RPJosh
/
authelia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master' into build-reproducible

pull/5232/head
James Elliott 2023-05-08 16:09:43 +10:00
parent 08c6323df7 83cd09db79
commit a4d3070dc6
No known key found for this signature in database
GPG Key ID: 0F1C4A096E857E49
192 changed files with 6988 additions and 3970 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/FUNDING.yml vendored
View File

@ -3,7 +3,7 @@
# github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2] # github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
# patreon: # Replace with a single Patreon username # patreon: # Replace with a single Patreon username
open_collective: authelia-sponsors open_collective: 'authelia-sponsors'
# ko_fi: # Replace with a single Ko-fi username # ko_fi: # Replace with a single Ko-fi username
# tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel # tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
# community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry # community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry

254
.github/ISSUE_TEMPLATE/bug-report.yml vendored
View File

@ -1,12 +1,12 @@
--- ---
name: Bug Report name: 'Bug Report'
description: Report a bug description: 'Report a bug'
labels: labels:
- type/bug/unconfirmed - 'type/bug/unconfirmed'
- status/needs-triage - 'status/needs-triage'
- priority/4/normal - 'priority/4/normal'
body: body:
- type: markdown - type: 'markdown'
attributes: attributes:
value: | value: |
Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first. Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first.
@ -25,160 +25,190 @@ body:
- Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section. - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section.
- If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section. - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section.
7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues. 7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues.
- type: dropdown - type: 'dropdown'
id: version id: 'version'
attributes: attributes:
label: Version label: |
description: What version(s) of Authelia can you reproduce this bug on? Version
description: |
What version(s) of Authelia can you reproduce this bug on?
multiple: true multiple: true
options: options:
- v4.37.5 - 'v4.37.5'
- v4.37.4 - 'v4.37.4'
- v4.37.3 - 'v4.37.3'
- v4.37.2 - 'v4.37.2'
- v4.37.1 - 'v4.37.1'
- v4.37.0 - 'v4.37.0'
- v4.36.9 - 'v4.36.9'
- v4.36.8 - 'v4.36.8'
- v4.36.7 - 'v4.36.7'
- v4.36.6 - 'v4.36.6'
- v4.36.5 - 'v4.36.5'
- v4.36.4 - 'v4.36.4'
- v4.36.3 - 'v4.36.3'
- v4.36.2 - 'v4.36.2'
- v4.36.1 - 'v4.36.1'
- v4.36.0 - 'v4.36.0'
- v4.35.6 - 'v4.35.6'
- v4.35.5 - 'v4.35.5'
- v4.35.4 - 'v4.35.4'
- v4.35.3 - 'v4.35.3'
- v4.35.2 - 'v4.35.2'
- v4.35.1 - 'v4.35.1'
- v4.35.0 - 'v4.35.0'
- v4.34.6 - 'v4.34.6'
- v4.34.5 - 'v4.34.5'
- v4.34.4 - 'v4.34.4'
- v4.34.3 - 'v4.34.3'
- v4.34.2 - 'v4.34.2'
- v4.34.1 - 'v4.34.1'
- v4.34.0 - 'v4.34.0'
- v4.33.2 - 'v4.33.2'
- v4.33.1 - 'v4.33.1'
- v4.33.0 - 'v4.33.0'
- v4.32.2 - 'v4.32.2'
- v4.32.1 - 'v4.32.1'
- v4.32.0 - 'v4.32.0'
validations: validations:
required: true required: true
- type: dropdown - type: 'dropdown'
id: deployment id: 'deployment'
attributes: attributes:
label: Deployment Method label: |
description: How are you deploying Authelia? Deployment Method
description: |
How are you deploying Authelia?
options: options:
- Docker - 'Docker'
- Kubernetes - 'Kubernetes'
- Bare-metal - 'Bare-metal'
- Other - 'Other'
validations: validations:
required: true required: true
- type: dropdown - type: 'dropdown'
id: proxy id: 'proxy'
attributes: attributes:
label: Reverse Proxy label: |
description: What reverse proxy are you using? Reverse Proxy
description: |
What reverse proxy are you using?
options: options:
- Caddy - 'Caddy'
- Traefik - 'Traefik'
- Envoy - 'Envoy'
- Istio - 'Istio'
- NGINX - 'NGINX'
- SWAG - 'SWAG'
- NGINX Proxy Manager - 'NGINX Proxy Manager'
- HAProxy - 'HAProxy'
validations: validations:
required: true required: true
- type: input - type: 'input'
id: proxy-version id: 'proxy-version'
attributes: attributes:
label: Reverse Proxy Version label: |
description: What is the version of your reverse proxy? Reverse Proxy Version
placeholder: x.x.x description: |
What is the version of your reverse proxy?
placeholder: 'x.x.x'
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: description id: 'description'
attributes: attributes:
label: Description label: |
description: Describe the bug. Description
description: |
Describe the bug.
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: reproduction id: 'reproduction'
attributes: attributes:
label: Reproduction label: |
description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. Reproduction
description: |
Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: expectations id: 'expectations'
attributes: attributes:
label: Expectations label: |
description: Describe the desired or expected results. Expectations
description: |
Describe the desired or expected results.
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: configuration id: 'configuration'
attributes: attributes:
label: Configuration (Authelia) label: |
description: Provide a complete configuration file (the template will automatically put this content in a code block). Configuration (Authelia)
render: yaml description: |
Provide a complete configuration file (the template will automatically put this content in a code block).
render: 'yaml'
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: logs id: 'logs'
attributes: attributes:
label: Logs (Authelia) label: |
Logs (Authelia)
description: | description: |
Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide. Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide.
The template will automatically put this content in a code block so you can just paste it. The template will automatically put this content in a code block so you can just paste it.
render: shell render: 'shell'
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: logs-other id: 'logs-other'
attributes: attributes:
label: Logs (Proxy / Application) label: |
description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). Logs (Proxy / Application)
render: shell description: |
Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
render: 'shell'
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: documentation id: 'documentation'
attributes: attributes:
label: Documentation label: |
description: Provide any relevant specification or other documentation if applicable. Documentation
description: |
Provide any relevant specification or other documentation if applicable.
validations: validations:
required: false required: false
- type: checkboxes - type: 'checkboxes'
id: checklist id: 'checklist'
attributes: attributes:
label: Pre-Submission Checklist label: |
description: By submitting this issue confirm all of the following. Pre-Submission Checklist
description: |
By submitting this issue confirm all of the following.
options: options:
- label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) - label: |
I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
required: true required: true
- label: This is a bug report and not a support request - label: |
This is a bug report and not a support request
required: true required: true
- label: I have read the security policy and this bug report is not a security issue or security related issue - label: |
I have read the security policy and this bug report is not a security issue or security related issue
required: true required: true
- label: I have either included the complete configuration file or I am sure it's unrelated to the configuration - label: |
I have either included the complete configuration file or I am sure it's unrelated to the configuration
required: true required: true
- label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide - label: |
I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
required: true required: true
- label: I have checked for related proxy or application logs and included them if available - label: |
I have checked for related proxy or application logs and included them if available
required: true required: true
- label: I have checked for related issues and checked the documentation - label: |
I have checked for related issues and checked the documentation
required: true required: true
... ...

36
.github/ISSUE_TEMPLATE/config.yml vendored
View File

@ -1,22 +1,22 @@
--- ---
blank_issues_enabled: false blank_issues_enabled: false
contact_links: contact_links:
- name: Idea - name: 'Idea'
url: https://github.com/authelia/authelia/discussions/new?category=ideas url: 'https://github.com/authelia/authelia/discussions/new?category=ideas'
about: Submit an Idea for Voting about: 'Submit an Idea for Voting'
- name: Question - name: 'Question'
url: https://github.com/authelia/authelia/discussions/new?category=q-a url: 'https://github.com/authelia/authelia/discussions/new?category=q-a'
about: Ask a Question about: 'Ask a Question'
- name: Discussion - name: 'Discussion'
url: https://github.com/authelia/authelia/discussions/new url: 'https://github.com/authelia/authelia/discussions/new'
about: Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics about: 'Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics'
- name: Documentation - name: 'Documentation'
url: https://www.authelia.com/ url: 'https://www.authelia.com/'
about: Read the Documentation about: 'Read the Documentation'
- name: Matrix - name: 'Matrix'
url: https://matrix.to/#/#community:authelia.com url: 'https://matrix.to/#/#community:authelia.com'
about: Discuss Authelia with the Developers on Matrix which is the preferred method of contact about: 'Discuss Authelia with the Developers on Matrix which is the preferred method of contact'
- name: Discord - name: 'Discord'
url: https://discord.authelia.com url: 'https://discord.authelia.com'
about: Discuss Authelia with the Developers on Discord which is bridged to Matrix about: 'Discuss Authelia with the Developers on Discord which is bridged to Matrix'
... ...

68
.github/ISSUE_TEMPLATE/feature-request.yml vendored
View File

@ -1,12 +1,12 @@
--- ---
name: Feature Request name: 'Feature Request'
description: Submit a Feature Request description: 'Submit a Feature Request'
labels: labels:
- type/feature - 'type/feature'
- status/needs-design - 'status/needs-design'
- priority/4/normal - 'priority/4/normal'
body: body:
- type: markdown - type: 'markdown'
attributes: attributes:
value: | value: |
Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature. Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature.
@ -16,42 +16,54 @@ body:
1. Ensure there are no other similar feature requests. 1. Ensure there are no other similar feature requests.
2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already. 2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already.
3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist. 3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist.
- type: textarea - type: 'textarea'
id: description id: 'description'
attributes: attributes:
label: Description label: |
description: Describe the feature Description
description: |
Describe the feature
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: use-case id: 'use-case'
attributes: attributes:
label: Use Case label: |
description: Provide a use case Use Case
description: |
Provide a use case
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: details id: 'details'
attributes: attributes:
label: Details label: |
description: Describe the feature in detail Details
description: |
Describe the feature in detail
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: documentation id: 'documentation'
attributes: attributes:
label: Documentation label: |
description: Provide any relevant specification or other documentation if applicable Documentation
description: |
Provide any relevant specification or other documentation if applicable
validations: validations:
required: false required: false
- type: checkboxes - type: 'checkboxes'
id: checklist id: 'checklist'
attributes: attributes:
label: Pre-Submission Checklist label: |
description: By submitting this issue confirm all of the following Pre-Submission Checklist
description: |
By submitting this issue confirm all of the following
options: options:
- label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) - label: |
I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
required: true required: true
- label: I have checked for related issues and checked the documentation - label: |
I have checked for related issues and checked the documentation
required: true required: true
... ...

1
.yamllint.yml
View File

@ -11,6 +11,7 @@ yaml-files:
ignore: | ignore: |
api/openapi.yml api/openapi.yml
docs/pnpm-lock.yaml docs/pnpm-lock.yaml
docs/node_modules/
internal/configuration/test_resources/config_bad_quoting.yml internal/configuration/test_resources/config_bad_quoting.yml
web/pnpm-lock.yaml web/pnpm-lock.yaml
web/node_modules/ web/node_modules/

2
Dockerfile.coverage
View File

@ -15,7 +15,7 @@ RUN yarn global add pnpm && \
# ======================================= # =======================================
# ===== Build image for the backend ===== # ===== Build image for the backend =====
# ======================================= # =======================================
FROM golang:1.20.3-alpine AS builder-backend FROM golang:1.20.4-alpine AS builder-backend
WORKDIR /go/src/app WORKDIR /go/src/app

2
Dockerfile.dev
View File

@ -13,7 +13,7 @@ RUN yarn install --frozen-lockfile && yarn build
# ======================================= # =======================================
# ===== Build image for the backend ===== # ===== Build image for the backend =====
# ======================================= # =======================================
FROM golang:1.20.3-alpine AS builder-backend FROM golang:1.20.4-alpine AS builder-backend
WORKDIR /go/src/app WORKDIR /go/src/app

4
cmd/authelia-gen/helpers.go
View File

@ -62,6 +62,10 @@ var decodedTypes = []reflect.Type{
reflect.TypeOf(url.URL{}), reflect.TypeOf(url.URL{}),
reflect.TypeOf(time.Duration(0)), reflect.TypeOf(time.Duration(0)),
reflect.TypeOf(schema.Address{}), reflect.TypeOf(schema.Address{}),
reflect.TypeOf(schema.AddressTCP{}),
reflect.TypeOf(schema.AddressUDP{}),
reflect.TypeOf(schema.AddressLDAP{}),
reflect.TypeOf(schema.AddressSMTP{}),
reflect.TypeOf(schema.X509CertificateChain{}), reflect.TypeOf(schema.X509CertificateChain{}),
reflect.TypeOf(schema.PasswordDigest{}), reflect.TypeOf(schema.PasswordDigest{}),
reflect.TypeOf(rsa.PrivateKey{}), reflect.TypeOf(rsa.PrivateKey{}),

166
cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl
View File

@ -1,12 +1,12 @@
--- ---
name: Bug Report name: 'Bug Report'
description: Report a bug description: 'Report a bug'
labels: labels:
{{- range .Labels }} {{- range .Labels }}
- {{ . }} - '{{ . }}'
{{- end }} {{- end }}
body: body:
- type: markdown - type: 'markdown'
attributes: attributes:
value: | value: |
Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first. Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first.
@ -25,122 +25,152 @@ body:
- Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section. - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section.
- If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section. - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section.
7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues. 7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues.
- type: dropdown - type: 'dropdown'
id: version id: 'version'
attributes: attributes:
label: Version label: |
description: What version(s) of Authelia can you reproduce this bug on? Version
description: |
What version(s) of Authelia can you reproduce this bug on?
multiple: true multiple: true
options: options:
{{- range .Versions }} {{- range .Versions }}
- {{ . }} - '{{ . }}'
{{- end }} {{- end }}
validations: validations:
required: true required: true
- type: dropdown - type: 'dropdown'
id: deployment id: 'deployment'
attributes: attributes:
label: Deployment Method label: |
description: How are you deploying Authelia? Deployment Method
description: |
How are you deploying Authelia?
options: options:
- Docker - 'Docker'
- Kubernetes - 'Kubernetes'
- Bare-metal - 'Bare-metal'
- Other - 'Other'
validations: validations:
required: true required: true
- type: dropdown - type: 'dropdown'
id: proxy id: 'proxy'
attributes: attributes:
label: Reverse Proxy label: |
description: What reverse proxy are you using? Reverse Proxy
description: |
What reverse proxy are you using?
options: options:
{{- range .Proxies }} {{- range .Proxies }}
- {{ . }} - '{{ . }}'
{{- end }} {{- end }}
validations: validations:
required: true required: true
- type: input - type: 'input'
id: proxy-version id: 'proxy-version'
attributes: attributes:
label: Reverse Proxy Version label: |
description: What is the version of your reverse proxy? Reverse Proxy Version
placeholder: x.x.x description: |
What is the version of your reverse proxy?
placeholder: 'x.x.x'
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: description id: 'description'
attributes: attributes:
label: Description label: |
description: Describe the bug. Description
description: |
Describe the bug.
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: reproduction id: 'reproduction'
attributes: attributes:
label: Reproduction label: |
description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. Reproduction
description: |
Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: expectations id: 'expectations'
attributes: attributes:
label: Expectations label: |
description: Describe the desired or expected results. Expectations
description: |
Describe the desired or expected results.
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: configuration id: 'configuration'
attributes: attributes:
label: Configuration (Authelia) label: |
description: Provide a complete configuration file (the template will automatically put this content in a code block). Configuration (Authelia)
render: yaml description: |
Provide a complete configuration file (the template will automatically put this content in a code block).
render: 'yaml'
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: logs id: 'logs'
attributes: attributes:
label: Logs (Authelia) label: |
Logs (Authelia)
description: | description: |
Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide. Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide.
The template will automatically put this content in a code block so you can just paste it. The template will automatically put this content in a code block so you can just paste it.
render: shell render: 'shell'
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: logs-other id: 'logs-other'
attributes: attributes:
label: Logs (Proxy / Application) label: |
description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). Logs (Proxy / Application)
render: shell description: |
Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
render: 'shell'
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: documentation id: 'documentation'
attributes: attributes:
label: Documentation label: |
description: Provide any relevant specification or other documentation if applicable. Documentation
description: |
Provide any relevant specification or other documentation if applicable.
validations: validations:
required: false required: false
- type: checkboxes - type: 'checkboxes'
id: checklist id: 'checklist'
attributes: attributes:
label: Pre-Submission Checklist label: |
description: By submitting this issue confirm all of the following. Pre-Submission Checklist
description: |
By submitting this issue confirm all of the following.
options: options:
- label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) - label: |
I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
required: true required: true
- label: This is a bug report and not a support request - label: |
This is a bug report and not a support request
required: true required: true
- label: I have read the security policy and this bug report is not a security issue or security related issue - label: |
I have read the security policy and this bug report is not a security issue or security related issue
required: true required: true
- label: I have either included the complete configuration file or I am sure it's unrelated to the configuration - label: |
I have either included the complete configuration file or I am sure it's unrelated to the configuration
required: true required: true
- label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide - label: |
I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
required: true required: true
- label: I have checked for related proxy or application logs and included them if available - label: |
I have checked for related proxy or application logs and included them if available
required: true required: true
- label: I have checked for related issues and checked the documentation - label: |
I have checked for related issues and checked the documentation
required: true required: true
... ...

64
cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl
View File

@ -1,12 +1,12 @@
--- ---
name: Feature Request name: 'Feature Request'
description: Submit a Feature Request description: 'Submit a Feature Request'
labels: labels:
{{- range .Labels }} {{- range .Labels }}
- {{ . }} - '{{ . }}'
{{- end }} {{- end }}
body: body:
- type: markdown - type: 'markdown'
attributes: attributes:
value: | value: |
Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature. Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature.
@ -16,42 +16,54 @@ body:
1. Ensure there are no other similar feature requests. 1. Ensure there are no other similar feature requests.
2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already. 2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already.
3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist. 3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist.
- type: textarea - type: 'textarea'
id: description id: 'description'
attributes: attributes:
label: Description label: |
description: Describe the feature Description
description: |
Describe the feature
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: use-case id: 'use-case'
attributes: attributes:
label: Use Case label: |
description: Provide a use case Use Case
description: |
Provide a use case
validations: validations:
required: true required: true
- type: textarea - type: 'textarea'
id: details id: 'details'
attributes: attributes:
label: Details label: |
description: Describe the feature in detail Details
description: |
Describe the feature in detail
validations: validations:
required: false required: false
- type: textarea - type: 'textarea'
id: documentation id: 'documentation'
attributes: attributes:
label: Documentation label: |
description: Provide any relevant specification or other documentation if applicable Documentation
description: |
Provide any relevant specification or other documentation if applicable
validations: validations:
required: false required: false
- type: checkboxes - type: 'checkboxes'
id: checklist id: 'checklist'
attributes: attributes:
label: Pre-Submission Checklist label: |
description: By submitting this issue confirm all of the following Pre-Submission Checklist
description: |
By submitting this issue confirm all of the following
options: options:
- label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) - label: |
I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
required: true required: true
- label: I have checked for related issues and checked the documentation - label: |
I have checked for related issues and checked the documentation
required: true required: true
... ...

457
config.template.yml
View File

@ -9,14 +9,14 @@
## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store. ## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/ # certificates_directory: '/config/certificates/'
## The theme to display: light, dark, grey, auto. ## The theme to display: light, dark, grey, auto.
theme: light theme: 'light'
## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/c/secrets ## set using a secret: https://www.authelia.com/c/secrets
jwt_secret: a_very_important_secret jwt_secret: 'a_very_important_secret'
## Default redirection URL ## Default redirection URL
## ##
@ -25,31 +25,32 @@ jwt_secret: a_very_important_secret
## in such a case. ## in such a case.
## ##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://home.example.com/ default_redirection_url: 'https://home.example.com/'
## Set the default 2FA method for new users and for when a user has a preferred method configured that has been ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
## disabled. This setting must be a method that is enabled. ## disabled. This setting must be a method that is enabled.
## Options are totp, webauthn, mobile_push. ## Options are totp, webauthn, mobile_push.
default_2fa_method: "" default_2fa_method: ''
## ##
## Server Configuration ## Server Configuration
## ##
server: server:
## The address for the Main server to listen on in the address common syntax.
## The address to listen on. ## Formats:
host: 0.0.0.0 ## - [<scheme>://]<hostname>[:<port>]
## - [<scheme>://][hostname]:<port>
## The port to listen on. ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
port: 9091 ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'.
address: 'tcp://:9091'
## Set the single level path Authelia listens on. ## Set the single level path Authelia listens on.
## Must be alphanumeric chars and should not contain any slashes. ## Must be alphanumeric chars and should not contain any slashes.
path: "" path: ''
## Set the path on disk to Authelia assets. ## Set the path on disk to Authelia assets.
## Useful to allow overriding of specific static assets. ## Useful to allow overriding of specific static assets.
# asset_path: /config/assets/ # asset_path: '/config/assets/'
## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
@ -58,10 +59,10 @@ server:
## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
tls: tls:
## The path to the DER base64/PEM format private key. ## The path to the DER base64/PEM format private key.
key: "" key: ''
## The path to the DER base64/PEM format public certificate. ## The path to the DER base64/PEM format public certificate.
certificate: "" certificate: ''
## The list of certificates for client authentication. ## The list of certificates for client authentication.
client_certificates: [] client_certificates: []
@ -70,7 +71,7 @@ server:
headers: headers:
## The CSP Template. Read the docs. ## The CSP Template. Read the docs.
csp_template: "" csp_template: ''
## Server Buffers configuration. ## Server Buffers configuration.
# buffers: # buffers:
@ -89,14 +90,14 @@ server:
## Server Timeouts configuration. ## Server Timeouts configuration.
# timeouts: # timeouts:
## Read timeout. ## Read timeout in the duration common syntax.
# read: 6s # read: '6s'
## Write timeout. ## Write timeout in the duration common syntax.
# write: 6s # write: '6s'
## Idle timeout. ## Idle timeout in the duration common syntax.
# idle: 30s # idle: '30s'
## Server Endpoints configuration. ## Server Endpoints configuration.
## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation. ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation.
@ -110,16 +111,16 @@ server:
## Configure the authz endpoints. ## Configure the authz endpoints.
# authz: # authz:
# forward-auth: # forward-auth:
# implementation: ForwardAuth # implementation: 'ForwardAuth'
# authn_strategies: [] # authn_strategies: []
# ext-authz: # ext-authz:
# implementation: ExtAuthz # implementation: 'ExtAuthz'
# authn_strategies: [] # authn_strategies: []
# auth-request: # auth-request:
# implementation: AuthRequest # implementation: 'AuthRequest'
# authn_strategies: [] # authn_strategies: []
# legacy: # legacy:
# implementation: Legacy # implementation: 'Legacy'
# authn_strategies: [] # authn_strategies: []
## ##
@ -127,13 +128,13 @@ server:
## ##
log: log:
## Level of verbosity for logs: info, debug, trace. ## Level of verbosity for logs: info, debug, trace.
level: debug level: 'debug'
## Format the logs are written as: json, text. ## Format the logs are written as: json, text.
# format: json # format: 'json'
## File path where the logs will be written. If not set logs are written to stdout. ## File path where the logs will be written. If not set logs are written to stdout.
# file_path: /config/authelia.log # file_path: '/config/authelia.log'
## Whether to also log to stdout when a log_file_path is defined. ## Whether to also log to stdout when a log_file_path is defined.
# keep_stdout: false # keep_stdout: false
@ -150,8 +151,13 @@ telemetry:
## Enable Metrics. ## Enable Metrics.
enabled: false enabled: false
## The address to listen on for metrics. This should be on a different port to the main server.port value. ## The address for the Metrics server to listen on in the address common syntax.
address: tcp://0.0.0.0:9959 ## Formats:
## - [<scheme>://]<hostname>[:<port>]
## - [<scheme>://][hostname]:<port>
## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'.
address: 'tcp://:9959'
## Metrics Server Buffers configuration. ## Metrics Server Buffers configuration.
# buffers: # buffers:
@ -165,14 +171,14 @@ telemetry:
## Metrics Server Timeouts configuration. ## Metrics Server Timeouts configuration.
# timeouts: # timeouts:
## Read timeout. ## Read timeout in the duration common syntax.
# read: 6s # read: '6s'
## Write timeout. ## Write timeout in the duration common syntax.
# write: 6s # write: '6s'
## Idle timeout. ## Idle timeout in the duration common syntax.
# idle: 30s # idle: '30s'
## ##
## TOTP Configuration ## TOTP Configuration
@ -183,12 +189,12 @@ totp:
disable: false disable: false
## The issuer name displayed in the Authenticator application of your choice. ## The issuer name displayed in the Authenticator application of your choice.
issuer: authelia.com issuer: 'authelia.com'
## The TOTP algorithm to use. ## The TOTP algorithm to use.
## It is CRITICAL you read the documentation before changing this option: ## It is CRITICAL you read the documentation before changing this option:
## https://www.authelia.com/c/totp#algorithm ## https://www.authelia.com/c/totp#algorithm
algorithm: sha1 algorithm: 'sha1'
## The number of digits a user has to input. Must either be 6 or 8. ## The number of digits a user has to input. Must either be 6 or 8.
## Changing this option only affects newly generated TOTP configurations. ## Changing this option only affects newly generated TOTP configurations.
@ -217,19 +223,19 @@ webauthn:
## Disable WebAuthn. ## Disable WebAuthn.
disable: false disable: false
## Adjust the interaction timeout for WebAuthn dialogues. ## The interaction timeout for WebAuthn dialogues in the duration common syntax.
timeout: 60s timeout: '60s'
## The display name the browser should show the user for when using WebAuthn to login/register. ## The display name the browser should show the user for when using WebAuthn to login/register.
display_name: Authelia display_name: 'Authelia'
## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device. ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
## Options are none, indirect, direct. ## Options are none, indirect, direct.
attestation_conveyance_preference: indirect attestation_conveyance_preference: 'indirect'
## User verification controls if the user must make a gesture or action to confirm they are present. ## User verification controls if the user must make a gesture or action to confirm they are present.
## Options are required, preferred, discouraged. ## Options are required, preferred, discouraged.
user_verification: preferred user_verification: 'preferred'
## ##
## Duo Push API Configuration ## Duo Push API Configuration
@ -238,10 +244,10 @@ webauthn:
## "Partner Auth API" in the management panel. ## "Partner Auth API" in the management panel.
# duo_api: # duo_api:
# disable: false # disable: false
# hostname: api-123456789.example.com # hostname: 'api-123456789.example.com'
# integration_key: ABCDEF # integration_key: 'ABCDEF'
## Secret can also be set using a secret: https://www.authelia.com/c/secrets ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
# secret_key: 1234567890abcdefghifjkl # secret_key: '1234567890abcdefghifjkl'
# enable_self_enrollment: false # enable_self_enrollment: false
## ##
@ -249,14 +255,17 @@ webauthn:
## ##
## This is used to validate the servers time is accurate enough to validate TOTP. ## This is used to validate the servers time is accurate enough to validate TOTP.
ntp: ntp:
## NTP server address. ## The address of the NTP server to connect to in the address common syntax.
address: "time.cloudflare.com:123" ## Format: [<scheme>://]<hostname>[:<port>].
## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'.
## The default scheme is 'udp'. The default port is '123'.
address: 'udp://time.cloudflare.com:123'
## NTP version. ## NTP version.
version: 4 version: 4
## Maximum allowed time offset between the host and the NTP server. ## Maximum allowed time offset between the host and the NTP server in the duration common syntax.
max_desync: 3s max_desync: '3s'
## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
## set this to true, and can operate in a truly offline mode. ## set this to true, and can operate in a truly offline mode.
@ -282,16 +291,15 @@ authentication_backend:
## External reset password url that redirects the user to an external reset portal. This disables the internal reset ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
## functionality. ## functionality.
custom_url: "" custom_url: ''
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. ## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax.
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
## See the below documentation for more information. ## See the below documentation for more information.
## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format
## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
refresh_interval: 5m refresh_interval: '5m'
## ##
## LDAP (Authentication Provider) ## LDAP (Authentication Provider)
@ -300,6 +308,13 @@ authentication_backend:
## because it allows Authelia to offload the stateful operations ## because it allows Authelia to offload the stateful operations
## onto the LDAP service. ## onto the LDAP service.
# ldap: # ldap:
## The address of the LDAP server to connect to in the address common syntax.
## Format: [<scheme>://]<hostname>[:<port>].
## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`.
## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'.
## The default port is '636', unless the scheme is 'ldap' in which case it's '389'.
# address: 'ldaps://127.0.0.1:636'
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
## Acceptable options are as follows: ## Acceptable options are as follows:
## - 'activedirectory' - for Microsoft Active Directory. ## - 'activedirectory' - for Microsoft Active Directory.
@ -311,22 +326,18 @@ authentication_backend:
## Depending on the option here certain other values in this section have a default value, notably all of the ## Depending on the option here certain other values in this section have a default value, notably all of the
## attribute mappings have a default value that this config overrides, you can read more about these default values ## attribute mappings have a default value that this config overrides, you can read more about these default values
## at https://www.authelia.com/c/ldap#defaults ## at https://www.authelia.com/c/ldap#defaults
# implementation: custom # implementation: 'custom'
## The url to the ldap server. Format: <scheme>://<address>[:<port>]. ## The dial timeout for LDAP in the duration common syntax.
## Scheme can be ldap or ldaps in the format (port optional). # timeout: '5s'
# url: ldap://127.0.0.1
## The dial timeout for LDAP.
# timeout: 5s
## Use StartTLS with the LDAP connection. ## Use StartTLS with the LDAP connection.
# start_tls: false # start_tls: false
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host portion of the url option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: ldap.example.com # server_name: 'ldap.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -337,10 +348,10 @@ authentication_backend:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -417,7 +428,7 @@ authentication_backend:
## The distinguished name of the container searched for objects in the directory information tree. ## The distinguished name of the container searched for objects in the directory information tree.
## See also: additional_users_dn, additional_groups_dn. ## See also: additional_users_dn, additional_groups_dn.
# base_dn: dc=example,dc=com # base_dn: 'dc=example,dc=com'
## The attribute holding the username of the user. This attribute is used to populate the username in the session ## The attribute holding the username of the user. This attribute is used to populate the username in the session
## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually
@ -427,11 +438,11 @@ authentication_backend:
## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use
## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to
## follow https://datatracker.ietf.org/doc/html/rfc2307. ## follow https://datatracker.ietf.org/doc/html/rfc2307.
# username_attribute: uid # username_attribute: 'uid'
## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
# additional_users_dn: ou=users # additional_users_dn: 'ou=users'
## The users filter used in search queries to find the user profile based on input filled in login form. ## The users filter used in search queries to find the user profile based on input filled in login form.
## Various placeholders are available in the user filter which you can read about in the documentation which can ## Various placeholders are available in the user filter which you can read about in the documentation which can
@ -445,11 +456,11 @@ authentication_backend:
## ##
## To allow sign in both with username and email, one can use a filter like ## To allow sign in both with username and email, one can use a filter like
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
# users_filter: (&({username_attribute}={input})(objectClass=person)) # users_filter: '(&({username_attribute}={input})(objectClass=person))'
## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
# additional_groups_dn: ou=groups # additional_groups_dn: 'ou=groups'
## The groups filter used in search queries to find the groups based on relevant authenticated user. ## The groups filter used in search queries to find the groups based on relevant authenticated user.
## Various placeholders are available in the groups filter which you can read about in the documentation which can ## Various placeholders are available in the groups filter which you can read about in the documentation which can
@ -457,17 +468,17 @@ authentication_backend:
## ##
## If your groups use the `groupOfUniqueNames` structure use this instead: ## If your groups use the `groupOfUniqueNames` structure use this instead:
## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
# groups_filter: (&(member={dn})(objectClass=groupOfNames)) # groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
## The attribute holding the name of the group. ## The attribute holding the name of the group.
# group_name_attribute: cn # group_name_attribute: 'cn'
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
## first one returned by the LDAP server is used. ## first one returned by the LDAP server is used.
# mail_attribute: mail # mail_attribute: 'mail'
## The attribute holding the display name of the user. This will be used to greet an authenticated user. ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
# display_name_attribute: displayName # display_name_attribute: 'displayName'
## Follow referrals returned by the server. ## Follow referrals returned by the server.
## This is especially useful for environments where read-only servers exist. Only implemented for write operations. ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
@ -476,7 +487,7 @@ authentication_backend:
## The username and password of the admin user. ## The username and password of the admin user.
# user: cn=admin,dc=example,dc=com # user: cn=admin,dc=example,dc=com
## Password can also be set using a secret: https://www.authelia.com/c/secrets ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: password # password: 'password'
## ##
## File (Authentication Provider) ## File (Authentication Provider)
@ -491,15 +502,15 @@ authentication_backend:
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
## ##
# file: # file:
# path: /config/users_database.yml # path: '/config/users_database.yml'
# watch: false # watch: false
# search: # search:
# email: false # email: false
# case_insensitive: false # case_insensitive: false
# password: # password:
# algorithm: argon2 # algorithm: 'argon2'
# argon2: # argon2:
# variant: argon2id # variant: 'argon2id'
# iterations: 3 # iterations: 3
# memory: 65536 # memory: 65536
# parallelism: 4 # parallelism: 4
@ -512,15 +523,15 @@ authentication_backend:
# key_length: 32 # key_length: 32
# salt_length: 16 # salt_length: 16
# pbkdf2: # pbkdf2:
# variant: sha512 # variant: 'sha512'
# iterations: 310000 # iterations: 310000
# salt_length: 16 # salt_length: 16
# sha2crypt: # sha2crypt:
# variant: sha512 # variant: 'sha512'
# iterations: 50000 # iterations: 50000
# salt_length: 16 # salt_length: 16
# bcrypt: # bcrypt:
# variant: standard # variant: 'standard'
# cost: 12 # cost: 12
## ##
@ -604,91 +615,91 @@ privacy_policy:
access_control: access_control:
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
## resource if there is no policy to be applied to the user. ## resource if there is no policy to be applied to the user.
default_policy: deny default_policy: 'deny'
# networks: # networks:
# - name: internal # - name: 'internal'
# networks: # networks:
# - 10.10.0.0/16 # - '10.10.0.0/16'
# - 192.168.2.0/24 # - '192.168.2.0/24'
# - name: VPN # - name: VPN
# networks: 10.9.0.0/16 # networks: '10.9.0.0/16'
# rules: # rules:
## Rules applied to everyone ## Rules applied to everyone
# - domain: 'public.example.com' # - domain: 'public.example.com'
# policy: bypass # policy: 'bypass'
## Domain Regex examples. Generally we recommend just using a standard domain. ## Domain Regex examples. Generally we recommend just using a standard domain.
# - domain_regex: '^(?P<User>\w+)\.example\.com$' # - domain_regex: '^(?P<User>\w+)\.example\.com$'
# policy: one_factor # policy: 'one_factor'
# - domain_regex: '^(?P<Group>\w+)\.example\.com$' # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
# policy: one_factor # policy: 'one_factor'
# - domain_regex: # - domain_regex:
# - '^appgroup-.*\.example\.com$' # - '^appgroup-.*\.example\.com$'
# - '^appgroup2-.*\.example\.com$' # - '^appgroup2-.*\.example\.com$'
# policy: one_factor # policy: 'one_factor'
# - domain_regex: '^.*\.example\.com$' # - domain_regex: '^.*\.example\.com$'
# policy: two_factor # policy: 'two_factor'
# - domain: 'secure.example.com' # - domain: 'secure.example.com'
# policy: one_factor # policy: 'one_factor'
## Network based rule, if not provided any network matches. ## Network based rule, if not provided any network matches.
# networks: # networks:
# - internal # - 'internal'
# - VPN # - 'VPN'
# - 192.168.1.0/24 # - '192.168.1.0/24'
# - 10.0.0.1 # - '10.0.0.1'
# - domain: # - domain:
# - 'secure.example.com' # - 'secure.example.com'
# - 'private.example.com' # - 'private.example.com'
# policy: two_factor # policy: 'two_factor'
# - domain: 'singlefactor.example.com' # - domain: 'singlefactor.example.com'
# policy: one_factor # policy: 'one_factor'
## Rules applied to 'admins' group ## Rules applied to 'admins' group
# - domain: 'mx2.mail.example.com' # - domain: 'mx2.mail.example.com'
# subject: 'group:admins' # subject: 'group:admins'
# policy: deny # policy: 'deny'
# - domain: '*.example.com' # - domain: '*.example.com'
# subject: # subject:
# - 'group:admins' # - 'group:admins'
# - 'group:moderators' # - 'group:moderators'
# policy: two_factor # policy: 'two_factor'
## Rules applied to 'dev' group ## Rules applied to 'dev' group
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/groups/dev/.*$' # - '^/groups/dev/.*$'
# subject: 'group:dev' # subject: 'group:dev'
# policy: two_factor # policy: 'two_factor'
## Rules applied to user 'john' ## Rules applied to user 'john'
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/users/john/.*$' # - '^/users/john/.*$'
# subject: 'user:john' # subject: 'user:john'
# policy: two_factor # policy: 'two_factor'
## Rules applied to user 'harry' ## Rules applied to user 'harry'
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/users/harry/.*$' # - '^/users/harry/.*$'
# subject: 'user:harry' # subject: 'user:harry'
# policy: two_factor # policy: 'two_factor'
## Rules applied to user 'bob' ## Rules applied to user 'bob'
# - domain: '*.mail.example.com' # - domain: '*.mail.example.com'
# subject: 'user:bob' # subject: 'user:bob'
# policy: two_factor # policy: 'two_factor'
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/users/bob/.*$' # - '^/users/bob/.*$'
# subject: 'user:bob' # subject: 'user:bob'
# policy: two_factor # policy: 'two_factor'
## ##
## Session Provider Configuration ## Session Provider Configuration
@ -723,8 +734,7 @@ session:
## Please read https://www.authelia.com/c/session#same_site ## Please read https://www.authelia.com/c/session#same_site
# same_site: 'lax' # same_site: 'lax'
## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
## See: https://www.authelia.com/c/common#duration-notation-format
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
## because a stolen cookie will last longer giving attackers more time to spy or attack. ## because a stolen cookie will last longer giving attackers more time to spy or attack.
@ -741,30 +751,19 @@ session:
## this value to -1 disables remember me for this session cookie domain. ## this value to -1 disables remember me for this session cookie domain.
# remember_me: '1M' # remember_me: '1M'
## Cookie Session Domain default 'name' value. The name of the session cookie. ## Cookie Session Domain default 'name' value.
name: 'authelia_session' name: 'authelia_session'
## Cookie Session Domain default 'same_site' value. Sets the Cookie SameSite value. Possible options are none, lax, ## Cookie Session Domain default 'same_site' value.
## or strict. Please read https://www.authelia.com/c/session#same_site
same_site: 'lax' same_site: 'lax'
## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. ## Cookie Session Domain default 'inactivity' value.
## See: https://www.authelia.com/c/common#duration-notation-format
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
## because a stolen cookie will last longer giving attackers more time to spy or attack.
## Cookie Session Domain default 'inactivity' value. The inactivity time before the session is reset. If expiration is
## set to 1h, and this is set to 5m, if the user does not select the remember me option their session will get
## destroyed after 1h, or after 5m since the last time Authelia detected user activity.
inactivity: '5m' inactivity: '5m'
## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is ## Cookie Session Domain default 'expiration' value.
## destroyed if remember me IS NOT selected by the user.
expiration: '1h' expiration: '1h'
## Cookie Session Domain default 'remember_me' value. The time before the cookie expires and the session is destroyed ## Cookie Session Domain default 'remember_me' value.
## if remember me IS selected by the user. Setting this value to -1 disables remember me for all session cookie
## domains which do not have a specific 'remember_me' value.
remember_me: '1M' remember_me: '1M'
## ##
@ -773,16 +772,16 @@ session:
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
## ##
# redis: # redis:
# host: 127.0.0.1 # host: '127.0.0.1'
# port: 6379 # port: 6379
## Use a unix socket instead ## Use a unix socket instead
# host: /var/run/redis/redis.sock # host: '/var/run/redis/redis.sock'
## Username used for redis authentication. This is optional and a new feature in redis 6.0. ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
# username: authelia # username: 'authelia'
## Password can also be set using a secret: https://www.authelia.com/c/secrets ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: authelia # password: 'authelia'
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
# database_index: 0 # database_index: 0
@ -797,7 +796,7 @@ session:
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the host option.
# server_name: myredis.example.com # server_name: 'myredis.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -808,10 +807,10 @@ session:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -890,21 +889,21 @@ session:
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
# high_availability: # high_availability:
## Sentinel Name / Master Name. ## Sentinel Name / Master Name.
# sentinel_name: mysentinel # sentinel_name: 'mysentinel'
## Specific username for Redis Sentinel. The node username and password is configured above. ## Specific username for Redis Sentinel. The node username and password is configured above.
# sentinel_username: sentinel_specific_user # sentinel_username: 'sentinel_specific_user'
## Specific password for Redis Sentinel. The node username and password is configured above. ## Specific password for Redis Sentinel. The node username and password is configured above.
# sentinel_password: sentinel_specific_pass # sentinel_password: 'sentinel_specific_pass'
## The additional nodes to pre-seed the redis provider with (for sentinel). ## The additional nodes to pre-seed the redis provider with (for sentinel).
## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
## For high availability to be used you must have either defined; the host above or at least one node below. ## For high availability to be used you must have either defined; the host above or at least one node below.
# nodes: # nodes:
# - host: sentinel-node1 # - host: 'sentinel-node1'
# port: 6379 # port: 6379
# - host: sentinel-node2 # - host: 'sentinel-node2'
# port: 6379 # port: 6379
## Choose the host with the lowest latency. ## Choose the host with the lowest latency.
@ -922,14 +921,12 @@ regulation:
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
max_retries: 3 max_retries: 3
## The time range during which the user can attempt login before being banned. The user is banned if the ## The time range during which the user can attempt login before being banned in the duration common syntax. The user
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. ## is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window.
## See: https://www.authelia.com/c/common#duration-notation-format find_time: '2m'
find_time: 2m
## The length of time before a banned user can login again. Ban Time accepts duration notation. ## The length of time before a banned user can login again in the duration common syntax.
## See: https://www.authelia.com/c/common#duration-notation-format ban_time: '5m'
ban_time: 5m
## ##
## Storage Provider Configuration ## Storage Provider Configuration
@ -939,7 +936,7 @@ regulation:
## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use
## the CLI to change this in the database if you want to change it from a previously configured value. ## the CLI to change this in the database if you want to change it from a previously configured value.
# encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this'
## ##
## Local (Storage Provider) ## Local (Storage Provider)
@ -951,25 +948,36 @@ regulation:
## ##
# local: # local:
## Path to the SQLite3 Database. ## Path to the SQLite3 Database.
# path: /config/db.sqlite3 # path: '/config/db.sqlite3'
## ##
## MySQL / MariaDB (Storage Provider) ## MySQL / MariaDB (Storage Provider)
## ##
# mysql: # mysql:
# host: 127.0.0.1 ## The address of the MySQL server to connect to in the address common syntax.
# port: 3306 ## Format: [<scheme>://]<hostname>[:<port>].
# database: authelia ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
# username: authelia ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'.
## Password can also be set using a secret: https://www.authelia.com/c/secrets # address: 'tcp://127.0.0.1:3306'
# password: mypassword
# timeout: 5s ## The database name to use.
# database: 'authelia'
## The username used for SQL authentication.
# username: 'authelia'
## The password used for SQL authentication.
## Can also be set using a secret: https://www.authelia.com/c/secrets
# password: 'mypassword'
## The connection timeout in the duration common syntax.
# timeout: '5s'
## MySQL TLS settings. Configuring this requires TLS. ## MySQL TLS settings. Configuring this requires TLS.
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: mysql.example.com # server_name: 'mysql.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -980,10 +988,10 @@ regulation:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -1062,20 +1070,33 @@ regulation:
## PostgreSQL (Storage Provider) ## PostgreSQL (Storage Provider)
## ##
# postgres: # postgres:
# host: 127.0.0.1 ## The address of the PostgreSQL server to connect to in the address common syntax.
# port: 5432 ## Format: [<scheme>://]<hostname>[:<port>].
# database: authelia ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
# schema: public ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'.
# username: authelia # address: 'tcp://127.0.0.1:5432'
## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: mypassword ## The database name to use.
# timeout: 5s # database: 'authelia'
## The schema name to use.
# schema: 'public'
## The username used for SQL authentication.
# username: 'authelia'
## The password used for SQL authentication.
## Can also be set using a secret: https://www.authelia.com/c/secrets
# password: 'mypassword'
## The connection timeout in the duration common syntax.
# timeout: '5s'
## PostgreSQL TLS settings. Configuring this requires TLS. ## PostgreSQL TLS settings. Configuring this requires TLS.
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: postgres.example.com # server_name: 'postgres.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -1086,10 +1107,10 @@ regulation:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -1179,7 +1200,7 @@ notifier:
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
## ##
# filesystem: # filesystem:
# filename: /config/notification.txt # filename: '/config/notification.txt'
## ##
## SMTP (Notification Provider) ## SMTP (Notification Provider)
@ -1192,36 +1213,33 @@ notifier:
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
## (configure in tls section) ## (configure in tls section)
# smtp: # smtp:
## The SMTP host to connect to. ## The address of the SMTP server to connect to in the address common syntax.
# host: 127.0.0.1 # address: 'smtp://127.0.0.1:25'
## The port to connect to the SMTP host on. ## The connection timeout in the duration common syntax.
# port: 1025 # timeout: '5s'
## The connection timeout.
# timeout: 5s
## The username used for SMTP authentication. ## The username used for SMTP authentication.
# username: test # username: 'test'
## The password used for SMTP authentication. ## The password used for SMTP authentication.
## Can also be set using a secret: https://www.authelia.com/c/secrets ## Can also be set using a secret: https://www.authelia.com/c/secrets
# password: password # password: 'password'
## The sender is used to is used for the MAIL FROM command and the FROM header. ## The sender is used to is used for the MAIL FROM command and the FROM header.
## If this is not defined and the username is an email, we use the username as this value. This can either be just ## If this is not defined and the username is an email, we use the username as this value. This can either be just
## an email address or the RFC5322 'Name <email address>' format. ## an email address or the RFC5322 'Name <email address>' format.
# sender: "Authelia <admin@example.com>" # sender: 'Authelia <admin@example.com>'
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
# identifier: localhost # identifier: 'localhost'
## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
# subject: "[Authelia] {title}" # subject: '[Authelia] {title}'
## This address is used during the startup check to verify the email configuration is correct. ## This address is used during the startup check to verify the email configuration is correct.
## It's not important what it is except if your email server only allows local delivery. ## It's not important what it is except if your email server only allows local delivery.
# startup_check_address: test@authelia.com # startup_check_address: 'test@authelia.com'
## By default we require some form of TLS. This disables this check though is not advised. ## By default we require some form of TLS. This disables this check though is not advised.
# disable_require_tls: false # disable_require_tls: false
@ -1231,8 +1249,8 @@ notifier:
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: smtp.example.com # server_name: 'smtp.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -1243,10 +1261,10 @@ notifier:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -1334,7 +1352,7 @@ notifier:
# oidc: # oidc:
## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
# hmac_secret: this_is_a_secret_abc123abc123abc # hmac_secret: 'this_is_a_secret_abc123abc123abc'
## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the
## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every
@ -1410,11 +1428,11 @@ notifier:
# DO NOT USE== # DO NOT USE==
# -----END RSA PRIVATE KEY----- # -----END RSA PRIVATE KEY-----
## The lifespans configure the expiration for these token types. ## The lifespans configure the expiration for these token types in the duration common syntax.
# access_token_lifespan: 1h # access_token_lifespan: '1h'
# authorize_code_lifespan: 1m # authorize_code_lifespan: '1m'
# id_token_lifespan: 1h # id_token_lifespan: '1h'
# refresh_token_lifespan: 90m # refresh_token_lifespan: '90m'
## Enables additional debug messages. ## Enables additional debug messages.
# enable_client_debug_messages: false # enable_client_debug_messages: false
@ -1424,23 +1442,23 @@ notifier:
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
## for security reasons. ## for security reasons.
# enforce_pkce: public_clients_only # enforce_pkce: 'public_clients_only'
## Cross-Origin Resource Sharing (CORS) settings. ## Cross-Origin Resource Sharing (CORS) settings.
# cors: # cors:
## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
# endpoints: # endpoints:
# - authorization # - 'authorization'
# - token # - 'token'
# - revocation # - 'revocation'
# - introspection # - 'introspection'
# - userinfo # - 'userinfo'
## List of allowed origins. ## List of allowed origins.
## Any origin with https is permitted unless this option is configured or the ## Any origin with https is permitted unless this option is configured or the
## allowed_origins_from_client_redirect_uris option is enabled. ## allowed_origins_from_client_redirect_uris option is enabled.
# allowed_origins: # allowed_origins:
# - https://example.com # - 'https://example.com'
## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
## provided they have the scheme http or https and do not have the hostname of localhost. ## provided they have the scheme http or https and do not have the hostname of localhost.
@ -1450,71 +1468,72 @@ notifier:
# clients: # clients:
# - # -
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
# id: myapp # id: 'myapp'
## The description to show to users when they end up on the consent screen. Defaults to the ID above. ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
# description: My Application # description: 'My Application'
## The client secret is a shared secret between Authelia and the consumer of this client. ## The client secret is a shared secret between Authelia and the consumer of this client.
# secret: this_is_a_secret # yamllint disable-line rule:line-length
# secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
## necessary. Read the documentation for more information. ## necessary. Read the documentation for more information.
## The subject identifier must be the host component of a URL, which is a domain name with an optional port. ## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
# sector_identifier: example.com # sector_identifier: 'example.com'
## Sets the client to public. This should typically not be set, please see the documentation for usage. ## Sets the client to public. This should typically not be set, please see the documentation for usage.
# public: false # public: false
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
# redirect_uris: # redirect_uris:
# - https://oidc.example.com:8080/oauth2/callback # - 'https://oidc.example.com:8080/oauth2/callback'
## Audience this client is allowed to request. ## Audience this client is allowed to request.
# audience: [] # audience: []
## Scopes this client is allowed to request. ## Scopes this client is allowed to request.
# scopes: # scopes:
# - openid # - 'openid'
# - groups # - 'groups'
# - email # - 'email'
# - profile # - 'profile'
## Response Types configures which responses this client can be sent. ## Response Types configures which responses this client can be sent.
## It's not recommended to define this unless you know what you're doing. ## It's not recommended to define this unless you know what you're doing.
# response_types: # response_types:
# - code # - 'code'
## Response Modes configures which response modes this client supports. ## Response Modes configures which response modes this client supports.
# response_modes: # response_modes:
# - form_post # - 'form_post'
# - query # - 'query'
## Grant Types configures which grants this client can obtain. ## Grant Types configures which grants this client can obtain.
## It's not recommended to define this unless you know what you're doing. ## It's not recommended to define this unless you know what you're doing.
# grant_types: # grant_types:
# - authorization_code # - 'authorization_code'
## The permitted client authentication method for the Token Endpoint for this client. ## The permitted client authentication method for the Token Endpoint for this client.
# token_endpoint_auth_method: client_secret_basic # token_endpoint_auth_method: 'client_secret_basic'
## The policy to require for this client; one_factor or two_factor. ## The policy to require for this client; one_factor or two_factor.
# authorization_policy: two_factor # authorization_policy: 'two_factor'
## Enforces the use of PKCE for this client when set to true. ## Enforces the use of PKCE for this client when set to true.
# enforce_pkce: false # enforce_pkce: false
## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method. ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method.
## Options are 'plain' and 'S256'. ## Options are 'plain' and 'S256'.
# pkce_challenge_method: S256 # pkce_challenge_method: 'S256'
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
# userinfo_signing_algorithm: none # userinfo_signing_algorithm: 'none'
## The consent mode controls how consent is obtained. ## The consent mode controls how consent is obtained.
# consent_mode: auto # consent_mode: 'auto'
## This value controls the duration a consent on this client remains remembered when the consent mode is ## This value controls the duration a consent on this client remains remembered when the consent mode is
## configured as 'auto' or 'pre-configured'. ## configured as 'auto' or 'pre-configured' in the duration common syntax.
# pre_configured_consent_duration: 1w # pre_configured_consent_duration: '1w'
... ...

8
crowdin.yml
View File

@ -1,9 +1,9 @@
--- ---
pull_request_title: "i18n: update translations" pull_request_title: 'i18n: update translations'
commit_message: "i18n: update translation for %original_file_name% (%language%)" commit_message: 'i18n: update translation for %original_file_name% (%language%)'
append_commit_message: false append_commit_message: false
files: files:
- source: /internal/server/locales/en/* - source: '/internal/server/locales/en/*'
translation: /internal/server/locales/%locale%/%original_file_name% translation: '/internal/server/locales/%locale%/%original_file_name%'
skip_untranslated_files: true skip_untranslated_files: true
... ...

2
docs/config/next/config.toml
View File

@ -1 +1 @@
baseurl = "https://authelia-staging.netlify.app/" baseurl = "https://authelia-next.netlify.app/"

16
docs/content/en/configuration/first-factor/file.md
View File

@ -16,18 +16,20 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
authentication_backend: authentication_backend:
file: file:
path: /config/users.yml path: '/config/users.yml'
watch: false watch: false
search: search:
email: false email: false
case_insensitive: false case_insensitive: false
password: password:
algorithm: argon2 algorithm: 'argon2'
argon2: argon2:
variant: argon2id variant: 'argon2id'
iterations: 3 iterations: 3
memory: 65536 memory: 65536
parallelism: 4 parallelism: 4
@ -40,20 +42,22 @@ authentication_backend:
key_length: 32 key_length: 32
salt_length: 16 salt_length: 16
pbkdf2: pbkdf2:
variant: sha512 variant: 'sha512'
iterations: 310000 iterations: 310000
salt_length: 16 salt_length: 16
sha2crypt: sha2crypt:
variant: sha512 variant: 'sha512'
iterations: 50000 iterations: 50000
salt_length: 16 salt_length: 16
bcrypt: bcrypt:
variant: standard variant: 'standard'
cost: 12 cost: 12
``` ```
## Options ## Options
This section describes the individual configuration options.
### path ### path
{{< confkey type="string" required="yes" >}} {{< confkey type="string" required="yes" >}}

7
docs/content/en/configuration/first-factor/introduction.md
View File

@ -23,6 +23,8 @@ There are two ways to integrate *Authelia* with an authentication backend:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
authentication_backend: authentication_backend:
refresh_interval: 5m refresh_interval: 5m
@ -33,10 +35,15 @@ authentication_backend:
## Options ## Options
This section describes the individual configuration options.
### refresh_interval ### refresh_interval
{{< confkey type="duration" default="5m" required="no" >}} {{< confkey type="duration" default="5m" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
This setting controls the interval at which details are refreshed from the backend. Particularly useful for This setting controls the interval at which details are refreshed from the backend. Particularly useful for
[LDAP](#ldap). [LDAP](#ldap).

98
docs/content/en/configuration/first-factor/ldap.md
View File

@ -17,18 +17,20 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
authentication_backend: authentication_backend:
ldap: ldap:
implementation: custom address: 'ldap://127.0.0.1'
url: ldap://127.0.0.1 implementation: 'custom'
timeout: 5s timeout: '5s'
start_tls: false start_tls: false
tls: tls:
server_name: ldap.example.com server_name: 'ldap.example.com'
skip_verify: false skip_verify: false
minimum_version: TLS1.2 minimum_version: 'TLS1.2'
maximum_version: TLS1.3 maximum_version: 'TLS1.3'
certificate_chain: | certificate_chain: |
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@ -96,23 +98,54 @@ authentication_backend:
27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid..
DO NOT USE== DO NOT USE==
-----END RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----
base_dn: DC=example,DC=com base_dn: 'DC=example,DC=com'
additional_users_dn: OU=users additional_users_dn: 'OU=users'
users_filter: (&({username_attribute}={input})(objectClass=person)) users_filter: '(&({username_attribute}={input})(objectClass=person))'
username_attribute: uid username_attribute: 'uid'
mail_attribute: mail mail_attribute: 'mail'
display_name_attribute: displayName display_name_attribute: 'displayName'
additional_groups_dn: OU=groups additional_groups_dn: 'OU=groups'
groups_filter: (&(member={dn})(objectClass=groupOfNames)) groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
group_name_attribute: cn group_name_attribute: 'cn'
permit_referrals: false permit_referrals: false
permit_unauthenticated_bind: false permit_unauthenticated_bind: false
user: CN=admin,DC=example,DC=com user: 'CN=admin,DC=example,DC=com'
password: password password: 'password'
``` ```
## Options ## Options
This section describes the individual configuration options.
### address
{{< confkey type="string" required="yes" >}}
*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
see the [documentation](../prologue/common.md#address) on this format for more information.*
The LDAP URL which consists of a scheme, hostname, and port. Format is `[<scheme>://]<hostname>[:<port>]`. The default
scheme is `ldapi` if the path is absolute otherwise it's `ldaps`, and the permitted schemes are `ldap`, `ldaps`, or
`ldapi` (a unix domain socket).
If the scheme is `ldapi` it must be followed by an absolute path to an existing unix domain socket that the
user/group the Authelia process is running as has the appropriate permissions to access. For example if the socket is
located at `/var/run/slapd.sock` the address should be `ldapi:///var/run/slapd.sock`.
__Examples:__
```yaml
authentication_backend:
ldap:
address: 'ldaps://dc1.example.com'
```
```yaml
authentication_backend:
ldap:
address: 'ldap://[fd00:1111:2222:3333::1]'
```
### implementation ### implementation
{{< confkey type="string" default="custom" required="no" >}} {{< confkey type="string" default="custom" required="no" >}}
@ -121,31 +154,13 @@ Configures the LDAP implementation used by Authelia.
See the [Implementation Guide](../../reference/guides/ldap.md#implementation-guide) for information. See the [Implementation Guide](../../reference/guides/ldap.md#implementation-guide) for information.
### url
{{< confkey type="string" required="yes" >}}
The LDAP URL which consists of a scheme, address, and port. Format is `<scheme>://<address>:<port>` or
`<scheme>://<address>` where scheme is either `ldap` or `ldaps`.
```yaml
authentication_backend:
ldap:
url: ldaps://dc1.example.com
```
If utilising an IPv6 literal address it must be enclosed by square brackets:
```yaml
authentication_backend:
ldap:
url: ldap://[fd00:1111:2222:3333::1]
```
### timeout ### timeout
{{< confkey type="duration" default="5s" required="no" >}} {{< confkey type="duration" default="5s" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The timeout for dialing an LDAP connection. The timeout for dialing an LDAP connection.
### start_tls ### start_tls
@ -158,8 +173,11 @@ URL's are slightly more secure.
### tls ### tls
Controls the TLS connection validation process. You can see how to configure the tls *__Reference Note:__ This configuration option uses the
section [here](../prologue/common.md#tls-configuration). [TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
Controls the TLS connection validation parameters for either StartTLS or the TLS socket.
### base_dn ### base_dn

79
docs/content/en/configuration/identity-providers/open-id-connect.md
View File

@ -28,12 +28,12 @@ More information about the beta can be found in the [roadmap](../../roadmap/acti
## Configuration ## Configuration
The following snippet provides a sample-configuration for the OIDC identity provider explaining each field in detail. {{< config-alert-example >}}
```yaml ```yaml
identity_providers: identity_providers:
oidc: oidc:
hmac_secret: this_is_a_secret_abc123abc123abc hmac_secret: 'this_is_a_secret_abc123abc123abc'
issuer_certificate_chain: | issuer_certificate_chain: |
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@ -101,52 +101,54 @@ identity_providers:
27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid..
DO NOT USE== DO NOT USE==
-----END RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----
access_token_lifespan: 1h access_token_lifespan: '1h'
authorize_code_lifespan: 1m authorize_code_lifespan: '1m'
id_token_lifespan: 1h id_token_lifespan: '1h'
refresh_token_lifespan: 90m refresh_token_lifespan: '90m'
enable_client_debug_messages: false enable_client_debug_messages: false
enforce_pkce: public_clients_only enforce_pkce: 'public_clients_only'
cors: cors:
endpoints: endpoints:
- authorization - 'authorization'
- token - 'token'
- revocation - 'revocation'
- introspection - 'introspection'
allowed_origins: allowed_origins:
- https://example.com - 'https://example.com'
allowed_origins_from_client_redirect_uris: false allowed_origins_from_client_redirect_uris: false
clients: clients:
- id: myapp - id: 'myapp'
description: My Application description: 'My Application'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
sector_identifier: '' sector_identifier: ''
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
consent_mode: explicit consent_mode: 'explicit'
pre_configured_consent_duration: 1w pre_configured_consent_duration: '1w'
audience: [] audience: []
scopes: scopes:
- openid - 'openid'
- groups - 'groups'
- email - 'email'
- profile - 'profile'
redirect_uris: redirect_uris:
- https://oidc.example.com:8080/oauth2/callback - 'https://oidc.example.com:8080/oauth2/callback'
grant_types: grant_types:
- refresh_token - 'refresh_token'
- authorization_code - 'authorization_code'
response_types: response_types:
- code - 'code'
response_modes: response_modes:
- form_post - 'form_post'
- query - 'query'
- fragment - 'fragment'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## Options ## Options
This section describes the individual configuration options.
### hmac_secret ### hmac_secret
{{< confkey type="string" required="yes" >}} {{< confkey type="string" required="yes" >}}
@ -201,6 +203,9 @@ key data for the first certificate in the chain.
{{< confkey type="duration" default="1h" required="no" >}} {{< confkey type="duration" default="1h" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default. The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default.
For more information read these docs about [token lifespan]. For more information read these docs about [token lifespan].
@ -208,6 +213,9 @@ For more information read these docs about [token lifespan].
{{< confkey type="duration" default="1m" required="no" >}} {{< confkey type="duration" default="1m" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to
obtain the other token types. For more information read these docs about [token lifespan]. obtain the other token types. For more information read these docs about [token lifespan].
@ -215,12 +223,18 @@ obtain the other token types. For more information read these docs about [token
{{< confkey type="duration" default="1h" required="no" >}} {{< confkey type="duration" default="1h" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The maximum lifetime of an ID token. For more information read these docs about [token lifespan]. The maximum lifetime of an ID token. For more information read these docs about [token lifespan].
### refresh_token_lifespan ### refresh_token_lifespan
{{< confkey type="string" default="90m" required="no" >}} {{< confkey type="string" default="90m" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The maximum lifetime of a refresh token. The The maximum lifetime of a refresh token. The
refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an
up-to-date expiration. For more information read these docs about [token lifespan]. up-to-date expiration. For more information read these docs about [token lifespan].
@ -286,6 +300,9 @@ When enabled all authorization requests must use the [Pushed Authorization Reque
{{< confkey type="duration" default="5m" required="no" >}} {{< confkey type="duration" default="5m" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated
`request_uri` being utilized by a client. `request_uri` being utilized by a client.
@ -566,8 +583,8 @@ Configures the consent mode. The following table describes the different modes:
{{< confkey type="duration" default="1w" required="no" >}} {{< confkey type="duration" default="1w" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is
specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`. specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`.

2
docs/content/en/configuration/methods/environment.md
View File

@ -39,7 +39,7 @@ For example this YAML configuration:
```yaml ```yaml
log: log:
level: info level: 'info'
server: server:
buffers: buffers:
read: 4096 read: 4096

12
docs/content/en/configuration/miscellaneous/introduction.md
View File

@ -17,15 +17,19 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
certificates_directory: /config/certs/ certificates_directory: '/config/certs/'
default_redirection_url: https://home.example.com:8080/ default_redirection_url: 'https://home.example.com:8080/'
jwt_secret: v3ry_important_s3cr3t jwt_secret: 'v3ry_important_s3cr3t'
theme: light theme: 'light'
``` ```
## Options ## Options
This section describes the individual configuration options.
### certificates_directory ### certificates_directory
This option defines the location of additional certificates to load into the trust chain specifically for Authelia. This option defines the location of additional certificates to load into the trust chain specifically for Authelia.

10
docs/content/en/configuration/miscellaneous/logging.md
View File

@ -18,16 +18,20 @@ The logging section tunes the logging settings.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
log: log:
level: info level: 'info'
format: text format: 'text'
file_path: "" file_path: ''
keep_stdout: false keep_stdout: false
``` ```
## Options ## Options
This section describes the individual configuration options.
### level ### level
{{< confkey type="string" default="info" required="no" >}} {{< confkey type="string" default="info" required="no" >}}

34
docs/content/en/configuration/miscellaneous/ntp.md
View File

@ -23,17 +23,21 @@ unless configured otherwise.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
ntp: ntp:
address: "time.cloudflare.com:123" address: 'udp://time.cloudflare.com:123'
version: 3 version: 3
max_desync: 3s max_desync: '3s'
disable_startup_check: false disable_startup_check: false
disable_failure: false disable_failure: false
``` ```
## Options ## Options
This section describes the individual configuration options.
### address ### address
{{< confkey type="string" default="time.cloudflare.com:123" required="no" >}} {{< confkey type="string" default="time.cloudflare.com:123" required="no" >}}
@ -41,6 +45,28 @@ ntp:
Determines the address of the NTP server to retrieve the time from. The format is `<host>:<port>`, and both of these are Determines the address of the NTP server to retrieve the time from. The format is `<host>:<port>`, and both of these are
required. required.
### address
{{< confkey type="address" default="udp://time.cloudflare.com:123" required="no" >}}
*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
see the [documentation](../prologue/common.md#address) on this format for more information.*
Configures the address for the NTP Server. The address itself is a connector and the scheme must be `udp`,
`udp4`, or `udp6`.
__Examples:__
```yaml
ntp:
address: 'udp://127.0.0.1:123'
```
```yaml
ntp:
address: 'udp6://[fd00:1111:2222:3333::1]:123'
```
### version ### version
{{< confkey type="integer" default="4" required="no" >}} {{< confkey type="integer" default="4" required="no" >}}
@ -51,8 +77,8 @@ Determines the NTP version supported. Valid values are 3 or 4.
{{< confkey type="duration" default="3s" required="no" >}} {{< confkey type="duration" default="3s" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
This is used to tune the acceptable desync from the time reported from the NTP server. This is used to tune the acceptable desync from the time reported from the NTP server.

4
docs/content/en/configuration/miscellaneous/privacy-policy.md
View File

@ -14,6 +14,8 @@ toc: true
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
privacy_policy: privacy_policy:
enabled: false enabled: false
@ -23,6 +25,8 @@ privacy_policy:
## Options ## Options
This section describes the individual configuration options.
### enabled ### enabled
{{< confkey type="boolean" default="false" required="no" >}} {{< confkey type="boolean" default="false" required="no" >}}

10
docs/content/en/configuration/miscellaneous/server-endpoints-authz.md
View File

@ -16,21 +16,23 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
server: server:
endpoints: endpoints:
authz: authz:
forward-auth: forward-auth:
implementation: ForwardAuth implementation: 'ForwardAuth'
authn_strategies: [] authn_strategies: []
ext-authz: ext-authz:
implementation: ExtAuthz implementation: 'ExtAuthz'
authn_strategies: [] authn_strategies: []
auth-request: auth-request:
implementation: AuthRequest implementation: 'AuthRequest'
authn_strategies: [] authn_strategies: []
legacy: legacy:
implementation: Legacy implementation: 'Legacy'
authn_strategies: [] authn_strategies: []
``` ```

81
docs/content/en/configuration/miscellaneous/server.md
View File

@ -17,63 +17,82 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
server: server:
host: 0.0.0.0 address: 'tcp://:9091'
port: 9091 umask: 0022
path: "" path: ''
disable_healthcheck: false disable_healthcheck: false
tls: tls:
key: "" key: ''
certificate: "" certificate: ''
client_certificates: [] client_certificates: []
headers: headers:
csp_template: "" csp_template: ''
buffers: buffers:
read: 4096 read: 4096
write: 4096 write: 4096
timeouts: timeouts:
read: 6s read: '6s'
write: 6s write: '6s'
idle: 30s idle: '30s'
endpoints: endpoints:
enable_pprof: false enable_pprof: false
enable_expvars: false enable_expvars: false
authz: authz:
forward-auth: forward-auth:
implementation: ForwardAuth implementation: 'ForwardAuth'
authn_strategies: [] authn_strategies: []
ext-authz: ext-authz:
implementation: ExtAuthz implementation: 'ExtAuthz'
authn_strategies: [] authn_strategies: []
auth-request: auth-request:
implementation: AuthRequest implementation: 'AuthRequest'
authn_strategies: [] authn_strategies: []
legacy: legacy:
implementation: Legacy implementation: 'Legacy'
authn_strategies: [] authn_strategies: []
``` ```
## Options ## Options
## host ### address
{{< confkey type="string" default="0.0.0.0" required="no" >}} {{< confkey type="address" default="tcp://:9091" required="no" >}}
Defines the address to listen on. See also [port](#port). Should typically be `0.0.0.0` or `127.0.0.1`, the former for *__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
containerized environments and the later for daemonized environments like init.d and systemd. see the [documentation](../prologue/common.md#address) on this format for more information.*
Note: If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: Configures the listener address for the Main HTTP Server. The address itself is a listener and the scheme must either be
the `unix` scheme or one of the `tcp` schemes.
__Examples:__
```yaml ```yaml
host: "[fd00:1111:2222:3333::1]" server:
address: tcp://127.0.0.1:9091
``` ```
### port ```yaml
server:
address: unix:///var/run/authelia.sock
```
{{< confkey type="integer" default="9091" required="no" >}} ### umask
Defines the port to listen on. See also [host](#host). {{< confkey type="int" required="no" >}}
If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the
[address](#address). Typically this should be set before the process is actually running and users should not use this
option, however it's recognized in various specific scenarios this may not be completely adequate.
One such example is when you want the proxy to have permission to the socket but not the files, in which case running a
umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has
permission to the socket.
This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly.
### path ### path
@ -171,13 +190,19 @@ research about how browsers utilize and understand this header before attempting
### buffers ### buffers
Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more *__Reference Note:__ This configuration option uses the
information. [Server buffers common structure](../prologue/common.md#server-buffers). Please see the
[documentation](../prologue/common.md#server-buffers) on this structure for more information.*
Configures the server buffers.
### timeouts ### timeouts
Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more *__Reference Note:__ This configuration option uses the
information. [Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the
[documentation](../prologue/common.md#server-timeouts) on this structure for more information.*
Configures the server timeouts.
### endpoints ### endpoints
@ -192,11 +217,11 @@ Enables the go [pprof](https://pkg.go.dev/net/http/pprof) endpoints.
#### enable_expvars #### enable_expvars
{{< confkey type="boolean" default="false" required="no" >}}
*__Security Note:__ This is a developer endpoint. __DO NOT__ enable it unless you know why you're enabling it. *__Security Note:__ This is a developer endpoint. __DO NOT__ enable it unless you know why you're enabling it.
__DO NOT__ enable this in production.* __DO NOT__ enable this in production.*
{{< confkey type="boolean" default="false" required="no" >}}
Enables the go [expvar](https://pkg.go.dev/expvar) endpoints. Enables the go [expvar](https://pkg.go.dev/expvar) endpoints.
#### authz #### authz

6
docs/content/en/configuration/notifications/file.md
View File

@ -21,15 +21,19 @@ This method will use the plain text email template for readability purposes.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
notifier: notifier:
disable_startup_check: false disable_startup_check: false
filesystem: filesystem:
filename: /config/notification.txt filename: '/config/notification.txt'
``` ```
## Options ## Options
This section describes the individual configuration options.
### filename ### filename
{{< confkey type="string" required="yes" >}} {{< confkey type="string" required="yes" >}}

4
docs/content/en/configuration/notifications/introduction.md
View File

@ -16,6 +16,8 @@ Authelia sends messages to users in order to verify their identity.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
notifier: notifier:
disable_startup_check: false disable_startup_check: false
@ -26,6 +28,8 @@ notifier:
## Options ## Options
This section describes the individual configuration options.
### disable_startup_check ### disable_startup_check
{{< confkey type="boolean" default="false" required="no" >}} {{< confkey type="boolean" default="false" required="no" >}}

80
docs/content/en/configuration/notifications/smtp.md
View File

@ -17,27 +17,28 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
notifier: notifier:
disable_startup_check: false disable_startup_check: false
smtp: smtp:
host: 127.0.0.1 address: 'smtp://127.0.0.1:25'
port: 1025 timeout: '5s'
timeout: 5s username: 'test'
username: test password: 'password'
password: password
sender: "Authelia <admin@example.com>" sender: "Authelia <admin@example.com>"
identifier: localhost identifier: 'localhost'
subject: "[Authelia] {title}" subject: "[Authelia] {title}"
startup_check_address: test@authelia.com startup_check_address: 'test@authelia.com'
disable_require_tls: false disable_require_tls: false
disable_starttls: false disable_starttls: false
disable_html_emails: false disable_html_emails: false
tls: tls:
server_name: smtp.example.com server_name: 'smtp.example.com'
skip_verify: false skip_verify: false
minimum_version: TLS1.2 minimum_version: 'TLS1.2'
maximum_version: TLS1.3 maximum_version: 'TLS1.3'
certificate_chain: | certificate_chain: |
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@ -109,35 +110,43 @@ notifier:
## Options ## Options
### host This section describes the individual configuration options.
{{< confkey type="integer" required="yes" >}} ### address
The hostname of the SMTP server. {{< confkey type="address" required="yes" >}}
If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: *__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
see the [documentation](../prologue/common.md#address) on this format for more information.*
```yaml Configures the address for the SMTP Server. The address itself is a connector and the scheme must be `smtp`,
host: "[fd00:1111:2222:3333::1]" `submission`, or `submissions`. The only difference between these schemes are the default ports and `submissions`
``` requires a TLS transport per [SMTP Ports Security Measures][docs-security-smtp-port], whereas `submission` and `smtp`
use a standard TCP transport and typically enforce StartTLS.
### port
{{< confkey type="integer" required="yes" >}}
The port the SMTP service is listening on.
A connection is securely established with TLS after a succesful STARTTLS negotiation.
[Port 465 is an exception][docs-security-smtp-port] when supported by the mail server as a `submissions` service port.
STARTTLS negotiation is not required for this port, the connection is implicitly established with TLS.
[docs-security-smtp-port]: ../../overview/security/measures.md#smtp-ports [docs-security-smtp-port]: ../../overview/security/measures.md#smtp-ports
__Examples:__
```yaml
notifier:
smtp:
address: 'smtp://127.0.0.1:25'
```
```yaml
notifier:
smtp:
address: 'submissions://[fd00:1111:2222:3333::1]:465'
```
### timeout ### timeout
{{< confkey type="duration" default="5s" required="no" >}} {{< confkey type="duration" default="5s" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The SMTP connection timeout. The SMTP connection timeout.
### username ### username
@ -223,8 +232,11 @@ mixed emails which contain both HTML and text so this option is rarely necessary
### tls ### tls
Controls the TLS connection validation process. You can see how to configure the tls section *__Reference Note:__ This configuration option uses the
[here](../prologue/common.md#tls-configuration). [TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
Controls the TLS connection validation parameters for either StartTLS or the TLS socket.
## Using Gmail ## Using Gmail
@ -234,10 +246,10 @@ You need to generate an app password in order to use Gmail SMTP servers. The pro
```yaml ```yaml
notifier: notifier:
smtp: smtp:
username: myaccount@gmail.com username: 'myaccount@gmail.com'
# Password can also be set using a secret: https://www.authelia.com/configuration/methods/secrets/ # Password can also be set using a secret: https://www.authelia.com/configuration/methods/secrets/
password: yourapppassword password: 'yourapppassword'
sender: admin@example.com sender: 'admin@example.com'
host: smtp.gmail.com host: 'smtp.gmail.com'
port: 587 port: 587
``` ```

271
docs/content/en/configuration/prologue/common.md
View File

@ -14,103 +14,169 @@ aliases:
- /c/common - /c/common
--- ---
## Duration Notation Format ## Syntax
We have implemented a string/integer based notation for configuration options that take a duration of time. This section The following represent common syntax used within the configuration which have specific format requirements that are
describes the implementation of this. You can use this implementation in various areas of configuration such as: used in multiple areas. This is intended on assisting in understanding these specific values, and not as a specific
guide on configuring any particular instance.
* session: ### Duration
* expiration
* inactivity
* remember_me
* regulation:
* ban_time
* find_time
* ntp:
* max_desync
* webauthn:
* timeout
The way this format works is you can either configure an integer or a string in the specific configuration areas. If you The base type for this syntax is a string, and it also handles integers however this is discouraged.
supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in blocks
of quantities and units (number followed by a unit letter). For example `5h` indicates a quantity of 5 units of `h`.
The following is ignored: If you supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in
blocks of quantities and units (number followed by a unit letter). For example `5h` indicates a quantity of 5 units
of `h`.
The following is ignored or stripped from the input:
- all spaces - all spaces
- leading zeros - leading zeros
- the word `and`
While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. In
addition it's important to note that the format while somewhat human readable still requires you closely follow the
expected formats.
### Unit Legend #### Unit Legend
#### Short Units The following is a legend for the unit formats available in this syntax. The long form units are only available from
v4.38.0 or newer.
These values have been available for a long time. | Unit | Short Unit | Human Readable Long Unit |
|:------------:|:----------:|:-----------------------------:|
| Years | `y` | `year`, `years` |
| Months | `M` | `month`, `months` |
| Weeks | `w` | `week`, `weeks` |
| Days | `d` | `day`, `days` |
| Hours | `h` | `hour`, `hours` |
| Minutes | `m` | `minute`, `minutes` |
| Seconds | `s` | `second`, `seconds` |
| Milliseconds | `ms` | `millisecond`, `milliseconds` |
| Unit | Associated Letter | #### Examples
|:-------:|:-----------------:|
| Years | y |
| Months | M |
| Weeks | w |
| Days | d |
| Hours | h |
| Minutes | m |
| Seconds | s |
#### Long Units | Desired Value | Configuration Examples (Short) | Configuration Examples (Long) |
|:---------------------:|:-------------------------------------:|:---------------------------------------:|
| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` | `1 hour and 30 mninutes` |
| 1 day | `1d` or `24h` or `86400` or `86400s` | `1 day` |
| 10 hours | `10h` or `600m` or `9h60m` or `36000` | `10 hours` |
These values are more human readable but have only been available since v4.38.0. ### Address
| Unit | Human Readable Long Unit | The base type for this syntax is a string.
|:------------:|:-----------------------------:|
| Years | `year`, `years` |
| Months | `month`, `months` |
| Weeks | `week`, `weeks` |
| Days | `day`, `days` |
| Hours | `hour`, `hours` |
| Minutes | `minute`, `minutes` |
| Seconds | `second`, `seconds` |
| Milliseconds | `millisecond`, `milliseconds` |
### Examples The address type is a string that indicates how to configure a listener (i.e. listening for connections) or connector
(i.e. opening remote connections), which are the two primary categories of addresses.
| Desired Value | Configuration Examples |
|:---------------------:|:-------------------------------------:|
| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` |
| 1 day | `1d` or `24h` or `86400` or `86400s` |
| 10 hours | `10h` or `600m` or `9h60m` or `36000` |
## Address #### Format
The address type is a string that takes the following format: This section outlines the format for these strings. The formats use a conventional POSIX format to indicate optional and
required elements. The square brackets `[]` surround optional portions, and the angled brackets `<>` surround required
```text portions. Required portions may exist within optional portions, in which case they are often accompanied with other
[<scheme>://]<ip>[:<port>] format specific text which indicates if the accompanying text exists then it is actually required, otherwise it's
``` entirely optional.
The square brackets indicate optional sections, and the angled brackets indicate required sections. The following The square brackets indicate optional sections, and the angled brackets indicate required sections. The following
sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration
requirement that one of these is provided. requirement that one of these is provided.
### scheme ##### Hostname
The following format represents the hostname format. It's valid for both a listener and connector in most instances.
Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and port
are optional. The default for these when not provided varies.
```text
[<scheme>://]<hostname>[:<port>]
```
##### Port
The following format represents the port format. It's valid only for a listener in most instances.
Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and
hostname are optional. The default for the scheme when not provided varies, and the default for the hostname is all
available addresses when not provided.
```text
[<scheme>://][hostname]:<port>
```
##### Unix Domain Socket
The following format represents the unix domain socket format. It's valid for both a listener and connector in most
instances. Refer to the individual documentation for an option for clarity. In this format as per the notation there
are no optional portions.
```text
unix://<path>
```
##### Examples
Various examples for these formats.
```text
0.0.0.0
tcp://0.0.0.0
tcp://0.0.0.0:9091
tcp://:9091
0.0.0.0:9091
udp://0.0.0.0:123
udp://:123
unix:///var/lib/authelia.sock
```
#### scheme
The entire scheme is optional, but if the scheme host delimiter `://` is in the string, the scheme must be present. The The entire scheme is optional, but if the scheme host delimiter `://` is in the string, the scheme must be present. The
scheme must be one of `tcp://`, or `udp://`. The default scheme is `tcp://`. scheme must be one of the following (the listeners and connectors columns indicate support for the scheme on the
respective address type):
### ip | Scheme | Listeners | Connectors | Default Port | Notes |
|:-------------:|:---------:|:----------:|:------------:|:-------------------------------------------------------------------------:|
| `tcp` | Yes | Yes | N/A | Standard TCP Socket which allows IPv4 and/or IPv6 addresses |
| `tcp4` | Yes | Yes | N/A | Standard TCP Socket which allows only IPv4 addresses |
| `tcp6` | Yes | Yes | N/A | Standard TCP Socket which allows only IPv6 addresses |
| `udp` | Yes | Yes | N/A | Standard UDP Socket which allows IPv4 and/or IPv6 addresses |
| `udp4` | Yes | Yes | N/A | Standard UDP Socket which allows only IPv4 addresses |
| `udp6` | Yes | Yes | N/A | Standard UDP Socket which allows only IPv6 addresses |
| `unix` | Yes | Yes | N/A | Standard Unix Domain Socket which allows only absolute paths |
| `ldap` | No | Yes | 389 | Remote LDAP connection via TCP with implicit TLS via StartTLS |
| `ldaps` | No | Yes | 636 | Remote LDAP connection via TCP with explicit TLS |
| `ldapi` | No | Yes | N/A | LDAP connection via Unix Domain Socket |
| `smtp` | No | Yes | 25 | Remote SMTP connection via TCP using implicit TLS via StartTLS |
| `submission` | No | Yes | 587 | Remote SMTP Submission connection via TCP using implicit TLS via StartTLS |
| `submissions` | No | Yes | 465 | Remote SMTP Submission connection via TCP using explicit TLS |
The IP is required. If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address If the scheme is absent, the default scheme is assumed. If the address has a `/` prefix it's assumed to be `unix`,
`::1` with the `tcp://` scheme and port `80`: `tcp://[::1]:80`. otherwise it's assumed to be`tcp`. If the scheme is `unix` it must be suffixed with an absolute path i.e.
`/var/local/authelia.sock` would be represented as `unix:///var/run/authelia.sock`.
### port #### hostname
The entire port is optional, but if the host port delimiter `:` exists it must also include a numeric port. The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [port](#port) specified. It
can be any IP that is locally addressable or a hostname which resolves to a locally addressable IP.
## Regular Expressions If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address `::1` with the `tcp`
scheme and port `80` the correct address would be `tcp://[::1]:80`.
We have several sections of configuration that utilize regular expressions. It's recommended to validate your regex #### port
manually either via tools like [Regex 101](https://regex101.com/) (ensure you pick the `Golang` option) or some other
means. The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [hostname](#hostname)
specified.
### Regular Expressions
We have several sections of configuration that utilize regular expressions. We use the Google RE2 regular expression
engine which is the full Go regular expression syntax engine, the syntax of which is described
[here](https://github.com/google/re2/wiki/Syntax) by the authors. It's very similar to regular expression engines like
PCRE, Perl, and Python; with the major exceptions being that it doesn't have backtracking.
It's recommended to validate your regular expressions manually either via tools like [Regex 101](https://regex101.com/)
(ensure you pick the `Golang` option) or some other means.
It's important when attempting to utilize a backslash that it's utilized correctly. The YAML parser is likely to parse It's important when attempting to utilize a backslash that it's utilized correctly. The YAML parser is likely to parse
this as you trying to use YAML escape syntax instead of regex escape syntax. To avoid this use single quotes instead of this as you trying to use YAML escape syntax instead of regex escape syntax. To avoid this use single quotes instead of
@ -128,19 +194,30 @@ Bad Example:
domain_regex: "^(admin|secure)\.example\.com$" domain_regex: "^(admin|secure)\.example\.com$"
``` ```
## TLS Configuration ## Structures
The following represent common data structures used within the configuration which have specific requirements that are
used in multiple areas. This is intended on assisting in understanding these specific structures, and not as a specific
guide on configuring any particular instance.
### TLS Configuration
Various sections of the configuration use a uniform configuration section called TLS. Notably LDAP and SMTP. Various sections of the configuration use a uniform configuration section called TLS. Notably LDAP and SMTP.
This section documents the usage. This section documents the usage.
### server_name Various sections of the configuration use a uniform configuration section called `tls` which configure TLS socket and
TLS verification parameters. Notably the [LDAP](../first-factor/ldap.md#tls), [SMTP](../notifications/smtp.md#tls),
[PostgreSQL](../storage/postgres.md#tls), [MySQL](../storage/mysql.md#tls), and [Redis](../session/redis.md#tls)
sections. This section documents the common parts of this structure.
#### server_name
{{< confkey type="string" required="no" >}} {{< confkey type="string" required="no" >}}
The key `server_name` overrides the name checked against the certificate in the verification process. Useful if you The key `server_name` overrides the name checked against the certificate in the verification process. Useful if you
require an IP address for the host of the backend service but want to verify a specific certificate server name. require an IP address for the host of the backend service but want to verify a specific certificate server name.
### skip_verify #### skip_verify
{{< confkey type="boolean" default="false" required="no" >}} {{< confkey type="boolean" default="false" required="no" >}}
@ -148,7 +225,7 @@ The key `skip_verify` completely negates validating the certificate of the backe
instead you should tweak the `server_name` option, and the global option instead you should tweak the `server_name` option, and the global option
[certificates directory](../miscellaneous/introduction.md#certificatesdirectory). [certificates directory](../miscellaneous/introduction.md#certificatesdirectory).
### minimum_version #### minimum_version
{{< confkey type="string" default="TLS1.2" required="no" >}} {{< confkey type="string" default="TLS1.2" required="no" >}}
@ -157,7 +234,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi
are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing
this value. At the time of this writing `SSL3.0` will always produce errors. this value. At the time of this writing `SSL3.0` will always produce errors.
### maximum_version #### maximum_version
{{< confkey type="string" default="TLS1.3" required="no" >}} {{< confkey type="string" default="TLS1.3" required="no" >}}
@ -166,7 +243,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi
are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing
this value. At the time of this writing `SSL3.0` will always produce errors. this value. At the time of this writing `SSL3.0` will always produce errors.
### certificate_chain #### certificate_chain
{{< confkey type="string" required="no" >}} {{< confkey type="string" required="no" >}}
@ -175,7 +252,7 @@ the server.
The value must be one or more certificates encoded in the DER base64 ([RFC4648]) encoded PEM format. The value must be one or more certificates encoded in the DER base64 ([RFC4648]) encoded PEM format.
### private_key #### private_key
{{< confkey type="string" required="no" >}} {{< confkey type="string" required="no" >}}
@ -184,49 +261,69 @@ especially for containerized deployments.*
The private key to be used with the [certificate_chain](#certificatechain) for mutual TLS authentication. The private key to be used with the [certificate_chain](#certificatechain) for mutual TLS authentication.
The value must be one private key encoded in the DER base64 ([RFC4648]) encoded PEM format. The value must be one private key encoded in the DER base64 ([RFC4648]) encoded PEM format. If more than one certificate
is provided, in top down order, each certificate must be signed by the next certificate if provided.
[RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648 [RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648
## Server Buffers ### Server Buffers
### read Various sections of the configuration use a uniform configuration section called `buffers` which configure HTTP server
buffers. Notably the [server](../miscellaneous/server.md#buffers) and
[metrics telemetry](../telemetry/metrics.md#buffers) sections. This section documents the common parts of this
structure.
#### read
{{< confkey type="integer" default="4096" required="no" >}} {{< confkey type="integer" default="4096" required="no" >}}
Configures the maximum request size. The default of 4096 is generally sufficient for most use cases. Configures the maximum request size. The default of 4096 is generally sufficient for most use cases.
### write #### write
{{< confkey type="integer" default="4096" required="no" >}} {{< confkey type="integer" default="4096" required="no" >}}
Configures the maximum response size. The default of 4096 is generally sufficient for most use cases. Configures the maximum response size. The default of 4096 is generally sufficient for most use cases.
## Server Timeouts ### Server Timeouts
### read Various sections of the configuration use a uniform configuration section called `timeouts` which configure HTTP server
timeouts. Notably the [server](../miscellaneous/server.md#timeouts) and
[metrics telemetry](../telemetry/metrics.md#timeouts) sections. This section documents the common parts of this
structure.
#### read
{{< confkey type="duration" default="6s" required="no" >}} {{< confkey type="duration" default="6s" required="no" >}}
*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the *__Reference Note:__ This configuration option uses the [duration common syntax](#duration).
[common options](#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
Configures the server read timeout. Configures the server read timeout.
### write #### write
{{< confkey type="duration" default="6s" required="no" >}} {{< confkey type="duration" default="6s" required="no" >}}
*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the *__Reference Note:__ This configuration option uses the [duration common syntax](#duration).
[common options](#duration-notation-format) documentation for information on this format.* Please see the [documentation](#duration) on this format for more information.*
Configures the server write timeout. Configures the server write timeout.
### idle #### idle
{{< confkey type="duration" default="30s" required="no" >}} {{< confkey type="duration" default="30s" required="no" >}}
*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the *__Reference Note:__ This configuration option uses the [duration common syntax](#duration).
[common options](#duration-notation-format) documentation for information on this format.* Please see the [documentation](#duration) on this format for more information.*
Configures the server idle timeout. Configures the server idle timeout.
## Historical References
This contains links to historical anchors.
##### Duration Notation Format
See [duration common syntax](#duration).

10
docs/content/en/configuration/second-factor/duo.md
View File

@ -25,17 +25,21 @@ section of the configuration.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
duo_api: duo_api:
disable: false disable: false
hostname: api-123456789.example.com hostname: 'api-123456789.example.com'
integration_key: ABCDEF integration_key: 'ABCDEF'
secret_key: 1234567890abcdefghifjkl secret_key: '1234567890abcdefghifjkl'
enable_self_enrollment: false enable_self_enrollment: false
``` ```
## Options ## Options
This section describes the individual configuration options.
### Disable ### Disable
{{< confkey type="boolean" default="false" required="no" >}} {{< confkey type="boolean" default="false" required="no" >}}

18
docs/content/en/configuration/second-factor/time-based-one-time-password.md
View File

@ -26,11 +26,13 @@ and many only support SHA1.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
totp: totp:
disable: false disable: false
issuer: authelia.com issuer: 'authelia.com'
algorithm: sha1 algorithm: 'sha1'
digits: 6 digits: 6
period: 30 period: 30
skew: 1 skew: 1
@ -39,6 +41,8 @@ totp:
## Options ## Options
This section describes the individual configuration options.
### disable ### disable
{{< confkey type="boolean" default="false" required="no" >}} {{< confkey type="boolean" default="false" required="no" >}}
@ -61,9 +65,8 @@ by Authelia from others.
*__Important Note:__ Many TOTP applications do not support this option. It is strongly advised you find out which *__Important Note:__ Many TOTP applications do not support this option. It is strongly advised you find out which
applications your users use and test them before changing this option. It is insufficient to test that the application applications your users use and test them before changing this option. It is insufficient to test that the application
can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden] can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the
is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option [Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.*
please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).*
[Bitwarden]: https://bitwarden.com/ [Bitwarden]: https://bitwarden.com/
@ -84,9 +87,8 @@ information.
*__Important Note:__ Some TOTP applications do not support this option. It is strongly advised you find out which *__Important Note:__ Some TOTP applications do not support this option. It is strongly advised you find out which
applications your users use and test them before changing this option. It is insufficient to test that the application applications your users use and test them before changing this option. It is insufficient to test that the application
can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden] can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the
is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option [Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.*
please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).*
The number of digits a user needs to input to perform authentication. It's generally not recommended for this to be The number of digits a user needs to input to perform authentication. It's generally not recommended for this to be
altered as many TOTP applications do not support anything other than 6. What's worse is some TOTP applications allow altered as many TOTP applications do not support anything other than 6. What's worse is some TOTP applications allow

16
docs/content/en/configuration/second-factor/webauthn.md
View File

@ -16,17 +16,21 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
webauthn: webauthn:
disable: false disable: false
display_name: Authelia display_name: 'Authelia'
attestation_conveyance_preference: indirect attestation_conveyance_preference: 'indirect'
user_verification: preferred user_verification: 'preferred'
timeout: 60s timeout: '60s'
``` ```
## Options ## Options
This section describes the individual configuration options.
### disable ### disable
{{< confkey type="boolean" default="false" required="no" >}} {{< confkey type="boolean" default="false" required="no" >}}
@ -80,8 +84,8 @@ Available Options:
{{< confkey type="duration" default="60s" required="no" >}} {{< confkey type="duration" default="60s" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
This adjusts the requested timeout for a WebAuthn interaction. This adjusts the requested timeout for a WebAuthn interaction.

118
docs/content/en/configuration/security/access-control.md
View File

@ -17,11 +17,13 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
access_control: access_control:
default_policy: deny default_policy: 'deny'
networks: networks:
- name: internal - name: 'internal'
networks: networks:
- '10.0.0.0/8' - '10.0.0.0/8'
- '172.16.0.0/12' - '172.16.0.0/12'
@ -29,7 +31,7 @@ access_control:
rules: rules:
- domain: 'private.example.com' - domain: 'private.example.com'
domain_regex: '^(\d+\-)?priv-img.example.com$' domain_regex: '^(\d+\-)?priv-img.example.com$'
policy: one_factor policy: 'one_factor'
networks: networks:
- 'internal' - 'internal'
- '1.1.1.1' - '1.1.1.1'
@ -38,8 +40,8 @@ access_control:
- ['user:fred'] - ['user:fred']
- ['group:admins'] - ['group:admins']
methods: methods:
- GET - 'GET'
- HEAD - 'HEAD'
resources: resources:
- '^/api.*' - '^/api.*'
query: query:
@ -57,6 +59,8 @@ access_control:
## Options ## Options
This section describes the individual configuration options.
### default_policy ### default_policy
{{< confkey type="string" default="deny" required="no" >}} {{< confkey type="string" default="deny" required="no" >}}
@ -150,10 +154,10 @@ different ways.*
access_control: access_control:
rules: rules:
- domain: '*.example.com' - domain: '*.example.com'
policy: bypass policy: 'bypass'
- domain: - domain:
- '*.example.com' - '*.example.com'
policy: bypass policy: 'bypass'
``` ```
*Multiple domains matched. These rules will match either `apple.example.com` or `orange.example.com`. All rules in this *Multiple domains matched. These rules will match either `apple.example.com` or `orange.example.com`. All rules in this
@ -163,11 +167,11 @@ list are effectively the same rule just expressed in different ways.*
access_control: access_control:
rules: rules:
- domain: ['apple.example.com', 'banana.example.com'] - domain: ['apple.example.com', 'banana.example.com']
policy: bypass policy: 'bypass'
- domain: - domain:
- apple.example.com - 'apple.example.com'
- banana.example.com - 'banana.example.com'
policy: bypass policy: 'bypass'
``` ```
*Multiple domains matched either via a static domain or via a [domain_regex]. This rule will match *Multiple domains matched either via a static domain or via a [domain_regex]. This rule will match
@ -213,7 +217,7 @@ access_control:
- domain_regex: - domain_regex:
- '^user-(?P<User>\w+)\.example\.com$' - '^user-(?P<User>\w+)\.example\.com$'
- '^group-(?P<Group>\w+)\.example\.com$' - '^group-(?P<Group>\w+)\.example\.com$'
policy: one_factor policy: 'one_factor'
``` ```
*Multiple domains example, one with a static domain and one with a regex domain. This will match requests to *Multiple domains example, one with a static domain and one with a regex domain. This will match requests to
@ -224,7 +228,7 @@ access_control:
rules: rules:
- domain: 'protected.example.com' - domain: 'protected.example.com'
- domain_regex: '^(img|data)-private\.example\.com' - domain_regex: '^(img|data)-private\.example\.com'
policy: one_factor policy: 'one_factor'
``` ```
#### policy #### policy
@ -263,14 +267,14 @@ ways.*
```yaml ```yaml
access_control: access_control:
rules: rules:
- domain: example.com - domain: 'example.com'
policy: two_factor policy: 'two_factor'
subject: subject:
- 'user:john' - 'user:john'
- ['group:admin', 'group:app-name'] - ['group:admin', 'group:app-name']
- 'group:super-admin' - 'group:super-admin'
- domain: example.com - domain: 'example.com'
policy: two_factor policy: 'two_factor'
subject: subject:
- ['user:john'] - ['user:john']
- ['group:admin', 'group:app-name'] - ['group:admin', 'group:app-name']
@ -283,15 +287,15 @@ expressed in different ways.*
```yaml ```yaml
access_control: access_control:
rules: rules:
- domain: example.com - domain: 'example.com'
policy: one_factor policy: 'one_factor'
subject: 'group:super-admin' subject: 'group:super-admin'
- domain: example.com - domain: 'example.com'
policy: one_factor policy: 'one_factor'
subject: subject:
- 'group:super-admin' - 'group:super-admin'
- domain: example.com - domain: 'example.com'
policy: one_factor policy: 'one_factor'
subject: subject:
- ['group:super-admin'] - ['group:super-admin']
``` ```
@ -328,10 +332,10 @@ relevant methods are listed in this table:
```yaml ```yaml
access_control: access_control:
rules: rules:
- domain: example.com - domain: 'example.com'
policy: bypass policy: 'bypass'
methods: methods:
- OPTIONS - 'OPTIONS'
``` ```
#### networks #### networks
@ -365,28 +369,28 @@ rules in this list are effectively the same rule just expressed in different way
```yaml ```yaml
access_control: access_control:
default_policy: two_factor default_policy: 'two_factor'
networks: networks:
- name: internal - name: 'internal'
networks: networks:
- '10.0.0.0/8' - '10.0.0.0/8'
- '172.16.0.0/12' - '172.16.0.0/12'
- '192.168.0.0/18' - '192.168.0.0/18'
rules: rules:
- domain: secure.example.com - domain: 'secure.example.com'
policy: one_factor policy: 'one_factor'
networks: networks:
- '10.0.0.0/8' - '10.0.0.0/8'
- '172.16.0.0/12' - '172.16.0.0/12'
- '192.168.0.0/18' - '192.168.0.0/18'
- '112.134.145.167/32' - '112.134.145.167/32'
- domain: secure.example.com - domain: 'secure.example.com'
policy: one_factor policy: 'one_factor'
networks: networks:
- 'internal' - 'internal'
- '112.134.145.167/32' - '112.134.145.167/32'
- domain: secure.example.com - domain: 'secure.example.com'
policy: two_factor policy: 'two_factor'
``` ```
#### resources #### resources
@ -421,8 +425,8 @@ likely save you a lot of time if you do it for all resource rules.
```yaml ```yaml
access_control: access_control:
rules: rules:
- domain: app.example.com - domain: 'app.example.com'
policy: bypass policy: 'bypass'
resources: resources:
- '^/api([/?].*)?$' - '^/api([/?].*)?$'
``` ```
@ -467,8 +471,8 @@ defaults to `present`.
```yaml ```yaml
access_control: access_control:
rules: rules:
- domain: app.example.com - domain: 'app.example.com'
policy: bypass policy: 'bypass'
query: query:
- - operator: 'present' - - operator: 'present'
key: 'secure' key: 'secure'
@ -545,13 +549,13 @@ a match for that request.
- domain: - domain:
- 'example.com' - 'example.com'
- '*.example.com' - '*.example.com'
policy: bypass policy: 'bypass'
resources: resources:
- '^/api$' - '^/api$'
- '^/api/' - '^/api/'
- domain: - domain:
- 'app.example.com' - 'app.example.com'
policy: two_factor policy: 'two_factor'
``` ```
[Rule Matching Concept 1]: #rule-matching-concept-1-sequential-order [Rule Matching Concept 1]: #rule-matching-concept-1-sequential-order
@ -603,25 +607,25 @@ Here is a detailed example of an example access control section:
```yaml ```yaml
access_control: access_control:
default_policy: deny default_policy: 'deny'
networks: networks:
- name: internal - name: 'internal'
networks: networks:
- '10.10.0.0/16' - '10.10.0.0/16'
- '192.168.2.0/24' - '192.168.2.0/24'
- name: VPN - name: 'VPN'
networks: 10.9.0.0/16 networks: '10.9.0.0/16'
rules: rules:
- domain: 'public.example.com' - domain: 'public.example.com'
policy: bypass policy: 'bypass'
- domain: '*.example.com' - domain: '*.example.com'
policy: bypass policy: 'bypass'
methods: methods:
- OPTIONS - 'OPTIONS'
- domain: 'secure.example.com' - domain: 'secure.example.com'
policy: one_factor policy: 'one_factor'
networks: networks:
- 'internal' - 'internal'
- 'VPN' - 'VPN'
@ -631,37 +635,37 @@ access_control:
- domain: - domain:
- 'secure.example.com' - 'secure.example.com'
- 'private.example.com' - 'private.example.com'
policy: two_factor policy: 'two_factor'
- domain: 'singlefactor.example.com' - domain: 'singlefactor.example.com'
policy: one_factor policy: 'one_factor'
- domain: 'mx2.mail.example.com' - domain: 'mx2.mail.example.com'
subject: 'group:admins' subject: 'group:admins'
policy: deny policy: 'deny'
- domain: '*.example.com' - domain: '*.example.com'
subject: subject:
- 'group:admins' - 'group:admins'
- 'group:moderators' - 'group:moderators'
policy: two_factor policy: 'two_factor'
- domain: dev.example.com - domain: 'dev.example.com'
resources: resources:
- '^/groups/dev/.*$' - '^/groups/dev/.*$'
subject: 'group:dev' subject: 'group:dev'
policy: two_factor policy: 'two_factor'
- domain: dev.example.com - domain: 'dev.example.com'
resources: resources:
- '^/users/john/.*$' - '^/users/john/.*$'
subject: subject:
- ['group:dev', 'user:john'] - ['group:dev', 'user:john']
- 'group:admins' - 'group:admins'
policy: two_factor policy: 'two_factor'
- domain: '{user}.example.com' - domain: '{user}.example.com'
policy: bypass policy: 'bypass'
``` ```
[RFC7231]: https://datatracker.ietf.org/doc/html/rfc7231 [RFC7231]: https://datatracker.ietf.org/doc/html/rfc7231

4
docs/content/en/configuration/security/password-policy.md
View File

@ -18,6 +18,8 @@ aliases:
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
password_policy: password_policy:
standard: standard:
@ -35,6 +37,8 @@ password_policy:
## Options ## Options
This section describes the individual configuration options.
### standard ### standard
This section allows you to enable standard security policies. This section allows you to enable standard security policies.

16
docs/content/en/configuration/security/regulation.md
View File

@ -20,15 +20,19 @@ authentication attempts. This helps prevent brute-force attacks.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
regulation: regulation:
max_retries: 3 max_retries: 3
find_time: 2m find_time: '2m'
ban_time: 5m ban_time: '5m'
``` ```
## Options ## Options
This section describes the individual configuration options.
### max_retries ### max_retries
{{< confkey type="integer" default="3" required="no" >}} {{< confkey type="integer" default="3" required="no" >}}
@ -39,8 +43,8 @@ The number of failed login attempts before a user may be banned. Setting this op
{{< confkey type="duration" default="2m" required="no" >}} {{< confkey type="duration" default="2m" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The period of time analyzed for failed attempts. For The period of time analyzed for failed attempts. For
example if you set `max_retries` to 3 and `find_time` to `2m` this means the user must have 3 failed logins in example if you set `max_retries` to 3 and `find_time` to `2m` this means the user must have 3 failed logins in
@ -50,8 +54,8 @@ example if you set `max_retries` to 3 and `find_time` to `2m` this means the use
{{< confkey type="duration" default="5m" required="no" >}} {{< confkey type="duration" default="5m" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The period of time the user is banned for after meeting the `max_retries` and `find_time` configuration. After this The period of time the user is banned for after meeting the `max_retries` and `find_time` configuration. After this
duration the account will be able to login again. duration the account will be able to login again.

56
docs/content/en/configuration/session/introduction.md
View File

@ -20,24 +20,24 @@ the session cookie behaviour and the domains which Authelia can service authoriz
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
session: session:
secret: insecure_session_secret secret: 'insecure_session_secret'
name: 'authelia_session'
name: authelia_session same_site: 'lax'
same_site: lax inactivity: '5m'
inactivity: 5m expiration: '1h'
expiration: 1h remember_me: '1M'
remember_me: 1M
cookies: cookies:
- domain: example.com - domain: 'example.com'
authelia_url: https://auth.example.com authelia_url: 'https://auth.example.com'
name: authelia_session name: 'authelia_session'
same_site: lax same_site: 'lax'
inactivity: 5m inactivity: '5m'
expiration: 1h expiration: '1h'
remember_me: 1d remember_me: '1d'
``` ```
## Providers ## Providers
@ -56,6 +56,8 @@ providers are recommended.
## Options ## Options
This section describes the individual configuration options.
### secret ### secret
{{< confkey type="string" required="yes" >}} {{< confkey type="string" required="yes" >}}
@ -95,8 +97,8 @@ The default `same_site` value for all `cookies` configurations.
{{< confkey type="duration" default="5m" required="no" >}} {{< confkey type="duration" default="5m" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The default `inactivity` value for all [cookies](#cookies) configurations. The default `inactivity` value for all [cookies](#cookies) configurations.
@ -104,8 +106,8 @@ The default `inactivity` value for all [cookies](#cookies) configurations.
{{< confkey type="duration" default="1h" required="no" >}} {{< confkey type="duration" default="1h" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The default `expiration` value for all [cookies](#cookies) configurations. The default `expiration` value for all [cookies](#cookies) configurations.
@ -113,8 +115,8 @@ The default `expiration` value for all [cookies](#cookies) configurations.
{{< confkey type="duration" default="1M" required="no" >}} {{< confkey type="duration" default="1M" required="no" >}}
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The default `remember_me` value for all [cookies](#cookies) configurations. The default `remember_me` value for all [cookies](#cookies) configurations.
@ -193,8 +195,8 @@ state but it's available as an option anyway.
*__Default Value:__ This option takes its default value from the [inactivity](#inactivity) setting above.* *__Default Value:__ This option takes its default value from the [inactivity](#inactivity) setting above.*
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The period of time the user can be inactive for until the session is destroyed. Useful if you want long session timers The period of time the user can be inactive for until the session is destroyed. Useful if you want long session timers
but don't want unused devices to be vulnerable. but don't want unused devices to be vulnerable.
@ -205,8 +207,8 @@ but don't want unused devices to be vulnerable.
*__Default Value:__ This option takes its default value from the [expiration](#expiration) setting above.* *__Default Value:__ This option takes its default value from the [expiration](#expiration) setting above.*
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The period of time before the cookie expires and the session is destroyed. This is overriden by The period of time before the cookie expires and the session is destroyed. This is overriden by
[remember_me](#rememberme) when the remember me box is checked. [remember_me](#rememberme) when the remember me box is checked.
@ -217,8 +219,8 @@ The period of time before the cookie expires and the session is destroyed. This
*__Default Value:__ This option takes its default value from the [remember_me](#rememberme) setting above.* *__Default Value:__ This option takes its default value from the [remember_me](#rememberme) setting above.*
*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see *__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The period of time before the cookie expires and the session is destroyed when the remember me box is checked. Setting The period of time before the cookie expires and the session is destroyed when the remember me box is checked. Setting
this to `-1` disables this feature entirely for this session cookie domain. this to `-1` disables this feature entirely for this session cookie domain.

34
docs/content/en/configuration/session/redis.md
View File

@ -20,21 +20,23 @@ this option and we highly recommend it in production environments. It requires y
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
session: session:
redis: redis:
host: 127.0.0.1 host: '127.0.0.1'
port: 6379 port: 6379
username: authelia username: 'authelia'
password: authelia password: 'authelia'
database_index: 0 database_index: 0
maximum_active_connections: 8 maximum_active_connections: 8
minimum_idle_connections: 0 minimum_idle_connections: 0
tls: tls:
server_name: myredis.example.com server_name: 'myredis.example.com'
skip_verify: false skip_verify: false
minimum_version: TLS1.2 minimum_version: 'TLS1.2'
maximum_version: TLS1.3 maximum_version: 'TLS1.3'
certificate_chain: | certificate_chain: |
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@ -103,15 +105,15 @@ session:
DO NOT USE== DO NOT USE==
-----END RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----
high_availability: high_availability:
sentinel_name: mysentinel sentinel_name: 'mysentinel'
# If `sentinel_username` is supplied, Authelia will connect using ACL-based # If `sentinel_username` is supplied, Authelia will connect using ACL-based
# authentication. Otherwise, it will use traditional `requirepass` auth. # authentication. Otherwise, it will use traditional `requirepass` auth.
sentinel_username: sentinel_user sentinel_username: 'sentinel_user'
sentinel_password: sentinel_specific_pass sentinel_password: 'sentinel_specific_pass'
nodes: nodes:
- host: sentinel-node1 - host: 'sentinel-node1'
port: 26379 port: 26379
- host: sentinel-node2 - host: 'sentinel-node2'
port: 26379 port: 26379
route_by_latency: false route_by_latency: false
route_randomly: false route_randomly: false
@ -119,6 +121,8 @@ session:
## Options ## Options
This section describes the individual configuration options.
### host ### host
{{< confkey type="string" required="yes" >}} {{< confkey type="string" required="yes" >}}
@ -178,8 +182,12 @@ is useful if there are long delays in establishing connections.
### tls ### tls
If defined enables [redis] over TLS, and additionally controls the TLS connection validation process. You can see how to *__Reference Note:__ This configuration option uses the
configure the tls section [here](../prologue/common.md#tls-configuration). [TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
If defined enables connecting to [redis] over a TLS socket, and additionally controls the TLS connection
validation parameters.
### high_availability ### high_availability

6
docs/content/en/configuration/storage/introduction.md
View File

@ -21,9 +21,11 @@ The available storage backends are listed in the table of contents below.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
storage: storage:
encryption_key: a_very_important_secret encryption_key: 'a_very_important_secret'
local: {} local: {}
mysql: {} mysql: {}
postgres: {} postgres: {}
@ -31,6 +33,8 @@ storage:
## Options ## Options
This section describes the individual configuration options.
### encryption_key ### encryption_key
{{< confkey type="string" required="yes" >}} {{< confkey type="string" required="yes" >}}

60
docs/content/en/configuration/storage/mysql.md
View File

@ -22,21 +22,22 @@ guide for supported version information.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
storage: storage:
encryption_key: a_very_important_secret encryption_key: 'a_very_important_secret'
mysql: mysql:
host: 127.0.0.1 address: 'tcp://127.0.0.1:3306'
port: 3306 database: 'authelia'
database: authelia username: 'authelia'
username: authelia password: 'mypassword'
password: mypassword timeout: '5s'
timeout: 5s
tls: tls:
server_name: mysql.example.com server_name: 'mysql.example.com'
skip_verify: false skip_verify: false
minimum_version: TLS1.2 minimum_version: 'TLS1.2'
maximum_version: TLS1.3 maximum_version: 'TLS1.3'
certificate_chain: | certificate_chain: |
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@ -108,37 +109,41 @@ storage:
## Options ## Options
This section describes the individual configuration options.
### encryption_key ### encryption_key
See the [encryption_key docs](introduction.md#encryption_key). See the [encryption_key docs](introduction.md#encryption_key).
### host ### address
{{< confkey type="string" default="localhost" required="no" >}} {{< confkey type="address" required="yes" >}}
The database server host. This can also be a unix socket. *__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
see the [documentation](../prologue/common.md#address) on this format for more information.*
If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: Configures the address for the MySQL/MariaDB Server. The address itself is a connector and the scheme must either be
the `unix` scheme or one of the `tcp` schemes.
__Examples:__
```yaml ```yaml
storage: storage:
mysql: mysql:
host: "[fd00:1111:2222:3333::1]" address: 'tcp://127.0.0.1:3306'
``` ```
If utilizing a unix socket it must have the `/` prefix:
```yaml ```yaml
storage: storage:
mysql: mysql:
host: /var/run/mysqld.sock address: 'tcp://[fd00:1111:2222:3333::1]:3306'
``` ```
### port ```yaml
storage:
{{< confkey type="integer" default="3306" required="no" >}} mysql:
address: 'unix:///var/run/mysqld.sock'
The port the database server is listening on. ```
### database ### database
@ -170,12 +175,19 @@ characters and the user password is changed to this value.
{{< confkey type="duration" default="5s" required="no" >}} {{< confkey type="duration" default="5s" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The SQL connection timeout. The SQL connection timeout.
### tls ### tls
*__Reference Note:__ This configuration option uses the
[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
If defined enables connecting to [MySQL] or [MariaDB] over a TLS socket, and additionally controls the TLS connection If defined enables connecting to [MySQL] or [MariaDB] over a TLS socket, and additionally controls the TLS connection
validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration). validation parameters.
[MySQL]: https://www.mysql.com/ [MySQL]: https://www.mysql.com/
[MariaDB]: https://mariadb.org/ [MariaDB]: https://mariadb.org/

62
docs/content/en/configuration/storage/postgres.md
View File

@ -21,21 +21,22 @@ guide for supported version information.
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
storage: storage:
encryption_key: a_very_important_secret encryption_key: 'a_very_important_secret'
postgres: postgres:
host: 127.0.0.1 address: 'tcp://127.0.0.1:5432'
port: 5432 database: 'authelia'
database: authelia schema: 'public'
schema: public username: 'authelia'
username: authelia password: 'mypassword'
password: mypassword
tls: tls:
server_name: postgres.example.com server_name: 'postgres.example.com'
skip_verify: false skip_verify: false
minimum_version: TLS1.2 minimum_version: 'TLS1.2'
maximum_version: TLS1.3 maximum_version: 'TLS1.3'
certificate_chain: | certificate_chain: |
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@ -107,37 +108,41 @@ storage:
## Options ## Options
This section describes the individual configuration options.
### encryption_key ### encryption_key
See the [encryption_key docs](introduction.md#encryption_key). See the [encryption_key docs](introduction.md#encryptionkey).
### host ### address
{{< confkey type="string" required="yes" >}} {{< confkey type="address" required="yes" >}}
The database server host. This can also be a unix socket. *__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
see the [documentation](../prologue/common.md#address) on this format for more information.*
If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: Configures the address for the PostgreSQL Server. The address itself is a connector and the scheme must either be
the `unix` scheme or one of the `tcp` schemes.
__Examples:__
```yaml ```yaml
storage: storage:
postgres: postgres:
host: "[fd00:1111:2222:3333::1]" address: 'tcp://127.0.0.1:5432'
``` ```
If utilizing a unix socket it must have the `/` prefix:
```yaml ```yaml
storage: storage:
postgres: postgres:
host: /var/run/postgres.sock address: 'tcp://[fd00:1111:2222:3333::1]:5432'
``` ```
### port ```yaml
storage:
{{< confkey type="integer" default="5432" required="no" >}} postgres:
address: 'unix:///var/run/postgres.sock'
The port the database server is listening on. ```
### database ### database
@ -176,11 +181,18 @@ characters and the user password is changed to this value.
{{< confkey type="duration" default="5s" required="no" >}} {{< confkey type="duration" default="5s" required="no" >}}
*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
The SQL connection timeout. The SQL connection timeout.
### tls ### tls
*__Reference Note:__ This configuration option uses the
[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
If defined enables connecting to [PostgreSQL] over a TLS socket, and additionally controls the TLS connection If defined enables connecting to [PostgreSQL] over a TLS socket, and additionally controls the TLS connection
validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration). validation parameters.
[PostgreSQL]: https://www.postgresql.org/ [PostgreSQL]: https://www.postgresql.org/

8
docs/content/en/configuration/storage/sqlite.md
View File

@ -24,15 +24,19 @@ but this requires you setup an external database such as [PostgreSQL](postgres.m
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
storage: storage:
encryption_key: a_very_important_secret encryption_key: 'a_very_important_secret'
local: local:
path: /config/db.sqlite3 path: '/config/db.sqlite3'
``` ```
## Options ## Options
This section describes the individual configuration options.
### encryption_key ### encryption_key
See the [encryption_key docs](introduction.md#encryptionkey). See the [encryption_key docs](introduction.md#encryptionkey).

50
docs/content/en/configuration/telemetry/metrics.md
View File

@ -16,22 +16,27 @@ toc: true
## Configuration ## Configuration
{{< config-alert-example >}}
```yaml ```yaml
telemetry: telemetry:
metrics: metrics:
enabled: false enabled: false
address: "tcp://0.0.0.0:9959" address: 'tcp://:9959'
umask: 0022
buffers: buffers:
read: 4096 read: 4096
write: 4096 write: 4096
timeouts: timeouts:
read: 6s read: '6s'
write: 6s write: '6s'
idle: 30s idle: '30s'
``` ```
## Options ## Options
This section describes the individual configuration options.
### enabled ### enabled
{{< confkey type="boolean" default="false" required="no" >}} {{< confkey type="boolean" default="false" required="no" >}}
@ -40,20 +45,43 @@ Determines if the [Prometheus] HTTP Metrics Exporter is enabled.
### address ### address
{{< confkey type="address" default="tcp://0.0.0.0:9959" required="no" >}} {{< confkey type="address" default="tcp://:9959" required="no" >}}
Configures the listener address for the [Prometheus] HTTP Metrics Exporter. This configuration key uses the *__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
[Address](../prologue/common.md#address) format. The scheme must be `tcp://` or empty. see the [documentation](../prologue/common.md#address) on this format for more information.*
Configures the listener address for the [Prometheus] Metrics Exporter HTTP Server. The address itself is a listener and
the scheme must either be the `unix` scheme or one of the `tcp` schemes.
### umask
{{< confkey type="int" required="no" >}}
If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the
[address](#address). Typically this should be set before the process is actually running and users should not use this
option, however it's recognized in various specific scenarios this may not be completely adequate.
One such example is when you want the proxy to have permission to the socket but not the files, in which case running a
umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has
permission to the socket.
This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly.
### buffers ### buffers
Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more *__Reference Note:__ This configuration option uses the
information. [Server buffers common structure](../prologue/common.md#server-buffers). Please see the
[documentation](../prologue/common.md#server-buffers) on this structure for more information.*
Configures the server buffers.
### timeouts ### timeouts
Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more *__Reference Note:__ This configuration option uses the
information. [Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the
[documentation](../prologue/common.md#server-timeouts) on this structure for more information.*
Configures the server timeouts.
## See More ## See More

10
docs/content/en/integration/deployment/bare-metal.md
View File

@ -42,6 +42,16 @@ on most Debian based operating systems.
In addition to the `.deb` packages we also have an [APT Repository](https://apt.authelia.com). In addition to the `.deb` packages we also have an [APT Repository](https://apt.authelia.com).
## Nix
Using the Nix package manager Authelia is available via the `https://nixos.org/channels/nixpkgs-unstable` channel.
```shell
$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable
$ nix-channel --update
$ nix-env -iA nixpkgs.authelia
```
## FreeBSD ## FreeBSD
In addition to the [binaries](#binaries) we publish, [FreshPorts](https://www.freshports.org/www/authelia/) offer a In addition to the [binaries](#binaries) we publish, [FreshPorts](https://www.freshports.org/www/authelia/) offer a

14
docs/content/en/integration/kubernetes/istio.md
View File

@ -30,8 +30,8 @@ This is an example IstioOperator manifest adjusted to authenticate with Authelia
portions of the resource that you add as well as context. You will need to adapt it to your needs. portions of the resource that you add as well as context. You will need to adapt it to your needs.
```yaml ```yaml
apiVersion: install.istio.io/v1alpha1 apiVersion: 'install.istio.io/v1alpha1'
kind: IstioOperator kind: 'IstioOperator'
spec: spec:
meshConfig: meshConfig:
extensionProviders: extensionProviders:
@ -63,13 +63,13 @@ spec:
The following [Authorization Policy] applies the above filter extension provider to the `nextcloud.example.com` domain: The following [Authorization Policy] applies the above filter extension provider to the `nextcloud.example.com` domain:
```yaml ```yaml
apiVersion: security.istio.io/v1beta1 apiVersion: 'security.istio.io/v1beta1'
kind: AuthorizationPolicy kind: 'AuthorizationPolicy'
metadata: metadata:
name: nextcloud name: 'nextcloud'
namespace: apps namespace: 'apps'
spec: spec:
action: CUSTOM action: 'CUSTOM'
provider: provider:
name: 'authelia' name: 'authelia'
rules: rules:

62
docs/content/en/integration/kubernetes/traefik-ingress.md
View File

@ -51,14 +51,14 @@ __SHOULD NOT__ be applied to the Authelia [Ingress] / [IngressRoute] itself.*
{{< details "middleware.yml" >}} {{< details "middleware.yml" >}}
```yaml ```yaml
--- ---
apiVersion: traefik.containo.us/v1alpha1 apiVersion: 'traefik.containo.us/v1alpha1'
kind: Middleware kind: 'Middleware'
metadata: metadata:
name: forwardauth-authelia name: 'forwardauth-authelia'
namespace: default namespace: 'default'
labels: labels:
app.kubernetes.io/instance: authelia app.kubernetes.io/instance: 'authelia'
app.kubernetes.io/name: authelia app.kubernetes.io/name: 'authelia'
spec: spec:
forwardAuth: forwardAuth:
address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth' address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth'
@ -85,25 +85,25 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat
{{< details "ingress.yml" >}} {{< details "ingress.yml" >}}
```yaml ```yaml
--- ---
apiVersion: networking.k8s.io/v1 apiVersion: 'networking.k8s.io/v1'
kind: Ingress kind: 'Ingress'
metadata: metadata:
name: app name: 'app'
namespace: default namespace: 'default'
annotations: annotations:
traefik.ingress.kubernetes.io/router.entryPoints: websecure traefik.ingress.kubernetes.io/router.entryPoints: 'websecure'
traefik.ingress.kubernetes.io/router.middlewares: default-forwardauth-authelia@kubernetescrd traefik.ingress.kubernetes.io/router.middlewares: 'default-forwardauth-authelia@kubernetescrd'
traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.tls: 'true'
spec: spec:
rules: rules:
- host: app.example.com - host: 'app.example.com'
http: http:
paths: paths:
- path: /bar - path: '/bar'
pathType: Prefix pathType: 'Prefix'
backend: backend:
service: service:
name: app name: 'app'
port: port:
number: 80 number: 80
... ...
@ -119,27 +119,27 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat
{{< details "ingressRoute.yml" >}} {{< details "ingressRoute.yml" >}}
```yaml ```yaml
--- ---
apiVersion: traefik.containo.us/v1alpha1 apiVersion: 'traefik.containo.us/v1alpha1'
kind: IngressRoute kind: 'IngressRoute'
metadata: metadata:
name: app name: 'app'
namespace: default namespace: 'default'
spec: spec:
entryPoints: entryPoints:
- websecure - 'websecure'
routes: routes:
- kind: Rule - kind: 'Rule'
match: Host(`app.example.com`) match: 'Host(`app.example.com`)'
middlewares: middlewares:
- name: forwardauth-authelia - name: 'forwardauth-authelia'
namespace: default namespace: 'default'
services: services:
- kind: Service - kind: 'Service'
name: app name: 'app'
namespace: default namespace: 'default'
port: 80 port: 80
scheme: http scheme: 'http'
strategy: RoundRobin strategy: 'RoundRobin'
weight: 10 weight: 10
... ...
``` ```

6
docs/content/en/integration/ldap/introduction.md
View File

@ -44,8 +44,8 @@ In your Authelia configuration you will need to enter and update the following v
```yaml ```yaml
ldap: ldap:
address: 'ldap://OpenLDAP:1389'
implementation: custom implementation: custom
url: ldap://OpenLDAP:1389
timeout: 5s timeout: 5s
start_tls: false start_tls: false
tls: tls:
@ -91,8 +91,8 @@ In your Authelia configuration you will need to enter and update the following v
```yaml ```yaml
ldap: ldap:
address: 'ldaps://ldap.example.com'
implementation: custom implementation: custom
url: ldaps://ldap.example.com
timeout: 5s timeout: 5s
start_tls: false start_tls: false
tls: tls:
@ -134,8 +134,8 @@ In your Authelia configuration you will need to enter and update the following v
```yaml ```yaml
ldap: ldap:
address: 'ldap://lldap:3890'
implementation: custom implementation: custom
url: ldap://lldap:3890
timeout: 5s timeout: 5s
start_tls: false start_tls: false
base_dn: dc=example,DC=com base_dn: dc=example,DC=com

22
docs/content/en/integration/openid-connect/apache-guacamole/index.md
View File

@ -62,23 +62,23 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: guacamole - id: 'guacamole'
description: Apache Guacamole description: 'Apache Guacamole'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://guacamole.example.com - 'https://guacamole.example.com'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
response_types: response_types:
- id_token - 'id_token'
grant_types: grant_types:
- implicit - 'implicit'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

38
docs/content/en/integration/openid-connect/argocd/index.md
View File

@ -65,32 +65,32 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: argocd - id: 'argocd'
description: Argo CD description: 'Argo CD'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://argocd.example.com/auth/callback - 'https://argocd.example.com/auth/callback'
scopes: scopes:
- openid - 'openid'
- groups - 'groups'
- email - 'email'
- profile - 'profile'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
- id: argocd-cli - id: 'argocd-cli'
description: Argo CD (CLI) description: 'Argo CD (CLI)'
public: true public: true
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- http://localhost:8085/auth/callback - 'http://localhost:8085/auth/callback'
scopes: scopes:
- openid - 'openid'
- groups - 'groups'
- email - 'email'
- profile - 'profile'
- offline_access - 'offline_access'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

16
docs/content/en/integration/openid-connect/bookstack/index.md
View File

@ -67,18 +67,18 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: bookstack - id: 'bookstack'
description: BookStack description: 'BookStack'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://bookstack.example.com/oidc/callback - 'https://bookstack.example.com/oidc/callback'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

16
docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md
View File

@ -75,18 +75,18 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: cloudflare - id: 'cloudflare'
description: Cloudflare ZeroTrust description: 'Cloudflare ZeroTrust'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://example-team.cloudflareaccess.com/cdn-cgi/access/callback - 'https://example-team.cloudflareaccess.com/cdn-cgi/access/callback'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/firezone/index.md
View File

@ -76,20 +76,20 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: firezone - id: 'firezone'
description: Firezone description: 'Firezone'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
enforce_pkce: true enforce_pkce: true
pkce_challenge_method: S256 pkce_challenge_method: 'S256'
redirect_uris: redirect_uris:
- https://firezone.example.com/auth/oidc/authelia/callback - 'https://firezone.example.com/auth/oidc/authelia/callback'
scopes: scopes:
- openid - 'openid'
- email - 'email'
- profile - 'profile'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

4
docs/content/en/integration/openid-connect/frequently-asked-questions.md
View File

@ -132,7 +132,7 @@ services:
## Mandatory that the proxy is on the same network as the application, and that it has this alias. ## Mandatory that the proxy is on the same network as the application, and that it has this alias.
proxy: proxy:
aliases: aliases:
- auth.example.com - 'auth.example.com'
authelia: authelia:
networks: networks:
proxy: {} proxy: {}
@ -140,7 +140,7 @@ networks:
proxy: proxy:
## An external network can be created manually and shared between multiple compose files. This is NOT mandatory. ## An external network can be created manually and shared between multiple compose files. This is NOT mandatory.
external: true external: true
name: proxy-net name: 'proxy-net'
``` ```
```console ```console

16
docs/content/en/integration/openid-connect/gitea/index.md
View File

@ -86,18 +86,18 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: gitea - id: 'gitea'
description: Gitea description: 'Gitea'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://gitea.example.com/user/oauth2/authelia/callback - 'https://gitea.example.com/user/oauth2/authelia/callback'
scopes: scopes:
- openid - 'openid'
- email - 'email'
- profile - 'profile'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/gitlab/index.md
View File

@ -78,19 +78,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: gitlab - id: 'gitlab'
description: GitLab description: 'GitLab'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://gitlab.example.com/users/auth/openid_connect/callback - 'https://gitlab.example.com/users/auth/openid_connect/callback'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/grafana/index.md
View File

@ -96,19 +96,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: grafana - id: 'grafana'
description: Grafana description: 'Grafana'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://grafana.example.com/login/generic_oauth - 'https://grafana.example.com/login/generic_oauth'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/harbor/index.md
View File

@ -69,19 +69,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: harbor - id: 'harbor'
description: Harbor description: 'Harbor'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://harbor.example.com/c/oidc/callback - 'https://harbor.example.com/c/oidc/callback'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

20
docs/content/en/integration/openid-connect/hashicorp-vault/index.md
View File

@ -52,20 +52,20 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: vault - id: 'vault'
description: HashiCorp Vault description: 'HashiCorp Vault'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://vault.example.com/oidc/callback - 'https://vault.example.com/oidc/callback'
- https://vault.example.com/ui/vault/auth/oidc/oidc/callback - 'https://vault.example.com/ui/vault/auth/oidc/oidc/callback'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

20
docs/content/en/integration/openid-connect/kasm-workspaces/index.md
View File

@ -67,20 +67,20 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: kasm - id: 'kasm'
description: Kasm Workspaces description: 'Kasm Workspaces'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://kasm.example.com/api/oidc_callback - 'https://kasm.example.com/api/oidc_callback'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
consent_mode: implicit consent_mode: 'implicit'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

32
docs/content/en/integration/openid-connect/komga/index.md
View File

@ -50,16 +50,16 @@ spring:
client: client:
registration: registration:
authelia: authelia:
client-id: `komga` client-id: 'komga'
client-secret: `insecure_secret` client-secret: 'insecure_secret'
client-name: Authelia client-name: 'Authelia'
scope: openid,profile,email scope: 'openid,profile,email'
authorization-grant-type: authorization_code authorization-grant-type: 'authorization_code'
redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/login/oauth2/code/authelia" redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/login/oauth2/code/authelia"
provider: provider:
authelia: authelia:
issuer-uri: https://auth.example.com issuer-uri: 'https://auth.example.com'
user-name-attribute: preferred_username user-name-attribute: 'preferred_username'
```` ````
### Authelia ### Authelia
@ -74,20 +74,20 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: komga - id: 'komga'
description: Komga description: 'Komga'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://komga.example.com/login/oauth2/code/authelia - 'https://komga.example.com/login/oauth2/code/authelia'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
grant_types: grant_types:
- authorization_code - 'authorization_code'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/minio/index.md
View File

@ -72,19 +72,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: minio - id: 'minio'
description: MinIO description: 'MinIO'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://minio.example.com/apps/oidc_login/oidc - 'https://minio.example.com/apps/oidc_login/oidc'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
- groups - 'groups'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

21
docs/content/en/integration/openid-connect/misago/index.md
View File

@ -87,23 +87,24 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: misago - id: 'misago'
description: 'Misago'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
redirect_uris: redirect_uris:
- https://misago.example.com/oauth2/complete/ - 'https://misago.example.com/oauth2/complete/'
grant_types: grant_types:
- authorization_code - 'authorization_code'
response_types: response_types:
- code - 'code'
response_modes: response_modes:
- query - 'query'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
--- ---

18
docs/content/en/integration/openid-connect/nextcloud/index.md
View File

@ -95,19 +95,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: nextcloud - id: 'nextcloud'
description: NextCloud description: 'NextCloud'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://nextcloud.example.com/apps/oidc_login/oidc - 'https://nextcloud.example.com/apps/oidc_login/oidc'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
- groups - 'groups'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/outline/index.md
View File

@ -69,19 +69,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: outline - id: 'outline'
description: Outline description: 'Outline'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://outline.example.com/auth/oidc.callback - 'https://outline.example.com/auth/oidc.callback'
scopes: scopes:
- openid - 'openid'
- offline_access - 'offline_access'
- profile - 'profile'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/portainer/index.md
View File

@ -70,19 +70,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: portainer - id: 'portainer'
description: Portainer description: 'Portainer'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://portainer.example.com - 'https://portainer.example.com'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

16
docs/content/en/integration/openid-connect/proxmox/index.md
View File

@ -74,18 +74,18 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: proxmox - id: 'proxmox'
description: Proxmox description: 'Proxmox'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://proxmox.example.com - 'https://proxmox.example.com'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

16
docs/content/en/integration/openid-connect/seafile/index.md
View File

@ -78,18 +78,18 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: seafile - id: 'seafile'
description: Seafile description: 'Seafile'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://seafile.example.com/oauth/callback/ - 'https://seafile.example.com/oauth/callback/'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

16
docs/content/en/integration/openid-connect/synapse/index.md
View File

@ -72,18 +72,18 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: synapse - id: 'synapse'
description: Synapse description: 'Synapse'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://synapse.example.com/_synapse/client/oidc/callback - 'https://synapse.example.com/_synapse/client/oidc/callback'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

18
docs/content/en/integration/openid-connect/synology-dsm/index.md
View File

@ -74,19 +74,19 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: synology-dsm - id: 'synology-dsm'
description: Synology DSM description: 'Synology DSM'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false public: false
authorization_policy: two_factor authorization_policy: 'two_factor'
redirect_uris: redirect_uris:
- https://dsm.example.com - 'https://dsm.example.com'
scopes: scopes:
- openid - 'openid'
- profile - 'profile'
- groups - 'groups'
- email - 'email'
userinfo_signing_algorithm: none userinfo_signing_algorithm: 'none'
``` ```
## See Also ## See Also

60
docs/content/en/integration/openid-connect/tailscale/index.md
View File

@ -17,7 +17,7 @@ community: true
* [Authelia] * [Authelia]
* [v4.37.5](https://github.com/authelia/authelia/releases/tag/v4.37.5) * [v4.37.5](https://github.com/authelia/authelia/releases/tag/v4.37.5)
* [Tailscale] - Note: Version not important, since configuration is via the web UI * [Tailscale] - **Note:** Version not important, since configuration is via the WebUI
* [1.38.4](https://github.com/tailscale/tailscale/releases/tag/v1.38.4) * [1.38.4](https://github.com/tailscale/tailscale/releases/tag/v1.38.4)
## Before You Begin ## Before You Begin
@ -36,35 +36,39 @@ This example makes the following assumptions:
## Configuration ## Configuration
The configuration in Authelia is straightforwarded: Tailscale is just another `identity_provider/oidc` entry. Complicating things is the necessary WebFinger reply for your domain - see the following [Application](#application) section. The configuration in Authelia is straight forward, Tailscale is just another `identity_provider/oidc` entry.
Tailscale also requires a WebFinger reply for your domain - see the following [Application](#application)
section.
### Application ### Application
To configure [Tailscale] to utilize Authelia as an [OpenID Connect 1.0] Provider, you will need a public WebFinger reply for your domain (see [RFC 7033](https://www.rfc-editor.org/rfc/rfc7033#section-3.1)) and point it to Authelia. The steps necessary are outlined in the Tailscale documentation on [Custom OIDC providers](https://tailscale.com/kb/1240/sso-custom-oidc/). This WebFinger reply is not generated by Authelia, so your external webserver hosted at the root of your domain will need to generate the reponse (Check [See also](#see-also) for example implementations). The following steps are necessary to get Tailscale working with Authelia: To configure [Tailscale] to utilize Authelia as a [OpenID Connect 1.0] Provider, you will need a public WebFinger reply
for your domain (see [RFC7033 Section 3.1]) and point it to Authelia. The steps necessary are outlined in the Tailscale
documentation on [Custom OIDC providers KB article]. This WebFinger reply is not generated by Authelia, so your external
webserver hosted at the root of your domain will need to generate the response (Check [See also](#see-also) for example
implementations). The following steps are necessary to get Tailscale working with Authelia:
1. Your domain will need to reply to a WebFinger request for your Authelia account 1. Your domain will need to reply to a WebFinger request for your Authelia account
2. Your domain root is `example.com` and the Authelia account in question is `user@example.com`, the WebFinger request will be: `https://example.com/.well-known/webfinger/?resource=acct:user@example.com` (the complete request is `https://example.com/.well-known/webfinger?rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer&resource=acct%3Auser%40example.com`) 2. Your domain root is `example.com` and the Authelia account in question is `user@example.com` the WebFinger request
will be: `https://example.com/.well-known/webfinger/?resource=acct:user@example.com the complete request is `https://example.com/.well-known/webfinger?rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer&resource=acct%3Auser%40example.com`
3. The WebFinger request needs to be answered with the following example reply: 3. The WebFinger request needs to be answered with the following example reply:
``` ```json
{ {
"subject" : "acct:user@example.com", "subject": "acct:user@example.com",
"links" : "links": [{
[ "rel": "http://openid.net/specs/connect/1.0/issuer",
{ "href": "https://auth.example.com"
"rel" : "http://openid.net/specs/connect/1.0/issuer", }]
"href" : "https://auth.example.com"
}
]
} }
``` ```
4. For any other users that you want to add to Tailscale, you will need to to provide similar WebFinger replies (e.g. for `user2@example.com` or `user3@example.com`) 4. For any other users that you want to add to Tailscale, you will need to provide similar WebFinger replies (e.g. for `user2@example.com` or `user3@example.com`)
5. Once you have the WebFinger reply set up and your [Authelia OpenID Connect Discovery endpoint](https://www.authelia.com/integration/openid-connect/introduction/#well-known-discovery-endpoints) is working (e.g. `https://auth.example.com/.well-known/openid-configuration`), you can sign up for a **new Tailnet** (currently migration isn't supported) via the link: [Sign up with OIDC](https://login.tailscale.com/start/oidc) where you will see the following screen: 5. Once you have the WebFinger reply set up and your [Authelia OpenID Connect Discovery endpoint](https://www.authelia.com/integration/openid-connect/introduction/#well-known-discovery-endpoints) is working (e.g. `https://auth.example.com/.well-known/openid-configuration`), you can sign up for a **new Tailnet** (migration can only be done if the Tailnet is associated with a custom domain) via the link: [Sign up with OIDC](https://login.tailscale.com/start/oidc) where you will see the following screen: \
{{< figure src="tailscale_signup_1.png" alt="Tailscale Signup Screen 1" width="300" >}} {{< figure src="tailscale_signup_1.png" alt="Tailscale Signup Screen 1" width="300" >}} \
**Note:** Even though the WebFinger URL displayed is `https://example.com/.well-known/webfinger`, the actual GET request will be including request parameters, most importantly `resource`. **Note:** Even though the WebFinger URL displayed is `https://example.com/.well-known/webfinger`, the actual GET request will be including request parameters, most importantly `resource`.
6. After clicking on **Get OIDC Issuer**, Tailscale will fetch the WebFinger reply via `https://example.com/.well-known/webfinger/?resource=acct:user@example.com` and follow the set `href` to `https://auth.example.com/.well-known/openid-configuration`. 6. After clicking on **Get OIDC Issuer**, Tailscale will fetch the WebFinger reply via `https://example.com/.well-known/webfinger/?resource=acct:user@example.com` and follow the set `href` to `https://auth.example.com/.well-known/openid-configuration`. \
**Note:** make sure that the `href` URL matches the `issuer` URL returned from the Authelia OIDC dicsovery endpoint **Note:** Make sure that the `href` URL matches the `issuer` URL returned from the Authelia OIDC discovery endpoint
7. On the next screen you will need to add your client ID & secret configured in Authelia to finish the OIDC provider registration in [Tailscale]. See the following example screenshot: 7. On the next screen you will need to add your client ID & secret configured in Authelia to finish the OIDC provider registration in [Tailscale]. See the following example screenshot: \
{{< figure src="tailscale_signup_2.png" alt="Tailscale Signup Screen 2" width="300" >}} {{< figure src="tailscale_signup_2.png" alt="Tailscale Signup Screen 2" width="300" >}}
@ -80,23 +84,25 @@ identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc ## See: https://www.authelia.com/c/oidc
clients: clients:
- id: tailscale - id: 'tailscale'
description: Tailscale SSO description: 'Tailscale'
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
redirect_uris: redirect_uris:
- https://login.tailscale.com/a/oauth_response - 'https://login.tailscale.com/a/oauth_response'
scopes: scopes:
- openid - 'openid'
- email - 'email'
- profile - 'profile'
``` ```
## See Also ## See Also
- [Tailscale] [Custom OIDC Provider Knowledge Base entry](https://tailscale.com/kb/1240/sso-custom-oidc/): - [Tailscale] [Custom OIDC providers KB article]
- [RFC 7033, Identity Provider Discovery for OpenID Connect](https://www.rfc-editor.org/rfc/rfc7033#section-3.1) - [RFC7033 Section 3.1] _WebFinger: Identity Provider Discovery for OpenID Connect_
- [WebFinger example implementations](https://webfinger.net/code/) - [WebFinger example implementations](https://webfinger.net/code/)
[Authelia]: https://www.authelia.com [Authelia]: https://www.authelia.com
[Tailscale]: https://tailscale.com [Tailscale]: https://tailscale.com
[Custom OIDC providers KB article]: https://tailscale.com/kb/1240/sso-custom-oidc/
[RFC7033 Section 3.1]: https://datatracker.ietf.org/doc/html/rfc7033#section-3.1
[OpenID Connect 1.0]: ../../openid-connect/introduction.md [OpenID Connect 1.0]: ../../openid-connect/introduction.md

2
docs/content/en/integration/proxies/caddy.md
View File

@ -101,7 +101,7 @@ server:
endpoints: endpoints:
authz: authz:
forward-auth: forward-auth:
implementation: ForwardAuth implementation: 'ForwardAuth'
``` ```
## Configuration ## Configuration

168
docs/content/en/integration/proxies/envoy.md
View File

@ -75,7 +75,7 @@ server:
endpoints: endpoints:
authz: authz:
ext-authz: ext-authz:
implementation: ExtAuthz implementation: 'ExtAuthz'
``` ```
## Configuration ## Configuration
@ -97,47 +97,47 @@ Support for [Envoy] is possible with Authelia v4.37.0 and higher via the [Envoy]
version: "3.8" version: "3.8"
networks: networks:
net: net:
driver: bridge driver: 'bridge'
services: services:
envoy: envoy:
container_name: envoy container_name: 'envoy'
image: envoyproxy/envoy:v1.24 image: 'envoyproxy/envoy:v1.24'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
ports: ports:
- '80:8080' - '80:8080'
- '443:8443' - '443:8443'
volumes: volumes:
- ${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro - '${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro'
- ${PWD}/data/certificates:/certificates:ro - '${PWD}/data/certificates:/certificates:ro'
authelia: authelia:
container_name: authelia container_name: 'authelia'
image: authelia/authelia image: 'authelia/authelia'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 9091 - 9091
volumes: volumes:
- ${PWD}/data/authelia/config:/config - '${PWD}/data/authelia/config:/config'
environment: environment:
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
nextcloud: nextcloud:
container_name: nextcloud container_name: 'nextcloud'
image: linuxserver/nextcloud image: 'linuxserver/nextcloud'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 443 - 443
volumes: volumes:
- ${PWD}/data/nextcloud/config:/config - '${PWD}/data/nextcloud/config:/config'
- ${PWD}/data/nextcloud/data:/data - '${PWD}/data/nextcloud/data:/data'
environment: environment:
PUID: "1000" PUID: '1000'
PGID: "1000" PGID: '1000'
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
``` ```
{{< /details >}} {{< /details >}}
@ -145,92 +145,92 @@ services:
```yaml ```yaml
static_resources: static_resources:
listeners: listeners:
- name: listener_http - name: 'listener_http'
address: address:
socket_address: socket_address:
address: 0.0.0.0 address: '0.0.0.0'
port_value: 8080 port_value: 8080
filter_chains: filter_chains:
- filters: - filters:
- name: envoy.filters.network.http_connection_manager - name: 'envoy.filters.network.http_connection_manager'
typed_config: typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager'
codec_type: auto codec_type: 'auto'
stat_prefix: ingress_http stat_prefix: 'ingress_http'
route_config: route_config:
name: local_route name: 'local_route'
virtual_hosts: virtual_hosts:
- name: backend - name: 'backend'
domains: ["*"] domains: ['*']
routes: routes:
- match: - match:
prefix: "/" prefix: '/'
redirect: redirect:
https_redirect: true https_redirect: true
http_filters: http_filters:
- name: envoy.filters.http.router - name: 'envoy.filters.http.router'
typed_config: typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router'
- name: listener_https - name: 'listener_https'
address: address:
socket_address: socket_address:
address: 0.0.0.0 address: '0.0.0.0'
port_value: 8443 port_value: 8443
filter_chains: filter_chains:
- filters: - filters:
- name: envoy.filters.network.http_connection_manager - name: 'envoy.filters.network.http_connection_manager'
typed_config: typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager'
stat_prefix: ingress_http stat_prefix: 'ingress_http'
use_remote_address: true use_remote_address: true
skip_xff_append: false skip_xff_append: false
route_config: route_config:
name: local_route name: 'local_route'
virtual_hosts: virtual_hosts:
- name: whoami_service - name: 'whoami_service'
domains: ["nextcloud.example.com"] domains: ["nextcloud.example.com"]
routes: routes:
- match: - match:
prefix: "/" prefix: "/"
route: route:
cluster: nextcloud cluster: 'nextcloud'
- name: authelia_service - name: 'authelia_service'
domains: ["auth.example.com"] domains: ['auth.example.com']
typed_per_filter_config: typed_per_filter_config:
envoy.filters.http.ext_authz: envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute'
disabled: true disabled: true
routes: routes:
- match: - match:
prefix: "/" prefix: '/'
route: route:
cluster: authelia cluster: 'authelia'
http_filters: http_filters:
- name: envoy.filters.http.ext_authz - name: 'envoy.filters.http.ext_authz'
typed_config: typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz'
transport_api_version: v3 transport_api_version: 'v3'
allowed_headers: allowed_headers:
patterns: patterns:
- exact: authorization - exact: 'authorization'
- exact: proxy-authorization - exact: 'proxy-authorization'
- exact: accept - exact: 'accept'
- exact: cookie - exact: 'cookie'
http_service: http_service:
path_prefix: /api/authz/ext-authz/ path_prefix: '/api/authz/ext-authz/'
server_uri: server_uri:
uri: authelia:9091 uri: 'authelia:9091'
cluster: authelia cluster: 'authelia'
timeout: 0.25s timeout: '0.25s'
authorization_request: authorization_request:
allowed_headers: allowed_headers:
patterns: patterns:
- exact: authorization - exact: 'authorization'
- exact: proxy-authorization - exact: 'proxy-authorization'
- exact: accept - exact: 'accept'
- exact: cookie - exact: 'cookie'
headers_to_add: headers_to_add:
- key: X-Forwarded-Proto - key: 'X-Forwarded-Proto'
value: '%REQ(:SCHEME)%' value: '%REQ(:SCHEME)%'
## The following commented lines are for configuring the Authelia URL in the proxy. We ## The following commented lines are for configuring the Authelia URL in the proxy. We
## strongly suggest this is configured in the Session Cookies section of the Authelia configuration. ## strongly suggest this is configured in the Session Cookies section of the Authelia configuration.
@ -239,52 +239,52 @@ static_resources:
authorization_response: authorization_response:
allowed_upstream_headers: allowed_upstream_headers:
patterns: patterns:
- exact: authorization - exact: 'authorization'
- exact: proxy-authorization - exact: 'proxy-authorization'
- prefix: remote- - prefix: 'remote-'
- prefix: authelia- - prefix: 'authelia-'
allowed_client_headers: allowed_client_headers:
patterns: patterns:
- exact: set-cookie - exact: 'set-cookie'
allowed_client_headers_on_success: allowed_client_headers_on_success:
patterns: patterns:
- exact: set-cookie - exact: 'set-cookie'
failure_mode_allow: false failure_mode_allow: false
- name: envoy.filters.http.router - name: 'envoy.filters.http.router'
typed_config: typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router'
clusters: clusters:
- name: nextcloud - name: 'nextcloud'
connect_timeout: 0.25s connect_timeout: '0.25s'
type: logical_dns type: 'logical_dns'
dns_lookup_family: v4_only dns_lookup_family: 'v4_only'
lb_policy: round_robin lb_policy: 'round_robin'
load_assignment: load_assignment:
cluster_name: nextcloud cluster_name: 'nextcloud'
endpoints: endpoints:
- lb_endpoints: - lb_endpoints:
- endpoint: - endpoint:
address: address:
socket_address: socket_address:
address: nextcloud address: 'nextcloud'
port_value: 80 port_value: 80
- name: authelia - name: 'authelia'
connect_timeout: 0.25s connect_timeout: '0.25s'
type: logical_dns type: 'logical_dns'
dns_lookup_family: v4_only dns_lookup_family: 'v4_only'
lb_policy: round_robin lb_policy: 'round_robin'
load_assignment: load_assignment:
cluster_name: authelia cluster_name: 'authelia'
endpoints: endpoints:
- lb_endpoints: - lb_endpoints:
- endpoint: - endpoint:
address: address:
socket_address: socket_address:
address: authelia address: 'authelia'
port_value: 9091 port_value: 9091
layered_runtime: layered_runtime:
layers: layers:
- name: static_layer_0 - name: 'static_layer_0'
static_layer: static_layer:
envoy: envoy:
resource_limits: resource_limits:

2
docs/content/en/integration/proxies/haproxy.md
View File

@ -104,7 +104,7 @@ server:
endpoints: endpoints:
authz: authz:
forward-auth: forward-auth:
implementation: ForwardAuth implementation: 'ForwardAuth'
``` ```
## Configuration ## Configuration

38
docs/content/en/integration/proxies/nginx-proxy-manager/index.md
View File

@ -75,13 +75,13 @@ version: "3.8"
networks: networks:
net: net:
driver: bridge driver: 'bridge'
services: services:
nginx: nginx:
container_name: nginx container_name: 'nginx'
image: jc21/nginx-proxy-manager image: 'jc21/nginx-proxy-manager'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []
@ -90,44 +90,44 @@ services:
- '81:81' - '81:81'
- '443:443' - '443:443'
volumes: volumes:
- ${PWD}/data/nginx-proxy-manager/data:/data - '${PWD}/data/nginx-proxy-manager/data:/data'
- ${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt - '${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt'
- ${PWD}/data/nginx/snippets:/snippets:ro - '${PWD}/data/nginx/snippets:/snippets:ro'
environment: environment:
TZ: 'Australia/Melbourne' TZ: 'Australia/Melbourne'
authelia: authelia:
container_name: authelia container_name: 'authelia'
image: authelia/authelia image: 'authelia/authelia'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []
expose: expose:
- 9091 - 9091
volumes: volumes:
- ${PWD}/data/authelia/config:/config - '${PWD}/data/authelia/config:/config'
environment: environment:
TZ: 'Australia/Melbourne' TZ: 'Australia/Melbourne'
nextcloud: nextcloud:
container_name: nextcloud container_name: 'nextcloud'
image: lscr.io/linuxserver/nextcloud image: 'lscr.io/linuxserver/nextcloud'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []
expose: expose:
- 443 - 443
volumes: volumes:
- ${PWD}/data/nextcloud/config:/config - '${PWD}/data/nextcloud/config:/config'
- ${PWD}/data/nextcloud/data:/data - '${PWD}/data/nextcloud/data:/data'
environment: environment:
PUID: '1000' PUID: '1000'
PGID: '1000' PGID: '1000'
TZ: 'Australia/Melbourne' TZ: 'Australia/Melbourne'
whoami: whoami:
container_name: whoami container_name: 'whoami'
image: docker.io/traefik/whoami image: 'docker.io/traefik/whoami'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []

2
docs/content/en/integration/proxies/nginx.md
View File

@ -90,7 +90,7 @@ server:
endpoints: endpoints:
authz: authz:
auth-request: auth-request:
implementation: AuthRequest implementation: 'AuthRequest'
``` ```
## Docker Compose ## Docker Compose

36
docs/content/en/integration/proxies/swag.md
View File

@ -156,13 +156,13 @@ version: "3.8"
networks: networks:
net: net:
driver: bridge driver: 'bridge'
services: services:
swag: swag:
container_name: swag container_name: 'swag'
image: lscr.io/linuxserver/swag image: 'lscr.io/linuxserver/swag'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []
@ -170,7 +170,7 @@ services:
- '80:80' - '80:80'
- '443:443' - '443:443'
volumes: volumes:
- ${PWD}/data/swag:/config - '${PWD}/data/swag:/config'
## Uncomment the line below if you want to use the Authelia configuration snippets. ## Uncomment the line below if you want to use the Authelia configuration snippets.
#- ${PWD}/data/nginx/snippets:/snippets:ro #- ${PWD}/data/nginx/snippets:/snippets:ro
environment: environment:
@ -184,40 +184,40 @@ services:
ONLY_SUBDOMAINS: 'false' ONLY_SUBDOMAINS: 'false'
STAGING: 'true' STAGING: 'true'
cap_add: cap_add:
- NET_ADMIN - 'NET_ADMIN'
authelia: authelia:
container_name: authelia container_name: 'authelia'
image: authelia/authelia image: 'authelia/authelia'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []
expose: expose:
- 9091 - 9091
volumes: volumes:
- ${PWD}/data/authelia/config:/config - '${PWD}/data/authelia/config:/config'
environment: environment:
TZ: 'Australia/Melbourne' TZ: 'Australia/Melbourne'
nextcloud: nextcloud:
container_name: nextcloud container_name: 'nextcloud'
image: lscr.io/linuxserver/nextcloud image: 'lscr.io/linuxserver/nextcloud'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []
expose: expose:
- 443 - 443
volumes: volumes:
- ${PWD}/data/nextcloud/config:/config - '${PWD}/data/nextcloud/config:/config'
- ${PWD}/data/nextcloud/data:/data - '${PWD}/data/nextcloud/data:/data'
environment: environment:
PUID: '1000' PUID: '1000'
PGID: '1000' PGID: '1000'
TZ: 'Australia/Melbourne' TZ: 'Australia/Melbourne'
whoami: whoami:
container_name: whoami container_name: 'whoami'
image: docker.io/traefik/whoami image: 'docker.io/traefik/whoami'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: net:
aliases: [] aliases: []

240
docs/content/en/integration/proxies/traefik.md
View File

@ -75,7 +75,7 @@ server:
endpoints: endpoints:
authz: authz:
forward-auth: forward-auth:
implementation: ForwardAuth implementation: 'ForwardAuth'
``` ```
## Configuration ## Configuration
@ -130,9 +130,9 @@ networks:
driver: bridge driver: bridge
services: services:
traefik: traefik:
container_name: traefik container_name: 'traefik'
image: traefik:v2.9 image: 'traefik:v2.9'
restart: unless-stopped restart: 'unless-stopped'
command: command:
- '--api=true' - '--api=true'
- '--api.dashboard=true' - '--api.dashboard=true'
@ -164,11 +164,11 @@ services:
networks: networks:
net: {} net: {}
ports: ports:
- "80:8080" - '80:8080'
- "443:8443" - '443:8443'
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - '/var/run/docker.sock:/var/run/docker.sock'
- ${PWD}/data/traefik:/config - '${PWD}/data/traefik:/config'
labels: labels:
- 'traefik.enable=true' - 'traefik.enable=true'
- 'traefik.http.routers.api.rule=Host(`traefik.example.com`)' - 'traefik.http.routers.api.rule=Host(`traefik.example.com`)'
@ -177,15 +177,15 @@ services:
- 'traefik.http.routers.api.service=api@internal' - 'traefik.http.routers.api.service=api@internal'
- 'traefik.http.routers.api.middlewares=authelia@docker' - 'traefik.http.routers.api.middlewares=authelia@docker'
authelia: authelia:
container_name: authelia container_name: 'authelia'
image: authelia/authelia image: 'authelia/authelia'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 9091 - 9091
volumes: volumes:
- ${PWD}/data/authelia/config:/config - '${PWD}/data/authelia/config:/config'
environment: environment:
TZ: "Australia/Melbourne" TZ: "Australia/Melbourne"
labels: labels:
@ -200,20 +200,20 @@ services:
- 'traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true' - 'traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true'
- 'traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' - 'traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
nextcloud: nextcloud:
container_name: nextcloud container_name: 'nextcloud'
image: linuxserver/nextcloud image: 'linuxserver/nextcloud'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 443 - 443
volumes: volumes:
- ${PWD}/data/nextcloud/config:/config - '${PWD}/data/nextcloud/config:/config'
- ${PWD}/data/nextcloud/data:/data - '${PWD}/data/nextcloud/data:/data'
environment: environment:
PUID: "1000" PUID: '1000'
PGID: "1000" PGID: '1000'
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
labels: labels:
- 'traefik.enable=true' - 'traefik.enable=true'
- 'traefik.http.routers.nextcloud.rule=Host(`nextcloud.example.com`)' - 'traefik.http.routers.nextcloud.rule=Host(`nextcloud.example.com`)'
@ -221,19 +221,19 @@ services:
- 'traefik.http.routers.nextcloud.tls=true' - 'traefik.http.routers.nextcloud.tls=true'
- 'traefik.http.routers.nextcloud.middlewares=authelia@docker' - 'traefik.http.routers.nextcloud.middlewares=authelia@docker'
heimdall: heimdall:
container_name: heimdall container_name: 'heimdall'
image: linuxserver/heimdall image: 'linuxserver/heimdall'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 443 - 443
volumes: volumes:
- ${PWD}/data/heimdall/config:/config - '${PWD}/data/heimdall/config:/config'
environment: environment:
PUID: "1000" PUID: '1000'
PGID: "1000" PGID: '1000'
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
labels: labels:
- 'traefik.enable=true' - 'traefik.enable=true'
- 'traefik.http.routers.heimdall.rule=Host(`heimdall.example.com`)' - 'traefik.http.routers.heimdall.rule=Host(`heimdall.example.com`)'
@ -264,12 +264,12 @@ This example uses a `docker-compose.yml` similar to the one above however it has
version: "3.8" version: "3.8"
networks: networks:
net: net:
driver: bridge driver: 'bridge'
services: services:
traefik: traefik:
container_name: traefik container_name: 'traefik'
image: traefik:v2.9 image: 'traefik:v2.9'
restart: unless-stopped restart: 'unless-stopped'
command: command:
- '--api=true' - '--api=true'
- '--api.dashboard=true' - '--api.dashboard=true'
@ -294,74 +294,74 @@ services:
networks: networks:
net: {} net: {}
ports: ports:
- "80:8080" - '80:8080'
- "443:8443" - '443:8443'
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - '/var/run/docker.sock:/var/run/docker.sock'
- ${PWD}/data/traefik/config:/config - '${PWD}/data/traefik/config:/config'
- ${PWD}/data/traefik/certificates:/certificates - '${PWD}/data/traefik/certificates:/certificates'
labels: labels:
- 'traefik.enable=true' - 'traefik.enable=true'
authelia: authelia:
container_name: authelia container_name: 'authelia'
image: authelia/authelia image: 'authelia/authelia'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 9091 - 9091
volumes: volumes:
- ${PWD}/data/authelia/config:/config - '${PWD}/data/authelia/config:/config'
- ${PWD}/data/authelia/certificates:/certificates - '${PWD}/data/authelia/certificates:/certificates'
environment: environment:
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
labels: labels:
- 'traefik.enable=true' - 'traefik.enable=true'
nextcloud: nextcloud:
container_name: nextcloud container_name: 'nextcloud'
image: linuxserver/nextcloud image: 'linuxserver/nextcloud'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 443 - 443
volumes: volumes:
- ${PWD}/data/nextcloud/config:/config - '${PWD}/data/nextcloud/config:/config'
- ${PWD}/data/nextcloud/data:/data - '${PWD}/data/nextcloud/data:/data'
environment: environment:
PUID: "1000" PUID: '1000'
PGID: "1000" PGID: '1000'
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
labels: labels:
- 'traefik.enable=true' - 'traefik.enable=true'
heimdall: heimdall:
container_name: heimdall container_name: 'heimdall'
image: linuxserver/heimdall image: 'linuxserver/heimdall'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 443 - 443
volumes: volumes:
- ${PWD}/data/heimdall/config:/config - '${PWD}/data/heimdall/config:/config'
environment: environment:
PUID: "1000" PUID: '1000'
PGID: "1000" PGID: '1000'
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
labels: labels:
- 'traefik.enable=true' - 'traefik.enable=true'
whoami: whoami:
container_name: whoami container_name: 'whoami'
image: traefik/whoami:latest image: 'traefik/whoami:latest'
restart: unless-stopped restart: 'unless-stopped'
networks: networks:
net: {} net: {}
expose: expose:
- 80 - 80
environment: environment:
TZ: "Australia/Melbourne" TZ: 'Australia/Melbourne'
labels: labels:
- "traefik.enable=true" - 'traefik.enable=true'
... ...
``` ```
{{< /details >}} {{< /details >}}
@ -391,16 +391,16 @@ entryPoints:
tls: tls:
options: options:
modern: modern:
minVersion: "VersionTLS13" minVersion: 'VersionTLS13'
intermediate: intermediate:
minVersion: "VersionTLS12" minVersion: 'VersionTLS12'
cipherSuites: cipherSuites:
- "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" - 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256'
- "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" - 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'
- "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" - 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384'
- "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" - 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
- "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305" - 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305'
- "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" - 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305'
http: http:
middlewares: middlewares:
authelia: authelia:
@ -418,9 +418,9 @@ http:
- 'Remote-Email' - 'Remote-Email'
- 'Remote-Name' - 'Remote-Name'
tls: tls:
ca: /certificates/ca.public.crt ca: '/certificates/ca.public.crt'
cert: /certificates/traefik.public.crt cert: '/certificates/traefik.public.crt'
key: /certificates/traefik.private.pem key: '/certificates/traefik.private.pem'
authelia-basic: authelia-basic:
forwardAuth: forwardAuth:
address: 'https://authelia:9091/api/verify?auth=basic' address: 'https://authelia:9091/api/verify?auth=basic'
@ -433,86 +433,86 @@ http:
- 'Remote-Email' - 'Remote-Email'
- 'Remote-Name' - 'Remote-Name'
tls: tls:
ca: /certificates/ca.public.crt ca: '/certificates/ca.public.crt'
cert: /certificates/traefik.public.crt cert: '/certificates/traefik.public.crt'
key: /certificates/traefik.private.pem key: '/certificates/traefik.private.pem'
routers: routers:
traefik: traefik:
rule: Host(`traefik.example.com`) rule: 'Host(`traefik.example.com`)'
entryPoints: websecure entryPoints: 'websecure'
service: api@internal service: 'api@internal'
middlewares: middlewares:
- authelia@file - 'authelia@file'
tls: tls:
options: modern@file options: 'modern@file'
certResolver: default certResolver: 'default'
domains: domains:
- main: "example.com" - main: 'example.com'
sans: sans:
- "*.example.com" - '*.example.com'
whoami: whoami:
rule: Host(`whoami.example.com`) rule: 'Host(`whoami.example.com`)'
entryPoints: websecure entryPoints: 'websecure'
service: whoami-net@docker service: 'whoami-net@docker'
middlewares: middlewares:
- authelia@file - 'authelia@file'
tls: tls:
options: modern@file options: 'modern@file'
certResolver: default certResolver: 'default'
domains: domains:
- main: "example.com" - main: 'example.com'
sans: sans:
- "*.example.com" - '*.example.com'
nextcloud: nextcloud:
rule: Host(`nextcloud.example.com`) rule: 'Host(`nextcloud.example.com`)'
entryPoints: websecure entryPoints: 'websecure'
service: nextcloud-net@docker service: 'nextcloud-net@docker'
middlewares: middlewares:
- authelia@file - 'authelia@file'
tls: tls:
options: modern@file options: 'modern@file'
certResolver: default certResolver: 'default'
domains: domains:
- main: "example.com" - main: 'example.com'
sans: sans:
- "*.example.com" - '*.example.com'
heimdall: heimdall:
rule: Host(`heimdall.example.com`) rule: 'Host(`heimdall.example.com`)'
entryPoints: websecure entryPoints: 'websecure'
service: heimdall-net@docker service: 'heimdall-net@docker'
middlewares: middlewares:
- authelia-basic@file - 'authelia-basic@file'
tls: tls:
options: modern@file options: 'modern@file'
certResolver: default certResolver: 'default'
domains: domains:
- main: "example.com" - main: 'example.com'
sans: sans:
- "*.example.com" - '*.example.com'
authelia: authelia:
rule: Host(`auth.example.com`) rule: 'Host(`auth.example.com`)'
entryPoints: websecure entryPoints: 'websecure'
service: authelia@file service: 'authelia@file'
tls: tls:
options: modern@file options: 'modern@file'
certResolver: default certResolver: 'default'
domains: domains:
- main: "example.com" - main: 'example.com'
sans: sans:
- "*.example.com" - '*.example.com'
services: services:
authelia: authelia:
loadBalancer: loadBalancer:
servers: servers:
- url: https://authelia:9091/ - url: 'https://authelia:9091/'
serversTransport: autheliaMutualTLS serversTransport: 'autheliaMutualTLS'
serversTransports: serversTransports:
autheliaMutualTLS: autheliaMutualTLS:
certificates: certificates:
- certFile: /certificates/traefik.public.crt - certFile: '/certificates/traefik.public.crt'
keyFile: /certificates/traefik.private.pem keyFile: '/certificates/traefik.private.pem'
rootCAs: rootCAs:
- /certificates/ca.public.crt - '/certificates/ca.public.crt'
... ...
``` ```
{{< /details >}} {{< /details >}}

60
docs/content/en/integration/proxies/traefikv1.md
View File

@ -88,7 +88,7 @@ server:
endpoints: endpoints:
authz: authz:
forward-auth: forward-auth:
implementation: ForwardAuth implementation: 'ForwardAuth'
``` ```
## Configuration ## Configuration
@ -119,15 +119,15 @@ version: '3'
networks: networks:
net: net:
driver: bridge driver: 'bridge'
services: services:
traefik: traefik:
image: traefik:v1.7.34-alpine image: 'traefik:v1.7.34-alpine'
container_name: traefik container_name: 'traefik'
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - '/var/run/docker.sock:/var/run/docker.sock'
networks: networks:
- net - 'net'
labels: labels:
- 'traefik.frontend.rule=Host:traefik.example.com' - 'traefik.frontend.rule=Host:traefik.example.com'
- 'traefik.port=8081' - 'traefik.port=8081'
@ -135,7 +135,7 @@ services:
- '80:80' - '80:80'
- '443:443' - '443:443'
- '8081:8081' - '8081:8081'
restart: unless-stopped restart: 'unless-stopped'
command: command:
- '--api' - '--api'
- '--api.entrypoint=api' - '--api.entrypoint=api'
@ -151,27 +151,27 @@ services:
# - '--entryPoints=Name:https Address::443 TLS ForwardedHeaders.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7 ProxyProtocol.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7' # - '--entryPoints=Name:https Address::443 TLS ForwardedHeaders.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7 ProxyProtocol.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7'
- '--entryPoints=Name:api Address::8081' - '--entryPoints=Name:api Address::8081'
authelia: authelia:
image: authelia/authelia image: 'authelia/authelia'
container_name: authelia container_name: 'authelia'
volumes: volumes:
- /path/to/authelia:/config - '/path/to/authelia:/config'
networks: networks:
- net - 'net'
labels: labels:
- 'traefik.frontend.rule=Host:auth.example.com' - 'traefik.frontend.rule=Host:auth.example.com'
expose: expose:
- 9091 - 9091
restart: unless-stopped restart: 'unless-stopped'
environment: environment:
- TZ=Australia/Melbourne TZ: 'Australia/Melbourne'
nextcloud: nextcloud:
image: linuxserver/nextcloud image: 'linuxserver/nextcloud'
container_name: nextcloud container_name: 'nextcloud'
volumes: volumes:
- /path/to/nextcloud/config:/config - '/path/to/nextcloud/config:/config'
- /path/to/nextcloud/data:/data - '/path/to/nextcloud/data:/data'
networks: networks:
- net - 'net'
labels: labels:
- 'traefik.frontend.rule=Host:nextcloud.example.com' - 'traefik.frontend.rule=Host:nextcloud.example.com'
- 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth' - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth'
@ -182,18 +182,18 @@ services:
- 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
expose: expose:
- 443 - 443
restart: unless-stopped restart: 'unless-stopped'
environment: environment:
- PUID=1000 PUID: '1000'
- PGID=1000 PGID: '1000'
- TZ=Australia/Melbourne TZ: 'Australia/Melbourne'
heimdall: heimdall:
image: linuxserver/heimdall image: 'linuxserver/heimdall'
container_name: heimdall container_name: 'heimdall'
volumes: volumes:
- /path/to/heimdall/config:/config - '/path/to/heimdall/config:/config'
networks: networks:
- net - 'net'
labels: labels:
- 'traefik.frontend.rule=Host:heimdall.example.com' - 'traefik.frontend.rule=Host:heimdall.example.com'
- 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth/basic' - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth/basic'
@ -201,11 +201,11 @@ services:
- 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
expose: expose:
- 443 - 443
restart: unless-stopped restart: 'unless-stopped'
environment: environment:
- PUID=1000 PUID: '1000'
- PGID=1000 PGID: '1000'
- TZ=Australia/Melbourne TZ: 'Australia/Melbourne'
``` ```
## See Also ## See Also

14
docs/content/en/overview/security/measures.md
View File

@ -160,7 +160,7 @@ values.
As such all SMTP connections require the following: As such all SMTP connections require the following:
1. A TLS Connection (STARTTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated 1. A TLS Connection (StartTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated
connections require it as well_) connections require it as well_)
2. Valid X509 Certificate presented to the client during the TLS handshake 2. Valid X509 Certificate presented to the client during the TLS handshake
@ -207,22 +207,22 @@ for SMTP servers that allow unauthenticated relaying (bad practice).
### SMTP Ports ### SMTP Ports
All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via STARTTLS. All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via StartTLS.
The [`submissions` service][service-submissions] (_typically port 465_) is an exception to this rule, where the The [`submissions` service][service-submissions] (_typically port 465_) is an exception to this rule, where the
connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [port for connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [scheme for
SMTP][docs-config-smtp-port] is set to `465`, Authelia will initiate TLS connections without requiring STARTTLS SMTP][docs-config-smtp-port] is set to `submissions`, Authelia will initiate TLS connections without requiring StartTLS
negotiation. negotiation.
When the `submissions` service port is available, it [should be preferred][port-465] over any STARTTLS port for When the `submissions` service port is available, it [should be preferred][port-465] over any StartTLS port for
submitting mail. submitting mail.
**NOTE:** Prior to 2018, port 465 was previously assigned for a similar purpose known as [`smtps`][port-465] (_A TLS **NOTE:** Prior to 2018, port 465 was previously assigned for a similar purpose known as [`smtps`][port-465] (_A TLS
only equivalent of the `smtp` port 25_), which it had been deprecated for. Port 465 has since been re-assigned for only only equivalent of the `smtp` port 25_), which it had been deprecated for. Port 465 has since been re-assigned for only
supporting mail submission (_which unlike SMTP transfers via port 25, [requires authentication][smtp-auth]_), similar supporting mail submission (_which unlike SMTP transfers via port 25, [requires authentication][smtp-auth]_), similar
to port 587 (_the `submission` port, a common alternative that uses STARTTLS instead_). to port 587 (_the `submission` port, a common alternative that uses StartTLS instead_).
[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#port [docs-config-smtp-port]: ../../configuration/notifications/smtp.md#address
[cleartext]: https://cwe.mitre.org/data/definitions/312.html [cleartext]: https://cwe.mitre.org/data/definitions/312.html
[service-submissions]: https://datatracker.ietf.org/doc/html/rfc8314#section-7.3 [service-submissions]: https://datatracker.ietf.org/doc/html/rfc8314#section-7.3
[port-465]: https://datatracker.ietf.org/doc/html/rfc8314#section-3.3 [port-465]: https://datatracker.ietf.org/doc/html/rfc8314#section-3.3

31
docs/content/en/reference/guides/passwords.md
View File

@ -26,30 +26,31 @@ The format of the [YAML] file is as follows:
users: users:
john: john:
disabled: false disabled: false
displayname: "John Doe" displayname: 'John Doe'
password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
email: john.doe@authelia.com email: 'john.doe@authelia.com'
groups: groups:
- admins - 'admins'
- dev - 'dev'
harry: harry:
disabled: false disabled: false
displayname: "Harry Potter" displayname: 'Harry Potter'
password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
email: harry.potter@authelia.com email: 'harry.potter@authelia.com'
groups: [] groups: []
bob: bob:
disabled: false disabled: false
displayname: "Bob Dylan" displayname: 'Bob Dylan'
password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
email: bob.dylan@authelia.com email: 'bob.dylan@authelia.com'
groups: groups:
- dev - 'dev'
james: james:
disabled: false disabled: false
displayname: "James Dean" displayname: 'James Dean'
password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
email: james.dean@authelia.com email: 'james.dean@authelia.com'
groups: []
``` ```
## Passwords ## Passwords

2
docs/content/en/reference/guides/troubleshooting.md
View File

@ -2,7 +2,7 @@
title: "Troubleshooting" title: "Troubleshooting"
description: "This guide describes and helps users provide information during troubleshooting including sanitization etc" description: "This guide describes and helps users provide information during troubleshooting including sanitization etc"
lead: "This guide describes and helps users provide troubleshooting information." lead: "This guide describes and helps users provide troubleshooting information."
date: 2023-05-01T11:30:07+10:00 date: 2023-05-01T12:36:02+10:00
draft: false draft: false
images: [] images: []
menu: menu:

25
docs/content/en/reference/integrations/time-based-one-time-password-apps.md 100644
View File

@ -0,0 +1,25 @@
---
title: "Time-based OTP Applications"
description: "A Time-based OTP Application integration reference guide"
lead: "This section contains a Time-based OTP Application integration reference guide for Authelia."
date: 2023-05-07T17:52:47+10:00
draft: false
images: []
menu:
reference:
parent: "integrations"
weight: 320
toc: true
---
## Settings
Authelia allows for a wide variety of time-based OTP settings. There are several applications which can support these
algorithms and this matrix is a guide on applications that have been tested that work. It should not be assumed if an
application is on this list that the information is correct for the current version of a product and it's likely they
may now support some that were not previously supported, or in rare cases they may support less than they previously
did.
{{< table-totp-support >}}

2
docs/data/configkeys.json
View File

File diff suppressed because one or more lines are too long

12
docs/data/support.json 100644
View File

@ -0,0 +1,12 @@
{
"totp": [
{"name": "Google Authenticator", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US&pli=1"},
{"name": "Bitwarden", "clear": true, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://bitwarden.com/"},
{"name": "Yubico Authenticator", "clear": true, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": true}, "url": "https://www.yubico.com/products/yubico-authenticator/"},
{"name": "Authenticator Plus", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://www.authenticatorplus.com/"},
{"name": "1Password", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://1password.com/"},
{"name": "Ravio", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://raivo-otp.com/"},
{"name": "Authy", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": false, "eight": true}, "url": "https://authy.com/"},
{"name": "Aegis", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://getaegis.app/"}
]
}

22
docs/i18n/en.yaml
View File

@ -1,19 +1,19 @@
--- ---
- id: get-started - id: 'get-started'
translation: "Get Started" translation: 'Get Started'
- id: on-this-page - id: 'on-this-page'
translation: "On this page" translation: 'On this page'
- id: search-text - id: 'search-text'
translation: "Search..." translation: 'Search...'
- id: 404-title - id: '404-title'
translation: "Page not found :(" translation: 'Page not found :('
- id: 404-text - id: '404-text'
translation: "The page you are looking for doesn't exist or has been moved. If you followed a link to get to this page please report it if it was on this site, the official GitHub repository, or the logs on the latest version." # yamllint disable-line rule:line-length translation: "The page you are looking for doesn't exist or has been moved. If you followed a link to get to this page please report it if it was on this site, the official GitHub repository, or the logs on the latest version." # yamllint disable-line rule:line-length
- id: browse - id: 'browse'
translation: "Browse" translation: 'Browse'
... ...

7
docs/layouts/shortcodes/config-alert-example.html 100644
View File

@ -0,0 +1,7 @@
<div class="alert alert-warning d-flex" role="alert">
<div class="flex-shrink-1 alert-icon">⚠️</div>
<div class="w-100">
This section is intended as an example configuration to help users with a rough contextual layout of this configuration section, it is <b>not</b> intended to explain the <a class="alert-link" href="#options">options</a>.
The configuration shown may not be a valid configuration, and you should see the <a class="alert-link" href="#options">options section</a> below and the navigation links to properly understand each option individually.
</div>
</div>

28
docs/layouts/shortcodes/table-totp-support.html 100644
View File

@ -0,0 +1,28 @@
<table class="table table-hover">
<thead>
<tr>
<th style="text-align: center;" rowspan="2">Application</th>
<th style="text-align: center;" colspan="3" class="border-end">Algorithm</th>
<th style="text-align: center;" colspan="2">Digits</th>
</tr>
<tr>
<th style="text-align: center;">SHA1</th>
<th style="text-align: center;">SHA256</th>
<th style="text-align: center;" class="border-end">SHA512</th>
<th style="text-align: center;">6</th>
<th style="text-align: center;">8</th>
</tr>
</thead>
<tbody>
{{- range $.Site.Data.support.totp }}
<tr>
<td style="text-align: center;"><a href="{{ .url }}" target="_blank">{{ .name }}</a></td>
<td style="text-align: center;"><i class="{{ cond .algorithms.SHA1 "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .algorithms.SHA1 "" "Not " }}Supported"></i></td>
<td style="text-align: center;"><i class="{{ cond .algorithms.SHA256 "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .algorithms.SHA256 "" "Not " }}Supported"></i></td>
<td style="text-align: center;" class="border-end"><i class="{{ cond .algorithms.SHA512 "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .algorithms.SHA512 "" "Not " }}Supported"></i></td>
<td style="text-align: center;"><i class="{{ cond .digits.six "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .digits.six "" "Not " }}Supported"></i></td>
<td style="text-align: center;"><i class="{{ cond .digits.eight "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .digits.eight "" "Not " }}Supported"></i></td>
</tr>
{{- end }}
</tbody>
</table>

3
examples/compose/lite/authelia/configuration.yml
View File

@ -8,8 +8,7 @@ jwt_secret: a_very_important_secret
default_redirection_url: https://public.example.com default_redirection_url: https://public.example.com
server: server:
host: 0.0.0.0 address: 'tcp://:9091'
port: 9091
log: log:
level: debug level: debug

3
examples/compose/local/authelia/configuration.yml
View File

@ -7,8 +7,7 @@ jwt_secret: a_very_important_secret
default_redirection_url: https://public.example.com default_redirection_url: https://public.example.com
server: server:
host: 0.0.0.0 address: 'tcp://:9091'
port: 9091
log: log:
level: debug level: debug

24
go.mod
View File

@ -7,13 +7,13 @@ require (
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
github.com/deckarep/golang-set/v2 v2.3.0 github.com/deckarep/golang-set/v2 v2.3.0
github.com/duosecurity/duo_api_golang v0.0.0-20230418202038-096d3306c029 github.com/duosecurity/duo_api_golang v0.0.0-20230418202038-096d3306c029
github.com/fasthttp/router v1.4.18 github.com/fasthttp/router v1.4.19
github.com/fasthttp/session/v2 v2.4.17 github.com/fasthttp/session/v2 v2.5.0
github.com/fsnotify/fsnotify v1.6.0 github.com/fsnotify/fsnotify v1.6.0
github.com/go-asn1-ber/asn1-ber v1.5.4 github.com/go-asn1-ber/asn1-ber v1.5.4
github.com/go-crypt/crypt v0.2.7 github.com/go-crypt/crypt v0.2.7
github.com/go-ldap/ldap/v3 v3.4.4 github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835
github.com/go-rod/rod v0.112.8 github.com/go-rod/rod v0.112.9
github.com/go-sql-driver/mysql v1.7.1 github.com/go-sql-driver/mysql v1.7.1
github.com/go-webauthn/webauthn v0.5.0 github.com/go-webauthn/webauthn v0.5.0
github.com/golang-jwt/jwt/v4 v4.5.0 github.com/golang-jwt/jwt/v4 v4.5.0
@ -37,24 +37,24 @@ require (
github.com/otiai10/copy v1.11.0 github.com/otiai10/copy v1.11.0
github.com/pkg/errors v0.9.1 github.com/pkg/errors v0.9.1
github.com/pquerna/otp v1.4.0 github.com/pquerna/otp v1.4.0
github.com/prometheus/client_golang v1.15.0 github.com/prometheus/client_golang v1.15.1
github.com/sirupsen/logrus v1.9.0 github.com/sirupsen/logrus v1.9.0
github.com/spf13/cobra v1.7.0 github.com/spf13/cobra v1.7.0
github.com/spf13/pflag v1.0.5 github.com/spf13/pflag v1.0.5
github.com/stretchr/testify v1.8.2 github.com/stretchr/testify v1.8.2
github.com/trustelem/zxcvbn v1.0.1 github.com/trustelem/zxcvbn v1.0.1
github.com/valyala/fasthttp v1.46.0 github.com/valyala/fasthttp v1.47.0
github.com/wneessen/go-mail v0.3.9 github.com/wneessen/go-mail v0.3.9
golang.org/x/net v0.9.0 golang.org/x/net v0.9.0
golang.org/x/sync v0.1.0 golang.org/x/sync v0.2.0
golang.org/x/term v0.7.0 golang.org/x/term v0.8.0
golang.org/x/text v0.9.0 golang.org/x/text v0.9.0
gopkg.in/square/go-jose.v2 v2.6.0 gopkg.in/square/go-jose.v2 v2.6.0
gopkg.in/yaml.v3 v3.0.1 gopkg.in/yaml.v3 v3.0.1
) )
require ( require (
github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
github.com/andybalholm/brotli v1.0.5 // indirect github.com/andybalholm/brotli v1.0.5 // indirect
github.com/beorn7/perks v1.0.1 // indirect github.com/beorn7/perks v1.0.1 // indirect
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
@ -83,7 +83,7 @@ require (
github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
github.com/jandelgado/gcov2lcov v1.0.5 // indirect github.com/jandelgado/gcov2lcov v1.0.5 // indirect
github.com/klauspost/compress v1.16.3 // indirect github.com/klauspost/compress v1.16.5 // indirect
github.com/knadh/koanf/maps v0.1.1 // indirect github.com/knadh/koanf/maps v0.1.1 // indirect
github.com/magiconair/properties v1.8.7 // indirect github.com/magiconair/properties v1.8.7 // indirect
github.com/mattn/goveralls v0.0.11 // indirect github.com/mattn/goveralls v0.0.11 // indirect
@ -100,6 +100,7 @@ require (
github.com/prometheus/client_model v0.3.0 // indirect github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/common v0.42.0 // indirect github.com/prometheus/common v0.42.0 // indirect
github.com/prometheus/procfs v0.9.0 // indirect github.com/prometheus/procfs v0.9.0 // indirect
github.com/redis/go-redis/v9 v9.0.4 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee // indirect github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee // indirect
github.com/spf13/afero v1.9.5 // indirect github.com/spf13/afero v1.9.5 // indirect
@ -111,13 +112,14 @@ require (
github.com/tinylib/msgp v1.1.8 // indirect github.com/tinylib/msgp v1.1.8 // indirect
github.com/valyala/bytebufferpool v1.0.0 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect
github.com/x448/float16 v0.8.4 // indirect github.com/x448/float16 v0.8.4 // indirect
github.com/ysmood/fetchup v0.2.2 // indirect
github.com/ysmood/goob v0.4.0 // indirect github.com/ysmood/goob v0.4.0 // indirect
github.com/ysmood/gson v0.7.3 // indirect github.com/ysmood/gson v0.7.3 // indirect
github.com/ysmood/leakless v0.8.0 // indirect github.com/ysmood/leakless v0.8.0 // indirect
golang.org/x/crypto v0.7.0 // indirect golang.org/x/crypto v0.7.0 // indirect
golang.org/x/mod v0.10.0 // indirect golang.org/x/mod v0.10.0 // indirect
golang.org/x/oauth2 v0.5.0 // indirect golang.org/x/oauth2 v0.5.0 // indirect
golang.org/x/sys v0.7.0 // indirect golang.org/x/sys v0.8.0 // indirect
golang.org/x/tools v0.7.0 // indirect golang.org/x/tools v0.7.0 // indirect
google.golang.org/appengine v1.6.7 // indirect google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd // indirect google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd // indirect

71
go.sum
View File

@ -36,8 +36,8 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo= cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft7pkxDf6WoUvEZJ/uOKsvtpjLnn8MU= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4 h1:vdT7QwBhJJEVNFMBNhRSFDRCB6O16T28VhvqRgqFyn8= github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4 h1:vdT7QwBhJJEVNFMBNhRSFDRCB6O16T28VhvqRgqFyn8=
@ -45,6 +45,8 @@ github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4/go.mod h1:S
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs= github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs=
github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
@ -56,6 +58,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
github.com/bsm/ginkgo/v2 v2.7.0 h1:ItPMPH90RbmZJt5GtkcNvIRuGEdwlBItdNVoyzaNQao=
github.com/bsm/gomega v1.26.0 h1:LhQm+AFcgV2M0WyKroMASzAzCAJVpAxQXv4SaI9a69Y=
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@ -112,10 +116,10 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojtoVVWjGfOF9635RETekkoH6Cc9SX0A= github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojtoVVWjGfOF9635RETekkoH6Cc9SX0A=
github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg= github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg=
github.com/fasthttp/router v1.4.18 h1:elMnlFq527oZd8MHsuUpO6uLDup1exv8rXPfIjClDHk= github.com/fasthttp/router v1.4.19 h1:RLE539IU/S4kfb4MP56zgP0TIBU9kEg0ID9GpWO0vqk=
github.com/fasthttp/router v1.4.18/go.mod h1:ZmC20Mn0VgCBbUWFDmnYzFbQYRfdGeKgpkBy0+JioKA= github.com/fasthttp/router v1.4.19/go.mod h1:+Fh3YOd8x1+he6ZS+d2iUDBH9MGGZ1xQFUor0DE9rKE=
github.com/fasthttp/session/v2 v2.4.17 h1:jcS21Xoi1fE/4Ikz5Nm37x6FjpMUPnPQPVJWxKnQ8FE= github.com/fasthttp/session/v2 v2.5.0 h1:Vt+U2yKCmBxnEZ4v6rjEsO4YeTSaCpz/HPEI4DTN59M=
github.com/fasthttp/session/v2 v2.4.17/go.mod h1:+pr8HLEQp6h9X70KLBY/Y4NrdJR2ts7VERydkMkiZaI= github.com/fasthttp/session/v2 v2.5.0/go.mod h1:gmUptI/jKL7qTfFtBHU3us36nv2Bm7U4jazt9pnBPLY=
github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w= github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE= github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
@ -134,14 +138,14 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs= github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 h1:XgBmN9yZXIh9vJGzs2qYPb5ee8/VnOWLHHYcKXGXKME=
github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI= github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs=
github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI= github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo= github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
github.com/go-rod/rod v0.112.8 h1:lYFnHv/lFyjW/Ye0IhyKLeHw/zfhHbSTqawoCi2z/nI= github.com/go-rod/rod v0.112.9 h1:uA/yLbB+t0UlqJcLJtK2pZrCNPzd15dOKRUEOnmnt9k=
github.com/go-rod/rod v0.112.8/go.mod h1:ElViL9ABbcshNQw93+11FrYRH92RRhMKleuILo6+5V0= github.com/go-rod/rod v0.112.9/go.mod h1:l0or0gEnZ7E5C0L/W7iD+yXBnm/OM3avP1ji74k8N9s=
github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI= github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
@ -264,8 +268,8 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q= github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
github.com/klauspost/compress v1.16.3 h1:XuJt9zzcnaz6a16/OU53ZjWp/v7/42WcR5t2a0PcNQY= github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
github.com/klauspost/compress v1.16.3/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs= github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs=
github.com/knadh/koanf/maps v0.1.1/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/maps v0.1.1/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
github.com/knadh/koanf/parsers/yaml v0.1.0 h1:ZZ8/iGfRLvKSaMEECEBPM1HQslrZADk8fP1XFUxVI5w= github.com/knadh/koanf/parsers/yaml v0.1.0 h1:ZZ8/iGfRLvKSaMEECEBPM1HQslrZADk8fP1XFUxVI5w=
@ -289,7 +293,7 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo= github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw= github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY= github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
@ -352,8 +356,8 @@ github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg= github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso= github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
github.com/prometheus/client_golang v1.15.0 h1:5fCgGYogn0hFdhyhLbw7hEsWxufKtY9klyvdNfFlFhM= github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
github.com/prometheus/client_golang v1.15.0/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@ -368,6 +372,8 @@ github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7z
github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI= github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY= github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU= github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
github.com/redis/go-redis/v9 v9.0.4 h1:FC82T+CHJ/Q/PdyLW++GeCO+Ol59Y4T7R4jbgjvktgc=
github.com/redis/go-redis/v9 v9.0.4/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk=
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg= github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8= github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
@ -413,7 +419,6 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
@ -431,18 +436,22 @@ github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGr
github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0= github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
github.com/valyala/fasthttp v1.46.0 h1:6ZRhrFg8zBXTRYY6vdzbFhqsBd7FVv123pV2m9V87U4= github.com/valyala/fasthttp v1.47.0 h1:y7moDoxYzMooFpT5aHgNgVOQDrS3qlkfiP9mDtGGK9c=
github.com/valyala/fasthttp v1.46.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA= github.com/valyala/fasthttp v1.47.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA=
github.com/wneessen/go-mail v0.3.9 h1:Q4DbCk3htT5DtDWKeMgNXCiHc4bBY/vv/XQPT6XDXzc= github.com/wneessen/go-mail v0.3.9 h1:Q4DbCk3htT5DtDWKeMgNXCiHc4bBY/vv/XQPT6XDXzc=
github.com/wneessen/go-mail v0.3.9/go.mod h1:zxOlafWCP/r6FEhAaRgH4IC1vg2YXxO0Nar9u0IScZ8= github.com/wneessen/go-mail v0.3.9/go.mod h1:zxOlafWCP/r6FEhAaRgH4IC1vg2YXxO0Nar9u0IScZ8=
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q= github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
github.com/ysmood/fetchup v0.2.2 h1:Qn8/q5uDW7szclt4sVXCFJ1TXup3hogz94OaLf6kloo=
github.com/ysmood/fetchup v0.2.2/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ= github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ=
github.com/ysmood/goob v0.4.0/go.mod h1:u6yx7ZhS4Exf2MwciFr6nIM8knHQIE22lFpWHnfql18= github.com/ysmood/goob v0.4.0/go.mod h1:u6yx7ZhS4Exf2MwciFr6nIM8knHQIE22lFpWHnfql18=
github.com/ysmood/got v0.32.0 h1:aAHdQgfgMb/lo4v+OekM+SSqEJYFI035h5YYvLXsVyU= github.com/ysmood/gop v0.0.2 h1:VuWweTmXK+zedLqYufJdh3PlxDNBOfFHjIZlPT2T5nw=
github.com/ysmood/got v0.32.0/go.mod h1:pE1l4LOwOBhQg6A/8IAatkGp7uZjnalzrZolnlhhMgY= github.com/ysmood/gop v0.0.2/go.mod h1:rr5z2z27oGEbyB787hpEcx4ab8cCiPnKxn0SUHt6xzk=
github.com/ysmood/got v0.34.1 h1:IrV2uWLs45VXNvZqhJ6g2nIhY+pgIG1CUoOcqfXFl1s=
github.com/ysmood/got v0.34.1/go.mod h1:yddyjq/PmAf08RMLSwDjPyCvHvYed+WjHnQxpH851LM=
github.com/ysmood/gotrace v0.6.0 h1:SyI1d4jclswLhg7SWTL6os3L1WOKeNn/ZtzVQF8QmdY= github.com/ysmood/gotrace v0.6.0 h1:SyI1d4jclswLhg7SWTL6os3L1WOKeNn/ZtzVQF8QmdY=
github.com/ysmood/gotrace v0.6.0/go.mod h1:TzhIG7nHDry5//eYZDYcTzuJLYQIkykJzCRIo4/dzQM= github.com/ysmood/gotrace v0.6.0/go.mod h1:TzhIG7nHDry5//eYZDYcTzuJLYQIkykJzCRIo4/dzQM=
github.com/ysmood/gson v0.7.3 h1:QFkWbTH8MxyUTKPkVWAENJhxqdBa4lYTQWqZCiLG6kE= github.com/ysmood/gson v0.7.3 h1:QFkWbTH8MxyUTKPkVWAENJhxqdBa4lYTQWqZCiLG6kE=
@ -474,7 +483,6 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4= golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A= golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
@ -514,6 +522,7 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@ -554,6 +563,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@ -579,8 +590,9 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@ -629,13 +641,17 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
golang.org/x/term v0.7.0 h1:BEvjmm5fURWqcfbSKTdpkDXYBrUS1c0m8agp14W48vQ= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY= golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@ -645,6 +661,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@ -702,6 +720,7 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4= golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=
golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s= golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

24
internal/authentication/const_test.go 100644
View File

@ -0,0 +1,24 @@
package authentication
import (
"github.com/authelia/authelia/v4/internal/configuration/schema"
)
const (
testLDAPURL = "ldap://127.0.0.1:389"
testLDAPSURL = "ldaps://127.0.0.1:389"
)
var (
testLDAPAddress = MustParseAddress(testLDAPURL)
testLDAPSAddress = MustParseAddress(testLDAPSURL)
)
func MustParseAddress(input string) *schema.AddressLDAP {
address, err := schema.NewAddress(input)
if err != nil {
panic(err)
}
return &schema.AddressLDAP{Address: *address}
}

18
internal/authentication/ldap_client_mock.go
View File

@ -65,9 +65,11 @@ func (mr *MockLDAPClientMockRecorder) Bind(arg0, arg1 interface{}) *gomock.Call
} }
// Close mocks base method. // Close mocks base method.
func (m *MockLDAPClient) Close() { func (m *MockLDAPClient) Close() error {
m.ctrl.T.Helper() m.ctrl.T.Helper()
m.ctrl.Call(m, "Close") ret := m.ctrl.Call(m, "Close")
ret0, _ := ret[0].(error)
return ret0
} }
// Close indicates an expected call of Close. // Close indicates an expected call of Close.
@ -334,18 +336,6 @@ func (mr *MockLDAPClientMockRecorder) SimpleBind(arg0 interface{}) *gomock.Call
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SimpleBind", reflect.TypeOf((*MockLDAPClient)(nil).SimpleBind), arg0) return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SimpleBind", reflect.TypeOf((*MockLDAPClient)(nil).SimpleBind), arg0)
} }
// Start mocks base method.
func (m *MockLDAPClient) Start() {
m.ctrl.T.Helper()
m.ctrl.Call(m, "Start")
}
// Start indicates an expected call of Start.
func (mr *MockLDAPClientMockRecorder) Start() *gomock.Call {
mr.mock.ctrl.T.Helper()
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Start", reflect.TypeOf((*MockLDAPClient)(nil).Start))
}
// StartTLS mocks base method. // StartTLS mocks base method.
func (m *MockLDAPClient) StartTLS(arg0 *tls.Config) error { func (m *MockLDAPClient) StartTLS(arg0 *tls.Config) error {
m.ctrl.T.Helper() m.ctrl.T.Helper()

4
internal/authentication/ldap_user_provider.go
View File

@ -107,7 +107,7 @@ func (p *LDAPUserProvider) CheckUserPassword(username string, password string) (
return false, err return false, err
} }
if clientUser, err = p.connectCustom(p.config.URL, profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil { if clientUser, err = p.connectCustom(p.config.Address.String(), profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil {
return false, fmt.Errorf("authentication failed. Cause: %w", err) return false, fmt.Errorf("authentication failed. Cause: %w", err)
} }
@ -234,7 +234,7 @@ func (p *LDAPUserProvider) UpdatePassword(username, password string) (err error)
} }
func (p *LDAPUserProvider) connect() (client LDAPClient, err error) { func (p *LDAPUserProvider) connect() (client LDAPClient, err error) {
return p.connectCustom(p.config.URL, p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...) return p.connectCustom(p.config.Address.String(), p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...)
} }
func (p *LDAPUserProvider) connectCustom(url, username, password string, startTLS bool, opts ...ldap.DialOpt) (client LDAPClient, err error) { func (p *LDAPUserProvider) connectCustom(url, username, password string, startTLS bool, opts ...ldap.DialOpt) (client LDAPClient, err error) {

2
internal/authentication/ldap_user_provider_startup.go
View File

@ -31,7 +31,7 @@ func (p *LDAPUserProvider) StartupCheck() (err error) {
"attribute when users reset their password via Authelia.") "attribute when users reset their password via Authelia.")
} }
if p.features.Extensions.TLS && !p.config.StartTLS && !strings.HasPrefix(p.config.URL, "ldaps://") { if p.features.Extensions.TLS && !p.config.StartTLS && !p.config.Address.IsExplicitlySecure() {
p.log.Error("Your LDAP Server supports TLS but you don't appear to be utilizing it. We strongly " + p.log.Error("Your LDAP Server supports TLS but you don't appear to be utilizing it. We strongly " +
"recommend using the scheme 'ldaps://' or enabling the StartTLS option to secure connections with your " + "recommend using the scheme 'ldaps://' or enabling the StartTLS option to secure connections with your " +
"LDAP Server.") "LDAP Server.")

98
internal/authentication/ldap_user_provider_test.go
View File

@ -25,7 +25,7 @@ func TestShouldCreateRawConnectionWhenSchemeIsLDAP(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
}, },
@ -57,7 +57,7 @@ func TestShouldCreateTLSConnectionWhenSchemeIsLDAPS(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldaps://127.0.0.1:389", Address: testLDAPSAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
}, },
@ -107,7 +107,7 @@ func TestEscapeSpecialCharsInGroupsFilter(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldaps://127.0.0.1:389", Address: testLDAPSAddress,
GroupsFilter: "(|(member={dn})(uid={username})(uid={input}))", GroupsFilter: "(|(member={dn})(uid={username})(uid={input}))",
}, },
false, false,
@ -165,7 +165,7 @@ func TestShouldCheckLDAPServerExtensions(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -230,7 +230,7 @@ func TestShouldNotCheckLDAPServerExtensionsWhenRootDSEReturnsMoreThanOneEntry(t
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -296,7 +296,7 @@ func TestShouldCheckLDAPServerControlTypes(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -361,7 +361,7 @@ func TestShouldNotEnablePasswdModifyExtensionOrControlTypes(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -426,7 +426,7 @@ func TestShouldReturnCheckServerConnectError(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -459,7 +459,7 @@ func TestShouldReturnCheckServerSearchError(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -521,7 +521,7 @@ func TestShouldEscapeUserInput(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -555,7 +555,7 @@ func TestShouldReturnEmailWhenAttributeSameAsUsername(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "mail", UsernameAttribute: "mail",
@ -626,7 +626,7 @@ func TestShouldReturnUsernameAndBlankDisplayNameWhenAttributesTheSame(t *testing
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -697,7 +697,7 @@ func TestShouldReturnBlankEmailAndDisplayNameWhenAttrsLenZero(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -771,7 +771,7 @@ func TestShouldCombineUsernameFilterAndUsersFilter(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
UsernameAttribute: "uid", UsernameAttribute: "uid",
UsersFilter: "(&({username_attribute}={input})(&(objectCategory=person)(objectClass=user)))", UsersFilter: "(&({username_attribute}={input})(&(objectCategory=person)(objectClass=user)))",
@ -822,7 +822,7 @@ func TestShouldNotCrashWhenGroupsAreNotRetrievedFromLDAP(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -895,7 +895,7 @@ func TestShouldNotCrashWhenEmailsAreNotRetrievedFromLDAP(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -956,7 +956,7 @@ func TestShouldReturnUsernameFromLDAP(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1029,7 +1029,7 @@ func TestShouldReturnUsernameFromLDAPWithReferrals(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1121,7 +1121,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsInErrorAndResult(t *testing.T)
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1246,7 +1246,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsErr(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1333,7 +1333,7 @@ func TestShouldNotUpdateUserPasswordConnect(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1400,7 +1400,7 @@ func TestShouldNotUpdateUserPasswordGetDetails(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1477,7 +1477,7 @@ func TestShouldUpdateUserPassword(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1585,7 +1585,7 @@ func TestShouldUpdateUserPasswordMSAD(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1695,7 +1695,7 @@ func TestShouldUpdateUserPasswordMSADWithReferrals(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1823,7 +1823,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralConnectErr(t *test
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -1942,7 +1942,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralModifyErr(t *testi
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -2074,7 +2074,7 @@ func TestShouldUpdateUserPasswordMSADWithoutReferrals(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -2187,7 +2187,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtension(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -2294,7 +2294,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferrals(t *testing.T
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -2421,7 +2421,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithoutReferrals(t *testin
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -2534,7 +2534,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralConne
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -2652,7 +2652,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralPassw
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -2784,7 +2784,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHints(t *testing
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "sAMAccountName", UsernameAttribute: "sAMAccountName",
@ -2895,7 +2895,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHintsDeprecated(
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "sAMAccountName", UsernameAttribute: "sAMAccountName",
@ -3006,7 +3006,7 @@ func TestShouldUpdateUserPasswordActiveDirectory(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "activedirectory", Implementation: "activedirectory",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "sAMAccountName", UsernameAttribute: "sAMAccountName",
@ -3117,7 +3117,7 @@ func TestShouldUpdateUserPasswordBasic(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
Implementation: "custom", Implementation: "custom",
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "uid=admin,dc=example,dc=com", User: "uid=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3224,7 +3224,7 @@ func TestShouldReturnErrorWhenMultipleUsernameAttributes(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3290,7 +3290,7 @@ func TestShouldReturnErrorWhenZeroUsernameAttributes(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3356,7 +3356,7 @@ func TestShouldReturnErrorWhenUsernameAttributeNotReturned(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3418,7 +3418,7 @@ func TestShouldReturnErrorWhenMultipleUsersFound(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3501,7 +3501,7 @@ func TestShouldReturnErrorWhenNoDN(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3567,7 +3567,7 @@ func TestShouldCheckValidUserPassword(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3635,7 +3635,7 @@ func TestShouldNotCheckValidUserPasswordWithConnectError(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3674,7 +3674,7 @@ func TestShouldCheckInvalidUserPassword(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3742,7 +3742,7 @@ func TestShouldCallStartTLSWhenEnabled(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3817,7 +3817,7 @@ func TestShouldParseDynamicConfiguration(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3866,7 +3866,7 @@ func TestShouldCallStartTLSWithInsecureSkipVerifyWhenSkipVerifyTrue(t *testing.T
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldap://127.0.0.1:389", Address: testLDAPAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",
@ -3949,7 +3949,7 @@ func TestShouldReturnLDAPSAlreadySecuredWhenStartTLSAttempted(t *testing.T) {
provider := NewLDAPUserProviderWithFactory( provider := NewLDAPUserProviderWithFactory(
schema.LDAPAuthenticationBackend{ schema.LDAPAuthenticationBackend{
URL: "ldaps://127.0.0.1:389", Address: testLDAPSAddress,
User: "cn=admin,dc=example,dc=com", User: "cn=admin,dc=example,dc=com",
Password: "password", Password: "password",
UsernameAttribute: "uid", UsernameAttribute: "uid",

2
internal/authentication/types.go
View File

@ -18,7 +18,7 @@ type LDAPClientFactory interface {
// //
// Methods added to this interface that have a direct correlation with one from ldap.Client should have the same signature. // Methods added to this interface that have a direct correlation with one from ldap.Client should have the same signature.
type LDAPClient interface { type LDAPClient interface {
Close() Close() (err error)
IsClosing() bool IsClosing() bool
SetTimeout(timeout time.Duration) SetTimeout(timeout time.Duration)

457
internal/configuration/config.template.yml
View File

@ -9,14 +9,14 @@
## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store. ## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/ # certificates_directory: '/config/certificates/'
## The theme to display: light, dark, grey, auto. ## The theme to display: light, dark, grey, auto.
theme: light theme: 'light'
## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/c/secrets ## set using a secret: https://www.authelia.com/c/secrets
jwt_secret: a_very_important_secret jwt_secret: 'a_very_important_secret'
## Default redirection URL ## Default redirection URL
## ##
@ -25,31 +25,32 @@ jwt_secret: a_very_important_secret
## in such a case. ## in such a case.
## ##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://home.example.com/ default_redirection_url: 'https://home.example.com/'
## Set the default 2FA method for new users and for when a user has a preferred method configured that has been ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
## disabled. This setting must be a method that is enabled. ## disabled. This setting must be a method that is enabled.
## Options are totp, webauthn, mobile_push. ## Options are totp, webauthn, mobile_push.
default_2fa_method: "" default_2fa_method: ''
## ##
## Server Configuration ## Server Configuration
## ##
server: server:
## The address for the Main server to listen on in the address common syntax.
## The address to listen on. ## Formats:
host: 0.0.0.0 ## - [<scheme>://]<hostname>[:<port>]
## - [<scheme>://][hostname]:<port>
## The port to listen on. ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
port: 9091 ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'.
address: 'tcp://:9091'
## Set the single level path Authelia listens on. ## Set the single level path Authelia listens on.
## Must be alphanumeric chars and should not contain any slashes. ## Must be alphanumeric chars and should not contain any slashes.
path: "" path: ''
## Set the path on disk to Authelia assets. ## Set the path on disk to Authelia assets.
## Useful to allow overriding of specific static assets. ## Useful to allow overriding of specific static assets.
# asset_path: /config/assets/ # asset_path: '/config/assets/'
## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
@ -58,10 +59,10 @@ server:
## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
tls: tls:
## The path to the DER base64/PEM format private key. ## The path to the DER base64/PEM format private key.
key: "" key: ''
## The path to the DER base64/PEM format public certificate. ## The path to the DER base64/PEM format public certificate.
certificate: "" certificate: ''
## The list of certificates for client authentication. ## The list of certificates for client authentication.
client_certificates: [] client_certificates: []
@ -70,7 +71,7 @@ server:
headers: headers:
## The CSP Template. Read the docs. ## The CSP Template. Read the docs.
csp_template: "" csp_template: ''
## Server Buffers configuration. ## Server Buffers configuration.
# buffers: # buffers:
@ -89,14 +90,14 @@ server:
## Server Timeouts configuration. ## Server Timeouts configuration.
# timeouts: # timeouts:
## Read timeout. ## Read timeout in the duration common syntax.
# read: 6s # read: '6s'
## Write timeout. ## Write timeout in the duration common syntax.
# write: 6s # write: '6s'
## Idle timeout. ## Idle timeout in the duration common syntax.
# idle: 30s # idle: '30s'
## Server Endpoints configuration. ## Server Endpoints configuration.
## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation. ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation.
@ -110,16 +111,16 @@ server:
## Configure the authz endpoints. ## Configure the authz endpoints.
# authz: # authz:
# forward-auth: # forward-auth:
# implementation: ForwardAuth # implementation: 'ForwardAuth'
# authn_strategies: [] # authn_strategies: []
# ext-authz: # ext-authz:
# implementation: ExtAuthz # implementation: 'ExtAuthz'
# authn_strategies: [] # authn_strategies: []
# auth-request: # auth-request:
# implementation: AuthRequest # implementation: 'AuthRequest'
# authn_strategies: [] # authn_strategies: []
# legacy: # legacy:
# implementation: Legacy # implementation: 'Legacy'
# authn_strategies: [] # authn_strategies: []
## ##
@ -127,13 +128,13 @@ server:
## ##
log: log:
## Level of verbosity for logs: info, debug, trace. ## Level of verbosity for logs: info, debug, trace.
level: debug level: 'debug'
## Format the logs are written as: json, text. ## Format the logs are written as: json, text.
# format: json # format: 'json'
## File path where the logs will be written. If not set logs are written to stdout. ## File path where the logs will be written. If not set logs are written to stdout.
# file_path: /config/authelia.log # file_path: '/config/authelia.log'
## Whether to also log to stdout when a log_file_path is defined. ## Whether to also log to stdout when a log_file_path is defined.
# keep_stdout: false # keep_stdout: false
@ -150,8 +151,13 @@ telemetry:
## Enable Metrics. ## Enable Metrics.
enabled: false enabled: false
## The address to listen on for metrics. This should be on a different port to the main server.port value. ## The address for the Metrics server to listen on in the address common syntax.
address: tcp://0.0.0.0:9959 ## Formats:
## - [<scheme>://]<hostname>[:<port>]
## - [<scheme>://][hostname]:<port>
## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'.
address: 'tcp://:9959'
## Metrics Server Buffers configuration. ## Metrics Server Buffers configuration.
# buffers: # buffers:
@ -165,14 +171,14 @@ telemetry:
## Metrics Server Timeouts configuration. ## Metrics Server Timeouts configuration.
# timeouts: # timeouts:
## Read timeout. ## Read timeout in the duration common syntax.
# read: 6s # read: '6s'
## Write timeout. ## Write timeout in the duration common syntax.
# write: 6s # write: '6s'
## Idle timeout. ## Idle timeout in the duration common syntax.
# idle: 30s # idle: '30s'
## ##
## TOTP Configuration ## TOTP Configuration
@ -183,12 +189,12 @@ totp:
disable: false disable: false
## The issuer name displayed in the Authenticator application of your choice. ## The issuer name displayed in the Authenticator application of your choice.
issuer: authelia.com issuer: 'authelia.com'
## The TOTP algorithm to use. ## The TOTP algorithm to use.
## It is CRITICAL you read the documentation before changing this option: ## It is CRITICAL you read the documentation before changing this option:
## https://www.authelia.com/c/totp#algorithm ## https://www.authelia.com/c/totp#algorithm
algorithm: sha1 algorithm: 'sha1'
## The number of digits a user has to input. Must either be 6 or 8. ## The number of digits a user has to input. Must either be 6 or 8.
## Changing this option only affects newly generated TOTP configurations. ## Changing this option only affects newly generated TOTP configurations.
@ -217,19 +223,19 @@ webauthn:
## Disable WebAuthn. ## Disable WebAuthn.
disable: false disable: false
## Adjust the interaction timeout for WebAuthn dialogues. ## The interaction timeout for WebAuthn dialogues in the duration common syntax.
timeout: 60s timeout: '60s'
## The display name the browser should show the user for when using WebAuthn to login/register. ## The display name the browser should show the user for when using WebAuthn to login/register.
display_name: Authelia display_name: 'Authelia'
## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device. ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
## Options are none, indirect, direct. ## Options are none, indirect, direct.
attestation_conveyance_preference: indirect attestation_conveyance_preference: 'indirect'
## User verification controls if the user must make a gesture or action to confirm they are present. ## User verification controls if the user must make a gesture or action to confirm they are present.
## Options are required, preferred, discouraged. ## Options are required, preferred, discouraged.
user_verification: preferred user_verification: 'preferred'
## ##
## Duo Push API Configuration ## Duo Push API Configuration
@ -238,10 +244,10 @@ webauthn:
## "Partner Auth API" in the management panel. ## "Partner Auth API" in the management panel.
# duo_api: # duo_api:
# disable: false # disable: false
# hostname: api-123456789.example.com # hostname: 'api-123456789.example.com'
# integration_key: ABCDEF # integration_key: 'ABCDEF'
## Secret can also be set using a secret: https://www.authelia.com/c/secrets ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
# secret_key: 1234567890abcdefghifjkl # secret_key: '1234567890abcdefghifjkl'
# enable_self_enrollment: false # enable_self_enrollment: false
## ##
@ -249,14 +255,17 @@ webauthn:
## ##
## This is used to validate the servers time is accurate enough to validate TOTP. ## This is used to validate the servers time is accurate enough to validate TOTP.
ntp: ntp:
## NTP server address. ## The address of the NTP server to connect to in the address common syntax.
address: "time.cloudflare.com:123" ## Format: [<scheme>://]<hostname>[:<port>].
## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'.
## The default scheme is 'udp'. The default port is '123'.
address: 'udp://time.cloudflare.com:123'
## NTP version. ## NTP version.
version: 4 version: 4
## Maximum allowed time offset between the host and the NTP server. ## Maximum allowed time offset between the host and the NTP server in the duration common syntax.
max_desync: 3s max_desync: '3s'
## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
## set this to true, and can operate in a truly offline mode. ## set this to true, and can operate in a truly offline mode.
@ -282,16 +291,15 @@ authentication_backend:
## External reset password url that redirects the user to an external reset portal. This disables the internal reset ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
## functionality. ## functionality.
custom_url: "" custom_url: ''
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. ## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax.
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
## See the below documentation for more information. ## See the below documentation for more information.
## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format
## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
refresh_interval: 5m refresh_interval: '5m'
## ##
## LDAP (Authentication Provider) ## LDAP (Authentication Provider)
@ -300,6 +308,13 @@ authentication_backend:
## because it allows Authelia to offload the stateful operations ## because it allows Authelia to offload the stateful operations
## onto the LDAP service. ## onto the LDAP service.
# ldap: # ldap:
## The address of the LDAP server to connect to in the address common syntax.
## Format: [<scheme>://]<hostname>[:<port>].
## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`.
## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'.
## The default port is '636', unless the scheme is 'ldap' in which case it's '389'.
# address: 'ldaps://127.0.0.1:636'
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
## Acceptable options are as follows: ## Acceptable options are as follows:
## - 'activedirectory' - for Microsoft Active Directory. ## - 'activedirectory' - for Microsoft Active Directory.
@ -311,22 +326,18 @@ authentication_backend:
## Depending on the option here certain other values in this section have a default value, notably all of the ## Depending on the option here certain other values in this section have a default value, notably all of the
## attribute mappings have a default value that this config overrides, you can read more about these default values ## attribute mappings have a default value that this config overrides, you can read more about these default values
## at https://www.authelia.com/c/ldap#defaults ## at https://www.authelia.com/c/ldap#defaults
# implementation: custom # implementation: 'custom'
## The url to the ldap server. Format: <scheme>://<address>[:<port>]. ## The dial timeout for LDAP in the duration common syntax.
## Scheme can be ldap or ldaps in the format (port optional). # timeout: '5s'
# url: ldap://127.0.0.1
## The dial timeout for LDAP.
# timeout: 5s
## Use StartTLS with the LDAP connection. ## Use StartTLS with the LDAP connection.
# start_tls: false # start_tls: false
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host portion of the url option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: ldap.example.com # server_name: 'ldap.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -337,10 +348,10 @@ authentication_backend:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -417,7 +428,7 @@ authentication_backend:
## The distinguished name of the container searched for objects in the directory information tree. ## The distinguished name of the container searched for objects in the directory information tree.
## See also: additional_users_dn, additional_groups_dn. ## See also: additional_users_dn, additional_groups_dn.
# base_dn: dc=example,dc=com # base_dn: 'dc=example,dc=com'
## The attribute holding the username of the user. This attribute is used to populate the username in the session ## The attribute holding the username of the user. This attribute is used to populate the username in the session
## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually
@ -427,11 +438,11 @@ authentication_backend:
## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use
## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to
## follow https://datatracker.ietf.org/doc/html/rfc2307. ## follow https://datatracker.ietf.org/doc/html/rfc2307.
# username_attribute: uid # username_attribute: 'uid'
## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
# additional_users_dn: ou=users # additional_users_dn: 'ou=users'
## The users filter used in search queries to find the user profile based on input filled in login form. ## The users filter used in search queries to find the user profile based on input filled in login form.
## Various placeholders are available in the user filter which you can read about in the documentation which can ## Various placeholders are available in the user filter which you can read about in the documentation which can
@ -445,11 +456,11 @@ authentication_backend:
## ##
## To allow sign in both with username and email, one can use a filter like ## To allow sign in both with username and email, one can use a filter like
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
# users_filter: (&({username_attribute}={input})(objectClass=person)) # users_filter: '(&({username_attribute}={input})(objectClass=person))'
## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
# additional_groups_dn: ou=groups # additional_groups_dn: 'ou=groups'
## The groups filter used in search queries to find the groups based on relevant authenticated user. ## The groups filter used in search queries to find the groups based on relevant authenticated user.
## Various placeholders are available in the groups filter which you can read about in the documentation which can ## Various placeholders are available in the groups filter which you can read about in the documentation which can
@ -457,17 +468,17 @@ authentication_backend:
## ##
## If your groups use the `groupOfUniqueNames` structure use this instead: ## If your groups use the `groupOfUniqueNames` structure use this instead:
## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
# groups_filter: (&(member={dn})(objectClass=groupOfNames)) # groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
## The attribute holding the name of the group. ## The attribute holding the name of the group.
# group_name_attribute: cn # group_name_attribute: 'cn'
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
## first one returned by the LDAP server is used. ## first one returned by the LDAP server is used.
# mail_attribute: mail # mail_attribute: 'mail'
## The attribute holding the display name of the user. This will be used to greet an authenticated user. ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
# display_name_attribute: displayName # display_name_attribute: 'displayName'
## Follow referrals returned by the server. ## Follow referrals returned by the server.
## This is especially useful for environments where read-only servers exist. Only implemented for write operations. ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
@ -476,7 +487,7 @@ authentication_backend:
## The username and password of the admin user. ## The username and password of the admin user.
# user: cn=admin,dc=example,dc=com # user: cn=admin,dc=example,dc=com
## Password can also be set using a secret: https://www.authelia.com/c/secrets ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: password # password: 'password'
## ##
## File (Authentication Provider) ## File (Authentication Provider)
@ -491,15 +502,15 @@ authentication_backend:
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
## ##
# file: # file:
# path: /config/users_database.yml # path: '/config/users_database.yml'
# watch: false # watch: false
# search: # search:
# email: false # email: false
# case_insensitive: false # case_insensitive: false
# password: # password:
# algorithm: argon2 # algorithm: 'argon2'
# argon2: # argon2:
# variant: argon2id # variant: 'argon2id'
# iterations: 3 # iterations: 3
# memory: 65536 # memory: 65536
# parallelism: 4 # parallelism: 4
@ -512,15 +523,15 @@ authentication_backend:
# key_length: 32 # key_length: 32
# salt_length: 16 # salt_length: 16
# pbkdf2: # pbkdf2:
# variant: sha512 # variant: 'sha512'
# iterations: 310000 # iterations: 310000
# salt_length: 16 # salt_length: 16
# sha2crypt: # sha2crypt:
# variant: sha512 # variant: 'sha512'
# iterations: 50000 # iterations: 50000
# salt_length: 16 # salt_length: 16
# bcrypt: # bcrypt:
# variant: standard # variant: 'standard'
# cost: 12 # cost: 12
## ##
@ -604,91 +615,91 @@ privacy_policy:
access_control: access_control:
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
## resource if there is no policy to be applied to the user. ## resource if there is no policy to be applied to the user.
default_policy: deny default_policy: 'deny'
# networks: # networks:
# - name: internal # - name: 'internal'
# networks: # networks:
# - 10.10.0.0/16 # - '10.10.0.0/16'
# - 192.168.2.0/24 # - '192.168.2.0/24'
# - name: VPN # - name: VPN
# networks: 10.9.0.0/16 # networks: '10.9.0.0/16'
# rules: # rules:
## Rules applied to everyone ## Rules applied to everyone
# - domain: 'public.example.com' # - domain: 'public.example.com'
# policy: bypass # policy: 'bypass'
## Domain Regex examples. Generally we recommend just using a standard domain. ## Domain Regex examples. Generally we recommend just using a standard domain.
# - domain_regex: '^(?P<User>\w+)\.example\.com$' # - domain_regex: '^(?P<User>\w+)\.example\.com$'
# policy: one_factor # policy: 'one_factor'
# - domain_regex: '^(?P<Group>\w+)\.example\.com$' # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
# policy: one_factor # policy: 'one_factor'
# - domain_regex: # - domain_regex:
# - '^appgroup-.*\.example\.com$' # - '^appgroup-.*\.example\.com$'
# - '^appgroup2-.*\.example\.com$' # - '^appgroup2-.*\.example\.com$'
# policy: one_factor # policy: 'one_factor'
# - domain_regex: '^.*\.example\.com$' # - domain_regex: '^.*\.example\.com$'
# policy: two_factor # policy: 'two_factor'
# - domain: 'secure.example.com' # - domain: 'secure.example.com'
# policy: one_factor # policy: 'one_factor'
## Network based rule, if not provided any network matches. ## Network based rule, if not provided any network matches.
# networks: # networks:
# - internal # - 'internal'
# - VPN # - 'VPN'
# - 192.168.1.0/24 # - '192.168.1.0/24'
# - 10.0.0.1 # - '10.0.0.1'
# - domain: # - domain:
# - 'secure.example.com' # - 'secure.example.com'
# - 'private.example.com' # - 'private.example.com'
# policy: two_factor # policy: 'two_factor'
# - domain: 'singlefactor.example.com' # - domain: 'singlefactor.example.com'
# policy: one_factor # policy: 'one_factor'
## Rules applied to 'admins' group ## Rules applied to 'admins' group
# - domain: 'mx2.mail.example.com' # - domain: 'mx2.mail.example.com'
# subject: 'group:admins' # subject: 'group:admins'
# policy: deny # policy: 'deny'
# - domain: '*.example.com' # - domain: '*.example.com'
# subject: # subject:
# - 'group:admins' # - 'group:admins'
# - 'group:moderators' # - 'group:moderators'
# policy: two_factor # policy: 'two_factor'
## Rules applied to 'dev' group ## Rules applied to 'dev' group
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/groups/dev/.*$' # - '^/groups/dev/.*$'
# subject: 'group:dev' # subject: 'group:dev'
# policy: two_factor # policy: 'two_factor'
## Rules applied to user 'john' ## Rules applied to user 'john'
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/users/john/.*$' # - '^/users/john/.*$'
# subject: 'user:john' # subject: 'user:john'
# policy: two_factor # policy: 'two_factor'
## Rules applied to user 'harry' ## Rules applied to user 'harry'
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/users/harry/.*$' # - '^/users/harry/.*$'
# subject: 'user:harry' # subject: 'user:harry'
# policy: two_factor # policy: 'two_factor'
## Rules applied to user 'bob' ## Rules applied to user 'bob'
# - domain: '*.mail.example.com' # - domain: '*.mail.example.com'
# subject: 'user:bob' # subject: 'user:bob'
# policy: two_factor # policy: 'two_factor'
# - domain: 'dev.example.com' # - domain: 'dev.example.com'
# resources: # resources:
# - '^/users/bob/.*$' # - '^/users/bob/.*$'
# subject: 'user:bob' # subject: 'user:bob'
# policy: two_factor # policy: 'two_factor'
## ##
## Session Provider Configuration ## Session Provider Configuration
@ -723,8 +734,7 @@ session:
## Please read https://www.authelia.com/c/session#same_site ## Please read https://www.authelia.com/c/session#same_site
# same_site: 'lax' # same_site: 'lax'
## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
## See: https://www.authelia.com/c/common#duration-notation-format
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
## because a stolen cookie will last longer giving attackers more time to spy or attack. ## because a stolen cookie will last longer giving attackers more time to spy or attack.
@ -741,30 +751,19 @@ session:
## this value to -1 disables remember me for this session cookie domain. ## this value to -1 disables remember me for this session cookie domain.
# remember_me: '1M' # remember_me: '1M'
## Cookie Session Domain default 'name' value. The name of the session cookie. ## Cookie Session Domain default 'name' value.
name: 'authelia_session' name: 'authelia_session'
## Cookie Session Domain default 'same_site' value. Sets the Cookie SameSite value. Possible options are none, lax, ## Cookie Session Domain default 'same_site' value.
## or strict. Please read https://www.authelia.com/c/session#same_site
same_site: 'lax' same_site: 'lax'
## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. ## Cookie Session Domain default 'inactivity' value.
## See: https://www.authelia.com/c/common#duration-notation-format
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
## because a stolen cookie will last longer giving attackers more time to spy or attack.
## Cookie Session Domain default 'inactivity' value. The inactivity time before the session is reset. If expiration is
## set to 1h, and this is set to 5m, if the user does not select the remember me option their session will get
## destroyed after 1h, or after 5m since the last time Authelia detected user activity.
inactivity: '5m' inactivity: '5m'
## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is ## Cookie Session Domain default 'expiration' value.
## destroyed if remember me IS NOT selected by the user.
expiration: '1h' expiration: '1h'
## Cookie Session Domain default 'remember_me' value. The time before the cookie expires and the session is destroyed ## Cookie Session Domain default 'remember_me' value.
## if remember me IS selected by the user. Setting this value to -1 disables remember me for all session cookie
## domains which do not have a specific 'remember_me' value.
remember_me: '1M' remember_me: '1M'
## ##
@ -773,16 +772,16 @@ session:
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
## ##
# redis: # redis:
# host: 127.0.0.1 # host: '127.0.0.1'
# port: 6379 # port: 6379
## Use a unix socket instead ## Use a unix socket instead
# host: /var/run/redis/redis.sock # host: '/var/run/redis/redis.sock'
## Username used for redis authentication. This is optional and a new feature in redis 6.0. ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
# username: authelia # username: 'authelia'
## Password can also be set using a secret: https://www.authelia.com/c/secrets ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: authelia # password: 'authelia'
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
# database_index: 0 # database_index: 0
@ -797,7 +796,7 @@ session:
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the host option.
# server_name: myredis.example.com # server_name: 'myredis.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -808,10 +807,10 @@ session:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -890,21 +889,21 @@ session:
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
# high_availability: # high_availability:
## Sentinel Name / Master Name. ## Sentinel Name / Master Name.
# sentinel_name: mysentinel # sentinel_name: 'mysentinel'
## Specific username for Redis Sentinel. The node username and password is configured above. ## Specific username for Redis Sentinel. The node username and password is configured above.
# sentinel_username: sentinel_specific_user # sentinel_username: 'sentinel_specific_user'
## Specific password for Redis Sentinel. The node username and password is configured above. ## Specific password for Redis Sentinel. The node username and password is configured above.
# sentinel_password: sentinel_specific_pass # sentinel_password: 'sentinel_specific_pass'
## The additional nodes to pre-seed the redis provider with (for sentinel). ## The additional nodes to pre-seed the redis provider with (for sentinel).
## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
## For high availability to be used you must have either defined; the host above or at least one node below. ## For high availability to be used you must have either defined; the host above or at least one node below.
# nodes: # nodes:
# - host: sentinel-node1 # - host: 'sentinel-node1'
# port: 6379 # port: 6379
# - host: sentinel-node2 # - host: 'sentinel-node2'
# port: 6379 # port: 6379
## Choose the host with the lowest latency. ## Choose the host with the lowest latency.
@ -922,14 +921,12 @@ regulation:
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
max_retries: 3 max_retries: 3
## The time range during which the user can attempt login before being banned. The user is banned if the ## The time range during which the user can attempt login before being banned in the duration common syntax. The user
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. ## is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window.
## See: https://www.authelia.com/c/common#duration-notation-format find_time: '2m'
find_time: 2m
## The length of time before a banned user can login again. Ban Time accepts duration notation. ## The length of time before a banned user can login again in the duration common syntax.
## See: https://www.authelia.com/c/common#duration-notation-format ban_time: '5m'
ban_time: 5m
## ##
## Storage Provider Configuration ## Storage Provider Configuration
@ -939,7 +936,7 @@ regulation:
## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use
## the CLI to change this in the database if you want to change it from a previously configured value. ## the CLI to change this in the database if you want to change it from a previously configured value.
# encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this'
## ##
## Local (Storage Provider) ## Local (Storage Provider)
@ -951,25 +948,36 @@ regulation:
## ##
# local: # local:
## Path to the SQLite3 Database. ## Path to the SQLite3 Database.
# path: /config/db.sqlite3 # path: '/config/db.sqlite3'
## ##
## MySQL / MariaDB (Storage Provider) ## MySQL / MariaDB (Storage Provider)
## ##
# mysql: # mysql:
# host: 127.0.0.1 ## The address of the MySQL server to connect to in the address common syntax.
# port: 3306 ## Format: [<scheme>://]<hostname>[:<port>].
# database: authelia ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
# username: authelia ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'.
## Password can also be set using a secret: https://www.authelia.com/c/secrets # address: 'tcp://127.0.0.1:3306'
# password: mypassword
# timeout: 5s ## The database name to use.
# database: 'authelia'
## The username used for SQL authentication.
# username: 'authelia'
## The password used for SQL authentication.
## Can also be set using a secret: https://www.authelia.com/c/secrets
# password: 'mypassword'
## The connection timeout in the duration common syntax.
# timeout: '5s'
## MySQL TLS settings. Configuring this requires TLS. ## MySQL TLS settings. Configuring this requires TLS.
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: mysql.example.com # server_name: 'mysql.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -980,10 +988,10 @@ regulation:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -1062,20 +1070,33 @@ regulation:
## PostgreSQL (Storage Provider) ## PostgreSQL (Storage Provider)
## ##
# postgres: # postgres:
# host: 127.0.0.1 ## The address of the PostgreSQL server to connect to in the address common syntax.
# port: 5432 ## Format: [<scheme>://]<hostname>[:<port>].
# database: authelia ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
# schema: public ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'.
# username: authelia # address: 'tcp://127.0.0.1:5432'
## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: mypassword ## The database name to use.
# timeout: 5s # database: 'authelia'
## The schema name to use.
# schema: 'public'
## The username used for SQL authentication.
# username: 'authelia'
## The password used for SQL authentication.
## Can also be set using a secret: https://www.authelia.com/c/secrets
# password: 'mypassword'
## The connection timeout in the duration common syntax.
# timeout: '5s'
## PostgreSQL TLS settings. Configuring this requires TLS. ## PostgreSQL TLS settings. Configuring this requires TLS.
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: postgres.example.com # server_name: 'postgres.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -1086,10 +1107,10 @@ regulation:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -1179,7 +1200,7 @@ notifier:
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
## ##
# filesystem: # filesystem:
# filename: /config/notification.txt # filename: '/config/notification.txt'
## ##
## SMTP (Notification Provider) ## SMTP (Notification Provider)
@ -1192,36 +1213,33 @@ notifier:
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
## (configure in tls section) ## (configure in tls section)
# smtp: # smtp:
## The SMTP host to connect to. ## The address of the SMTP server to connect to in the address common syntax.
# host: 127.0.0.1 # address: 'smtp://127.0.0.1:25'
## The port to connect to the SMTP host on. ## The connection timeout in the duration common syntax.
# port: 1025 # timeout: '5s'
## The connection timeout.
# timeout: 5s
## The username used for SMTP authentication. ## The username used for SMTP authentication.
# username: test # username: 'test'
## The password used for SMTP authentication. ## The password used for SMTP authentication.
## Can also be set using a secret: https://www.authelia.com/c/secrets ## Can also be set using a secret: https://www.authelia.com/c/secrets
# password: password # password: 'password'
## The sender is used to is used for the MAIL FROM command and the FROM header. ## The sender is used to is used for the MAIL FROM command and the FROM header.
## If this is not defined and the username is an email, we use the username as this value. This can either be just ## If this is not defined and the username is an email, we use the username as this value. This can either be just
## an email address or the RFC5322 'Name <email address>' format. ## an email address or the RFC5322 'Name <email address>' format.
# sender: "Authelia <admin@example.com>" # sender: 'Authelia <admin@example.com>'
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
# identifier: localhost # identifier: 'localhost'
## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
# subject: "[Authelia] {title}" # subject: '[Authelia] {title}'
## This address is used during the startup check to verify the email configuration is correct. ## This address is used during the startup check to verify the email configuration is correct.
## It's not important what it is except if your email server only allows local delivery. ## It's not important what it is except if your email server only allows local delivery.
# startup_check_address: test@authelia.com # startup_check_address: 'test@authelia.com'
## By default we require some form of TLS. This disables this check though is not advised. ## By default we require some form of TLS. This disables this check though is not advised.
# disable_require_tls: false # disable_require_tls: false
@ -1231,8 +1249,8 @@ notifier:
# tls: # tls:
## The server subject name to check the servers certificate against during the validation process. ## The server subject name to check the servers certificate against during the validation process.
## This option is not required if the certificate has a SAN which matches the host option. ## This option is not required if the certificate has a SAN which matches the address options hostname.
# server_name: smtp.example.com # server_name: 'smtp.example.com'
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
## certificate or the certificate of the authority signing the certificate to the certificates directory which is ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@ -1243,10 +1261,10 @@ notifier:
# skip_verify: false # skip_verify: false
## Minimum TLS version for the connection. ## Minimum TLS version for the connection.
# minimum_version: TLS1.2 # minimum_version: 'TLS1.2'
## Maximum TLS version for the connection. ## Maximum TLS version for the connection.
# maximum_version: TLS1.3 # maximum_version: 'TLS1.3'
## The certificate chain used with the private_key if the server requests TLS Client Authentication ## The certificate chain used with the private_key if the server requests TLS Client Authentication
## i.e. Mutual TLS. ## i.e. Mutual TLS.
@ -1334,7 +1352,7 @@ notifier:
# oidc: # oidc:
## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
# hmac_secret: this_is_a_secret_abc123abc123abc # hmac_secret: 'this_is_a_secret_abc123abc123abc'
## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the
## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every
@ -1410,11 +1428,11 @@ notifier:
# DO NOT USE== # DO NOT USE==
# -----END RSA PRIVATE KEY----- # -----END RSA PRIVATE KEY-----
## The lifespans configure the expiration for these token types. ## The lifespans configure the expiration for these token types in the duration common syntax.
# access_token_lifespan: 1h # access_token_lifespan: '1h'
# authorize_code_lifespan: 1m # authorize_code_lifespan: '1m'
# id_token_lifespan: 1h # id_token_lifespan: '1h'
# refresh_token_lifespan: 90m # refresh_token_lifespan: '90m'
## Enables additional debug messages. ## Enables additional debug messages.
# enable_client_debug_messages: false # enable_client_debug_messages: false
@ -1424,23 +1442,23 @@ notifier:
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
## for security reasons. ## for security reasons.
# enforce_pkce: public_clients_only # enforce_pkce: 'public_clients_only'
## Cross-Origin Resource Sharing (CORS) settings. ## Cross-Origin Resource Sharing (CORS) settings.
# cors: # cors:
## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
# endpoints: # endpoints:
# - authorization # - 'authorization'
# - token # - 'token'
# - revocation # - 'revocation'
# - introspection # - 'introspection'
# - userinfo # - 'userinfo'
## List of allowed origins. ## List of allowed origins.
## Any origin with https is permitted unless this option is configured or the ## Any origin with https is permitted unless this option is configured or the
## allowed_origins_from_client_redirect_uris option is enabled. ## allowed_origins_from_client_redirect_uris option is enabled.
# allowed_origins: # allowed_origins:
# - https://example.com # - 'https://example.com'
## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
## provided they have the scheme http or https and do not have the hostname of localhost. ## provided they have the scheme http or https and do not have the hostname of localhost.
@ -1450,71 +1468,72 @@ notifier:
# clients: # clients:
# - # -
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
# id: myapp # id: 'myapp'
## The description to show to users when they end up on the consent screen. Defaults to the ID above. ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
# description: My Application # description: 'My Application'
## The client secret is a shared secret between Authelia and the consumer of this client. ## The client secret is a shared secret between Authelia and the consumer of this client.
# secret: this_is_a_secret # yamllint disable-line rule:line-length
# secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
## necessary. Read the documentation for more information. ## necessary. Read the documentation for more information.
## The subject identifier must be the host component of a URL, which is a domain name with an optional port. ## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
# sector_identifier: example.com # sector_identifier: 'example.com'
## Sets the client to public. This should typically not be set, please see the documentation for usage. ## Sets the client to public. This should typically not be set, please see the documentation for usage.
# public: false # public: false
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
# redirect_uris: # redirect_uris:
# - https://oidc.example.com:8080/oauth2/callback # - 'https://oidc.example.com:8080/oauth2/callback'
## Audience this client is allowed to request. ## Audience this client is allowed to request.
# audience: [] # audience: []
## Scopes this client is allowed to request. ## Scopes this client is allowed to request.
# scopes: # scopes:
# - openid # - 'openid'
# - groups # - 'groups'
# - email # - 'email'
# - profile # - 'profile'
## Response Types configures which responses this client can be sent. ## Response Types configures which responses this client can be sent.
## It's not recommended to define this unless you know what you're doing. ## It's not recommended to define this unless you know what you're doing.
# response_types: # response_types:
# - code # - 'code'
## Response Modes configures which response modes this client supports. ## Response Modes configures which response modes this client supports.
# response_modes: # response_modes:
# - form_post # - 'form_post'
# - query # - 'query'
## Grant Types configures which grants this client can obtain. ## Grant Types configures which grants this client can obtain.
## It's not recommended to define this unless you know what you're doing. ## It's not recommended to define this unless you know what you're doing.
# grant_types: # grant_types:
# - authorization_code # - 'authorization_code'
## The permitted client authentication method for the Token Endpoint for this client. ## The permitted client authentication method for the Token Endpoint for this client.
# token_endpoint_auth_method: client_secret_basic # token_endpoint_auth_method: 'client_secret_basic'
## The policy to require for this client; one_factor or two_factor. ## The policy to require for this client; one_factor or two_factor.
# authorization_policy: two_factor # authorization_policy: 'two_factor'
## Enforces the use of PKCE for this client when set to true. ## Enforces the use of PKCE for this client when set to true.
# enforce_pkce: false # enforce_pkce: false
## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method. ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method.
## Options are 'plain' and 'S256'. ## Options are 'plain' and 'S256'.
# pkce_challenge_method: S256 # pkce_challenge_method: 'S256'
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
# userinfo_signing_algorithm: none # userinfo_signing_algorithm: 'none'
## The consent mode controls how consent is obtained. ## The consent mode controls how consent is obtained.
# consent_mode: auto # consent_mode: 'auto'
## This value controls the duration a consent on this client remains remembered when the consent mode is ## This value controls the duration a consent on this client remains remembered when the consent mode is
## configured as 'auto' or 'pre-configured'. ## configured as 'auto' or 'pre-configured' in the duration common syntax.
# pre_configured_consent_duration: 1w # pre_configured_consent_duration: '1w'
... ...

6
internal/configuration/const.go
View File

@ -2,6 +2,8 @@ package configuration
import ( import (
"errors" "errors"
"math"
"time"
) )
// DefaultEnvPrefix is the default environment prefix. // DefaultEnvPrefix is the default environment prefix.
@ -38,6 +40,10 @@ const (
errFmtDecodeHookCouldNotParseEmptyValue = "could not decode an empty value to a %s%s: %w" errFmtDecodeHookCouldNotParseEmptyValue = "could not decode an empty value to a %s%s: %w"
) )
const (
durationMax = time.Duration(math.MaxInt64)
)
// IMPORTANT: There is an uppercase copy of this in github.com/authelia/authelia/internal/templates named // IMPORTANT: There is an uppercase copy of this in github.com/authelia/authelia/internal/templates named
// envSecretSuffixes. // envSecretSuffixes.
// Make sure you update these at the same time. // Make sure you update these at the same time.

125
internal/configuration/decode_hooks.go
View File

@ -9,6 +9,7 @@ import (
"net/url" "net/url"
"reflect" "reflect"
"regexp" "regexp"
"strconv"
"strings" "strings"
"time" "time"
@ -112,19 +113,14 @@ func StringToURLHookFunc() mapstructure.DecodeHookFuncType {
} }
// ToTimeDurationHookFunc converts string and integer types to a time.Duration. // ToTimeDurationHookFunc converts string and integer types to a time.Duration.
//
//nolint:gocyclo // Function is necessarily complex though flows well due to switch statement usage.
func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType { func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType {
return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { return func(f reflect.Type, t reflect.Type, data any) (value any, err error) {
var ptr bool var (
ptr bool
switch f.Kind() { prefixType string
case reflect.String, reflect.Int, reflect.Int32, reflect.Int64: )
// We only allow string and integer from kinds to match.
break
default:
return data, nil
}
prefixType := ""
if t.Kind() == reflect.Ptr { if t.Kind() == reflect.Ptr {
ptr = true ptr = true
@ -139,6 +135,14 @@ func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType {
return data, nil return data, nil
} }
switch f.Kind() {
case reflect.String, reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Float64:
// We only allow string and integer from kinds to match.
break
default:
return data, nil
}
var result time.Duration var result time.Duration
switch { switch {
@ -151,11 +155,29 @@ func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType {
case f.Kind() == reflect.Int: case f.Kind() == reflect.Int:
seconds := data.(int) seconds := data.(int)
result = time.Second * time.Duration(seconds)
case f.Kind() == reflect.Int8:
seconds := data.(int8)
result = time.Second * time.Duration(seconds)
case f.Kind() == reflect.Int16:
seconds := data.(int16)
result = time.Second * time.Duration(seconds) result = time.Second * time.Duration(seconds)
case f.Kind() == reflect.Int32: case f.Kind() == reflect.Int32:
seconds := data.(int32) seconds := data.(int32)
result = time.Second * time.Duration(seconds) result = time.Second * time.Duration(seconds)
case f.Kind() == reflect.Float64:
fseconds := data.(float64)
if fseconds > durationMax.Seconds() {
result = durationMax
} else {
seconds, _ := strconv.Atoi(fmt.Sprintf("%.0f", fseconds))
result = time.Second * time.Duration(seconds)
}
case f == expectedType: case f == expectedType:
result = data.(time.Duration) result = data.(time.Duration)
case f.Kind() == reflect.Int64: case f.Kind() == reflect.Int64:
@ -219,6 +241,8 @@ func StringToRegexpHookFunc() mapstructure.DecodeHookFuncType {
} }
// StringToAddressHookFunc decodes a string into an Address or *Address. // StringToAddressHookFunc decodes a string into an Address or *Address.
//
//nolint:gocyclo // This is an adequately clear function even with the complexity.
func StringToAddressHookFunc() mapstructure.DecodeHookFuncType { func StringToAddressHookFunc() mapstructure.DecodeHookFuncType {
return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { return func(f reflect.Type, t reflect.Type, data any) (value any, err error) {
var ptr bool var ptr bool
@ -235,18 +259,90 @@ func StringToAddressHookFunc() mapstructure.DecodeHookFuncType {
} }
expectedType := reflect.TypeOf(schema.Address{}) expectedType := reflect.TypeOf(schema.Address{})
expectedTypeTCP := reflect.TypeOf(schema.AddressTCP{})
expectedTypeUDP := reflect.TypeOf(schema.AddressUDP{})
expectedTypeLDAP := reflect.TypeOf(schema.AddressLDAP{})
expectedTypeSMTP := reflect.TypeOf(schema.AddressSMTP{})
if ptr && t.Elem() != expectedType { switch {
case ptr:
switch t.Elem() {
case expectedType:
case expectedTypeTCP:
expectedType = expectedTypeTCP
case expectedTypeUDP:
expectedType = expectedTypeUDP
case expectedTypeLDAP:
expectedType = expectedTypeLDAP
case expectedTypeSMTP:
expectedType = expectedTypeSMTP
default:
return data, nil return data, nil
} else if !ptr && t != expectedType { }
default:
switch t {
case expectedType:
break
case expectedTypeTCP:
expectedType = expectedTypeTCP
case expectedTypeUDP:
expectedType = expectedTypeUDP
case expectedTypeLDAP:
expectedType = expectedTypeLDAP
case expectedTypeSMTP:
expectedType = expectedTypeSMTP
default:
return data, nil return data, nil
} }
}
dataStr := data.(string) dataStr := data.(string)
var result *schema.Address var result *schema.Address
if result, err = schema.NewAddressFromString(dataStr); err != nil { switch expectedType {
case expectedTypeTCP:
if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeTCP, schema.AddressSchemeUnix); err != nil {
return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err)
}
if ptr {
return &schema.AddressTCP{Address: *result}, nil
}
return schema.AddressTCP{Address: *result}, nil
case expectedTypeUDP:
if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeUDP, schema.AddressSchemeUnix); err != nil {
return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err)
}
if ptr {
return &schema.AddressUDP{Address: *result}, nil
}
return schema.AddressUDP{Address: *result}, nil
case expectedTypeLDAP:
if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeLDAPS, schema.AddressSchemeLDAPI); err != nil {
return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err)
}
if ptr {
return &schema.AddressLDAP{Address: *result}, nil
}
return schema.AddressLDAP{Address: *result}, nil
case expectedTypeSMTP:
if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeSMTP, schema.AddressSchemeUnix); err != nil {
return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err)
}
if ptr {
return &schema.AddressSMTP{Address: *result}, nil
}
return schema.AddressSMTP{Address: *result}, nil
default:
if result, err = schema.NewAddress(dataStr); err != nil {
return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err)
} }
@ -256,6 +352,7 @@ func StringToAddressHookFunc() mapstructure.DecodeHookFuncType {
return *result, nil return *result, nil
} }
}
} }
// StringToX509CertificateHookFunc decodes strings to x509.Certificate's. // StringToX509CertificateHookFunc decodes strings to x509.Certificate's.

37
internal/configuration/decode_hooks_test.go
View File

@ -6,6 +6,7 @@ import (
"crypto/rsa" "crypto/rsa"
"crypto/x509" "crypto/x509"
"encoding/pem" "encoding/pem"
"math"
"net/mail" "net/mail"
"net/url" "net/url"
"reflect" "reflect"
@ -345,12 +346,36 @@ func TestToTimeDurationHookFunc(t *testing.T) {
want: time.Second * 60, want: time.Second * 60,
decode: true, decode: true,
}, },
{
desc: "ShouldDecodeInt8ToSeconds",
have: int8(90),
want: time.Second * 90,
decode: true,
},
{
desc: "ShouldDecodeInt16ToSeconds",
have: int16(90),
want: time.Second * 90,
decode: true,
},
{ {
desc: "ShouldDecodeInt32ToSeconds", desc: "ShouldDecodeInt32ToSeconds",
have: int32(90), have: int32(90),
want: time.Second * 90, want: time.Second * 90,
decode: true, decode: true,
}, },
{
desc: "ShouldDecodeFloat64ToSeconds",
have: float64(90),
want: time.Second * 90,
decode: true,
},
{
desc: "ShouldDecodeFloat64ToSeconds",
have: math.MaxFloat64,
want: time.Duration(math.MaxInt64),
decode: true,
},
{ {
desc: "ShouldDecodeInt64ToSeconds", desc: "ShouldDecodeInt64ToSeconds",
have: int64(120), have: int64(120),
@ -375,6 +400,12 @@ func TestToTimeDurationHookFunc(t *testing.T) {
want: time.Duration(0), want: time.Duration(0),
decode: true, decode: true,
}, },
{
desc: "ShouldSkipParsingBoolean",
have: true,
want: time.Duration(0),
decode: false,
},
{ {
desc: "ShouldNotDecodeFromBool", desc: "ShouldNotDecodeFromBool",
have: true, have: true,
@ -756,7 +787,7 @@ func TestStringToRegexpFuncPointers(t *testing.T) {
func TestStringToAddressHookFunc(t *testing.T) { func TestStringToAddressHookFunc(t *testing.T) {
mustParseAddress := func(a string) (addr schema.Address) { mustParseAddress := func(a string) (addr schema.Address) {
addrs, err := schema.NewAddressFromString(a) addrs, err := schema.NewAddress(a)
if err != nil { if err != nil {
panic(err) panic(err)
} }
@ -765,7 +796,7 @@ func TestStringToAddressHookFunc(t *testing.T) {
} }
mustParseAddressPtr := func(a string) (addr *schema.Address) { mustParseAddressPtr := func(a string) (addr *schema.Address) {
addr, err := schema.NewAddressFromString(a) addr, err := schema.NewAddress(a)
if err != nil { if err != nil {
panic(err) panic(err)
} }
@ -838,7 +869,7 @@ func TestStringToAddressHookFunc(t *testing.T) {
name: "ShouldFailDecode", name: "ShouldFailDecode",
have: "tcp://&!@^#*&!@#&*@!:2020", have: "tcp://&!@^#*&!@#&*@!:2020",
expected: schema.Address{}, expected: schema.Address{},
err: "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [<scheme>://]<ip>[:<port>]: parse \"tcp://&!@^\": invalid character \"^\" in host name", err: "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [<scheme>://]<hostname>[:<port>]: parse \"tcp://&!@^\": invalid character \"^\" in host name",
decode: false, decode: false,
}, },
} }

100
internal/configuration/deprecation.go
View File

@ -1,6 +1,9 @@
package configuration package configuration
import ( import (
"fmt"
"github.com/authelia/authelia/v4/internal/configuration/schema"
"github.com/authelia/authelia/v4/internal/model" "github.com/authelia/authelia/v4/internal/model"
) )
@ -10,8 +13,9 @@ type Deprecation struct {
Key string Key string
NewKey string NewKey string
AutoMap bool AutoMap bool
Keep bool
MapFunc func(value any) any MapFunc func(value any) any
ErrText string ErrFunc func(d Deprecation, keysFinal map[string]any, value any, val *schema.StructValidator)
} }
var deprecations = map[string]Deprecation{ var deprecations = map[string]Deprecation{
@ -21,6 +25,7 @@ var deprecations = map[string]Deprecation{
NewKey: "log.level", NewKey: "log.level",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"logs_file": { "logs_file": {
Version: model.SemanticVersion{Major: 4, Minor: 7}, Version: model.SemanticVersion{Major: 4, Minor: 7},
@ -28,6 +33,7 @@ var deprecations = map[string]Deprecation{
NewKey: "log.file_path", NewKey: "log.file_path",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"authentication_backend.ldap.skip_verify": { "authentication_backend.ldap.skip_verify": {
Version: model.SemanticVersion{Major: 4, Minor: 25}, Version: model.SemanticVersion{Major: 4, Minor: 25},
@ -35,6 +41,7 @@ var deprecations = map[string]Deprecation{
NewKey: "authentication_backend.ldap.tls.skip_verify", NewKey: "authentication_backend.ldap.tls.skip_verify",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"authentication_backend.ldap.minimum_tls_version": { "authentication_backend.ldap.minimum_tls_version": {
Version: model.SemanticVersion{Major: 4, Minor: 25}, Version: model.SemanticVersion{Major: 4, Minor: 25},
@ -42,6 +49,7 @@ var deprecations = map[string]Deprecation{
NewKey: "authentication_backend.ldap.tls.minimum_version", NewKey: "authentication_backend.ldap.tls.minimum_version",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"notifier.smtp.disable_verify_cert": { "notifier.smtp.disable_verify_cert": {
Version: model.SemanticVersion{Major: 4, Minor: 25}, Version: model.SemanticVersion{Major: 4, Minor: 25},
@ -49,6 +57,7 @@ var deprecations = map[string]Deprecation{
NewKey: "notifier.smtp.tls.skip_verify", NewKey: "notifier.smtp.tls.skip_verify",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"notifier.smtp.trusted_cert": { "notifier.smtp.trusted_cert": {
Version: model.SemanticVersion{Major: 4, Minor: 25}, Version: model.SemanticVersion{Major: 4, Minor: 25},
@ -56,6 +65,7 @@ var deprecations = map[string]Deprecation{
NewKey: "certificates_directory", NewKey: "certificates_directory",
AutoMap: false, AutoMap: false,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"host": { "host": {
Version: model.SemanticVersion{Major: 4, Minor: 30}, Version: model.SemanticVersion{Major: 4, Minor: 30},
@ -63,6 +73,7 @@ var deprecations = map[string]Deprecation{
NewKey: "server.host", NewKey: "server.host",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"port": { "port": {
Version: model.SemanticVersion{Major: 4, Minor: 30}, Version: model.SemanticVersion{Major: 4, Minor: 30},
@ -70,6 +81,7 @@ var deprecations = map[string]Deprecation{
NewKey: "server.port", NewKey: "server.port",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"tls_key": { "tls_key": {
Version: model.SemanticVersion{Major: 4, Minor: 30}, Version: model.SemanticVersion{Major: 4, Minor: 30},
@ -77,6 +89,7 @@ var deprecations = map[string]Deprecation{
NewKey: "server.tls.key", NewKey: "server.tls.key",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"tls_cert": { "tls_cert": {
Version: model.SemanticVersion{Major: 4, Minor: 30}, Version: model.SemanticVersion{Major: 4, Minor: 30},
@ -84,6 +97,7 @@ var deprecations = map[string]Deprecation{
NewKey: "server.tls.certificate", NewKey: "server.tls.certificate",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"log_level": { "log_level": {
Version: model.SemanticVersion{Major: 4, Minor: 30}, Version: model.SemanticVersion{Major: 4, Minor: 30},
@ -91,6 +105,7 @@ var deprecations = map[string]Deprecation{
NewKey: "log.level", NewKey: "log.level",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"log_file_path": { "log_file_path": {
Version: model.SemanticVersion{Major: 4, Minor: 30}, Version: model.SemanticVersion{Major: 4, Minor: 30},
@ -98,6 +113,7 @@ var deprecations = map[string]Deprecation{
NewKey: "log.file_path", NewKey: "log.file_path",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"log_format": { "log_format": {
Version: model.SemanticVersion{Major: 4, Minor: 30}, Version: model.SemanticVersion{Major: 4, Minor: 30},
@ -105,6 +121,7 @@ var deprecations = map[string]Deprecation{
NewKey: "log.format", NewKey: "log.format",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"storage.postgres.sslmode": { "storage.postgres.sslmode": {
Version: model.SemanticVersion{Major: 4, Minor: 36}, Version: model.SemanticVersion{Major: 4, Minor: 36},
@ -112,6 +129,7 @@ var deprecations = map[string]Deprecation{
NewKey: "storage.postgres.ssl.mode", NewKey: "storage.postgres.ssl.mode",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"authentication_backend.disable_reset_password": { "authentication_backend.disable_reset_password": {
Version: model.SemanticVersion{Major: 4, Minor: 36}, Version: model.SemanticVersion{Major: 4, Minor: 36},
@ -119,6 +137,7 @@ var deprecations = map[string]Deprecation{
NewKey: "authentication_backend.password_reset.disable", NewKey: "authentication_backend.password_reset.disable",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"server.read_buffer_size": { "server.read_buffer_size": {
Version: model.SemanticVersion{Major: 4, Minor: 36}, Version: model.SemanticVersion{Major: 4, Minor: 36},
@ -126,6 +145,7 @@ var deprecations = map[string]Deprecation{
NewKey: "server.buffers.read", NewKey: "server.buffers.read",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"server.write_buffer_size": { "server.write_buffer_size": {
Version: model.SemanticVersion{Major: 4, Minor: 36}, Version: model.SemanticVersion{Major: 4, Minor: 36},
@ -133,6 +153,7 @@ var deprecations = map[string]Deprecation{
NewKey: "server.buffers.write", NewKey: "server.buffers.write",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"session.remember_me_duration": { "session.remember_me_duration": {
Version: model.SemanticVersion{Major: 4, Minor: 38}, Version: model.SemanticVersion{Major: 4, Minor: 38},
@ -140,6 +161,7 @@ var deprecations = map[string]Deprecation{
NewKey: "session.remember_me", NewKey: "session.remember_me",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"server.enable_pprof": { "server.enable_pprof": {
Version: model.SemanticVersion{Major: 4, Minor: 38}, Version: model.SemanticVersion{Major: 4, Minor: 38},
@ -147,6 +169,7 @@ var deprecations = map[string]Deprecation{
NewKey: "server.endpoints.enable_pprof", NewKey: "server.endpoints.enable_pprof",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
}, },
"server.enable_expvars": { "server.enable_expvars": {
Version: model.SemanticVersion{Major: 4, Minor: 38}, Version: model.SemanticVersion{Major: 4, Minor: 38},
@ -154,5 +177,80 @@ var deprecations = map[string]Deprecation{
NewKey: "server.endpoints.enable_expvars", NewKey: "server.endpoints.enable_expvars",
AutoMap: true, AutoMap: true,
MapFunc: nil, MapFunc: nil,
ErrFunc: nil,
},
"server.host": {
Version: model.SemanticVersion{Major: 4, Minor: 38},
Key: "server.host",
NewKey: "server.address",
AutoMap: false,
Keep: true,
MapFunc: nil,
ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
val.PushWarning(fmt.Errorf("configuration key 'server.host' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
},
},
"server.port": {
Version: model.SemanticVersion{Major: 4, Minor: 38},
Key: "server.port",
NewKey: "server.address",
AutoMap: false,
Keep: true,
MapFunc: nil,
ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
val.PushWarning(fmt.Errorf("configuration key 'server.port' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
},
},
"storage.mysql.host": {
Version: model.SemanticVersion{Major: 4, Minor: 38},
Key: "storage.mysql.host",
NewKey: "storage.mysql.address",
AutoMap: false,
Keep: true,
MapFunc: nil,
ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.host' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
},
},
"storage.mysql.port": {
Version: model.SemanticVersion{Major: 4, Minor: 38},
Key: "storage.mysql.port",
NewKey: "storage.mysql.address",
AutoMap: false,
Keep: true,
MapFunc: nil,
ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.port' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
},
},
"storage.postgres.host": {
Version: model.SemanticVersion{Major: 4, Minor: 38},
Key: "storage.postgres.host",
NewKey: "storage.postgres.address",
AutoMap: false,
Keep: true,
MapFunc: nil,
ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.host' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
},
},
"storage.postgres.port": {
Version: model.SemanticVersion{Major: 4, Minor: 38},
Key: "storage.postgres.port",
NewKey: "storage.postgres.address",
AutoMap: false,
Keep: true,
MapFunc: nil,
ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.port' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
},
},
"authentication_backend.ldap.url": {
Version: model.SemanticVersion{Major: 4, Minor: 38},
Key: "authentication_backend.ldap.url",
NewKey: "authentication_backend.ldap.address",
AutoMap: true,
MapFunc: nil,
ErrFunc: nil,
}, },
} }

Some files were not shown because too many files have changed in this diff Show More