redirect_uris: false clients: - - id: myapp - description: My Application + - id: 'myapp' + description: 'My Application' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. sector_identifier: '' public: false - authorization_policy: two_factor - consent_mode: explicit - pre_configured_consent_duration: 1w + authorization_policy: 'two_factor' + consent_mode: 'explicit' + pre_configured_consent_duration: '1w' audience: [] scopes: - - openid - - groups - - email - - profile + - 'openid' + - 'groups' + - 'email' + - 'profile' redirect_uris: - - https://oidc.example.com:8080/oauth2/callback + - 'https://oidc.example.com:8080/oauth2/callback' grant_types: - - refresh_token - - authorization_code + - 'refresh_token' + - 'authorization_code' response_types: - - code + - 'code' response_modes: - - form_post - - query - - fragment - userinfo_signing_algorithm: none + - 'form_post' + - 'query' + - 'fragment' + userinfo_signing_algorithm: 'none' ``` ## Options +This section describes the individual configuration options. + ### hmac_secret {{< confkey type="string" required="yes" >}} @@ -201,6 +203,9 @@ key data for the first certificate in the chain. {{< confkey type="duration" default="1h" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default. For more information read these docs about [token lifespan]. @@ -208,6 +213,9 @@ For more information read these docs about [token lifespan]. {{< confkey type="duration" default="1m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to obtain the other token types. For more information read these docs about [token lifespan]. @@ -215,12 +223,18 @@ obtain the other token types. For more information read these docs about [token {{< confkey type="duration" default="1h" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of an ID token. For more information read these docs about [token lifespan]. ### refresh_token_lifespan {{< confkey type="string" default="90m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of a refresh token. The refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an up-to-date expiration. For more information read these docs about [token lifespan]. @@ -286,6 +300,9 @@ When enabled all authorization requests must use the [Pushed Authorization Reque {{< confkey type="duration" default="5m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated `request_uri` being utilized by a client. @@ -566,8 +583,8 @@ Configures the consent mode. The following table describes the different modes: {{< confkey type="duration" default="1w" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`. diff --git a/docs/content/en/configuration/methods/environment.md b/docs/content/en/configuration/methods/environment.md index 0aec76276..0019382fc 100644 --- a/docs/content/en/configuration/methods/environment.md +++ b/docs/content/en/configuration/methods/environment.md @@ -39,7 +39,7 @@ For example this YAML configuration: ```yaml log: - level: info + level: 'info' server: buffers: read: 4096 diff --git a/docs/content/en/configuration/miscellaneous/introduction.md b/docs/content/en/configuration/miscellaneous/introduction.md index b7036e231..549542bdb 100644 --- a/docs/content/en/configuration/miscellaneous/introduction.md +++ b/docs/content/en/configuration/miscellaneous/introduction.md @@ -17,15 +17,19 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml -certificates_directory: /config/certs/ -default_redirection_url: https://home.example.com:8080/ -jwt_secret: v3ry_important_s3cr3t -theme: light +certificates_directory: '/config/certs/' +default_redirection_url: 'https://home.example.com:8080/' +jwt_secret: 'v3ry_important_s3cr3t' +theme: 'light' ``` ## Options +This section describes the individual configuration options. + ### certificates_directory This option defines the location of additional certificates to load into the trust chain specifically for Authelia. diff --git a/docs/content/en/configuration/miscellaneous/logging.md b/docs/content/en/configuration/miscellaneous/logging.md index 278511f08..2320168bb 100644 --- a/docs/content/en/configuration/miscellaneous/logging.md +++ b/docs/content/en/configuration/miscellaneous/logging.md @@ -18,16 +18,20 @@ The logging section tunes the logging settings. ## Configuration +{{< config-alert-example >}} + ```yaml log: - level: info - format: text - file_path: "" + level: 'info' + format: 'text' + file_path: '' keep_stdout: false ``` ## Options +This section describes the individual configuration options. + ### level {{< confkey type="string" default="info" required="no" >}} diff --git a/docs/content/en/configuration/miscellaneous/ntp.md b/docs/content/en/configuration/miscellaneous/ntp.md index b16751d8e..048d31692 100644 --- a/docs/content/en/configuration/miscellaneous/ntp.md +++ b/docs/content/en/configuration/miscellaneous/ntp.md @@ -23,17 +23,21 @@ unless configured otherwise. ## Configuration +{{< config-alert-example >}} + ```yaml ntp: - address: "time.cloudflare.com:123" + address: 'udp://time.cloudflare.com:123' version: 3 - max_desync: 3s + max_desync: '3s' disable_startup_check: false disable_failure: false ``` ## Options +This section describes the individual configuration options. + ### address {{< confkey type="string" default="time.cloudflare.com:123" required="no" >}} @@ -41,6 +45,28 @@ ntp: Determines the address of the NTP server to retrieve the time from. The format is `:`, and both of these are required. +### address + +{{< confkey type="address" default="udp://time.cloudflare.com:123" required="no" >}} + +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* + +Configures the address for the NTP Server. The address itself is a connector and the scheme must be `udp`, +`udp4`, or `udp6`. + +__Examples:__ + +```yaml +ntp: + address: 'udp://127.0.0.1:123' +``` + +```yaml +ntp: + address: 'udp6://[fd00:1111:2222:3333::1]:123' +``` + ### version {{< confkey type="integer" default="4" required="no" >}} @@ -51,8 +77,8 @@ Determines the NTP version supported. Valid values are 3 or 4. {{< confkey type="duration" default="3s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* This is used to tune the acceptable desync from the time reported from the NTP server. diff --git a/docs/content/en/configuration/miscellaneous/privacy-policy.md b/docs/content/en/configuration/miscellaneous/privacy-policy.md index 148e9f0ae..327b7e821 100644 --- a/docs/content/en/configuration/miscellaneous/privacy-policy.md +++ b/docs/content/en/configuration/miscellaneous/privacy-policy.md @@ -14,6 +14,8 @@ toc: true ## Configuration +{{< config-alert-example >}} + ```yaml privacy_policy: enabled: false @@ -23,6 +25,8 @@ privacy_policy: ## Options +This section describes the individual configuration options. + ### enabled {{< confkey type="boolean" default="false" required="no" >}} diff --git a/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md b/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md index c6763a4e2..f62bebd93 100644 --- a/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md +++ b/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md @@ -16,21 +16,23 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' authn_strategies: [] ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' authn_strategies: [] auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' authn_strategies: [] legacy: - implementation: Legacy + implementation: 'Legacy' authn_strategies: [] ``` diff --git a/docs/content/en/configuration/miscellaneous/server.md b/docs/content/en/configuration/miscellaneous/server.md index 2eaa4d1db..683590747 100644 --- a/docs/content/en/configuration/miscellaneous/server.md +++ b/docs/content/en/configuration/miscellaneous/server.md @@ -17,63 +17,82 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml server: - host: 0.0.0.0 - port: 9091 - path: "" + address: 'tcp://:9091' + umask: 0022 + path: '' disable_healthcheck: false tls: - key: "" - certificate: "" + key: '' + certificate: '' client_certificates: [] headers: - csp_template: "" + csp_template: '' buffers: read: 4096 write: 4096 timeouts: - read: 6s - write: 6s - idle: 30s + read: '6s' + write: '6s' + idle: '30s' endpoints: enable_pprof: false enable_expvars: false authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' authn_strategies: [] ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' authn_strategies: [] auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' authn_strategies: [] legacy: - implementation: Legacy + implementation: 'Legacy' authn_strategies: [] ``` ## Options -## host +### address -{{< confkey type="string" default="0.0.0.0" required="no" >}} +{{< confkey type="address" default="tcp://:9091" required="no" >}} -Defines the address to listen on. See also [port](#port). Should typically be `0.0.0.0` or `127.0.0.1`, the former for -containerized environments and the later for daemonized environments like init.d and systemd. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -Note: If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: +Configures the listener address for the Main HTTP Server. The address itself is a listener and the scheme must either be +the `unix` scheme or one of the `tcp` schemes. + +__Examples:__ ```yaml -host: "[fd00:1111:2222:3333::1]" +server: + address: tcp://127.0.0.1:9091 ``` -### port +```yaml +server: + address: unix:///var/run/authelia.sock +``` -{{< confkey type="integer" default="9091" required="no" >}} +### umask -Defines the port to listen on. See also [host](#host). +{{< confkey type="int" required="no" >}} + +If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the +[address](#address). Typically this should be set before the process is actually running and users should not use this +option, however it's recognized in various specific scenarios this may not be completely adequate. + +One such example is when you want the proxy to have permission to the socket but not the files, in which case running a +umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has +permission to the socket. + +This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly. ### path @@ -171,13 +190,19 @@ research about how browsers utilize and understand this header before attempting ### buffers -Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server buffers common structure](../prologue/common.md#server-buffers). Please see the +[documentation](../prologue/common.md#server-buffers) on this structure for more information.* + +Configures the server buffers. ### timeouts -Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the +[documentation](../prologue/common.md#server-timeouts) on this structure for more information.* + +Configures the server timeouts. ### endpoints @@ -192,11 +217,11 @@ Enables the go [pprof](https://pkg.go.dev/net/http/pprof) endpoints. #### enable_expvars +{{< confkey type="boolean" default="false" required="no" >}} + *__Security Note:__ This is a developer endpoint. __DO NOT__ enable it unless you know why you're enabling it. __DO NOT__ enable this in production.* -{{< confkey type="boolean" default="false" required="no" >}} - Enables the go [expvar](https://pkg.go.dev/expvar) endpoints. #### authz diff --git a/docs/content/en/configuration/notifications/file.md b/docs/content/en/configuration/notifications/file.md index e004fad9c..1bc73dac8 100644 --- a/docs/content/en/configuration/notifications/file.md +++ b/docs/content/en/configuration/notifications/file.md @@ -21,15 +21,19 @@ This method will use the plain text email template for readability purposes. ## Configuration +{{< config-alert-example >}} + ```yaml notifier: disable_startup_check: false filesystem: - filename: /config/notification.txt + filename: '/config/notification.txt' ``` ## Options +This section describes the individual configuration options. + ### filename {{< confkey type="string" required="yes" >}} diff --git a/docs/content/en/configuration/notifications/introduction.md b/docs/content/en/configuration/notifications/introduction.md index eb04def3d..d3752f55a 100644 --- a/docs/content/en/configuration/notifications/introduction.md +++ b/docs/content/en/configuration/notifications/introduction.md @@ -16,6 +16,8 @@ Authelia sends messages to users in order to verify their identity. ## Configuration +{{< config-alert-example >}} + ```yaml notifier: disable_startup_check: false @@ -26,6 +28,8 @@ notifier: ## Options +This section describes the individual configuration options. + ### disable_startup_check {{< confkey type="boolean" default="false" required="no" >}} diff --git a/docs/content/en/configuration/notifications/smtp.md b/docs/content/en/configuration/notifications/smtp.md index e22d4f834..8c537e58c 100644 --- a/docs/content/en/configuration/notifications/smtp.md +++ b/docs/content/en/configuration/notifications/smtp.md @@ -17,27 +17,28 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml notifier: disable_startup_check: false smtp: - host: 127.0.0.1 - port: 1025 - timeout: 5s - username: test - password: password + address: 'smtp://127.0.0.1:25' + timeout: '5s' + username: 'test' + password: 'password' sender: "Authelia " - identifier: localhost + identifier: 'localhost' subject: "[Authelia] {title}" - startup_check_address: test@authelia.com + startup_check_address: 'test@authelia.com' disable_require_tls: false disable_starttls: false disable_html_emails: false tls: - server_name: smtp.example.com + server_name: 'smtp.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -109,35 +110,43 @@ notifier: ## Options -### host +This section describes the individual configuration options. -{{< confkey type="integer" required="yes" >}} +### address -The hostname of the SMTP server. +{{< confkey type="address" required="yes" >}} -If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -```yaml -host: "[fd00:1111:2222:3333::1]" -``` - -### port - -{{< confkey type="integer" required="yes" >}} - -The port the SMTP service is listening on. - -A connection is securely established with TLS after a succesful STARTTLS negotiation. - -[Port 465 is an exception][docs-security-smtp-port] when supported by the mail server as a `submissions` service port. -STARTTLS negotiation is not required for this port, the connection is implicitly established with TLS. +Configures the address for the SMTP Server. The address itself is a connector and the scheme must be `smtp`, +`submission`, or `submissions`. The only difference between these schemes are the default ports and `submissions` +requires a TLS transport per [SMTP Ports Security Measures][docs-security-smtp-port], whereas `submission` and `smtp` +use a standard TCP transport and typically enforce StartTLS. [docs-security-smtp-port]: ../../overview/security/measures.md#smtp-ports +__Examples:__ + +```yaml +notifier: + smtp: + address: 'smtp://127.0.0.1:25' +``` + +```yaml +notifier: + smtp: + address: 'submissions://[fd00:1111:2222:3333::1]:465' +``` + ### timeout {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The SMTP connection timeout. ### username @@ -223,8 +232,11 @@ mixed emails which contain both HTML and text so this option is rarely necessary ### tls -Controls the TLS connection validation process. You can see how to configure the tls section -[here](../prologue/common.md#tls-configuration). +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + +Controls the TLS connection validation parameters for either StartTLS or the TLS socket. ## Using Gmail @@ -234,10 +246,10 @@ You need to generate an app password in order to use Gmail SMTP servers. The pro ```yaml notifier: smtp: - username: myaccount@gmail.com + username: 'myaccount@gmail.com' # Password can also be set using a secret: https://www.authelia.com/configuration/methods/secrets/ - password: yourapppassword - sender: admin@example.com - host: smtp.gmail.com + password: 'yourapppassword' + sender: 'admin@example.com' + host: 'smtp.gmail.com' port: 587 ``` diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index 2c549f75c..67446637e 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -14,103 +14,169 @@ aliases: - /c/common --- -## Duration Notation Format +## Syntax -We have implemented a string/integer based notation for configuration options that take a duration of time. This section -describes the implementation of this. You can use this implementation in various areas of configuration such as: +The following represent common syntax used within the configuration which have specific format requirements that are +used in multiple areas. This is intended on assisting in understanding these specific values, and not as a specific +guide on configuring any particular instance. -* session: - * expiration - * inactivity - * remember_me -* regulation: - * ban_time - * find_time -* ntp: - * max_desync -* webauthn: - * timeout +### Duration -The way this format works is you can either configure an integer or a string in the specific configuration areas. If you -supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in blocks -of quantities and units (number followed by a unit letter). For example `5h` indicates a quantity of 5 units of `h`. +The base type for this syntax is a string, and it also handles integers however this is discouraged. -The following is ignored: +If you supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in +blocks of quantities and units (number followed by a unit letter). For example `5h` indicates a quantity of 5 units +of `h`. + +The following is ignored or stripped from the input: - all spaces - leading zeros + - the word `and` -While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. +While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. In +addition it's important to note that the format while somewhat human readable still requires you closely follow the +expected formats. -### Unit Legend +#### Unit Legend -#### Short Units +The following is a legend for the unit formats available in this syntax. The long form units are only available from +v4.38.0 or newer. -These values have been available for a long time. +| Unit | Short Unit | Human Readable Long Unit | +|:------------:|:----------:|:-----------------------------:| +| Years | `y` | `year`, `years` | +| Months | `M` | `month`, `months` | +| Weeks | `w` | `week`, `weeks` | +| Days | `d` | `day`, `days` | +| Hours | `h` | `hour`, `hours` | +| Minutes | `m` | `minute`, `minutes` | +| Seconds | `s` | `second`, `seconds` | +| Milliseconds | `ms` | `millisecond`, `milliseconds` | -| Unit | Associated Letter | -|:-------:|:-----------------:| -| Years | y | -| Months | M | -| Weeks | w | -| Days | d | -| Hours | h | -| Minutes | m | -| Seconds | s | +#### Examples -#### Long Units +| Desired Value | Configuration Examples (Short) | Configuration Examples (Long) | +|:---------------------:|:-------------------------------------:|:---------------------------------------:| +| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` | `1 hour and 30 mninutes` | +| 1 day | `1d` or `24h` or `86400` or `86400s` | `1 day` | +| 10 hours | `10h` or `600m` or `9h60m` or `36000` | `10 hours` | -These values are more human readable but have only been available since v4.38.0. +### Address -| Unit | Human Readable Long Unit | -|:------------:|:-----------------------------:| -| Years | `year`, `years` | -| Months | `month`, `months` | -| Weeks | `week`, `weeks` | -| Days | `day`, `days` | -| Hours | `hour`, `hours` | -| Minutes | `minute`, `minutes` | -| Seconds | `second`, `seconds` | -| Milliseconds | `millisecond`, `milliseconds` | +The base type for this syntax is a string. -### Examples +The address type is a string that indicates how to configure a listener (i.e. listening for connections) or connector +(i.e. opening remote connections), which are the two primary categories of addresses. -| Desired Value | Configuration Examples | -|:---------------------:|:-------------------------------------:| -| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` | -| 1 day | `1d` or `24h` or `86400` or `86400s` | -| 10 hours | `10h` or `600m` or `9h60m` or `36000` | -## Address +#### Format -The address type is a string that takes the following format: - -```text -[://][:] -``` +This section outlines the format for these strings. The formats use a conventional POSIX format to indicate optional and +required elements. The square brackets `[]` surround optional portions, and the angled brackets `<>` surround required +portions. Required portions may exist within optional portions, in which case they are often accompanied with other +format specific text which indicates if the accompanying text exists then it is actually required, otherwise it's +entirely optional. The square brackets indicate optional sections, and the angled brackets indicate required sections. The following sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration requirement that one of these is provided. -### scheme +##### Hostname + +The following format represents the hostname format. It's valid for both a listener and connector in most instances. +Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and port +are optional. The default for these when not provided varies. + +```text +[://][:] +``` + +##### Port + +The following format represents the port format. It's valid only for a listener in most instances. +Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and +hostname are optional. The default for the scheme when not provided varies, and the default for the hostname is all +available addresses when not provided. + +```text +[://][hostname]: +``` + +##### Unix Domain Socket + +The following format represents the unix domain socket format. It's valid for both a listener and connector in most +instances. Refer to the individual documentation for an option for clarity. In this format as per the notation there +are no optional portions. + +```text +unix:// +``` + +##### Examples + +Various examples for these formats. + +```text +0.0.0.0 +tcp://0.0.0.0 +tcp://0.0.0.0:9091 +tcp://:9091 +0.0.0.0:9091 + +udp://0.0.0.0:123 +udp://:123 + +unix:///var/lib/authelia.sock +``` + +#### scheme The entire scheme is optional, but if the scheme host delimiter `://` is in the string, the scheme must be present. The -scheme must be one of `tcp://`, or `udp://`. The default scheme is `tcp://`. +scheme must be one of the following (the listeners and connectors columns indicate support for the scheme on the +respective address type): -### ip +| Scheme | Listeners | Connectors | Default Port | Notes | +|:-------------:|:---------:|:----------:|:------------:|:-------------------------------------------------------------------------:| +| `tcp` | Yes | Yes | N/A | Standard TCP Socket which allows IPv4 and/or IPv6 addresses | +| `tcp4` | Yes | Yes | N/A | Standard TCP Socket which allows only IPv4 addresses | +| `tcp6` | Yes | Yes | N/A | Standard TCP Socket which allows only IPv6 addresses | +| `udp` | Yes | Yes | N/A | Standard UDP Socket which allows IPv4 and/or IPv6 addresses | +| `udp4` | Yes | Yes | N/A | Standard UDP Socket which allows only IPv4 addresses | +| `udp6` | Yes | Yes | N/A | Standard UDP Socket which allows only IPv6 addresses | +| `unix` | Yes | Yes | N/A | Standard Unix Domain Socket which allows only absolute paths | +| `ldap` | No | Yes | 389 | Remote LDAP connection via TCP with implicit TLS via StartTLS | +| `ldaps` | No | Yes | 636 | Remote LDAP connection via TCP with explicit TLS | +| `ldapi` | No | Yes | N/A | LDAP connection via Unix Domain Socket | +| `smtp` | No | Yes | 25 | Remote SMTP connection via TCP using implicit TLS via StartTLS | +| `submission` | No | Yes | 587 | Remote SMTP Submission connection via TCP using implicit TLS via StartTLS | +| `submissions` | No | Yes | 465 | Remote SMTP Submission connection via TCP using explicit TLS | -The IP is required. If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address -`::1` with the `tcp://` scheme and port `80`: `tcp://[::1]:80`. +If the scheme is absent, the default scheme is assumed. If the address has a `/` prefix it's assumed to be `unix`, +otherwise it's assumed to be`tcp`. If the scheme is `unix` it must be suffixed with an absolute path i.e. +`/var/local/authelia.sock` would be represented as `unix:///var/run/authelia.sock`. -### port +#### hostname -The entire port is optional, but if the host port delimiter `:` exists it must also include a numeric port. +The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [port](#port) specified. It +can be any IP that is locally addressable or a hostname which resolves to a locally addressable IP. -## Regular Expressions +If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address `::1` with the `tcp` +scheme and port `80` the correct address would be `tcp://[::1]:80`. -We have several sections of configuration that utilize regular expressions. It's recommended to validate your regex -manually either via tools like [Regex 101](https://regex101.com/) (ensure you pick the `Golang` option) or some other -means. +#### port + +The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [hostname](#hostname) +specified. + +### Regular Expressions + +We have several sections of configuration that utilize regular expressions. We use the Google RE2 regular expression +engine which is the full Go regular expression syntax engine, the syntax of which is described +[here](https://github.com/google/re2/wiki/Syntax) by the authors. It's very similar to regular expression engines like +PCRE, Perl, and Python; with the major exceptions being that it doesn't have backtracking. + +It's recommended to validate your regular expressions manually either via tools like [Regex 101](https://regex101.com/) +(ensure you pick the `Golang` option) or some other means. It's important when attempting to utilize a backslash that it's utilized correctly. The YAML parser is likely to parse this as you trying to use YAML escape syntax instead of regex escape syntax. To avoid this use single quotes instead of @@ -128,19 +194,30 @@ Bad Example: domain_regex: "^(admin|secure)\.example\.com$" ``` -## TLS Configuration +## Structures + +The following represent common data structures used within the configuration which have specific requirements that are +used in multiple areas. This is intended on assisting in understanding these specific structures, and not as a specific +guide on configuring any particular instance. + +### TLS Configuration Various sections of the configuration use a uniform configuration section called TLS. Notably LDAP and SMTP. This section documents the usage. -### server_name +Various sections of the configuration use a uniform configuration section called `tls` which configure TLS socket and +TLS verification parameters. Notably the [LDAP](../first-factor/ldap.md#tls), [SMTP](../notifications/smtp.md#tls), +[PostgreSQL](../storage/postgres.md#tls), [MySQL](../storage/mysql.md#tls), and [Redis](../session/redis.md#tls) +sections. This section documents the common parts of this structure. + +#### server_name {{< confkey type="string" required="no" >}} The key `server_name` overrides the name checked against the certificate in the verification process. Useful if you require an IP address for the host of the backend service but want to verify a specific certificate server name. -### skip_verify +#### skip_verify {{< confkey type="boolean" default="false" required="no" >}} @@ -148,7 +225,7 @@ The key `skip_verify` completely negates validating the certificate of the backe instead you should tweak the `server_name` option, and the global option [certificates directory](../miscellaneous/introduction.md#certificatesdirectory). -### minimum_version +#### minimum_version {{< confkey type="string" default="TLS1.2" required="no" >}} @@ -157,7 +234,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing this value. At the time of this writing `SSL3.0` will always produce errors. -### maximum_version +#### maximum_version {{< confkey type="string" default="TLS1.3" required="no" >}} @@ -166,7 +243,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing this value. At the time of this writing `SSL3.0` will always produce errors. -### certificate_chain +#### certificate_chain {{< confkey type="string" required="no" >}} @@ -175,7 +252,7 @@ the server. The value must be one or more certificates encoded in the DER base64 ([RFC4648]) encoded PEM format. -### private_key +#### private_key {{< confkey type="string" required="no" >}} @@ -184,49 +261,69 @@ especially for containerized deployments.* The private key to be used with the [certificate_chain](#certificatechain) for mutual TLS authentication. -The value must be one private key encoded in the DER base64 ([RFC4648]) encoded PEM format. +The value must be one private key encoded in the DER base64 ([RFC4648]) encoded PEM format. If more than one certificate +is provided, in top down order, each certificate must be signed by the next certificate if provided. [RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648 -## Server Buffers +### Server Buffers -### read +Various sections of the configuration use a uniform configuration section called `buffers` which configure HTTP server +buffers. Notably the [server](../miscellaneous/server.md#buffers) and +[metrics telemetry](../telemetry/metrics.md#buffers) sections. This section documents the common parts of this +structure. + +#### read {{< confkey type="integer" default="4096" required="no" >}} Configures the maximum request size. The default of 4096 is generally sufficient for most use cases. -### write +#### write {{< confkey type="integer" default="4096" required="no" >}} Configures the maximum response size. The default of 4096 is generally sufficient for most use cases. -## Server Timeouts +### Server Timeouts -### read +Various sections of the configuration use a uniform configuration section called `timeouts` which configure HTTP server +timeouts. Notably the [server](../miscellaneous/server.md#timeouts) and +[metrics telemetry](../telemetry/metrics.md#timeouts) sections. This section documents the common parts of this +structure. + +#### read {{< confkey type="duration" default="6s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the -[common options](#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* Configures the server read timeout. -### write +#### write {{< confkey type="duration" default="6s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the -[common options](#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](#duration). +Please see the [documentation](#duration) on this format for more information.* Configures the server write timeout. -### idle +#### idle {{< confkey type="duration" default="30s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the -[common options](#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](#duration). +Please see the [documentation](#duration) on this format for more information.* Configures the server idle timeout. + +## Historical References + +This contains links to historical anchors. + +##### Duration Notation Format + +See [duration common syntax](#duration). + diff --git a/docs/content/en/configuration/second-factor/duo.md b/docs/content/en/configuration/second-factor/duo.md index 9eacab0e9..6ac7b0cd7 100644 --- a/docs/content/en/configuration/second-factor/duo.md +++ b/docs/content/en/configuration/second-factor/duo.md @@ -25,17 +25,21 @@ section of the configuration. ## Configuration +{{< config-alert-example >}} + ```yaml duo_api: disable: false - hostname: api-123456789.example.com - integration_key: ABCDEF - secret_key: 1234567890abcdefghifjkl + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' + secret_key: '1234567890abcdefghifjkl' enable_self_enrollment: false ``` ## Options +This section describes the individual configuration options. + ### Disable {{< confkey type="boolean" default="false" required="no" >}} diff --git a/docs/content/en/configuration/second-factor/time-based-one-time-password.md b/docs/content/en/configuration/second-factor/time-based-one-time-password.md index b93ca987b..09993d4bd 100644 --- a/docs/content/en/configuration/second-factor/time-based-one-time-password.md +++ b/docs/content/en/configuration/second-factor/time-based-one-time-password.md @@ -26,11 +26,13 @@ and many only support SHA1. ## Configuration +{{< config-alert-example >}} + ```yaml totp: disable: false - issuer: authelia.com - algorithm: sha1 + issuer: 'authelia.com' + algorithm: 'sha1' digits: 6 period: 30 skew: 1 @@ -39,6 +41,8 @@ totp: ## Options +This section describes the individual configuration options. + ### disable {{< confkey type="boolean" default="false" required="no" >}} @@ -61,9 +65,8 @@ by Authelia from others. *__Important Note:__ Many TOTP applications do not support this option. It is strongly advised you find out which applications your users use and test them before changing this option. It is insufficient to test that the application -can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden] -is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option -please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).* +can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the +[Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.* [Bitwarden]: https://bitwarden.com/ @@ -84,9 +87,8 @@ information. *__Important Note:__ Some TOTP applications do not support this option. It is strongly advised you find out which applications your users use and test them before changing this option. It is insufficient to test that the application -can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden] -is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option -please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).* +can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the +[Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.* The number of digits a user needs to input to perform authentication. It's generally not recommended for this to be altered as many TOTP applications do not support anything other than 6. What's worse is some TOTP applications allow diff --git a/docs/content/en/configuration/second-factor/webauthn.md b/docs/content/en/configuration/second-factor/webauthn.md index 99c66851c..fd8966a71 100644 --- a/docs/content/en/configuration/second-factor/webauthn.md +++ b/docs/content/en/configuration/second-factor/webauthn.md @@ -16,17 +16,21 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml webauthn: disable: false - display_name: Authelia - attestation_conveyance_preference: indirect - user_verification: preferred - timeout: 60s + display_name: 'Authelia' + attestation_conveyance_preference: 'indirect' + user_verification: 'preferred' + timeout: '60s' ``` ## Options +This section describes the individual configuration options. + ### disable {{< confkey type="boolean" default="false" required="no" >}} @@ -80,8 +84,8 @@ Available Options: {{< confkey type="duration" default="60s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* This adjusts the requested timeout for a WebAuthn interaction. diff --git a/docs/content/en/configuration/security/access-control.md b/docs/content/en/configuration/security/access-control.md index 5dae020d8..b4d43a15d 100644 --- a/docs/content/en/configuration/security/access-control.md +++ b/docs/content/en/configuration/security/access-control.md @@ -17,11 +17,13 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml access_control: - default_policy: deny + default_policy: 'deny' networks: - - name: internal + - name: 'internal' networks: - '10.0.0.0/8' - '172.16.0.0/12' @@ -29,7 +31,7 @@ access_control: rules: - domain: 'private.example.com' domain_regex: '^(\d+\-)?priv-img.example.com$' - policy: one_factor + policy: 'one_factor' networks: - 'internal' - '1.1.1.1' @@ -38,8 +40,8 @@ access_control: - ['user:fred'] - ['group:admins'] methods: - - GET - - HEAD + - 'GET' + - 'HEAD' resources: - '^/api.*' query: @@ -57,6 +59,8 @@ access_control: ## Options +This section describes the individual configuration options. + ### default_policy {{< confkey type="string" default="deny" required="no" >}} @@ -150,10 +154,10 @@ different ways.* access_control: rules: - domain: '*.example.com' - policy: bypass + policy: 'bypass' - domain: - '*.example.com' - policy: bypass + policy: 'bypass' ``` *Multiple domains matched. These rules will match either `apple.example.com` or `orange.example.com`. All rules in this @@ -163,11 +167,11 @@ list are effectively the same rule just expressed in different ways.* access_control: rules: - domain: ['apple.example.com', 'banana.example.com'] - policy: bypass + policy: 'bypass' - domain: - - apple.example.com - - banana.example.com - policy: bypass + - 'apple.example.com' + - 'banana.example.com' + policy: 'bypass' ``` *Multiple domains matched either via a static domain or via a [domain_regex]. This rule will match @@ -213,7 +217,7 @@ access_control: - domain_regex: - '^user-(?P\w+)\.example\.com$' - '^group-(?P\w+)\.example\.com$' - policy: one_factor + policy: 'one_factor' ``` *Multiple domains example, one with a static domain and one with a regex domain. This will match requests to @@ -224,7 +228,7 @@ access_control: rules: - domain: 'protected.example.com' - domain_regex: '^(img|data)-private\.example\.com' - policy: one_factor + policy: 'one_factor' ``` #### policy @@ -263,14 +267,14 @@ ways.* ```yaml access_control: rules: - - domain: example.com - policy: two_factor + - domain: 'example.com' + policy: 'two_factor' subject: - 'user:john' - ['group:admin', 'group:app-name'] - 'group:super-admin' - - domain: example.com - policy: two_factor + - domain: 'example.com' + policy: 'two_factor' subject: - ['user:john'] - ['group:admin', 'group:app-name'] @@ -283,15 +287,15 @@ expressed in different ways.* ```yaml access_control: rules: - - domain: example.com - policy: one_factor + - domain: 'example.com' + policy: 'one_factor' subject: 'group:super-admin' - - domain: example.com - policy: one_factor + - domain: 'example.com' + policy: 'one_factor' subject: - 'group:super-admin' - - domain: example.com - policy: one_factor + - domain: 'example.com' + policy: 'one_factor' subject: - ['group:super-admin'] ``` @@ -328,10 +332,10 @@ relevant methods are listed in this table: ```yaml access_control: rules: - - domain: example.com - policy: bypass + - domain: 'example.com' + policy: 'bypass' methods: - - OPTIONS + - 'OPTIONS' ``` #### networks @@ -365,28 +369,28 @@ rules in this list are effectively the same rule just expressed in different way ```yaml access_control: - default_policy: two_factor + default_policy: 'two_factor' networks: - - name: internal + - name: 'internal' networks: - '10.0.0.0/8' - '172.16.0.0/12' - '192.168.0.0/18' rules: - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' networks: - '10.0.0.0/8' - '172.16.0.0/12' - '192.168.0.0/18' - '112.134.145.167/32' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' networks: - 'internal' - '112.134.145.167/32' - - domain: secure.example.com - policy: two_factor + - domain: 'secure.example.com' + policy: 'two_factor' ``` #### resources @@ -421,8 +425,8 @@ likely save you a lot of time if you do it for all resource rules. ```yaml access_control: rules: - - domain: app.example.com - policy: bypass + - domain: 'app.example.com' + policy: 'bypass' resources: - '^/api([/?].*)?$' ``` @@ -467,8 +471,8 @@ defaults to `present`. ```yaml access_control: rules: - - domain: app.example.com - policy: bypass + - domain: 'app.example.com' + policy: 'bypass' query: - - operator: 'present' key: 'secure' @@ -545,13 +549,13 @@ a match for that request. - domain: - 'example.com' - '*.example.com' - policy: bypass + policy: 'bypass' resources: - '^/api$' - '^/api/' - domain: - 'app.example.com' - policy: two_factor + policy: 'two_factor' ``` [Rule Matching Concept 1]: #rule-matching-concept-1-sequential-order @@ -603,25 +607,25 @@ Here is a detailed example of an example access control section: ```yaml access_control: - default_policy: deny + default_policy: 'deny' networks: - - name: internal + - name: 'internal' networks: - '10.10.0.0/16' - '192.168.2.0/24' - - name: VPN - networks: 10.9.0.0/16 + - name: 'VPN' + networks: '10.9.0.0/16' rules: - domain: 'public.example.com' - policy: bypass + policy: 'bypass' - domain: '*.example.com' - policy: bypass + policy: 'bypass' methods: - - OPTIONS + - 'OPTIONS' - domain: 'secure.example.com' - policy: one_factor + policy: 'one_factor' networks: - 'internal' - 'VPN' @@ -631,37 +635,37 @@ access_control: - domain: - 'secure.example.com' - 'private.example.com' - policy: two_factor + policy: 'two_factor' - domain: 'singlefactor.example.com' - policy: one_factor + policy: 'one_factor' - domain: 'mx2.mail.example.com' subject: 'group:admins' - policy: deny + policy: 'deny' - domain: '*.example.com' subject: - 'group:admins' - 'group:moderators' - policy: two_factor + policy: 'two_factor' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - '^/groups/dev/.*$' subject: 'group:dev' - policy: two_factor + policy: 'two_factor' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - '^/users/john/.*$' subject: - ['group:dev', 'user:john'] - 'group:admins' - policy: two_factor + policy: 'two_factor' - domain: '{user}.example.com' - policy: bypass + policy: 'bypass' ``` [RFC7231]: https://datatracker.ietf.org/doc/html/rfc7231 diff --git a/docs/content/en/configuration/security/password-policy.md b/docs/content/en/configuration/security/password-policy.md index 5a759f70e..77a985c45 100644 --- a/docs/content/en/configuration/security/password-policy.md +++ b/docs/content/en/configuration/security/password-policy.md @@ -18,6 +18,8 @@ aliases: ## Configuration +{{< config-alert-example >}} + ```yaml password_policy: standard: @@ -35,6 +37,8 @@ password_policy: ## Options +This section describes the individual configuration options. + ### standard This section allows you to enable standard security policies. diff --git a/docs/content/en/configuration/security/regulation.md b/docs/content/en/configuration/security/regulation.md index 705c7e718..3c818095d 100644 --- a/docs/content/en/configuration/security/regulation.md +++ b/docs/content/en/configuration/security/regulation.md @@ -20,15 +20,19 @@ authentication attempts. This helps prevent brute-force attacks. ## Configuration +{{< config-alert-example >}} + ```yaml regulation: max_retries: 3 - find_time: 2m - ban_time: 5m + find_time: '2m' + ban_time: '5m' ``` ## Options +This section describes the individual configuration options. + ### max_retries {{< confkey type="integer" default="3" required="no" >}} @@ -39,8 +43,8 @@ The number of failed login attempts before a user may be banned. Setting this op {{< confkey type="duration" default="2m" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time analyzed for failed attempts. For example if you set `max_retries` to 3 and `find_time` to `2m` this means the user must have 3 failed logins in @@ -50,8 +54,8 @@ example if you set `max_retries` to 3 and `find_time` to `2m` this means the use {{< confkey type="duration" default="5m" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time the user is banned for after meeting the `max_retries` and `find_time` configuration. After this duration the account will be able to login again. diff --git a/docs/content/en/configuration/session/introduction.md b/docs/content/en/configuration/session/introduction.md index 4a5ed19ca..323cd505d 100644 --- a/docs/content/en/configuration/session/introduction.md +++ b/docs/content/en/configuration/session/introduction.md @@ -20,24 +20,24 @@ the session cookie behaviour and the domains which Authelia can service authoriz ## Configuration +{{< config-alert-example >}} + ```yaml session: - secret: insecure_session_secret - - name: authelia_session - same_site: lax - inactivity: 5m - expiration: 1h - remember_me: 1M - + secret: 'insecure_session_secret' + name: 'authelia_session' + same_site: 'lax' + inactivity: '5m' + expiration: '1h' + remember_me: '1M' cookies: - - domain: example.com - authelia_url: https://auth.example.com - name: authelia_session - same_site: lax - inactivity: 5m - expiration: 1h - remember_me: 1d + - domain: 'example.com' + authelia_url: 'https://auth.example.com' + name: 'authelia_session' + same_site: 'lax' + inactivity: '5m' + expiration: '1h' + remember_me: '1d' ``` ## Providers @@ -56,6 +56,8 @@ providers are recommended. ## Options +This section describes the individual configuration options. + ### secret {{< confkey type="string" required="yes" >}} @@ -95,8 +97,8 @@ The default `same_site` value for all `cookies` configurations. {{< confkey type="duration" default="5m" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The default `inactivity` value for all [cookies](#cookies) configurations. @@ -104,8 +106,8 @@ The default `inactivity` value for all [cookies](#cookies) configurations. {{< confkey type="duration" default="1h" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The default `expiration` value for all [cookies](#cookies) configurations. @@ -113,8 +115,8 @@ The default `expiration` value for all [cookies](#cookies) configurations. {{< confkey type="duration" default="1M" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The default `remember_me` value for all [cookies](#cookies) configurations. @@ -193,8 +195,8 @@ state but it's available as an option anyway. *__Default Value:__ This option takes its default value from the [inactivity](#inactivity) setting above.* -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time the user can be inactive for until the session is destroyed. Useful if you want long session timers but don't want unused devices to be vulnerable. @@ -205,8 +207,8 @@ but don't want unused devices to be vulnerable. *__Default Value:__ This option takes its default value from the [expiration](#expiration) setting above.* -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time before the cookie expires and the session is destroyed. This is overriden by [remember_me](#rememberme) when the remember me box is checked. @@ -217,8 +219,8 @@ The period of time before the cookie expires and the session is destroyed. This *__Default Value:__ This option takes its default value from the [remember_me](#rememberme) setting above.* -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time before the cookie expires and the session is destroyed when the remember me box is checked. Setting this to `-1` disables this feature entirely for this session cookie domain. diff --git a/docs/content/en/configuration/session/redis.md b/docs/content/en/configuration/session/redis.md index fa6b9dd8a..e663a4b42 100644 --- a/docs/content/en/configuration/session/redis.md +++ b/docs/content/en/configuration/session/redis.md @@ -20,21 +20,23 @@ this option and we highly recommend it in production environments. It requires y ## Configuration +{{< config-alert-example >}} + ```yaml session: redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 - username: authelia - password: authelia + username: 'authelia' + password: 'authelia' database_index: 0 maximum_active_connections: 8 minimum_idle_connections: 0 tls: - server_name: myredis.example.com + server_name: 'myredis.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -103,15 +105,15 @@ session: DO NOT USE== -----END RSA PRIVATE KEY----- high_availability: - sentinel_name: mysentinel + sentinel_name: 'mysentinel' # If `sentinel_username` is supplied, Authelia will connect using ACL-based # authentication. Otherwise, it will use traditional `requirepass` auth. - sentinel_username: sentinel_user - sentinel_password: sentinel_specific_pass + sentinel_username: 'sentinel_user' + sentinel_password: 'sentinel_specific_pass' nodes: - - host: sentinel-node1 + - host: 'sentinel-node1' port: 26379 - - host: sentinel-node2 + - host: 'sentinel-node2' port: 26379 route_by_latency: false route_randomly: false @@ -119,6 +121,8 @@ session: ## Options +This section describes the individual configuration options. + ### host {{< confkey type="string" required="yes" >}} @@ -178,8 +182,12 @@ is useful if there are long delays in establishing connections. ### tls -If defined enables [redis] over TLS, and additionally controls the TLS connection validation process. You can see how to -configure the tls section [here](../prologue/common.md#tls-configuration). +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + +If defined enables connecting to [redis] over a TLS socket, and additionally controls the TLS connection +validation parameters. ### high_availability diff --git a/docs/content/en/configuration/storage/introduction.md b/docs/content/en/configuration/storage/introduction.md index d2c09e830..8f7a44efc 100644 --- a/docs/content/en/configuration/storage/introduction.md +++ b/docs/content/en/configuration/storage/introduction.md @@ -21,9 +21,11 @@ The available storage backends are listed in the table of contents below. ## Configuration +{{< config-alert-example >}} + ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' local: {} mysql: {} postgres: {} @@ -31,6 +33,8 @@ storage: ## Options +This section describes the individual configuration options. + ### encryption_key {{< confkey type="string" required="yes" >}} diff --git a/docs/content/en/configuration/storage/mysql.md b/docs/content/en/configuration/storage/mysql.md index 227eff96f..f638d0c45 100644 --- a/docs/content/en/configuration/storage/mysql.md +++ b/docs/content/en/configuration/storage/mysql.md @@ -22,21 +22,22 @@ guide for supported version information. ## Configuration +{{< config-alert-example >}} + ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia - password: mypassword - timeout: 5s + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' + password: 'mypassword' + timeout: '5s' tls: - server_name: mysql.example.com + server_name: 'mysql.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -108,37 +109,41 @@ storage: ## Options +This section describes the individual configuration options. + ### encryption_key See the [encryption_key docs](introduction.md#encryption_key). -### host +### address -{{< confkey type="string" default="localhost" required="no" >}} +{{< confkey type="address" required="yes" >}} -The database server host. This can also be a unix socket. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: +Configures the address for the MySQL/MariaDB Server. The address itself is a connector and the scheme must either be +the `unix` scheme or one of the `tcp` schemes. + +__Examples:__ ```yaml storage: mysql: - host: "[fd00:1111:2222:3333::1]" + address: 'tcp://127.0.0.1:3306' ``` -If utilizing a unix socket it must have the `/` prefix: - ```yaml storage: mysql: - host: /var/run/mysqld.sock + address: 'tcp://[fd00:1111:2222:3333::1]:3306' ``` -### port - -{{< confkey type="integer" default="3306" required="no" >}} - -The port the database server is listening on. +```yaml +storage: + mysql: + address: 'unix:///var/run/mysqld.sock' +``` ### database @@ -170,12 +175,19 @@ characters and the user password is changed to this value. {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The SQL connection timeout. ### tls +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + If defined enables connecting to [MySQL] or [MariaDB] over a TLS socket, and additionally controls the TLS connection -validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration). +validation parameters. [MySQL]: https://www.mysql.com/ [MariaDB]: https://mariadb.org/ diff --git a/docs/content/en/configuration/storage/postgres.md b/docs/content/en/configuration/storage/postgres.md index 8ea2fae07..993f3c978 100644 --- a/docs/content/en/configuration/storage/postgres.md +++ b/docs/content/en/configuration/storage/postgres.md @@ -21,21 +21,22 @@ guide for supported version information. ## Configuration +{{< config-alert-example >}} + ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' postgres: - host: 127.0.0.1 - port: 5432 - database: authelia - schema: public - username: authelia - password: mypassword + address: 'tcp://127.0.0.1:5432' + database: 'authelia' + schema: 'public' + username: 'authelia' + password: 'mypassword' tls: - server_name: postgres.example.com + server_name: 'postgres.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -107,37 +108,41 @@ storage: ## Options +This section describes the individual configuration options. + ### encryption_key -See the [encryption_key docs](introduction.md#encryption_key). +See the [encryption_key docs](introduction.md#encryptionkey). -### host +### address -{{< confkey type="string" required="yes" >}} +{{< confkey type="address" required="yes" >}} -The database server host. This can also be a unix socket. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: +Configures the address for the PostgreSQL Server. The address itself is a connector and the scheme must either be +the `unix` scheme or one of the `tcp` schemes. + +__Examples:__ ```yaml storage: postgres: - host: "[fd00:1111:2222:3333::1]" + address: 'tcp://127.0.0.1:5432' ``` -If utilizing a unix socket it must have the `/` prefix: - ```yaml storage: postgres: - host: /var/run/postgres.sock + address: 'tcp://[fd00:1111:2222:3333::1]:5432' ``` -### port - -{{< confkey type="integer" default="5432" required="no" >}} - -The port the database server is listening on. +```yaml +storage: + postgres: + address: 'unix:///var/run/postgres.sock' +``` ### database @@ -176,11 +181,18 @@ characters and the user password is changed to this value. {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The SQL connection timeout. ### tls +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + If defined enables connecting to [PostgreSQL] over a TLS socket, and additionally controls the TLS connection -validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration). +validation parameters. [PostgreSQL]: https://www.postgresql.org/ diff --git a/docs/content/en/configuration/storage/sqlite.md b/docs/content/en/configuration/storage/sqlite.md index cdb39a319..417388a4d 100644 --- a/docs/content/en/configuration/storage/sqlite.md +++ b/docs/content/en/configuration/storage/sqlite.md @@ -24,15 +24,19 @@ but this requires you setup an external database such as [PostgreSQL](postgres.m ## Configuration +{{< config-alert-example >}} + ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' local: - path: /config/db.sqlite3 + path: '/config/db.sqlite3' ``` ## Options +This section describes the individual configuration options. + ### encryption_key See the [encryption_key docs](introduction.md#encryptionkey). diff --git a/docs/content/en/configuration/telemetry/metrics.md b/docs/content/en/configuration/telemetry/metrics.md index 4917637e1..4c9b3acbf 100644 --- a/docs/content/en/configuration/telemetry/metrics.md +++ b/docs/content/en/configuration/telemetry/metrics.md @@ -16,22 +16,27 @@ toc: true ## Configuration +{{< config-alert-example >}} + ```yaml telemetry: metrics: enabled: false - address: "tcp://0.0.0.0:9959" + address: 'tcp://:9959' + umask: 0022 buffers: read: 4096 write: 4096 timeouts: - read: 6s - write: 6s - idle: 30s + read: '6s' + write: '6s' + idle: '30s' ``` ## Options +This section describes the individual configuration options. + ### enabled {{< confkey type="boolean" default="false" required="no" >}} @@ -40,20 +45,43 @@ Determines if the [Prometheus] HTTP Metrics Exporter is enabled. ### address -{{< confkey type="address" default="tcp://0.0.0.0:9959" required="no" >}} +{{< confkey type="address" default="tcp://:9959" required="no" >}} -Configures the listener address for the [Prometheus] HTTP Metrics Exporter. This configuration key uses the -[Address](../prologue/common.md#address) format. The scheme must be `tcp://` or empty. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* + +Configures the listener address for the [Prometheus] Metrics Exporter HTTP Server. The address itself is a listener and +the scheme must either be the `unix` scheme or one of the `tcp` schemes. + +### umask + +{{< confkey type="int" required="no" >}} + +If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the +[address](#address). Typically this should be set before the process is actually running and users should not use this +option, however it's recognized in various specific scenarios this may not be completely adequate. + +One such example is when you want the proxy to have permission to the socket but not the files, in which case running a +umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has +permission to the socket. + +This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly. ### buffers -Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server buffers common structure](../prologue/common.md#server-buffers). Please see the +[documentation](../prologue/common.md#server-buffers) on this structure for more information.* + +Configures the server buffers. ### timeouts -Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the +[documentation](../prologue/common.md#server-timeouts) on this structure for more information.* + +Configures the server timeouts. ## See More diff --git a/docs/content/en/integration/deployment/bare-metal.md b/docs/content/en/integration/deployment/bare-metal.md index 8e03e00fb..51f44a85a 100644 --- a/docs/content/en/integration/deployment/bare-metal.md +++ b/docs/content/en/integration/deployment/bare-metal.md @@ -42,6 +42,16 @@ on most Debian based operating systems. In addition to the `.deb` packages we also have an [APT Repository](https://apt.authelia.com). +## Nix + +Using the Nix package manager Authelia is available via the `https://nixos.org/channels/nixpkgs-unstable` channel. + +```shell +$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable +$ nix-channel --update +$ nix-env -iA nixpkgs.authelia +``` + ## FreeBSD In addition to the [binaries](#binaries) we publish, [FreshPorts](https://www.freshports.org/www/authelia/) offer a diff --git a/docs/content/en/integration/kubernetes/istio.md b/docs/content/en/integration/kubernetes/istio.md index 60360c6b0..9201d50c5 100644 --- a/docs/content/en/integration/kubernetes/istio.md +++ b/docs/content/en/integration/kubernetes/istio.md @@ -30,8 +30,8 @@ This is an example IstioOperator manifest adjusted to authenticate with Authelia portions of the resource that you add as well as context. You will need to adapt it to your needs. ```yaml -apiVersion: install.istio.io/v1alpha1 -kind: IstioOperator +apiVersion: 'install.istio.io/v1alpha1' +kind: 'IstioOperator' spec: meshConfig: extensionProviders: @@ -63,13 +63,13 @@ spec: The following [Authorization Policy] applies the above filter extension provider to the `nextcloud.example.com` domain: ```yaml -apiVersion: security.istio.io/v1beta1 -kind: AuthorizationPolicy +apiVersion: 'security.istio.io/v1beta1' +kind: 'AuthorizationPolicy' metadata: - name: nextcloud - namespace: apps + name: 'nextcloud' + namespace: 'apps' spec: - action: CUSTOM + action: 'CUSTOM' provider: name: 'authelia' rules: diff --git a/docs/content/en/integration/kubernetes/traefik-ingress.md b/docs/content/en/integration/kubernetes/traefik-ingress.md index 3a50d8e9e..d2ffd2d38 100644 --- a/docs/content/en/integration/kubernetes/traefik-ingress.md +++ b/docs/content/en/integration/kubernetes/traefik-ingress.md @@ -51,14 +51,14 @@ __SHOULD NOT__ be applied to the Authelia [Ingress] / [IngressRoute] itself.* {{< details "middleware.yml" >}} ```yaml --- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware +apiVersion: 'traefik.containo.us/v1alpha1' +kind: 'Middleware' metadata: - name: forwardauth-authelia - namespace: default + name: 'forwardauth-authelia' + namespace: 'default' labels: - app.kubernetes.io/instance: authelia - app.kubernetes.io/name: authelia + app.kubernetes.io/instance: 'authelia' + app.kubernetes.io/name: 'authelia' spec: forwardAuth: address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth' @@ -85,25 +85,25 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat {{< details "ingress.yml" >}} ```yaml --- -apiVersion: networking.k8s.io/v1 -kind: Ingress +apiVersion: 'networking.k8s.io/v1' +kind: 'Ingress' metadata: - name: app - namespace: default + name: 'app' + namespace: 'default' annotations: - traefik.ingress.kubernetes.io/router.entryPoints: websecure - traefik.ingress.kubernetes.io/router.middlewares: default-forwardauth-authelia@kubernetescrd - traefik.ingress.kubernetes.io/router.tls: "true" + traefik.ingress.kubernetes.io/router.entryPoints: 'websecure' + traefik.ingress.kubernetes.io/router.middlewares: 'default-forwardauth-authelia@kubernetescrd' + traefik.ingress.kubernetes.io/router.tls: 'true' spec: rules: - - host: app.example.com + - host: 'app.example.com' http: paths: - - path: /bar - pathType: Prefix + - path: '/bar' + pathType: 'Prefix' backend: service: - name: app + name: 'app' port: number: 80 ... @@ -119,27 +119,27 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat {{< details "ingressRoute.yml" >}} ```yaml --- -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute +apiVersion: 'traefik.containo.us/v1alpha1' +kind: 'IngressRoute' metadata: - name: app - namespace: default + name: 'app' + namespace: 'default' spec: entryPoints: - - websecure + - 'websecure' routes: - - kind: Rule - match: Host(`app.example.com`) + - kind: 'Rule' + match: 'Host(`app.example.com`)' middlewares: - - name: forwardauth-authelia - namespace: default + - name: 'forwardauth-authelia' + namespace: 'default' services: - - kind: Service - name: app - namespace: default + - kind: 'Service' + name: 'app' + namespace: 'default' port: 80 - scheme: http - strategy: RoundRobin + scheme: 'http' + strategy: 'RoundRobin' weight: 10 ... ``` diff --git a/docs/content/en/integration/ldap/introduction.md b/docs/content/en/integration/ldap/introduction.md index 596caa125..6988ee9e7 100644 --- a/docs/content/en/integration/ldap/introduction.md +++ b/docs/content/en/integration/ldap/introduction.md @@ -44,8 +44,8 @@ In your Authelia configuration you will need to enter and update the following v ```yaml ldap: + address: 'ldap://OpenLDAP:1389' implementation: custom - url: ldap://OpenLDAP:1389 timeout: 5s start_tls: false tls: @@ -91,8 +91,8 @@ In your Authelia configuration you will need to enter and update the following v ```yaml ldap: + address: 'ldaps://ldap.example.com' implementation: custom - url: ldaps://ldap.example.com timeout: 5s start_tls: false tls: @@ -134,8 +134,8 @@ In your Authelia configuration you will need to enter and update the following v ```yaml ldap: + address: 'ldap://lldap:3890' implementation: custom - url: ldap://lldap:3890 timeout: 5s start_tls: false base_dn: dc=example,DC=com diff --git a/docs/content/en/integration/openid-connect/apache-guacamole/index.md b/docs/content/en/integration/openid-connect/apache-guacamole/index.md index 856ed202f..ac21220f2 100644 --- a/docs/content/en/integration/openid-connect/apache-guacamole/index.md +++ b/docs/content/en/integration/openid-connect/apache-guacamole/index.md @@ -62,23 +62,23 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: guacamole - description: Apache Guacamole + - id: 'guacamole' + description: 'Apache Guacamole' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://guacamole.example.com + - 'https://guacamole.example.com' scopes: - - openid - - profile - - groups - - email + - 'openid' + - 'profile' + - 'groups' + - 'email' response_types: - - id_token + - 'id_token' grant_types: - - implicit - userinfo_signing_algorithm: none + - 'implicit' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/argocd/index.md b/docs/content/en/integration/openid-connect/argocd/index.md index b37fd2e1d..43071cced 100644 --- a/docs/content/en/integration/openid-connect/argocd/index.md +++ b/docs/content/en/integration/openid-connect/argocd/index.md @@ -65,32 +65,32 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: argocd - description: Argo CD + - id: 'argocd' + description: 'Argo CD' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://argocd.example.com/auth/callback + - 'https://argocd.example.com/auth/callback' scopes: - - openid - - groups - - email - - profile - userinfo_signing_algorithm: none - - id: argocd-cli - description: Argo CD (CLI) + - 'openid' + - 'groups' + - 'email' + - 'profile' + userinfo_signing_algorithm: 'none' + - id: 'argocd-cli' + description: 'Argo CD (CLI)' public: true - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - http://localhost:8085/auth/callback + - 'http://localhost:8085/auth/callback' scopes: - - openid - - groups - - email - - profile - - offline_access - userinfo_signing_algorithm: none + - 'openid' + - 'groups' + - 'email' + - 'profile' + - 'offline_access' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/bookstack/index.md b/docs/content/en/integration/openid-connect/bookstack/index.md index 73e8214a2..3d8ef133c 100644 --- a/docs/content/en/integration/openid-connect/bookstack/index.md +++ b/docs/content/en/integration/openid-connect/bookstack/index.md @@ -67,18 +67,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: bookstack - description: BookStack + - id: 'bookstack' + description: 'BookStack' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://bookstack.example.com/oidc/callback + - 'https://bookstack.example.com/oidc/callback' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md b/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md index eecf2c9fc..2259f473a 100644 --- a/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md +++ b/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md @@ -75,18 +75,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: cloudflare - description: Cloudflare ZeroTrust + - id: 'cloudflare' + description: 'Cloudflare ZeroTrust' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://example-team.cloudflareaccess.com/cdn-cgi/access/callback + - 'https://example-team.cloudflareaccess.com/cdn-cgi/access/callback' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/firezone/index.md b/docs/content/en/integration/openid-connect/firezone/index.md index 39728c5a1..121c49cc3 100644 --- a/docs/content/en/integration/openid-connect/firezone/index.md +++ b/docs/content/en/integration/openid-connect/firezone/index.md @@ -76,20 +76,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: firezone - description: Firezone + - id: 'firezone' + description: 'Firezone' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' enforce_pkce: true - pkce_challenge_method: S256 + pkce_challenge_method: 'S256' redirect_uris: - - https://firezone.example.com/auth/oidc/authelia/callback + - 'https://firezone.example.com/auth/oidc/authelia/callback' scopes: - - openid - - email - - profile - userinfo_signing_algorithm: none + - 'openid' + - 'email' + - 'profile' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/frequently-asked-questions.md b/docs/content/en/integration/openid-connect/frequently-asked-questions.md index 0862e1f1a..e7557003c 100644 --- a/docs/content/en/integration/openid-connect/frequently-asked-questions.md +++ b/docs/content/en/integration/openid-connect/frequently-asked-questions.md @@ -132,7 +132,7 @@ services: ## Mandatory that the proxy is on the same network as the application, and that it has this alias. proxy: aliases: - - auth.example.com + - 'auth.example.com' authelia: networks: proxy: {} @@ -140,7 +140,7 @@ networks: proxy: ## An external network can be created manually and shared between multiple compose files. This is NOT mandatory. external: true - name: proxy-net + name: 'proxy-net' ``` ```console diff --git a/docs/content/en/integration/openid-connect/gitea/index.md b/docs/content/en/integration/openid-connect/gitea/index.md index c51fdc238..ed4c691c9 100644 --- a/docs/content/en/integration/openid-connect/gitea/index.md +++ b/docs/content/en/integration/openid-connect/gitea/index.md @@ -86,18 +86,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: gitea - description: Gitea + - id: 'gitea' + description: 'Gitea' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://gitea.example.com/user/oauth2/authelia/callback + - 'https://gitea.example.com/user/oauth2/authelia/callback' scopes: - - openid - - email - - profile - userinfo_signing_algorithm: none + - 'openid' + - 'email' + - 'profile' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/gitlab/index.md b/docs/content/en/integration/openid-connect/gitlab/index.md index 72bc826bd..71ba8d01c 100644 --- a/docs/content/en/integration/openid-connect/gitlab/index.md +++ b/docs/content/en/integration/openid-connect/gitlab/index.md @@ -78,19 +78,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: gitlab - description: GitLab + - id: 'gitlab' + description: 'GitLab' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://gitlab.example.com/users/auth/openid_connect/callback + - 'https://gitlab.example.com/users/auth/openid_connect/callback' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/grafana/index.md b/docs/content/en/integration/openid-connect/grafana/index.md index 45fc15f79..245b588c6 100644 --- a/docs/content/en/integration/openid-connect/grafana/index.md +++ b/docs/content/en/integration/openid-connect/grafana/index.md @@ -96,19 +96,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: grafana - description: Grafana + - id: 'grafana' + description: 'Grafana' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://grafana.example.com/login/generic_oauth + - 'https://grafana.example.com/login/generic_oauth' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/harbor/index.md b/docs/content/en/integration/openid-connect/harbor/index.md index 42d42909b..2c8223657 100644 --- a/docs/content/en/integration/openid-connect/harbor/index.md +++ b/docs/content/en/integration/openid-connect/harbor/index.md @@ -69,19 +69,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: harbor - description: Harbor + - id: 'harbor' + description: 'Harbor' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://harbor.example.com/c/oidc/callback + - 'https://harbor.example.com/c/oidc/callback' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/hashicorp-vault/index.md b/docs/content/en/integration/openid-connect/hashicorp-vault/index.md index 2f14beb74..8c5a9713c 100644 --- a/docs/content/en/integration/openid-connect/hashicorp-vault/index.md +++ b/docs/content/en/integration/openid-connect/hashicorp-vault/index.md @@ -52,20 +52,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: vault - description: HashiCorp Vault + - id: 'vault' + description: 'HashiCorp Vault' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://vault.example.com/oidc/callback - - https://vault.example.com/ui/vault/auth/oidc/oidc/callback + - 'https://vault.example.com/oidc/callback' + - 'https://vault.example.com/ui/vault/auth/oidc/oidc/callback' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/kasm-workspaces/index.md b/docs/content/en/integration/openid-connect/kasm-workspaces/index.md index 2860bcbf1..873c04098 100644 --- a/docs/content/en/integration/openid-connect/kasm-workspaces/index.md +++ b/docs/content/en/integration/openid-connect/kasm-workspaces/index.md @@ -67,20 +67,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: kasm - description: Kasm Workspaces + - id: 'kasm' + description: 'Kasm Workspaces' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://kasm.example.com/api/oidc_callback + - 'https://kasm.example.com/api/oidc_callback' scopes: - - openid - - profile - - groups - - email - consent_mode: implicit - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + consent_mode: 'implicit' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/komga/index.md b/docs/content/en/integration/openid-connect/komga/index.md index d07272e71..2299af893 100644 --- a/docs/content/en/integration/openid-connect/komga/index.md +++ b/docs/content/en/integration/openid-connect/komga/index.md @@ -50,16 +50,16 @@ spring: client: registration: authelia: - client-id: `komga` - client-secret: `insecure_secret` - client-name: Authelia - scope: openid,profile,email - authorization-grant-type: authorization_code + client-id: 'komga' + client-secret: 'insecure_secret' + client-name: 'Authelia' + scope: 'openid,profile,email' + authorization-grant-type: 'authorization_code' redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/login/oauth2/code/authelia" provider: authelia: - issuer-uri: https://auth.example.com - user-name-attribute: preferred_username + issuer-uri: 'https://auth.example.com' + user-name-attribute: 'preferred_username' ```` ### Authelia @@ -74,20 +74,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: komga - description: Komga + - id: 'komga' + description: 'Komga' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://komga.example.com/login/oauth2/code/authelia + - 'https://komga.example.com/login/oauth2/code/authelia' scopes: - - openid - - profile - - email + - 'openid' + - 'profile' + - 'email' grant_types: - - authorization_code - userinfo_signing_algorithm: none + - 'authorization_code' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/minio/index.md b/docs/content/en/integration/openid-connect/minio/index.md index 6a0b2c801..8b3067002 100644 --- a/docs/content/en/integration/openid-connect/minio/index.md +++ b/docs/content/en/integration/openid-connect/minio/index.md @@ -72,19 +72,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: minio - description: MinIO + - id: 'minio' + description: 'MinIO' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://minio.example.com/apps/oidc_login/oidc + - 'https://minio.example.com/apps/oidc_login/oidc' scopes: - - openid - - profile - - email - - groups - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + - 'groups' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/misago/index.md b/docs/content/en/integration/openid-connect/misago/index.md index d462c25e5..dc11c8efc 100644 --- a/docs/content/en/integration/openid-connect/misago/index.md +++ b/docs/content/en/integration/openid-connect/misago/index.md @@ -87,23 +87,24 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: misago + - id: 'misago' + description: 'Misago' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' scopes: - - openid - - profile - - email + - 'openid' + - 'profile' + - 'email' redirect_uris: - - https://misago.example.com/oauth2/complete/ + - 'https://misago.example.com/oauth2/complete/' grant_types: - - authorization_code + - 'authorization_code' response_types: - - code + - 'code' response_modes: - - query - userinfo_signing_algorithm: none + - 'query' + userinfo_signing_algorithm: 'none' ``` --- diff --git a/docs/content/en/integration/openid-connect/nextcloud/index.md b/docs/content/en/integration/openid-connect/nextcloud/index.md index 83249dc46..540e2069e 100644 --- a/docs/content/en/integration/openid-connect/nextcloud/index.md +++ b/docs/content/en/integration/openid-connect/nextcloud/index.md @@ -95,19 +95,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: nextcloud - description: NextCloud + - id: 'nextcloud' + description: 'NextCloud' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://nextcloud.example.com/apps/oidc_login/oidc + - 'https://nextcloud.example.com/apps/oidc_login/oidc' scopes: - - openid - - profile - - email - - groups - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + - 'groups' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/outline/index.md b/docs/content/en/integration/openid-connect/outline/index.md index c01c7720a..1a330e0f8 100644 --- a/docs/content/en/integration/openid-connect/outline/index.md +++ b/docs/content/en/integration/openid-connect/outline/index.md @@ -69,19 +69,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: outline - description: Outline + - id: 'outline' + description: 'Outline' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://outline.example.com/auth/oidc.callback + - 'https://outline.example.com/auth/oidc.callback' scopes: - - openid - - offline_access - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'offline_access' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/portainer/index.md b/docs/content/en/integration/openid-connect/portainer/index.md index 511461cdc..e50a282da 100644 --- a/docs/content/en/integration/openid-connect/portainer/index.md +++ b/docs/content/en/integration/openid-connect/portainer/index.md @@ -70,19 +70,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: portainer - description: Portainer + - id: 'portainer' + description: 'Portainer' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://portainer.example.com + - 'https://portainer.example.com' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/proxmox/index.md b/docs/content/en/integration/openid-connect/proxmox/index.md index f7ba35255..17eefafc9 100644 --- a/docs/content/en/integration/openid-connect/proxmox/index.md +++ b/docs/content/en/integration/openid-connect/proxmox/index.md @@ -74,18 +74,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: proxmox - description: Proxmox + - id: 'proxmox' + description: 'Proxmox' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://proxmox.example.com + - 'https://proxmox.example.com' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/seafile/index.md b/docs/content/en/integration/openid-connect/seafile/index.md index 0a1d5d021..41b4e1482 100644 --- a/docs/content/en/integration/openid-connect/seafile/index.md +++ b/docs/content/en/integration/openid-connect/seafile/index.md @@ -78,18 +78,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: seafile - description: Seafile + - id: 'seafile' + description: 'Seafile' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://seafile.example.com/oauth/callback/ + - 'https://seafile.example.com/oauth/callback/' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/synapse/index.md b/docs/content/en/integration/openid-connect/synapse/index.md index 13428e28f..1927f306e 100644 --- a/docs/content/en/integration/openid-connect/synapse/index.md +++ b/docs/content/en/integration/openid-connect/synapse/index.md @@ -72,18 +72,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: synapse - description: Synapse + - id: 'synapse' + description: 'Synapse' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://synapse.example.com/_synapse/client/oidc/callback + - 'https://synapse.example.com/_synapse/client/oidc/callback' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/synology-dsm/index.md b/docs/content/en/integration/openid-connect/synology-dsm/index.md index e6de3acec..a5dcd075e 100644 --- a/docs/content/en/integration/openid-connect/synology-dsm/index.md +++ b/docs/content/en/integration/openid-connect/synology-dsm/index.md @@ -74,19 +74,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: synology-dsm - description: Synology DSM + - id: 'synology-dsm' + description: 'Synology DSM' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://dsm.example.com + - 'https://dsm.example.com' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/tailscale/index.md b/docs/content/en/integration/openid-connect/tailscale/index.md index e8c35d1a6..3a3f927dd 100644 --- a/docs/content/en/integration/openid-connect/tailscale/index.md +++ b/docs/content/en/integration/openid-connect/tailscale/index.md @@ -17,7 +17,7 @@ community: true * [Authelia] * [v4.37.5](https://github.com/authelia/authelia/releases/tag/v4.37.5) -* [Tailscale] - Note: Version not important, since configuration is via the web UI +* [Tailscale] - **Note:** Version not important, since configuration is via the WebUI * [1.38.4](https://github.com/tailscale/tailscale/releases/tag/v1.38.4) ## Before You Begin @@ -36,35 +36,39 @@ This example makes the following assumptions: ## Configuration -The configuration in Authelia is straightforwarded: Tailscale is just another `identity_provider/oidc` entry. Complicating things is the necessary WebFinger reply for your domain - see the following [Application](#application) section. +The configuration in Authelia is straight forward, Tailscale is just another `identity_provider/oidc` entry. +Tailscale also requires a WebFinger reply for your domain - see the following [Application](#application) +section. ### Application -To configure [Tailscale] to utilize Authelia as an [OpenID Connect 1.0] Provider, you will need a public WebFinger reply for your domain (see [RFC 7033](https://www.rfc-editor.org/rfc/rfc7033#section-3.1)) and point it to Authelia. The steps necessary are outlined in the Tailscale documentation on [Custom OIDC providers](https://tailscale.com/kb/1240/sso-custom-oidc/). This WebFinger reply is not generated by Authelia, so your external webserver hosted at the root of your domain will need to generate the reponse (Check [See also](#see-also) for example implementations). The following steps are necessary to get Tailscale working with Authelia: +To configure [Tailscale] to utilize Authelia as a [OpenID Connect 1.0] Provider, you will need a public WebFinger reply +for your domain (see [RFC7033 Section 3.1]) and point it to Authelia. The steps necessary are outlined in the Tailscale +documentation on [Custom OIDC providers KB article]. This WebFinger reply is not generated by Authelia, so your external +webserver hosted at the root of your domain will need to generate the response (Check [See also](#see-also) for example +implementations). The following steps are necessary to get Tailscale working with Authelia: 1. Your domain will need to reply to a WebFinger request for your Authelia account -2. Your domain root is `example.com` and the Authelia account in question is `user@example.com`, the WebFinger request will be: `https://example.com/.well-known/webfinger/?resource=acct:user@example.com` (the complete request is `https://example.com/.well-known/webfinger?rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer&resource=acct%3Auser%40example.com`) +2. Your domain root is `example.com` and the Authelia account in question is `user@example.com` the WebFinger request +will be: `https://example.com/.well-known/webfinger/?resource=acct:user@example.com the complete request is `https://example.com/.well-known/webfinger?rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer&resource=acct%3Auser%40example.com` 3. The WebFinger request needs to be answered with the following example reply: -``` +```json { - "subject" : "acct:user@example.com", - "links" : - [ - { - "rel" : "http://openid.net/specs/connect/1.0/issuer", - "href" : "https://auth.example.com" - } - ] + "subject": "acct:user@example.com", + "links": [{ + "rel": "http://openid.net/specs/connect/1.0/issuer", + "href": "https://auth.example.com" + }] } ``` -4. For any other users that you want to add to Tailscale, you will need to to provide similar WebFinger replies (e.g. for `user2@example.com` or `user3@example.com`) -5. Once you have the WebFinger reply set up and your [Authelia OpenID Connect Discovery endpoint](https://www.authelia.com/integration/openid-connect/introduction/#well-known-discovery-endpoints) is working (e.g. `https://auth.example.com/.well-known/openid-configuration`), you can sign up for a **new Tailnet** (currently migration isn't supported) via the link: [Sign up with OIDC](https://login.tailscale.com/start/oidc) where you will see the following screen: -{{< figure src="tailscale_signup_1.png" alt="Tailscale Signup Screen 1" width="300" >}} +4. For any other users that you want to add to Tailscale, you will need to provide similar WebFinger replies (e.g. for `user2@example.com` or `user3@example.com`) +5. Once you have the WebFinger reply set up and your [Authelia OpenID Connect Discovery endpoint](https://www.authelia.com/integration/openid-connect/introduction/#well-known-discovery-endpoints) is working (e.g. `https://auth.example.com/.well-known/openid-configuration`), you can sign up for a **new Tailnet** (migration can only be done if the Tailnet is associated with a custom domain) via the link: [Sign up with OIDC](https://login.tailscale.com/start/oidc) where you will see the following screen: \ +{{< figure src="tailscale_signup_1.png" alt="Tailscale Signup Screen 1" width="300" >}} \ **Note:** Even though the WebFinger URL displayed is `https://example.com/.well-known/webfinger`, the actual GET request will be including request parameters, most importantly `resource`. -6. After clicking on **Get OIDC Issuer**, Tailscale will fetch the WebFinger reply via `https://example.com/.well-known/webfinger/?resource=acct:user@example.com` and follow the set `href` to `https://auth.example.com/.well-known/openid-configuration`. -**Note:** make sure that the `href` URL matches the `issuer` URL returned from the Authelia OIDC dicsovery endpoint -7. On the next screen you will need to add your client ID & secret configured in Authelia to finish the OIDC provider registration in [Tailscale]. See the following example screenshot: +6. After clicking on **Get OIDC Issuer**, Tailscale will fetch the WebFinger reply via `https://example.com/.well-known/webfinger/?resource=acct:user@example.com` and follow the set `href` to `https://auth.example.com/.well-known/openid-configuration`. \ +**Note:** Make sure that the `href` URL matches the `issuer` URL returned from the Authelia OIDC discovery endpoint +7. On the next screen you will need to add your client ID & secret configured in Authelia to finish the OIDC provider registration in [Tailscale]. See the following example screenshot: \ {{< figure src="tailscale_signup_2.png" alt="Tailscale Signup Screen 2" width="300" >}} @@ -80,23 +84,25 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: tailscale - description: Tailscale SSO + - id: 'tailscale' + description: 'Tailscale' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. redirect_uris: - - https://login.tailscale.com/a/oauth_response + - 'https://login.tailscale.com/a/oauth_response' scopes: - - openid - - email - - profile + - 'openid' + - 'email' + - 'profile' ``` ## See Also -- [Tailscale] [Custom OIDC Provider Knowledge Base entry](https://tailscale.com/kb/1240/sso-custom-oidc/): -- [RFC 7033, Identity Provider Discovery for OpenID Connect](https://www.rfc-editor.org/rfc/rfc7033#section-3.1) +- [Tailscale] [Custom OIDC providers KB article] +- [RFC7033 Section 3.1] _WebFinger: Identity Provider Discovery for OpenID Connect_ - [WebFinger example implementations](https://webfinger.net/code/) [Authelia]: https://www.authelia.com [Tailscale]: https://tailscale.com +[Custom OIDC providers KB article]: https://tailscale.com/kb/1240/sso-custom-oidc/ +[RFC7033 Section 3.1]: https://datatracker.ietf.org/doc/html/rfc7033#section-3.1 [OpenID Connect 1.0]: ../../openid-connect/introduction.md diff --git a/docs/content/en/integration/proxies/caddy.md b/docs/content/en/integration/proxies/caddy.md index 850538aaa..7e2496ce7 100644 --- a/docs/content/en/integration/proxies/caddy.md +++ b/docs/content/en/integration/proxies/caddy.md @@ -101,7 +101,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration diff --git a/docs/content/en/integration/proxies/envoy.md b/docs/content/en/integration/proxies/envoy.md index af37d3cc8..8a50de23f 100644 --- a/docs/content/en/integration/proxies/envoy.md +++ b/docs/content/en/integration/proxies/envoy.md @@ -75,7 +75,7 @@ server: endpoints: authz: ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' ``` ## Configuration @@ -97,47 +97,47 @@ Support for [Envoy] is possible with Authelia v4.37.0 and higher via the [Envoy] version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: envoy: - container_name: envoy - image: envoyproxy/envoy:v1.24 - restart: unless-stopped + container_name: 'envoy' + image: 'envoyproxy/envoy:v1.24' + restart: 'unless-stopped' networks: net: {} ports: - '80:8080' - '443:8443' volumes: - - ${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro - - ${PWD}/data/certificates:/certificates:ro + - '${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro' + - '${PWD}/data/certificates:/certificates:ro' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: {} expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: - TZ: "Australia/Melbourne" + TZ: 'Australia/Melbourne' nextcloud: - container_name: nextcloud - image: linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' ``` {{< /details >}} @@ -145,92 +145,92 @@ services: ```yaml static_resources: listeners: - - name: listener_http + - name: 'listener_http' address: socket_address: - address: 0.0.0.0 + address: '0.0.0.0' port_value: 8080 filter_chains: - filters: - - name: envoy.filters.network.http_connection_manager + - name: 'envoy.filters.network.http_connection_manager' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - codec_type: auto - stat_prefix: ingress_http + "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager' + codec_type: 'auto' + stat_prefix: 'ingress_http' route_config: - name: local_route + name: 'local_route' virtual_hosts: - - name: backend - domains: ["*"] + - name: 'backend' + domains: ['*'] routes: - match: - prefix: "/" + prefix: '/' redirect: https_redirect: true http_filters: - - name: envoy.filters.http.router + - name: 'envoy.filters.http.router' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router - - name: listener_https + "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router' + - name: 'listener_https' address: socket_address: - address: 0.0.0.0 + address: '0.0.0.0' port_value: 8443 filter_chains: - filters: - - name: envoy.filters.network.http_connection_manager + - name: 'envoy.filters.network.http_connection_manager' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - stat_prefix: ingress_http + "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager' + stat_prefix: 'ingress_http' use_remote_address: true skip_xff_append: false route_config: - name: local_route + name: 'local_route' virtual_hosts: - - name: whoami_service + - name: 'whoami_service' domains: ["nextcloud.example.com"] routes: - match: prefix: "/" route: - cluster: nextcloud - - name: authelia_service - domains: ["auth.example.com"] + cluster: 'nextcloud' + - name: 'authelia_service' + domains: ['auth.example.com'] typed_per_filter_config: envoy.filters.http.ext_authz: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' disabled: true routes: - match: - prefix: "/" + prefix: '/' route: - cluster: authelia + cluster: 'authelia' http_filters: - - name: envoy.filters.http.ext_authz + - name: 'envoy.filters.http.ext_authz' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz - transport_api_version: v3 + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz' + transport_api_version: 'v3' allowed_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - exact: accept - - exact: cookie + - exact: 'authorization' + - exact: 'proxy-authorization' + - exact: 'accept' + - exact: 'cookie' http_service: - path_prefix: /api/authz/ext-authz/ + path_prefix: '/api/authz/ext-authz/' server_uri: - uri: authelia:9091 - cluster: authelia - timeout: 0.25s + uri: 'authelia:9091' + cluster: 'authelia' + timeout: '0.25s' authorization_request: allowed_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - exact: accept - - exact: cookie + - exact: 'authorization' + - exact: 'proxy-authorization' + - exact: 'accept' + - exact: 'cookie' headers_to_add: - - key: X-Forwarded-Proto + - key: 'X-Forwarded-Proto' value: '%REQ(:SCHEME)%' ## The following commented lines are for configuring the Authelia URL in the proxy. We ## strongly suggest this is configured in the Session Cookies section of the Authelia configuration. @@ -239,52 +239,52 @@ static_resources: authorization_response: allowed_upstream_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - prefix: remote- - - prefix: authelia- + - exact: 'authorization' + - exact: 'proxy-authorization' + - prefix: 'remote-' + - prefix: 'authelia-' allowed_client_headers: patterns: - - exact: set-cookie + - exact: 'set-cookie' allowed_client_headers_on_success: patterns: - - exact: set-cookie + - exact: 'set-cookie' failure_mode_allow: false - - name: envoy.filters.http.router + - name: 'envoy.filters.http.router' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router' clusters: - - name: nextcloud - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'nextcloud' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: nextcloud + cluster_name: 'nextcloud' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: nextcloud + address: 'nextcloud' port_value: 80 - - name: authelia - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'authelia' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: authelia + cluster_name: 'authelia' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: authelia + address: 'authelia' port_value: 9091 layered_runtime: layers: - - name: static_layer_0 + - name: 'static_layer_0' static_layer: envoy: resource_limits: diff --git a/docs/content/en/integration/proxies/haproxy.md b/docs/content/en/integration/proxies/haproxy.md index 12b9f98a1..d7f5efd66 100644 --- a/docs/content/en/integration/proxies/haproxy.md +++ b/docs/content/en/integration/proxies/haproxy.md @@ -104,7 +104,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration diff --git a/docs/content/en/integration/proxies/nginx-proxy-manager/index.md b/docs/content/en/integration/proxies/nginx-proxy-manager/index.md index b260455dd..c57968712 100644 --- a/docs/content/en/integration/proxies/nginx-proxy-manager/index.md +++ b/docs/content/en/integration/proxies/nginx-proxy-manager/index.md @@ -75,13 +75,13 @@ version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: nginx: - container_name: nginx - image: jc21/nginx-proxy-manager - restart: unless-stopped + container_name: 'nginx' + image: 'jc21/nginx-proxy-manager' + restart: 'unless-stopped' networks: net: aliases: [] @@ -90,44 +90,44 @@ services: - '81:81' - '443:443' volumes: - - ${PWD}/data/nginx-proxy-manager/data:/data - - ${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt - - ${PWD}/data/nginx/snippets:/snippets:ro + - '${PWD}/data/nginx-proxy-manager/data:/data' + - '${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt' + - '${PWD}/data/nginx/snippets:/snippets:ro' environment: TZ: 'Australia/Melbourne' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: TZ: 'Australia/Melbourne' nextcloud: - container_name: nextcloud - image: lscr.io/linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'lscr.io/linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: PUID: '1000' PGID: '1000' TZ: 'Australia/Melbourne' whoami: - container_name: whoami - image: docker.io/traefik/whoami - restart: unless-stopped + container_name: 'whoami' + image: 'docker.io/traefik/whoami' + restart: 'unless-stopped' networks: net: aliases: [] diff --git a/docs/content/en/integration/proxies/nginx.md b/docs/content/en/integration/proxies/nginx.md index 8d185e697..c8419f909 100644 --- a/docs/content/en/integration/proxies/nginx.md +++ b/docs/content/en/integration/proxies/nginx.md @@ -90,7 +90,7 @@ server: endpoints: authz: auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' ``` ## Docker Compose diff --git a/docs/content/en/integration/proxies/swag.md b/docs/content/en/integration/proxies/swag.md index 8f39865d5..f936ac7fa 100644 --- a/docs/content/en/integration/proxies/swag.md +++ b/docs/content/en/integration/proxies/swag.md @@ -156,13 +156,13 @@ version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: swag: - container_name: swag - image: lscr.io/linuxserver/swag - restart: unless-stopped + container_name: 'swag' + image: 'lscr.io/linuxserver/swag' + restart: 'unless-stopped' networks: net: aliases: [] @@ -170,7 +170,7 @@ services: - '80:80' - '443:443' volumes: - - ${PWD}/data/swag:/config + - '${PWD}/data/swag:/config' ## Uncomment the line below if you want to use the Authelia configuration snippets. #- ${PWD}/data/nginx/snippets:/snippets:ro environment: @@ -184,40 +184,40 @@ services: ONLY_SUBDOMAINS: 'false' STAGING: 'true' cap_add: - - NET_ADMIN + - 'NET_ADMIN' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: TZ: 'Australia/Melbourne' nextcloud: - container_name: nextcloud - image: lscr.io/linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'lscr.io/linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: PUID: '1000' PGID: '1000' TZ: 'Australia/Melbourne' whoami: - container_name: whoami - image: docker.io/traefik/whoami - restart: unless-stopped + container_name: 'whoami' + image: 'docker.io/traefik/whoami' + restart: 'unless-stopped' networks: net: aliases: [] diff --git a/docs/content/en/integration/proxies/traefik.md b/docs/content/en/integration/proxies/traefik.md index d5553e95d..8d6b084aa 100644 --- a/docs/content/en/integration/proxies/traefik.md +++ b/docs/content/en/integration/proxies/traefik.md @@ -75,7 +75,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration @@ -130,9 +130,9 @@ networks: driver: bridge services: traefik: - container_name: traefik - image: traefik:v2.9 - restart: unless-stopped + container_name: 'traefik' + image: 'traefik:v2.9' + restart: 'unless-stopped' command: - '--api=true' - '--api.dashboard=true' @@ -164,11 +164,11 @@ services: networks: net: {} ports: - - "80:8080" - - "443:8443" + - '80:8080' + - '443:8443' volumes: - - /var/run/docker.sock:/var/run/docker.sock - - ${PWD}/data/traefik:/config + - '/var/run/docker.sock:/var/run/docker.sock' + - '${PWD}/data/traefik:/config' labels: - 'traefik.enable=true' - 'traefik.http.routers.api.rule=Host(`traefik.example.com`)' @@ -177,15 +177,15 @@ services: - 'traefik.http.routers.api.service=api@internal' - 'traefik.http.routers.api.middlewares=authelia@docker' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: {} expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: TZ: "Australia/Melbourne" labels: @@ -200,20 +200,20 @@ services: - 'traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true' - 'traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' nextcloud: - container_name: nextcloud - image: linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' - 'traefik.http.routers.nextcloud.rule=Host(`nextcloud.example.com`)' @@ -221,19 +221,19 @@ services: - 'traefik.http.routers.nextcloud.tls=true' - 'traefik.http.routers.nextcloud.middlewares=authelia@docker' heimdall: - container_name: heimdall - image: linuxserver/heimdall - restart: unless-stopped + container_name: 'heimdall' + image: 'linuxserver/heimdall' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/heimdall/config:/config + - '${PWD}/data/heimdall/config:/config' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' - 'traefik.http.routers.heimdall.rule=Host(`heimdall.example.com`)' @@ -264,12 +264,12 @@ This example uses a `docker-compose.yml` similar to the one above however it has version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: traefik: - container_name: traefik - image: traefik:v2.9 - restart: unless-stopped + container_name: 'traefik' + image: 'traefik:v2.9' + restart: 'unless-stopped' command: - '--api=true' - '--api.dashboard=true' @@ -294,74 +294,74 @@ services: networks: net: {} ports: - - "80:8080" - - "443:8443" + - '80:8080' + - '443:8443' volumes: - - /var/run/docker.sock:/var/run/docker.sock - - ${PWD}/data/traefik/config:/config - - ${PWD}/data/traefik/certificates:/certificates + - '/var/run/docker.sock:/var/run/docker.sock' + - '${PWD}/data/traefik/config:/config' + - '${PWD}/data/traefik/certificates:/certificates' labels: - 'traefik.enable=true' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: {} expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config - - ${PWD}/data/authelia/certificates:/certificates + - '${PWD}/data/authelia/config:/config' + - '${PWD}/data/authelia/certificates:/certificates' environment: - TZ: "Australia/Melbourne" + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' nextcloud: - container_name: nextcloud - image: linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' heimdall: - container_name: heimdall - image: linuxserver/heimdall - restart: unless-stopped + container_name: 'heimdall' + image: 'linuxserver/heimdall' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/heimdall/config:/config + - '${PWD}/data/heimdall/config:/config' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' whoami: - container_name: whoami - image: traefik/whoami:latest - restart: unless-stopped + container_name: 'whoami' + image: 'traefik/whoami:latest' + restart: 'unless-stopped' networks: net: {} expose: - 80 environment: - TZ: "Australia/Melbourne" + TZ: 'Australia/Melbourne' labels: - - "traefik.enable=true" + - 'traefik.enable=true' ... ``` {{< /details >}} @@ -391,16 +391,16 @@ entryPoints: tls: options: modern: - minVersion: "VersionTLS13" + minVersion: 'VersionTLS13' intermediate: - minVersion: "VersionTLS12" + minVersion: 'VersionTLS12' cipherSuites: - - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" - - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" - - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" - - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" - - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305" - - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" + - 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256' + - 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256' + - 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' + - 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384' + - 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305' + - 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305' http: middlewares: authelia: @@ -418,9 +418,9 @@ http: - 'Remote-Email' - 'Remote-Name' tls: - ca: /certificates/ca.public.crt - cert: /certificates/traefik.public.crt - key: /certificates/traefik.private.pem + ca: '/certificates/ca.public.crt' + cert: '/certificates/traefik.public.crt' + key: '/certificates/traefik.private.pem' authelia-basic: forwardAuth: address: 'https://authelia:9091/api/verify?auth=basic' @@ -433,86 +433,86 @@ http: - 'Remote-Email' - 'Remote-Name' tls: - ca: /certificates/ca.public.crt - cert: /certificates/traefik.public.crt - key: /certificates/traefik.private.pem + ca: '/certificates/ca.public.crt' + cert: '/certificates/traefik.public.crt' + key: '/certificates/traefik.private.pem' routers: traefik: - rule: Host(`traefik.example.com`) - entryPoints: websecure - service: api@internal + rule: 'Host(`traefik.example.com`)' + entryPoints: 'websecure' + service: 'api@internal' middlewares: - - authelia@file + - 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' whoami: - rule: Host(`whoami.example.com`) - entryPoints: websecure - service: whoami-net@docker + rule: 'Host(`whoami.example.com`)' + entryPoints: 'websecure' + service: 'whoami-net@docker' middlewares: - - authelia@file + - 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' nextcloud: - rule: Host(`nextcloud.example.com`) - entryPoints: websecure - service: nextcloud-net@docker + rule: 'Host(`nextcloud.example.com`)' + entryPoints: 'websecure' + service: 'nextcloud-net@docker' middlewares: - - authelia@file + - 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' heimdall: - rule: Host(`heimdall.example.com`) - entryPoints: websecure - service: heimdall-net@docker + rule: 'Host(`heimdall.example.com`)' + entryPoints: 'websecure' + service: 'heimdall-net@docker' middlewares: - - authelia-basic@file + - 'authelia-basic@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' authelia: - rule: Host(`auth.example.com`) - entryPoints: websecure - service: authelia@file + rule: 'Host(`auth.example.com`)' + entryPoints: 'websecure' + service: 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' services: authelia: loadBalancer: servers: - - url: https://authelia:9091/ - serversTransport: autheliaMutualTLS + - url: 'https://authelia:9091/' + serversTransport: 'autheliaMutualTLS' serversTransports: autheliaMutualTLS: certificates: - - certFile: /certificates/traefik.public.crt - keyFile: /certificates/traefik.private.pem + - certFile: '/certificates/traefik.public.crt' + keyFile: '/certificates/traefik.private.pem' rootCAs: - - /certificates/ca.public.crt + - '/certificates/ca.public.crt' ... ``` {{< /details >}} diff --git a/docs/content/en/integration/proxies/traefikv1.md b/docs/content/en/integration/proxies/traefikv1.md index 0519782ca..3aa1195d0 100644 --- a/docs/content/en/integration/proxies/traefikv1.md +++ b/docs/content/en/integration/proxies/traefikv1.md @@ -88,7 +88,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration @@ -119,15 +119,15 @@ version: '3' networks: net: - driver: bridge + driver: 'bridge' services: traefik: - image: traefik:v1.7.34-alpine - container_name: traefik + image: 'traefik:v1.7.34-alpine' + container_name: 'traefik' volumes: - - /var/run/docker.sock:/var/run/docker.sock + - '/var/run/docker.sock:/var/run/docker.sock' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:traefik.example.com' - 'traefik.port=8081' @@ -135,7 +135,7 @@ services: - '80:80' - '443:443' - '8081:8081' - restart: unless-stopped + restart: 'unless-stopped' command: - '--api' - '--api.entrypoint=api' @@ -151,27 +151,27 @@ services: # - '--entryPoints=Name:https Address::443 TLS ForwardedHeaders.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7 ProxyProtocol.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7' - '--entryPoints=Name:api Address::8081' authelia: - image: authelia/authelia - container_name: authelia + image: 'authelia/authelia' + container_name: 'authelia' volumes: - - /path/to/authelia:/config + - '/path/to/authelia:/config' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:auth.example.com' expose: - 9091 - restart: unless-stopped + restart: 'unless-stopped' environment: - - TZ=Australia/Melbourne + TZ: 'Australia/Melbourne' nextcloud: - image: linuxserver/nextcloud - container_name: nextcloud + image: 'linuxserver/nextcloud' + container_name: 'nextcloud' volumes: - - /path/to/nextcloud/config:/config - - /path/to/nextcloud/data:/data + - '/path/to/nextcloud/config:/config' + - '/path/to/nextcloud/data:/data' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:nextcloud.example.com' - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth' @@ -182,18 +182,18 @@ services: - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' expose: - 443 - restart: unless-stopped + restart: 'unless-stopped' environment: - - PUID=1000 - - PGID=1000 - - TZ=Australia/Melbourne + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' heimdall: - image: linuxserver/heimdall - container_name: heimdall + image: 'linuxserver/heimdall' + container_name: 'heimdall' volumes: - - /path/to/heimdall/config:/config + - '/path/to/heimdall/config:/config' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:heimdall.example.com' - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth/basic' @@ -201,11 +201,11 @@ services: - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' expose: - 443 - restart: unless-stopped + restart: 'unless-stopped' environment: - - PUID=1000 - - PGID=1000 - - TZ=Australia/Melbourne + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' ``` ## See Also diff --git a/docs/content/en/overview/security/measures.md b/docs/content/en/overview/security/measures.md index 88714dd16..41e91c60b 100644 --- a/docs/content/en/overview/security/measures.md +++ b/docs/content/en/overview/security/measures.md @@ -160,7 +160,7 @@ values. As such all SMTP connections require the following: -1. A TLS Connection (STARTTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated +1. A TLS Connection (StartTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated connections require it as well_) 2. Valid X509 Certificate presented to the client during the TLS handshake @@ -207,22 +207,22 @@ for SMTP servers that allow unauthenticated relaying (bad practice). ### SMTP Ports -All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via STARTTLS. +All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via StartTLS. The [`submissions` service][service-submissions] (_typically port 465_) is an exception to this rule, where the -connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [port for -SMTP][docs-config-smtp-port] is set to `465`, Authelia will initiate TLS connections without requiring STARTTLS +connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [scheme for +SMTP][docs-config-smtp-port] is set to `submissions`, Authelia will initiate TLS connections without requiring StartTLS negotiation. -When the `submissions` service port is available, it [should be preferred][port-465] over any STARTTLS port for +When the `submissions` service port is available, it [should be preferred][port-465] over any StartTLS port for submitting mail. **NOTE:** Prior to 2018, port 465 was previously assigned for a similar purpose known as [`smtps`][port-465] (_A TLS only equivalent of the `smtp` port 25_), which it had been deprecated for. Port 465 has since been re-assigned for only supporting mail submission (_which unlike SMTP transfers via port 25, [requires authentication][smtp-auth]_), similar -to port 587 (_the `submission` port, a common alternative that uses STARTTLS instead_). +to port 587 (_the `submission` port, a common alternative that uses StartTLS instead_). -[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#port +[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#address [cleartext]: https://cwe.mitre.org/data/definitions/312.html [service-submissions]: https://datatracker.ietf.org/doc/html/rfc8314#section-7.3 [port-465]: https://datatracker.ietf.org/doc/html/rfc8314#section-3.3 diff --git a/docs/content/en/reference/guides/passwords.md b/docs/content/en/reference/guides/passwords.md index a21fc3bf0..e90749354 100644 --- a/docs/content/en/reference/guides/passwords.md +++ b/docs/content/en/reference/guides/passwords.md @@ -26,30 +26,31 @@ The format of the [YAML] file is as follows: users: john: disabled: false - displayname: "John Doe" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: john.doe@authelia.com + displayname: 'John Doe' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'john.doe@authelia.com' groups: - - admins - - dev + - 'admins' + - 'dev' harry: disabled: false - displayname: "Harry Potter" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: harry.potter@authelia.com + displayname: 'Harry Potter' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'harry.potter@authelia.com' groups: [] bob: disabled: false - displayname: "Bob Dylan" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: bob.dylan@authelia.com + displayname: 'Bob Dylan' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'bob.dylan@authelia.com' groups: - - dev + - 'dev' james: disabled: false - displayname: "James Dean" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: james.dean@authelia.com + displayname: 'James Dean' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'james.dean@authelia.com' + groups: [] ``` ## Passwords diff --git a/docs/content/en/reference/guides/troubleshooting.md b/docs/content/en/reference/guides/troubleshooting.md index 6dd6a864a..d8811ecfa 100644 --- a/docs/content/en/reference/guides/troubleshooting.md +++ b/docs/content/en/reference/guides/troubleshooting.md @@ -2,7 +2,7 @@ title: "Troubleshooting" description: "This guide describes and helps users provide information during troubleshooting including sanitization etc" lead: "This guide describes and helps users provide troubleshooting information." -date: 2023-05-01T11:30:07+10:00 +date: 2023-05-01T12:36:02+10:00 draft: false images: [] menu: diff --git a/docs/content/en/reference/integrations/time-based-one-time-password-apps.md b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md new file mode 100644 index 000000000..2d8c63931 --- /dev/null +++ b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md @@ -0,0 +1,25 @@ +--- +title: "Time-based OTP Applications" +description: "A Time-based OTP Application integration reference guide" +lead: "This section contains a Time-based OTP Application integration reference guide for Authelia." +date: 2023-05-07T17:52:47+10:00 +draft: false +images: [] +menu: + reference: + parent: "integrations" +weight: 320 +toc: true +--- + +## Settings + +Authelia allows for a wide variety of time-based OTP settings. There are several applications which can support these +algorithms and this matrix is a guide on applications that have been tested that work. It should not be assumed if an +application is on this list that the information is correct for the current version of a product and it's likely they +may now support some that were not previously supported, or in rare cases they may support less than they previously +did. + +{{< table-totp-support >}} + + diff --git a/docs/data/configkeys.json b/docs/data/configkeys.json index bf06efb15..ecc9213cf 100644 --- a/docs/data/configkeys.json +++ b/docs/data/configkeys.json @@ -1 +1 @@ -[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_URL"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file +[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.address","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDRESS"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.address","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_ADDRESS"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.address","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_ADDRESS"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_ADDRESS"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.umask","secret":false,"env":"AUTHELIA_SERVER_UMASK"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.umask","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_UMASK"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file diff --git a/docs/data/support.json b/docs/data/support.json new file mode 100644 index 000000000..507f9af16 --- /dev/null +++ b/docs/data/support.json @@ -0,0 +1,12 @@ +{ + "totp": [ + {"name": "Google Authenticator", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US&pli=1"}, + {"name": "Bitwarden", "clear": true, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://bitwarden.com/"}, + {"name": "Yubico Authenticator", "clear": true, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": true}, "url": "https://www.yubico.com/products/yubico-authenticator/"}, + {"name": "Authenticator Plus", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://www.authenticatorplus.com/"}, + {"name": "1Password", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://1password.com/"}, + {"name": "Ravio", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://raivo-otp.com/"}, + {"name": "Authy", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": false, "eight": true}, "url": "https://authy.com/"}, + {"name": "Aegis", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://getaegis.app/"} + ] +} diff --git a/docs/i18n/en.yaml b/docs/i18n/en.yaml index 4994b7e52..9d0a5ee56 100644 --- a/docs/i18n/en.yaml +++ b/docs/i18n/en.yaml @@ -1,19 +1,19 @@ --- -- id: get-started - translation: "Get Started" +- id: 'get-started' + translation: 'Get Started' -- id: on-this-page - translation: "On this page" +- id: 'on-this-page' + translation: 'On this page' -- id: search-text - translation: "Search..." +- id: 'search-text' + translation: 'Search...' -- id: 404-title - translation: "Page not found :(" +- id: '404-title' + translation: 'Page not found :(' -- id: 404-text +- id: '404-text' translation: "The page you are looking for doesn't exist or has been moved. If you followed a link to get to this page please report it if it was on this site, the official GitHub repository, or the logs on the latest version." # yamllint disable-line rule:line-length -- id: browse - translation: "Browse" +- id: 'browse' + translation: 'Browse' ... diff --git a/docs/layouts/shortcodes/config-alert-example.html b/docs/layouts/shortcodes/config-alert-example.html new file mode 100644 index 000000000..19f8d1430 --- /dev/null +++ b/docs/layouts/shortcodes/config-alert-example.html @@ -0,0 +1,7 @@ + \ No newline at end of file diff --git a/docs/layouts/shortcodes/table-totp-support.html b/docs/layouts/shortcodes/table-totp-support.html new file mode 100644 index 000000000..4513d672b --- /dev/null +++ b/docs/layouts/shortcodes/table-totp-support.html @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + {{- range $.Site.Data.support.totp }} + + + + + + + + + {{- end }} + +
ApplicationAlgorithmDigits
SHA1SHA256SHA51268
{{ .name }}
\ No newline at end of file diff --git a/examples/compose/lite/authelia/configuration.yml b/examples/compose/lite/authelia/configuration.yml index d9841d310..bd06a5dd3 100644 --- a/examples/compose/lite/authelia/configuration.yml +++ b/examples/compose/lite/authelia/configuration.yml @@ -8,8 +8,7 @@ jwt_secret: a_very_important_secret default_redirection_url: https://public.example.com server: - host: 0.0.0.0 - port: 9091 + address: 'tcp://:9091' log: level: debug diff --git a/examples/compose/local/authelia/configuration.yml b/examples/compose/local/authelia/configuration.yml index 42b770e6c..c19b62167 100644 --- a/examples/compose/local/authelia/configuration.yml +++ b/examples/compose/local/authelia/configuration.yml @@ -7,8 +7,7 @@ jwt_secret: a_very_important_secret default_redirection_url: https://public.example.com server: - host: 0.0.0.0 - port: 9091 + address: 'tcp://:9091' log: level: debug diff --git a/go.mod b/go.mod index cef25bfcd..c3ae71364 100644 --- a/go.mod +++ b/go.mod @@ -7,13 +7,13 @@ require ( github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d github.com/deckarep/golang-set/v2 v2.3.0 github.com/duosecurity/duo_api_golang v0.0.0-20230418202038-096d3306c029 - github.com/fasthttp/router v1.4.18 - github.com/fasthttp/session/v2 v2.4.17 + github.com/fasthttp/router v1.4.19 + github.com/fasthttp/session/v2 v2.5.0 github.com/fsnotify/fsnotify v1.6.0 github.com/go-asn1-ber/asn1-ber v1.5.4 github.com/go-crypt/crypt v0.2.7 - github.com/go-ldap/ldap/v3 v3.4.4 - github.com/go-rod/rod v0.112.8 + github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 + github.com/go-rod/rod v0.112.9 github.com/go-sql-driver/mysql v1.7.1 github.com/go-webauthn/webauthn v0.5.0 github.com/golang-jwt/jwt/v4 v4.5.0 @@ -37,24 +37,24 @@ require ( github.com/otiai10/copy v1.11.0 github.com/pkg/errors v0.9.1 github.com/pquerna/otp v1.4.0 - github.com/prometheus/client_golang v1.15.0 + github.com/prometheus/client_golang v1.15.1 github.com/sirupsen/logrus v1.9.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 github.com/trustelem/zxcvbn v1.0.1 - github.com/valyala/fasthttp v1.46.0 + github.com/valyala/fasthttp v1.47.0 github.com/wneessen/go-mail v0.3.9 golang.org/x/net v0.9.0 - golang.org/x/sync v0.1.0 - golang.org/x/term v0.7.0 + golang.org/x/sync v0.2.0 + golang.org/x/term v0.8.0 golang.org/x/text v0.9.0 gopkg.in/square/go-jose.v2 v2.6.0 gopkg.in/yaml.v3 v3.0.1 ) require ( - github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect + github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect github.com/andybalholm/brotli v1.0.5 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect @@ -83,7 +83,7 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect github.com/jandelgado/gcov2lcov v1.0.5 // indirect - github.com/klauspost/compress v1.16.3 // indirect + github.com/klauspost/compress v1.16.5 // indirect github.com/knadh/koanf/maps v0.1.1 // indirect github.com/magiconair/properties v1.8.7 // indirect github.com/mattn/goveralls v0.0.11 // indirect @@ -100,6 +100,7 @@ require ( github.com/prometheus/client_model v0.3.0 // indirect github.com/prometheus/common v0.42.0 // indirect github.com/prometheus/procfs v0.9.0 // indirect + github.com/redis/go-redis/v9 v9.0.4 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee // indirect github.com/spf13/afero v1.9.5 // indirect @@ -111,13 +112,14 @@ require ( github.com/tinylib/msgp v1.1.8 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect github.com/x448/float16 v0.8.4 // indirect + github.com/ysmood/fetchup v0.2.2 // indirect github.com/ysmood/goob v0.4.0 // indirect github.com/ysmood/gson v0.7.3 // indirect github.com/ysmood/leakless v0.8.0 // indirect golang.org/x/crypto v0.7.0 // indirect golang.org/x/mod v0.10.0 // indirect golang.org/x/oauth2 v0.5.0 // indirect - golang.org/x/sys v0.7.0 // indirect + golang.org/x/sys v0.8.0 // indirect golang.org/x/tools v0.7.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd // indirect diff --git a/go.sum b/go.sum index 1b7b6a1b3..ed5889579 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo= dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= -github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft7pkxDf6WoUvEZJ/uOKsvtpjLnn8MU= -github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= +github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8= +github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4 h1:vdT7QwBhJJEVNFMBNhRSFDRCB6O16T28VhvqRgqFyn8= @@ -45,6 +45,8 @@ github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4/go.mod h1:S github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= +github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA= +github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs= github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= @@ -56,6 +58,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= +github.com/bsm/ginkgo/v2 v2.7.0 h1:ItPMPH90RbmZJt5GtkcNvIRuGEdwlBItdNVoyzaNQao= +github.com/bsm/gomega v1.26.0 h1:LhQm+AFcgV2M0WyKroMASzAzCAJVpAxQXv4SaI9a69Y= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= @@ -112,10 +116,10 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojtoVVWjGfOF9635RETekkoH6Cc9SX0A= github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg= -github.com/fasthttp/router v1.4.18 h1:elMnlFq527oZd8MHsuUpO6uLDup1exv8rXPfIjClDHk= -github.com/fasthttp/router v1.4.18/go.mod h1:ZmC20Mn0VgCBbUWFDmnYzFbQYRfdGeKgpkBy0+JioKA= -github.com/fasthttp/session/v2 v2.4.17 h1:jcS21Xoi1fE/4Ikz5Nm37x6FjpMUPnPQPVJWxKnQ8FE= -github.com/fasthttp/session/v2 v2.4.17/go.mod h1:+pr8HLEQp6h9X70KLBY/Y4NrdJR2ts7VERydkMkiZaI= +github.com/fasthttp/router v1.4.19 h1:RLE539IU/S4kfb4MP56zgP0TIBU9kEg0ID9GpWO0vqk= +github.com/fasthttp/router v1.4.19/go.mod h1:+Fh3YOd8x1+he6ZS+d2iUDBH9MGGZ1xQFUor0DE9rKE= +github.com/fasthttp/session/v2 v2.5.0 h1:Vt+U2yKCmBxnEZ4v6rjEsO4YeTSaCpz/HPEI4DTN59M= +github.com/fasthttp/session/v2 v2.5.0/go.mod h1:gmUptI/jKL7qTfFtBHU3us36nv2Bm7U4jazt9pnBPLY= github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w= github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= @@ -134,14 +138,14 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= -github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs= -github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI= +github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 h1:XgBmN9yZXIh9vJGzs2qYPb5ee8/VnOWLHHYcKXGXKME= +github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI= github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo= -github.com/go-rod/rod v0.112.8 h1:lYFnHv/lFyjW/Ye0IhyKLeHw/zfhHbSTqawoCi2z/nI= -github.com/go-rod/rod v0.112.8/go.mod h1:ElViL9ABbcshNQw93+11FrYRH92RRhMKleuILo6+5V0= +github.com/go-rod/rod v0.112.9 h1:uA/yLbB+t0UlqJcLJtK2pZrCNPzd15dOKRUEOnmnt9k= +github.com/go-rod/rod v0.112.9/go.mod h1:l0or0gEnZ7E5C0L/W7iD+yXBnm/OM3avP1ji74k8N9s= github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI= github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= @@ -264,8 +268,8 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.16.3 h1:XuJt9zzcnaz6a16/OU53ZjWp/v7/42WcR5t2a0PcNQY= -github.com/klauspost/compress v1.16.3/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI= +github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs= github.com/knadh/koanf/maps v0.1.1/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/parsers/yaml v0.1.0 h1:ZZ8/iGfRLvKSaMEECEBPM1HQslrZADk8fP1XFUxVI5w= @@ -289,7 +293,7 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo= -github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw= +github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw= github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY= github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= @@ -352,8 +356,8 @@ github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg= github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg= github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso= -github.com/prometheus/client_golang v1.15.0 h1:5fCgGYogn0hFdhyhLbw7hEsWxufKtY9klyvdNfFlFhM= -github.com/prometheus/client_golang v1.15.0/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= +github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI= +github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= @@ -368,6 +372,8 @@ github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7z github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI= github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY= github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU= +github.com/redis/go-redis/v9 v9.0.4 h1:FC82T+CHJ/Q/PdyLW++GeCO+Ol59Y4T7R4jbgjvktgc= +github.com/redis/go-redis/v9 v9.0.4/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk= github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8= @@ -413,7 +419,6 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= @@ -431,18 +436,22 @@ github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGr github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= -github.com/valyala/fasthttp v1.46.0 h1:6ZRhrFg8zBXTRYY6vdzbFhqsBd7FVv123pV2m9V87U4= -github.com/valyala/fasthttp v1.46.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA= +github.com/valyala/fasthttp v1.47.0 h1:y7moDoxYzMooFpT5aHgNgVOQDrS3qlkfiP9mDtGGK9c= +github.com/valyala/fasthttp v1.47.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA= github.com/wneessen/go-mail v0.3.9 h1:Q4DbCk3htT5DtDWKeMgNXCiHc4bBY/vv/XQPT6XDXzc= github.com/wneessen/go-mail v0.3.9/go.mod h1:zxOlafWCP/r6FEhAaRgH4IC1vg2YXxO0Nar9u0IScZ8= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q= +github.com/ysmood/fetchup v0.2.2 h1:Qn8/q5uDW7szclt4sVXCFJ1TXup3hogz94OaLf6kloo= +github.com/ysmood/fetchup v0.2.2/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns= github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ= github.com/ysmood/goob v0.4.0/go.mod h1:u6yx7ZhS4Exf2MwciFr6nIM8knHQIE22lFpWHnfql18= -github.com/ysmood/got v0.32.0 h1:aAHdQgfgMb/lo4v+OekM+SSqEJYFI035h5YYvLXsVyU= -github.com/ysmood/got v0.32.0/go.mod h1:pE1l4LOwOBhQg6A/8IAatkGp7uZjnalzrZolnlhhMgY= +github.com/ysmood/gop v0.0.2 h1:VuWweTmXK+zedLqYufJdh3PlxDNBOfFHjIZlPT2T5nw= +github.com/ysmood/gop v0.0.2/go.mod h1:rr5z2z27oGEbyB787hpEcx4ab8cCiPnKxn0SUHt6xzk= +github.com/ysmood/got v0.34.1 h1:IrV2uWLs45VXNvZqhJ6g2nIhY+pgIG1CUoOcqfXFl1s= +github.com/ysmood/got v0.34.1/go.mod h1:yddyjq/PmAf08RMLSwDjPyCvHvYed+WjHnQxpH851LM= github.com/ysmood/gotrace v0.6.0 h1:SyI1d4jclswLhg7SWTL6os3L1WOKeNn/ZtzVQF8QmdY= github.com/ysmood/gotrace v0.6.0/go.mod h1:TzhIG7nHDry5//eYZDYcTzuJLYQIkykJzCRIo4/dzQM= github.com/ysmood/gson v0.7.3 h1:QFkWbTH8MxyUTKPkVWAENJhxqdBa4lYTQWqZCiLG6kE= @@ -474,7 +483,6 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A= golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= @@ -514,6 +522,7 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -554,6 +563,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= @@ -579,8 +590,9 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI= +golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -629,13 +641,17 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= -golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU= +golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= -golang.org/x/term v0.7.0 h1:BEvjmm5fURWqcfbSKTdpkDXYBrUS1c0m8agp14W48vQ= -golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= +golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols= +golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -645,6 +661,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -702,6 +720,7 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4= golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/internal/authentication/const_test.go b/internal/authentication/const_test.go new file mode 100644 index 000000000..3829c3eb5 --- /dev/null +++ b/internal/authentication/const_test.go @@ -0,0 +1,24 @@ +package authentication + +import ( + "github.com/authelia/authelia/v4/internal/configuration/schema" +) + +const ( + testLDAPURL = "ldap://127.0.0.1:389" + testLDAPSURL = "ldaps://127.0.0.1:389" +) + +var ( + testLDAPAddress = MustParseAddress(testLDAPURL) + testLDAPSAddress = MustParseAddress(testLDAPSURL) +) + +func MustParseAddress(input string) *schema.AddressLDAP { + address, err := schema.NewAddress(input) + if err != nil { + panic(err) + } + + return &schema.AddressLDAP{Address: *address} +} diff --git a/internal/authentication/ldap_client_mock.go b/internal/authentication/ldap_client_mock.go index c58b602a2..5c996114d 100644 --- a/internal/authentication/ldap_client_mock.go +++ b/internal/authentication/ldap_client_mock.go @@ -65,9 +65,11 @@ func (mr *MockLDAPClientMockRecorder) Bind(arg0, arg1 interface{}) *gomock.Call } // Close mocks base method. -func (m *MockLDAPClient) Close() { +func (m *MockLDAPClient) Close() error { m.ctrl.T.Helper() - m.ctrl.Call(m, "Close") + ret := m.ctrl.Call(m, "Close") + ret0, _ := ret[0].(error) + return ret0 } // Close indicates an expected call of Close. @@ -334,18 +336,6 @@ func (mr *MockLDAPClientMockRecorder) SimpleBind(arg0 interface{}) *gomock.Call return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SimpleBind", reflect.TypeOf((*MockLDAPClient)(nil).SimpleBind), arg0) } -// Start mocks base method. -func (m *MockLDAPClient) Start() { - m.ctrl.T.Helper() - m.ctrl.Call(m, "Start") -} - -// Start indicates an expected call of Start. -func (mr *MockLDAPClientMockRecorder) Start() *gomock.Call { - mr.mock.ctrl.T.Helper() - return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Start", reflect.TypeOf((*MockLDAPClient)(nil).Start)) -} - // StartTLS mocks base method. func (m *MockLDAPClient) StartTLS(arg0 *tls.Config) error { m.ctrl.T.Helper() diff --git a/internal/authentication/ldap_user_provider.go b/internal/authentication/ldap_user_provider.go index 56ad08c6f..d2bb2603f 100644 --- a/internal/authentication/ldap_user_provider.go +++ b/internal/authentication/ldap_user_provider.go @@ -107,7 +107,7 @@ func (p *LDAPUserProvider) CheckUserPassword(username string, password string) ( return false, err } - if clientUser, err = p.connectCustom(p.config.URL, profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil { + if clientUser, err = p.connectCustom(p.config.Address.String(), profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil { return false, fmt.Errorf("authentication failed. Cause: %w", err) } @@ -234,7 +234,7 @@ func (p *LDAPUserProvider) UpdatePassword(username, password string) (err error) } func (p *LDAPUserProvider) connect() (client LDAPClient, err error) { - return p.connectCustom(p.config.URL, p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...) + return p.connectCustom(p.config.Address.String(), p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...) } func (p *LDAPUserProvider) connectCustom(url, username, password string, startTLS bool, opts ...ldap.DialOpt) (client LDAPClient, err error) { diff --git a/internal/authentication/ldap_user_provider_startup.go b/internal/authentication/ldap_user_provider_startup.go index edf668587..076b02fd4 100644 --- a/internal/authentication/ldap_user_provider_startup.go +++ b/internal/authentication/ldap_user_provider_startup.go @@ -31,7 +31,7 @@ func (p *LDAPUserProvider) StartupCheck() (err error) { "attribute when users reset their password via Authelia.") } - if p.features.Extensions.TLS && !p.config.StartTLS && !strings.HasPrefix(p.config.URL, "ldaps://") { + if p.features.Extensions.TLS && !p.config.StartTLS && !p.config.Address.IsExplicitlySecure() { p.log.Error("Your LDAP Server supports TLS but you don't appear to be utilizing it. We strongly " + "recommend using the scheme 'ldaps://' or enabling the StartTLS option to secure connections with your " + "LDAP Server.") diff --git a/internal/authentication/ldap_user_provider_test.go b/internal/authentication/ldap_user_provider_test.go index ebda277a6..97c9dc749 100644 --- a/internal/authentication/ldap_user_provider_test.go +++ b/internal/authentication/ldap_user_provider_test.go @@ -25,7 +25,7 @@ func TestShouldCreateRawConnectionWhenSchemeIsLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", }, @@ -57,7 +57,7 @@ func TestShouldCreateTLSConnectionWhenSchemeIsLDAPS(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldaps://127.0.0.1:389", + Address: testLDAPSAddress, User: "cn=admin,dc=example,dc=com", Password: "password", }, @@ -107,7 +107,7 @@ func TestEscapeSpecialCharsInGroupsFilter(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldaps://127.0.0.1:389", + Address: testLDAPSAddress, GroupsFilter: "(|(member={dn})(uid={username})(uid={input}))", }, false, @@ -165,7 +165,7 @@ func TestShouldCheckLDAPServerExtensions(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -230,7 +230,7 @@ func TestShouldNotCheckLDAPServerExtensionsWhenRootDSEReturnsMoreThanOneEntry(t provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -296,7 +296,7 @@ func TestShouldCheckLDAPServerControlTypes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -361,7 +361,7 @@ func TestShouldNotEnablePasswdModifyExtensionOrControlTypes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -426,7 +426,7 @@ func TestShouldReturnCheckServerConnectError(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -459,7 +459,7 @@ func TestShouldReturnCheckServerSearchError(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -521,7 +521,7 @@ func TestShouldEscapeUserInput(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -555,7 +555,7 @@ func TestShouldReturnEmailWhenAttributeSameAsUsername(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "mail", @@ -626,7 +626,7 @@ func TestShouldReturnUsernameAndBlankDisplayNameWhenAttributesTheSame(t *testing provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -697,7 +697,7 @@ func TestShouldReturnBlankEmailAndDisplayNameWhenAttrsLenZero(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -771,7 +771,7 @@ func TestShouldCombineUsernameFilterAndUsersFilter(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsernameAttribute: "uid", UsersFilter: "(&({username_attribute}={input})(&(objectCategory=person)(objectClass=user)))", @@ -822,7 +822,7 @@ func TestShouldNotCrashWhenGroupsAreNotRetrievedFromLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -895,7 +895,7 @@ func TestShouldNotCrashWhenEmailsAreNotRetrievedFromLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -956,7 +956,7 @@ func TestShouldReturnUsernameFromLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1029,7 +1029,7 @@ func TestShouldReturnUsernameFromLDAPWithReferrals(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1121,7 +1121,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsInErrorAndResult(t *testing.T) provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1246,7 +1246,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsErr(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1333,7 +1333,7 @@ func TestShouldNotUpdateUserPasswordConnect(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1400,7 +1400,7 @@ func TestShouldNotUpdateUserPasswordGetDetails(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1477,7 +1477,7 @@ func TestShouldUpdateUserPassword(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1585,7 +1585,7 @@ func TestShouldUpdateUserPasswordMSAD(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1695,7 +1695,7 @@ func TestShouldUpdateUserPasswordMSADWithReferrals(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1823,7 +1823,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralConnectErr(t *test provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1942,7 +1942,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralModifyErr(t *testi provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2074,7 +2074,7 @@ func TestShouldUpdateUserPasswordMSADWithoutReferrals(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2187,7 +2187,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtension(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2294,7 +2294,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferrals(t *testing.T provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2421,7 +2421,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithoutReferrals(t *testin provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2534,7 +2534,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralConne provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2652,7 +2652,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralPassw provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2784,7 +2784,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHints(t *testing provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "sAMAccountName", @@ -2895,7 +2895,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHintsDeprecated( provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "sAMAccountName", @@ -3006,7 +3006,7 @@ func TestShouldUpdateUserPasswordActiveDirectory(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "sAMAccountName", @@ -3117,7 +3117,7 @@ func TestShouldUpdateUserPasswordBasic(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "custom", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "uid=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3224,7 +3224,7 @@ func TestShouldReturnErrorWhenMultipleUsernameAttributes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3290,7 +3290,7 @@ func TestShouldReturnErrorWhenZeroUsernameAttributes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3356,7 +3356,7 @@ func TestShouldReturnErrorWhenUsernameAttributeNotReturned(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3418,7 +3418,7 @@ func TestShouldReturnErrorWhenMultipleUsersFound(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3501,7 +3501,7 @@ func TestShouldReturnErrorWhenNoDN(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3567,7 +3567,7 @@ func TestShouldCheckValidUserPassword(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3635,7 +3635,7 @@ func TestShouldNotCheckValidUserPasswordWithConnectError(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3674,7 +3674,7 @@ func TestShouldCheckInvalidUserPassword(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3742,7 +3742,7 @@ func TestShouldCallStartTLSWhenEnabled(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3817,7 +3817,7 @@ func TestShouldParseDynamicConfiguration(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3866,7 +3866,7 @@ func TestShouldCallStartTLSWithInsecureSkipVerifyWhenSkipVerifyTrue(t *testing.T provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3949,7 +3949,7 @@ func TestShouldReturnLDAPSAlreadySecuredWhenStartTLSAttempted(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldaps://127.0.0.1:389", + Address: testLDAPSAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", diff --git a/internal/authentication/types.go b/internal/authentication/types.go index 8e695fe00..df96dc3ad 100644 --- a/internal/authentication/types.go +++ b/internal/authentication/types.go @@ -18,7 +18,7 @@ type LDAPClientFactory interface { // // Methods added to this interface that have a direct correlation with one from ldap.Client should have the same signature. type LDAPClient interface { - Close() + Close() (err error) IsClosing() bool SetTimeout(timeout time.Duration) diff --git a/internal/configuration/config.template.yml b/internal/configuration/config.template.yml index 3bc54dbc5..2319109de 100644 --- a/internal/configuration/config.template.yml +++ b/internal/configuration/config.template.yml @@ -9,14 +9,14 @@ ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. -# certificates_directory: /config/certificates/ +# certificates_directory: '/config/certificates/' ## The theme to display: light, dark, grey, auto. -theme: light +theme: 'light' ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## set using a secret: https://www.authelia.com/c/secrets -jwt_secret: a_very_important_secret +jwt_secret: 'a_very_important_secret' ## Default redirection URL ## @@ -25,31 +25,32 @@ jwt_secret: a_very_important_secret ## in such a case. ## ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. -default_redirection_url: https://home.example.com/ +default_redirection_url: 'https://home.example.com/' ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been ## disabled. This setting must be a method that is enabled. ## Options are totp, webauthn, mobile_push. -default_2fa_method: "" +default_2fa_method: '' ## ## Server Configuration ## server: - - ## The address to listen on. - host: 0.0.0.0 - - ## The port to listen on. - port: 9091 + ## The address for the Main server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'. + address: 'tcp://:9091' ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. - path: "" + path: '' ## Set the path on disk to Authelia assets. ## Useful to allow overriding of specific static assets. - # asset_path: /config/assets/ + # asset_path: '/config/assets/' ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. @@ -58,10 +59,10 @@ server: ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. tls: ## The path to the DER base64/PEM format private key. - key: "" + key: '' ## The path to the DER base64/PEM format public certificate. - certificate: "" + certificate: '' ## The list of certificates for client authentication. client_certificates: [] @@ -70,7 +71,7 @@ server: headers: ## The CSP Template. Read the docs. - csp_template: "" + csp_template: '' ## Server Buffers configuration. # buffers: @@ -89,14 +90,14 @@ server: ## Server Timeouts configuration. # timeouts: - ## Read timeout. - # read: 6s + ## Read timeout in the duration common syntax. + # read: '6s' - ## Write timeout. - # write: 6s + ## Write timeout in the duration common syntax. + # write: '6s' - ## Idle timeout. - # idle: 30s + ## Idle timeout in the duration common syntax. + # idle: '30s' ## Server Endpoints configuration. ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation. @@ -110,16 +111,16 @@ server: ## Configure the authz endpoints. # authz: # forward-auth: - # implementation: ForwardAuth + # implementation: 'ForwardAuth' # authn_strategies: [] # ext-authz: - # implementation: ExtAuthz + # implementation: 'ExtAuthz' # authn_strategies: [] # auth-request: - # implementation: AuthRequest + # implementation: 'AuthRequest' # authn_strategies: [] # legacy: - # implementation: Legacy + # implementation: 'Legacy' # authn_strategies: [] ## @@ -127,13 +128,13 @@ server: ## log: ## Level of verbosity for logs: info, debug, trace. - level: debug + level: 'debug' ## Format the logs are written as: json, text. - # format: json + # format: 'json' ## File path where the logs will be written. If not set logs are written to stdout. - # file_path: /config/authelia.log + # file_path: '/config/authelia.log' ## Whether to also log to stdout when a log_file_path is defined. # keep_stdout: false @@ -150,8 +151,13 @@ telemetry: ## Enable Metrics. enabled: false - ## The address to listen on for metrics. This should be on a different port to the main server.port value. - address: tcp://0.0.0.0:9959 + ## The address for the Metrics server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'. + address: 'tcp://:9959' ## Metrics Server Buffers configuration. # buffers: @@ -165,14 +171,14 @@ telemetry: ## Metrics Server Timeouts configuration. # timeouts: - ## Read timeout. - # read: 6s + ## Read timeout in the duration common syntax. + # read: '6s' - ## Write timeout. - # write: 6s + ## Write timeout in the duration common syntax. + # write: '6s' - ## Idle timeout. - # idle: 30s + ## Idle timeout in the duration common syntax. + # idle: '30s' ## ## TOTP Configuration @@ -183,12 +189,12 @@ totp: disable: false ## The issuer name displayed in the Authenticator application of your choice. - issuer: authelia.com + issuer: 'authelia.com' ## The TOTP algorithm to use. ## It is CRITICAL you read the documentation before changing this option: ## https://www.authelia.com/c/totp#algorithm - algorithm: sha1 + algorithm: 'sha1' ## The number of digits a user has to input. Must either be 6 or 8. ## Changing this option only affects newly generated TOTP configurations. @@ -217,19 +223,19 @@ webauthn: ## Disable WebAuthn. disable: false - ## Adjust the interaction timeout for WebAuthn dialogues. - timeout: 60s + ## The interaction timeout for WebAuthn dialogues in the duration common syntax. + timeout: '60s' ## The display name the browser should show the user for when using WebAuthn to login/register. - display_name: Authelia + display_name: 'Authelia' ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device. ## Options are none, indirect, direct. - attestation_conveyance_preference: indirect + attestation_conveyance_preference: 'indirect' ## User verification controls if the user must make a gesture or action to confirm they are present. ## Options are required, preferred, discouraged. - user_verification: preferred + user_verification: 'preferred' ## ## Duo Push API Configuration @@ -238,10 +244,10 @@ webauthn: ## "Partner Auth API" in the management panel. # duo_api: # disable: false - # hostname: api-123456789.example.com - # integration_key: ABCDEF + # hostname: 'api-123456789.example.com' + # integration_key: 'ABCDEF' ## Secret can also be set using a secret: https://www.authelia.com/c/secrets - # secret_key: 1234567890abcdefghifjkl + # secret_key: '1234567890abcdefghifjkl' # enable_self_enrollment: false ## @@ -249,14 +255,17 @@ webauthn: ## ## This is used to validate the servers time is accurate enough to validate TOTP. ntp: - ## NTP server address. - address: "time.cloudflare.com:123" + ## The address of the NTP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'. + ## The default scheme is 'udp'. The default port is '123'. + address: 'udp://time.cloudflare.com:123' ## NTP version. version: 4 - ## Maximum allowed time offset between the host and the NTP server. - max_desync: 3s + ## Maximum allowed time offset between the host and the NTP server in the duration common syntax. + max_desync: '3s' ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you ## set this to true, and can operate in a truly offline mode. @@ -282,16 +291,15 @@ authentication_backend: ## External reset password url that redirects the user to an external reset portal. This disables the internal reset ## functionality. - custom_url: "" + custom_url: '' - ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + ## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. - ## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval - refresh_interval: 5m + refresh_interval: '5m' ## ## LDAP (Authentication Provider) @@ -300,6 +308,13 @@ authentication_backend: ## because it allows Authelia to offload the stateful operations ## onto the LDAP service. # ldap: + ## The address of the LDAP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`. + ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'. + ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'. + # address: 'ldaps://127.0.0.1:636' + ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## Acceptable options are as follows: ## - 'activedirectory' - for Microsoft Active Directory. @@ -311,22 +326,18 @@ authentication_backend: ## Depending on the option here certain other values in this section have a default value, notably all of the ## attribute mappings have a default value that this config overrides, you can read more about these default values ## at https://www.authelia.com/c/ldap#defaults - # implementation: custom + # implementation: 'custom' - ## The url to the ldap server. Format: ://
[:]. - ## Scheme can be ldap or ldaps in the format (port optional). - # url: ldap://127.0.0.1 - - ## The dial timeout for LDAP. - # timeout: 5s + ## The dial timeout for LDAP in the duration common syntax. + # timeout: '5s' ## Use StartTLS with the LDAP connection. # start_tls: false # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host portion of the url option. - # server_name: ldap.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'ldap.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -337,10 +348,10 @@ authentication_backend: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -417,7 +428,7 @@ authentication_backend: ## The distinguished name of the container searched for objects in the directory information tree. ## See also: additional_users_dn, additional_groups_dn. - # base_dn: dc=example,dc=com + # base_dn: 'dc=example,dc=com' ## The attribute holding the username of the user. This attribute is used to populate the username in the session ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually @@ -427,11 +438,11 @@ authentication_backend: ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to ## follow https://datatracker.ietf.org/doc/html/rfc2307. - # username_attribute: uid + # username_attribute: 'uid' ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. - # additional_users_dn: ou=users + # additional_users_dn: 'ou=users' ## The users filter used in search queries to find the user profile based on input filled in login form. ## Various placeholders are available in the user filter which you can read about in the documentation which can @@ -445,11 +456,11 @@ authentication_backend: ## ## To allow sign in both with username and email, one can use a filter like ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) - # users_filter: (&({username_attribute}={input})(objectClass=person)) + # users_filter: '(&({username_attribute}={input})(objectClass=person))' ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. - # additional_groups_dn: ou=groups + # additional_groups_dn: 'ou=groups' ## The groups filter used in search queries to find the groups based on relevant authenticated user. ## Various placeholders are available in the groups filter which you can read about in the documentation which can @@ -457,17 +468,17 @@ authentication_backend: ## ## If your groups use the `groupOfUniqueNames` structure use this instead: ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) - # groups_filter: (&(member={dn})(objectClass=groupOfNames)) + # groups_filter: '(&(member={dn})(objectClass=groupOfNames))' ## The attribute holding the name of the group. - # group_name_attribute: cn + # group_name_attribute: 'cn' ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## first one returned by the LDAP server is used. - # mail_attribute: mail + # mail_attribute: 'mail' ## The attribute holding the display name of the user. This will be used to greet an authenticated user. - # display_name_attribute: displayName + # display_name_attribute: 'displayName' ## Follow referrals returned by the server. ## This is especially useful for environments where read-only servers exist. Only implemented for write operations. @@ -476,7 +487,7 @@ authentication_backend: ## The username and password of the admin user. # user: cn=admin,dc=example,dc=com ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## ## File (Authentication Provider) @@ -491,15 +502,15 @@ authentication_backend: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # file: - # path: /config/users_database.yml + # path: '/config/users_database.yml' # watch: false # search: # email: false # case_insensitive: false # password: - # algorithm: argon2 + # algorithm: 'argon2' # argon2: - # variant: argon2id + # variant: 'argon2id' # iterations: 3 # memory: 65536 # parallelism: 4 @@ -512,15 +523,15 @@ authentication_backend: # key_length: 32 # salt_length: 16 # pbkdf2: - # variant: sha512 + # variant: 'sha512' # iterations: 310000 # salt_length: 16 # sha2crypt: - # variant: sha512 + # variant: 'sha512' # iterations: 50000 # salt_length: 16 # bcrypt: - # variant: standard + # variant: 'standard' # cost: 12 ## @@ -604,91 +615,91 @@ privacy_policy: access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. - default_policy: deny + default_policy: 'deny' # networks: - # - name: internal + # - name: 'internal' # networks: - # - 10.10.0.0/16 - # - 192.168.2.0/24 + # - '10.10.0.0/16' + # - '192.168.2.0/24' # - name: VPN - # networks: 10.9.0.0/16 + # networks: '10.9.0.0/16' # rules: ## Rules applied to everyone # - domain: 'public.example.com' - # policy: bypass + # policy: 'bypass' ## Domain Regex examples. Generally we recommend just using a standard domain. # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: # - '^appgroup-.*\.example\.com$' # - '^appgroup2-.*\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^.*\.example\.com$' - # policy: two_factor + # policy: 'two_factor' # - domain: 'secure.example.com' - # policy: one_factor + # policy: 'one_factor' ## Network based rule, if not provided any network matches. # networks: - # - internal - # - VPN - # - 192.168.1.0/24 - # - 10.0.0.1 + # - 'internal' + # - 'VPN' + # - '192.168.1.0/24' + # - '10.0.0.1' # - domain: # - 'secure.example.com' # - 'private.example.com' - # policy: two_factor + # policy: 'two_factor' # - domain: 'singlefactor.example.com' - # policy: one_factor + # policy: 'one_factor' ## Rules applied to 'admins' group # - domain: 'mx2.mail.example.com' # subject: 'group:admins' - # policy: deny + # policy: 'deny' # - domain: '*.example.com' # subject: # - 'group:admins' # - 'group:moderators' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to 'dev' group # - domain: 'dev.example.com' # resources: # - '^/groups/dev/.*$' # subject: 'group:dev' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'john' # - domain: 'dev.example.com' # resources: # - '^/users/john/.*$' # subject: 'user:john' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'harry' # - domain: 'dev.example.com' # resources: # - '^/users/harry/.*$' # subject: 'user:harry' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'bob' # - domain: '*.mail.example.com' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' # - domain: 'dev.example.com' # resources: # - '^/users/bob/.*$' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' ## ## Session Provider Configuration @@ -723,8 +734,7 @@ session: ## Please read https://www.authelia.com/c/session#same_site # same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format + ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -741,30 +751,19 @@ session: ## this value to -1 disables remember me for this session cookie domain. # remember_me: '1M' - ## Cookie Session Domain default 'name' value. The name of the session cookie. + ## Cookie Session Domain default 'name' value. name: 'authelia_session' - ## Cookie Session Domain default 'same_site' value. Sets the Cookie SameSite value. Possible options are none, lax, - ## or strict. Please read https://www.authelia.com/c/session#same_site + ## Cookie Session Domain default 'same_site' value. same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format - ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure - ## because a stolen cookie will last longer giving attackers more time to spy or attack. - - ## Cookie Session Domain default 'inactivity' value. The inactivity time before the session is reset. If expiration is - ## set to 1h, and this is set to 5m, if the user does not select the remember me option their session will get - ## destroyed after 1h, or after 5m since the last time Authelia detected user activity. + ## Cookie Session Domain default 'inactivity' value. inactivity: '5m' - ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is - ## destroyed if remember me IS NOT selected by the user. + ## Cookie Session Domain default 'expiration' value. expiration: '1h' - ## Cookie Session Domain default 'remember_me' value. The time before the cookie expires and the session is destroyed - ## if remember me IS selected by the user. Setting this value to -1 disables remember me for all session cookie - ## domains which do not have a specific 'remember_me' value. + ## Cookie Session Domain default 'remember_me' value. remember_me: '1M' ## @@ -773,16 +772,16 @@ session: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # redis: - # host: 127.0.0.1 + # host: '127.0.0.1' # port: 6379 ## Use a unix socket instead - # host: /var/run/redis/redis.sock + # host: '/var/run/redis/redis.sock' ## Username used for redis authentication. This is optional and a new feature in redis 6.0. - # username: authelia + # username: 'authelia' ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: authelia + # password: 'authelia' ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). # database_index: 0 @@ -797,7 +796,7 @@ session: # tls: ## The server subject name to check the servers certificate against during the validation process. ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: myredis.example.com + # server_name: 'myredis.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -808,10 +807,10 @@ session: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -890,21 +889,21 @@ session: ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). # high_availability: ## Sentinel Name / Master Name. - # sentinel_name: mysentinel + # sentinel_name: 'mysentinel' ## Specific username for Redis Sentinel. The node username and password is configured above. - # sentinel_username: sentinel_specific_user + # sentinel_username: 'sentinel_specific_user' ## Specific password for Redis Sentinel. The node username and password is configured above. - # sentinel_password: sentinel_specific_pass + # sentinel_password: 'sentinel_specific_pass' ## The additional nodes to pre-seed the redis provider with (for sentinel). ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## For high availability to be used you must have either defined; the host above or at least one node below. # nodes: - # - host: sentinel-node1 + # - host: 'sentinel-node1' # port: 6379 - # - host: sentinel-node2 + # - host: 'sentinel-node2' # port: 6379 ## Choose the host with the lowest latency. @@ -922,14 +921,12 @@ regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 - ## The time range during which the user can attempt login before being banned. The user is banned if the - ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - find_time: 2m + ## The time range during which the user can attempt login before being banned in the duration common syntax. The user + ## is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. + find_time: '2m' - ## The length of time before a banned user can login again. Ban Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - ban_time: 5m + ## The length of time before a banned user can login again in the duration common syntax. + ban_time: '5m' ## ## Storage Provider Configuration @@ -939,7 +936,7 @@ regulation: ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use ## the CLI to change this in the database if you want to change it from a previously configured value. - # encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this + # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this' ## ## Local (Storage Provider) @@ -951,25 +948,36 @@ regulation: ## # local: ## Path to the SQLite3 Database. - # path: /config/db.sqlite3 + # path: '/config/db.sqlite3' ## ## MySQL / MariaDB (Storage Provider) ## # mysql: - # host: 127.0.0.1 - # port: 3306 - # database: authelia - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the MySQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'. + # address: 'tcp://127.0.0.1:3306' + + ## The database name to use. + # database: 'authelia' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## MySQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: mysql.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'mysql.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -980,10 +988,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1062,20 +1070,33 @@ regulation: ## PostgreSQL (Storage Provider) ## # postgres: - # host: 127.0.0.1 - # port: 5432 - # database: authelia - # schema: public - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the PostgreSQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'. + # address: 'tcp://127.0.0.1:5432' + + ## The database name to use. + # database: 'authelia' + + ## The schema name to use. + # schema: 'public' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## PostgreSQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: postgres.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'postgres.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1086,10 +1107,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1179,7 +1200,7 @@ notifier: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # filesystem: - # filename: /config/notification.txt + # filename: '/config/notification.txt' ## ## SMTP (Notification Provider) @@ -1192,36 +1213,33 @@ notifier: ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## (configure in tls section) # smtp: - ## The SMTP host to connect to. - # host: 127.0.0.1 + ## The address of the SMTP server to connect to in the address common syntax. + # address: 'smtp://127.0.0.1:25' - ## The port to connect to the SMTP host on. - # port: 1025 - - ## The connection timeout. - # timeout: 5s + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## The username used for SMTP authentication. - # username: test + # username: 'test' ## The password used for SMTP authentication. ## Can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## The sender is used to is used for the MAIL FROM command and the FROM header. ## If this is not defined and the username is an email, we use the username as this value. This can either be just ## an email address or the RFC5322 'Name ' format. - # sender: "Authelia " + # sender: 'Authelia ' ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. - # identifier: localhost + # identifier: 'localhost' ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. - # subject: "[Authelia] {title}" + # subject: '[Authelia] {title}' ## This address is used during the startup check to verify the email configuration is correct. ## It's not important what it is except if your email server only allows local delivery. - # startup_check_address: test@authelia.com + # startup_check_address: 'test@authelia.com' ## By default we require some form of TLS. This disables this check though is not advised. # disable_require_tls: false @@ -1231,8 +1249,8 @@ notifier: # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: smtp.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'smtp.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1243,10 +1261,10 @@ notifier: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1334,7 +1352,7 @@ notifier: # oidc: ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets - # hmac_secret: this_is_a_secret_abc123abc123abc + # hmac_secret: 'this_is_a_secret_abc123abc123abc' ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every @@ -1410,11 +1428,11 @@ notifier: # DO NOT USE== # -----END RSA PRIVATE KEY----- - ## The lifespans configure the expiration for these token types. - # access_token_lifespan: 1h - # authorize_code_lifespan: 1m - # id_token_lifespan: 1h - # refresh_token_lifespan: 90m + ## The lifespans configure the expiration for these token types in the duration common syntax. + # access_token_lifespan: '1h' + # authorize_code_lifespan: '1m' + # id_token_lifespan: '1h' + # refresh_token_lifespan: '90m' ## Enables additional debug messages. # enable_client_debug_messages: false @@ -1424,23 +1442,23 @@ notifier: ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' ## for security reasons. - # enforce_pkce: public_clients_only + # enforce_pkce: 'public_clients_only' ## Cross-Origin Resource Sharing (CORS) settings. # cors: ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. # endpoints: - # - authorization - # - token - # - revocation - # - introspection - # - userinfo + # - 'authorization' + # - 'token' + # - 'revocation' + # - 'introspection' + # - 'userinfo' ## List of allowed origins. ## Any origin with https is permitted unless this option is configured or the ## allowed_origins_from_client_redirect_uris option is enabled. # allowed_origins: - # - https://example.com + # - 'https://example.com' ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, ## provided they have the scheme http or https and do not have the hostname of localhost. @@ -1450,71 +1468,72 @@ notifier: # clients: # - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. - # id: myapp + # id: 'myapp' ## The description to show to users when they end up on the consent screen. Defaults to the ID above. - # description: My Application + # description: 'My Application' ## The client secret is a shared secret between Authelia and the consumer of this client. - # secret: this_is_a_secret + # yamllint disable-line rule:line-length + # secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not ## necessary. Read the documentation for more information. ## The subject identifier must be the host component of a URL, which is a domain name with an optional port. - # sector_identifier: example.com + # sector_identifier: 'example.com' ## Sets the client to public. This should typically not be set, please see the documentation for usage. # public: false ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. # redirect_uris: - # - https://oidc.example.com:8080/oauth2/callback + # - 'https://oidc.example.com:8080/oauth2/callback' ## Audience this client is allowed to request. # audience: [] ## Scopes this client is allowed to request. # scopes: - # - openid - # - groups - # - email - # - profile + # - 'openid' + # - 'groups' + # - 'email' + # - 'profile' ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: - # - code + # - 'code' ## Response Modes configures which response modes this client supports. # response_modes: - # - form_post - # - query + # - 'form_post' + # - 'query' ## Grant Types configures which grants this client can obtain. ## It's not recommended to define this unless you know what you're doing. # grant_types: - # - authorization_code + # - 'authorization_code' ## The permitted client authentication method for the Token Endpoint for this client. - # token_endpoint_auth_method: client_secret_basic + # token_endpoint_auth_method: 'client_secret_basic' ## The policy to require for this client; one_factor or two_factor. - # authorization_policy: two_factor + # authorization_policy: 'two_factor' ## Enforces the use of PKCE for this client when set to true. # enforce_pkce: false ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method. ## Options are 'plain' and 'S256'. - # pkce_challenge_method: S256 + # pkce_challenge_method: 'S256' ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. - # userinfo_signing_algorithm: none + # userinfo_signing_algorithm: 'none' ## The consent mode controls how consent is obtained. - # consent_mode: auto + # consent_mode: 'auto' ## This value controls the duration a consent on this client remains remembered when the consent mode is - ## configured as 'auto' or 'pre-configured'. - # pre_configured_consent_duration: 1w + ## configured as 'auto' or 'pre-configured' in the duration common syntax. + # pre_configured_consent_duration: '1w' ... diff --git a/internal/configuration/const.go b/internal/configuration/const.go index cc9b5a6fb..7ec14716c 100644 --- a/internal/configuration/const.go +++ b/internal/configuration/const.go @@ -2,6 +2,8 @@ package configuration import ( "errors" + "math" + "time" ) // DefaultEnvPrefix is the default environment prefix. @@ -38,6 +40,10 @@ const ( errFmtDecodeHookCouldNotParseEmptyValue = "could not decode an empty value to a %s%s: %w" ) +const ( + durationMax = time.Duration(math.MaxInt64) +) + // IMPORTANT: There is an uppercase copy of this in github.com/authelia/authelia/internal/templates named // envSecretSuffixes. // Make sure you update these at the same time. diff --git a/internal/configuration/decode_hooks.go b/internal/configuration/decode_hooks.go index f0cb8468f..c9d4be4f5 100644 --- a/internal/configuration/decode_hooks.go +++ b/internal/configuration/decode_hooks.go @@ -9,6 +9,7 @@ import ( "net/url" "reflect" "regexp" + "strconv" "strings" "time" @@ -112,19 +113,14 @@ func StringToURLHookFunc() mapstructure.DecodeHookFuncType { } // ToTimeDurationHookFunc converts string and integer types to a time.Duration. +// +//nolint:gocyclo // Function is necessarily complex though flows well due to switch statement usage. func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType { return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { - var ptr bool - - switch f.Kind() { - case reflect.String, reflect.Int, reflect.Int32, reflect.Int64: - // We only allow string and integer from kinds to match. - break - default: - return data, nil - } - - prefixType := "" + var ( + ptr bool + prefixType string + ) if t.Kind() == reflect.Ptr { ptr = true @@ -139,6 +135,14 @@ func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType { return data, nil } + switch f.Kind() { + case reflect.String, reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Float64: + // We only allow string and integer from kinds to match. + break + default: + return data, nil + } + var result time.Duration switch { @@ -151,11 +155,29 @@ func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType { case f.Kind() == reflect.Int: seconds := data.(int) + result = time.Second * time.Duration(seconds) + case f.Kind() == reflect.Int8: + seconds := data.(int8) + + result = time.Second * time.Duration(seconds) + case f.Kind() == reflect.Int16: + seconds := data.(int16) + result = time.Second * time.Duration(seconds) case f.Kind() == reflect.Int32: seconds := data.(int32) result = time.Second * time.Duration(seconds) + case f.Kind() == reflect.Float64: + fseconds := data.(float64) + + if fseconds > durationMax.Seconds() { + result = durationMax + } else { + seconds, _ := strconv.Atoi(fmt.Sprintf("%.0f", fseconds)) + + result = time.Second * time.Duration(seconds) + } case f == expectedType: result = data.(time.Duration) case f.Kind() == reflect.Int64: @@ -219,6 +241,8 @@ func StringToRegexpHookFunc() mapstructure.DecodeHookFuncType { } // StringToAddressHookFunc decodes a string into an Address or *Address. +// +//nolint:gocyclo // This is an adequately clear function even with the complexity. func StringToAddressHookFunc() mapstructure.DecodeHookFuncType { return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { var ptr bool @@ -235,26 +259,99 @@ func StringToAddressHookFunc() mapstructure.DecodeHookFuncType { } expectedType := reflect.TypeOf(schema.Address{}) + expectedTypeTCP := reflect.TypeOf(schema.AddressTCP{}) + expectedTypeUDP := reflect.TypeOf(schema.AddressUDP{}) + expectedTypeLDAP := reflect.TypeOf(schema.AddressLDAP{}) + expectedTypeSMTP := reflect.TypeOf(schema.AddressSMTP{}) - if ptr && t.Elem() != expectedType { - return data, nil - } else if !ptr && t != expectedType { - return data, nil + switch { + case ptr: + switch t.Elem() { + case expectedType: + case expectedTypeTCP: + expectedType = expectedTypeTCP + case expectedTypeUDP: + expectedType = expectedTypeUDP + case expectedTypeLDAP: + expectedType = expectedTypeLDAP + case expectedTypeSMTP: + expectedType = expectedTypeSMTP + default: + return data, nil + } + default: + switch t { + case expectedType: + break + case expectedTypeTCP: + expectedType = expectedTypeTCP + case expectedTypeUDP: + expectedType = expectedTypeUDP + case expectedTypeLDAP: + expectedType = expectedTypeLDAP + case expectedTypeSMTP: + expectedType = expectedTypeSMTP + default: + return data, nil + } } dataStr := data.(string) var result *schema.Address - if result, err = schema.NewAddressFromString(dataStr); err != nil { - return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) - } + switch expectedType { + case expectedTypeTCP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeTCP, schema.AddressSchemeUnix); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } - if ptr { - return result, nil - } + if ptr { + return &schema.AddressTCP{Address: *result}, nil + } - return *result, nil + return schema.AddressTCP{Address: *result}, nil + case expectedTypeUDP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeUDP, schema.AddressSchemeUnix); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return &schema.AddressUDP{Address: *result}, nil + } + + return schema.AddressUDP{Address: *result}, nil + case expectedTypeLDAP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeLDAPS, schema.AddressSchemeLDAPI); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return &schema.AddressLDAP{Address: *result}, nil + } + + return schema.AddressLDAP{Address: *result}, nil + case expectedTypeSMTP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeSMTP, schema.AddressSchemeUnix); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return &schema.AddressSMTP{Address: *result}, nil + } + + return schema.AddressSMTP{Address: *result}, nil + default: + if result, err = schema.NewAddress(dataStr); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return result, nil + } + + return *result, nil + } } } diff --git a/internal/configuration/decode_hooks_test.go b/internal/configuration/decode_hooks_test.go index b13d350c7..6a3b9d0df 100644 --- a/internal/configuration/decode_hooks_test.go +++ b/internal/configuration/decode_hooks_test.go @@ -6,6 +6,7 @@ import ( "crypto/rsa" "crypto/x509" "encoding/pem" + "math" "net/mail" "net/url" "reflect" @@ -345,12 +346,36 @@ func TestToTimeDurationHookFunc(t *testing.T) { want: time.Second * 60, decode: true, }, + { + desc: "ShouldDecodeInt8ToSeconds", + have: int8(90), + want: time.Second * 90, + decode: true, + }, + { + desc: "ShouldDecodeInt16ToSeconds", + have: int16(90), + want: time.Second * 90, + decode: true, + }, { desc: "ShouldDecodeInt32ToSeconds", have: int32(90), want: time.Second * 90, decode: true, }, + { + desc: "ShouldDecodeFloat64ToSeconds", + have: float64(90), + want: time.Second * 90, + decode: true, + }, + { + desc: "ShouldDecodeFloat64ToSeconds", + have: math.MaxFloat64, + want: time.Duration(math.MaxInt64), + decode: true, + }, { desc: "ShouldDecodeInt64ToSeconds", have: int64(120), @@ -375,6 +400,12 @@ func TestToTimeDurationHookFunc(t *testing.T) { want: time.Duration(0), decode: true, }, + { + desc: "ShouldSkipParsingBoolean", + have: true, + want: time.Duration(0), + decode: false, + }, { desc: "ShouldNotDecodeFromBool", have: true, @@ -756,7 +787,7 @@ func TestStringToRegexpFuncPointers(t *testing.T) { func TestStringToAddressHookFunc(t *testing.T) { mustParseAddress := func(a string) (addr schema.Address) { - addrs, err := schema.NewAddressFromString(a) + addrs, err := schema.NewAddress(a) if err != nil { panic(err) } @@ -765,7 +796,7 @@ func TestStringToAddressHookFunc(t *testing.T) { } mustParseAddressPtr := func(a string) (addr *schema.Address) { - addr, err := schema.NewAddressFromString(a) + addr, err := schema.NewAddress(a) if err != nil { panic(err) } @@ -838,7 +869,7 @@ func TestStringToAddressHookFunc(t *testing.T) { name: "ShouldFailDecode", have: "tcp://&!@^#*&!@#&*@!:2020", expected: schema.Address{}, - err: "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [://][:]: parse \"tcp://&!@^\": invalid character \"^\" in host name", + err: "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [://][:]: parse \"tcp://&!@^\": invalid character \"^\" in host name", decode: false, }, } diff --git a/internal/configuration/deprecation.go b/internal/configuration/deprecation.go index d8eae81fb..5fb997a42 100644 --- a/internal/configuration/deprecation.go +++ b/internal/configuration/deprecation.go @@ -1,6 +1,9 @@ package configuration import ( + "fmt" + + "github.com/authelia/authelia/v4/internal/configuration/schema" "github.com/authelia/authelia/v4/internal/model" ) @@ -10,8 +13,9 @@ type Deprecation struct { Key string NewKey string AutoMap bool + Keep bool MapFunc func(value any) any - ErrText string + ErrFunc func(d Deprecation, keysFinal map[string]any, value any, val *schema.StructValidator) } var deprecations = map[string]Deprecation{ @@ -21,6 +25,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.level", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "logs_file": { Version: model.SemanticVersion{Major: 4, Minor: 7}, @@ -28,6 +33,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.file_path", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "authentication_backend.ldap.skip_verify": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -35,6 +41,7 @@ var deprecations = map[string]Deprecation{ NewKey: "authentication_backend.ldap.tls.skip_verify", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "authentication_backend.ldap.minimum_tls_version": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -42,6 +49,7 @@ var deprecations = map[string]Deprecation{ NewKey: "authentication_backend.ldap.tls.minimum_version", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "notifier.smtp.disable_verify_cert": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -49,6 +57,7 @@ var deprecations = map[string]Deprecation{ NewKey: "notifier.smtp.tls.skip_verify", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "notifier.smtp.trusted_cert": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -56,6 +65,7 @@ var deprecations = map[string]Deprecation{ NewKey: "certificates_directory", AutoMap: false, MapFunc: nil, + ErrFunc: nil, }, "host": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -63,6 +73,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.host", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "port": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -70,6 +81,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.port", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "tls_key": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -77,6 +89,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.tls.key", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "tls_cert": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -84,6 +97,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.tls.certificate", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "log_level": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -91,6 +105,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.level", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "log_file_path": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -98,6 +113,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.file_path", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "log_format": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -105,6 +121,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.format", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "storage.postgres.sslmode": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -112,6 +129,7 @@ var deprecations = map[string]Deprecation{ NewKey: "storage.postgres.ssl.mode", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "authentication_backend.disable_reset_password": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -119,6 +137,7 @@ var deprecations = map[string]Deprecation{ NewKey: "authentication_backend.password_reset.disable", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.read_buffer_size": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -126,6 +145,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.buffers.read", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.write_buffer_size": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -133,6 +153,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.buffers.write", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "session.remember_me_duration": { Version: model.SemanticVersion{Major: 4, Minor: 38}, @@ -140,6 +161,7 @@ var deprecations = map[string]Deprecation{ NewKey: "session.remember_me", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.enable_pprof": { Version: model.SemanticVersion{Major: 4, Minor: 38}, @@ -147,6 +169,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.endpoints.enable_pprof", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.enable_expvars": { Version: model.SemanticVersion{Major: 4, Minor: 38}, @@ -154,5 +177,80 @@ var deprecations = map[string]Deprecation{ NewKey: "server.endpoints.enable_expvars", AutoMap: true, MapFunc: nil, + ErrFunc: nil, + }, + "server.host": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "server.host", + NewKey: "server.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'server.host' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "server.port": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "server.port", + NewKey: "server.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'server.port' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "storage.mysql.host": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.mysql.host", + NewKey: "storage.mysql.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.host' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "storage.mysql.port": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.mysql.port", + NewKey: "storage.mysql.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.port' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "storage.postgres.host": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.postgres.host", + NewKey: "storage.postgres.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.host' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "storage.postgres.port": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.postgres.port", + NewKey: "storage.postgres.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.port' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "authentication_backend.ldap.url": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "authentication_backend.ldap.url", + NewKey: "authentication_backend.ldap.address", + AutoMap: true, + MapFunc: nil, + ErrFunc: nil, }, } diff --git a/internal/configuration/helpers.go b/internal/configuration/helpers.go index 22b793e9a..ab3f44cf5 100644 --- a/internal/configuration/helpers.go +++ b/internal/configuration/helpers.go @@ -21,6 +21,14 @@ func getEnvConfigMap(keys []string, prefix, delimiter string) (keyMap map[string } } + for _, deprecation := range deprecations { + if !deprecation.AutoMap { + continue + } + + keyMap[ToEnvironmentKey(deprecation.Key, prefix, delimiter)] = deprecation.Key + } + return keyMap, ignoredKeys } diff --git a/internal/configuration/koanf_util.go b/internal/configuration/koanf_util.go index b08320e41..0b162d9c1 100644 --- a/internal/configuration/koanf_util.go +++ b/internal/configuration/koanf_util.go @@ -66,22 +66,29 @@ func koanfRemapKeysStandard(keys map[string]any, val *schema.StructValidator, ds for key, value = range keys { if d, ok = ds[key]; ok { if !d.AutoMap { - val.Push(fmt.Errorf("invalid configuration key '%s' was replaced by '%s'", d.Key, d.NewKey)) - keysFinal[key] = value + if d.ErrFunc != nil { + d.ErrFunc(d, keysFinal, value, val) + } else { + val.Push(fmt.Errorf("invalid configuration key '%s' was replaced by '%s'", d.Key, d.NewKey)) + } + continue - } else { - val.PushWarning(fmt.Errorf("configuration key '%s' is deprecated in %s and has been replaced by '%s': "+ - "this has been automatically mapped for you but you will need to adjust your configuration to remove this message", d.Key, d.Version.String(), d.NewKey)) } if !mapHasKey(d.NewKey, keys) && !mapHasKey(d.NewKey, keysFinal) { + val.PushWarning(fmt.Errorf("configuration key '%s' is deprecated in %s and has been replaced by '%s': "+ + "this has been automatically mapped for you but you will need to adjust your configuration to remove this message", d.Key, d.Version.String(), d.NewKey)) + if d.MapFunc != nil { keysFinal[d.NewKey] = d.MapFunc(value) } else { keysFinal[d.NewKey] = value } + } else { + val.PushWarning(fmt.Errorf("configuration key '%s' is deprecated in %s and has been replaced by '%s': "+ + "this has not been automatically mapped for you because the replacement key also exists and you will need to adjust your configuration to remove this message", d.Key, d.Version.String(), d.NewKey)) } continue diff --git a/internal/configuration/provider_test.go b/internal/configuration/provider_test.go index 6c1658948..27f363d4f 100644 --- a/internal/configuration/provider_test.go +++ b/internal/configuration/provider_test.go @@ -7,6 +7,7 @@ import ( "runtime" "sort" "testing" + "time" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" @@ -86,6 +87,18 @@ func TestShouldHaveNotifier(t *testing.T) { assert.NotNil(t, config.Notifier) } +func TestShouldParseLargeIntegerDurations(t *testing.T) { + val := schema.NewStructValidator() + _, config, err := Load(val, NewDefaultSources([]string{"./test_resources/config.durations.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + assert.Len(t, val.Errors(), 0) + assert.Len(t, val.Warnings(), 0) + + assert.Equal(t, durationMax, config.Regulation.FindTime) + assert.Equal(t, time.Second*1000, config.Regulation.BanTime) +} + func TestShouldValidateConfigurationWithEnv(t *testing.T) { testSetEnv(t, "SESSION_SECRET", "abc") testSetEnv(t, "STORAGE_MYSQL_PASSWORD", "abc") @@ -120,7 +133,7 @@ func TestShouldValidateConfigurationWithFilters(t *testing.T) { require.Len(t, val.Warnings(), 0) assert.Equal(t, "api-123456789.example.org", config.DuoAPI.Hostname) - assert.Equal(t, "10.10.10.10", config.Notifier.SMTP.Host) + assert.Equal(t, "smtp://10.10.10.10:1025", config.Notifier.SMTP.Address.String()) assert.Equal(t, "10.10.10.10", config.Session.Redis.Host) require.Len(t, config.IdentityProviders.OIDC.Clients, 3) @@ -135,7 +148,7 @@ func TestShouldNotIgnoreInvalidEnvs(t *testing.T) { testSetEnv(t, "STORAGE_MYSQL", "a bad env") testSetEnv(t, "JWT_SECRET", "an env jwt secret") testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_PASSWORD", "an env authentication backend ldap password") - testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "an env authentication backend ldap password") + testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_ADDRESS", "an env authentication backend ldap password") val := schema.NewStructValidator() keys, _, err := Load(val, NewDefaultSources([]string{"./test_resources/config.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) @@ -145,9 +158,10 @@ func TestShouldNotIgnoreInvalidEnvs(t *testing.T) { validator.ValidateKeys(keys, DefaultEnvPrefix, val) require.Len(t, val.Warnings(), 1) - assert.Len(t, val.Errors(), 0) + assert.Len(t, val.Errors(), 1) assert.EqualError(t, val.Warnings()[0], fmt.Sprintf("configuration environment variable not expected: %sSTORAGE_MYSQL", DefaultEnvPrefix)) + assert.EqualError(t, val.Errors()[0], "error occurred during unmarshalling configuration: 1 error(s) decoding:\n\n* error decoding 'authentication_backend.ldap.address': could not decode 'an env authentication backend ldap password' to a *schema.AddressLDAP: could not parse string 'an env authentication backend ldap password' as address: expected format is [://][:]: parse \"ldaps://an env authentication backend ldap password\": invalid character \" \" in host name") } func TestShouldValidateAndRaiseErrorsOnNormalConfigurationAndSecret(t *testing.T) { @@ -268,6 +282,75 @@ func TestShouldValidateAndRaiseErrorsOnBadConfiguration(t *testing.T) { assert.Equal(t, "debug", c.Log.Level) } +func TestShouldValidateDeprecatedEnvNames(t *testing.T) { + testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "ldap://from-env") + + val := schema.NewStructValidator() + keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + + validator.ValidateKeys(keys, DefaultEnvPrefix, val) + + assert.Len(t, val.Errors(), 0) + require.Len(t, val.Warnings(), 1) + + assert.EqualError(t, val.Warnings()[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has not been automatically mapped for you because the replacement key also exists and you will need to adjust your configuration to remove this message") + + assert.Equal(t, "ldap://127.0.0.1:389", c.AuthenticationBackend.LDAP.Address.String()) +} + +func TestShouldValidateDeprecatedEnvNamesWithDeprecatedKeys(t *testing.T) { + testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "ldap://from-env") + + val := schema.NewStructValidator() + keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.deprecated.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + + validator.ValidateKeys(keys, DefaultEnvPrefix, val) + + assert.Len(t, val.Errors(), 0) + + warnings := val.Warnings() + require.Len(t, warnings, 3) + + sort.Sort(utils.ErrSliceSortAlphabetical(warnings)) + + assert.EqualError(t, warnings[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has been automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[1], "configuration key 'storage.mysql.host' is deprecated in 4.38.0 and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[2], "configuration key 'storage.mysql.port' is deprecated in 4.38.0 and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + + assert.Equal(t, "ldap://from-env:389", c.AuthenticationBackend.LDAP.Address.String()) +} + +func TestShouldValidateDeprecatedEnvNamesWithDeprecatedKeysAlt(t *testing.T) { + val := schema.NewStructValidator() + keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.deprecated.alt.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + + validator.ValidateKeys(keys, DefaultEnvPrefix, val) + + assert.Len(t, val.Errors(), 0) + + warnings := val.Warnings() + require.Len(t, warnings, 3) + + sort.Sort(utils.ErrSliceSortAlphabetical(warnings)) + + assert.EqualError(t, warnings[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has been automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[1], "configuration key 'storage.postgres.host' is deprecated in 4.38.0 and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[2], "configuration key 'storage.postgres.port' is deprecated in 4.38.0 and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + + val.Clear() + + validator.ValidateConfiguration(c, val) + + require.NotNil(t, c.Storage.PostgreSQL.Address) + assert.Equal(t, "tcp://127.0.0.1:5432", c.Storage.PostgreSQL.Address.String()) +} + func TestShouldRaiseErrOnInvalidNotifierSMTPSender(t *testing.T) { val := schema.NewStructValidator() keys, _, err := Load(val, NewDefaultSources([]string{"./test_resources/config_smtp_sender_invalid.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) @@ -409,7 +492,9 @@ func TestShouldLoadDirectoryConfiguration(t *testing.T) { assert.NoError(t, err) assert.Len(t, val.Errors(), 0) - assert.Len(t, val.Warnings(), 0) + require.Len(t, val.Warnings(), 1) + + assert.EqualError(t, val.Warnings()[0], "configuration key 'server.port' is deprecated in 4.38.0 and has been replaced by 'server.address' when combined with the 'server.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") } func testSetEnv(t *testing.T, key, value string) { diff --git a/internal/configuration/schema/authentication.go b/internal/configuration/schema/authentication.go index c44954c9d..876982498 100644 --- a/internal/configuration/schema/authentication.go +++ b/internal/configuration/schema/authentication.go @@ -95,8 +95,8 @@ type SCryptPassword struct { // LDAPAuthenticationBackend represents the configuration related to LDAP server. type LDAPAuthenticationBackend struct { + Address *AddressLDAP `koanf:"address"` Implementation string `koanf:"implementation"` - URL string `koanf:"url"` Timeout time.Duration `koanf:"timeout"` StartTLS bool `koanf:"start_tls"` TLS *TLSConfig `koanf:"tls"` diff --git a/internal/configuration/schema/const.go b/internal/configuration/schema/const.go index 6f0ef781f..0e59410c5 100644 --- a/internal/configuration/schema/const.go +++ b/internal/configuration/schema/const.go @@ -105,7 +105,7 @@ const ( // regexpHasScheme checks if a string has a scheme. Valid characters for schemes include alphanumeric, hyphen, // period, and plus characters. -var regexpHasScheme = regexp.MustCompile(`^[-+.a-zA-Z\d]+://`) +var regexpHasScheme = regexp.MustCompile(`^[-+.a-zA-Z\d]*(://|:$)`) const ( blockCERTIFICATE = "CERTIFICATE" @@ -119,3 +119,20 @@ const ( ldapAttrDescription = "description" ldapAttrCommonName = "cn" ) + +// Address Schemes. +const ( + AddressSchemeTCP = "tcp" + AddressSchemeTCP4 = "tcp4" + AddressSchemeTCP6 = "tcp6" + AddressSchemeUDP = "udp" + AddressSchemeUDP4 = "udp4" + AddressSchemeUDP6 = "udp6" + AddressSchemeUnix = "unix" + AddressSchemeLDAP = "ldap" + AddressSchemeLDAPS = "ldaps" + AddressSchemeLDAPI = "ldapi" + AddressSchemeSMTP = "smtp" + AddressSchemeSUBMISSION = "submission" + AddressSchemeSUBMISSIONS = "submissions" +) diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go index 85923eb1a..ac5dbca3e 100644 --- a/internal/configuration/schema/keys.go +++ b/internal/configuration/schema/keys.go @@ -85,8 +85,8 @@ var Keys = []string{ "authentication_backend.file.password.salt_length", "authentication_backend.file.search.email", "authentication_backend.file.search.case_insensitive", + "authentication_backend.ldap.address", "authentication_backend.ldap.implementation", - "authentication_backend.ldap.url", "authentication_backend.ldap.timeout", "authentication_backend.ldap.start_tls", "authentication_backend.ldap.tls.minimum_version", @@ -184,24 +184,26 @@ var Keys = []string{ "regulation.find_time", "regulation.ban_time", "storage.local.path", - "storage.mysql.host", - "storage.mysql.port", + "storage.mysql.address", "storage.mysql.database", "storage.mysql.username", "storage.mysql.password", "storage.mysql.timeout", + "storage.mysql.host", + "storage.mysql.port", "storage.mysql.tls.minimum_version", "storage.mysql.tls.maximum_version", "storage.mysql.tls.skip_verify", "storage.mysql.tls.server_name", "storage.mysql.tls.private_key", "storage.mysql.tls.certificate_chain", - "storage.postgres.host", - "storage.postgres.port", + "storage.postgres.address", "storage.postgres.database", "storage.postgres.username", "storage.postgres.password", "storage.postgres.timeout", + "storage.postgres.host", + "storage.postgres.port", "storage.postgres.schema", "storage.postgres.tls.minimum_version", "storage.postgres.tls.maximum_version", @@ -216,8 +218,7 @@ var Keys = []string{ "storage.encryption_key", "notifier.disable_startup_check", "notifier.filesystem.filename", - "notifier.smtp.host", - "notifier.smtp.port", + "notifier.smtp.address", "notifier.smtp.timeout", "notifier.smtp.username", "notifier.smtp.password", @@ -234,9 +235,11 @@ var Keys = []string{ "notifier.smtp.tls.server_name", "notifier.smtp.tls.private_key", "notifier.smtp.tls.certificate_chain", + "notifier.smtp.host", + "notifier.smtp.port", "notifier.template_path", - "server.host", - "server.port", + "server.address", + "server.umask", "server.path", "server.asset_path", "server.disable_healthcheck", @@ -255,8 +258,11 @@ var Keys = []string{ "server.timeouts.read", "server.timeouts.write", "server.timeouts.idle", + "server.host", + "server.port", "telemetry.metrics.enabled", "telemetry.metrics.address", + "telemetry.metrics.umask", "telemetry.metrics.buffers.read", "telemetry.metrics.buffers.write", "telemetry.metrics.timeouts.read", diff --git a/internal/configuration/schema/notifier.go b/internal/configuration/schema/notifier.go index a95b935f1..d554e6d64 100644 --- a/internal/configuration/schema/notifier.go +++ b/internal/configuration/schema/notifier.go @@ -3,6 +3,7 @@ package schema import ( "crypto/tls" "net/mail" + "net/url" "time" ) @@ -13,8 +14,7 @@ type FileSystemNotifierConfiguration struct { // SMTPNotifierConfiguration represents the configuration of the SMTP server to send emails with. type SMTPNotifierConfiguration struct { - Host string `koanf:"host"` - Port int `koanf:"port"` + Address *AddressSMTP `koanf:"address"` Timeout time.Duration `koanf:"timeout"` Username string `koanf:"username"` Password string `koanf:"password"` @@ -26,6 +26,12 @@ type SMTPNotifierConfiguration struct { DisableHTMLEmails bool `koanf:"disable_html_emails"` DisableStartTLS bool `koanf:"disable_starttls"` TLS *TLSConfig `koanf:"tls"` + + // Deprecated: use address instead. + Host string `koanf:"host"` + + // Deprecated: use address instead. + Port int `koanf:"port"` } // NotifierConfiguration represents the configuration of the notifier to use when sending notifications to users. @@ -38,6 +44,7 @@ type NotifierConfiguration struct { // DefaultSMTPNotifierConfiguration represents default configuration parameters for the SMTP notifier. var DefaultSMTPNotifierConfiguration = SMTPNotifierConfiguration{ + Address: &AddressSMTP{Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "localhost:25"}}}, Timeout: time.Second * 5, Subject: "[Authelia] {title}", Identifier: "localhost", diff --git a/internal/configuration/schema/ntp.go b/internal/configuration/schema/ntp.go index a9fdd3d2e..2cfce4b1d 100644 --- a/internal/configuration/schema/ntp.go +++ b/internal/configuration/schema/ntp.go @@ -1,12 +1,13 @@ package schema import ( + "net/url" "time" ) // NTPConfiguration represents the configuration related to ntp server. type NTPConfiguration struct { - Address string `koanf:"address"` + Address *AddressUDP `koanf:"address"` Version int `koanf:"version"` MaximumDesync time.Duration `koanf:"max_desync"` DisableStartupCheck bool `koanf:"disable_startup_check"` @@ -15,7 +16,7 @@ type NTPConfiguration struct { // DefaultNTPConfiguration represents default configuration parameters for the NTP server. var DefaultNTPConfiguration = NTPConfiguration{ - Address: "time.cloudflare.com:123", + Address: &AddressUDP{Address{valid: true, socket: false, port: 123, url: &url.URL{Scheme: AddressSchemeUDP, Host: "time.cloudflare.com:123"}}}, Version: 4, MaximumDesync: time.Second * 3, } diff --git a/internal/configuration/schema/server.go b/internal/configuration/schema/server.go index c786567b0..46264f3c8 100644 --- a/internal/configuration/schema/server.go +++ b/internal/configuration/schema/server.go @@ -1,13 +1,15 @@ package schema import ( + "net/url" "time" ) // ServerConfiguration represents the configuration of the http server. type ServerConfiguration struct { - Host string `koanf:"host"` - Port int `koanf:"port"` + Address *AddressTCP `koanf:"address"` + UMask *int `koanf:"umask"` + Path string `koanf:"path"` AssetPath string `koanf:"asset_path"` DisableHealthcheck bool `koanf:"disable_healthcheck"` @@ -18,6 +20,12 @@ type ServerConfiguration struct { Buffers ServerBuffers `koanf:"buffers"` Timeouts ServerTimeouts `koanf:"timeouts"` + + // Deprecated: use address instead. + Host string `koanf:"host"` + + // Deprecated: use address instead. + Port int `koanf:"port"` } // ServerEndpoints is the endpoints configuration for the HTTP server. @@ -54,8 +62,7 @@ type ServerHeaders struct { // DefaultServerConfiguration represents the default values of the ServerConfiguration. var DefaultServerConfiguration = ServerConfiguration{ - Host: "0.0.0.0", - Port: 9091, + Address: &AddressTCP{Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: ":9091"}}}, Buffers: ServerBuffers{ Read: 4096, Write: 4096, diff --git a/internal/configuration/schema/storage.go b/internal/configuration/schema/storage.go index d8eb93808..3dc2836f0 100644 --- a/internal/configuration/schema/storage.go +++ b/internal/configuration/schema/storage.go @@ -2,6 +2,7 @@ package schema import ( "crypto/tls" + "net/url" "time" ) @@ -12,12 +13,17 @@ type LocalStorageConfiguration struct { // SQLStorageConfiguration represents the configuration of the SQL database. type SQLStorageConfiguration struct { - Host string `koanf:"host"` - Port int `koanf:"port"` + Address *AddressTCP `koanf:"address"` Database string `koanf:"database"` Username string `koanf:"username"` Password string `koanf:"password"` Timeout time.Duration `koanf:"timeout"` + + // Deprecated: use address instead. + Host string `koanf:"host"` + + // Deprecated: use address instead. + Port int `koanf:"port"` } // MySQLStorageConfiguration represents the configuration of a MySQL database. @@ -68,6 +74,9 @@ var DefaultMySQLStorageConfiguration = MySQLStorageConfiguration{ // DefaultPostgreSQLStorageConfiguration represents the default PostgreSQL configuration. var DefaultPostgreSQLStorageConfiguration = PostgreSQLStorageConfiguration{ + SQLStorageConfiguration: SQLStorageConfiguration{ + Address: &AddressTCP{Address{true, false, 5432, &url.URL{Scheme: AddressSchemeTCP, Host: "localhost:5432"}}}, + }, Schema: "public", TLS: &TLSConfig{ MinimumVersion: TLSVersion{tls.VersionTLS12}, diff --git a/internal/configuration/schema/telemetry.go b/internal/configuration/schema/telemetry.go index 3b0dcf3b5..f3231144e 100644 --- a/internal/configuration/schema/telemetry.go +++ b/internal/configuration/schema/telemetry.go @@ -1,7 +1,7 @@ package schema import ( - "net" + "net/url" "time" ) @@ -12,8 +12,9 @@ type TelemetryConfig struct { // TelemetryMetricsConfig represents the telemetry metrics config. type TelemetryMetricsConfig struct { - Enabled bool `koanf:"enabled"` - Address *Address `koanf:"address"` + Enabled bool `koanf:"enabled"` + Address *AddressTCP `koanf:"address"` + UMask *int `koanf:"umask"` Buffers ServerBuffers `koanf:"buffers"` Timeouts ServerTimeouts `koanf:"timeouts"` @@ -22,7 +23,7 @@ type TelemetryMetricsConfig struct { // DefaultTelemetryConfig is the default telemetry configuration. var DefaultTelemetryConfig = TelemetryConfig{ Metrics: TelemetryMetricsConfig{ - Address: &Address{true, "tcp", net.ParseIP("0.0.0.0"), 9959}, + Address: &AddressTCP{Address{true, false, 9959, &url.URL{Scheme: AddressSchemeTCP, Host: ":9959"}}}, Buffers: ServerBuffers{ Read: 4096, Write: 4096, diff --git a/internal/configuration/schema/types.go b/internal/configuration/schema/types.go index 01bbe26a0..bc5bd988c 100644 --- a/internal/configuration/schema/types.go +++ b/internal/configuration/schema/types.go @@ -9,9 +9,6 @@ import ( "crypto/x509" "encoding/pem" "fmt" - "net" - "net/url" - "strconv" "strings" "time" @@ -20,98 +17,6 @@ import ( "github.com/go-crypt/crypt/algorithm/plaintext" ) -// NewAddressFromString returns an *Address and error depending on the ability to parse the string as an Address. -func NewAddressFromString(a string) (addr *Address, err error) { - if len(a) == 0 { - return &Address{true, "tcp", net.ParseIP("0.0.0.0"), 0}, nil - } - - var u *url.URL - - if regexpHasScheme.MatchString(a) { - u, err = url.Parse(a) - } else { - u, err = url.Parse("tcp://" + a) - } - - if err != nil { - return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", a, err) - } - - return NewAddressFromURL(u) -} - -// NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address. -func NewAddressFromURL(u *url.URL) (addr *Address, err error) { - addr = &Address{ - Scheme: strings.ToLower(u.Scheme), - IP: net.ParseIP(u.Hostname()), - } - - if addr.IP == nil { - return nil, fmt.Errorf("could not parse ip for address '%s': %s does not appear to be an IP", u.String(), u.Hostname()) - } - - port := u.Port() - switch port { - case "": - break - default: - addr.Port, err = strconv.Atoi(port) - if err != nil { - return nil, fmt.Errorf("could not parse port for address '%s': %w", u.String(), err) - } - } - - switch addr.Scheme { - case "tcp", "udp": - break - default: - return nil, fmt.Errorf("could not parse scheme for address '%s': scheme '%s' is not valid, expected to be one of 'tcp://', 'udp://'", u.String(), addr.Scheme) - } - - addr.valid = true - - return addr, nil -} - -// Address represents an address. -type Address struct { - valid bool - - Scheme string - IP net.IP - Port int -} - -// Valid returns true if the Address is valid. -func (a Address) Valid() bool { - return a.valid -} - -// String returns a string representation of the Address. -func (a Address) String() string { - if !a.valid { - return "" - } - - return fmt.Sprintf("%s://%s:%d", a.Scheme, a.IP.String(), a.Port) -} - -// HostPort returns a string representation of the Address with just the host and port. -func (a Address) HostPort() string { - if !a.valid { - return "" - } - - return fmt.Sprintf("%s:%d", a.IP.String(), a.Port) -} - -// Listener creates and returns a net.Listener. -func (a Address) Listener() (net.Listener, error) { - return net.Listen(a.Scheme, a.HostPort()) -} - var cdecoder algorithm.DecoderRegister // DecodePasswordDigest returns a new PasswordDigest if it can be decoded. diff --git a/internal/configuration/schema/types_address.go b/internal/configuration/schema/types_address.go new file mode 100644 index 000000000..c33dcf6c0 --- /dev/null +++ b/internal/configuration/schema/types_address.go @@ -0,0 +1,482 @@ +package schema + +import ( + "fmt" + "net" + "net/url" + "strconv" + "strings" + "syscall" +) + +// NewAddress returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the 'unix' scheme, and everything else without +// a scheme is the 'tcp' scheme. +func NewAddress(value string) (address *Address, err error) { + return NewAddressDefault(value, AddressSchemeTCP, AddressSchemeUnix) +} + +// NewAddressDefault returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything +// else without a scheme is the schemeDefault scheme. +func NewAddressDefault(value, schemeDefault, schemeDefaultPath string) (address *Address, err error) { + if len(value) == 0 { + return &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil + } + + var u *url.URL + + if regexpHasScheme.MatchString(value) { + u, err = url.Parse(value) + } else { + if strings.HasPrefix(value, "/") { + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value)) + } else { + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value)) + } + } + + if err != nil { + return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", value, err) + } + + return NewAddressFromURL(u) +} + +// NewAddressFromNetworkValuesDefault returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything +// else without a scheme is the schemeDefault scheme. +func NewAddressFromNetworkValuesDefault(value string, port int, schemeDefault, schemeDefaultPath string) (address *Address, err error) { + var u *url.URL + + if regexpHasScheme.MatchString(value) { + u, err = url.Parse(value) + } else { + switch { + case strings.HasPrefix(value, "/"): + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value)) + case port > 0: + u, err = url.Parse(fmt.Sprintf("%s://%s:%d", schemeDefault, value, port)) + default: + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value)) + } + } + + if err != nil { + return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", value, err) + } + + return NewAddressFromURL(u) +} + +// NewAddressUnix returns an *Address from a path value. +func NewAddressUnix(path string) Address { + return Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}} +} + +// NewAddressFromNetworkValues returns an *Address from network values. +func NewAddressFromNetworkValues(network, host string, port int) Address { + return Address{true, false, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port)}} +} + +// NewSMTPAddress returns an *AddressSMTP from SMTP values. +func NewSMTPAddress(scheme, host string, port int) *AddressSMTP { + if port == 0 { + switch scheme { + case AddressSchemeSUBMISSIONS: + port = 465 + case AddressSchemeSUBMISSION: + port = 587 + default: + port = 25 + } + } + + if scheme == "" { + switch port { + case 465: + scheme = AddressSchemeSUBMISSIONS + case 587: + scheme = AddressSchemeSUBMISSION + default: + scheme = AddressSchemeSMTP + } + } + + return &AddressSMTP{Address: Address{true, false, port, &url.URL{Scheme: scheme, Host: fmt.Sprintf("%s:%d", host, port)}}} +} + +// NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address. +func NewAddressFromURL(u *url.URL) (addr *Address, err error) { + addr = &Address{ + url: u, + } + + if err = addr.validate(); err != nil { + return nil, err + } + + return addr, nil +} + +// AddressTCP is just a type with an underlying type of Address. +type AddressTCP struct { + Address +} + +// AddressUDP is just a type with an underlying type of Address. +type AddressUDP struct { + Address +} + +// AddressLDAP is just a type with an underlying type of Address. +type AddressLDAP struct { + Address +} + +// AddressSMTP is just a type with an underlying type of Address. +type AddressSMTP struct { + Address +} + +// Address represents an address. +type Address struct { + valid bool + socket bool + port int + + url *url.URL +} + +// Valid returns true if the Address is valid. +func (a *Address) Valid() bool { + return a.valid +} + +// IsUnixDomainSocket returns true if the address has been determined to be a Unix Domain Socket. +func (a *Address) IsUnixDomainSocket() bool { + return a.socket +} + +// IsTCP returns true if the address is one of the TCP schemes (not including application schemes that use TCP). +func (a *Address) IsTCP() bool { + switch a.Scheme() { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6: + return true + default: + return false + } +} + +// IsUDP returns true if the address is one of the UDP schemes (not including application schemes that use UDP). +func (a *Address) IsUDP() bool { + switch a.Scheme() { + case AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6: + return true + default: + return false + } +} + +// IsExplicitlySecure returns true if the address is an explicitly secure. +func (a *Address) IsExplicitlySecure() bool { + switch a.Scheme() { + case AddressSchemeSUBMISSIONS, AddressSchemeLDAPS: + return true + default: + return false + } +} + +// ValidateListener returns true if the Address is valid for a connection listener. +func (a *Address) ValidateListener() error { + switch a.Scheme() { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: + break + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as '%s'", a.Scheme()) + } + + return nil +} + +// ValidateHTTP returns true if the Address is valid for a HTTP connection listener. +func (a *Address) ValidateHTTP() error { + if a.IsTCP() { + return nil + } + + switch a.Scheme() { + case AddressSchemeUnix: + return nil + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme()) + } +} + +// ValidateSMTP returns true if the Address is valid for a remote SMTP connection opener. +func (a *Address) ValidateSMTP() error { + switch a.Scheme() { + case AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: + return nil + default: + return fmt.Errorf("scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as '%s'", a.Scheme()) + } +} + +// ValidateSQL returns true if the Address is valid for a remote SQL connection opener. +func (a *Address) ValidateSQL() error { + if a.IsTCP() { + return nil + } + + switch a.Scheme() { + case AddressSchemeUnix: + return nil + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme()) + } +} + +// ValidateLDAP returns true if the Address has a value Scheme for an LDAP connection opener. +func (a *Address) ValidateLDAP() error { + switch a.Scheme() { + case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeLDAPI: + return nil + default: + return fmt.Errorf("scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as '%s'", a.Scheme()) + } +} + +// String returns a string representation of the Address. +func (a *Address) String() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.String() +} + +// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp. +func (a *Address) Network() string { + switch scheme := a.Scheme(); scheme { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: + return scheme + default: + return AddressSchemeTCP + } +} + +// Scheme returns the *url.URL Scheme field. +func (a *Address) Scheme() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Scheme +} + +// Hostname returns the output of the *url.URL Hostname func. +func (a *Address) Hostname() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Hostname() +} + +// SocketHostname returns the correct hostname for a socket connection. +func (a *Address) SocketHostname() string { + if !a.valid || a.url == nil { + return "" + } + + if a.socket { + return a.url.Path + } + + return a.url.Hostname() +} + +// SetHostname sets the hostname preserving the port. +func (a *Address) SetHostname(hostname string) { + if !a.valid || a.url == nil { + return + } + + if port := a.url.Port(); port == "" { + a.url.Host = hostname + } else { + a.url.Host = fmt.Sprintf("%s:%s", hostname, port) + } +} + +// Port returns the port. +func (a *Address) Port() int { + return a.port +} + +// SetPort sets the port preserving the hostname. +func (a *Address) SetPort(port int) { + if !a.valid || a.url == nil { + return + } + + a.setport(port) +} + +// Host returns the *url.URL Host field. +func (a *Address) Host() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Host +} + +// NetworkAddress returns a string representation of the Address with just the host and port. +func (a *Address) NetworkAddress() string { + if !a.valid || a.url == nil { + return "" + } + + if a.socket { + return a.url.Path + } + + return a.url.Host +} + +// Listener creates and returns a net.Listener. +func (a *Address) Listener() (net.Listener, error) { + return a.listener() +} + +// Dial creates and returns a dialed net.Conn. +func (a *Address) Dial() (net.Conn, error) { + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + return net.Dial(a.Network(), a.NetworkAddress()) +} + +// ListenerWithUMask creates and returns a net.Listener with a temporary UMask if the scheme is `unix`. +func (a *Address) ListenerWithUMask(umask int) (ln net.Listener, err error) { + if !a.socket { + return a.listener() + } + + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + umask = syscall.Umask(umask) + + ln, err = net.Listen(a.Network(), a.NetworkAddress()) + + _ = syscall.Umask(umask) + + return ln, err +} + +func (a *Address) listener() (net.Listener, error) { + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + return net.Listen(a.Network(), a.NetworkAddress()) +} + +func (a *Address) setport(port int) { + a.port = port + a.url.Host = net.JoinHostPort(a.url.Hostname(), strconv.Itoa(port)) +} + +func (a *Address) validate() (err error) { + if a.url == nil { + return fmt.Errorf("error validating the address: address url was nil") + } + + switch { + case a.url.RawQuery != "": + return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses", a.url.String()) + case a.url.RawFragment != "", a.url.Fragment != "": + return fmt.Errorf("error validating the address: the url '%s' appears to have a fragment but this is not valid for addresses", a.url.String()) + case a.url.User != nil: + return fmt.Errorf("error validating the address: the url '%s' appears to have user info but this is not valid for addresses", a.url.String()) + } + + switch a.url.Scheme { + case AddressSchemeUnix, AddressSchemeLDAPI: + if err = a.validateUnixSocket(); err != nil { + return err + } + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6: + if err = a.validateTCPUDP(); err != nil { + return err + } + case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: + if err = a.validateProtocol(); err != nil { + return err + } + } + + a.valid = true + + return nil +} + +func (a *Address) validateProtocol() (err error) { + port := a.url.Port() + + switch port { + case "": + switch a.url.Scheme { + case AddressSchemeLDAP: + a.setport(389) + case AddressSchemeLDAPS: + a.setport(636) + case AddressSchemeSMTP: + a.setport(25) + case AddressSchemeSUBMISSION: + a.setport(587) + case AddressSchemeSUBMISSIONS: + a.setport(465) + } + default: + actualPort, _ := strconv.Atoi(port) + + a.setport(actualPort) + } + + return nil +} + +func (a *Address) validateTCPUDP() (err error) { + port := a.url.Port() + + switch port { + case "": + a.setport(0) + default: + actualPort, _ := strconv.Atoi(port) + + a.setport(actualPort) + } + + return nil +} + +func (a *Address) validateUnixSocket() (err error) { + switch { + case a.url.Path == "" && a.url.Scheme != AddressSchemeLDAPI: + return fmt.Errorf("error validating the unix socket address: could not determine path from '%s'", a.url.String()) + case a.url.Host != "": + return fmt.Errorf("error validating the unix socket address: the url '%s' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", a.url.String()) + } + + a.socket = true + + return nil +} diff --git a/internal/configuration/schema/types_address_test.go b/internal/configuration/schema/types_address_test.go new file mode 100644 index 000000000..f40393d60 --- /dev/null +++ b/internal/configuration/schema/types_address_test.go @@ -0,0 +1,743 @@ +package schema + +import ( + "net" + "net/url" + "path/filepath" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestNewAddressFromString(t *testing.T) { + testCases := []struct { + name string + have string + expected *Address + expectedAddress, expectedString, expectedErr string + }{ + { + "ShouldParseBasicAddress", + "tcp://0.0.0.0:9091", + &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + "0.0.0.0:9091", + "tcp://0.0.0.0:9091", + "", + }, + { + "ShouldParseEmptyAddress", + "", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, + ":0", + "tcp://:0", + "", + }, + { + "ShouldParseAddressMissingScheme", + "0.0.0.0:9091", + &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + "0.0.0.0:9091", + "tcp://0.0.0.0:9091", + "", + }, + { + "ShouldParseUnixAddressMissingScheme", + "/var/run/example.sock", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}}, + "/var/run/example.sock", + "unix:///var/run/example.sock", + "", + }, + { + "ShouldParseAddressMissingPort", + "tcp://0.0.0.0", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}}, + "0.0.0.0:0", + "tcp://0.0.0.0:0", + "", + }, + { + "ShouldParseUnixSocket", + "unix:///path/to/a/socket.sock", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}}, + "/path/to/a/socket.sock", + "unix:///path/to/a/socket.sock", + "", + }, + { + "ShouldNotParseUnixSocketWithHost", + "unix://ahost/path/to/a/socket.sock", + nil, + "", + "", + "error validating the unix socket address: the url 'unix://ahost/path/to/a/socket.sock' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", + }, + { + "ShouldNotParseUnixSocketWithoutPath", + "unix://nopath.com", + nil, + "", + "", + "error validating the unix socket address: could not determine path from 'unix://nopath.com'", + }, + { + "ShouldNotParseUnixSocketWithQuery", + "unix:///path/to/a/socket.sock?q=yes", + nil, + "", + "", + "error validating the address: the url 'unix:///path/to/a/socket.sock?q=yes' appears to have a query but this is not valid for addresses", + }, + { + "ShouldNotParseUnixSocketWithFragment", + "unix:///path/to/a/socket.sock#example", + nil, + "", + "", + "error validating the address: the url 'unix:///path/to/a/socket.sock#example' appears to have a fragment but this is not valid for addresses", + }, + { + "ShouldNotParseUnixSocketWithUserInfo", + "unix://user:example@/path/to/a/socket.sock", + nil, + "", + "", + "error validating the address: the url 'unix://user:example@/path/to/a/socket.sock' appears to have user info but this is not valid for addresses", + }, + { + "ShouldParseUnknownScheme", + "a://0.0.0.0", + &Address{true, false, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}}, + "0.0.0.0", + "a://0.0.0.0", + "", + }, + { + "ShouldNotParseInvalidPort", + "tcp://0.0.0.0:abc", + nil, + "", + "", + "could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [://][:]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host", + }, + { + "ShouldNotParseInvalidAddress", + "@$@#%@#$@@", + nil, + "", + "", + "could not parse string '@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", + }, + { + "ShouldNotParseInvalidAddressWithScheme", + "tcp://@$@#%@#$@@", + nil, + "", + "", + "could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", + }, + { + "ShouldSetDefaultPortLDAP", + "ldap://127.0.0.1", + &Address{true, false, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}}, + "127.0.0.1:389", + "ldap://127.0.0.1:389", + "", + }, + { + "ShouldSetDefaultPortLDAPS", + "ldaps://127.0.0.1", + &Address{true, false, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}}, + "127.0.0.1:636", + "ldaps://127.0.0.1:636", + "", + }, + { + "ShouldAllowLDAPI", + "ldapi:///abc", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}}, + "/abc", + "ldapi:///abc", + "", + }, + { + "ShouldAllowImplicitLDAPI", + "ldapi://", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + "", + "ldapi:", + "", + }, + { + "ShouldAllowImplicitLDAPINoSlash", + "ldapi:", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + "", + "ldapi:", + "", + }, + { + "ShouldSetDefaultPortSMTP", + "smtp://127.0.0.1", + &Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}}, + "127.0.0.1:25", + "smtp://127.0.0.1:25", + "", + }, + { + "ShouldSetDefaultPortSUBMISSION", + "submission://127.0.0.1", + &Address{true, false, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}}, + "127.0.0.1:587", + "submission://127.0.0.1:587", + "", + }, + { + "ShouldSetDefaultPortSUBMISSIONS", + "submissions://127.0.0.1", + &Address{true, false, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}}, + "127.0.0.1:465", + "submissions://127.0.0.1:465", + "", + }, + { + "ShouldNotOverridePort", + "ldap://127.0.0.1:123", + &Address{true, false, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}}, + "127.0.0.1:123", + "ldap://127.0.0.1:123", + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + actual, actualErr := NewAddress(tc.have) + + if len(tc.expectedErr) != 0 { + assert.EqualError(t, actualErr, tc.expectedErr) + } else { + assert.Nil(t, actualErr) + + assert.Equal(t, tc.expectedAddress, actual.NetworkAddress()) + assert.Equal(t, tc.expectedString, actual.String()) + + assert.True(t, actual.Valid()) + } + + assert.Equal(t, tc.expected, actual) + }) + } +} + +func TestAddress_ValidateErrors(t *testing.T) { + testCases := []struct { + name string + have *Address + expectedLDAP, expectedSMTP, expectedHTTP, expectedSQL, expectedListener string + }{ + { + "ShouldValidateLDAPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}}, + "", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'ldap'", + }, + { + "ShouldValidateSMTPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'", + "", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'smtp'", + }, + { + "ShouldValidateTCPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'tcp'", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'tcp'", + "", + "", + "", + }, + { + "ShouldValidateUnixSocket", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/socket"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'unix'", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'unix'", + "", + "", + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + if tc.expectedLDAP == "" { + assert.NoError(t, tc.have.ValidateLDAP()) + } else { + assert.EqualError(t, tc.have.ValidateLDAP(), tc.expectedLDAP) + } + + if tc.expectedSMTP == "" { + assert.NoError(t, tc.have.ValidateSMTP()) + } else { + assert.EqualError(t, tc.have.ValidateSMTP(), tc.expectedSMTP) + } + + if tc.expectedHTTP == "" { + assert.NoError(t, tc.have.ValidateHTTP()) + } else { + assert.EqualError(t, tc.have.ValidateHTTP(), tc.expectedHTTP) + } + + if tc.expectedSQL == "" { + assert.NoError(t, tc.have.ValidateSQL()) + } else { + assert.EqualError(t, tc.have.ValidateSQL(), tc.expectedSQL) + } + + if tc.expectedListener == "" { + assert.NoError(t, tc.have.ValidateListener()) + } else { + assert.EqualError(t, tc.have.ValidateListener(), tc.expectedListener) + } + }) + } +} + +func TestAddress_SetHostname(t *testing.T) { + address := &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}} + + assert.Equal(t, "tcp://0.0.0.0", address.String()) + + address.SetHostname("127.0.0.1") + + assert.Equal(t, "tcp://127.0.0.1", address.String()) +} + +func TestAddress_ListenerWithUMask(t *testing.T) { + dir := t.TempDir() + + address := &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: filepath.Join(dir, "example.sock")}} + + ln, err := address.ListenerWithUMask(600) + + assert.NotNil(t, ln) + assert.NoError(t, err) + assert.NoError(t, ln.Close()) + + address = &Address{true, true, 0, nil} + + ln, err = address.ListenerWithUMask(600) + + assert.Nil(t, ln) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 0, nil} + + ln, err = address.ListenerWithUMask(600) + + assert.Nil(t, ln) + assert.EqualError(t, err, "address url is nil") +} + +func TestAddressOutputValues(t *testing.T) { + var ( + address *Address + listener net.Listener + err error + ) + + address = &Address{} + assert.EqualError(t, address.validate(), "error validating the address: address url was nil") + + address = &Address{false, false, 0, nil} + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}} + + assert.Equal(t, "tcp://0.0.0.0:8080", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:8080", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:8080", address.NetworkAddress()) + assert.Equal(t, 8080, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + address = &Address{true, false, 0, nil} + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address.SetHostname("abc123.com") + address.SetPort(50) + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}} + + assert.Equal(t, "tcp://0.0.0.0:9091", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:9091", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:9091", address.NetworkAddress()) + assert.Equal(t, 9091, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + assert.NoError(t, listener.Close()) + + address.SetPort(9092) + + assert.Equal(t, "tcp://0.0.0.0:9092", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:9092", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:9092", address.NetworkAddress()) + assert.Equal(t, 9092, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + assert.NoError(t, listener.Close()) + + address.SetHostname("example.com") + + assert.Equal(t, "tcp://example.com:9092", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "example.com:9092", address.Host()) + assert.Equal(t, "example.com", address.Hostname()) + assert.Equal(t, "example.com:9092", address.NetworkAddress()) + assert.Equal(t, 9092, address.Port()) +} + +func TestNewAddressUnix(t *testing.T) { + have := NewAddressUnix("/abc/123") + + require.NotNil(t, have) + assert.Equal(t, "unix:///abc/123", have.String()) +} + +func TestNewAddressFromNetworkValues(t *testing.T) { + have := NewAddressFromNetworkValues(AddressSchemeUDP, "av", 1) + + require.NotNil(t, have) + assert.Equal(t, "udp://av:1", have.String()) +} + +func TestNewSMTPAddress(t *testing.T) { + testCases := []struct { + name string + haveScheme string + haveHost string + havePort int + expected string + expectedNetwork, expectedScheme string + expectedHostname string + expectedPort int + expectedExplicitTLS bool + }{ + { + "ShouldParseUnknownSchemePort25", + "", + "hosta", + 25, + "smtp://hosta:25", + "tcp", + "smtp", + "hosta", + 25, + false, + }, + { + "ShouldParseUnknownSchemePort465", + "", + "hostb", + 465, + "submissions://hostb:465", + "tcp", + "submissions", + "hostb", + 465, + true, + }, + { + "ShouldParseUnknownSchemePort587", + "", + "hostc", + 587, + "submission://hostc:587", + "tcp", + "submission", + "hostc", + 587, + false, + }, + { + "ShouldParseUnknownPortSchemeSMTP", + "smtp", + "hostd", + 0, + "smtp://hostd:25", + "tcp", + "smtp", + "hostd", + 25, + false, + }, + { + "ShouldParseUnknownPortSchemeSUBMISSION", + "submission", + "hoste", + 0, + "submission://hoste:587", + "tcp", + "submission", + "hoste", + 587, + false, + }, + { + "ShouldParseUnknownPortSchemeSUBMISSIONS", + "submissions", + "hostf", + 0, + "submissions://hostf:465", + "tcp", + "submissions", + "hostf", + 465, + true, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + have := NewSMTPAddress(tc.haveScheme, tc.haveHost, tc.havePort) + + assert.Equal(t, tc.expected, have.String()) + assert.Equal(t, tc.expectedScheme, have.Scheme()) + assert.Equal(t, tc.expectedNetwork, have.Network()) + assert.Equal(t, tc.expectedHostname, have.Hostname()) + assert.Equal(t, tc.expectedHostname, have.SocketHostname()) + assert.Equal(t, tc.expectedPort, have.Port()) + assert.Equal(t, tc.expectedExplicitTLS, have.IsExplicitlySecure()) + }) + } +} + +func TestAddress_SocketHostname(t *testing.T) { + testCases := []struct { + name string + have Address + expected string + }{ + { + "ShouldReturnHostname", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "examplea:80"}}, + "examplea", + }, + { + "ShouldReturnPath", + Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, + "/abc/123", + }, + { + "ShouldReturnNothing", + Address{false, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, + "", + }, + { + "ShouldReturnNothingNil", + Address{true, true, 80, nil}, + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.expected, tc.have.SocketHostname()) + }) + } +} + +func TestAddress_IsTCP_IsUDP(t *testing.T) { + testCases := []struct { + name string + have Address + isTCP bool + isUDP bool + }{ + { + "ShouldReturnTrueTCP", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta"}}, + true, + false, + }, + { + "ShouldReturnTrueTCP4", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP4, Host: "tcphostb"}}, + true, + false, + }, + { + "ShouldReturnTrueTCP6", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP6, Host: "tcphostc"}}, + true, + false, + }, + { + "ShouldReturnFalseUDP", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP, Host: "tcphostd"}}, + false, + true, + }, + { + "ShouldReturnFalseUDP4", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP4, Host: "tcphoste"}}, + false, + true, + }, + { + "ShouldReturnFalseUDP6", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP6, Host: "tcphostf"}}, + false, + true, + }, + { + "ShouldReturnFalseSMTP", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeSMTP, Host: "tcphostg"}}, + false, + false, + }, + { + "ShouldReturnFalseUnix", + Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Host: "tcphosth"}}, + false, + false, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.isTCP, tc.have.IsTCP()) + assert.Equal(t, tc.isUDP, tc.have.IsUDP()) + }) + } +} + +func TestNewAddressFromNetworkValuesDefault(t *testing.T) { + testCases := []struct { + name string + haveHost string + havePort int + haveSchemeDefault string + haveSchemeDefaultPath string + expected string + expectedErr string + }{ + { + "ShouldParseTCPWithTCPUnix", + "cba", + 80, + AddressSchemeTCP, + AddressSchemeUnix, + "tcp://cba:80", + "", + }, + { + "ShouldParseTCPWithTCPUnixNoPort", + "cba", + 0, + AddressSchemeTCP, + AddressSchemeUnix, + "tcp://cba:0", + "", + }, + { + "ShouldParseUnixWithTCPUnix", + "/abc/123", + 80, + AddressSchemeTCP, + AddressSchemeUnix, + "unix:///abc/123", + "", + }, + { + "ShouldParseUnixWithScheme", + "unix:///abc/123", + 0, + AddressSchemeTCP, + AddressSchemeUnix, + "unix:///abc/123", + "", + }, + { + "ShouldErrBadURL", + "tcp://127.0.0.1:abc", + 0, + AddressSchemeTCP, + AddressSchemeUnix, + "", + "could not parse string 'tcp://127.0.0.1:abc' as address: expected format is [://][:]: parse \"tcp://127.0.0.1:abc\": invalid port \":abc\" after host", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + actual, theError := NewAddressFromNetworkValuesDefault(tc.haveHost, tc.havePort, tc.haveSchemeDefault, tc.haveSchemeDefaultPath) + + if tc.expectedErr == "" { + require.NoError(t, theError) + assert.Equal(t, tc.expected, actual.String()) + } else { + assert.EqualError(t, theError, tc.expectedErr) + assert.Nil(t, actual) + } + }) + } +} diff --git a/internal/configuration/schema/types_test.go b/internal/configuration/schema/types_test.go index ab83941a1..886b9ce32 100644 --- a/internal/configuration/schema/types_test.go +++ b/internal/configuration/schema/types_test.go @@ -3,10 +3,10 @@ package schema import ( "crypto" "crypto/rsa" + "crypto/tls" "crypto/x509" "encoding/pem" "fmt" - "net" "regexp" "testing" @@ -14,44 +14,162 @@ import ( "github.com/stretchr/testify/require" ) -func TestNewAddressFromString(t *testing.T) { +func TestNewTLSVersion(t *testing.T) { testCases := []struct { - name string - have string - expected *Address - expectedHostPort, expectedString, expectedErr string + name string + have string + expected *TLSVersion + err string }{ - {"ShouldParseBasicAddress", "tcp://0.0.0.0:9091", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 9091}, "0.0.0.0:9091", "tcp://0.0.0.0:9091", ""}, - {"ShouldParseEmptyAddress", "", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 0}, "0.0.0.0:0", "tcp://0.0.0.0:0", ""}, - {"ShouldParseAddressMissingScheme", "0.0.0.0:9091", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 9091}, "0.0.0.0:9091", "tcp://0.0.0.0:9091", ""}, - {"ShouldParseAddressMissingPort", "tcp://0.0.0.0", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 0}, "0.0.0.0:0", "tcp://0.0.0.0:0", ""}, - {"ShouldNotParseUnknownScheme", "a://0.0.0.0", nil, "", "", "could not parse scheme for address 'a://0.0.0.0': scheme 'a' is not valid, expected to be one of 'tcp://', 'udp://'"}, - {"ShouldNotParseInvalidPort", "tcp://0.0.0.0:abc", nil, "", "", "could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [://][:]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host"}, - {"ShouldNotParseInvalidIP", "tcp://example.com:9091", nil, "", "", "could not parse ip for address 'tcp://example.com:9091': example.com does not appear to be an IP"}, - {"ShouldNotParseInvalidAddress", "@$@#%@#$@@", nil, "", "", "could not parse string '@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\""}, - {"ShouldNotParseInvalidAddressWithScheme", "tcp://@$@#%@#$@@", nil, "", "", "could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\""}, + { + "ShouldParseTLS1.3", + "TLS1.3", + &TLSVersion{Value: tls.VersionTLS13}, + "", + }, + { + "ShouldParse1.3", + "1.3", + &TLSVersion{Value: tls.VersionTLS13}, + "", + }, + { + "ShouldParseTLS1.2", + "TLS1.2", + &TLSVersion{Value: tls.VersionTLS12}, + "", + }, + { + "ShouldParse1.2", + "1.2", + &TLSVersion{Value: tls.VersionTLS12}, + "", + }, + { + "ShouldParseTLS1.1", + "TLS1.1", + &TLSVersion{Value: tls.VersionTLS11}, + "", + }, + { + "ShouldParse1.1", + "1.1", + &TLSVersion{Value: tls.VersionTLS11}, + "", + }, + { + "ShouldParseTLS1.0", + "TLS1.0", + &TLSVersion{Value: tls.VersionTLS10}, + "", + }, + { + "ShouldParse1.0", + "1.0", + &TLSVersion{Value: tls.VersionTLS10}, + "", + }, + { + "ShouldParseSSL3.0", + "SSL3.0", + &TLSVersion{Value: tls.VersionSSL30}, //nolint:staticcheck + "", + }, + { + "ShouldNotParse3.0", + "3.0", + nil, + "supplied tls version isn't supported", + }, } for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { - actual, actualErr := NewAddressFromString(tc.have) + actual, theError := NewTLSVersion(tc.have) - if len(tc.expectedErr) != 0 { - assert.EqualError(t, actualErr, tc.expectedErr) + if tc.err == "" { + assert.NoError(t, theError) + assert.Equal(t, tc.expected, actual) } else { - assert.Nil(t, actualErr) - - assert.Equal(t, actual.HostPort(), tc.expectedHostPort) - assert.Equal(t, actual.String(), tc.expectedString) + assert.EqualError(t, theError, tc.err) + assert.Nil(t, actual) } + }) + } +} - assert.Equal(t, tc.expected, actual) +func TestTLSVersion_Functions(t *testing.T) { + type expected struct { + min, max uint16 + str string + } - if actual != nil { - assert.True(t, actual.Valid()) - assert.NotEmpty(t, actual.String()) - assert.NotEmpty(t, actual.HostPort()) - } + testCases := []struct { + name string + have *TLSVersion + expected expected + }{ + { + "ShouldReturnCorrectValuesNotConfigured", + &TLSVersion{}, + expected{ + tls.VersionTLS12, + tls.VersionTLS13, + "", + }, + }, + { + "ShouldReturnCorrectValueTLS1.3", + &TLSVersion{Value: tls.VersionTLS13}, + expected{ + tls.VersionTLS13, + tls.VersionTLS13, + "TLS1.3", + }, + }, + { + "ShouldReturnCorrectValueTLS1.2", + &TLSVersion{Value: tls.VersionTLS12}, + expected{ + tls.VersionTLS12, + tls.VersionTLS12, + "TLS1.2", + }, + }, + { + "ShouldReturnCorrectValueTLS1.1", + &TLSVersion{Value: tls.VersionTLS11}, + expected{ + tls.VersionTLS11, + tls.VersionTLS11, + "TLS1.1", + }, + }, + { + "ShouldReturnCorrectValueTLS1.0", + &TLSVersion{Value: tls.VersionTLS10}, + expected{ + tls.VersionTLS10, + tls.VersionTLS10, + "TLS1.0", + }, + }, + { + "ShouldReturnCorrectValueSSL3.0", + &TLSVersion{Value: tls.VersionSSL30}, //nolint:staticcheck + expected{ + tls.VersionSSL30, //nolint:staticcheck + tls.VersionSSL30, //nolint:staticcheck + "SSL3.0", + }, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.expected.min, tc.have.MinVersion()) + assert.Equal(t, tc.expected.max, tc.have.MaxVersion()) + assert.Equal(t, tc.expected.str, tc.have.String()) }) } } diff --git a/internal/configuration/template_test.go b/internal/configuration/template_test.go index aab4b26ae..909b85b9d 100644 --- a/internal/configuration/template_test.go +++ b/internal/configuration/template_test.go @@ -25,7 +25,7 @@ func TestShouldGenerateConfiguration(t *testing.T) { assert.NoError(t, err) } -func TestNotShouldGenerateConfigurationifExists(t *testing.T) { +func TestNotShouldGenerateConfigurationIfExists(t *testing.T) { dir := t.TempDir() cfg := filepath.Join(dir, "config.yml") diff --git a/internal/configuration/test_resources/config.deprecated.alt.yml b/internal/configuration/test_resources/config.deprecated.alt.yml new file mode 100644 index 000000000..9ea5f9cd6 --- /dev/null +++ b/internal/configuration/test_resources/config.deprecated.alt.yml @@ -0,0 +1,173 @@ +--- +default_redirection_url: https://home.example.com:8080/ + +server: + address: "tcp://127.0.0.1:9091" + endpoints: + authz: + forward-auth: + implementation: ForwardAuth + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + ext-authz: + implementation: ExtAuthz + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + auth-request: + implementation: AuthRequest + authn_strategies: + - name: HeaderAuthRequestProxyAuthorization + - name: CookieSession + legacy: + implementation: Legacy + +log: + level: debug + +totp: + issuer: authelia.com + +duo_api: + hostname: api-123456789.example.com + integration_key: ABCDEF + +authentication_backend: + ldap: + url: 'ldap://127.0.0.1' + tls: + private_key: | + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758 + cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn + ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5 + Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa + rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp + EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU + L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+ + Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm + 9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7 + 8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV + I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7 + CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE + hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi + jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q + E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b + CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn + jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio + Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ + Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX + bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1 + otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj + HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd + tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM + USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 + 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== + -----END RSA PRIVATE KEY----- + base_dn: dc=example,dc=com + username_attribute: uid + additional_users_dn: ou=users + users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + additional_groups_dn: ou=groups + groups_filter: (&(member={dn})(objectClass=groupOfNames)) + group_name_attribute: cn + mail_attribute: mail + user: cn=admin,dc=example,dc=com + +access_control: + default_policy: deny + + rules: + # Rules applied to everyone + - domain: public.example.com + policy: bypass + + - domain: secure.example.com + policy: one_factor + # Network based rule, if not provided any network matches. + networks: + - 192.168.1.0/24 + - domain: secure.example.com + policy: two_factor + + - domain: [singlefactor.example.com, onefactor.example.com] + policy: one_factor + + # Rules applied to 'admins' group + - domain: "mx2.mail.example.com" + subject: "group:admins" + policy: deny + - domain: "*.example.com" + subject: "group:admins" + policy: two_factor + + # Rules applied to 'dev' group + - domain: dev.example.com + resources: + - "^/groups/dev/.*$" + subject: "group:dev" + policy: two_factor + + # Rules applied to user 'john' + - domain: dev.example.com + resources: + - "^/users/john/.*$" + subject: "user:john" + policy: two_factor + + # Rules applied to 'dev' group and user 'john' + - domain: dev.example.com + resources: + - "^/deny-all.*$" + subject: ["group:dev", "user:john"] + policy: deny + + # Rules applied to user 'harry' + - domain: dev.example.com + resources: + - "^/users/harry/.*$" + subject: "user:harry" + policy: two_factor + + # Rules applied to user 'bob' + - domain: "*.mail.example.com" + subject: "user:bob" + policy: two_factor + - domain: "dev.example.com" + resources: + - "^/users/bob/.*$" + subject: "user:bob" + policy: two_factor + +session: + name: authelia_session + expiration: 3600000 # 1 hour + inactivity: 300000 # 5 minutes + domain: example.com + redis: + host: 127.0.0.1 + port: 6379 + high_availability: + sentinel_name: test + +regulation: + max_retries: 3 + find_time: 120 + ban_time: 300 + +storage: + postgres: + host: 127.0.0.1 + port: 5432 + database: authelia + username: authelia + +notifier: + smtp: + username: test + host: 127.0.0.1 + port: 1025 + sender: admin@example.com + disable_require_tls: true +... diff --git a/internal/configuration/test_resources/config.deprecated.yml b/internal/configuration/test_resources/config.deprecated.yml new file mode 100644 index 000000000..24a577b4f --- /dev/null +++ b/internal/configuration/test_resources/config.deprecated.yml @@ -0,0 +1,173 @@ +--- +default_redirection_url: https://home.example.com:8080/ + +server: + address: "tcp://127.0.0.1:9091" + endpoints: + authz: + forward-auth: + implementation: ForwardAuth + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + ext-authz: + implementation: ExtAuthz + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + auth-request: + implementation: AuthRequest + authn_strategies: + - name: HeaderAuthRequestProxyAuthorization + - name: CookieSession + legacy: + implementation: Legacy + +log: + level: debug + +totp: + issuer: authelia.com + +duo_api: + hostname: api-123456789.example.com + integration_key: ABCDEF + +authentication_backend: + ldap: + url: 'ldap://127.0.0.1' + tls: + private_key: | + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758 + cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn + ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5 + Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa + rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp + EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU + L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+ + Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm + 9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7 + 8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV + I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7 + CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE + hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi + jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q + E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b + CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn + jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio + Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ + Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX + bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1 + otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj + HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd + tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM + USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 + 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== + -----END RSA PRIVATE KEY----- + base_dn: dc=example,dc=com + username_attribute: uid + additional_users_dn: ou=users + users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + additional_groups_dn: ou=groups + groups_filter: (&(member={dn})(objectClass=groupOfNames)) + group_name_attribute: cn + mail_attribute: mail + user: cn=admin,dc=example,dc=com + +access_control: + default_policy: deny + + rules: + # Rules applied to everyone + - domain: public.example.com + policy: bypass + + - domain: secure.example.com + policy: one_factor + # Network based rule, if not provided any network matches. + networks: + - 192.168.1.0/24 + - domain: secure.example.com + policy: two_factor + + - domain: [singlefactor.example.com, onefactor.example.com] + policy: one_factor + + # Rules applied to 'admins' group + - domain: "mx2.mail.example.com" + subject: "group:admins" + policy: deny + - domain: "*.example.com" + subject: "group:admins" + policy: two_factor + + # Rules applied to 'dev' group + - domain: dev.example.com + resources: + - "^/groups/dev/.*$" + subject: "group:dev" + policy: two_factor + + # Rules applied to user 'john' + - domain: dev.example.com + resources: + - "^/users/john/.*$" + subject: "user:john" + policy: two_factor + + # Rules applied to 'dev' group and user 'john' + - domain: dev.example.com + resources: + - "^/deny-all.*$" + subject: ["group:dev", "user:john"] + policy: deny + + # Rules applied to user 'harry' + - domain: dev.example.com + resources: + - "^/users/harry/.*$" + subject: "user:harry" + policy: two_factor + + # Rules applied to user 'bob' + - domain: "*.mail.example.com" + subject: "user:bob" + policy: two_factor + - domain: "dev.example.com" + resources: + - "^/users/bob/.*$" + subject: "user:bob" + policy: two_factor + +session: + name: authelia_session + expiration: 3600000 # 1 hour + inactivity: 300000 # 5 minutes + domain: example.com + redis: + host: 127.0.0.1 + port: 6379 + high_availability: + sentinel_name: test + +regulation: + max_retries: 3 + find_time: 120 + ban_time: 300 + +storage: + mysql: + host: 127.0.0.1 + port: 3306 + database: authelia + username: authelia + +notifier: + smtp: + username: test + host: 127.0.0.1 + port: 1025 + sender: admin@example.com + disable_require_tls: true +... diff --git a/internal/configuration/test_resources/config.durations.yml b/internal/configuration/test_resources/config.durations.yml new file mode 100644 index 000000000..f20f5d3be --- /dev/null +++ b/internal/configuration/test_resources/config.durations.yml @@ -0,0 +1,171 @@ +--- +default_redirection_url: 'https://home.example.com:8080/' + +server: + address: 'tcp://127.0.0.1:9091' + endpoints: + authz: + forward-auth: + implementation: 'ForwardAuth' + authn_strategies: + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' + ext-authz: + implementation: 'ExtAuthz' + authn_strategies: + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' + auth-request: + implementation: 'AuthRequest' + authn_strategies: + - name: 'HeaderAuthRequestProxyAuthorization' + - name: 'CookieSession' + legacy: + implementation: 'Legacy' + +log: + level: 'debug' + +totp: + issuer: 'authelia.com' + +duo_api: + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' + +authentication_backend: + ldap: + address: 'ldap://127.0.0.1' + tls: + private_key: | + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758 + cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn + ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5 + Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa + rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp + EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU + L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+ + Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm + 9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7 + 8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV + I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7 + CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE + hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi + jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q + E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b + CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn + jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio + Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ + Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX + bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1 + otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj + HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd + tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM + USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 + 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== + -----END RSA PRIVATE KEY----- + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' + +access_control: + default_policy: 'deny' + + rules: + # Rules applied to everyone + - domain: 'public.example.com' + policy: 'bypass' + + - domain: 'secure.example.com' + policy: 'one_factor' + # Network based rule, if not provided any network matches. + networks: + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' + + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' + + # Rules applied to 'admins' group + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' + + # Rules applied to 'dev' group + - domain: 'dev.example.com' + resources: + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' + + # Rules applied to user 'john' + - domain: 'dev.example.com' + resources: + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' + + # Rules applied to 'dev' group and user 'john' + - domain: 'dev.example.com' + resources: + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' + + # Rules applied to user 'harry' + - domain: 'dev.example.com' + resources: + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' + + # Rules applied to user 'bob' + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' + resources: + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' + +session: + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' + redis: + host: '127.0.0.1' + port: 6379 + high_availability: + sentinel_name: 'test' + +regulation: + max_retries: 3 + find_time: 123456789123456789123 + ban_time: 1.0e3 + +storage: + mysql: + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' + +notifier: + smtp: + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' + disable_require_tls: true +... diff --git a/internal/configuration/test_resources/config.filtered.yml b/internal/configuration/test_resources/config.filtered.yml index 0a5d84daf..aa7f5ca27 100644 --- a/internal/configuration/test_resources/config.filtered.yml +++ b/internal/configuration/test_resources/config.filtered.yml @@ -2,8 +2,7 @@ default_redirection_url: 'https://home.{{ env "ROOT_DOMAIN" }}:8080/' server: - host: '{{ env "SERVICES_SERVER" }}' - port: 9091 + address: 'tcp://{{ env "SERVICES_SERVER" }}:9091' log: level: debug @@ -17,7 +16,7 @@ duo_api: authentication_backend: ldap: - url: 'ldap://{{ env "SERVICES_SERVER" }}' + address: 'ldap://{{ env "SERVICES_SERVER" }}' tls: private_key: | -----BEGIN RSA PRIVATE KEY----- @@ -162,16 +161,14 @@ regulation: storage: mysql: - host: '{{ env "SERVICES_SERVER" }}' - port: 3306 + address: 'tcp://{{ env "SERVICES_SERVER" }}:3306' database: authelia username: authelia notifier: smtp: username: test - host: '{{ env "SERVICES_SERVER" }}' - port: 1025 + address: 'smtp://{{ env "SERVICES_SERVER" }}:1025' sender: 'admin@{{ env "ROOT_DOMAIN" }}' disable_require_tls: true diff --git a/internal/configuration/test_resources/config.yml b/internal/configuration/test_resources/config.yml index 3d6437343..816e422ce 100644 --- a/internal/configuration/test_resources/config.yml +++ b/internal/configuration/test_resources/config.yml @@ -1,42 +1,41 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' authn_strategies: - - name: HeaderProxyAuthorization - - name: CookieSession + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' authn_strategies: - - name: HeaderProxyAuthorization - - name: CookieSession + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' authn_strategies: - - name: HeaderAuthRequestProxyAuthorization - - name: CookieSession + - name: 'HeaderAuthRequestProxyAuthorization' + - name: 'CookieSession' legacy: - implementation: Legacy + implementation: 'Legacy' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 + address: 'ldap://127.0.0.1' tls: private_key: | -----BEGIN RSA PRIVATE KEY----- @@ -66,109 +65,107 @@ authentication_backend: USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== -----END RSA PRIVATE KEY----- - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_alt.yml b/internal/configuration/test_resources/config_alt.yml index 7f20e787e..ec9177f72 100644 --- a/internal/configuration/test_resources/config_alt.yml +++ b/internal/configuration/test_resources/config_alt.yml @@ -1,125 +1,122 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes remember_me: -1 - domain: example.com + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: postgres: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:5432' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: Admin + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'Admin ' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_bad_keys.yml b/internal/configuration/test_resources/config_bad_keys.yml index d0bcacd1e..fc898ac75 100644 --- a/internal/configuration/test_resources/config_bad_keys.yml +++ b/internal/configuration/test_resources/config_bad_keys.yml @@ -1,125 +1,122 @@ --- -loggy_file: /config/svc.log +loggy_file: '/config/svc.log' -logs_level: debug +logs_level: 'debug' -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_bad_quoting.yml b/internal/configuration/test_resources/config_bad_quoting.yml index 90613b2d0..3bf7c4be0 100644 --- a/internal/configuration/test_resources/config_bad_quoting.yml +++ b/internal/configuration/test_resources/config_bad_quoting.yml @@ -1,57 +1,54 @@ --- -jwt_secret: RUtG9TnbXrOl1XLLmDgySw1DGgx9QcrtepIf1uDDBlBVKFZxkVBruYKBi32PvaU +jwt_secret: 'RUtG9TnbXrOl1XLLmDgySw1DGgx9QcrtepIf1uDDBlBVKFZxkVBruYKBi32PvaU' -default_redirection_url: example.com +default_redirection_url: 'example.com' server: - host: 0.0.0.0 - port: 9091 + address: 'tcp://:9091' log: - level: debug + level: 'debug' totp: - issuer: example.com + issuer: 'example.com' period: 30 skew: 1 authentication_backend: file: - path: /config/users_database.yml + path: '/config/users_database.yml' access_control: - default_policy: deny + default_policy: 'deny' rules: - - domain: example.com - policy: bypass - - domain: *.example.com - policy: one_factor + - domain: 'example.com' + policy: 'bypass' + - domain: '*.example.com' + policy: 'one_factor' session: - name: authelia_session - secret: TVPMIcDFbBwhnW3kLJzKhdjeHhtqisr7m28FgRY8oLh2A4lwuV2jV2ZGdGbh4aa - expiration: 3600 - inactivity: 300 - domain: example.com + name: 'authelia_session' + secret: 'TVPMIcDFbBwhnW3kLJzKhdjeHhtqisr7m28FgRY8oLh2A4lwuV2jV2ZGdGbh4aa' + expiration: '1h' + inactivity: '5m' + domain: 'example.com' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: example.com - port: 3306 - database: authelia - username: authelia - password: example.com + address: 'tcp://example.com:3306' + database: 'authelia' + username: 'authelia' + password: 'example.com' notifier: smtp: - username: example.com - password: example.com - host: smtp.gmail.com - port: 465 - sender: example.com + address: 'submissions://smtp.gmail.com:465' + username: 'example.com' + password: 'example.com' + sender: 'example.com' ... diff --git a/internal/configuration/test_resources/config_domain_bad_regex.yml b/internal/configuration/test_resources/config_domain_bad_regex.yml index 37147b8d5..7c8250dae 100644 --- a/internal/configuration/test_resources/config_domain_bad_regex.yml +++ b/internal/configuration/test_resources/config_domain_bad_regex.yml @@ -1,126 +1,123 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain_regex: ^\K(public|public2).example.com$ - policy: bypass + - domain_regex: '^\K(public|public2).example.com$' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_domain_regex.yml b/internal/configuration/test_resources/config_domain_regex.yml index 24f194f8b..78a486d21 100644 --- a/internal/configuration/test_resources/config_domain_regex.yml +++ b/internal/configuration/test_resources/config_domain_regex.yml @@ -1,132 +1,129 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain_regex: ^(public|public2).example.com$ - policy: bypass + - domain_regex: '^(public|public2).example.com$' + policy: 'bypass' - - domain_regex: ^portfolio-(?P[a-zA-Z0-9]+).example.com$ - policy: one_factor + - domain_regex: '^portfolio-(?P[a-zA-Z0-9]+).example.com$' + policy: 'one_factor' - - domain_regex: ^portfolio-(?P[a-zA-Z0-9]+)-(?P[a-zA-Z0-9]+).example.com$ - policy: one_factor + - domain_regex: '^portfolio-(?P[a-zA-Z0-9]+)-(?P[a-zA-Z0-9]+).example.com$' + policy: 'one_factor' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_oidc.yml b/internal/configuration/test_resources/config_oidc.yml index 94a76e0bb..076d5ae82 100644 --- a/internal/configuration/test_resources/config_oidc.yml +++ b/internal/configuration/test_resources/config_oidc.yml @@ -1,137 +1,134 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true identity_providers: oidc: cors: allowed_origins: - - https://google.com - - https://example.com + - 'https://google.com' + - 'https://example.com' clients: - - id: abc + - id: 'abc' secret: '123' - consent_mode: explicit + consent_mode: 'explicit' ... diff --git a/internal/configuration/test_resources/config_smtp_sender_blank.yml b/internal/configuration/test_resources/config_smtp_sender_blank.yml index a07eeb60a..0fe8205a5 100644 --- a/internal/configuration/test_resources/config_smtp_sender_blank.yml +++ b/internal/configuration/test_resources/config_smtp_sender_blank.yml @@ -1,126 +1,123 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: "" + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: '' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_smtp_sender_invalid.yml b/internal/configuration/test_resources/config_smtp_sender_invalid.yml index 255c01bb1..8d2b55a35 100644 --- a/internal/configuration/test_resources/config_smtp_sender_invalid.yml +++ b/internal/configuration/test_resources/config_smtp_sender_invalid.yml @@ -1,126 +1,123 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_with_secret.yml b/internal/configuration/test_resources/config_with_secret.yml index e97d9391c..aa2b3acc9 100644 --- a/internal/configuration/test_resources/config_with_secret.yml +++ b/internal/configuration/test_resources/config_with_secret.yml @@ -1,126 +1,123 @@ --- -jwt_secret: secret_from_config +jwt_secret: 'secret_from_config' -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - host: 127.0.0.1 - port: 9091 + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/validator/authentication.go b/internal/configuration/validator/authentication.go index fb209f179..cf90832bc 100644 --- a/internal/configuration/validator/authentication.go +++ b/internal/configuration/validator/authentication.go @@ -2,7 +2,6 @@ package validator import ( "fmt" - "net/url" "strings" "github.com/go-crypt/crypt/algorithm/argon2" @@ -323,11 +322,7 @@ func validateLDAPAuthenticationBackend(config *schema.AuthenticationBackend, val defaultTLS := validateLDAPAuthenticationBackendImplementation(config, validator) - if config.LDAP.URL == "" { - validator.Push(fmt.Errorf(errFmtLDAPAuthBackendMissingOption, "url")) - } else { - defaultTLS.ServerName = validateLDAPAuthenticationBackendURL(config.LDAP, validator) - } + defaultTLS.ServerName = validateLDAPAuthenticationAddress(config.LDAP, validator) if config.LDAP.TLS == nil { config.LDAP.TLS = &schema.TLSConfig{} @@ -428,27 +423,22 @@ func setDefaultImplementationLDAPAuthenticationBackendProfileAttributes(config * } } -func validateLDAPAuthenticationBackendURL(config *schema.LDAPAuthenticationBackend, validator *schema.StructValidator) (hostname string) { +func validateLDAPAuthenticationAddress(config *schema.LDAPAuthenticationBackend, validator *schema.StructValidator) (hostname string) { + if config.Address == nil { + validator.Push(fmt.Errorf(errFmtLDAPAuthBackendMissingOption, "address")) + + return + } + var ( - parsedURL *url.URL - err error + err error ) - if parsedURL, err = url.Parse(config.URL); err != nil { - validator.Push(fmt.Errorf(errFmtLDAPAuthBackendURLNotParsable, err)) - - return + if err = config.Address.ValidateLDAP(); err != nil { + validator.Push(fmt.Errorf(errFmtLDAPAuthBackendAddress, config.Address.String(), err)) } - if parsedURL.Scheme != schemeLDAP && parsedURL.Scheme != schemeLDAPS { - validator.Push(fmt.Errorf(errFmtLDAPAuthBackendURLInvalidScheme, parsedURL.Scheme)) - - return - } - - config.URL = parsedURL.String() - - return parsedURL.Hostname() + return config.Address.Hostname() } func validateLDAPRequiredParameters(config *schema.AuthenticationBackend, validator *schema.StructValidator) { diff --git a/internal/configuration/validator/authentication_test.go b/internal/configuration/validator/authentication_test.go index 9abec6e1a..a606348ce 100644 --- a/internal/configuration/validator/authentication_test.go +++ b/internal/configuration/validator/authentication_test.go @@ -26,7 +26,7 @@ func TestShouldRaiseErrorWhenBothBackendsProvided(t *testing.T) { require.Len(t, validator.Errors(), 7) assert.EqualError(t, validator.Errors()[0], "authentication_backend: please ensure only one of the 'file' or 'ldap' backend is configured") - assert.EqualError(t, validator.Errors()[1], "authentication_backend: ldap: option 'url' is required") + assert.EqualError(t, validator.Errors()[1], "authentication_backend: ldap: option 'address' is required") assert.EqualError(t, validator.Errors()[2], "authentication_backend: ldap: option 'user' is required") assert.EqualError(t, validator.Errors()[3], "authentication_backend: ldap: option 'password' is required") assert.EqualError(t, validator.Errors()[4], "authentication_backend: ldap: option 'base_dn' is required") @@ -61,8 +61,8 @@ func (suite *FileBasedAuthenticationBackend) SetupTest() { func (suite *FileBasedAuthenticationBackend) TestShouldValidateCompleteConfiguration() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenNoPathProvided() { @@ -70,38 +70,38 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenNoPathProvi ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: option 'path' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: option 'path' is required") } func (suite *FileBasedAuthenticationBackend) TestShouldSetDefaultConfigurationWhenBlank() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal(0, suite.config.File.Password.KeyLength) - suite.Assert().Equal(0, suite.config.File.Password.Iterations) - suite.Assert().Equal(0, suite.config.File.Password.SaltLength) - suite.Assert().Equal("", suite.config.File.Password.Algorithm) - suite.Assert().Equal(0, suite.config.File.Password.Memory) - suite.Assert().Equal(0, suite.config.File.Password.Parallelism) + suite.Equal(0, suite.config.File.Password.KeyLength) + suite.Equal(0, suite.config.File.Password.Iterations) + suite.Equal(0, suite.config.File.Password.SaltLength) + suite.Equal("", suite.config.File.Password.Algorithm) + suite.Equal(0, suite.config.File.Password.Memory) + suite.Equal(0, suite.config.File.Password.Parallelism) ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.DefaultPasswordConfig.KeyLength, suite.config.File.Password.KeyLength) - suite.Assert().Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) - suite.Assert().Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) - suite.Assert().Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) - suite.Assert().Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) - suite.Assert().Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) + suite.Equal(schema.DefaultPasswordConfig.KeyLength, suite.config.File.Password.KeyLength) + suite.Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) + suite.Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) + suite.Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) + suite.Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) + suite.Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationSHA512() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: digestSHA512, @@ -111,18 +111,18 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(8, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(8, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationSHA512ButNotOverride() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: digestSHA512, @@ -137,18 +137,18 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA256, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(50000, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(12, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA256, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(50000, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(12, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationSHA512Alt() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: digestSHA512, @@ -158,18 +158,18 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(16, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(16, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationArgon2() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: "argon2id", @@ -182,21 +182,21 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("argon2", suite.config.File.Password.Algorithm) - suite.Assert().Equal("argon2id", suite.config.File.Password.Argon2.Variant) - suite.Assert().Equal(4, suite.config.File.Password.Argon2.Iterations) - suite.Assert().Equal(1048576, suite.config.File.Password.Argon2.Memory) - suite.Assert().Equal(4, suite.config.File.Password.Argon2.Parallelism) - suite.Assert().Equal(64, suite.config.File.Password.Argon2.KeyLength) - suite.Assert().Equal(64, suite.config.File.Password.Argon2.SaltLength) + suite.Equal("argon2", suite.config.File.Password.Algorithm) + suite.Equal("argon2id", suite.config.File.Password.Argon2.Variant) + suite.Equal(4, suite.config.File.Password.Argon2.Iterations) + suite.Equal(1048576, suite.config.File.Password.Argon2.Memory) + suite.Equal(4, suite.config.File.Password.Argon2.Parallelism) + suite.Equal(64, suite.config.File.Password.Argon2.KeyLength) + suite.Equal(64, suite.config.File.Password.Argon2.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationArgon2ButNotOverride() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: "argon2id", @@ -217,102 +217,102 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("argon2", suite.config.File.Password.Algorithm) - suite.Assert().Equal("argon2d", suite.config.File.Password.Argon2.Variant) - suite.Assert().Equal(1, suite.config.File.Password.Argon2.Iterations) - suite.Assert().Equal(2048, suite.config.File.Password.Argon2.Memory) - suite.Assert().Equal(1, suite.config.File.Password.Argon2.Parallelism) - suite.Assert().Equal(32, suite.config.File.Password.Argon2.KeyLength) - suite.Assert().Equal(32, suite.config.File.Password.Argon2.SaltLength) + suite.Equal("argon2", suite.config.File.Password.Algorithm) + suite.Equal("argon2d", suite.config.File.Password.Argon2.Variant) + suite.Equal(1, suite.config.File.Password.Argon2.Iterations) + suite.Equal(2048, suite.config.File.Password.Argon2.Memory) + suite.Equal(1, suite.config.File.Password.Argon2.Parallelism) + suite.Equal(32, suite.config.File.Password.Argon2.KeyLength) + suite.Equal(32, suite.config.File.Password.Argon2.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationWhenOnlySHA512Set() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = digestSHA512 ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(schema.DefaultPasswordConfig.SHA2Crypt.Iterations, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(schema.DefaultPasswordConfig.SHA2Crypt.SaltLength, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(schema.DefaultPasswordConfig.SHA2Crypt.Iterations, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(schema.DefaultPasswordConfig.SHA2Crypt.SaltLength, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidArgon2Variant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = "argon2" suite.config.File.Password.Argon2.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'variant' must be one of 'argon2id', 'id', 'argon2i', 'i', 'argon2d', or 'd' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'variant' must be one of 'argon2id', 'id', 'argon2i', 'i', 'argon2d', or 'd' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidSHA2CryptVariant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = hashSHA2Crypt suite.config.File.Password.SHA2Crypt.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'variant' must be one of 'sha256' or 'sha512' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'variant' must be one of 'sha256' or 'sha512' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidSHA2CryptSaltLength() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = hashSHA2Crypt suite.config.File.Password.SHA2Crypt.SaltLength = 40 ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '40' but must be less than or equal to '16'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '40' but must be less than or equal to '16'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidPBKDF2Variant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = "pbkdf2" suite.config.File.Password.PBKDF2.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'variant' must be one of 'sha1', 'sha224', 'sha256', 'sha384', or 'sha512' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'variant' must be one of 'sha1', 'sha224', 'sha256', 'sha384', or 'sha512' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidBCryptVariant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = "bcrypt" suite.config.File.Password.BCrypt.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'variant' must be one of 'standard' or 'sha256' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'variant' must be one of 'standard' or 'sha256' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOptionsTooLow() { @@ -321,11 +321,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOp ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1000'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1000'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOptionsTooHigh() { @@ -334,11 +334,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOp ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '999999999999' but must be less than or equal to '999999999'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '99' but must be less than or equal to '16'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '999999999999' but must be less than or equal to '999999999'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '99' but must be less than or equal to '16'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2OptionsTooLow() { @@ -347,11 +347,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '-1' but must be greater than or equal to '100000'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '-1' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '-1' but must be greater than or equal to '100000'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '-1' but must be greater than or equal to '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2OptionsTooHigh() { @@ -360,11 +360,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '2147483649' but must be less than or equal to '2147483647'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '2147483650' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '2147483649' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '2147483650' but must be less than or equal to '2147483647'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptionsTooLow() { @@ -372,10 +372,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '-1' but must be greater than or equal to '10'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '-1' but must be greater than or equal to '10'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptionsTooHigh() { @@ -383,10 +383,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '900' but must be less than or equal to '31'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '900' but must be less than or equal to '31'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptionsTooLow() { @@ -398,14 +398,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '-21' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '-11' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '-77' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '7' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '-21' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '-11' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '-77' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '7' but must be greater than or equal to '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptionsTooHigh() { @@ -417,14 +417,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '59' but must be less than or equal to '58'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '360287970189639672' but must be less than or equal to '36028797018963967'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '1073741825' but must be less than or equal to '1073741823'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '1374389534409' but must be less than or equal to '137438953440'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '2147483647' but must be less than or equal to '1024'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '59' but must be less than or equal to '58'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '360287970189639672' but must be less than or equal to '36028797018963967'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '1073741825' but must be less than or equal to '1073741823'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '1374389534409' but must be less than or equal to '137438953440'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '2147483647' but must be less than or equal to '1024'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2OptionsTooLow() { @@ -436,14 +436,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '-1' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '-1' but must be greater than or equal to '8'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '1' but must be greater than or equal to '4'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '-1' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '1' but must be greater than or equal to '4'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2OptionsTooHigh() { @@ -455,14 +455,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '9999999999' but must be less than or equal to '2147483647'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '16777216' but must be less than or equal to '16777215'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '4294967296' but must be less than or equal to '4294967295'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '9999999998' but must be less than or equal to '2147483647'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '9999999997' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '9999999999' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '16777216' but must be less than or equal to '16777215'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '4294967296' but must be less than or equal to '4294967295'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '9999999998' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '9999999997' but must be less than or equal to '2147483647'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2MemoryTooLow() { @@ -471,10 +471,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Memor ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '4' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '4' but must be greater than or equal to '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2MemoryTooLowMultiplier() { @@ -483,10 +483,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Memor ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '8' but must be greater than or equal to '32' or '4' (the value of 'parallelism) multiplied by '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '8' but must be greater than or equal to '32' or '4' (the value of 'parallelism) multiplied by '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBadAlgorithmDefined() { @@ -494,10 +494,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBadAlgorith ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: option 'algorithm' must be one of 'sha2crypt', 'pbkdf2', 'scrypt', 'bcrypt', or 'argon2' but it's configured as 'bogus'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: option 'algorithm' must be one of 'sha2crypt', 'pbkdf2', 'scrypt', 'bcrypt', or 'argon2' but it's configured as 'bogus'") } func (suite *FileBasedAuthenticationBackend) TestShouldSetDefaultValues() { @@ -509,30 +509,30 @@ func (suite *FileBasedAuthenticationBackend) TestShouldSetDefaultValues() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) - suite.Assert().Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) - suite.Assert().Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) - suite.Assert().Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) - suite.Assert().Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) + suite.Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) + suite.Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) + suite.Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) + suite.Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) + suite.Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenResetURLIsInvalid() { suite.config.PasswordReset.CustomURL = url.URL{Scheme: "ldap", Host: "google.com"} suite.config.PasswordReset.Disable = true - suite.Assert().True(suite.config.PasswordReset.Disable) + suite.True(suite.config.PasswordReset.Disable) ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: password_reset: option 'custom_url' is configured to 'ldap://google.com' which has the scheme 'ldap' but the scheme must be either 'http' or 'https'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: password_reset: option 'custom_url' is configured to 'ldap://google.com' which has the scheme 'ldap' but the scheme must be either 'http' or 'https'") - suite.Assert().True(suite.config.PasswordReset.Disable) + suite.True(suite.config.PasswordReset.Disable) } func (suite *FileBasedAuthenticationBackend) TestShouldNotRaiseErrorWhenResetURLIsValid() { @@ -540,22 +540,22 @@ func (suite *FileBasedAuthenticationBackend) TestShouldNotRaiseErrorWhenResetURL ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *FileBasedAuthenticationBackend) TestShouldConfigureDisableResetPasswordWhenCustomURL() { suite.config.PasswordReset.CustomURL = url.URL{Scheme: "https", Host: "google.com"} suite.config.PasswordReset.Disable = true - suite.Assert().True(suite.config.PasswordReset.Disable) + suite.True(suite.config.PasswordReset.Disable) ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().False(suite.config.PasswordReset.Disable) + suite.False(suite.config.PasswordReset.Disable) } func TestFileBasedAuthenticationBackend(t *testing.T) { @@ -573,7 +573,7 @@ func (suite *LDAPAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationCustom - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -585,8 +585,8 @@ func (suite *LDAPAuthenticationBackendSuite) SetupTest() { func (suite *LDAPAuthenticationBackendSuite) TestShouldValidateCompleteConfiguration() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *LDAPAuthenticationBackendSuite) TestShouldValidateDefaultImplementationAndUsernameAttribute() { @@ -594,11 +594,11 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldValidateDefaultImplementa suite.config.LDAP.UsernameAttribute = "" ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) + suite.Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) - suite.Assert().Equal(suite.config.LDAP.UsernameAttribute, schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.UsernameAttribute) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Equal(suite.config.LDAP.UsernameAttribute, schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.UsernameAttribute) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenImplementationIsInvalidMSAD() { @@ -606,20 +606,20 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenImplementat ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'implementation' must be one of 'custom', 'activedirectory', 'rfc2307bis', 'freeipa', 'lldap', or 'glauth' but it's configured as 'masd'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'implementation' must be one of 'custom', 'activedirectory', 'rfc2307bis', 'freeipa', 'lldap', or 'glauth' but it's configured as 'masd'") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenURLNotProvided() { - suite.config.LDAP.URL = "" + suite.config.LDAP.Address = nil ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'url' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'address' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenUserNotProvided() { @@ -627,10 +627,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenUserNotProv ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'user' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'user' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordNotProvided() { @@ -638,10 +638,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordNot ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'password' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'password' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPasswordNotProvidedWithPermitUnauthenticatedBind() { @@ -650,10 +650,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPassword ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when password reset is enabled") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when password reset is enabled") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordProvidedWithPermitUnauthenticatedBind() { @@ -663,10 +663,39 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordPro ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when a password is specified") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when a password is specified") +} + +func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultPorts() { + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("ldap://abc")} + + ValidateAuthenticationBackend(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal("ldap://abc:389", suite.config.LDAP.Address.String()) + + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("ldaps://abc")} + + ValidateAuthenticationBackend(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal("ldaps://abc:636", suite.config.LDAP.Address.String()) + + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("ldapi:///a/path")} + + ValidateAuthenticationBackend(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal("ldapi:///a/path", suite.config.LDAP.Address.String()) } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPermitUnauthenticatedBindConfiguredCorrectly() { @@ -676,7 +705,7 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPermitUn ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 0) } @@ -685,10 +714,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenBaseDNNotPr ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'base_dn' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'base_dn' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyGroupsFilter() { @@ -696,10 +725,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyGroupsFilter( ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyUsersFilter() { @@ -707,10 +736,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyUsersFilter() ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseOnEmptyUsernameAttribute() { @@ -718,8 +747,8 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseOnEmptyUsernameAt ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnBadRefreshInterval() { @@ -727,19 +756,19 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnBadRefreshInterval ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: option 'refresh_interval' is configured to 'blah' but it must be either a duration notation or one of 'disable', or 'always': could not parse 'blah' as a duration") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: option 'refresh_interval' is configured to 'blah' but it must be either in duration common syntax or one of 'disable', or 'always': could not parse 'blah' as a duration") } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultImplementation() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) + suite.Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorOnBadFilterPlaceholders() { @@ -748,50 +777,50 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorOnBadFilterPlac ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().True(suite.validator.HasErrors()) + suite.Len(suite.validator.Warnings(), 0) + suite.True(suite.validator.HasErrors()) suite.Require().Len(suite.validator.Errors(), 4) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{1}' has been removed, please use '{username}' instead") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{1}' has been removed, please use '{username}' instead") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultGroupNameAttribute() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("cn", suite.config.LDAP.GroupNameAttribute) + suite.Equal("cn", suite.config.LDAP.GroupNameAttribute) } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultMailAttribute() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("mail", suite.config.LDAP.MailAttribute) + suite.Equal("mail", suite.config.LDAP.MailAttribute) } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultDisplayNameAttribute() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("displayName", suite.config.LDAP.DisplayNameAttribute) + suite.Equal("displayName", suite.config.LDAP.DisplayNameAttribute) } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultRefreshInterval() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("5m", suite.config.RefreshInterval) + suite.Equal("5m", suite.config.RefreshInterval) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenUsersFilterDoesNotContainEnclosingParenthesis() { @@ -799,10 +828,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenUsersFilterDoesN ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain enclosing parenthesis: '{username_attribute}={input}' should probably be '({username_attribute}={input})'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain enclosing parenthesis: '{username_attribute}={input}' should probably be '({username_attribute}={input})'") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenGroupsFilterDoesNotContainEnclosingParenthesis() { @@ -810,20 +839,20 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenGroupsFilterDoes ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' must contain enclosing parenthesis: 'cn={input}' should probably be '(cn={input})'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' must contain enclosing parenthesis: 'cn={input}' should probably be '(cn={input})'") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenUsersFilterDoesNotContainUsernameAttribute() { suite.config.LDAP.UsersFilter = "(&({mail_attribute}={input})(objectClass=person))" ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{username_attribute}' but it's absent") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{username_attribute}' but it's absent") } func (suite *LDAPAuthenticationBackendSuite) TestShouldHelpDetectNoInputPlaceholder() { @@ -831,10 +860,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldHelpDetectNoInputPlacehol ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultTLSMinimumVersion() { @@ -842,10 +871,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultTLSMinimumVersi ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.TLS.MinimumVersion.Value, suite.config.LDAP.TLS.MinimumVersion.MinVersion()) + suite.Equal(schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.TLS.MinimumVersion.Value, suite.config.LDAP.TLS.MinimumVersion.MinVersion()) } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowSSL30() { @@ -855,10 +884,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowSSL30() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowTLSVerMinGreaterThanVerMax() { @@ -869,10 +898,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowTLSVerMinGreaterT ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.2") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.2") } func TestLDAPAuthenticationBackend(t *testing.T) { @@ -890,7 +919,7 @@ func (suite *ActiveDirectoryAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationActiveDirectory - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -900,40 +929,40 @@ func (suite *ActiveDirectoryAuthenticationBackendSuite) SetupTest() { func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldSetActiveDirectoryDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -951,51 +980,42 @@ func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldOnlySetDefault ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldRaiseErrorOnInvalidURLWithHTTP() { - suite.config.LDAP.URL = "http://dc1:389" + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("http://dc1:389")} - validateLDAPAuthenticationBackendURL(suite.config.LDAP, suite.validator) + validateLDAPAuthenticationAddress(suite.config.LDAP, suite.validator) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'url' must have either the 'ldap' or 'ldaps' scheme but it's configured as 'http'") -} - -func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldRaiseErrorOnInvalidURLWithBadCharacters() { - suite.config.LDAP.URL = "ldap://dc1:abc" - - validateLDAPAuthenticationBackendURL(suite.config.LDAP, suite.validator) - - suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'url' could not be parsed: parse \"ldap://dc1:abc\": invalid port \":abc\" after host") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'address' with value 'http://dc1:389' is invalid: scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'http'") } func TestActiveDirectoryAuthenticationBackend(t *testing.T) { @@ -1013,7 +1033,7 @@ func (suite *RFC2307bisAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationRFC2307bis - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1023,34 +1043,34 @@ func (suite *RFC2307bisAuthenticationBackendSuite) SetupTest() { func (suite *RFC2307bisAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1068,34 +1088,34 @@ func (suite *RFC2307bisAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNo ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1115,7 +1135,7 @@ func (suite *FreeIPAAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationFreeIPA - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1125,34 +1145,34 @@ func (suite *FreeIPAAuthenticationBackendSuite) SetupTest() { func (suite *FreeIPAAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1170,31 +1190,31 @@ func (suite *FreeIPAAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNotMa ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1214,7 +1234,7 @@ func (suite *LLDAPAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationLLDAP - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1224,34 +1244,34 @@ func (suite *LLDAPAuthenticationBackendSuite) SetupTest() { func (suite *LLDAPAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1269,34 +1289,34 @@ func (suite *LLDAPAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNotManu ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1316,7 +1336,7 @@ func (suite *GLAuthAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationGLAuth - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1326,34 +1346,34 @@ func (suite *GLAuthAuthenticationBackendSuite) SetupTest() { func (suite *GLAuthAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1371,34 +1391,34 @@ func (suite *GLAuthAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNotMan ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } diff --git a/internal/configuration/validator/configuration_test.go b/internal/configuration/validator/configuration_test.go index f40aaea1c..d39de0ff2 100644 --- a/internal/configuration/validator/configuration_test.go +++ b/internal/configuration/validator/configuration_test.go @@ -13,8 +13,7 @@ import ( func newDefaultConfig() schema.Configuration { config := schema.Configuration{} - config.Server.Host = loopback - config.Server.Port = 9090 + config.Server.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues("tcp", loopback, 9090)} config.Log.Level = "info" config.Log.Format = "text" config.JWTSecret = testJWTSecret diff --git a/internal/configuration/validator/const.go b/internal/configuration/validator/const.go index 29922efe7..63be6a4fc 100644 --- a/internal/configuration/validator/const.go +++ b/internal/configuration/validator/const.go @@ -45,8 +45,6 @@ const ( // Scheme constants. const ( - schemeLDAP = "ldap" - schemeLDAPS = "ldaps" schemeHTTP = "http" schemeHTTPS = "https" ) @@ -61,7 +59,10 @@ const ( errFmtNotifierFileSystemFileNameNotConfigured = "notifier: filesystem: option 'filename' is required" errFmtNotifierSMTPNotConfigured = "notifier: smtp: option '%s' is required" errFmtNotifierSMTPTLSConfigInvalid = "notifier: smtp: tls: %w" - errFmtNotifierStartTlsDisabled = "notifier: smtp: option 'disable_starttls' is enabled: " + + errFmtNotifierSMTPAddress = "notifier: smtp: option 'address' with value '%s' is invalid: %w" + errFmtNotifierSMTPAddressLegacyAndModern = "notifier: smtp: option 'host' and 'port' can't be configured at the same time as 'address'" + + errFmtNotifierStartTlsDisabled = "notifier: smtp: option 'disable_starttls' is enabled: " + "opportunistic STARTTLS is explicitly disabled which means all emails will be sent insecurely over plaintext " + "and this setting is only necessary for non-compliant SMTP servers which advertise they support STARTTLS " + "when they actually don't support STARTTLS" @@ -78,7 +79,7 @@ const ( errFmtAuthBackendMultipleConfigured = "authentication_backend: please ensure only one of the 'file' or 'ldap' " + "backend is configured" errFmtAuthBackendRefreshInterval = "authentication_backend: option 'refresh_interval' is configured to '%s' but " + - "it must be either a duration notation or one of 'disable', or 'always': %w" + "it must be either in duration common syntax or one of 'disable', or 'always': %w" errFmtAuthBackendPasswordResetCustomURLScheme = "authentication_backend: password_reset: option 'custom_url' is" + " configured to '%s' which has the scheme '%s' but the scheme must be either 'http' or 'https'" @@ -103,10 +104,7 @@ const ( errSuffixMustBeOneOf errFmtLDAPAuthBackendFilterReplacedPlaceholders = "authentication_backend: ldap: option " + "'%s' has an invalid placeholder: '%s' has been removed, please use '%s' instead" - errFmtLDAPAuthBackendURLNotParsable = "authentication_backend: ldap: option " + - "'url' could not be parsed: %w" - errFmtLDAPAuthBackendURLInvalidScheme = "authentication_backend: ldap: option " + - "'url' must have either the 'ldap' or 'ldaps' scheme but it's configured as '%s'" + errFmtLDAPAuthBackendAddress = "authentication_backend: ldap: option 'address' with value '%s' is invalid: %w" errFmtLDAPAuthBackendFilterEnclosingParenthesis = "authentication_backend: ldap: option " + "'%s' must contain enclosing parenthesis: '%s' should probably be '(%s)'" errFmtLDAPAuthBackendFilterMissingPlaceholder = "authentication_backend: ldap: option " + @@ -123,11 +121,14 @@ const ( // Storage Error constants. const ( - errStrStorage = "storage: configuration for a 'local', 'mysql' or 'postgres' database must be provided" - errStrStorageEncryptionKeyMustBeProvided = "storage: option 'encryption_key' is required" - errStrStorageEncryptionKeyTooShort = "storage: option 'encryption_key' must be 20 characters or longer" - errFmtStorageUserPassMustBeProvided = "storage: %s: option 'username' and 'password' are required" //nolint:gosec - errFmtStorageOptionMustBeProvided = "storage: %s: option '%s' is required" + errStrStorage = "storage: configuration for a 'local', 'mysql' or 'postgres' database must be provided" + errStrStorageEncryptionKeyMustBeProvided = "storage: option 'encryption_key' is required" + errStrStorageEncryptionKeyTooShort = "storage: option 'encryption_key' must be 20 characters or longer" + errFmtStorageUserPassMustBeProvided = "storage: %s: option 'username' and 'password' are required" //nolint:gosec + errFmtStorageOptionMustBeProvided = "storage: %s: option '%s' is required" + errFmtStorageOptionAddressConflictWithHostPort = "storage: %s: option 'host' and 'port' can't be configured at the same time as 'address'" + errFmtStorageFailedToConvertHostPortToAddress = "storage: %s: option 'address' failed to parse options 'host' and 'port' as address: %w" + errFmtStorageTLSConfigInvalid = "storage: %s: tls: %w" errFmtStoragePostgreSQLInvalidSSLMode = "storage: postgres: ssl: option 'mode' must be one of %s but it's configured as '%s'" errFmtStoragePostgreSQLInvalidSSLAndTLSConfig = "storage: postgres: can't define both 'tls' and 'ssl' configuration options" @@ -136,7 +137,7 @@ const ( // Telemetry Error constants. const ( - errFmtTelemetryMetricsScheme = "telemetry: metrics: option 'address' must have a scheme 'tcp://' but it's configured as '%s'" + errFmtTelemetryMetricsAddress = "telemetry: metrics: option 'address' with value '%s' is invalid: %w" ) // OpenID Error constants. @@ -246,7 +247,8 @@ const ( // NTP Error constants. const ( - errFmtNTPVersion = "ntp: option 'version' must be either 3 or 4 but it's configured as '%d'" + errFmtNTPVersion = "ntp: option 'version' must be either 3 or 4 but it's configured as '%d'" + errFmtNTPAddressScheme = "ntp: option 'address' with value '%s' is invalid: %w" ) // Session error constants. @@ -283,12 +285,15 @@ const ( // Server Error constants. const ( - errFmtServerTLSCert = "server: tls: option 'key' must also be accompanied by option 'certificate'" - errFmtServerTLSKey = "server: tls: option 'certificate' must also be accompanied by option 'key'" - errFmtServerTLSCertFileDoesNotExist = "server: tls: file path %s provided in 'certificate' does not exist" - errFmtServerTLSKeyFileDoesNotExist = "server: tls: file path %s provided in 'key' does not exist" - errFmtServerTLSClientAuthCertFileDoesNotExist = "server: tls: client_certificates: certificates: file path %s does not exist" - errFmtServerTLSClientAuthNoAuth = "server: tls: client authentication cannot be configured if no server certificate and key are provided" + errFmtServerTLSCert = "server: tls: option 'key' must also be accompanied by option 'certificate'" + errFmtServerTLSKey = "server: tls: option 'certificate' must also be accompanied by option 'key'" + errFmtServerTLSFileNotExist = "server: tls: option '%s' the file '%s' does not exist" + errFmtServerTLSFileNotExistErr = "server: tls: option '%s' could not determine if the file '%s' exists: %w" + + errFmtServerTLSClientAuthNoAuth = "server: tls: client authentication cannot be configured if no server certificate and key are provided" + + errFmtServerAddressLegacyAndModern = "server: option 'host' and 'port' can't be configured at the same time as 'address'" + errFmtServerAddress = "server: option 'address' with value '%s' is invalid: %w" errFmtServerPathNoForwardSlashes = "server: option 'path' must not contain any forward slashes" errFmtServerPathAlphaNum = "server: option 'path' must only contain alpha numeric characters" diff --git a/internal/configuration/validator/const_test.go b/internal/configuration/validator/const_test.go index 1eea835ba..2ae760b5d 100644 --- a/internal/configuration/validator/const_test.go +++ b/internal/configuration/validator/const_test.go @@ -1,5 +1,9 @@ package validator +import ( + "github.com/authelia/authelia/v4/internal/configuration/schema" +) + // Test constants. const ( testInvalid = "invalid" @@ -14,3 +18,29 @@ const ( const ( exampleDotCom = "example.com" ) + +const ( + local25 = "127.0.0.25" +) + +var ( + testLDAPAddress = MustParseAddressPtr(testLDAPURL) +) + +func MustParseAddressPtr(input string) *schema.Address { + address, err := schema.NewAddress(input) + if err != nil { + panic(err) + } + + return address +} + +func MustParseAddress(input string) schema.Address { + address, err := schema.NewAddress(input) + if err != nil { + panic(err) + } + + return *address +} diff --git a/internal/configuration/validator/notifier.go b/internal/configuration/validator/notifier.go index b3515188f..eaa64508b 100644 --- a/internal/configuration/validator/notifier.go +++ b/internal/configuration/validator/notifier.go @@ -54,18 +54,12 @@ func validateNotifierTemplates(config *schema.NotifierConfiguration, validator * } func validateSMTPNotifier(config *schema.SMTPNotifierConfiguration, validator *schema.StructValidator) { + validateSMTPNotifierAddress(config, validator) + if config.StartupCheckAddress.Address == "" { config.StartupCheckAddress = schema.DefaultSMTPNotifierConfiguration.StartupCheckAddress } - if config.Host == "" { - validator.Push(fmt.Errorf(errFmtNotifierSMTPNotConfigured, "host")) - } - - if config.Port == 0 { - validator.Push(fmt.Errorf(errFmtNotifierSMTPNotConfigured, "port")) - } - if config.Timeout == 0 { config.Timeout = schema.DefaultSMTPNotifierConfiguration.Timeout } @@ -87,11 +81,14 @@ func validateSMTPNotifier(config *schema.SMTPNotifierConfiguration, validator *s } configDefaultTLS := &schema.TLSConfig{ - ServerName: config.Host, MinimumVersion: schema.DefaultSMTPNotifierConfiguration.TLS.MinimumVersion, MaximumVersion: schema.DefaultSMTPNotifierConfiguration.TLS.MaximumVersion, } + if config.Address != nil { + configDefaultTLS.ServerName = config.Address.Hostname() + } + if err := ValidateTLSConfig(config.TLS, configDefaultTLS); err != nil { validator.Push(fmt.Errorf(errFmtNotifierSMTPTLSConfigInvalid, err)) } @@ -100,3 +97,26 @@ func validateSMTPNotifier(config *schema.SMTPNotifierConfiguration, validator *s validator.PushWarning(fmt.Errorf(errFmtNotifierStartTlsDisabled)) } } + +func validateSMTPNotifierAddress(config *schema.SMTPNotifierConfiguration, validator *schema.StructValidator) { + if config.Address == nil { + if config.Host == "" && config.Port == 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtNotifierSMTPNotConfigured, "address")) + } else { + host := config.Host //nolint:staticcheck + port := config.Port //nolint:staticcheck + + config.Address = schema.NewSMTPAddress("", host, port) + } + } else { + if config.Host != "" || config.Port != 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtNotifierSMTPAddressLegacyAndModern)) + } + + var err error + + if err = config.Address.ValidateSMTP(); err != nil { + validator.Push(fmt.Errorf(errFmtNotifierSMTPAddress, config.Address.String(), err)) + } + } +} diff --git a/internal/configuration/validator/notifier_test.go b/internal/configuration/validator/notifier_test.go index 17819993f..e3c764153 100644 --- a/internal/configuration/validator/notifier_test.go +++ b/internal/configuration/validator/notifier_test.go @@ -22,11 +22,10 @@ type NotifierSuite struct { func (suite *NotifierSuite) SetupTest() { suite.validator = schema.NewStructValidator() suite.config.SMTP = &schema.SMTPNotifierConfiguration{ + Address: &schema.AddressSMTP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeSMTP, exampleDotCom, 25)}, Username: "john", Password: "password", Sender: mail.Address{Name: "Authelia", Address: "authelia@example.com"}, - Host: exampleDotCom, - Port: 25, } suite.config.FileSystem = nil } @@ -37,25 +36,25 @@ Common Tests. func (suite *NotifierSuite) TestShouldEnsureAtLeastSMTPOrFilesystemIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) suite.config.SMTP = nil ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], errFmtNotifierNotConfigured) + suite.EqualError(suite.validator.Errors()[0], errFmtNotifierNotConfigured) } func (suite *NotifierSuite) TestShouldEnsureEitherSMTPOrFilesystemIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Errors(), 0) suite.config.FileSystem = &schema.FileSystemNotifierConfiguration{ Filename: "test", @@ -63,12 +62,12 @@ func (suite *NotifierSuite) TestShouldEnsureEitherSMTPOrFilesystemIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], errFmtNotifierMultipleConfigured) + suite.EqualError(suite.validator.Errors()[0], errFmtNotifierMultipleConfigured) } /* @@ -77,57 +76,104 @@ SMTP Tests. func (suite *NotifierSuite) TestSMTPShouldSetTLSDefaults() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) - suite.Assert().Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) - suite.Assert().False(suite.config.SMTP.TLS.SkipVerify) + suite.Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) } -func (suite *NotifierSuite) TestSMTPShouldDefaultStartupCheckAddress() { - suite.Assert().Equal(mail.Address{Name: "", Address: ""}, suite.config.SMTP.StartupCheckAddress) +func (suite *NotifierSuite) TestSMTPShouldSetDefaultsWithLegacyAddress() { + suite.config.SMTP.Address = nil + suite.config.SMTP.Host = "xyz" //nolint:staticcheck + suite.config.SMTP.Port = 123 //nolint:staticcheck ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(mail.Address{Name: "Authelia Test", Address: "test@authelia.com"}, suite.config.SMTP.StartupCheckAddress) + suite.Equal(&schema.AddressSMTP{Address: MustParseAddress("smtp://xyz:123")}, suite.config.SMTP.Address) + suite.Equal("xyz", suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) +} + +func (suite *NotifierSuite) TestSMTPShouldErrorWithAddressAndLegacyAddress() { + suite.config.SMTP.Host = "fgh" //nolint:staticcheck + suite.config.SMTP.Port = 123 //nolint:staticcheck + + ValidateNotifier(&suite.config, suite.validator) + + suite.Equal(&schema.AddressSMTP{Address: MustParseAddress("smtp://example.com:25")}, suite.config.SMTP.Address) + suite.Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) + + suite.Len(suite.validator.Warnings(), 0) + suite.Require().Len(suite.validator.Errors(), 1) + + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: option 'host' and 'port' can't be configured at the same time as 'address'") +} + +func (suite *NotifierSuite) TestSMTPShouldErrorWithInvalidAddressScheme() { + suite.config.SMTP.Address = &schema.AddressSMTP{Address: MustParseAddress("udp://example.com:25")} + + ValidateNotifier(&suite.config, suite.validator) + + suite.Equal(&schema.AddressSMTP{Address: MustParseAddress("udp://example.com:25")}, suite.config.SMTP.Address) + suite.Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) + + suite.Len(suite.validator.Warnings(), 0) + suite.Require().Len(suite.validator.Errors(), 1) + + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: option 'address' with value 'udp://example.com:25' is invalid: scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'udp'") +} + +func (suite *NotifierSuite) TestSMTPShouldDefaultStartupCheckAddress() { + suite.Equal(mail.Address{Name: "", Address: ""}, suite.config.SMTP.StartupCheckAddress) + + ValidateNotifier(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal(mail.Address{Name: "Authelia Test", Address: "test@authelia.com"}, suite.config.SMTP.StartupCheckAddress) } func (suite *NotifierSuite) TestSMTPShouldDefaultTLSServerNameToHost() { - suite.config.SMTP.Host = "google.com" + suite.config.SMTP.Address.SetHostname("google.com") suite.config.SMTP.TLS = &schema.TLSConfig{ MinimumVersion: schema.TLSVersion{Value: tls.VersionTLS11}, } ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("google.com", suite.config.SMTP.TLS.ServerName) - suite.Assert().Equal(uint16(tls.VersionTLS11), suite.config.SMTP.TLS.MinimumVersion.MinVersion()) - suite.Assert().False(suite.config.SMTP.TLS.SkipVerify) + suite.Equal("google.com", suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS11), suite.config.SMTP.TLS.MinimumVersion.MinVersion()) + suite.False(suite.config.SMTP.TLS.SkipVerify) } func (suite *NotifierSuite) TestSMTPShouldErrorOnSSL30() { - suite.config.SMTP.Host = exampleDotCom suite.config.SMTP.TLS = &schema.TLSConfig{ MinimumVersion: schema.TLSVersion{Value: tls.VersionSSL30}, //nolint:staticcheck } ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") } func (suite *NotifierSuite) TestSMTPShouldErrorOnTLSMinVerGreaterThanMaxVer() { - suite.config.SMTP.Host = exampleDotCom suite.config.SMTP.TLS = &schema.TLSConfig{ MinimumVersion: schema.TLSVersion{Value: tls.VersionTLS13}, MaximumVersion: schema.TLSVersion{Value: tls.VersionTLS10}, @@ -135,45 +181,40 @@ func (suite *NotifierSuite) TestSMTPShouldErrorOnTLSMinVerGreaterThanMaxVer() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.0") + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.0") } func (suite *NotifierSuite) TestSMTPShouldWarnOnDisabledSTARTTLS() { - suite.config.SMTP.Host = exampleDotCom suite.config.SMTP.DisableStartTLS = true ValidateNotifier(&suite.config, suite.validator) suite.Require().Len(suite.validator.Warnings(), 1) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().EqualError(suite.validator.Warnings()[0], "notifier: smtp: option 'disable_starttls' is enabled: opportunistic STARTTLS is explicitly disabled which means all emails will be sent insecurely over plaintext and this setting is only necessary for non-compliant SMTP servers which advertise they support STARTTLS when they actually don't support STARTTLS") + suite.EqualError(suite.validator.Warnings()[0], "notifier: smtp: option 'disable_starttls' is enabled: opportunistic STARTTLS is explicitly disabled which means all emails will be sent insecurely over plaintext and this setting is only necessary for non-compliant SMTP servers which advertise they support STARTTLS when they actually don't support STARTTLS") } func (suite *NotifierSuite) TestSMTPShouldEnsureHostAndPortAreProvided() { suite.config.FileSystem = nil ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.config.SMTP.Host = "" - suite.config.SMTP.Port = 0 + suite.config.SMTP.Address = nil ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().True(suite.validator.HasErrors()) - errors := suite.validator.Errors() - suite.Require().Len(errors, 2) + suite.Len(suite.validator.Warnings(), 0) + suite.Require().Len(errors, 1) - suite.Assert().EqualError(errors[0], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "host")) - suite.Assert().EqualError(errors[1], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "port")) + suite.EqualError(errors[0], "notifier: smtp: option 'address' is required") } func (suite *NotifierSuite) TestSMTPShouldEnsureSenderIsProvided() { @@ -181,12 +222,12 @@ func (suite *NotifierSuite) TestSMTPShouldEnsureSenderIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "sender")) + suite.EqualError(suite.validator.Errors()[0], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "sender")) } func (suite *NotifierSuite) TestTemplatesEmptyDir() { @@ -196,8 +237,8 @@ func (suite *NotifierSuite) TestTemplatesEmptyDir() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *NotifierSuite) TestTemplatesEmptyDirNoExist() { @@ -209,8 +250,8 @@ func (suite *NotifierSuite) TestTemplatesEmptyDirNoExist() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 1) assert.EqualError(suite.T(), suite.validator.Errors()[0], fmt.Sprintf("notifier: option 'template_path' refers to location '%s' which does not exist", p)) } @@ -225,19 +266,19 @@ func (suite *NotifierSuite) TestFileShouldEnsureFilenameIsProvided() { } ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) suite.config.FileSystem.Filename = "" ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], errFmtNotifierFileSystemFileNameNotConfigured) + suite.EqualError(suite.validator.Errors()[0], errFmtNotifierFileSystemFileNameNotConfigured) } func TestNotifierSuite(t *testing.T) { diff --git a/internal/configuration/validator/ntp.go b/internal/configuration/validator/ntp.go index d3914c961..42aa1ce61 100644 --- a/internal/configuration/validator/ntp.go +++ b/internal/configuration/validator/ntp.go @@ -8,10 +8,14 @@ import ( // ValidateNTP validates and update NTP configuration. func ValidateNTP(config *schema.Configuration, validator *schema.StructValidator) { - if config.NTP.Address == "" { + if config.NTP.Address == nil { config.NTP.Address = schema.DefaultNTPConfiguration.Address } + if !config.NTP.Address.IsUDP() { + validator.Push(fmt.Errorf(errFmtNTPAddressScheme, config.NTP.Address.String(), fmt.Errorf("scheme must be one of 'udp', 'udp4', or 'udp6' but is configured as '%s'", config.NTP.Address.Scheme()))) + } + if config.NTP.Version == 0 { config.NTP.Version = schema.DefaultNTPConfiguration.Version } else if config.NTP.Version < 3 || config.NTP.Version > 4 { diff --git a/internal/configuration/validator/ntp_test.go b/internal/configuration/validator/ntp_test.go index 0bae5b830..39ffe7907 100644 --- a/internal/configuration/validator/ntp_test.go +++ b/internal/configuration/validator/ntp_test.go @@ -51,3 +51,15 @@ func TestShouldRaiseErrorOnInvalidNTPVersion(t *testing.T) { assert.EqualError(t, validator.Errors()[0], "ntp: option 'version' must be either 3 or 4 but it's configured as '1'") } + +func TestShouldRaiseErrorOnInvalidNTPScheme(t *testing.T) { + validator := schema.NewStructValidator() + config := newDefaultNTPConfig() + config.NTP.Address = &schema.AddressUDP{Address: MustParseAddress("tcp://abc:123")} + + ValidateNTP(&config, validator) + + require.Len(t, validator.Errors(), 1) + + assert.EqualError(t, validator.Errors()[0], "ntp: option 'address' with value 'tcp://abc:123' is invalid: scheme must be one of 'udp', 'udp4', or 'udp6' but is configured as 'tcp'") +} diff --git a/internal/configuration/validator/server.go b/internal/configuration/validator/server.go index c38850634..6b71a00b0 100644 --- a/internal/configuration/validator/server.go +++ b/internal/configuration/validator/server.go @@ -10,18 +10,6 @@ import ( "github.com/authelia/authelia/v4/internal/utils" ) -// validateFileExists checks whether a file exist. -func validateFileExists(path string, validator *schema.StructValidator, errTemplate string) { - exist, err := utils.FileExists(path) - if err != nil { - validator.Push(fmt.Errorf("tls: unable to check if file %s exists: %s", path, err)) - } - - if !exist { - validator.Push(fmt.Errorf(errTemplate, path)) - } -} - // ValidateServerTLS checks a server TLS configuration is correct. func ValidateServerTLS(config *schema.Configuration, validator *schema.StructValidator) { if config.Server.TLS.Key != "" && config.Server.TLS.Certificate == "" { @@ -31,11 +19,11 @@ func ValidateServerTLS(config *schema.Configuration, validator *schema.StructVal } if config.Server.TLS.Key != "" { - validateFileExists(config.Server.TLS.Key, validator, errFmtServerTLSKeyFileDoesNotExist) + validateFileExists(config.Server.TLS.Key, validator, "key") } if config.Server.TLS.Certificate != "" { - validateFileExists(config.Server.TLS.Certificate, validator, errFmtServerTLSCertFileDoesNotExist) + validateFileExists(config.Server.TLS.Certificate, validator, "certificate") } if config.Server.TLS.Key == "" && config.Server.TLS.Certificate == "" && @@ -44,20 +32,13 @@ func ValidateServerTLS(config *schema.Configuration, validator *schema.StructVal } for _, clientCertPath := range config.Server.TLS.ClientCertificates { - validateFileExists(clientCertPath, validator, errFmtServerTLSClientAuthCertFileDoesNotExist) + validateFileExists(clientCertPath, validator, "client_certificates") } } -// ValidateServer checks a server configuration is correct. +// ValidateServer checks the server configuration is correct. func ValidateServer(config *schema.Configuration, validator *schema.StructValidator) { - if config.Server.Host == "" { - config.Server.Host = schema.DefaultServerConfiguration.Host - } - - if config.Server.Port == 0 { - config.Server.Port = schema.DefaultServerConfiguration.Port - } - + ValidateServerAddress(config, validator) ValidateServerTLS(config, validator) switch { @@ -94,6 +75,38 @@ func ValidateServer(config *schema.Configuration, validator *schema.StructValida ValidateServerEndpoints(config, validator) } +// ValidateServerAddress checks the configured server address is correct. +func ValidateServerAddress(config *schema.Configuration, validator *schema.StructValidator) { + if config.Server.Address == nil { + if config.Server.Host == "" && config.Server.Port == 0 { //nolint:staticcheck + config.Server.Address = schema.DefaultServerConfiguration.Address + } else { + host := config.Server.Host //nolint:staticcheck + port := config.Server.Port //nolint:staticcheck + + if host == "" { + host = schema.DefaultServerConfiguration.Address.Hostname() + } + + if port == 0 { + port = schema.DefaultServerConfiguration.Address.Port() + } + + config.Server.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeTCP, host, port)} + } + } else { + if config.Server.Host != "" || config.Server.Port != 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtServerAddressLegacyAndModern)) + } + + var err error + + if err = config.Server.Address.ValidateHTTP(); err != nil { + validator.Push(fmt.Errorf(errFmtServerAddress, config.Server.Address.String(), err)) + } + } +} + // ValidateServerEndpoints configures the default endpoints and checks the configuration of custom endpoints. func ValidateServerEndpoints(config *schema.Configuration, validator *schema.StructValidator) { if config.Server.Endpoints.EnableExpvars { @@ -184,3 +197,13 @@ func validateServerEndpointsAuthzStrategies(name string, strategies []schema.Ser } } } + +// validateFileExists checks whether a file exist. +func validateFileExists(path string, validator *schema.StructValidator, opt string) { + exist, err := utils.FileExists(path) + if err != nil { + validator.Push(fmt.Errorf(errFmtServerTLSFileNotExistErr, opt, path, err)) + } else if !exist { + validator.Push(fmt.Errorf(errFmtServerTLSFileNotExist, opt, path)) + } +} diff --git a/internal/configuration/validator/server_test.go b/internal/configuration/validator/server_test.go index cf330d393..8c0c9d56b 100644 --- a/internal/configuration/validator/server_test.go +++ b/internal/configuration/validator/server_test.go @@ -22,8 +22,9 @@ func TestShouldSetDefaultServerValues(t *testing.T) { assert.Len(t, validator.Errors(), 0) assert.Len(t, validator.Warnings(), 0) - assert.Equal(t, schema.DefaultServerConfiguration.Host, config.Server.Host) - assert.Equal(t, schema.DefaultServerConfiguration.Port, config.Server.Port) + assert.Equal(t, "", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 0, config.Server.Port) //nolint:staticcheck + assert.Equal(t, schema.DefaultServerConfiguration.Address, config.Server.Address) assert.Equal(t, schema.DefaultServerConfiguration.Buffers.Read, config.Server.Buffers.Read) assert.Equal(t, schema.DefaultServerConfiguration.Buffers.Write, config.Server.Buffers.Write) assert.Equal(t, schema.DefaultServerConfiguration.TLS.Key, config.Server.TLS.Key) @@ -34,6 +35,55 @@ func TestShouldSetDefaultServerValues(t *testing.T) { assert.Equal(t, schema.DefaultServerConfiguration.Endpoints.Authz, config.Server.Endpoints.Authz) } +func TestShouldSetDefaultServerValuesWithLegacyAddress(t *testing.T) { + validator := schema.NewStructValidator() + config := &schema.Configuration{ + Server: schema.ServerConfiguration{ + Host: "abc", + Port: 123, + }, + } + + ValidateServer(config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + assert.Equal(t, "abc", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 123, config.Server.Port) //nolint:staticcheck + assert.Equal(t, &schema.AddressTCP{Address: MustParseAddress("tcp://abc:123")}, config.Server.Address) + + config = &schema.Configuration{ + Server: schema.ServerConfiguration{ + Host: "abc", + }, + } + + ValidateServer(config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + assert.Equal(t, "abc", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 0, config.Server.Port) //nolint:staticcheck + assert.Equal(t, &schema.AddressTCP{Address: MustParseAddress("tcp://abc:9091")}, config.Server.Address) + + config = &schema.Configuration{ + Server: schema.ServerConfiguration{ + Port: 123, + }, + } + + ValidateServer(config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + assert.Equal(t, "", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 123, config.Server.Port) //nolint:staticcheck + assert.Equal(t, &schema.AddressTCP{Address: MustParseAddress("tcp://:123")}, config.Server.Address) +} + func TestShouldSetDefaultConfig(t *testing.T) { validator := schema.NewStructValidator() config := &schema.Configuration{} @@ -63,6 +113,62 @@ func TestShouldParsePathCorrectly(t *testing.T) { assert.Equal(t, "/apple", config.Server.Path) } +func TestValidateServerShouldCorrectlyIdentifyValidAddressSchemes(t *testing.T) { + testCases := []struct { + have string + expected string + }{ + {schema.AddressSchemeTCP, ""}, + {schema.AddressSchemeTCP4, ""}, + {schema.AddressSchemeTCP6, ""}, + {schema.AddressSchemeUDP, "server: option 'address' with value 'udp://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp'"}, + {schema.AddressSchemeUDP4, "server: option 'address' with value 'udp4://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp4'"}, + {schema.AddressSchemeUDP6, "server: option 'address' with value 'udp6://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp6'"}, + {schema.AddressSchemeUnix, ""}, + {"http", "server: option 'address' with value 'http://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'http'"}, + } + + have := &schema.Configuration{ + Server: schema.ServerConfiguration{ + Buffers: schema.ServerBuffers{ + Read: -1, + Write: -1, + }, + Timeouts: schema.ServerTimeouts{ + Read: time.Second * -1, + Write: time.Second * -1, + Idle: time.Second * -1, + }, + }, + } + + validator := schema.NewStructValidator() + + for _, tc := range testCases { + t.Run(tc.have, func(t *testing.T) { + validator.Clear() + + switch tc.have { + case schema.AddressSchemeUnix: + have.Server.Address = &schema.AddressTCP{Address: schema.NewAddressUnix("/path/to/authelia.sock")} + default: + have.Server.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(tc.have, "", 9091)} + } + + ValidateServer(have, validator) + + assert.Len(t, validator.Warnings(), 0) + + if tc.expected == "" { + assert.Len(t, validator.Errors(), 0) + } else { + require.Len(t, validator.Errors(), 1) + assert.EqualError(t, validator.Errors()[0], tc.expected) + } + }) + } +} + func TestShouldDefaultOnNegativeValues(t *testing.T) { validator := schema.NewStructValidator() config := &schema.Configuration{ @@ -121,15 +227,43 @@ func TestShouldRaiseOnForwardSlashInPath(t *testing.T) { assert.Error(t, validator.Errors()[0], "server path must not contain any forward slashes") } -func TestShouldValidateAndUpdateHost(t *testing.T) { +func TestShouldValidateAndUpdateAddress(t *testing.T) { validator := schema.NewStructValidator() config := newDefaultConfig() - config.Server.Host = "" + config.Server.Address = nil ValidateServer(&config, validator) require.Len(t, validator.Errors(), 0) - assert.Equal(t, "0.0.0.0", config.Server.Host) + assert.Equal(t, "tcp://:9091", config.Server.Address.String()) +} + +func TestShouldRaiseErrorOnLegacyAndModernValues(t *testing.T) { + validator := schema.NewStructValidator() + config := newDefaultConfig() + config.Server.Host = local25 //nolint:staticcheck + config.Server.Port = 9999 //nolint:staticcheck + + ValidateServer(&config, validator) + + require.Len(t, validator.Errors(), 1) + assert.EqualError(t, validator.Errors()[0], "server: option 'host' and 'port' can't be configured at the same time as 'address'") +} + +func TestShouldValidateAndUpdateAddressWithOldValues(t *testing.T) { + validator := schema.NewStructValidator() + config := newDefaultConfig() + config.Server.Address = nil + config.Server.Host = local25 //nolint:staticcheck + config.Server.Port = 9999 //nolint:staticcheck + + ValidateServer(&config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + require.NotNil(t, config.Server.Address) + assert.Equal(t, "tcp://127.0.0.25:9999", config.Server.Address.String()) } func TestShouldRaiseErrorWhenTLSCertWithoutKeyIsProvided(t *testing.T) { @@ -162,7 +296,7 @@ func TestShouldRaiseErrorWhenTLSCertDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: file path /tmp/unexisting_file provided in 'certificate' does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'certificate' the file '/tmp/unexisting_file' does not exist") } func TestShouldRaiseErrorWhenTLSKeyWithoutCertIsProvided(t *testing.T) { @@ -195,7 +329,7 @@ func TestShouldRaiseErrorWhenTLSKeyDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: file path /tmp/unexisting_file provided in 'key' does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'key' the file '/tmp/unexisting_file' does not exist") } func TestShouldNotRaiseErrorWhenBothTLSCertificateAndKeyAreProvided(t *testing.T) { @@ -239,7 +373,7 @@ func TestShouldRaiseErrorWhenTLSClientCertificateDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: client_certificates: certificates: file path /tmp/unexisting does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'client_certificates' the file '/tmp/unexisting' does not exist") } func TestShouldRaiseErrorWhenTLSClientAuthIsDefinedButNotServerCertificate(t *testing.T) { @@ -265,19 +399,7 @@ func TestShouldNotUpdateConfig(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 0) - assert.Equal(t, 9090, config.Server.Port) - assert.Equal(t, loopback, config.Server.Host) -} - -func TestShouldValidateAndUpdatePort(t *testing.T) { - validator := schema.NewStructValidator() - config := newDefaultConfig() - config.Server.Port = 0 - - ValidateServer(&config, validator) - - require.Len(t, validator.Errors(), 0) - assert.Equal(t, 9091, config.Server.Port) + assert.Equal(t, "tcp://127.0.0.1:9090", config.Server.Address.String()) } func TestServerEndpointsDevelShouldWarn(t *testing.T) { diff --git a/internal/configuration/validator/storage.go b/internal/configuration/validator/storage.go index 035ac62e8..0f6f1dad6 100644 --- a/internal/configuration/validator/storage.go +++ b/internal/configuration/validator/storage.go @@ -31,12 +31,29 @@ func ValidateStorage(config schema.StorageConfiguration, validator *schema.Struc } func validateSQLConfiguration(config *schema.SQLStorageConfiguration, validator *schema.StructValidator, provider string) { - if config.Timeout == 0 { - config.Timeout = schema.DefaultSQLStorageConfiguration.Timeout - } + if config.Address == nil { + if config.Host == "" { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtStorageOptionMustBeProvided, provider, "address")) + } else { + host := config.Host //nolint:staticcheck + port := config.Port //nolint:staticcheck - if config.Host == "" { - validator.Push(fmt.Errorf(errFmtStorageOptionMustBeProvided, provider, "host")) + if address, err := schema.NewAddressFromNetworkValuesDefault(host, port, schema.AddressSchemeTCP, schema.AddressSchemeUnix); err != nil { + validator.Push(fmt.Errorf(errFmtStorageFailedToConvertHostPortToAddress, provider, err)) + } else { + config.Address = &schema.AddressTCP{Address: *address} + } + } + } else { + if config.Host != "" || config.Port != 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtStorageOptionAddressConflictWithHostPort, provider)) + } + + var err error + + if err = config.Address.ValidateSQL(); err != nil { + validator.Push(fmt.Errorf(errFmtServerAddress, config.Address.String(), err)) + } } if config.Username == "" || config.Password == "" { @@ -46,6 +63,10 @@ func validateSQLConfiguration(config *schema.SQLStorageConfiguration, validator if config.Database == "" { validator.Push(fmt.Errorf(errFmtStorageOptionMustBeProvided, provider, "database")) } + + if config.Timeout == 0 { + config.Timeout = schema.DefaultSQLStorageConfiguration.Timeout + } } func validateMySQLConfiguration(config *schema.MySQLStorageConfiguration, validator *schema.StructValidator) { @@ -53,11 +74,14 @@ func validateMySQLConfiguration(config *schema.MySQLStorageConfiguration, valida if config.TLS != nil { configDefaultTLS := &schema.TLSConfig{ - ServerName: config.Host, MinimumVersion: schema.DefaultMySQLStorageConfiguration.TLS.MinimumVersion, MaximumVersion: schema.DefaultMySQLStorageConfiguration.TLS.MaximumVersion, } + if config.Address != nil { + configDefaultTLS.ServerName = config.Address.Hostname() + } + if err := ValidateTLSConfig(config.TLS, configDefaultTLS); err != nil { validator.Push(fmt.Errorf(errFmtStorageTLSConfigInvalid, "mysql", err)) } @@ -76,7 +100,7 @@ func validatePostgreSQLConfiguration(config *schema.PostgreSQLStorageConfigurati validator.Push(fmt.Errorf(errFmtStoragePostgreSQLInvalidSSLAndTLSConfig)) case config.TLS != nil: configDefaultTLS := &schema.TLSConfig{ - ServerName: config.Host, + ServerName: config.Address.Hostname(), MinimumVersion: schema.DefaultPostgreSQLStorageConfiguration.TLS.MinimumVersion, MaximumVersion: schema.DefaultPostgreSQLStorageConfiguration.TLS.MaximumVersion, } diff --git a/internal/configuration/validator/storage_test.go b/internal/configuration/validator/storage_test.go index f69bffab1..1001add41 100644 --- a/internal/configuration/validator/storage_test.go +++ b/internal/configuration/validator/storage_test.go @@ -61,7 +61,7 @@ func (suite *StorageSuite) TestShouldValidateMySQLHostUsernamePasswordAndDatabas ValidateStorage(suite.config, suite.validator) suite.Require().Len(suite.validator.Errors(), 3) - suite.Assert().EqualError(suite.validator.Errors()[0], "storage: mysql: option 'host' is required") + suite.Assert().EqualError(suite.validator.Errors()[0], "storage: mysql: option 'address' is required") suite.Assert().EqualError(suite.validator.Errors()[1], "storage: mysql: option 'username' and 'password' are required") suite.Assert().EqualError(suite.validator.Errors()[2], "storage: mysql: option 'database' is required") @@ -83,7 +83,7 @@ func (suite *StorageSuite) TestShouldValidateMySQLHostUsernamePasswordAndDatabas func (suite *StorageSuite) TestShouldSetDefaultMySQLTLSServerName() { suite.config.MySQL = &schema.MySQLStorageConfiguration{ SQLStorageConfiguration: schema.SQLStorageConfiguration{ - Host: "mysql1", + Address: &schema.AddressTCP{Address: MustParseAddress("tcp://mysql:1234")}, Username: "myuser", Password: "pass", Database: "database", @@ -98,7 +98,8 @@ func (suite *StorageSuite) TestShouldSetDefaultMySQLTLSServerName() { suite.Assert().Len(suite.validator.Warnings(), 0) suite.Assert().Len(suite.validator.Errors(), 0) - suite.Assert().Equal(suite.config.MySQL.Host, suite.config.MySQL.TLS.ServerName) + suite.Assert().Equal(suite.config.MySQL.Address.Hostname(), suite.config.MySQL.TLS.ServerName) + suite.Assert().Equal("mysql", suite.config.MySQL.TLS.ServerName) } func (suite *StorageSuite) TestShouldRaiseErrorOnInvalidMySQLTLSVersion() { @@ -150,7 +151,7 @@ func (suite *StorageSuite) TestShouldValidatePostgreSQLHostUsernamePasswordAndDa ValidateStorage(suite.config, suite.validator) suite.Require().Len(suite.validator.Errors(), 3) - suite.Assert().EqualError(suite.validator.Errors()[0], "storage: postgres: option 'host' is required") + suite.Assert().EqualError(suite.validator.Errors()[0], "storage: postgres: option 'address' is required") suite.Assert().EqualError(suite.validator.Errors()[1], "storage: postgres: option 'username' and 'password' are required") suite.Assert().EqualError(suite.validator.Errors()[2], "storage: postgres: option 'database' is required") @@ -230,7 +231,7 @@ func (suite *StorageSuite) TestShouldSetDefaultPostgreSQLTLSServerName() { suite.Assert().Len(suite.validator.Warnings(), 0) suite.Assert().Len(suite.validator.Errors(), 0) - suite.Assert().Equal(suite.config.PostgreSQL.Host, suite.config.PostgreSQL.TLS.ServerName) + suite.Assert().Equal(suite.config.PostgreSQL.Address.Hostname(), suite.config.PostgreSQL.TLS.ServerName) } func (suite *StorageSuite) TestShouldRaiseErrorOnInvalidPostgreSQLTLSVersion() { diff --git a/internal/configuration/validator/telemetry.go b/internal/configuration/validator/telemetry.go index 8dc592e22..39c49273d 100644 --- a/internal/configuration/validator/telemetry.go +++ b/internal/configuration/validator/telemetry.go @@ -12,15 +12,12 @@ func ValidateTelemetry(config *schema.Configuration, validator *schema.StructVal config.Telemetry.Metrics.Address = schema.DefaultTelemetryConfig.Metrics.Address } - switch config.Telemetry.Metrics.Address.Scheme { - case "tcp": - break - default: - validator.Push(fmt.Errorf(errFmtTelemetryMetricsScheme, config.Telemetry.Metrics.Address.Scheme)) + if err := config.Telemetry.Metrics.Address.ValidateHTTP(); err != nil { + validator.Push(fmt.Errorf(errFmtTelemetryMetricsAddress, config.Telemetry.Metrics.Address.String(), err)) } - if config.Telemetry.Metrics.Address.Port == 0 { - config.Telemetry.Metrics.Address.Port = schema.DefaultTelemetryConfig.Metrics.Address.Port + if config.Telemetry.Metrics.Address.Port() == 0 { + config.Telemetry.Metrics.Address.SetPort(schema.DefaultTelemetryConfig.Metrics.Address.Port()) } if config.Telemetry.Metrics.Buffers.Read <= 0 { diff --git a/internal/configuration/validator/telemetry_test.go b/internal/configuration/validator/telemetry_test.go index 1643a5c40..e75ca5ca1 100644 --- a/internal/configuration/validator/telemetry_test.go +++ b/internal/configuration/validator/telemetry_test.go @@ -2,6 +2,7 @@ package validator import ( "testing" + "time" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" @@ -10,13 +11,13 @@ import ( ) func TestValidateTelemetry(t *testing.T) { - mustParseAddress := func(a string) *schema.Address { - addr, err := schema.NewAddressFromString(a) + mustParseAddress := func(a string) *schema.AddressTCP { + addr, err := schema.NewAddress(a) if err != nil { panic(err) } - return addr + return &schema.AddressTCP{Address: *addr} } testCases := []struct { @@ -35,13 +36,26 @@ func TestValidateTelemetry(t *testing.T) { { "ShouldSetDefaultPort", &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("tcp://0.0.0.0")}}}, - &schema.Configuration{Telemetry: schema.DefaultTelemetryConfig}, + &schema.Configuration{Telemetry: schema.TelemetryConfig{ + Metrics: schema.TelemetryMetricsConfig{ + Address: &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeTCP, "0.0.0.0", schema.DefaultTelemetryConfig.Metrics.Address.Port())}, + Buffers: schema.ServerBuffers{ + Read: 4096, + Write: 4096, + }, + Timeouts: schema.ServerTimeouts{ + Read: time.Second * 6, + Write: time.Second * 6, + Idle: time.Second * 30, + }, + }, + }}, nil, nil, }, { "ShouldSetDefaultPortAlt", - &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("tcp://0.0.0.0:0")}}}, + &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("tcp://:0")}}}, &schema.Configuration{Telemetry: schema.DefaultTelemetryConfig}, nil, nil, @@ -58,7 +72,7 @@ func TestValidateTelemetry(t *testing.T) { &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("udp://0.0.0.0")}}}, &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("udp://0.0.0.0:9959")}}}, nil, - []string{"telemetry: metrics: option 'address' must have a scheme 'tcp://' but it's configured as 'udp'"}, + []string{"telemetry: metrics: option 'address' with value 'udp://0.0.0.0:0' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp'"}, }, } @@ -99,3 +113,47 @@ func TestValidateTelemetry(t *testing.T) { }) } } + +func TestValidateTelemetryShouldCorrectlyIdentifyValidAddressSchemes(t *testing.T) { + testCases := []struct { + have string + expected string + }{ + {schema.AddressSchemeTCP, ""}, + {schema.AddressSchemeTCP4, ""}, + {schema.AddressSchemeTCP6, ""}, + {schema.AddressSchemeUDP, "telemetry: metrics: option 'address' with value 'udp://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp'"}, + {schema.AddressSchemeUDP4, "telemetry: metrics: option 'address' with value 'udp4://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp4'"}, + {schema.AddressSchemeUDP6, "telemetry: metrics: option 'address' with value 'udp6://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp6'"}, + {schema.AddressSchemeUnix, ""}, + {"http", "telemetry: metrics: option 'address' with value 'http://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'http'"}, + } + + have := &schema.Configuration{} + + validator := schema.NewStructValidator() + + for _, tc := range testCases { + t.Run(tc.have, func(t *testing.T) { + validator.Clear() + + switch tc.have { + case schema.AddressSchemeUnix: + have.Telemetry.Metrics.Address = &schema.AddressTCP{Address: schema.NewAddressUnix("/path/to/authelia.sock")} + default: + have.Telemetry.Metrics.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(tc.have, "", 9091)} + } + + ValidateTelemetry(have, validator) + + assert.Len(t, validator.Warnings(), 0) + + if tc.expected == "" { + assert.Len(t, validator.Errors(), 0) + } else { + require.Len(t, validator.Errors(), 1) + assert.EqualError(t, validator.Errors()[0], tc.expected) + } + }) + } +} diff --git a/internal/model/const.go b/internal/model/const.go index 085ef8946..3fc1604f0 100644 --- a/internal/model/const.go +++ b/internal/model/const.go @@ -22,7 +22,7 @@ const ( SecondFactorMethodDuo = "mobile_push" ) -var reSemanticVersion = regexp.MustCompile(`^v?(?P\d+)\.(?P\d+)\.(?P\d+)(\-(?P[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*))?(\+(?P[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*))?$`) +var reSemanticVersion = regexp.MustCompile(`^v?(?P0|[1-9]\d*)\.(?P0|[1-9]\d*)\.(?P0|[1-9]\d*)(?:-(?P(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+(?P[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`) const ( semverRegexpGroupPreRelease = "PreRelease" diff --git a/internal/notification/const.go b/internal/notification/const.go index f244ebef3..55b3a0052 100644 --- a/internal/notification/const.go +++ b/internal/notification/const.go @@ -5,10 +5,6 @@ const ( fileNotifierHeader = "Date: %s\nRecipient: %s\nSubject: %s\n" ) -const ( - smtpPortSUBMISSIONS = 465 -) - const ( posixNewLine = "\n" ) diff --git a/internal/notification/smtp_auth.go b/internal/notification/smtp_auth.go index 5901f9209..2cf34e4c2 100644 --- a/internal/notification/smtp_auth.go +++ b/internal/notification/smtp_auth.go @@ -20,7 +20,7 @@ func NewOpportunisticSMTPAuth(config *schema.SMTPNotifierConfiguration) *Opportu return &OpportunisticSMTPAuth{ username: config.Username, password: config.Password, - host: config.Host, + host: config.Address.Hostname(), } } diff --git a/internal/notification/smtp_notifier.go b/internal/notification/smtp_notifier.go index a7533e67b..41a873933 100644 --- a/internal/notification/smtp_notifier.go +++ b/internal/notification/smtp_notifier.go @@ -28,14 +28,14 @@ func NewSMTPNotifier(config *schema.SMTPNotifierConfiguration, certPool *x509.Ce } opts := []gomail.Option{ - gomail.WithPort(config.Port), + gomail.WithPort(config.Address.Port()), gomail.WithTLSConfig(tlsconfig), gomail.WithHELO(config.Identifier), gomail.WithTimeout(config.Timeout), gomail.WithoutNoop(), } - ssl := config.Port == smtpPortSUBMISSIONS + ssl := config.Address.IsExplicitlySecure() if ssl { opts = append(opts, gomail.WithSSL()) @@ -86,7 +86,7 @@ type SMTPNotifier struct { func (n *SMTPNotifier) StartupCheck() (err error) { var client *gomail.Client - if client, err = gomail.NewClient(n.config.Host, n.opts...); err != nil { + if client, err = gomail.NewClient(n.config.Address.Hostname(), n.opts...); err != nil { return fmt.Errorf("failed to establish client: %w", err) } @@ -139,7 +139,7 @@ func (n *SMTPNotifier) Send(ctx context.Context, recipient mail.Address, subject var client *gomail.Client - if client, err = gomail.NewClient(n.config.Host, n.opts...); err != nil { + if client, err = gomail.NewClient(n.config.Address.Hostname(), n.opts...); err != nil { return fmt.Errorf("notifier: smtp: failed to establish client: %w", err) } diff --git a/internal/ntp/ntp.go b/internal/ntp/ntp.go index fe8ba1964..2d5d55a01 100644 --- a/internal/ntp/ntp.go +++ b/internal/ntp/ntp.go @@ -3,6 +3,7 @@ package ntp import ( "encoding/binary" "errors" + "fmt" "net" "time" @@ -20,19 +21,37 @@ func NewProvider(config *schema.NTPConfiguration) *Provider { // StartupCheck implements the startup check provider interface. func (p *Provider) StartupCheck() (err error) { - conn, err := net.Dial("udp", p.config.Address) - if err != nil { - p.log.Warnf("Could not connect to NTP server to validate the system time is properly synchronized: %+v", err) + var offset time.Duration + + if offset, err = p.GetOffset(); err != nil { + p.log.WithError(err).Warnf("Could not determine the clock offset due to an error") return nil } - defer conn.Close() + if offset > p.config.MaximumDesync { + return errors.New("the system clock is not synchronized accurately enough with the configured NTP server") + } - if err := conn.SetDeadline(time.Now().Add(5 * time.Second)); err != nil { - p.log.Warnf("Could not connect to NTP server to validate the system time is properly synchronized: %+v", err) + return nil +} - return nil +// GetOffset returns the current offset for this provider. +func (p *Provider) GetOffset() (offset time.Duration, err error) { + var conn net.Conn + + if conn, err = net.Dial(p.config.Address.Network(), p.config.Address.NetworkAddress()); err != nil { + return offset, fmt.Errorf("error occurred during dial: %w", err) + } + + defer func() { + if closeErr := conn.Close(); closeErr != nil { + p.log.WithError(err).Error("Error occurred closing connection with NTP sever") + } + }() + + if err = conn.SetDeadline(time.Now().Add(5 * time.Second)); err != nil { + return offset, fmt.Errorf("error occurred setting connection deadline: %w", err) } version := ntpV4 @@ -42,27 +61,19 @@ func (p *Provider) StartupCheck() (err error) { req := &ntpPacket{LeapVersionMode: ntpLeapVersionClientMode(version)} - if err := binary.Write(conn, binary.BigEndian, req); err != nil { - p.log.Warnf("Could not write to the NTP server socket to validate the system time is properly synchronized: %+v", err) - - return nil + if err = binary.Write(conn, binary.BigEndian, req); err != nil { + return offset, fmt.Errorf("error occurred writing ntp packet request to the connection: %w", err) } now := time.Now() resp := &ntpPacket{} - if err := binary.Read(conn, binary.BigEndian, resp); err != nil { - p.log.Warnf("Could not read from the NTP server socket to validate the system time is properly synchronized: %+v", err) - - return nil + if err = binary.Read(conn, binary.BigEndian, resp); err != nil { + return offset, fmt.Errorf("error occurred reading ntp packet response to the connection: %w", err) } ntpTime := ntpPacketToTime(resp) - if result := ntpIsOffsetTooLarge(p.config.MaximumDesync, now, ntpTime); result { - return errors.New("the system clock is not synchronized accurately enough with the configured NTP server") - } - - return nil + return calcOffset(now, ntpTime), nil } diff --git a/internal/ntp/ntp_test.go b/internal/ntp/ntp_test.go index de88edfc3..2f3bf92cb 100644 --- a/internal/ntp/ntp_test.go +++ b/internal/ntp/ntp_test.go @@ -13,7 +13,7 @@ import ( func TestShouldCheckNTPV4(t *testing.T) { config := &schema.Configuration{ NTP: schema.NTPConfiguration{ - Address: "time.cloudflare.com:123", + Address: &schema.AddressUDP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeUDP, "time.cloudflare.com", 123)}, Version: 4, MaximumDesync: time.Second * 3, }, @@ -30,7 +30,7 @@ func TestShouldCheckNTPV4(t *testing.T) { func TestShouldCheckNTPV3(t *testing.T) { config := &schema.Configuration{ NTP: schema.NTPConfiguration{ - Address: "time.cloudflare.com:123", + Address: &schema.AddressUDP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeUDP, "time.cloudflare.com", 123)}, Version: 3, MaximumDesync: time.Second * 3, }, diff --git a/internal/ntp/util.go b/internal/ntp/util.go index 4e590c6d1..67be2faed 100644 --- a/internal/ntp/util.go +++ b/internal/ntp/util.go @@ -38,3 +38,11 @@ func ntpIsOffsetTooLarge(maxOffset time.Duration, first, second time.Time) (tooL return offset > maxOffset } + +func calcOffset(first, second time.Time) time.Duration { + if first.After(second) { + return first.Sub(second) + } + + return second.Sub(first) +} diff --git a/internal/server/server.go b/internal/server/server.go index 1841cfaa7..d1f83c9f7 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -6,7 +6,6 @@ import ( "fmt" "net" "os" - "strconv" "github.com/sirupsen/logrus" "github.com/valyala/fasthttp" @@ -34,12 +33,21 @@ func CreateDefaultServer(config *schema.Configuration, providers middlewares.Pro Logger: logging.LoggerPrintf(logrus.DebugLevel), } - address := net.JoinHostPort(config.Server.Host, strconv.Itoa(config.Server.Port)) - var ( - connectionScheme string + connectionScheme = schemeHTTP ) + switch config.Server.UMask { + case nil: + listener, err = config.Server.Address.Listener() + default: + listener, err = config.Server.Address.ListenerWithUMask(*config.Server.UMask) + } + + if err != nil { + return nil, nil, nil, false, fmt.Errorf("error occurred while attempting to initialize main server listener for address '%s': %w", config.Server.Address.String(), err) + } + if config.Server.TLS.Certificate != "" && config.Server.TLS.Key != "" { isTLS, connectionScheme = true, schemeHTTPS @@ -66,19 +74,11 @@ func CreateDefaultServer(config *schema.Configuration, providers middlewares.Pro server.TLSConfig.ClientAuth = tls.RequireAndVerifyClientCert } - if listener, err = tls.Listen("tcp", address, server.TLSConfig.Clone()); err != nil { - return nil, nil, nil, false, fmt.Errorf("unable to initialize tcp listener: %w", err) - } - } else { - connectionScheme = schemeHTTP - - if listener, err = net.Listen("tcp", address); err != nil { - return nil, nil, nil, false, fmt.Errorf("unable to initialize tcp listener: %w", err) - } + listener = tls.NewListener(listener, server.TLSConfig.Clone()) } - if err = writeHealthCheckEnv(config.Server.DisableHealthcheck, connectionScheme, config.Server.Host, - config.Server.Path, config.Server.Port); err != nil { + if err = writeHealthCheckEnv(config.Server.DisableHealthcheck, connectionScheme, config.Server.Address.Hostname(), + config.Server.Path, config.Server.Address.Port()); err != nil { return nil, nil, nil, false, fmt.Errorf("unable to configure healthcheck: %w", err) } @@ -109,8 +109,15 @@ func CreateMetricsServer(config *schema.Configuration, providers middlewares.Pro Logger: logging.LoggerPrintf(logrus.DebugLevel), } - if listener, err = config.Telemetry.Metrics.Address.Listener(); err != nil { - return nil, nil, nil, false, err + switch config.Telemetry.Metrics.UMask { + case nil: + listener, err = config.Telemetry.Metrics.Address.Listener() + default: + listener, err = config.Telemetry.Metrics.Address.ListenerWithUMask(*config.Telemetry.Metrics.UMask) + } + + if err != nil { + return nil, nil, nil, false, fmt.Errorf("error occurred while attempting to initialize metrics telemetry server listener for address '%s': %w", config.Telemetry.Metrics.Address.String(), err) } return server, listener, []string{"/metrics"}, false, nil diff --git a/internal/server/server_test.go b/internal/server/server_test.go index 18e506a4b..dd5429939 100644 --- a/internal/server/server_test.go +++ b/internal/server/server_test.go @@ -190,6 +190,7 @@ func TestShouldRaiseErrorWhenClientDoesNotSkipVerify(t *testing.T) { tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues("tcp", "0.0.0.0", 9091)}, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -218,6 +219,7 @@ func TestShouldServeOverTLSWhenClientDoesSkipVerify(t *testing.T) { tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -255,6 +257,7 @@ func TestShouldServeOverTLSWhenClientHasProperRootCA(t *testing.T) { tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -306,6 +309,7 @@ func TestShouldRaiseWhenMutualTLSIsConfiguredAndClientIsNotAuthenticated(t *test tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -349,6 +353,7 @@ func TestShouldServeProperlyWhenMutualTLSIsConfiguredAndClientIsAuthenticated(t tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), diff --git a/internal/session/provider_config.go b/internal/session/provider_config.go index 0336a703e..f61842d7a 100644 --- a/internal/session/provider_config.go +++ b/internal/session/provider_config.go @@ -134,7 +134,7 @@ func NewSessionProvider(config schema.SessionConfiguration, certPool *x509.CertP DB: config.Redis.DatabaseIndex, // DB is the fasthttp/session property for the Redis DB Index. PoolSize: config.Redis.MaximumActiveConnections, MinIdleConns: config.Redis.MinimumIdleConnections, - IdleTimeout: 300, + ConnMaxIdleTime: 300, TLSConfig: tlsConfig, KeyPrefix: "authelia-session", }) @@ -152,17 +152,17 @@ func NewSessionProvider(config schema.SessionConfiguration, certPool *x509.CertP } provider, err = redis.New(redis.Config{ - Logger: logging.LoggerCtxPrintf(logrus.TraceLevel), - Network: network, - Addr: addr, - Username: config.Redis.Username, - Password: config.Redis.Password, - DB: config.Redis.DatabaseIndex, // DB is the fasthttp/session property for the Redis DB Index. - PoolSize: config.Redis.MaximumActiveConnections, - MinIdleConns: config.Redis.MinimumIdleConnections, - IdleTimeout: 300, - TLSConfig: tlsConfig, - KeyPrefix: "authelia-session", + Logger: logging.LoggerCtxPrintf(logrus.TraceLevel), + Network: network, + Addr: addr, + Username: config.Redis.Username, + Password: config.Redis.Password, + DB: config.Redis.DatabaseIndex, // DB is the fasthttp/session property for the Redis DB Index. + PoolSize: config.Redis.MaximumActiveConnections, + MinIdleConns: config.Redis.MinimumIdleConnections, + ConnMaxIdleTime: 300, + TLSConfig: tlsConfig, + KeyPrefix: "authelia-session", }) } default: diff --git a/internal/storage/const.go b/internal/storage/const.go index 286d39620..2dec1b5e4 100644 --- a/internal/storage/const.go +++ b/internal/storage/const.go @@ -81,11 +81,6 @@ func (s OAuth2SessionType) Table() string { } } -const ( - sqlNetworkTypeTCP = "tcp" - sqlNetworkTypeUnixSocket = "unix" -) - const ( encryptionNameCheck = "check" ) diff --git a/internal/storage/sql_provider_backend_mysql.go b/internal/storage/sql_provider_backend_mysql.go index 32cc7de16..5ff2e531a 100644 --- a/internal/storage/sql_provider_backend_mysql.go +++ b/internal/storage/sql_provider_backend_mysql.go @@ -2,8 +2,6 @@ package storage import ( "crypto/x509" - "fmt" - "path" "time" "github.com/go-sql-driver/mysql" @@ -35,17 +33,8 @@ func NewMySQLProvider(config *schema.Configuration, caCertPool *x509.CertPool) ( func dsnMySQL(config *schema.MySQLStorageConfiguration, caCertPool *x509.CertPool) (dataSourceName string) { dsnConfig := mysql.NewConfig() - switch { - case path.IsAbs(config.Host): - dsnConfig.Net = sqlNetworkTypeUnixSocket - dsnConfig.Addr = config.Host - case config.Port == 0: - dsnConfig.Net = sqlNetworkTypeTCP - dsnConfig.Addr = fmt.Sprintf("%s:%d", config.Host, 3306) - default: - dsnConfig.Net = sqlNetworkTypeTCP - dsnConfig.Addr = fmt.Sprintf("%s:%d", config.Host, config.Port) - } + dsnConfig.Net = config.Address.Network() + dsnConfig.Addr = config.Address.NetworkAddress() if config.TLS != nil { _ = mysql.RegisterTLSConfig("storage", utils.NewTLSConfig(config.TLS, caCertPool)) @@ -53,13 +42,6 @@ func dsnMySQL(config *schema.MySQLStorageConfiguration, caCertPool *x509.CertPoo dsnConfig.TLSConfig = "storage" } - switch config.Port { - case 0: - dsnConfig.Addr = config.Host - default: - dsnConfig.Addr = fmt.Sprintf("%s:%d", config.Host, config.Port) - } - dsnConfig.DBName = config.Database dsnConfig.User = config.Username dsnConfig.Passwd = config.Password diff --git a/internal/storage/sql_provider_backend_postgres.go b/internal/storage/sql_provider_backend_postgres.go index 252ec3e0e..ef7054951 100644 --- a/internal/storage/sql_provider_backend_postgres.go +++ b/internal/storage/sql_provider_backend_postgres.go @@ -6,7 +6,6 @@ import ( "errors" "fmt" "os" - "path" "github.com/jackc/pgx/v5" "github.com/jackc/pgx/v5/stdlib" @@ -136,8 +135,8 @@ func NewPostgreSQLProvider(config *schema.Configuration, caCertPool *x509.CertPo func dsnPostgreSQL(config *schema.PostgreSQLStorageConfiguration, globalCACertPool *x509.CertPool) (dsn string) { dsnConfig, _ := pgx.ParseConfig("") - dsnConfig.Host = config.Host - dsnConfig.Port = uint16(config.Port) + dsnConfig.Host = config.Address.SocketHostname() + dsnConfig.Port = uint16(config.Address.Port()) dsnConfig.Database = config.Database dsnConfig.User = config.Username dsnConfig.Password = config.Password @@ -147,7 +146,7 @@ func dsnPostgreSQL(config *schema.PostgreSQLStorageConfiguration, globalCACertPo "search_path": config.Schema, } - if dsnConfig.Port == 0 && !path.IsAbs(dsnConfig.Host) { + if dsnConfig.Port == 0 && config.Address.IsUnixDomainSocket() { dsnConfig.Port = 5432 } @@ -190,7 +189,7 @@ func loadPostgreSQLTLSConfig(config *schema.PostgreSQLStorageConfiguration, glob tlsConfig.VerifyPeerCertificate = newPostgreSQLVerifyCAFunc(tlsConfig) case config.SSL.Mode == "verify-full": tlsConfig.InsecureSkipVerify = false - tlsConfig.ServerName = config.Host + tlsConfig.ServerName = config.Address.Hostname() } } diff --git a/internal/suites/ActiveDirectory/configuration.yml b/internal/suites/ActiveDirectory/configuration.yml index 88c297b54..a16d41a22 100644 --- a/internal/suites/ActiveDirectory/configuration.yml +++ b/internal/suites/ActiveDirectory/configuration.yml @@ -8,7 +8,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -18,8 +18,8 @@ log: authentication_backend: ldap: + address: 'ldap://sambaldap' implementation: activedirectory - url: ldap://sambaldap tls: skip_verify: true start_tls: true @@ -65,8 +65,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/BypassAll/configuration.yml b/internal/suites/BypassAll/configuration.yml index e5906d1dd..7802b6493 100644 --- a/internal/suites/BypassAll/configuration.yml +++ b/internal/suites/BypassAll/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -48,8 +48,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/CLI/configuration.yml b/internal/suites/CLI/configuration.yml index 9c4b95d50..e27f5a1d1 100644 --- a/internal/suites/CLI/configuration.yml +++ b/internal/suites/CLI/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Caddy/configuration.yml b/internal/suites/Caddy/configuration.yml index b57c30d69..a1b55633d 100644 --- a/internal/suites/Caddy/configuration.yml +++ b/internal/suites/Caddy/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - port: 9091 - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -52,8 +52,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Docker/configuration.yml b/internal/suites/Docker/configuration.yml index 776790973..70692bb00 100644 --- a/internal/suites/Docker/configuration.yml +++ b/internal/suites/Docker/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -85,8 +85,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/DuoPush/configuration.yml b/internal/suites/DuoPush/configuration.yml index 59565ac2b..3235ce73c 100644 --- a/internal/suites/DuoPush/configuration.yml +++ b/internal/suites/DuoPush/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Envoy/configuration.yml b/internal/suites/Envoy/configuration.yml index f04cd8b5d..4ec2d94fd 100644 --- a/internal/suites/Envoy/configuration.yml +++ b/internal/suites/Envoy/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - port: 9091 - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -55,8 +55,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/HAProxy/configuration.yml b/internal/suites/HAProxy/configuration.yml index e9685844a..2a0c29bbb 100644 --- a/internal/suites/HAProxy/configuration.yml +++ b/internal/suites/HAProxy/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -46,8 +46,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/HighAvailability/configuration.yml b/internal/suites/HighAvailability/configuration.yml index 8794cbd35..8aece0597 100644 --- a/internal/suites/HighAvailability/configuration.yml +++ b/internal/suites/HighAvailability/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -19,7 +19,7 @@ totp: authentication_backend: ldap: - url: ldap://openldap + address: 'ldap://openldap' base_dn: dc=example,dc=com username_attribute: uid additional_users_dn: ou=users @@ -114,16 +114,14 @@ regulation: storage: encryption_key: a_not_so_secure_encryption_key mysql: - host: mariadb - port: 3306 + address: 'tcp://mariadb:3306' database: authelia username: admin password: password notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/LDAP/configuration.yml b/internal/suites/LDAP/configuration.yml index d9c2ad7ee..1847f411e 100644 --- a/internal/suites/LDAP/configuration.yml +++ b/internal/suites/LDAP/configuration.yml @@ -8,7 +8,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -18,7 +18,7 @@ log: authentication_backend: ldap: - url: ldaps://openldap + address: 'ldaps://openldap' tls: skip_verify: true base_dn: dc=example,dc=com @@ -69,8 +69,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/MariaDB/configuration.yml b/internal/suites/MariaDB/configuration.yml index cd46fe740..3b7fb220f 100644 --- a/internal/suites/MariaDB/configuration.yml +++ b/internal/suites/MariaDB/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -32,8 +32,7 @@ session: storage: encryption_key: a_not_so_secure_encryption_key mysql: - host: mariadb - port: 3306 + address: 'tcp://mariadb:3306' database: authelia username: admin password: password @@ -71,8 +70,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/MultiCookieDomain/configuration.yml b/internal/suites/MultiCookieDomain/configuration.yml index d19f591f9..c4dd3fa1b 100644 --- a/internal/suites/MultiCookieDomain/configuration.yml +++ b/internal/suites/MultiCookieDomain/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret theme: auto server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -15,7 +15,7 @@ server: telemetry: metrics: enabled: true - address: tcp://0.0.0.0:9959 + address: 'tcp://:9959' log: level: debug @@ -187,13 +187,12 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ntp: ## NTP server address - address: "time.cloudflare.com:123" + address: 'udp://time.cloudflare.com:123' ## ntp version version: 4 ## "maximum desynchronization" is the allowed offset time between the host and the ntp server diff --git a/internal/suites/MySQL/configuration.yml b/internal/suites/MySQL/configuration.yml index 18a998436..2427b915e 100644 --- a/internal/suites/MySQL/configuration.yml +++ b/internal/suites/MySQL/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -33,11 +33,10 @@ session: storage: encryption_key: a_not_so_secure_encryption_key mysql: - host: mysql - port: 3306 - database: authelia - username: admin - password: password + address: 'tcp://mysql:3306' + database: 'authelia' + username: 'admin' + password: 'password' # TOTP Issuer Name # @@ -72,8 +71,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/NetworkACL/configuration.yml b/internal/suites/NetworkACL/configuration.yml index 3c29c965e..309d1ba4a 100644 --- a/internal/suites/NetworkACL/configuration.yml +++ b/internal/suites/NetworkACL/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -70,8 +70,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/OIDC/configuration.yml b/internal/suites/OIDC/configuration.yml index 14ebd61b4..e2c640839 100644 --- a/internal/suites/OIDC/configuration.yml +++ b/internal/suites/OIDC/configuration.yml @@ -1,6 +1,6 @@ --- server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -55,8 +55,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true diff --git a/internal/suites/OIDCTraefik/configuration.yml b/internal/suites/OIDCTraefik/configuration.yml index f5e936cca..be074e1f6 100644 --- a/internal/suites/OIDCTraefik/configuration.yml +++ b/internal/suites/OIDCTraefik/configuration.yml @@ -1,6 +1,6 @@ --- server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -56,8 +56,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true diff --git a/internal/suites/OneFactorOnly/configuration.yml b/internal/suites/OneFactorOnly/configuration.yml index 4e54656cd..21f6cc5f0 100644 --- a/internal/suites/OneFactorOnly/configuration.yml +++ b/internal/suites/OneFactorOnly/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/PathPrefix/configuration.yml b/internal/suites/PathPrefix/configuration.yml index 95c5861ed..441b88b20 100644 --- a/internal/suites/PathPrefix/configuration.yml +++ b/internal/suites/PathPrefix/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - port: 9091 - path: auth + address: 'tcp://:9091' + path: 'auth' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -47,8 +47,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Postgres/configuration.yml b/internal/suites/Postgres/configuration.yml index 2276a4763..d4c60290d 100644 --- a/internal/suites/Postgres/configuration.yml +++ b/internal/suites/Postgres/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -32,11 +32,10 @@ session: storage: encryption_key: a_not_so_secure_encryption_key postgres: - host: postgres - port: 5432 - database: authelia - username: admin - password: password + address: 'tcp://postgres:5432' + database: 'authelia' + username: 'admin' + password: 'password' # TOTP Issuer Name # @@ -71,8 +70,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/ShortTimeouts/configuration.yml b/internal/suites/ShortTimeouts/configuration.yml index 3a3cb945c..e330dca6c 100644 --- a/internal/suites/ShortTimeouts/configuration.yml +++ b/internal/suites/ShortTimeouts/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -77,8 +77,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Standalone/configuration.yml b/internal/suites/Standalone/configuration.yml index 19fba7a36..255afeeae 100644 --- a/internal/suites/Standalone/configuration.yml +++ b/internal/suites/Standalone/configuration.yml @@ -6,7 +6,7 @@ theme: auto server: - port: 9091 + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -94,8 +94,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ntp: diff --git a/internal/suites/Traefik/configuration.yml b/internal/suites/Traefik/configuration.yml index e4cb5c403..2276926be 100644 --- a/internal/suites/Traefik/configuration.yml +++ b/internal/suites/Traefik/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - port: 9091 - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -47,8 +47,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Traefik2/configuration.yml b/internal/suites/Traefik2/configuration.yml index cf45b4ca6..a77c46b13 100644 --- a/internal/suites/Traefik2/configuration.yml +++ b/internal/suites/Traefik2/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - port: 9091 - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -61,8 +61,7 @@ ntp: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/example/compose/authelia/Dockerfile.backend b/internal/suites/example/compose/authelia/Dockerfile.backend index ff3e4c755..26ce59b3a 100644 --- a/internal/suites/example/compose/authelia/Dockerfile.backend +++ b/internal/suites/example/compose/authelia/Dockerfile.backend @@ -1,4 +1,4 @@ -FROM golang:1.20.3-alpine +FROM golang:1.20.4-alpine ARG USER_ID ARG GROUP_ID diff --git a/internal/suites/example/compose/envoy/envoy.yaml b/internal/suites/example/compose/envoy/envoy.yaml index 2e7248e7f..2c4935e42 100644 --- a/internal/suites/example/compose/envoy/envoy.yaml +++ b/internal/suites/example/compose/envoy/envoy.yaml @@ -7,240 +7,240 @@ admin: port_value: 9901 static_resources: listeners: - - name: listener_0 + - name: 'listener_0' address: socket_address: - address: 0.0.0.0 + address: '0.0.0.0' port_value: 8080 filter_chains: - filters: - - name: envoy.filters.network.http_connection_manager + - name: 'envoy.filters.network.http_connection_manager' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager # yamllint disable-line rule:line-length - stat_prefix: ingress_http + "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager' # yamllint disable-line rule:line-length + stat_prefix: 'ingress_http' use_remote_address: true skip_xff_append: false access_log: - - name: envoy.access_loggers.stdout + - name: 'envoy.access_loggers.stdout' typed_config: - "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog + "@type": 'type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog' route_config: - name: local_route + name: 'local_route' virtual_hosts: - - name: login_service - domains: ["login.example.com:8080"] + - name: 'login_service' + domains: ['login.example.com:8080'] typed_per_filter_config: envoy.filters.http.ext_authz: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' disabled: true routes: - match: - prefix: "/.well-known/" + prefix: '/.well-known/' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - prefix: "/api/" + prefix: '/api/' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - prefix: "/locales/" + prefix: '/locales/' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - path: "/devworkflow" + path: '/devworkflow' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - path: "/jwks.json" + path: '/jwks.json' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - prefix: "/" + prefix: '/' route: - cluster: authelia-frontend - - name: mail_service - domains: ["mail.example.com:8080"] + cluster: 'authelia-frontend' + - name: 'mail_service' + domains: ['mail.example.com:8080'] typed_per_filter_config: envoy.filters.http.ext_authz: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' disabled: true routes: - match: - prefix: "/" + prefix: '/' route: - cluster: smtp - - name: http_service - domains: ["*.example.com:8080"] + cluster: 'smtp' + - name: 'http_service' + domains: ['*.example.com:8080'] routes: - match: - prefix: "/headers" + prefix: '/headers' route: - cluster: httpbin + cluster: 'httpbin' - match: - prefix: "/" + prefix: '/' route: - cluster: nginx-backend + cluster: 'nginx-backend' http_filters: - - name: envoy.filters.http.ext_authz + - name: 'envoy.filters.http.ext_authz' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz - transport_api_version: v3 + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz' + transport_api_version: 'v3' allowed_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - exact: accept - - exact: cookie + - exact: 'authorization' + - exact: 'proxy-authorization' + - exact: 'accept' + - exact: 'cookie' http_service: - path_prefix: /api/authz/ext-authz/ + path_prefix: '/api/authz/ext-authz/' server_uri: - uri: authelia-backend:9091 - cluster: authelia-backend - timeout: 0.25s + uri: 'authelia-backend:9091' + cluster: 'authelia-backend' + timeout: '0.25s' authorization_request: headers_to_add: - - key: X-Forwarded-Proto + - key: 'X-Forwarded-Proto' value: '%REQ(:SCHEME)%' authorization_response: allowed_upstream_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - prefix: remote- - - prefix: authelia- + - exact: 'authorization' + - exact: 'proxy-authorization' + - prefix: 'remote-' + - prefix: 'authelia-' allowed_client_headers: patterns: - - exact: set-cookie + - exact: 'set-cookie' allowed_client_headers_on_success: patterns: - - exact: set-cookie + - exact: 'set-cookie' failure_mode_allow: false - - name: envoy.filters.http.router + - name: 'envoy.filters.http.router' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router' transport_socket: - name: envoy.transport_sockets.tls + name: 'envoy.transport_sockets.tls' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext' common_tls_context: tls_certificates: - certificate_chain: - filename: /pki/public.chain.pem + filename: '/pki/public.chain.pem' private_key: - filename: /pki/private.pem + filename: '/pki/private.pem' clusters: - - name: authelia-frontend + - name: 'authelia-frontend' transport_socket_matches: - - name: "enableTLS" + - name: 'enableTLS' match: enableTLS: true transport_socket: - name: envoy.transport_sockets.tls + name: 'envoy.transport_sockets.tls' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext' common_tls_context: {} - - name: "defaultTLSDisabled" + - name: 'defaultTLSDisabled' match: {} transport_socket: - name: envoy.transport_sockets.raw_buffer + name: 'envoy.transport_sockets.raw_buffer' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer - connect_timeout: 0.25s - type: strict_dns - dns_lookup_family: V4_ONLY - lb_policy: round_robin + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer' + connect_timeout: '0.25s' + type: 'strict_dns' + dns_lookup_family: 'V4_ONLY' + lb_policy: 'round_robin' load_assignment: - cluster_name: authelia-frontend + cluster_name: 'authelia-frontend' endpoints: - locality: - region: dev + region: 'dev' priority: 0 lb_endpoints: - endpoint: health_check_config: - hostname: authelia-frontend + hostname: 'authelia-frontend' port_value: 3000 address: socket_address: - address: authelia-frontend + address: 'authelia-frontend' port_value: 3000 - locality: - region: ci + region: 'ci' priority: 1 lb_endpoints: - endpoint: address: socket_address: - address: authelia-backend + address: 'authelia-backend' port_value: 9091 metadata: filter_metadata: envoy.transport_socket_match: enableTLS: true - - name: authelia-backend - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'authelia-backend' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: authelia-backend + cluster_name: 'authelia-backend' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: authelia-backend + address: 'authelia-backend' port_value: 9091 transport_socket: - name: envoy.transport_sockets.tls + name: 'envoy.transport_sockets.tls' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext' common_tls_context: {} - - name: smtp - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'smtp' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: smtp + cluster_name: 'smtp' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: smtp + address: 'smtp' port_value: 1080 - - name: httpbin - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'httpbin' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: httpbin + cluster_name: 'httpbin' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: httpbin + address: 'httpbin' port_value: 8000 - - name: nginx-backend - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'nginx-backend' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: nginx-backend + cluster_name: 'nginx-backend' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: nginx-backend + address: 'nginx-backend' port_value: 80 layered_runtime: layers: - - name: static_layer_0 + - name: 'static_layer_0' static_layer: envoy: resource_limits: diff --git a/internal/suites/example/compose/haproxy/Dockerfile b/internal/suites/example/compose/haproxy/Dockerfile index a1f45a912..4b54f37ef 100644 --- a/internal/suites/example/compose/haproxy/Dockerfile +++ b/internal/suites/example/compose/haproxy/Dockerfile @@ -1,4 +1,4 @@ -FROM haproxy:2.7.7-alpine +FROM haproxy:2.7.8-alpine USER root RUN \ diff --git a/internal/suites/example/compose/redis-sentinel/docker-compose.yml b/internal/suites/example/compose/redis-sentinel/docker-compose.yml index 594753ddb..beb075492 100644 --- a/internal/suites/example/compose/redis-sentinel/docker-compose.yml +++ b/internal/suites/example/compose/redis-sentinel/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: redis-node-0: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh master expose: - "6379" @@ -16,7 +16,7 @@ services: - redis-node-0.example.com ipv4_address: 192.168.240.110 redis-node-1: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh slave depends_on: - redis-node-0 @@ -32,7 +32,7 @@ services: - redis-node-1.example.com ipv4_address: 192.168.240.111 redis-node-2: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh slave depends_on: - redis-node-0 @@ -48,7 +48,7 @@ services: - redis-node-2.example.com ipv4_address: 192.168.240.112 redis-sentinel-0: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh sentinel depends_on: - redis-node-1 @@ -64,7 +64,7 @@ services: - redis-sentinel-0.example.com ipv4_address: 192.168.240.120 redis-sentinel-1: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh sentinel depends_on: - redis-node-1 @@ -80,7 +80,7 @@ services: - redis-sentinel-1.example.com ipv4_address: 192.168.240.121 redis-sentinel-2: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh sentinel depends_on: - redis-node-1 diff --git a/internal/suites/example/compose/redis/docker-compose.yml b/internal/suites/example/compose/redis/docker-compose.yml index 68f0e869b..26659d778 100644 --- a/internal/suites/example/compose/redis/docker-compose.yml +++ b/internal/suites/example/compose/redis/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: redis: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh master expose: - "6379" diff --git a/internal/suites/example/kube/authelia/configs/configuration.yml b/internal/suites/example/kube/authelia/configs/configuration.yml index 8b8dc8180..edb8e04d7 100644 --- a/internal/suites/example/kube/authelia/configs/configuration.yml +++ b/internal/suites/example/kube/authelia/configs/configuration.yml @@ -6,7 +6,7 @@ default_redirection_url: https://home.example.com:8080 server: - port: 443 + address: 'tcp://:443' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -16,7 +16,7 @@ log: authentication_backend: ldap: - url: ldaps://ldap-service + address: 'ldaps://ldap-service' tls: skip_verify: true base_dn: dc=example,dc=com @@ -102,15 +102,13 @@ regulation: storage: mysql: - host: mariadb-service - port: 3306 + address: 'tcp://mariadb-service:3306' database: authelia username: admin notifier: smtp: - host: "mailcatcher-service" - port: 1025 - sender: admin@example.com + address: 'smtp://mailcatcher-service:1025' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/suites/example/kube/storage/redis.yml b/internal/suites/example/kube/storage/redis.yml index 15c9b007f..8aeff3056 100644 --- a/internal/suites/example/kube/storage/redis.yml +++ b/internal/suites/example/kube/storage/redis.yml @@ -18,7 +18,7 @@ spec: spec: containers: - name: redis - image: redis:6.2-alpine + image: redis:7.0-alpine ports: - containerPort: 6379 readinessProbe: diff --git a/internal/utils/time.go b/internal/utils/time.go index c044f899a..19884784a 100644 --- a/internal/utils/time.go +++ b/internal/utils/time.go @@ -13,6 +13,8 @@ func StandardizeDurationString(input string) (output string, err error) { return "0s", nil } + input = strings.ReplaceAll(input, "and", "") + matches := reDurationStandard.FindAllStringSubmatch(strings.ReplaceAll(input, " ", ""), -1) if len(matches) == 0 { diff --git a/internal/utils/time_test.go b/internal/utils/time_test.go index 39b011fa6..d1e1b6681 100644 --- a/internal/utils/time_test.go +++ b/internal/utils/time_test.go @@ -109,6 +109,23 @@ func TestParseDurationString(t *testing.T) { } } +func TestStandardizeDurationString(t *testing.T) { + var ( + actual string + err error + ) + + actual, err = StandardizeDurationString("1 hour and 20 minutes") + + assert.NoError(t, err) + assert.Equal(t, "1h20m", actual) + + actual, err = StandardizeDurationString("1 hour and 20 minutes") + + assert.NoError(t, err) + assert.Equal(t, "1h20m", actual) +} + func TestParseDurationString_ShouldNotParseDurationStringWithOutOfOrderQuantitiesAndUnits(t *testing.T) { duration, err := ParseDurationString("h1") diff --git a/web/package.json b/web/package.json index fc2ff810e..e7133e5e3 100644 --- a/web/package.json +++ b/web/package.json @@ -11,16 +11,16 @@ } }, "dependencies": { - "@emotion/cache": "11.10.8", - "@emotion/react": "11.10.8", - "@emotion/styled": "11.10.8", + "@emotion/cache": "11.11.0", + "@emotion/react": "11.11.0", + "@emotion/styled": "11.11.0", "@fortawesome/fontawesome-svg-core": "6.4.0", "@fortawesome/free-regular-svg-icons": "6.4.0", "@fortawesome/free-solid-svg-icons": "6.4.0", "@fortawesome/react-fontawesome": "0.2.0", "@mui/icons-material": "5.11.16", - "@mui/material": "5.12.2", - "@mui/styles": "5.12.0", + "@mui/material": "5.12.3", + "@mui/styles": "5.12.3", "axios": "1.4.0", "broadcast-channel": "5.1.0", "classnames": "2.3.2", @@ -32,7 +32,7 @@ "react-dom": "18.2.0", "react-i18next": "12.2.2", "react-loading": "2.0.3", - "react-router-dom": "6.11.0", + "react-router-dom": "6.11.1", "react18-input-otp": "1.1.3", "zxcvbn": "4.4.2" }, @@ -66,23 +66,22 @@ ] }, "devDependencies": { - "@commitlint/cli": "17.6.1", - "@commitlint/config-conventional": "17.6.1", + "@commitlint/cli": "17.6.3", + "@commitlint/config-conventional": "17.6.3", "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "18.16.3", - "@types/qrcode.react": "1.0.2", - "@types/react": "18.2.0", - "@types/react-dom": "18.2.1", + "@types/node": "20.1.0", + "@types/react": "18.2.6", + "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", "@types/zxcvbn": "4.4.1", - "@typescript-eslint/eslint-plugin": "5.59.1", - "@typescript-eslint/parser": "5.59.1", + "@typescript-eslint/eslint-plugin": "5.59.2", + "@typescript-eslint/parser": "5.59.2", "@vitejs/plugin-react": "4.0.0", - "@vitest/coverage-istanbul": "0.30.1", + "@vitest/coverage-istanbul": "0.31.0", "esbuild": "0.17.18", - "eslint": "8.39.0", + "eslint": "8.40.0", "eslint-config-prettier": "8.8.0", "eslint-config-react-app": "7.0.1", "eslint-formatter-rdjson": "1.0.5", @@ -92,17 +91,17 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.10.1", + "happy-dom": "9.10.9", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", "typescript": "5.0.4", - "vite": "4.3.3", + "vite": "4.3.5", "vite-plugin-eslint": "1.8.1", "vite-plugin-istanbul": "4.0.1", - "vite-plugin-svgr": "2.4.0", + "vite-plugin-svgr": "3.2.0", "vite-tsconfig-paths": "4.2.0", - "vitest": "0.30.1", + "vitest": "0.31.0", "vitest-preview": "0.0.1" } } diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 7a038c226..c43e90f34 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -2,14 +2,14 @@ lockfileVersion: '6.0' dependencies: '@emotion/cache': - specifier: 11.10.8 - version: 11.10.8 + specifier: 11.11.0 + version: 11.11.0 '@emotion/react': - specifier: 11.10.8 - version: 11.10.8(@types/react@18.2.0)(react@18.2.0) + specifier: 11.11.0 + version: 11.11.0(@types/react@18.2.6)(react@18.2.0) '@emotion/styled': - specifier: 11.10.8 - version: 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.0)(react@18.2.0) + specifier: 11.11.0 + version: 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) '@fortawesome/fontawesome-svg-core': specifier: 6.4.0 version: 6.4.0 @@ -24,13 +24,13 @@ dependencies: version: 0.2.0(@fortawesome/fontawesome-svg-core@6.4.0)(react@18.2.0) '@mui/icons-material': specifier: 5.11.16 - version: 5.11.16(@mui/material@5.12.2)(@types/react@18.2.0)(react@18.2.0) + version: 5.11.16(@mui/material@5.12.3)(@types/react@18.2.6)(react@18.2.0) '@mui/material': - specifier: 5.12.2 - version: 5.12.2(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.0)(react-dom@18.2.0)(react@18.2.0) + specifier: 5.12.3 + version: 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/styles': - specifier: 5.12.0 - version: 5.12.0(@types/react@18.2.0)(react@18.2.0) + specifier: 5.12.3 + version: 5.12.3(@types/react@18.2.6)(react@18.2.0) axios: specifier: 1.4.0 version: 1.4.0 @@ -65,8 +65,8 @@ dependencies: specifier: 2.0.3 version: 2.0.3(prop-types@15.8.1)(react@18.2.0) react-router-dom: - specifier: 6.11.0 - version: 6.11.0(react-dom@18.2.0)(react@18.2.0) + specifier: 6.11.1 + version: 6.11.1(react-dom@18.2.0)(react@18.2.0) react18-input-otp: specifier: 1.1.3 version: 1.1.3(react-dom@18.2.0)(react@18.2.0) @@ -76,14 +76,14 @@ dependencies: devDependencies: '@commitlint/cli': - specifier: 17.6.1 - version: 17.6.1 + specifier: 17.6.3 + version: 17.6.3 '@commitlint/config-conventional': - specifier: 17.6.1 - version: 17.6.1 + specifier: 17.6.3 + version: 17.6.3 '@limegrass/eslint-plugin-import-alias': specifier: 1.0.6 - version: 1.0.6(eslint@8.39.0) + version: 1.0.6(eslint@8.40.0) '@testing-library/jest-dom': specifier: 5.16.5 version: 5.16.5 @@ -91,17 +91,14 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 18.16.3 - version: 18.16.3 - '@types/qrcode.react': - specifier: 1.0.2 - version: 1.0.2 + specifier: 20.1.0 + version: 20.1.0 '@types/react': - specifier: 18.2.0 - version: 18.2.0 + specifier: 18.2.6 + version: 18.2.6 '@types/react-dom': - specifier: 18.2.1 - version: 18.2.1 + specifier: 18.2.4 + version: 18.2.4 '@types/testing-library__jest-dom': specifier: 5.14.5 version: 5.14.5 @@ -109,53 +106,53 @@ devDependencies: specifier: 4.4.1 version: 4.4.1 '@typescript-eslint/eslint-plugin': - specifier: 5.59.1 - version: 5.59.1(@typescript-eslint/parser@5.59.1)(eslint@8.39.0)(typescript@5.0.4) + specifier: 5.59.2 + version: 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) '@typescript-eslint/parser': - specifier: 5.59.1 - version: 5.59.1(eslint@8.39.0)(typescript@5.0.4) + specifier: 5.59.2 + version: 5.59.2(eslint@8.40.0)(typescript@5.0.4) '@vitejs/plugin-react': specifier: 4.0.0 - version: 4.0.0(vite@4.3.3) + version: 4.0.0(vite@4.3.5) '@vitest/coverage-istanbul': - specifier: 0.30.1 - version: 0.30.1(vitest@0.30.1) + specifier: 0.31.0 + version: 0.31.0(vitest@0.31.0) esbuild: specifier: 0.17.18 version: 0.17.18 eslint: - specifier: 8.39.0 - version: 8.39.0 + specifier: 8.40.0 + version: 8.40.0 eslint-config-prettier: specifier: 8.8.0 - version: 8.8.0(eslint@8.39.0) + version: 8.8.0(eslint@8.40.0) eslint-config-react-app: specifier: 7.0.1 - version: 7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0)(typescript@5.0.4) + version: 7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0)(typescript@5.0.4) eslint-formatter-rdjson: specifier: 1.0.5 version: 1.0.5 eslint-import-resolver-typescript: specifier: 3.5.5 - version: 3.5.5(@typescript-eslint/parser@5.59.1)(eslint-plugin-import@2.27.5)(eslint@8.39.0) + version: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0) eslint-plugin-import: specifier: 2.27.5 - version: 2.27.5(@typescript-eslint/parser@5.59.1)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) + version: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) eslint-plugin-jsx-a11y: specifier: 6.7.1 - version: 6.7.1(eslint@8.39.0) + version: 6.7.1(eslint@8.40.0) eslint-plugin-prettier: specifier: 4.2.1 - version: 4.2.1(eslint-config-prettier@8.8.0)(eslint@8.39.0)(prettier@2.8.8) + version: 4.2.1(eslint-config-prettier@8.8.0)(eslint@8.40.0)(prettier@2.8.8) eslint-plugin-react: specifier: 7.32.2 - version: 7.32.2(eslint@8.39.0) + version: 7.32.2(eslint@8.40.0) eslint-plugin-react-hooks: specifier: 4.6.0 - version: 4.6.0(eslint@8.39.0) + version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.10.1 - version: 9.10.1 + specifier: 9.10.9 + version: 9.10.9 husky: specifier: 8.0.3 version: 8.0.3 @@ -169,23 +166,23 @@ devDependencies: specifier: 5.0.4 version: 5.0.4 vite: - specifier: 4.3.3 - version: 4.3.3(@types/node@18.16.3) + specifier: 4.3.5 + version: 4.3.5(@types/node@20.1.0) vite-plugin-eslint: specifier: 1.8.1 - version: 1.8.1(eslint@8.39.0)(vite@4.3.3) + version: 1.8.1(eslint@8.40.0)(vite@4.3.5) vite-plugin-istanbul: specifier: 4.0.1 - version: 4.0.1(vite@4.3.3) + version: 4.0.1(vite@4.3.5) vite-plugin-svgr: - specifier: 2.4.0 - version: 2.4.0(vite@4.3.3) + specifier: 3.2.0 + version: 3.2.0(vite@4.3.5) vite-tsconfig-paths: specifier: 4.2.0 - version: 4.2.0(typescript@5.0.4)(vite@4.3.3) + version: 4.2.0(typescript@5.0.4)(vite@4.3.5) vitest: - specifier: 0.30.1 - version: 0.30.1(happy-dom@9.10.1) + specifier: 0.31.0 + version: 0.31.0(happy-dom@9.10.9) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -238,7 +235,7 @@ packages: - supports-color dev: true - /@babel/eslint-parser@7.21.3(@babel/core@7.21.4)(eslint@8.39.0): + /@babel/eslint-parser@7.21.3(@babel/core@7.21.4)(eslint@8.40.0): resolution: {integrity: sha512-kfhmPimwo6k4P8zxNs8+T7yR44q1LdpsZdE1NkCsVlfiuTPRfnGgjaF8Qgug9q9Pou17u6wneYF0lDCZJATMFg==} engines: {node: ^10.13.0 || ^12.13.0 || >=14.0.0} peerDependencies: @@ -247,7 +244,7 @@ packages: dependencies: '@babel/core': 7.21.4 '@nicolo-ribaudo/eslint-scope-5-internals': 5.1.1-v1 - eslint: 8.39.0 + eslint: 8.40.0 eslint-visitor-keys: 2.1.0 semver: 6.3.0 dev: true @@ -1552,13 +1549,13 @@ packages: '@babel/helper-validator-identifier': 7.19.1 to-fast-properties: 2.0.0 - /@commitlint/cli@17.6.1: - resolution: {integrity: sha512-kCnDD9LE2ySiTnj/VPaxy4/oRayRcdv4aCuVxtoum8SxIU7OADHc0nJPQfheE8bHcs3zZdWzDMWltRosuT13bg==} + /@commitlint/cli@17.6.3: + resolution: {integrity: sha512-ItSz2fd4F+CujgIbQOfNNerDF1eFlsBGEfp9QcCb1kxTYMuKTYZzA6Nu1YRRrIaaWwe2E7awUGpIMrPoZkOG3A==} engines: {node: '>=v14'} hasBin: true dependencies: '@commitlint/format': 17.4.4 - '@commitlint/lint': 17.6.1 + '@commitlint/lint': 17.6.3 '@commitlint/load': 17.5.0 '@commitlint/read': 17.5.1 '@commitlint/types': 17.4.4 @@ -1572,8 +1569,8 @@ packages: - '@swc/wasm' dev: true - /@commitlint/config-conventional@17.6.1: - resolution: {integrity: sha512-ng/ybaSLuTCH9F+7uavSOnEQ9EFMl7lHEjfAEgRh1hwmEe8SpLKpQeMo2aT1IWvHaGMuTb+gjfbzoRf2IR23NQ==} + /@commitlint/config-conventional@17.6.3: + resolution: {integrity: sha512-bLyHEjjRWqlLQWIgYFHmUPbEFMOOLXeF3QbUinDIJev/u9e769tkoTH9YPknEywiuIrAgZaVo+OfzAIsJP0fsw==} engines: {node: '>=v14'} dependencies: conventional-changelog-conventionalcommits: 5.0.0 @@ -1612,19 +1609,19 @@ packages: chalk: 4.1.2 dev: true - /@commitlint/is-ignored@17.4.4: - resolution: {integrity: sha512-Y3eo1SFJ2JQDik4rWkBC4tlRIxlXEFrRWxcyrzb1PUT2k3kZ/XGNuCDfk/u0bU2/yS0tOA/mTjFsV+C4qyACHw==} + /@commitlint/is-ignored@17.6.3: + resolution: {integrity: sha512-LQbNdnPbxrpbcrVKR5yf51SvquqktpyZJwqXx3lUMF6+nT9PHB8xn3wLy8pi2EQv5Zwba484JnUwDE1ygVYNQA==} engines: {node: '>=v14'} dependencies: '@commitlint/types': 17.4.4 - semver: 7.3.8 + semver: 7.5.0 dev: true - /@commitlint/lint@17.6.1: - resolution: {integrity: sha512-VARJ9kxH64isgwVnC+ABPafCYzqxpsWJIpDaTuI0gh8aX4GQ0i7cn9tvxtFNfJj4ER2BAJeWJ0vURdNYjK2RQQ==} + /@commitlint/lint@17.6.3: + resolution: {integrity: sha512-fBlXwt6SHJFgm3Tz+luuo3DkydAx9HNC5y4eBqcKuDuMVqHd2ugMNr+bQtx6riv9mXFiPoKp7nE4Xn/ls3iVDA==} engines: {node: '>=v14'} dependencies: - '@commitlint/is-ignored': 17.4.4 + '@commitlint/is-ignored': 17.6.3 '@commitlint/parse': 17.4.4 '@commitlint/rules': 17.6.1 '@commitlint/types': 17.4.4 @@ -1638,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 18.16.3 + '@types/node': 20.1.0 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@18.16.3)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@18.16.3)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.0)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -1727,48 +1724,52 @@ packages: '@jridgewell/trace-mapping': 0.3.9 dev: true - /@emotion/babel-plugin@11.10.8: - resolution: {integrity: sha512-gxNky50AJL3AlkbjvTARiwAqei6/tNUxDZPSKd+3jqWVM3AmdVTTdpjHorR/an/M0VJqdsuq5oGcFH+rjtyujQ==} + /@emotion/babel-plugin@11.11.0: + resolution: {integrity: sha512-m4HEDZleaaCH+XgDDsPF15Ht6wTLsgDTeR3WYj9Q/k76JtWhrJjcP4+/XlG8LGT/Rol9qUfOIztXeA84ATpqPQ==} dependencies: '@babel/helper-module-imports': 7.21.4 '@babel/runtime': 7.21.0 - '@emotion/hash': 0.9.0 - '@emotion/memoize': 0.8.0 - '@emotion/serialize': 1.1.1 + '@emotion/hash': 0.9.1 + '@emotion/memoize': 0.8.1 + '@emotion/serialize': 1.1.2 babel-plugin-macros: 3.1.0 convert-source-map: 1.9.0 escape-string-regexp: 4.0.0 find-root: 1.1.0 source-map: 0.5.7 - stylis: 4.1.4 + stylis: 4.2.0 dev: false - /@emotion/cache@11.10.8: - resolution: {integrity: sha512-5fyqGHi51LU95o7qQ/vD1jyvC4uCY5GcBT+UgP4LHdpO9jPDlXqhrRr9/wCKmfoAvh5G/F7aOh4MwQa+8uEqhA==} + /@emotion/cache@11.11.0: + resolution: {integrity: sha512-P34z9ssTCBi3e9EI1ZsWpNHcfY1r09ZO0rZbRO2ob3ZQMnFI35jB536qoXbkdesr5EUhYi22anuEJuyxifaqAQ==} dependencies: - '@emotion/memoize': 0.8.0 - '@emotion/sheet': 1.2.1 - '@emotion/utils': 1.2.0 - '@emotion/weak-memoize': 0.3.0 - stylis: 4.1.4 + '@emotion/memoize': 0.8.1 + '@emotion/sheet': 1.2.2 + '@emotion/utils': 1.2.1 + '@emotion/weak-memoize': 0.3.1 + stylis: 4.2.0 dev: false /@emotion/hash@0.9.0: resolution: {integrity: sha512-14FtKiHhy2QoPIzdTcvh//8OyBlknNs2nXRwIhG904opCby3l+9Xaf/wuPvICBF0rc1ZCNBd3nKe9cd2mecVkQ==} dev: false - /@emotion/is-prop-valid@1.2.0: - resolution: {integrity: sha512-3aDpDprjM0AwaxGE09bOPkNxHpBd+kA6jty3RnaEXdweX1DF1U3VQpPYb0g1IStAuK7SVQ1cy+bNBBKp4W3Fjg==} + /@emotion/hash@0.9.1: + resolution: {integrity: sha512-gJB6HLm5rYwSLI6PQa+X1t5CFGrv1J1TWG+sOyMCeKz2ojaj6Fnl/rZEspogG+cvqbt4AE/2eIyD2QfLKTBNlQ==} + dev: false + + /@emotion/is-prop-valid@1.2.1: + resolution: {integrity: sha512-61Mf7Ufx4aDxx1xlDeOm8aFFigGHE4z+0sKCa+IHCeZKiyP9RLD0Mmx7m8b9/Cf37f7NAvQOOJAbQQGVr5uERw==} dependencies: - '@emotion/memoize': 0.8.0 + '@emotion/memoize': 0.8.1 dev: false - /@emotion/memoize@0.8.0: - resolution: {integrity: sha512-G/YwXTkv7Den9mXDO7AhLWkE3q+I92B+VqAE+dYG4NGPaHZGvt3G8Q0p9vmE+sq7rTGphUbAvmQ9YpbfMQGGlA==} + /@emotion/memoize@0.8.1: + resolution: {integrity: sha512-W2P2c/VRW1/1tLox0mVUalvnWXxavmv/Oum2aPsRcoDJuob75FC3Y8FbpfLwUegRcxINtGUMPq0tFCvYNTBXNA==} dev: false - /@emotion/react@11.10.8(@types/react@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-ZfGfiABtJ1P1OXqOBsW08EgCDp5fK6C5I8hUJauc/VcJBGSzqAirMnFslhFWnZJ/w5HxPI36XbvMV0l4KZHl+w==} + /@emotion/react@11.11.0(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-ZSK3ZJsNkwfjT3JpDAWJZlrGD81Z3ytNDsxw1LKq1o+xkmO5pnWfr6gmCC8gHEFf3nSSX/09YrG67jybNPxSUw==} peerDependencies: '@types/react': '*' react: '>=16.8.0 || 18' @@ -1777,33 +1778,33 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/babel-plugin': 11.10.8 - '@emotion/cache': 11.10.8 - '@emotion/serialize': 1.1.1 - '@emotion/use-insertion-effect-with-fallbacks': 1.0.0(react@18.2.0) - '@emotion/utils': 1.2.0 - '@emotion/weak-memoize': 0.3.0 - '@types/react': 18.2.0 + '@emotion/babel-plugin': 11.11.0 + '@emotion/cache': 11.11.0 + '@emotion/serialize': 1.1.2 + '@emotion/use-insertion-effect-with-fallbacks': 1.0.1(react@18.2.0) + '@emotion/utils': 1.2.1 + '@emotion/weak-memoize': 0.3.1 + '@types/react': 18.2.6 hoist-non-react-statics: 3.3.2 react: 18.2.0 dev: false - /@emotion/serialize@1.1.1: - resolution: {integrity: sha512-Zl/0LFggN7+L1liljxXdsVSVlg6E/Z/olVWpfxUTxOAmi8NU7YoeWeLfi1RmnB2TATHoaWwIBRoL+FvAJiTUQA==} + /@emotion/serialize@1.1.2: + resolution: {integrity: sha512-zR6a/fkFP4EAcCMQtLOhIgpprZOwNmCldtpaISpvz348+DP4Mz8ZoKaGGCQpbzepNIUWbq4w6hNZkwDyKoS+HA==} dependencies: - '@emotion/hash': 0.9.0 - '@emotion/memoize': 0.8.0 - '@emotion/unitless': 0.8.0 - '@emotion/utils': 1.2.0 + '@emotion/hash': 0.9.1 + '@emotion/memoize': 0.8.1 + '@emotion/unitless': 0.8.1 + '@emotion/utils': 1.2.1 csstype: 3.1.2 dev: false - /@emotion/sheet@1.2.1: - resolution: {integrity: sha512-zxRBwl93sHMsOj4zs+OslQKg/uhF38MB+OMKoCrVuS0nyTkqnau+BM3WGEoOptg9Oz45T/aIGs1qbVAsEFo3nA==} + /@emotion/sheet@1.2.2: + resolution: {integrity: sha512-0QBtGvaqtWi+nx6doRwDdBIzhNdZrXUppvTM4dtZZWEGTXL/XE/yJxLMGlDT1Gt+UHH5IX1n+jkXyytE/av7OA==} dev: false - /@emotion/styled@11.10.8(@emotion/react@11.10.8)(@types/react@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-gow0lF4Uw/QEdX2REMhI8v6wLOabPKJ+4HKNF0xdJ2DJdznN6fxaXpQOx6sNkyBhSUL558Rmcu1Lq/MYlVo4vw==} + /@emotion/styled@11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-hM5Nnvu9P3midq5aaXj4I+lnSfNi7Pmd4EWk1fOZ3pxookaQTNew6bp4JaCBYM4HVFZF9g7UjJmsUmC2JlxOng==} peerDependencies: '@emotion/react': ^11.0.0-rc.0 '@types/react': '*' @@ -1813,34 +1814,34 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/babel-plugin': 11.10.8 - '@emotion/is-prop-valid': 1.2.0 - '@emotion/react': 11.10.8(@types/react@18.2.0)(react@18.2.0) - '@emotion/serialize': 1.1.1 - '@emotion/use-insertion-effect-with-fallbacks': 1.0.0(react@18.2.0) - '@emotion/utils': 1.2.0 - '@types/react': 18.2.0 + '@emotion/babel-plugin': 11.11.0 + '@emotion/is-prop-valid': 1.2.1 + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/serialize': 1.1.2 + '@emotion/use-insertion-effect-with-fallbacks': 1.0.1(react@18.2.0) + '@emotion/utils': 1.2.1 + '@types/react': 18.2.6 react: 18.2.0 dev: false - /@emotion/unitless@0.8.0: - resolution: {integrity: sha512-VINS5vEYAscRl2ZUDiT3uMPlrFQupiKgHz5AA4bCH1miKBg4qtwkim1qPmJj/4WG6TreYMY111rEFsjupcOKHw==} + /@emotion/unitless@0.8.1: + resolution: {integrity: sha512-KOEGMu6dmJZtpadb476IsZBclKvILjopjUii3V+7MnXIQCYh8W3NgNcgwo21n9LXZX6EDIKvqfjYxXebDwxKmQ==} dev: false - /@emotion/use-insertion-effect-with-fallbacks@1.0.0(react@18.2.0): - resolution: {integrity: sha512-1eEgUGmkaljiBnRMTdksDV1W4kUnmwgp7X9G8B++9GYwl1lUdqSndSriIrTJ0N7LQaoauY9JJ2yhiOYK5+NI4A==} + /@emotion/use-insertion-effect-with-fallbacks@1.0.1(react@18.2.0): + resolution: {integrity: sha512-jT/qyKZ9rzLErtrjGgdkMBn2OP8wl0G3sQlBb3YPryvKHsjvINUhVaPFfP+fpBcOkmrVOVEEHQFJ7nbj2TH2gw==} peerDependencies: react: '>=16.8.0 || 18' dependencies: react: 18.2.0 dev: false - /@emotion/utils@1.2.0: - resolution: {integrity: sha512-sn3WH53Kzpw8oQ5mgMmIzzyAaH2ZqFEbozVVBSYp538E06OSE6ytOp7pRAjNQR+Q/orwqdQYJSe2m3hCOeznkw==} + /@emotion/utils@1.2.1: + resolution: {integrity: sha512-Y2tGf3I+XVnajdItskUCn6LX+VUDmP6lTL4fcqsXAv43dnlbZiuW4MWQW38rW/BVWSE7Q/7+XQocmpnRYILUmg==} dev: false - /@emotion/weak-memoize@0.3.0: - resolution: {integrity: sha512-AHPmaAx+RYfZz0eYu6Gviiagpmiyw98ySSlQvCUhVGDRtDFe4DBS0x1bSjdF3gqUDYOczB+yYvBTtEylYSdRhg==} + /@emotion/weak-memoize@0.3.1: + resolution: {integrity: sha512-EsBwpc7hBUJWAsNPBmJy4hxWx12v6bshQsldrVmjxJoc3isbxhOrF2IcCpaXxfvq03NwkI7sbsOLXbYuqF/8Ww==} dev: false /@esbuild/android-arm64@0.17.18: @@ -2059,14 +2060,14 @@ packages: dev: true optional: true - /@eslint-community/eslint-utils@4.4.0(eslint@8.39.0): + /@eslint-community/eslint-utils@4.4.0(eslint@8.40.0): resolution: {integrity: sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || >=8.0.0 dependencies: - eslint: 8.39.0 - eslint-visitor-keys: 3.4.0 + eslint: 8.40.0 + eslint-visitor-keys: 3.4.1 dev: true /@eslint-community/regexpp@4.5.0: @@ -2074,13 +2075,13 @@ packages: engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0} dev: true - /@eslint/eslintrc@2.0.2: - resolution: {integrity: sha512-3W4f5tDUra+pA+FzgugqL2pRimUTDJWKr7BINqOpkZrC0uYI0NIc0/JFgBROCU07HR6GieA5m3/rsPIhDmCXTQ==} + /@eslint/eslintrc@2.0.3: + resolution: {integrity: sha512-+5gy6OQfk+xx3q0d6jGZZC3f3KzAkXc/IanVxd1is/VIIziRqqt3ongQz0FiTUXqTk0c7aDB3OaFuKnuSoJicQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: ajv: 6.12.6 debug: 4.3.4 - espree: 9.5.1 + espree: 9.5.2 globals: 13.20.0 ignore: 5.2.4 import-fresh: 3.3.0 @@ -2091,8 +2092,8 @@ packages: - supports-color dev: true - /@eslint/js@8.39.0: - resolution: {integrity: sha512-kf9RB0Fg7NZfap83B3QOqOGg9QmD9yBudqQXzzOtn3i4y7ZUXe5ONeW34Gwi+TxhH4mvj72R1Zc300KUMa9Bng==} + /@eslint/js@8.40.0: + resolution: {integrity: sha512-ElyB54bJIhXQYVKjDSvCkPO1iU1tSAeVQJbllWJq1XQSmmA4dgFk8CbiBGpiOPxleE48vDogxCtmMYku4HSVLA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true @@ -2194,7 +2195,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 18.16.3 + '@types/node': 20.1.0 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2245,12 +2246,12 @@ packages: '@jridgewell/sourcemap-codec': 1.4.15 dev: true - /@limegrass/eslint-plugin-import-alias@1.0.6(eslint@8.39.0): + /@limegrass/eslint-plugin-import-alias@1.0.6(eslint@8.40.0): resolution: {integrity: sha512-BtPmdHbL4NmkVh2wMnOboyOCrdLOpBqwwtBIsB0/giTiALw/UTHD9TyH4vVnbDOuWPZQgE6kKloJ9G77FApt7w==} peerDependencies: eslint: ^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 dependencies: - eslint: 8.39.0 + eslint: 8.40.0 find-up: 5.0.0 fs-extra: 10.1.0 micromatch: 4.0.5 @@ -2258,8 +2259,8 @@ packages: tsconfig-paths: 3.14.2 dev: true - /@mui/base@5.0.0-alpha.127(@types/react@18.2.0)(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-FoRQd0IOH9MnfyL5yXssyQRnC4vXI+1bwkU1idr+wNkP1ZfxE+JsThHcfl1dy5azLssVUGTtQFD9edQLdbyJog==} + /@mui/base@5.0.0-alpha.128(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-wub3wxNN+hUp8hzilMlXX3sZrPo75vsy1cXEQpqdTfIFlE9HprP1jlulFiPg5tfPst2OKmygXr2hhmgvAKRrzQ==} engines: {node: '>=12.0.0'} peerDependencies: '@types/react': ^17.0.0 || ^18.0.0 || 18 @@ -2270,11 +2271,11 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/is-prop-valid': 1.2.0 - '@mui/types': 7.2.4(@types/react@18.2.0) - '@mui/utils': 5.12.0(react@18.2.0) + '@emotion/is-prop-valid': 1.2.1 + '@mui/types': 7.2.4(@types/react@18.2.6) + '@mui/utils': 5.12.3(react@18.2.0) '@popperjs/core': 2.11.7 - '@types/react': 18.2.0 + '@types/react': 18.2.6 clsx: 1.2.1 prop-types: 15.8.1 react: 18.2.0 @@ -2282,11 +2283,11 @@ packages: react-is: 18.2.0 dev: false - /@mui/core-downloads-tracker@5.12.2: - resolution: {integrity: sha512-Qn7dy8tql6T0hY6gTFPkpWlnqVVFGu5Z6QzEzUSzzmLZpfAx4kf8sFz0PHiB7gU5yrqcZF9picMx1shpRY/rXw==} + /@mui/core-downloads-tracker@5.12.3: + resolution: {integrity: sha512-yiJZ+knaknPHuRKhRk4L6XiwppwkAahVal3LuYpvBH7GkA2g+D9WLEXOEnNYtVFUggyKf6fWGLGnx0iqzkU5YA==} dev: false - /@mui/icons-material@5.11.16(@mui/material@5.12.2)(@types/react@18.2.0)(react@18.2.0): + /@mui/icons-material@5.11.16(@mui/material@5.12.3)(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-oKkx9z9Kwg40NtcIajF9uOXhxiyTZrrm9nmIJ4UjkU2IdHpd4QVLbCc/5hZN/y0C6qzi2Zlxyr9TGddQx2vx2A==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2298,13 +2299,13 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@mui/material': 5.12.2(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.0)(react-dom@18.2.0)(react@18.2.0) - '@types/react': 18.2.0 + '@mui/material': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@types/react': 18.2.6 react: 18.2.0 dev: false - /@mui/material@5.12.2(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.0)(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-XOVy6fVC0rI2dEwDq/1s4Te2hewTUe6lznzeVnruyATGkdmM06WnHqkZOoLVIWo9hWwAxpcgTDcAIVpFtt1nrw==} + /@mui/material@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-xNmKlrEN4HsTaKFNLZfc7ie7CXx2YqEeO//hsXZx2p3MGtDdeMr2sV3jC4hsFs57RhQlF79weY7uVvC8xSuVbg==} engines: {node: '>=12.0.0'} peerDependencies: '@emotion/react': ^11.5.0 @@ -2321,14 +2322,14 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/react': 11.10.8(@types/react@18.2.0)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.0)(react@18.2.0) - '@mui/base': 5.0.0-alpha.127(@types/react@18.2.0)(react-dom@18.2.0)(react@18.2.0) - '@mui/core-downloads-tracker': 5.12.2 - '@mui/system': 5.12.1(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.0)(react@18.2.0) - '@mui/types': 7.2.4(@types/react@18.2.0) - '@mui/utils': 5.12.0(react@18.2.0) - '@types/react': 18.2.0 + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) + '@mui/base': 5.0.0-alpha.128(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@mui/core-downloads-tracker': 5.12.3 + '@mui/system': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0) + '@mui/types': 7.2.4(@types/react@18.2.6) + '@mui/utils': 5.12.3(react@18.2.0) + '@types/react': 18.2.6 '@types/react-transition-group': 4.4.5 clsx: 1.2.1 csstype: 3.1.2 @@ -2339,8 +2340,8 @@ packages: react-transition-group: 4.4.5(react-dom@18.2.0)(react@18.2.0) dev: false - /@mui/private-theming@5.12.0(@types/react@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-w5dwMen1CUm1puAtubqxY9BIzrBxbOThsg2iWMvRJmWyJAPdf3Z583fPXpqeA2lhTW79uH2jajk5Ka4FuGlTPg==} + /@mui/private-theming@5.12.3(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-o1e7Z1Bp27n4x2iUHhegV4/Jp6H3T6iBKHJdLivS5GbwsuAE/5l4SnZ+7+K+e5u9TuhwcAKZLkjvqzkDe8zqfA==} engines: {node: '>=12.0.0'} peerDependencies: '@types/react': ^17.0.0 || ^18.0.0 || 18 @@ -2350,14 +2351,14 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@mui/utils': 5.12.0(react@18.2.0) - '@types/react': 18.2.0 + '@mui/utils': 5.12.3(react@18.2.0) + '@types/react': 18.2.6 prop-types: 15.8.1 react: 18.2.0 dev: false - /@mui/styled-engine@5.12.0(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(react@18.2.0): - resolution: {integrity: sha512-frh8L7CRnvD0RDmIqEv6jFeKQUIXqW90BaZ6OrxJ2j4kIsiVLu29Gss4SbBvvrWwwatR72sBmC3w1aG4fjp9mQ==} + /@mui/styled-engine@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(react@18.2.0): + resolution: {integrity: sha512-AhZtiRyT8Bjr7fufxE/mLS+QJ3LxwX1kghIcM2B2dvJzSSg9rnIuXDXM959QfUVIM3C8U4x3mgVoPFMQJvc4/g==} engines: {node: '>=12.0.0'} peerDependencies: '@emotion/react': ^11.4.1 @@ -2370,16 +2371,16 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/cache': 11.10.8 - '@emotion/react': 11.10.8(@types/react@18.2.0)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.0)(react@18.2.0) + '@emotion/cache': 11.11.0 + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) csstype: 3.1.2 prop-types: 15.8.1 react: 18.2.0 dev: false - /@mui/styles@5.12.0(@types/react@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-X7obkgZTd9X+7igqwKKe8pEncyXYdUCNmyJfHruV9TSc6LThoI29OYs6hkN6n+7ueNli+YDKdZ+TCoC1GpJuOw==} + /@mui/styles@5.12.3(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-y0GN1kTYO2FF/0LH8a0PpVxwLotlcunFqdJpCL5gza0w5Fqz9wxlwauPZW0bDt0+sF79CrohzdzWkh+fxB+oww==} engines: {node: '>=12.0.0'} peerDependencies: '@types/react': ^17.0.0 || 18 @@ -2390,10 +2391,10 @@ packages: dependencies: '@babel/runtime': 7.21.0 '@emotion/hash': 0.9.0 - '@mui/private-theming': 5.12.0(@types/react@18.2.0)(react@18.2.0) - '@mui/types': 7.2.4(@types/react@18.2.0) - '@mui/utils': 5.12.0(react@18.2.0) - '@types/react': 18.2.0 + '@mui/private-theming': 5.12.3(@types/react@18.2.6)(react@18.2.0) + '@mui/types': 7.2.4(@types/react@18.2.6) + '@mui/utils': 5.12.3(react@18.2.0) + '@types/react': 18.2.6 clsx: 1.2.1 csstype: 3.1.2 hoist-non-react-statics: 3.3.2 @@ -2409,8 +2410,8 @@ packages: react: 18.2.0 dev: false - /@mui/system@5.12.1(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-Po+sicdV3bbRYXdU29XZaHPZrW7HUYUqU1qCu77GCCEMbahC756YpeyefdIYuPMUg0OdO3gKIUfDISBrkjJL+w==} + /@mui/system@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-JB/6sypHqeJCqwldWeQ1MKkijH829EcZAKKizxbU2MJdxGG5KSwZvTBa5D9qiJUA1hJFYYupjiuy9ZdJt6rV6w==} engines: {node: '>=12.0.0'} peerDependencies: '@emotion/react': ^11.5.0 @@ -2426,20 +2427,20 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/react': 11.10.8(@types/react@18.2.0)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.0)(react@18.2.0) - '@mui/private-theming': 5.12.0(@types/react@18.2.0)(react@18.2.0) - '@mui/styled-engine': 5.12.0(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(react@18.2.0) - '@mui/types': 7.2.4(@types/react@18.2.0) - '@mui/utils': 5.12.0(react@18.2.0) - '@types/react': 18.2.0 + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) + '@mui/private-theming': 5.12.3(@types/react@18.2.6)(react@18.2.0) + '@mui/styled-engine': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(react@18.2.0) + '@mui/types': 7.2.4(@types/react@18.2.6) + '@mui/utils': 5.12.3(react@18.2.0) + '@types/react': 18.2.6 clsx: 1.2.1 csstype: 3.1.2 prop-types: 15.8.1 react: 18.2.0 dev: false - /@mui/types@7.2.4(@types/react@18.2.0): + /@mui/types@7.2.4(@types/react@18.2.6): resolution: {integrity: sha512-LBcwa8rN84bKF+f5sDyku42w1NTxaPgPyYKODsh01U1fVstTClbUoSA96oyRBnSNyEiAVjKm6Gwx9vjR+xyqHA==} peerDependencies: '@types/react': '*' @@ -2447,11 +2448,11 @@ packages: '@types/react': optional: true dependencies: - '@types/react': 18.2.0 + '@types/react': 18.2.6 dev: false - /@mui/utils@5.12.0(react@18.2.0): - resolution: {integrity: sha512-RmQwgzF72p7Yr4+AAUO6j1v2uzt6wr7SWXn68KBsnfVpdOHyclCzH2lr/Xu6YOw9su4JRtdAIYfJFXsS6Cjkmw==} + /@mui/utils@5.12.3(react@18.2.0): + resolution: {integrity: sha512-D/Z4Ub3MRl7HiUccid7sQYclTr24TqUAQFFlxHQF8FR177BrCTQ0JJZom7EqYjZCdXhwnSkOj2ph685MSKNtIA==} engines: {node: '>=12.0.0'} peerDependencies: react: ^17.0.0 || ^18.0.0 || 18 @@ -2507,8 +2508,8 @@ packages: resolution: {integrity: sha512-Cr4OjIkipTtcXKjAsm8agyleBuDHvxzeBoa1v543lbv1YaIwQjESsVcmjiWiPEbC1FIeHOG/Op9kdCmAmiS3Kw==} dev: false - /@remix-run/router@1.6.0: - resolution: {integrity: sha512-N13NRw3T2+6Xi9J//3CGLsK2OqC8NMme3d/YX+nh05K9YHWGcv8DycHJrqGScSP4T75o8IN6nqIMhVFU8ohg8w==} + /@remix-run/router@1.6.1: + resolution: {integrity: sha512-YUkWj+xs0oOzBe74OgErsuR3wVn+efrFhXBWrit50kOiED+pvQe2r6MWY0iJMQU/mSVKxvNzL4ZaYvjdX+G7ZA==} engines: {node: '>=14'} dev: false @@ -2542,9 +2543,9 @@ packages: resolution: {integrity: sha512-XJfwUVUKDHF5ugKwIcxEgc9k8b7HbznCp6eUfWgu710hMPNIO4aw4/zB5RogDQz8nd6gyCDpU9O/m6qYEWY6yQ==} dev: true - /@svgr/babel-plugin-add-jsx-attribute@6.5.1(@babel/core@7.21.4): - resolution: {integrity: sha512-9PYGcXrAxitycIjRmZB+Q0JaN07GZIWaTBIGQzfaZv+qr1n8X1XUEJ5rZ/vx6OVD9RRYlrNnXWExQXcmZeD/BQ==} - engines: {node: '>=10'} + /@svgr/babel-plugin-add-jsx-attribute@7.0.0(@babel/core@7.21.4): + resolution: {integrity: sha512-khWbXesWIP9v8HuKCl2NU2HNAyqpSQ/vkIl36Nbn4HIwEYSRWL0H7Gs6idJdha2DkpFDWlsqMELvoCE8lfFY6Q==} + engines: {node: '>=14'} peerDependencies: '@babel/core': ^7.0.0-0 dependencies: @@ -2569,44 +2570,44 @@ packages: '@babel/core': 7.21.4 dev: true - /@svgr/babel-plugin-replace-jsx-attribute-value@6.5.1(@babel/core@7.21.4): - resolution: {integrity: sha512-8DPaVVE3fd5JKuIC29dqyMB54sA6mfgki2H2+swh+zNJoynC8pMPzOkidqHOSc6Wj032fhl8Z0TVn1GiPpAiJg==} - engines: {node: '>=10'} + /@svgr/babel-plugin-replace-jsx-attribute-value@7.0.0(@babel/core@7.21.4): + resolution: {integrity: sha512-i6MaAqIZXDOJeikJuzocByBf8zO+meLwfQ/qMHIjCcvpnfvWf82PFvredEZElErB5glQFJa2KVKk8N2xV6tRRA==} + engines: {node: '>=14'} peerDependencies: '@babel/core': ^7.0.0-0 dependencies: '@babel/core': 7.21.4 dev: true - /@svgr/babel-plugin-svg-dynamic-title@6.5.1(@babel/core@7.21.4): - resolution: {integrity: sha512-FwOEi0Il72iAzlkaHrlemVurgSQRDFbk0OC8dSvD5fSBPHltNh7JtLsxmZUhjYBZo2PpcU/RJvvi6Q0l7O7ogw==} - engines: {node: '>=10'} + /@svgr/babel-plugin-svg-dynamic-title@7.0.0(@babel/core@7.21.4): + resolution: {integrity: sha512-BoVSh6ge3SLLpKC0pmmN9DFlqgFy4NxNgdZNLPNJWBUU7TQpDWeBuyVuDW88iXydb5Cv0ReC+ffa5h3VrKfk1w==} + engines: {node: '>=14'} peerDependencies: '@babel/core': ^7.0.0-0 dependencies: '@babel/core': 7.21.4 dev: true - /@svgr/babel-plugin-svg-em-dimensions@6.5.1(@babel/core@7.21.4): - resolution: {integrity: sha512-gWGsiwjb4tw+ITOJ86ndY/DZZ6cuXMNE/SjcDRg+HLuCmwpcjOktwRF9WgAiycTqJD/QXqL2f8IzE2Rzh7aVXA==} - engines: {node: '>=10'} + /@svgr/babel-plugin-svg-em-dimensions@7.0.0(@babel/core@7.21.4): + resolution: {integrity: sha512-tNDcBa+hYn0gO+GkP/AuNKdVtMufVhU9fdzu+vUQsR18RIJ9RWe7h/pSBY338RO08wArntwbDk5WhQBmhf2PaA==} + engines: {node: '>=14'} peerDependencies: '@babel/core': ^7.0.0-0 dependencies: '@babel/core': 7.21.4 dev: true - /@svgr/babel-plugin-transform-react-native-svg@6.5.1(@babel/core@7.21.4): - resolution: {integrity: sha512-2jT3nTayyYP7kI6aGutkyfJ7UMGtuguD72OjeGLwVNyfPRBD8zQthlvL+fAbAKk5n9ZNcvFkp/b1lZ7VsYqVJg==} - engines: {node: '>=10'} + /@svgr/babel-plugin-transform-react-native-svg@7.0.0(@babel/core@7.21.4): + resolution: {integrity: sha512-qw54u8ljCJYL2KtBOjI5z7Nzg8LnSvQOP5hPKj77H4VQL4+HdKbAT5pnkkZLmHKYwzsIHSYKXxHouD8zZamCFQ==} + engines: {node: '>=14'} peerDependencies: '@babel/core': ^7.0.0-0 dependencies: '@babel/core': 7.21.4 dev: true - /@svgr/babel-plugin-transform-svg-component@6.5.1(@babel/core@7.21.4): - resolution: {integrity: sha512-a1p6LF5Jt33O3rZoVRBqdxL350oge54iZWHNI6LJB5tQ7EelvD/Mb1mfBiZNAan0dt4i3VArkFRjA4iObuNykQ==} + /@svgr/babel-plugin-transform-svg-component@7.0.0(@babel/core@7.21.4): + resolution: {integrity: sha512-CcFECkDj98daOg9jE3Bh3uyD9kzevCAnZ+UtzG6+BQG/jOQ2OA3jHnX6iG4G1MCJkUQFnUvEv33NvQfqrb/F3A==} engines: {node: '>=12'} peerDependencies: '@babel/core': ^7.0.0-0 @@ -2614,54 +2615,50 @@ packages: '@babel/core': 7.21.4 dev: true - /@svgr/babel-preset@6.5.1(@babel/core@7.21.4): - resolution: {integrity: sha512-6127fvO/FF2oi5EzSQOAjo1LE3OtNVh11R+/8FXa+mHx1ptAaS4cknIjnUA7e6j6fwGGJ17NzaTJFUwOV2zwCw==} - engines: {node: '>=10'} + /@svgr/babel-preset@7.0.0(@babel/core@7.21.4): + resolution: {integrity: sha512-EX/NHeFa30j5UjldQGVQikuuQNHUdGmbh9kEpBKofGUtF0GUPJ4T4rhoYiqDAOmBOxojyot36JIFiDUHUK1ilQ==} + engines: {node: '>=14'} peerDependencies: '@babel/core': ^7.0.0-0 dependencies: '@babel/core': 7.21.4 - '@svgr/babel-plugin-add-jsx-attribute': 6.5.1(@babel/core@7.21.4) + '@svgr/babel-plugin-add-jsx-attribute': 7.0.0(@babel/core@7.21.4) '@svgr/babel-plugin-remove-jsx-attribute': 7.0.0(@babel/core@7.21.4) '@svgr/babel-plugin-remove-jsx-empty-expression': 7.0.0(@babel/core@7.21.4) - '@svgr/babel-plugin-replace-jsx-attribute-value': 6.5.1(@babel/core@7.21.4) - '@svgr/babel-plugin-svg-dynamic-title': 6.5.1(@babel/core@7.21.4) - '@svgr/babel-plugin-svg-em-dimensions': 6.5.1(@babel/core@7.21.4) - '@svgr/babel-plugin-transform-react-native-svg': 6.5.1(@babel/core@7.21.4) - '@svgr/babel-plugin-transform-svg-component': 6.5.1(@babel/core@7.21.4) + '@svgr/babel-plugin-replace-jsx-attribute-value': 7.0.0(@babel/core@7.21.4) + '@svgr/babel-plugin-svg-dynamic-title': 7.0.0(@babel/core@7.21.4) + '@svgr/babel-plugin-svg-em-dimensions': 7.0.0(@babel/core@7.21.4) + '@svgr/babel-plugin-transform-react-native-svg': 7.0.0(@babel/core@7.21.4) + '@svgr/babel-plugin-transform-svg-component': 7.0.0(@babel/core@7.21.4) dev: true - /@svgr/core@6.5.1: - resolution: {integrity: sha512-/xdLSWxK5QkqG524ONSjvg3V/FkNyCv538OIBdQqPNaAta3AsXj/Bd2FbvR87yMbXO2hFSWiAe/Q6IkVPDw+mw==} - engines: {node: '>=10'} + /@svgr/core@7.0.0: + resolution: {integrity: sha512-ztAoxkaKhRVloa3XydohgQQCb0/8x9T63yXovpmHzKMkHO6pkjdsIAWKOS4bE95P/2quVh1NtjSKlMRNzSBffw==} + engines: {node: '>=14'} dependencies: '@babel/core': 7.21.4 - '@svgr/babel-preset': 6.5.1(@babel/core@7.21.4) - '@svgr/plugin-jsx': 6.5.1(@svgr/core@6.5.1) + '@svgr/babel-preset': 7.0.0(@babel/core@7.21.4) camelcase: 6.3.0 - cosmiconfig: 7.1.0 + cosmiconfig: 8.1.3 transitivePeerDependencies: - supports-color dev: true - /@svgr/hast-util-to-babel-ast@6.5.1: - resolution: {integrity: sha512-1hnUxxjd83EAxbL4a0JDJoD3Dao3hmjvyvyEV8PzWmLK3B9m9NPlW7GKjFyoWE8nM7HnXzPcmmSyOW8yOddSXw==} - engines: {node: '>=10'} + /@svgr/hast-util-to-babel-ast@7.0.0: + resolution: {integrity: sha512-42Ej9sDDEmsJKjrfQ1PHmiDiHagh/u9AHO9QWbeNx4KmD9yS5d1XHmXUNINfUcykAU+4431Cn+k6Vn5mWBYimQ==} + engines: {node: '>=14'} dependencies: '@babel/types': 7.21.4 entities: 4.4.0 dev: true - /@svgr/plugin-jsx@6.5.1(@svgr/core@6.5.1): - resolution: {integrity: sha512-+UdQxI3jgtSjCykNSlEMuy1jSRQlGC7pqBCPvkG/2dATdWo082zHTTK3uhnAju2/6XpE6B5mZ3z4Z8Ns01S8Gw==} - engines: {node: '>=10'} - peerDependencies: - '@svgr/core': ^6.0.0 + /@svgr/plugin-jsx@7.0.0: + resolution: {integrity: sha512-SWlTpPQmBUtLKxXWgpv8syzqIU8XgFRvyhfkam2So8b3BE0OS0HPe5UfmlJ2KIC+a7dpuuYovPR2WAQuSyMoPw==} + engines: {node: '>=14'} dependencies: '@babel/core': 7.21.4 - '@svgr/babel-preset': 6.5.1(@babel/core@7.21.4) - '@svgr/core': 6.5.1 - '@svgr/hast-util-to-babel-ast': 6.5.1 + '@svgr/babel-preset': 7.0.0(@babel/core@7.21.4) + '@svgr/hast-util-to-babel-ast': 7.0.0 svg-parser: 2.0.4 transitivePeerDependencies: - supports-color @@ -2705,7 +2702,7 @@ packages: dependencies: '@babel/runtime': 7.21.0 '@testing-library/dom': 9.2.0 - '@types/react-dom': 18.2.1 + '@types/react-dom': 18.2.4 react: 18.2.0 react-dom: 18.2.0(react@18.2.0) dev: true @@ -2734,7 +2731,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 18.16.3 + '@types/node': 20.1.0 dev: true /@types/chai-subset@1.3.3: @@ -2750,7 +2747,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 18.16.3 + '@types/node': 20.1.0 dev: true /@types/eslint@8.37.0: @@ -2767,7 +2764,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 18.16.3 + '@types/node': 20.1.0 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2820,8 +2817,12 @@ packages: resolution: {integrity: sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ==} dev: true - /@types/node@18.16.3: - resolution: {integrity: sha512-OPs5WnnT1xkCBiuQrZA4+YAV4HEJejmHneyraIaxsbev5yCEr6KMwINNFP9wQeFIw8FWcoTqF3vQsa5CDaI+8Q==} + /@types/node@18.16.5: + resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} + dev: true + + /@types/node@20.1.0: + resolution: {integrity: sha512-O+z53uwx64xY7D6roOi4+jApDGFg0qn6WHcxe5QeqjMaTezBO/mxdfFXIVAVVyNWKx84OmPB3L8kbVYOTeN34A==} dev: true /@types/normalize-package-data@2.4.1: @@ -2834,12 +2835,6 @@ packages: /@types/prop-types@15.7.5: resolution: {integrity: sha512-JCB8C6SnDoQf0cNycqd/35A7MjcnK+ZTqE7judS6o7utxUCg6imJg3QK2qzHKszlTjcj2cn+NwMB2i96ubpj7w==} - /@types/qrcode.react@1.0.2: - resolution: {integrity: sha512-I9Oq5Cjlkgy3Tw7krCnCXLw2/zMhizkTere49OOcta23tkvH0xBTP0yInimTh0gstLRtb8Ki9NZVujE5UI6ffQ==} - dependencies: - '@types/react': 18.2.0 - dev: true - /@types/qs@6.9.7: resolution: {integrity: sha512-FGa1F62FT09qcrueBA6qYTrJPVDzah9a+493+o2PCXsesWHIn27G98TsSMs3WPNbZIEj4+VJf6saSFpvD+3Zsw==} dev: true @@ -2848,26 +2843,26 @@ packages: resolution: {integrity: sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw==} dev: true - /@types/react-dom@18.2.1: - resolution: {integrity: sha512-8QZEV9+Kwy7tXFmjJrp3XUKQSs9LTnE0KnoUb0YCguWBiNW0Yfb2iBMYZ08WPg35IR6P3Z0s00B15SwZnO26+w==} + /@types/react-dom@18.2.4: + resolution: {integrity: sha512-G2mHoTMTL4yoydITgOGwWdWMVd8sNgyEP85xVmMKAPUBwQWm9wBPQUmvbeF4V3WBY1P7mmL4BkjQ0SqUpf1snw==} dependencies: - '@types/react': 18.2.0 + '@types/react': 18.2.6 dev: true /@types/react-is@17.0.3: resolution: {integrity: sha512-aBTIWg1emtu95bLTLx0cpkxwGW3ueZv71nE2YFBpL8k/z5czEW8yYpOo8Dp+UUAFAtKwNaOsh/ioSeQnWlZcfw==} dependencies: - '@types/react': 18.2.0 + '@types/react': 18.2.6 dev: false /@types/react-transition-group@4.4.5: resolution: {integrity: sha512-juKD/eiSM3/xZYzjuzH6ZwpP+/lejltmiS3QEzV/vmb/Q8+HfDmxu+Baga8UEMGBqV88Nbg4l2hY/K2DkyaLLA==} dependencies: - '@types/react': 18.2.0 + '@types/react': 18.2.6 dev: false - /@types/react@18.2.0: - resolution: {integrity: sha512-0FLj93y5USLHdnhIhABk83rm8XEGA7kH3cr+YUlvxoUGp1xNt/DINUMvqPxLyOQMzLmZe8i4RTHbvb8MC7NmrA==} + /@types/react@18.2.6: + resolution: {integrity: sha512-wRZClXn//zxCFW+ye/D2qY65UsYP1Fpex2YXorHc8awoNamkMZSvBxwxdYVInsHOZZd2Ppq8isnSzJL5Mpf8OA==} dependencies: '@types/prop-types': 15.7.5 '@types/scheduler': 0.16.3 @@ -2884,7 +2879,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 18.16.3 + '@types/node': 20.1.0 dev: true /@types/stack-utils@2.0.1: @@ -2911,8 +2906,8 @@ packages: resolution: {integrity: sha512-3NoqvZC2W5gAC5DZbTpCeJ251vGQmgcWIHQJGq2J240HY6ErQ9aWKkwfoKJlHLx+A83WPNTZ9+3cd2ILxbvr1w==} dev: true - /@typescript-eslint/eslint-plugin@5.59.1(@typescript-eslint/parser@5.59.1)(eslint@8.39.0)(typescript@5.0.4): - resolution: {integrity: sha512-AVi0uazY5quFB9hlp2Xv+ogpfpk77xzsgsIEWyVS7uK/c7MZ5tw7ZPbapa0SbfkqE0fsAMkz5UwtgMLVk2BQAg==} + /@typescript-eslint/eslint-plugin@5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-yVrXupeHjRxLDcPKL10sGQ/QlVrA8J5IYOEWVqk0lJaSZP7X5DfnP7Ns3cc74/blmbipQ1htFNVGsHX6wsYm0A==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: '@typescript-eslint/parser': ^5.0.0 @@ -2923,12 +2918,12 @@ packages: optional: true dependencies: '@eslint-community/regexpp': 4.5.0 - '@typescript-eslint/parser': 5.59.1(eslint@8.39.0)(typescript@5.0.4) - '@typescript-eslint/scope-manager': 5.59.1 - '@typescript-eslint/type-utils': 5.59.1(eslint@8.39.0)(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.1(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.2 + '@typescript-eslint/type-utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 - eslint: 8.39.0 + eslint: 8.40.0 grapheme-splitter: 1.0.4 ignore: 5.2.4 natural-compare-lite: 1.4.0 @@ -2939,21 +2934,21 @@ packages: - supports-color dev: true - /@typescript-eslint/experimental-utils@5.58.0(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/experimental-utils@5.58.0(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-LA/sRPaynZlrlYxdefrZbMx8dqs/1Kc0yNG+XOk5CwwZx7tTv263ix3AJNioF0YBVt7hADpAUR20owl6pv4MIQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 dependencies: - '@typescript-eslint/utils': 5.58.0(eslint@8.39.0)(typescript@5.0.4) - eslint: 8.39.0 + '@typescript-eslint/utils': 5.58.0(eslint@8.40.0)(typescript@5.0.4) + eslint: 8.40.0 transitivePeerDependencies: - supports-color - typescript dev: true - /@typescript-eslint/parser@5.59.1(eslint@8.39.0)(typescript@5.0.4): - resolution: {integrity: sha512-nzjFAN8WEu6yPRDizIFyzAfgK7nybPodMNFGNH0M9tei2gYnYszRDqVA0xlnRjkl7Hkx2vYrEdb6fP2a21cG1g==} + /@typescript-eslint/parser@5.59.2(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-uq0sKyw6ao1iFOZZGk9F8Nro/8+gfB5ezl1cA06SrqbgJAt0SRoFhb9pXaHvkrxUpZaoLxt8KlovHNk8Gp6/HQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -2962,11 +2957,11 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/scope-manager': 5.59.1 - '@typescript-eslint/types': 5.59.1 - '@typescript-eslint/typescript-estree': 5.59.1(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.2 + '@typescript-eslint/types': 5.59.2 + '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) debug: 4.3.4 - eslint: 8.39.0 + eslint: 8.40.0 typescript: 5.0.4 transitivePeerDependencies: - supports-color @@ -2980,16 +2975,16 @@ packages: '@typescript-eslint/visitor-keys': 5.58.0 dev: true - /@typescript-eslint/scope-manager@5.59.1: - resolution: {integrity: sha512-mau0waO5frJctPuAzcxiNWqJR5Z8V0190FTSqRw1Q4Euop6+zTwHAf8YIXNwDOT29tyUDrQ65jSg9aTU/H0omA==} + /@typescript-eslint/scope-manager@5.59.2: + resolution: {integrity: sha512-dB1v7ROySwQWKqQ8rEWcdbTsFjh2G0vn8KUyvTXdPoyzSL6lLGkiXEV5CvpJsEe9xIdKV+8Zqb7wif2issoOFA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: - '@typescript-eslint/types': 5.59.1 - '@typescript-eslint/visitor-keys': 5.59.1 + '@typescript-eslint/types': 5.59.2 + '@typescript-eslint/visitor-keys': 5.59.2 dev: true - /@typescript-eslint/type-utils@5.59.1(eslint@8.39.0)(typescript@5.0.4): - resolution: {integrity: sha512-ZMWQ+Oh82jWqWzvM3xU+9y5U7MEMVv6GLioM3R5NJk6uvP47kZ7YvlgSHJ7ERD6bOY7Q4uxWm25c76HKEwIjZw==} + /@typescript-eslint/type-utils@5.59.2(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-b1LS2phBOsEy/T381bxkkywfQXkV1dWda/z0PhnIy3bC5+rQWQDS7fk9CSpcXBccPY27Z6vBEuaPBCKCgYezyQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: '*' @@ -2998,10 +2993,10 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/typescript-estree': 5.59.1(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.1(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 - eslint: 8.39.0 + eslint: 8.40.0 tsutils: 3.21.0(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: @@ -3013,8 +3008,8 @@ packages: engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true - /@typescript-eslint/types@5.59.1: - resolution: {integrity: sha512-dg0ICB+RZwHlysIy/Dh1SP+gnXNzwd/KS0JprD3Lmgmdq+dJAJnUPe1gNG34p0U19HvRlGX733d/KqscrGC1Pg==} + /@typescript-eslint/types@5.59.2: + resolution: {integrity: sha512-LbJ/HqoVs2XTGq5shkiKaNTuVv5tTejdHgfdjqRUGdYhjW1crm/M7og2jhVskMt8/4wS3T1+PfFvL1K3wqYj4w==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true @@ -3032,15 +3027,15 @@ packages: debug: 4.3.4 globby: 11.1.0 is-glob: 4.0.3 - semver: 7.4.0 + semver: 7.5.0 tsutils: 3.21.0(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - supports-color dev: true - /@typescript-eslint/typescript-estree@5.59.1(typescript@5.0.4): - resolution: {integrity: sha512-lYLBBOCsFltFy7XVqzX0Ju+Lh3WPIAWxYpmH/Q7ZoqzbscLiCW00LeYCdsUnnfnj29/s1WovXKh2gwCoinHNGA==} + /@typescript-eslint/typescript-estree@5.59.2(typescript@5.0.4): + resolution: {integrity: sha512-+j4SmbwVmZsQ9jEyBMgpuBD0rKwi9RxRpjX71Brr73RsYnEr3Lt5QZ624Bxphp8HUkSKfqGnPJp1kA5nl0Sh7Q==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: typescript: '*' @@ -3048,8 +3043,8 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/types': 5.59.1 - '@typescript-eslint/visitor-keys': 5.59.1 + '@typescript-eslint/types': 5.59.2 + '@typescript-eslint/visitor-keys': 5.59.2 debug: 4.3.4 globby: 11.1.0 is-glob: 4.0.3 @@ -3060,39 +3055,39 @@ packages: - supports-color dev: true - /@typescript-eslint/utils@5.58.0(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/utils@5.58.0(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-gAmLOTFXMXOC+zP1fsqm3VceKSBQJNzV385Ok3+yzlavNHZoedajjS4UyS21gabJYcobuigQPs/z71A9MdJFqQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 dependencies: - '@eslint-community/eslint-utils': 4.4.0(eslint@8.39.0) + '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@types/json-schema': 7.0.11 '@types/semver': 7.3.13 '@typescript-eslint/scope-manager': 5.58.0 '@typescript-eslint/types': 5.58.0 '@typescript-eslint/typescript-estree': 5.58.0(typescript@5.0.4) - eslint: 8.39.0 + eslint: 8.40.0 eslint-scope: 5.1.1 - semver: 7.4.0 + semver: 7.5.0 transitivePeerDependencies: - supports-color - typescript dev: true - /@typescript-eslint/utils@5.59.1(eslint@8.39.0)(typescript@5.0.4): - resolution: {integrity: sha512-MkTe7FE+K1/GxZkP5gRj3rCztg45bEhsd8HYjczBuYm+qFHP5vtZmjx3B0yUCDotceQ4sHgTyz60Ycl225njmA==} + /@typescript-eslint/utils@5.59.2(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-kSuF6/77TZzyGPhGO4uVp+f0SBoYxCDf+lW3GKhtKru/L8k/Hd7NFQxyWUeY7Z/KGB2C6Fe3yf2vVi4V9TsCSQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 dependencies: - '@eslint-community/eslint-utils': 4.4.0(eslint@8.39.0) + '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@types/json-schema': 7.0.11 '@types/semver': 7.3.13 - '@typescript-eslint/scope-manager': 5.59.1 - '@typescript-eslint/types': 5.59.1 - '@typescript-eslint/typescript-estree': 5.59.1(typescript@5.0.4) - eslint: 8.39.0 + '@typescript-eslint/scope-manager': 5.59.2 + '@typescript-eslint/types': 5.59.2 + '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) + eslint: 8.40.0 eslint-scope: 5.1.1 semver: 7.4.0 transitivePeerDependencies: @@ -3105,18 +3100,18 @@ packages: engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: '@typescript-eslint/types': 5.58.0 - eslint-visitor-keys: 3.4.0 + eslint-visitor-keys: 3.4.1 dev: true - /@typescript-eslint/visitor-keys@5.59.1: - resolution: {integrity: sha512-6waEYwBTCWryx0VJmP7JaM4FpipLsFl9CvYf2foAE8Qh/Y0s+bxWysciwOs0LTBED4JCaNxTZ5rGadB14M6dwA==} + /@typescript-eslint/visitor-keys@5.59.2: + resolution: {integrity: sha512-EEpsO8m3RASrKAHI9jpavNv9NlEUebV4qmF1OWxSTtKSFBpC1NCmWazDQHFivRf0O1DV11BA645yrLEVQ0/Lig==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: - '@typescript-eslint/types': 5.59.1 - eslint-visitor-keys: 3.4.0 + '@typescript-eslint/types': 5.59.2 + eslint-visitor-keys: 3.4.1 dev: true - /@vitejs/plugin-react@4.0.0(vite@4.3.3): + /@vitejs/plugin-react@4.0.0(vite@4.3.5): resolution: {integrity: sha512-HX0XzMjL3hhOYm+0s95pb0Z7F8O81G7joUHgfDd/9J/ZZf5k4xX6QAMFkKsHFxaHlf6X7GD7+XuaZ66ULiJuhQ==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -3126,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.3(@types/node@18.16.3) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - supports-color dev: true @@ -3137,8 +3132,8 @@ packages: open: 8.4.2 dev: true - /@vitest/coverage-istanbul@0.30.1(vitest@0.30.1): - resolution: {integrity: sha512-DGlvErzx3zzrqtKlwTq/vxOPBRmUU/qDdlxTZgPhIuyoQIUCiQBrQod9wlX5uhppyYZ1mgxf2XtStZmzZxcSug==} + /@vitest/coverage-istanbul@0.31.0(vitest@0.31.0): + resolution: {integrity: sha512-SaTI1PSpCRtBhJ5ihBx7Z+jgrFAQlDjuI4MFmKQ/HjyYWzEoaU+I062SquRrOLjJtVOHnwJdjVJXKi0dgFiR9Q==} peerDependencies: vitest: '>=0.30.0 <1' dependencies: @@ -3148,44 +3143,44 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.30.1(happy-dom@9.10.1) + vitest: 0.31.0(happy-dom@9.10.9) transitivePeerDependencies: - supports-color dev: true - /@vitest/expect@0.30.1: - resolution: {integrity: sha512-c3kbEtN8XXJSeN81iDGq29bUzSjQhjES2WR3aColsS4lPGbivwLtas4DNUe0jD9gg/FYGIteqOenfU95EFituw==} + /@vitest/expect@0.31.0: + resolution: {integrity: sha512-Jlm8ZTyp6vMY9iz9Ny9a0BHnCG4fqBa8neCF6Pk/c/6vkUk49Ls6UBlgGAU82QnzzoaUs9E/mUhq/eq9uMOv/g==} dependencies: - '@vitest/spy': 0.30.1 - '@vitest/utils': 0.30.1 + '@vitest/spy': 0.31.0 + '@vitest/utils': 0.31.0 chai: 4.3.7 dev: true - /@vitest/runner@0.30.1: - resolution: {integrity: sha512-W62kT/8i0TF1UBCNMRtRMOBWJKRnNyv9RrjIgdUryEe0wNpGZvvwPDLuzYdxvgSckzjp54DSpv1xUbv4BQ0qVA==} + /@vitest/runner@0.31.0: + resolution: {integrity: sha512-H1OE+Ly7JFeBwnpHTrKyCNm/oZgr+16N4qIlzzqSG/YRQDATBYmJb/KUn3GrZaiQQyL7GwpNHVZxSQd6juLCgw==} dependencies: - '@vitest/utils': 0.30.1 + '@vitest/utils': 0.31.0 concordance: 5.0.4 p-limit: 4.0.0 pathe: 1.1.0 dev: true - /@vitest/snapshot@0.30.1: - resolution: {integrity: sha512-fJZqKrE99zo27uoZA/azgWyWbFvM1rw2APS05yB0JaLwUIg9aUtvvnBf4q7JWhEcAHmSwbrxKFgyBUga6tq9Tw==} + /@vitest/snapshot@0.31.0: + resolution: {integrity: sha512-5dTXhbHnyUMTMOujZPB0wjFjQ6q5x9c8TvAsSPUNKjp1tVU7i9pbqcKPqntyu2oXtmVxKbuHCqrOd+Ft60r4tg==} dependencies: magic-string: 0.30.0 pathe: 1.1.0 pretty-format: 27.5.1 dev: true - /@vitest/spy@0.30.1: - resolution: {integrity: sha512-YfJeIf37GvTZe04ZKxzJfnNNuNSmTEGnla2OdL60C8od16f3zOfv9q9K0nNii0NfjDJRt/CVN/POuY5/zTS+BA==} + /@vitest/spy@0.31.0: + resolution: {integrity: sha512-IzCEQ85RN26GqjQNkYahgVLLkULOxOm5H/t364LG0JYb3Apg0PsYCHLBYGA006+SVRMWhQvHlBBCyuByAMFmkg==} dependencies: tinyspy: 2.1.0 dev: true - /@vitest/utils@0.30.1: - resolution: {integrity: sha512-/c8Xv2zUVc+rnNt84QF0Y0zkfxnaGhp87K2dYJMLtLOIckPzuxLVzAtFCicGFdB4NeBHNzTRr1tNn7rCtQcWFA==} + /@vitest/utils@0.31.0: + resolution: {integrity: sha512-kahaRyLX7GS1urekRXN2752X4gIgOGVX4Wo8eDUGUkTWlGpXzf5ZS6N9RUUS+Re3XEE8nVGqNyxkSxF5HXlGhQ==} dependencies: concordance: 5.0.4 loupe: 2.3.6 @@ -3667,7 +3662,7 @@ packages: dev: true /concat-map@0.0.1: - resolution: {integrity: sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=} + resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} /concordance@5.0.4: resolution: {integrity: sha512-OAcsnTEYu1ARJqWVGwf4zh4JDfHZEaSNlNccFmt8YjB2l/n19/PF2viLINHc57vO4FKIAFl2FWASIGZZWZ2Kxw==} @@ -3679,7 +3674,7 @@ packages: js-string-escape: 1.0.1 lodash: 4.17.21 md5-hex: 3.0.1 - semver: 7.4.0 + semver: 7.5.0 well-known-symbols: 2.0.0 dev: true @@ -3747,7 +3742,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@18.16.3)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3756,9 +3751,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 18.16.3 + '@types/node': 20.1.0 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@18.16.3)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.0)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -4369,16 +4364,16 @@ packages: resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==} engines: {node: '>=10'} - /eslint-config-prettier@8.8.0(eslint@8.39.0): + /eslint-config-prettier@8.8.0(eslint@8.40.0): resolution: {integrity: sha512-wLbQiFre3tdGgpDv67NQKnJuTlcUVYHas3k+DZCc2U2BadthoEY4B7hLPvAxaqdyOGCzuLfii2fqGph10va7oA==} hasBin: true peerDependencies: eslint: '>=7.0.0' dependencies: - eslint: 8.39.0 + eslint: 8.40.0 dev: true - /eslint-config-react-app@7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0)(typescript@5.0.4): + /eslint-config-react-app@7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-K6rNzvkIeHaTd8m/QEh1Zko0KI7BACWkkneSs6s9cKZC/J27X3eZR6Upt1jkmZ/4FK+XUOPPxMEN7+lbUXfSlA==} engines: {node: '>=14.0.0'} peerDependencies: @@ -4389,20 +4384,20 @@ packages: optional: true dependencies: '@babel/core': 7.21.4 - '@babel/eslint-parser': 7.21.3(@babel/core@7.21.4)(eslint@8.39.0) + '@babel/eslint-parser': 7.21.3(@babel/core@7.21.4)(eslint@8.40.0) '@rushstack/eslint-patch': 1.2.0 - '@typescript-eslint/eslint-plugin': 5.59.1(@typescript-eslint/parser@5.59.1)(eslint@8.39.0)(typescript@5.0.4) - '@typescript-eslint/parser': 5.59.1(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) babel-preset-react-app: 10.0.1 confusing-browser-globals: 1.0.11 - eslint: 8.39.0 - eslint-plugin-flowtype: 8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.39.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.1)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) - eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.1)(eslint@8.39.0)(typescript@5.0.4) - eslint-plugin-jsx-a11y: 6.7.1(eslint@8.39.0) - eslint-plugin-react: 7.32.2(eslint@8.39.0) - eslint-plugin-react-hooks: 4.6.0(eslint@8.39.0) - eslint-plugin-testing-library: 5.10.2(eslint@8.39.0)(typescript@5.0.4) + eslint: 8.40.0 + eslint-plugin-flowtype: 8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.40.0) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + eslint-plugin-jsx-a11y: 6.7.1(eslint@8.40.0) + eslint-plugin-react: 7.32.2(eslint@8.40.0) + eslint-plugin-react-hooks: 4.6.0(eslint@8.40.0) + eslint-plugin-testing-library: 5.10.2(eslint@8.40.0)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@babel/plugin-syntax-flow' @@ -4427,7 +4422,7 @@ packages: - supports-color dev: true - /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.1)(eslint-plugin-import@2.27.5)(eslint@8.39.0): + /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0): resolution: {integrity: sha512-TdJqPHs2lW5J9Zpe17DZNQuDnox4xo2o+0tE7Pggain9Rbc19ik8kFtXdxZ250FVx2kF4vlt2RSf4qlUpG7bhw==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -4436,9 +4431,9 @@ packages: dependencies: debug: 4.3.4 enhanced-resolve: 5.12.0 - eslint: 8.39.0 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.1)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.1)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) + eslint: 8.40.0 + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) get-tsconfig: 4.5.0 globby: 13.1.3 is-core-module: 2.12.0 @@ -4451,7 +4446,7 @@ packages: - supports-color dev: true - /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.1)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0): + /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-j4GT+rqzCoRKHwURX7pddtIPGySnX9Si/cgMI5ztrcqOPtk5dDEeZ34CQVPphnqkJytlc97Vuk05Um2mJ3gEQA==} engines: {node: '>=4'} peerDependencies: @@ -4472,16 +4467,16 @@ packages: eslint-import-resolver-webpack: optional: true dependencies: - '@typescript-eslint/parser': 5.59.1(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) debug: 3.2.7 - eslint: 8.39.0 + eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.1)(eslint-plugin-import@2.27.5)(eslint@8.39.0) + eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0) transitivePeerDependencies: - supports-color dev: true - /eslint-plugin-flowtype@8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.39.0): + /eslint-plugin-flowtype@8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.40.0): resolution: {integrity: sha512-dX8l6qUL6O+fYPtpNRideCFSpmWOUVx5QcaGLVqe/vlDiBSe4vYljDWDETwnyFzpl7By/WVIu6rcrniCgH9BqQ==} engines: {node: '>=12.0.0'} peerDependencies: @@ -4491,12 +4486,12 @@ packages: dependencies: '@babel/plugin-syntax-flow': 7.21.4(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx': 7.21.0(@babel/core@7.21.4) - eslint: 8.39.0 + eslint: 8.40.0 lodash: 4.17.21 string-natural-compare: 3.0.1 dev: true - /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.1)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0): + /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-LmEt3GVofgiGuiE+ORpnvP+kAm3h6MLZJ4Q5HCyHADofsb4VzXFsRiWj3c0OFiV+3DWFh0qg3v9gcPlfc3zRow==} engines: {node: '>=4'} peerDependencies: @@ -4506,15 +4501,15 @@ packages: '@typescript-eslint/parser': optional: true dependencies: - '@typescript-eslint/parser': 5.59.1(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) array-includes: 3.1.6 array.prototype.flat: 1.3.1 array.prototype.flatmap: 1.3.1 debug: 3.2.7 doctrine: 2.1.0 - eslint: 8.39.0 + eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.1)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) has: 1.0.3 is-core-module: 2.12.0 is-glob: 4.0.3 @@ -4529,7 +4524,7 @@ packages: - supports-color dev: true - /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.1)(eslint@8.39.0)(typescript@5.0.4): + /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-PWLUEXeeF7C9QGKqvdSbzLOiLTx+bno7/HC9eefePfEb257QFHg7ye3dh80AZVkaa/RQsBB1Q/ORQvg2X7F0NQ==} engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0} peerDependencies: @@ -4542,15 +4537,15 @@ packages: jest: optional: true dependencies: - '@typescript-eslint/eslint-plugin': 5.59.1(@typescript-eslint/parser@5.59.1)(eslint@8.39.0)(typescript@5.0.4) - '@typescript-eslint/experimental-utils': 5.58.0(eslint@8.39.0)(typescript@5.0.4) - eslint: 8.39.0 + '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/experimental-utils': 5.58.0(eslint@8.40.0)(typescript@5.0.4) + eslint: 8.40.0 transitivePeerDependencies: - supports-color - typescript dev: true - /eslint-plugin-jsx-a11y@6.7.1(eslint@8.39.0): + /eslint-plugin-jsx-a11y@6.7.1(eslint@8.40.0): resolution: {integrity: sha512-63Bog4iIethyo8smBklORknVjB0T2dwB8Mr/hIC+fBS0uyHdYYpzM/Ed+YC8VxTjlXHEWFOdmgwcDn1U2L9VCA==} engines: {node: '>=4.0'} peerDependencies: @@ -4565,7 +4560,7 @@ packages: axobject-query: 3.1.1 damerau-levenshtein: 1.0.8 emoji-regex: 9.2.2 - eslint: 8.39.0 + eslint: 8.40.0 has: 1.0.3 jsx-ast-utils: 3.3.3 language-tags: 1.0.5 @@ -4575,7 +4570,7 @@ packages: semver: 6.3.0 dev: true - /eslint-plugin-prettier@4.2.1(eslint-config-prettier@8.8.0)(eslint@8.39.0)(prettier@2.8.8): + /eslint-plugin-prettier@4.2.1(eslint-config-prettier@8.8.0)(eslint@8.40.0)(prettier@2.8.8): resolution: {integrity: sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==} engines: {node: '>=12.0.0'} peerDependencies: @@ -4586,22 +4581,22 @@ packages: eslint-config-prettier: optional: true dependencies: - eslint: 8.39.0 - eslint-config-prettier: 8.8.0(eslint@8.39.0) + eslint: 8.40.0 + eslint-config-prettier: 8.8.0(eslint@8.40.0) prettier: 2.8.8 prettier-linter-helpers: 1.0.0 dev: true - /eslint-plugin-react-hooks@4.6.0(eslint@8.39.0): + /eslint-plugin-react-hooks@4.6.0(eslint@8.40.0): resolution: {integrity: sha512-oFc7Itz9Qxh2x4gNHStv3BqJq54ExXmfC+a1NjAta66IAN87Wu0R/QArgIS9qKzX3dXKPI9H5crl9QchNMY9+g==} engines: {node: '>=10'} peerDependencies: eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 dependencies: - eslint: 8.39.0 + eslint: 8.40.0 dev: true - /eslint-plugin-react@7.32.2(eslint@8.39.0): + /eslint-plugin-react@7.32.2(eslint@8.40.0): resolution: {integrity: sha512-t2fBMa+XzonrrNkyVirzKlvn5RXzzPwRHtMvLAtVZrt8oxgnTQaYbU6SXTOO1mwQgp1y5+toMSKInnzGr0Knqg==} engines: {node: '>=4'} peerDependencies: @@ -4611,7 +4606,7 @@ packages: array.prototype.flatmap: 1.3.1 array.prototype.tosorted: 1.1.1 doctrine: 2.1.0 - eslint: 8.39.0 + eslint: 8.40.0 estraverse: 5.3.0 jsx-ast-utils: 3.3.3 minimatch: 3.1.2 @@ -4625,14 +4620,14 @@ packages: string.prototype.matchall: 4.0.8 dev: true - /eslint-plugin-testing-library@5.10.2(eslint@8.39.0)(typescript@5.0.4): + /eslint-plugin-testing-library@5.10.2(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-f1DmDWcz5SDM+IpCkEX0lbFqrrTs8HRsEElzDEqN/EBI0hpRj8Cns5+IVANXswE8/LeybIJqPAOQIFu2j5Y5sw==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0, npm: '>=6'} peerDependencies: eslint: ^7.5.0 || ^8.0.0 dependencies: - '@typescript-eslint/utils': 5.59.1(eslint@8.39.0)(typescript@5.0.4) - eslint: 8.39.0 + '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + eslint: 8.40.0 transitivePeerDependencies: - supports-color - typescript @@ -4659,20 +4654,20 @@ packages: engines: {node: '>=10'} dev: true - /eslint-visitor-keys@3.4.0: - resolution: {integrity: sha512-HPpKPUBQcAsZOsHAFwTtIKcYlCje62XB7SEAcxjtmW6TD1WVpkS6i6/hOVtTZIl4zGj/mBqpFVGvaDneik+VoQ==} + /eslint-visitor-keys@3.4.1: + resolution: {integrity: sha512-pZnmmLwYzf+kWaM/Qgrvpen51upAktaaiI01nsJD/Yr3lMOdNtq0cxkrrg16w64VtisN6okbs7Q8AfGqj4c9fA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true - /eslint@8.39.0: - resolution: {integrity: sha512-mwiok6cy7KTW7rBpo05k6+p4YVZByLNjAZ/ACB9DRCu4YDRwjXI01tWHp6KAUWelsBetTxKK/2sHB0vdS8Z2Og==} + /eslint@8.40.0: + resolution: {integrity: sha512-bvR+TsP9EHL3TqNtj9sCNJVAFK3fBN8Q7g5waghxyRsPLIMwL73XSKnZFK0hk/O2ANC+iAoq6PWMQ+IfBAJIiQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} hasBin: true dependencies: - '@eslint-community/eslint-utils': 4.4.0(eslint@8.39.0) + '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@eslint-community/regexpp': 4.5.0 - '@eslint/eslintrc': 2.0.2 - '@eslint/js': 8.39.0 + '@eslint/eslintrc': 2.0.3 + '@eslint/js': 8.40.0 '@humanwhocodes/config-array': 0.11.8 '@humanwhocodes/module-importer': 1.0.1 '@nodelib/fs.walk': 1.2.8 @@ -4683,8 +4678,8 @@ packages: doctrine: 3.0.0 escape-string-regexp: 4.0.0 eslint-scope: 7.2.0 - eslint-visitor-keys: 3.4.0 - espree: 9.5.1 + eslint-visitor-keys: 3.4.1 + espree: 9.5.2 esquery: 1.5.0 esutils: 2.0.3 fast-deep-equal: 3.1.3 @@ -4713,13 +4708,13 @@ packages: - supports-color dev: true - /espree@9.5.1: - resolution: {integrity: sha512-5yxtHSZXRSW5pvv3hAlXM5+/Oswi1AUFqBmbibKb5s6bp3rGIDkyXU6xCoyuuLhijr4SFwPrXRoZjz0AZDN9tg==} + /espree@9.5.2: + resolution: {integrity: sha512-7OASN1Wma5fum5SrNhFMAMJxOUAbhyfQ8dQ//PJaJbNw0URTPWqIghHWt1MmAANKhHZIYOHruW4Kw4ruUWOdGw==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: acorn: 8.8.2 acorn-jsx: 5.3.2(acorn@8.8.2) - eslint-visitor-keys: 3.4.0 + eslint-visitor-keys: 3.4.1 dev: true /esprima@4.0.1: @@ -5161,8 +5156,8 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.10.1: - resolution: {integrity: sha512-4wEWL9jYxtjcvGJDACtcelTBD86Sv//Kwn3G/+zb0mrNF3sC/JC0lTznqLu4Vw4cNUfR4WLMjiC+jeAr8CxM2g==} + /happy-dom@9.10.9: + resolution: {integrity: sha512-3RnOyu6buPMpDAyOpp8yfR5Xi/k2p5MhrDwlG/dgpVHkptFN5IqubdbGOQU5luB7ANh6a08GOuiB+Bo9JCzCBw==} dependencies: css.escape: 1.5.1 he: 1.2.0 @@ -5651,7 +5646,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 18.16.3 + '@types/node': 20.1.0 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -6132,7 +6127,7 @@ packages: dependencies: hosted-git-info: 4.1.0 is-core-module: 2.12.0 - semver: 7.4.0 + semver: 7.5.0 validate-npm-package-license: 3.0.4 dev: true @@ -6558,26 +6553,26 @@ packages: engines: {node: '>=0.10.0'} dev: true - /react-router-dom@6.11.0(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-Q3mK1c/CYoF++J6ZINz7EZzwlgSOZK/kc7lxIA7PhtWhKju4KfF1WHqlx0kVCIFJAWztuYVpXZeljEbds8z4Og==} + /react-router-dom@6.11.1(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-dPC2MhoPeTQ1YUOt5uIK376SMNWbwUxYRWk2ZmTT4fZfwlOvabF8uduRKKJIyfkCZvMgiF0GSCQckmkGGijIrg==} engines: {node: '>=14'} peerDependencies: react: '>=16.8 || 18' react-dom: '>=16.8' dependencies: - '@remix-run/router': 1.6.0 + '@remix-run/router': 1.6.1 react: 18.2.0 react-dom: 18.2.0(react@18.2.0) - react-router: 6.11.0(react@18.2.0) + react-router: 6.11.1(react@18.2.0) dev: false - /react-router@6.11.0(react@18.2.0): - resolution: {integrity: sha512-hTm6KKNpj9SDG4syIWRjCU219O0RZY8RUPobCFt9p+PlF7nnkRgMoh2DieTKvw3F3Mw6zg565HGnSv8BuoY5oQ==} + /react-router@6.11.1(react@18.2.0): + resolution: {integrity: sha512-OZINSdjJ2WgvAi7hgNLazrEV8SGn6xrKA+MkJe9wVDMZ3zQ6fdJocUjpCUCI0cNrelWjcvon0S/QK/j0NzL3KA==} engines: {node: '>=14'} peerDependencies: react: '>=16.8 || 18' dependencies: - '@remix-run/router': 1.6.0 + '@remix-run/router': 1.6.1 react: 18.2.0 dev: false @@ -6823,16 +6818,16 @@ packages: hasBin: true dev: true - /semver@7.3.8: - resolution: {integrity: sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==} + /semver@7.4.0: + resolution: {integrity: sha512-RgOxM8Mw+7Zus0+zcLEUn8+JfoLpj/huFTItQy2hsM4khuC1HYRDp0cU482Ewn/Fcy6bCjufD8vAj7voC66KQw==} engines: {node: '>=10'} hasBin: true dependencies: lru-cache: 6.0.0 dev: true - /semver@7.4.0: - resolution: {integrity: sha512-RgOxM8Mw+7Zus0+zcLEUn8+JfoLpj/huFTItQy2hsM4khuC1HYRDp0cU482Ewn/Fcy6bCjufD8vAj7voC66KQw==} + /semver@7.5.0: + resolution: {integrity: sha512-+XC0AD/R7Q2mPSRuy2Id0+CGTZ98+8f+KvwirxOKIEyid+XSx6HbC63p+O4IndTHuX5Z+JxQ0TghCkO5Cg/2HA==} engines: {node: '>=10'} hasBin: true dependencies: @@ -7080,8 +7075,8 @@ packages: acorn: 8.8.2 dev: true - /stylis@4.1.4: - resolution: {integrity: sha512-USf5pszRYwuE6hg9by0OkKChkQYEXfkeTtm0xKw+jqQhwyjCVLdYyMBK7R+n7dhzsblAWJnGxju4vxq5eH20GQ==} + /stylis@4.2.0: + resolution: {integrity: sha512-Orov6g6BB1sDfYgzWfTHDOxamtX1bE/zo104Dh9e6fqJ3PooipYyfJ0pUmrZO2wAvO8YbEyeFrkV91XTsGMSrw==} dev: false /supports-color@5.5.0: @@ -7166,8 +7161,8 @@ packages: resolution: {integrity: sha512-iyziEiyFxX4kyxSp+MtY1oCH/lvjH3PxFN8PGCDeqcZWAJ/i+9y+nL85w99PxVzrIvew/GSkSbDYtiGVa85Afg==} dev: true - /tinypool@0.4.0: - resolution: {integrity: sha512-2ksntHOKf893wSAH4z/+JbPpi92esw8Gn9N2deXX+B0EO92hexAVI9GIZZPx7P5aYo5KULfeOSt3kMOmSOy6uA==} + /tinypool@0.5.0: + resolution: {integrity: sha512-paHQtnrlS1QZYKF/GnLoOM/DN9fqaGOFbCbxzAhwniySnzl9Ebk8w73/dd34DAhe/obUbPAOldTyYXQZxnPBPQ==} engines: {node: '>=14.0.0'} dev: true @@ -7201,7 +7196,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@18.16.3)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.0)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7220,7 +7215,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 18.16.3 + '@types/node': 20.1.0 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7418,8 +7413,8 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.30.1(@types/node@18.16.3): - resolution: {integrity: sha512-vTikpU/J7e6LU/8iM3dzBo8ZhEiKZEKRznEMm+mJh95XhWaPrJQraT/QsT2NWmuEf+zgAoMe64PKT7hfZ1Njmg==} + /vite-node@0.31.0(@types/node@20.1.0): + resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true dependencies: @@ -7428,7 +7423,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.3(@types/node@18.16.3) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - '@types/node' - less @@ -7439,7 +7434,7 @@ packages: - terser dev: true - /vite-plugin-eslint@1.8.1(eslint@8.39.0)(vite@4.3.3): + /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.5): resolution: {integrity: sha512-PqdMf3Y2fLO9FsNPmMX+//2BF5SF8nEWspZdgl4kSt7UvHDRHVVfHvxsD7ULYzZrJDGRxR81Nq7TOFgwMnUang==} peerDependencies: eslint: '>=7' @@ -7447,12 +7442,12 @@ packages: dependencies: '@rollup/pluginutils': 4.2.1 '@types/eslint': 8.37.0 - eslint: 8.39.0 + eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.3(@types/node@18.16.3) + vite: 4.3.5(@types/node@20.1.0) dev: true - /vite-plugin-istanbul@4.0.1(vite@4.3.3): + /vite-plugin-istanbul@4.0.1(vite@4.3.5): resolution: {integrity: sha512-1fUCJyYvt/vkDQWR/15knwCk+nWmNbVbmZTXf/X4XD0dcdmJsYrZF5JQo7ttYxFyflGH2SVu+XRlpN06CakKPQ==} peerDependencies: vite: '>=2.9.1 <= 5' @@ -7461,25 +7456,26 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.3(@types/node@18.16.3) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - supports-color dev: true - /vite-plugin-svgr@2.4.0(vite@4.3.3): - resolution: {integrity: sha512-q+mJJol6ThvqkkJvvVFEndI4EaKIjSI0I3jNFgSoC9fXAz1M7kYTVUin8fhUsFojFDKZ9VHKtX6NXNaOLpbsHA==} + /vite-plugin-svgr@3.2.0(vite@4.3.5): + resolution: {integrity: sha512-Uvq6niTvhqJU6ga78qLKBFJSDvxWhOnyfQSoKpDPMAGxJPo5S3+9hyjExE5YDj6Lpa4uaLkGc1cBgxXov+LjSw==} peerDependencies: vite: ^2.6.0 || 3 || 4 dependencies: '@rollup/pluginutils': 5.0.2 - '@svgr/core': 6.5.1 - vite: 4.3.3(@types/node@18.16.3) + '@svgr/core': 7.0.0 + '@svgr/plugin-jsx': 7.0.0 + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - rollup - supports-color dev: true - /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.3): + /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.5): resolution: {integrity: sha512-jGpus0eUy5qbbMVGiTxCL1iB9ZGN6Bd37VGLJU39kTDD6ZfULTTb1bcc5IeTWqWJKiWV5YihCaibeASPiGi8kw==} peerDependencies: vite: '*' @@ -7490,13 +7486,13 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.3(@types/node@18.16.3) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - supports-color - typescript dev: true - /vite@3.2.5(@types/node@18.16.3): + /vite@3.2.5(@types/node@18.16.5): resolution: {integrity: sha512-4mVEpXpSOgrssFZAOmGIr85wPHKvaDAcXqxVxVRZhljkJOMZi1ibLibzjLHzJvcok8BMguLc7g1W6W/GqZbLdQ==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7521,7 +7517,7 @@ packages: terser: optional: true dependencies: - '@types/node': 18.16.3 + '@types/node': 18.16.5 esbuild: 0.15.18 postcss: 8.4.21 resolve: 1.22.2 @@ -7530,8 +7526,8 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.3(@types/node@18.16.3): - resolution: {integrity: sha512-MwFlLBO4udZXd+VBcezo3u8mC77YQk+ik+fbc0GZWGgzfbPP+8Kf0fldhARqvSYmtIWoAJ5BXPClUbMTlqFxrA==} + /vite@4.3.5(@types/node@20.1.0): + resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true peerDependencies: @@ -7555,7 +7551,7 @@ packages: terser: optional: true dependencies: - '@types/node': 18.16.3 + '@types/node': 20.1.0 esbuild: 0.17.18 postcss: 8.4.23 rollup: 3.21.0 @@ -7568,10 +7564,10 @@ packages: hasBin: true dependencies: '@types/express': 4.17.17 - '@types/node': 18.16.3 + '@types/node': 18.16.5 '@vitest-preview/dev-utils': 0.0.1 express: 4.18.2 - vite: 3.2.5(@types/node@18.16.3) + vite: 3.2.5(@types/node@18.16.5) transitivePeerDependencies: - less - sass @@ -7581,8 +7577,8 @@ packages: - terser dev: true - /vitest@0.30.1(happy-dom@9.10.1): - resolution: {integrity: sha512-y35WTrSTlTxfMLttgQk4rHcaDkbHQwDP++SNwPb+7H8yb13Q3cu2EixrtHzF27iZ8v0XCciSsLg00RkPAzB/aA==} + /vitest@0.31.0(happy-dom@9.10.9): + resolution: {integrity: sha512-JwWJS9p3GU9GxkG7eBSmr4Q4x4bvVBSswaCFf1PBNHiPx00obfhHRJfgHcnI0ffn+NMlIh9QGvG75FlaIBdKGA==} engines: {node: '>=v14.18.0'} hasBin: true peerDependencies: @@ -7614,30 +7610,29 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 18.16.3 - '@vitest/expect': 0.30.1 - '@vitest/runner': 0.30.1 - '@vitest/snapshot': 0.30.1 - '@vitest/spy': 0.30.1 - '@vitest/utils': 0.30.1 + '@types/node': 20.1.0 + '@vitest/expect': 0.31.0 + '@vitest/runner': 0.31.0 + '@vitest/snapshot': 0.31.0 + '@vitest/spy': 0.31.0 + '@vitest/utils': 0.31.0 acorn: 8.8.2 acorn-walk: 8.2.0 cac: 6.7.14 chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.10.1 + happy-dom: 9.10.9 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 picocolors: 1.0.0 - source-map: 0.6.1 std-env: 3.3.2 strip-literal: 1.0.1 tinybench: 2.4.0 - tinypool: 0.4.0 - vite: 4.3.3(@types/node@18.16.3) - vite-node: 0.30.1(@types/node@18.16.3) + tinypool: 0.5.0 + vite: 4.3.5(@types/node@20.1.0) + vite-node: 0.31.0(@types/node@20.1.0) why-is-node-running: 2.2.2 transitivePeerDependencies: - less