From 7785a33adeeaf5a7203381db7a558c80c0f777b6 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Fri, 5 May 2023 23:50:35 +1000 Subject: [PATCH 01/67] build(deps): update module github.com/fasthttp/session to v2.5.0 (#5391) This offers redis v7 full compatibility. Closes #3856 Signed-off-by: James Elliott --- go.mod | 5 +++-- go.sum | 14 +++++++++----- internal/session/provider_config.go | 24 ++++++++++++------------ 3 files changed, 24 insertions(+), 19 deletions(-) diff --git a/go.mod b/go.mod index a5ca1d37a..fd8c851f8 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( github.com/deckarep/golang-set/v2 v2.3.0 github.com/duosecurity/duo_api_golang v0.0.0-20230418202038-096d3306c029 github.com/fasthttp/router v1.4.18 - github.com/fasthttp/session/v2 v2.4.17 + github.com/fasthttp/session/v2 v2.5.0 github.com/fsnotify/fsnotify v1.6.0 github.com/go-asn1-ber/asn1-ber v1.5.4 github.com/go-crypt/crypt v0.2.7 @@ -83,7 +83,7 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect github.com/jandelgado/gcov2lcov v1.0.5 // indirect - github.com/klauspost/compress v1.16.3 // indirect + github.com/klauspost/compress v1.16.5 // indirect github.com/knadh/koanf/maps v0.1.1 // indirect github.com/magiconair/properties v1.8.7 // indirect github.com/mattn/goveralls v0.0.11 // indirect @@ -100,6 +100,7 @@ require ( github.com/prometheus/client_model v0.3.0 // indirect github.com/prometheus/common v0.42.0 // indirect github.com/prometheus/procfs v0.9.0 // indirect + github.com/redis/go-redis/v9 v9.0.4 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee // indirect github.com/spf13/afero v1.9.5 // indirect diff --git a/go.sum b/go.sum index 6fd047db3..12be385df 100644 --- a/go.sum +++ b/go.sum @@ -56,6 +56,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= +github.com/bsm/ginkgo/v2 v2.7.0 h1:ItPMPH90RbmZJt5GtkcNvIRuGEdwlBItdNVoyzaNQao= +github.com/bsm/gomega v1.26.0 h1:LhQm+AFcgV2M0WyKroMASzAzCAJVpAxQXv4SaI9a69Y= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= @@ -114,8 +116,8 @@ github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojt github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg= github.com/fasthttp/router v1.4.18 h1:elMnlFq527oZd8MHsuUpO6uLDup1exv8rXPfIjClDHk= github.com/fasthttp/router v1.4.18/go.mod h1:ZmC20Mn0VgCBbUWFDmnYzFbQYRfdGeKgpkBy0+JioKA= -github.com/fasthttp/session/v2 v2.4.17 h1:jcS21Xoi1fE/4Ikz5Nm37x6FjpMUPnPQPVJWxKnQ8FE= -github.com/fasthttp/session/v2 v2.4.17/go.mod h1:+pr8HLEQp6h9X70KLBY/Y4NrdJR2ts7VERydkMkiZaI= +github.com/fasthttp/session/v2 v2.5.0 h1:Vt+U2yKCmBxnEZ4v6rjEsO4YeTSaCpz/HPEI4DTN59M= +github.com/fasthttp/session/v2 v2.5.0/go.mod h1:gmUptI/jKL7qTfFtBHU3us36nv2Bm7U4jazt9pnBPLY= github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w= github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= @@ -264,8 +266,8 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.16.3 h1:XuJt9zzcnaz6a16/OU53ZjWp/v7/42WcR5t2a0PcNQY= -github.com/klauspost/compress v1.16.3/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI= +github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs= github.com/knadh/koanf/maps v0.1.1/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= github.com/knadh/koanf/parsers/yaml v0.1.0 h1:ZZ8/iGfRLvKSaMEECEBPM1HQslrZADk8fP1XFUxVI5w= @@ -289,7 +291,7 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo= -github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw= +github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw= github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY= github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= @@ -368,6 +370,8 @@ github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7z github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI= github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY= github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU= +github.com/redis/go-redis/v9 v9.0.4 h1:FC82T+CHJ/Q/PdyLW++GeCO+Ol59Y4T7R4jbgjvktgc= +github.com/redis/go-redis/v9 v9.0.4/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk= github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8= diff --git a/internal/session/provider_config.go b/internal/session/provider_config.go index 0336a703e..f61842d7a 100644 --- a/internal/session/provider_config.go +++ b/internal/session/provider_config.go @@ -134,7 +134,7 @@ func NewSessionProvider(config schema.SessionConfiguration, certPool *x509.CertP DB: config.Redis.DatabaseIndex, // DB is the fasthttp/session property for the Redis DB Index. PoolSize: config.Redis.MaximumActiveConnections, MinIdleConns: config.Redis.MinimumIdleConnections, - IdleTimeout: 300, + ConnMaxIdleTime: 300, TLSConfig: tlsConfig, KeyPrefix: "authelia-session", }) @@ -152,17 +152,17 @@ func NewSessionProvider(config schema.SessionConfiguration, certPool *x509.CertP } provider, err = redis.New(redis.Config{ - Logger: logging.LoggerCtxPrintf(logrus.TraceLevel), - Network: network, - Addr: addr, - Username: config.Redis.Username, - Password: config.Redis.Password, - DB: config.Redis.DatabaseIndex, // DB is the fasthttp/session property for the Redis DB Index. - PoolSize: config.Redis.MaximumActiveConnections, - MinIdleConns: config.Redis.MinimumIdleConnections, - IdleTimeout: 300, - TLSConfig: tlsConfig, - KeyPrefix: "authelia-session", + Logger: logging.LoggerCtxPrintf(logrus.TraceLevel), + Network: network, + Addr: addr, + Username: config.Redis.Username, + Password: config.Redis.Password, + DB: config.Redis.DatabaseIndex, // DB is the fasthttp/session property for the Redis DB Index. + PoolSize: config.Redis.MaximumActiveConnections, + MinIdleConns: config.Redis.MinimumIdleConnections, + ConnMaxIdleTime: 300, + TLSConfig: tlsConfig, + KeyPrefix: "authelia-session", }) } default: From e5e831483283913d8033cdc54dc67692a7bc48c6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 May 2023 00:05:17 +1000 Subject: [PATCH 02/67] build(deps): update module github.com/fasthttp/router to v1.4.19 (#5392) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index fd8c851f8..85f0e1fad 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d github.com/deckarep/golang-set/v2 v2.3.0 github.com/duosecurity/duo_api_golang v0.0.0-20230418202038-096d3306c029 - github.com/fasthttp/router v1.4.18 + github.com/fasthttp/router v1.4.19 github.com/fasthttp/session/v2 v2.5.0 github.com/fsnotify/fsnotify v1.6.0 github.com/go-asn1-ber/asn1-ber v1.5.4 diff --git a/go.sum b/go.sum index 12be385df..baee796e4 100644 --- a/go.sum +++ b/go.sum @@ -114,8 +114,8 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojtoVVWjGfOF9635RETekkoH6Cc9SX0A= github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg= -github.com/fasthttp/router v1.4.18 h1:elMnlFq527oZd8MHsuUpO6uLDup1exv8rXPfIjClDHk= -github.com/fasthttp/router v1.4.18/go.mod h1:ZmC20Mn0VgCBbUWFDmnYzFbQYRfdGeKgpkBy0+JioKA= +github.com/fasthttp/router v1.4.19 h1:RLE539IU/S4kfb4MP56zgP0TIBU9kEg0ID9GpWO0vqk= +github.com/fasthttp/router v1.4.19/go.mod h1:+Fh3YOd8x1+he6ZS+d2iUDBH9MGGZ1xQFUor0DE9rKE= github.com/fasthttp/session/v2 v2.5.0 h1:Vt+U2yKCmBxnEZ4v6rjEsO4YeTSaCpz/HPEI4DTN59M= github.com/fasthttp/session/v2 v2.5.0/go.mod h1:gmUptI/jKL7qTfFtBHU3us36nv2Bm7U4jazt9pnBPLY= github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w= From 607bb01560580b7d363d64d35a47e67e12bcf34b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 May 2023 03:04:04 +1000 Subject: [PATCH 03/67] build(deps): update dependency @types/react-dom to v18.2.4 (#5393) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/web/package.json b/web/package.json index 0f746f1fc..e057b6243 100644 --- a/web/package.json +++ b/web/package.json @@ -73,7 +73,7 @@ "@testing-library/react": "14.0.0", "@types/node": "18.16.4", "@types/react": "18.2.5", - "@types/react-dom": "18.2.3", + "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", "@types/zxcvbn": "4.4.1", "@typescript-eslint/eslint-plugin": "5.59.2", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index ab02ff6de..06600acc0 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -97,8 +97,8 @@ devDependencies: specifier: 18.2.5 version: 18.2.5 '@types/react-dom': - specifier: 18.2.3 - version: 18.2.3 + specifier: 18.2.4 + version: 18.2.4 '@types/testing-library__jest-dom': specifier: 5.14.5 version: 5.14.5 @@ -2698,7 +2698,7 @@ packages: dependencies: '@babel/runtime': 7.21.0 '@testing-library/dom': 9.2.0 - '@types/react-dom': 18.2.3 + '@types/react-dom': 18.2.4 react: 18.2.0 react-dom: 18.2.0(react@18.2.0) dev: true @@ -2835,8 +2835,8 @@ packages: resolution: {integrity: sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw==} dev: true - /@types/react-dom@18.2.3: - resolution: {integrity: sha512-hxXEXWxFJXbY0LMj/T69mznqOZJXNtQMqVxIiirVAZnnpeYiD4zt+lPsgcr/cfWg2VLsxZ1y26vigG03prYB+Q==} + /@types/react-dom@18.2.4: + resolution: {integrity: sha512-G2mHoTMTL4yoydITgOGwWdWMVd8sNgyEP85xVmMKAPUBwQWm9wBPQUmvbeF4V3WBY1P7mmL4BkjQ0SqUpf1snw==} dependencies: '@types/react': 18.2.5 dev: true From 7ca95eebe8bca3ac91125b8aba1b8bb425da4115 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 May 2023 09:09:15 +1000 Subject: [PATCH 04/67] build(deps): update dependency eslint to v8.40.0 (#5395) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 212 ++++++++++++++++++++++----------------------- 2 files changed, 107 insertions(+), 107 deletions(-) diff --git a/web/package.json b/web/package.json index e057b6243..10c774a49 100644 --- a/web/package.json +++ b/web/package.json @@ -81,7 +81,7 @@ "@vitejs/plugin-react": "4.0.0", "@vitest/coverage-istanbul": "0.31.0", "esbuild": "0.17.18", - "eslint": "8.39.0", + "eslint": "8.40.0", "eslint-config-prettier": "8.8.0", "eslint-config-react-app": "7.0.1", "eslint-formatter-rdjson": "1.0.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 06600acc0..fef205ae9 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -83,7 +83,7 @@ devDependencies: version: 17.6.3 '@limegrass/eslint-plugin-import-alias': specifier: 1.0.6 - version: 1.0.6(eslint@8.39.0) + version: 1.0.6(eslint@8.40.0) '@testing-library/jest-dom': specifier: 5.16.5 version: 5.16.5 @@ -107,10 +107,10 @@ devDependencies: version: 4.4.1 '@typescript-eslint/eslint-plugin': specifier: 5.59.2 - version: 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.39.0)(typescript@5.0.4) + version: 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) '@typescript-eslint/parser': specifier: 5.59.2 - version: 5.59.2(eslint@8.39.0)(typescript@5.0.4) + version: 5.59.2(eslint@8.40.0)(typescript@5.0.4) '@vitejs/plugin-react': specifier: 4.0.0 version: 4.0.0(vite@4.3.5) @@ -121,35 +121,35 @@ devDependencies: specifier: 0.17.18 version: 0.17.18 eslint: - specifier: 8.39.0 - version: 8.39.0 + specifier: 8.40.0 + version: 8.40.0 eslint-config-prettier: specifier: 8.8.0 - version: 8.8.0(eslint@8.39.0) + version: 8.8.0(eslint@8.40.0) eslint-config-react-app: specifier: 7.0.1 - version: 7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0)(typescript@5.0.4) + version: 7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0)(typescript@5.0.4) eslint-formatter-rdjson: specifier: 1.0.5 version: 1.0.5 eslint-import-resolver-typescript: specifier: 3.5.5 - version: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.39.0) + version: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0) eslint-plugin-import: specifier: 2.27.5 - version: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) + version: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) eslint-plugin-jsx-a11y: specifier: 6.7.1 - version: 6.7.1(eslint@8.39.0) + version: 6.7.1(eslint@8.40.0) eslint-plugin-prettier: specifier: 4.2.1 - version: 4.2.1(eslint-config-prettier@8.8.0)(eslint@8.39.0)(prettier@2.8.8) + version: 4.2.1(eslint-config-prettier@8.8.0)(eslint@8.40.0)(prettier@2.8.8) eslint-plugin-react: specifier: 7.32.2 - version: 7.32.2(eslint@8.39.0) + version: 7.32.2(eslint@8.40.0) eslint-plugin-react-hooks: specifier: 4.6.0 - version: 4.6.0(eslint@8.39.0) + version: 4.6.0(eslint@8.40.0) happy-dom: specifier: 9.10.9 version: 9.10.9 @@ -170,7 +170,7 @@ devDependencies: version: 4.3.5(@types/node@18.16.4) vite-plugin-eslint: specifier: 1.8.1 - version: 1.8.1(eslint@8.39.0)(vite@4.3.5) + version: 1.8.1(eslint@8.40.0)(vite@4.3.5) vite-plugin-istanbul: specifier: 4.0.1 version: 4.0.1(vite@4.3.5) @@ -235,7 +235,7 @@ packages: - supports-color dev: true - /@babel/eslint-parser@7.21.3(@babel/core@7.21.4)(eslint@8.39.0): + /@babel/eslint-parser@7.21.3(@babel/core@7.21.4)(eslint@8.40.0): resolution: {integrity: sha512-kfhmPimwo6k4P8zxNs8+T7yR44q1LdpsZdE1NkCsVlfiuTPRfnGgjaF8Qgug9q9Pou17u6wneYF0lDCZJATMFg==} engines: {node: ^10.13.0 || ^12.13.0 || >=14.0.0} peerDependencies: @@ -244,7 +244,7 @@ packages: dependencies: '@babel/core': 7.21.4 '@nicolo-ribaudo/eslint-scope-5-internals': 5.1.1-v1 - eslint: 8.39.0 + eslint: 8.40.0 eslint-visitor-keys: 2.1.0 semver: 6.3.0 dev: true @@ -2056,14 +2056,14 @@ packages: dev: true optional: true - /@eslint-community/eslint-utils@4.4.0(eslint@8.39.0): + /@eslint-community/eslint-utils@4.4.0(eslint@8.40.0): resolution: {integrity: sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || >=8.0.0 dependencies: - eslint: 8.39.0 - eslint-visitor-keys: 3.4.0 + eslint: 8.40.0 + eslint-visitor-keys: 3.4.1 dev: true /@eslint-community/regexpp@4.5.0: @@ -2071,13 +2071,13 @@ packages: engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0} dev: true - /@eslint/eslintrc@2.0.2: - resolution: {integrity: sha512-3W4f5tDUra+pA+FzgugqL2pRimUTDJWKr7BINqOpkZrC0uYI0NIc0/JFgBROCU07HR6GieA5m3/rsPIhDmCXTQ==} + /@eslint/eslintrc@2.0.3: + resolution: {integrity: sha512-+5gy6OQfk+xx3q0d6jGZZC3f3KzAkXc/IanVxd1is/VIIziRqqt3ongQz0FiTUXqTk0c7aDB3OaFuKnuSoJicQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: ajv: 6.12.6 debug: 4.3.4 - espree: 9.5.1 + espree: 9.5.2 globals: 13.20.0 ignore: 5.2.4 import-fresh: 3.3.0 @@ -2088,8 +2088,8 @@ packages: - supports-color dev: true - /@eslint/js@8.39.0: - resolution: {integrity: sha512-kf9RB0Fg7NZfap83B3QOqOGg9QmD9yBudqQXzzOtn3i4y7ZUXe5ONeW34Gwi+TxhH4mvj72R1Zc300KUMa9Bng==} + /@eslint/js@8.40.0: + resolution: {integrity: sha512-ElyB54bJIhXQYVKjDSvCkPO1iU1tSAeVQJbllWJq1XQSmmA4dgFk8CbiBGpiOPxleE48vDogxCtmMYku4HSVLA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true @@ -2242,12 +2242,12 @@ packages: '@jridgewell/sourcemap-codec': 1.4.15 dev: true - /@limegrass/eslint-plugin-import-alias@1.0.6(eslint@8.39.0): + /@limegrass/eslint-plugin-import-alias@1.0.6(eslint@8.40.0): resolution: {integrity: sha512-BtPmdHbL4NmkVh2wMnOboyOCrdLOpBqwwtBIsB0/giTiALw/UTHD9TyH4vVnbDOuWPZQgE6kKloJ9G77FApt7w==} peerDependencies: eslint: ^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 dependencies: - eslint: 8.39.0 + eslint: 8.40.0 find-up: 5.0.0 fs-extra: 10.1.0 micromatch: 4.0.5 @@ -2898,7 +2898,7 @@ packages: resolution: {integrity: sha512-3NoqvZC2W5gAC5DZbTpCeJ251vGQmgcWIHQJGq2J240HY6ErQ9aWKkwfoKJlHLx+A83WPNTZ9+3cd2ILxbvr1w==} dev: true - /@typescript-eslint/eslint-plugin@5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/eslint-plugin@5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-yVrXupeHjRxLDcPKL10sGQ/QlVrA8J5IYOEWVqk0lJaSZP7X5DfnP7Ns3cc74/blmbipQ1htFNVGsHX6wsYm0A==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: @@ -2910,12 +2910,12 @@ packages: optional: true dependencies: '@eslint-community/regexpp': 4.5.0 - '@typescript-eslint/parser': 5.59.2(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) '@typescript-eslint/scope-manager': 5.59.2 - '@typescript-eslint/type-utils': 5.59.2(eslint@8.39.0)(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.2(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/type-utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 - eslint: 8.39.0 + eslint: 8.40.0 grapheme-splitter: 1.0.4 ignore: 5.2.4 natural-compare-lite: 1.4.0 @@ -2926,20 +2926,20 @@ packages: - supports-color dev: true - /@typescript-eslint/experimental-utils@5.58.0(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/experimental-utils@5.58.0(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-LA/sRPaynZlrlYxdefrZbMx8dqs/1Kc0yNG+XOk5CwwZx7tTv263ix3AJNioF0YBVt7hADpAUR20owl6pv4MIQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 dependencies: - '@typescript-eslint/utils': 5.58.0(eslint@8.39.0)(typescript@5.0.4) - eslint: 8.39.0 + '@typescript-eslint/utils': 5.58.0(eslint@8.40.0)(typescript@5.0.4) + eslint: 8.40.0 transitivePeerDependencies: - supports-color - typescript dev: true - /@typescript-eslint/parser@5.59.2(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/parser@5.59.2(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-uq0sKyw6ao1iFOZZGk9F8Nro/8+gfB5ezl1cA06SrqbgJAt0SRoFhb9pXaHvkrxUpZaoLxt8KlovHNk8Gp6/HQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: @@ -2953,7 +2953,7 @@ packages: '@typescript-eslint/types': 5.59.2 '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) debug: 4.3.4 - eslint: 8.39.0 + eslint: 8.40.0 typescript: 5.0.4 transitivePeerDependencies: - supports-color @@ -2975,7 +2975,7 @@ packages: '@typescript-eslint/visitor-keys': 5.59.2 dev: true - /@typescript-eslint/type-utils@5.59.2(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/type-utils@5.59.2(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-b1LS2phBOsEy/T381bxkkywfQXkV1dWda/z0PhnIy3bC5+rQWQDS7fk9CSpcXBccPY27Z6vBEuaPBCKCgYezyQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: @@ -2986,9 +2986,9 @@ packages: optional: true dependencies: '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.2(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 - eslint: 8.39.0 + eslint: 8.40.0 tsutils: 3.21.0(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: @@ -3047,19 +3047,19 @@ packages: - supports-color dev: true - /@typescript-eslint/utils@5.58.0(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/utils@5.58.0(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-gAmLOTFXMXOC+zP1fsqm3VceKSBQJNzV385Ok3+yzlavNHZoedajjS4UyS21gabJYcobuigQPs/z71A9MdJFqQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 dependencies: - '@eslint-community/eslint-utils': 4.4.0(eslint@8.39.0) + '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@types/json-schema': 7.0.11 '@types/semver': 7.3.13 '@typescript-eslint/scope-manager': 5.58.0 '@typescript-eslint/types': 5.58.0 '@typescript-eslint/typescript-estree': 5.58.0(typescript@5.0.4) - eslint: 8.39.0 + eslint: 8.40.0 eslint-scope: 5.1.1 semver: 7.5.0 transitivePeerDependencies: @@ -3067,19 +3067,19 @@ packages: - typescript dev: true - /@typescript-eslint/utils@5.59.2(eslint@8.39.0)(typescript@5.0.4): + /@typescript-eslint/utils@5.59.2(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-kSuF6/77TZzyGPhGO4uVp+f0SBoYxCDf+lW3GKhtKru/L8k/Hd7NFQxyWUeY7Z/KGB2C6Fe3yf2vVi4V9TsCSQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 dependencies: - '@eslint-community/eslint-utils': 4.4.0(eslint@8.39.0) + '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@types/json-schema': 7.0.11 '@types/semver': 7.3.13 '@typescript-eslint/scope-manager': 5.59.2 '@typescript-eslint/types': 5.59.2 '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) - eslint: 8.39.0 + eslint: 8.40.0 eslint-scope: 5.1.1 semver: 7.4.0 transitivePeerDependencies: @@ -3092,7 +3092,7 @@ packages: engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: '@typescript-eslint/types': 5.58.0 - eslint-visitor-keys: 3.4.0 + eslint-visitor-keys: 3.4.1 dev: true /@typescript-eslint/visitor-keys@5.59.2: @@ -3100,7 +3100,7 @@ packages: engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: '@typescript-eslint/types': 5.59.2 - eslint-visitor-keys: 3.4.0 + eslint-visitor-keys: 3.4.1 dev: true /@vitejs/plugin-react@4.0.0(vite@4.3.5): @@ -3654,7 +3654,7 @@ packages: dev: true /concat-map@0.0.1: - resolution: {integrity: sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=} + resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} /concordance@5.0.4: resolution: {integrity: sha512-OAcsnTEYu1ARJqWVGwf4zh4JDfHZEaSNlNccFmt8YjB2l/n19/PF2viLINHc57vO4FKIAFl2FWASIGZZWZ2Kxw==} @@ -4356,16 +4356,16 @@ packages: resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==} engines: {node: '>=10'} - /eslint-config-prettier@8.8.0(eslint@8.39.0): + /eslint-config-prettier@8.8.0(eslint@8.40.0): resolution: {integrity: sha512-wLbQiFre3tdGgpDv67NQKnJuTlcUVYHas3k+DZCc2U2BadthoEY4B7hLPvAxaqdyOGCzuLfii2fqGph10va7oA==} hasBin: true peerDependencies: eslint: '>=7.0.0' dependencies: - eslint: 8.39.0 + eslint: 8.40.0 dev: true - /eslint-config-react-app@7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0)(typescript@5.0.4): + /eslint-config-react-app@7.0.1(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-K6rNzvkIeHaTd8m/QEh1Zko0KI7BACWkkneSs6s9cKZC/J27X3eZR6Upt1jkmZ/4FK+XUOPPxMEN7+lbUXfSlA==} engines: {node: '>=14.0.0'} peerDependencies: @@ -4376,20 +4376,20 @@ packages: optional: true dependencies: '@babel/core': 7.21.4 - '@babel/eslint-parser': 7.21.3(@babel/core@7.21.4)(eslint@8.39.0) + '@babel/eslint-parser': 7.21.3(@babel/core@7.21.4)(eslint@8.40.0) '@rushstack/eslint-patch': 1.2.0 - '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.39.0)(typescript@5.0.4) - '@typescript-eslint/parser': 5.59.2(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) babel-preset-react-app: 10.0.1 confusing-browser-globals: 1.0.11 - eslint: 8.39.0 - eslint-plugin-flowtype: 8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.39.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) - eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.39.0)(typescript@5.0.4) - eslint-plugin-jsx-a11y: 6.7.1(eslint@8.39.0) - eslint-plugin-react: 7.32.2(eslint@8.39.0) - eslint-plugin-react-hooks: 4.6.0(eslint@8.39.0) - eslint-plugin-testing-library: 5.10.2(eslint@8.39.0)(typescript@5.0.4) + eslint: 8.40.0 + eslint-plugin-flowtype: 8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.40.0) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + eslint-plugin-jsx-a11y: 6.7.1(eslint@8.40.0) + eslint-plugin-react: 7.32.2(eslint@8.40.0) + eslint-plugin-react-hooks: 4.6.0(eslint@8.40.0) + eslint-plugin-testing-library: 5.10.2(eslint@8.40.0)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@babel/plugin-syntax-flow' @@ -4414,7 +4414,7 @@ packages: - supports-color dev: true - /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.39.0): + /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0): resolution: {integrity: sha512-TdJqPHs2lW5J9Zpe17DZNQuDnox4xo2o+0tE7Pggain9Rbc19ik8kFtXdxZ250FVx2kF4vlt2RSf4qlUpG7bhw==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -4423,9 +4423,9 @@ packages: dependencies: debug: 4.3.4 enhanced-resolve: 5.12.0 - eslint: 8.39.0 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) + eslint: 8.40.0 + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) get-tsconfig: 4.5.0 globby: 13.1.3 is-core-module: 2.12.0 @@ -4438,7 +4438,7 @@ packages: - supports-color dev: true - /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0): + /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-j4GT+rqzCoRKHwURX7pddtIPGySnX9Si/cgMI5ztrcqOPtk5dDEeZ34CQVPphnqkJytlc97Vuk05Um2mJ3gEQA==} engines: {node: '>=4'} peerDependencies: @@ -4459,16 +4459,16 @@ packages: eslint-import-resolver-webpack: optional: true dependencies: - '@typescript-eslint/parser': 5.59.2(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) debug: 3.2.7 - eslint: 8.39.0 + eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.39.0) + eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0) transitivePeerDependencies: - supports-color dev: true - /eslint-plugin-flowtype@8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.39.0): + /eslint-plugin-flowtype@8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.40.0): resolution: {integrity: sha512-dX8l6qUL6O+fYPtpNRideCFSpmWOUVx5QcaGLVqe/vlDiBSe4vYljDWDETwnyFzpl7By/WVIu6rcrniCgH9BqQ==} engines: {node: '>=12.0.0'} peerDependencies: @@ -4478,12 +4478,12 @@ packages: dependencies: '@babel/plugin-syntax-flow': 7.21.4(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx': 7.21.0(@babel/core@7.21.4) - eslint: 8.39.0 + eslint: 8.40.0 lodash: 4.17.21 string-natural-compare: 3.0.1 dev: true - /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0): + /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-LmEt3GVofgiGuiE+ORpnvP+kAm3h6MLZJ4Q5HCyHADofsb4VzXFsRiWj3c0OFiV+3DWFh0qg3v9gcPlfc3zRow==} engines: {node: '>=4'} peerDependencies: @@ -4493,15 +4493,15 @@ packages: '@typescript-eslint/parser': optional: true dependencies: - '@typescript-eslint/parser': 5.59.2(eslint@8.39.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) array-includes: 3.1.6 array.prototype.flat: 1.3.1 array.prototype.flatmap: 1.3.1 debug: 3.2.7 doctrine: 2.1.0 - eslint: 8.39.0 + eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.39.0) + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) has: 1.0.3 is-core-module: 2.12.0 is-glob: 4.0.3 @@ -4516,7 +4516,7 @@ packages: - supports-color dev: true - /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.39.0)(typescript@5.0.4): + /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-PWLUEXeeF7C9QGKqvdSbzLOiLTx+bno7/HC9eefePfEb257QFHg7ye3dh80AZVkaa/RQsBB1Q/ORQvg2X7F0NQ==} engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0} peerDependencies: @@ -4529,15 +4529,15 @@ packages: jest: optional: true dependencies: - '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.39.0)(typescript@5.0.4) - '@typescript-eslint/experimental-utils': 5.58.0(eslint@8.39.0)(typescript@5.0.4) - eslint: 8.39.0 + '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/experimental-utils': 5.58.0(eslint@8.40.0)(typescript@5.0.4) + eslint: 8.40.0 transitivePeerDependencies: - supports-color - typescript dev: true - /eslint-plugin-jsx-a11y@6.7.1(eslint@8.39.0): + /eslint-plugin-jsx-a11y@6.7.1(eslint@8.40.0): resolution: {integrity: sha512-63Bog4iIethyo8smBklORknVjB0T2dwB8Mr/hIC+fBS0uyHdYYpzM/Ed+YC8VxTjlXHEWFOdmgwcDn1U2L9VCA==} engines: {node: '>=4.0'} peerDependencies: @@ -4552,7 +4552,7 @@ packages: axobject-query: 3.1.1 damerau-levenshtein: 1.0.8 emoji-regex: 9.2.2 - eslint: 8.39.0 + eslint: 8.40.0 has: 1.0.3 jsx-ast-utils: 3.3.3 language-tags: 1.0.5 @@ -4562,7 +4562,7 @@ packages: semver: 6.3.0 dev: true - /eslint-plugin-prettier@4.2.1(eslint-config-prettier@8.8.0)(eslint@8.39.0)(prettier@2.8.8): + /eslint-plugin-prettier@4.2.1(eslint-config-prettier@8.8.0)(eslint@8.40.0)(prettier@2.8.8): resolution: {integrity: sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==} engines: {node: '>=12.0.0'} peerDependencies: @@ -4573,22 +4573,22 @@ packages: eslint-config-prettier: optional: true dependencies: - eslint: 8.39.0 - eslint-config-prettier: 8.8.0(eslint@8.39.0) + eslint: 8.40.0 + eslint-config-prettier: 8.8.0(eslint@8.40.0) prettier: 2.8.8 prettier-linter-helpers: 1.0.0 dev: true - /eslint-plugin-react-hooks@4.6.0(eslint@8.39.0): + /eslint-plugin-react-hooks@4.6.0(eslint@8.40.0): resolution: {integrity: sha512-oFc7Itz9Qxh2x4gNHStv3BqJq54ExXmfC+a1NjAta66IAN87Wu0R/QArgIS9qKzX3dXKPI9H5crl9QchNMY9+g==} engines: {node: '>=10'} peerDependencies: eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 dependencies: - eslint: 8.39.0 + eslint: 8.40.0 dev: true - /eslint-plugin-react@7.32.2(eslint@8.39.0): + /eslint-plugin-react@7.32.2(eslint@8.40.0): resolution: {integrity: sha512-t2fBMa+XzonrrNkyVirzKlvn5RXzzPwRHtMvLAtVZrt8oxgnTQaYbU6SXTOO1mwQgp1y5+toMSKInnzGr0Knqg==} engines: {node: '>=4'} peerDependencies: @@ -4598,7 +4598,7 @@ packages: array.prototype.flatmap: 1.3.1 array.prototype.tosorted: 1.1.1 doctrine: 2.1.0 - eslint: 8.39.0 + eslint: 8.40.0 estraverse: 5.3.0 jsx-ast-utils: 3.3.3 minimatch: 3.1.2 @@ -4612,14 +4612,14 @@ packages: string.prototype.matchall: 4.0.8 dev: true - /eslint-plugin-testing-library@5.10.2(eslint@8.39.0)(typescript@5.0.4): + /eslint-plugin-testing-library@5.10.2(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-f1DmDWcz5SDM+IpCkEX0lbFqrrTs8HRsEElzDEqN/EBI0hpRj8Cns5+IVANXswE8/LeybIJqPAOQIFu2j5Y5sw==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0, npm: '>=6'} peerDependencies: eslint: ^7.5.0 || ^8.0.0 dependencies: - '@typescript-eslint/utils': 5.59.2(eslint@8.39.0)(typescript@5.0.4) - eslint: 8.39.0 + '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + eslint: 8.40.0 transitivePeerDependencies: - supports-color - typescript @@ -4646,20 +4646,20 @@ packages: engines: {node: '>=10'} dev: true - /eslint-visitor-keys@3.4.0: - resolution: {integrity: sha512-HPpKPUBQcAsZOsHAFwTtIKcYlCje62XB7SEAcxjtmW6TD1WVpkS6i6/hOVtTZIl4zGj/mBqpFVGvaDneik+VoQ==} + /eslint-visitor-keys@3.4.1: + resolution: {integrity: sha512-pZnmmLwYzf+kWaM/Qgrvpen51upAktaaiI01nsJD/Yr3lMOdNtq0cxkrrg16w64VtisN6okbs7Q8AfGqj4c9fA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true - /eslint@8.39.0: - resolution: {integrity: sha512-mwiok6cy7KTW7rBpo05k6+p4YVZByLNjAZ/ACB9DRCu4YDRwjXI01tWHp6KAUWelsBetTxKK/2sHB0vdS8Z2Og==} + /eslint@8.40.0: + resolution: {integrity: sha512-bvR+TsP9EHL3TqNtj9sCNJVAFK3fBN8Q7g5waghxyRsPLIMwL73XSKnZFK0hk/O2ANC+iAoq6PWMQ+IfBAJIiQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} hasBin: true dependencies: - '@eslint-community/eslint-utils': 4.4.0(eslint@8.39.0) + '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@eslint-community/regexpp': 4.5.0 - '@eslint/eslintrc': 2.0.2 - '@eslint/js': 8.39.0 + '@eslint/eslintrc': 2.0.3 + '@eslint/js': 8.40.0 '@humanwhocodes/config-array': 0.11.8 '@humanwhocodes/module-importer': 1.0.1 '@nodelib/fs.walk': 1.2.8 @@ -4670,8 +4670,8 @@ packages: doctrine: 3.0.0 escape-string-regexp: 4.0.0 eslint-scope: 7.2.0 - eslint-visitor-keys: 3.4.0 - espree: 9.5.1 + eslint-visitor-keys: 3.4.1 + espree: 9.5.2 esquery: 1.5.0 esutils: 2.0.3 fast-deep-equal: 3.1.3 @@ -4700,13 +4700,13 @@ packages: - supports-color dev: true - /espree@9.5.1: - resolution: {integrity: sha512-5yxtHSZXRSW5pvv3hAlXM5+/Oswi1AUFqBmbibKb5s6bp3rGIDkyXU6xCoyuuLhijr4SFwPrXRoZjz0AZDN9tg==} + /espree@9.5.2: + resolution: {integrity: sha512-7OASN1Wma5fum5SrNhFMAMJxOUAbhyfQ8dQ//PJaJbNw0URTPWqIghHWt1MmAANKhHZIYOHruW4Kw4ruUWOdGw==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: acorn: 8.8.2 acorn-jsx: 5.3.2(acorn@8.8.2) - eslint-visitor-keys: 3.4.0 + eslint-visitor-keys: 3.4.1 dev: true /esprima@4.0.1: @@ -7426,7 +7426,7 @@ packages: - terser dev: true - /vite-plugin-eslint@1.8.1(eslint@8.39.0)(vite@4.3.5): + /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.5): resolution: {integrity: sha512-PqdMf3Y2fLO9FsNPmMX+//2BF5SF8nEWspZdgl4kSt7UvHDRHVVfHvxsD7ULYzZrJDGRxR81Nq7TOFgwMnUang==} peerDependencies: eslint: '>=7' @@ -7434,7 +7434,7 @@ packages: dependencies: '@rollup/pluginutils': 4.2.1 '@types/eslint': 8.37.0 - eslint: 8.39.0 + eslint: 8.40.0 rollup: 2.79.1 vite: 4.3.5(@types/node@18.16.4) dev: true From c303cbe7ed292573d68c550ad9ab6660848ce31c Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 May 2023 09:24:29 +1000 Subject: [PATCH 05/67] build(deps): update dependency @types/node to v18.16.5 (#5394) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 70 +++++++++++++++++++++++----------------------- 2 files changed, 36 insertions(+), 36 deletions(-) diff --git a/web/package.json b/web/package.json index 10c774a49..5b63bccad 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "18.16.4", + "@types/node": "18.16.5", "@types/react": "18.2.5", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index fef205ae9..bb444e989 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 18.16.4 - version: 18.16.4 + specifier: 18.16.5 + version: 18.16.5 '@types/react': specifier: 18.2.5 version: 18.2.5 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.5 - version: 4.3.5(@types/node@18.16.4) + version: 4.3.5(@types/node@18.16.5) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.5) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 18.16.4 + '@types/node': 18.16.5 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@18.16.4)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@18.16.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@18.16.4)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@18.16.5)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2191,7 +2191,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 18.16.4 + '@types/node': 18.16.5 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2727,7 +2727,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 18.16.4 + '@types/node': 18.16.5 dev: true /@types/chai-subset@1.3.3: @@ -2743,7 +2743,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 18.16.4 + '@types/node': 18.16.5 dev: true /@types/eslint@8.37.0: @@ -2760,7 +2760,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 18.16.4 + '@types/node': 18.16.5 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2813,8 +2813,8 @@ packages: resolution: {integrity: sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ==} dev: true - /@types/node@18.16.4: - resolution: {integrity: sha512-LUhvPmAKAbgm+p/K11IWszLZVoZDlMF4NRmqbhEzDz/CnCuehPkZXwZbBCKGJsgjnuVejotBwM7B3Scrq4EqDw==} + /@types/node@18.16.5: + resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true /@types/normalize-package-data@2.4.1: @@ -2871,7 +2871,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 18.16.4 + '@types/node': 18.16.5 dev: true /@types/stack-utils@2.0.1: @@ -3113,7 +3113,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.5(@types/node@18.16.4) + vite: 4.3.5(@types/node@18.16.5) transitivePeerDependencies: - supports-color dev: true @@ -3734,7 +3734,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@18.16.4)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@18.16.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3743,9 +3743,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 18.16.4 + '@types/node': 18.16.5 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@18.16.4)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@18.16.5)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5638,7 +5638,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 18.16.4 + '@types/node': 18.16.5 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7188,7 +7188,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@18.16.4)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@18.16.5)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7207,7 +7207,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 18.16.4 + '@types/node': 18.16.5 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7405,7 +7405,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@18.16.4): + /vite-node@0.31.0(@types/node@18.16.5): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7415,7 +7415,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.5(@types/node@18.16.4) + vite: 4.3.5(@types/node@18.16.5) transitivePeerDependencies: - '@types/node' - less @@ -7436,7 +7436,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.5(@types/node@18.16.4) + vite: 4.3.5(@types/node@18.16.5) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.5): @@ -7448,7 +7448,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.5(@types/node@18.16.4) + vite: 4.3.5(@types/node@18.16.5) transitivePeerDependencies: - supports-color dev: true @@ -7461,7 +7461,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.5(@types/node@18.16.4) + vite: 4.3.5(@types/node@18.16.5) transitivePeerDependencies: - rollup - supports-color @@ -7478,13 +7478,13 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.5(@types/node@18.16.4) + vite: 4.3.5(@types/node@18.16.5) transitivePeerDependencies: - supports-color - typescript dev: true - /vite@3.2.5(@types/node@18.16.4): + /vite@3.2.5(@types/node@18.16.5): resolution: {integrity: sha512-4mVEpXpSOgrssFZAOmGIr85wPHKvaDAcXqxVxVRZhljkJOMZi1ibLibzjLHzJvcok8BMguLc7g1W6W/GqZbLdQ==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7509,7 +7509,7 @@ packages: terser: optional: true dependencies: - '@types/node': 18.16.4 + '@types/node': 18.16.5 esbuild: 0.15.18 postcss: 8.4.21 resolve: 1.22.2 @@ -7518,7 +7518,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.5(@types/node@18.16.4): + /vite@4.3.5(@types/node@18.16.5): resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7543,7 +7543,7 @@ packages: terser: optional: true dependencies: - '@types/node': 18.16.4 + '@types/node': 18.16.5 esbuild: 0.17.18 postcss: 8.4.23 rollup: 3.21.0 @@ -7556,10 +7556,10 @@ packages: hasBin: true dependencies: '@types/express': 4.17.17 - '@types/node': 18.16.4 + '@types/node': 18.16.5 '@vitest-preview/dev-utils': 0.0.1 express: 4.18.2 - vite: 3.2.5(@types/node@18.16.4) + vite: 3.2.5(@types/node@18.16.5) transitivePeerDependencies: - less - sass @@ -7602,7 +7602,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 18.16.4 + '@types/node': 18.16.5 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7623,8 +7623,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.5(@types/node@18.16.4) - vite-node: 0.31.0(@types/node@18.16.4) + vite: 4.3.5(@types/node@18.16.5) + vite-node: 0.31.0(@types/node@18.16.5) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 60cb20906c8d5ca711c53870c87087c136efc81d Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 May 2023 09:43:33 +1000 Subject: [PATCH 06/67] build(deps): update redis docker tag to v7 (#3260) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .../compose/redis-sentinel/docker-compose.yml | 12 ++++++------ .../suites/example/compose/redis/docker-compose.yml | 2 +- internal/suites/example/kube/storage/redis.yml | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/internal/suites/example/compose/redis-sentinel/docker-compose.yml b/internal/suites/example/compose/redis-sentinel/docker-compose.yml index 594753ddb..beb075492 100644 --- a/internal/suites/example/compose/redis-sentinel/docker-compose.yml +++ b/internal/suites/example/compose/redis-sentinel/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: redis-node-0: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh master expose: - "6379" @@ -16,7 +16,7 @@ services: - redis-node-0.example.com ipv4_address: 192.168.240.110 redis-node-1: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh slave depends_on: - redis-node-0 @@ -32,7 +32,7 @@ services: - redis-node-1.example.com ipv4_address: 192.168.240.111 redis-node-2: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh slave depends_on: - redis-node-0 @@ -48,7 +48,7 @@ services: - redis-node-2.example.com ipv4_address: 192.168.240.112 redis-sentinel-0: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh sentinel depends_on: - redis-node-1 @@ -64,7 +64,7 @@ services: - redis-sentinel-0.example.com ipv4_address: 192.168.240.120 redis-sentinel-1: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh sentinel depends_on: - redis-node-1 @@ -80,7 +80,7 @@ services: - redis-sentinel-1.example.com ipv4_address: 192.168.240.121 redis-sentinel-2: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh sentinel depends_on: - redis-node-1 diff --git a/internal/suites/example/compose/redis/docker-compose.yml b/internal/suites/example/compose/redis/docker-compose.yml index 68f0e869b..26659d778 100644 --- a/internal/suites/example/compose/redis/docker-compose.yml +++ b/internal/suites/example/compose/redis/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: redis: - image: redis:6.2-alpine + image: redis:7.0-alpine command: /entrypoint.sh master expose: - "6379" diff --git a/internal/suites/example/kube/storage/redis.yml b/internal/suites/example/kube/storage/redis.yml index 15c9b007f..8aeff3056 100644 --- a/internal/suites/example/kube/storage/redis.yml +++ b/internal/suites/example/kube/storage/redis.yml @@ -18,7 +18,7 @@ spec: spec: containers: - name: redis - image: redis:6.2-alpine + image: redis:7.0-alpine ports: - containerPort: 6379 readinessProbe: From 4c454ebc497d5d27b00007c2a7f119815fe3d8a3 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 May 2023 10:04:38 +1000 Subject: [PATCH 07/67] build(deps): update dependency @types/node to v20 (#5388) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 ++++++++++++++++++++++++---------------------- 2 files changed, 34 insertions(+), 30 deletions(-) diff --git a/web/package.json b/web/package.json index 5b63bccad..c3af8a873 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "18.16.5", + "@types/node": "20.1.0", "@types/react": "18.2.5", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index bb444e989..ac233b9b6 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 18.16.5 - version: 18.16.5 + specifier: 20.1.0 + version: 20.1.0 '@types/react': specifier: 18.2.5 version: 18.2.5 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.5 - version: 4.3.5(@types/node@18.16.5) + version: 4.3.5(@types/node@20.1.0) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.5) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 18.16.5 + '@types/node': 20.1.0 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@18.16.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@18.16.5)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.0)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2191,7 +2191,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 18.16.5 + '@types/node': 20.1.0 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2727,7 +2727,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 18.16.5 + '@types/node': 20.1.0 dev: true /@types/chai-subset@1.3.3: @@ -2743,7 +2743,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 18.16.5 + '@types/node': 20.1.0 dev: true /@types/eslint@8.37.0: @@ -2760,7 +2760,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 18.16.5 + '@types/node': 20.1.0 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2817,6 +2817,10 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true + /@types/node@20.1.0: + resolution: {integrity: sha512-O+z53uwx64xY7D6roOi4+jApDGFg0qn6WHcxe5QeqjMaTezBO/mxdfFXIVAVVyNWKx84OmPB3L8kbVYOTeN34A==} + dev: true + /@types/normalize-package-data@2.4.1: resolution: {integrity: sha512-Gj7cI7z+98M282Tqmp2K5EIsoouUEzbBJhQQzDE3jSIRk6r9gsz0oUokqIUR4u1R3dMHo0pDHM7sNOHyhulypw==} dev: true @@ -2871,7 +2875,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 18.16.5 + '@types/node': 20.1.0 dev: true /@types/stack-utils@2.0.1: @@ -3113,7 +3117,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.5(@types/node@18.16.5) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - supports-color dev: true @@ -3734,7 +3738,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@18.16.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3743,9 +3747,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 18.16.5 + '@types/node': 20.1.0 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@18.16.5)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.0)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5638,7 +5642,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 18.16.5 + '@types/node': 20.1.0 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7188,7 +7192,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@18.16.5)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.0)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7207,7 +7211,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 18.16.5 + '@types/node': 20.1.0 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7405,7 +7409,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@18.16.5): + /vite-node@0.31.0(@types/node@20.1.0): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7415,7 +7419,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.5(@types/node@18.16.5) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - '@types/node' - less @@ -7436,7 +7440,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.5(@types/node@18.16.5) + vite: 4.3.5(@types/node@20.1.0) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.5): @@ -7448,7 +7452,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.5(@types/node@18.16.5) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - supports-color dev: true @@ -7461,7 +7465,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.5(@types/node@18.16.5) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - rollup - supports-color @@ -7478,7 +7482,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.5(@types/node@18.16.5) + vite: 4.3.5(@types/node@20.1.0) transitivePeerDependencies: - supports-color - typescript @@ -7518,7 +7522,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.5(@types/node@18.16.5): + /vite@4.3.5(@types/node@20.1.0): resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7543,7 +7547,7 @@ packages: terser: optional: true dependencies: - '@types/node': 18.16.5 + '@types/node': 20.1.0 esbuild: 0.17.18 postcss: 8.4.23 rollup: 3.21.0 @@ -7602,7 +7606,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 18.16.5 + '@types/node': 20.1.0 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7623,8 +7627,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.5(@types/node@18.16.5) - vite-node: 0.31.0(@types/node@18.16.5) + vite: 4.3.5(@types/node@20.1.0) + vite-node: 0.31.0(@types/node@20.1.0) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 73861ff17a407eee32629db36514d7f3653caefb Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sat, 6 May 2023 13:02:04 +1000 Subject: [PATCH 08/67] build(deps): update module github.com/go-ldap/ldap/v3 to b50d289 (#5396) This fixes various issues. Fixes #4199 Signed-off-by: James Elliott --- go.mod | 4 ++-- go.sum | 22 +++++++++++++++------ internal/authentication/ldap_client_mock.go | 18 ++++------------- internal/authentication/types.go | 2 +- 4 files changed, 23 insertions(+), 23 deletions(-) diff --git a/go.mod b/go.mod index 85f0e1fad..2fdc809fa 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/fsnotify/fsnotify v1.6.0 github.com/go-asn1-ber/asn1-ber v1.5.4 github.com/go-crypt/crypt v0.2.7 - github.com/go-ldap/ldap/v3 v3.4.4 + github.com/go-ldap/ldap/v3 v3.4.5-0.20230505180221-b50d28961f34 github.com/go-rod/rod v0.112.9 github.com/go-sql-driver/mysql v1.7.1 github.com/go-webauthn/webauthn v0.5.0 @@ -54,7 +54,7 @@ require ( ) require ( - github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect + github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect github.com/andybalholm/brotli v1.0.5 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect diff --git a/go.sum b/go.sum index baee796e4..271547b49 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo= dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= -github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft7pkxDf6WoUvEZJ/uOKsvtpjLnn8MU= -github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= +github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8= +github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4 h1:vdT7QwBhJJEVNFMBNhRSFDRCB6O16T28VhvqRgqFyn8= @@ -45,6 +45,8 @@ github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4/go.mod h1:S github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= +github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA= +github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs= github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= @@ -136,8 +138,8 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= -github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs= -github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI= +github.com/go-ldap/ldap/v3 v3.4.5-0.20230505180221-b50d28961f34 h1:i1FTHy0QwBMfp9KOPU3RfiGU3Bir3qgN+vW4v8wrrbs= +github.com/go-ldap/ldap/v3 v3.4.5-0.20230505180221-b50d28961f34/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI= @@ -417,7 +419,6 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= @@ -482,7 +483,6 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A= golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= @@ -522,6 +522,7 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -562,6 +563,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= @@ -638,11 +641,15 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -654,6 +661,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -711,6 +720,7 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4= golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/internal/authentication/ldap_client_mock.go b/internal/authentication/ldap_client_mock.go index c58b602a2..5c996114d 100644 --- a/internal/authentication/ldap_client_mock.go +++ b/internal/authentication/ldap_client_mock.go @@ -65,9 +65,11 @@ func (mr *MockLDAPClientMockRecorder) Bind(arg0, arg1 interface{}) *gomock.Call } // Close mocks base method. -func (m *MockLDAPClient) Close() { +func (m *MockLDAPClient) Close() error { m.ctrl.T.Helper() - m.ctrl.Call(m, "Close") + ret := m.ctrl.Call(m, "Close") + ret0, _ := ret[0].(error) + return ret0 } // Close indicates an expected call of Close. @@ -334,18 +336,6 @@ func (mr *MockLDAPClientMockRecorder) SimpleBind(arg0 interface{}) *gomock.Call return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SimpleBind", reflect.TypeOf((*MockLDAPClient)(nil).SimpleBind), arg0) } -// Start mocks base method. -func (m *MockLDAPClient) Start() { - m.ctrl.T.Helper() - m.ctrl.Call(m, "Start") -} - -// Start indicates an expected call of Start. -func (mr *MockLDAPClientMockRecorder) Start() *gomock.Call { - mr.mock.ctrl.T.Helper() - return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Start", reflect.TypeOf((*MockLDAPClient)(nil).Start)) -} - // StartTLS mocks base method. func (m *MockLDAPClient) StartTLS(arg0 *tls.Config) error { m.ctrl.T.Helper() diff --git a/internal/authentication/types.go b/internal/authentication/types.go index 8e695fe00..df96dc3ad 100644 --- a/internal/authentication/types.go +++ b/internal/authentication/types.go @@ -18,7 +18,7 @@ type LDAPClientFactory interface { // // Methods added to this interface that have a direct correlation with one from ldap.Client should have the same signature. type LDAPClient interface { - Close() + Close() (err error) IsClosing() bool SetTimeout(timeout time.Duration) From 99398e796b0f41e850088db5ae0ee42ff3d66f4e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 7 May 2023 02:03:00 +1000 Subject: [PATCH 09/67] build(deps): update dependency @types/react to v18.2.6 (#5401) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 92 +++++++++++++++++++++++----------------------- 2 files changed, 47 insertions(+), 47 deletions(-) diff --git a/web/package.json b/web/package.json index c3af8a873..1b3cd2da9 100644 --- a/web/package.json +++ b/web/package.json @@ -72,7 +72,7 @@ "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", "@types/node": "20.1.0", - "@types/react": "18.2.5", + "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", "@types/zxcvbn": "4.4.1", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index ac233b9b6..1b6aa85e0 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -6,10 +6,10 @@ dependencies: version: 11.10.8 '@emotion/react': specifier: 11.10.8 - version: 11.10.8(@types/react@18.2.5)(react@18.2.0) + version: 11.10.8(@types/react@18.2.6)(react@18.2.0) '@emotion/styled': specifier: 11.10.8 - version: 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.5)(react@18.2.0) + version: 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) '@fortawesome/fontawesome-svg-core': specifier: 6.4.0 version: 6.4.0 @@ -24,13 +24,13 @@ dependencies: version: 0.2.0(@fortawesome/fontawesome-svg-core@6.4.0)(react@18.2.0) '@mui/icons-material': specifier: 5.11.16 - version: 5.11.16(@mui/material@5.12.3)(@types/react@18.2.5)(react@18.2.0) + version: 5.11.16(@mui/material@5.12.3)(@types/react@18.2.6)(react@18.2.0) '@mui/material': specifier: 5.12.3 - version: 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.5)(react-dom@18.2.0)(react@18.2.0) + version: 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/styles': specifier: 5.12.3 - version: 5.12.3(@types/react@18.2.5)(react@18.2.0) + version: 5.12.3(@types/react@18.2.6)(react@18.2.0) axios: specifier: 1.4.0 version: 1.4.0 @@ -94,8 +94,8 @@ devDependencies: specifier: 20.1.0 version: 20.1.0 '@types/react': - specifier: 18.2.5 - version: 18.2.5 + specifier: 18.2.6 + version: 18.2.6 '@types/react-dom': specifier: 18.2.4 version: 18.2.4 @@ -1764,7 +1764,7 @@ packages: resolution: {integrity: sha512-G/YwXTkv7Den9mXDO7AhLWkE3q+I92B+VqAE+dYG4NGPaHZGvt3G8Q0p9vmE+sq7rTGphUbAvmQ9YpbfMQGGlA==} dev: false - /@emotion/react@11.10.8(@types/react@18.2.5)(react@18.2.0): + /@emotion/react@11.10.8(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-ZfGfiABtJ1P1OXqOBsW08EgCDp5fK6C5I8hUJauc/VcJBGSzqAirMnFslhFWnZJ/w5HxPI36XbvMV0l4KZHl+w==} peerDependencies: '@types/react': '*' @@ -1780,7 +1780,7 @@ packages: '@emotion/use-insertion-effect-with-fallbacks': 1.0.0(react@18.2.0) '@emotion/utils': 1.2.0 '@emotion/weak-memoize': 0.3.0 - '@types/react': 18.2.5 + '@types/react': 18.2.6 hoist-non-react-statics: 3.3.2 react: 18.2.0 dev: false @@ -1799,7 +1799,7 @@ packages: resolution: {integrity: sha512-zxRBwl93sHMsOj4zs+OslQKg/uhF38MB+OMKoCrVuS0nyTkqnau+BM3WGEoOptg9Oz45T/aIGs1qbVAsEFo3nA==} dev: false - /@emotion/styled@11.10.8(@emotion/react@11.10.8)(@types/react@18.2.5)(react@18.2.0): + /@emotion/styled@11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-gow0lF4Uw/QEdX2REMhI8v6wLOabPKJ+4HKNF0xdJ2DJdznN6fxaXpQOx6sNkyBhSUL558Rmcu1Lq/MYlVo4vw==} peerDependencies: '@emotion/react': ^11.0.0-rc.0 @@ -1812,11 +1812,11 @@ packages: '@babel/runtime': 7.21.0 '@emotion/babel-plugin': 11.10.8 '@emotion/is-prop-valid': 1.2.0 - '@emotion/react': 11.10.8(@types/react@18.2.5)(react@18.2.0) + '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) '@emotion/serialize': 1.1.1 '@emotion/use-insertion-effect-with-fallbacks': 1.0.0(react@18.2.0) '@emotion/utils': 1.2.0 - '@types/react': 18.2.5 + '@types/react': 18.2.6 react: 18.2.0 dev: false @@ -2255,7 +2255,7 @@ packages: tsconfig-paths: 3.14.2 dev: true - /@mui/base@5.0.0-alpha.128(@types/react@18.2.5)(react-dom@18.2.0)(react@18.2.0): + /@mui/base@5.0.0-alpha.128(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): resolution: {integrity: sha512-wub3wxNN+hUp8hzilMlXX3sZrPo75vsy1cXEQpqdTfIFlE9HprP1jlulFiPg5tfPst2OKmygXr2hhmgvAKRrzQ==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2268,10 +2268,10 @@ packages: dependencies: '@babel/runtime': 7.21.0 '@emotion/is-prop-valid': 1.2.0 - '@mui/types': 7.2.4(@types/react@18.2.5) + '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) '@popperjs/core': 2.11.7 - '@types/react': 18.2.5 + '@types/react': 18.2.6 clsx: 1.2.1 prop-types: 15.8.1 react: 18.2.0 @@ -2283,7 +2283,7 @@ packages: resolution: {integrity: sha512-yiJZ+knaknPHuRKhRk4L6XiwppwkAahVal3LuYpvBH7GkA2g+D9WLEXOEnNYtVFUggyKf6fWGLGnx0iqzkU5YA==} dev: false - /@mui/icons-material@5.11.16(@mui/material@5.12.3)(@types/react@18.2.5)(react@18.2.0): + /@mui/icons-material@5.11.16(@mui/material@5.12.3)(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-oKkx9z9Kwg40NtcIajF9uOXhxiyTZrrm9nmIJ4UjkU2IdHpd4QVLbCc/5hZN/y0C6qzi2Zlxyr9TGddQx2vx2A==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2295,12 +2295,12 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@mui/material': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.5)(react-dom@18.2.0)(react@18.2.0) - '@types/react': 18.2.5 + '@mui/material': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@types/react': 18.2.6 react: 18.2.0 dev: false - /@mui/material@5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.5)(react-dom@18.2.0)(react@18.2.0): + /@mui/material@5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): resolution: {integrity: sha512-xNmKlrEN4HsTaKFNLZfc7ie7CXx2YqEeO//hsXZx2p3MGtDdeMr2sV3jC4hsFs57RhQlF79weY7uVvC8xSuVbg==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2318,14 +2318,14 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/react': 11.10.8(@types/react@18.2.5)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.5)(react@18.2.0) - '@mui/base': 5.0.0-alpha.128(@types/react@18.2.5)(react-dom@18.2.0)(react@18.2.0) + '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) + '@mui/base': 5.0.0-alpha.128(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/core-downloads-tracker': 5.12.3 - '@mui/system': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.5)(react@18.2.0) - '@mui/types': 7.2.4(@types/react@18.2.5) + '@mui/system': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react@18.2.0) + '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) - '@types/react': 18.2.5 + '@types/react': 18.2.6 '@types/react-transition-group': 4.4.5 clsx: 1.2.1 csstype: 3.1.2 @@ -2336,7 +2336,7 @@ packages: react-transition-group: 4.4.5(react-dom@18.2.0)(react@18.2.0) dev: false - /@mui/private-theming@5.12.3(@types/react@18.2.5)(react@18.2.0): + /@mui/private-theming@5.12.3(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-o1e7Z1Bp27n4x2iUHhegV4/Jp6H3T6iBKHJdLivS5GbwsuAE/5l4SnZ+7+K+e5u9TuhwcAKZLkjvqzkDe8zqfA==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2348,7 +2348,7 @@ packages: dependencies: '@babel/runtime': 7.21.0 '@mui/utils': 5.12.3(react@18.2.0) - '@types/react': 18.2.5 + '@types/react': 18.2.6 prop-types: 15.8.1 react: 18.2.0 dev: false @@ -2368,14 +2368,14 @@ packages: dependencies: '@babel/runtime': 7.21.0 '@emotion/cache': 11.10.8 - '@emotion/react': 11.10.8(@types/react@18.2.5)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.5)(react@18.2.0) + '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) csstype: 3.1.2 prop-types: 15.8.1 react: 18.2.0 dev: false - /@mui/styles@5.12.3(@types/react@18.2.5)(react@18.2.0): + /@mui/styles@5.12.3(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-y0GN1kTYO2FF/0LH8a0PpVxwLotlcunFqdJpCL5gza0w5Fqz9wxlwauPZW0bDt0+sF79CrohzdzWkh+fxB+oww==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2387,10 +2387,10 @@ packages: dependencies: '@babel/runtime': 7.21.0 '@emotion/hash': 0.9.0 - '@mui/private-theming': 5.12.3(@types/react@18.2.5)(react@18.2.0) - '@mui/types': 7.2.4(@types/react@18.2.5) + '@mui/private-theming': 5.12.3(@types/react@18.2.6)(react@18.2.0) + '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) - '@types/react': 18.2.5 + '@types/react': 18.2.6 clsx: 1.2.1 csstype: 3.1.2 hoist-non-react-statics: 3.3.2 @@ -2406,7 +2406,7 @@ packages: react: 18.2.0 dev: false - /@mui/system@5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.5)(react@18.2.0): + /@mui/system@5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-JB/6sypHqeJCqwldWeQ1MKkijH829EcZAKKizxbU2MJdxGG5KSwZvTBa5D9qiJUA1hJFYYupjiuy9ZdJt6rV6w==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2423,20 +2423,20 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/react': 11.10.8(@types/react@18.2.5)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.5)(react@18.2.0) - '@mui/private-theming': 5.12.3(@types/react@18.2.5)(react@18.2.0) + '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) + '@mui/private-theming': 5.12.3(@types/react@18.2.6)(react@18.2.0) '@mui/styled-engine': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(react@18.2.0) - '@mui/types': 7.2.4(@types/react@18.2.5) + '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) - '@types/react': 18.2.5 + '@types/react': 18.2.6 clsx: 1.2.1 csstype: 3.1.2 prop-types: 15.8.1 react: 18.2.0 dev: false - /@mui/types@7.2.4(@types/react@18.2.5): + /@mui/types@7.2.4(@types/react@18.2.6): resolution: {integrity: sha512-LBcwa8rN84bKF+f5sDyku42w1NTxaPgPyYKODsh01U1fVstTClbUoSA96oyRBnSNyEiAVjKm6Gwx9vjR+xyqHA==} peerDependencies: '@types/react': '*' @@ -2444,7 +2444,7 @@ packages: '@types/react': optional: true dependencies: - '@types/react': 18.2.5 + '@types/react': 18.2.6 dev: false /@mui/utils@5.12.3(react@18.2.0): @@ -2842,23 +2842,23 @@ packages: /@types/react-dom@18.2.4: resolution: {integrity: sha512-G2mHoTMTL4yoydITgOGwWdWMVd8sNgyEP85xVmMKAPUBwQWm9wBPQUmvbeF4V3WBY1P7mmL4BkjQ0SqUpf1snw==} dependencies: - '@types/react': 18.2.5 + '@types/react': 18.2.6 dev: true /@types/react-is@17.0.3: resolution: {integrity: sha512-aBTIWg1emtu95bLTLx0cpkxwGW3ueZv71nE2YFBpL8k/z5czEW8yYpOo8Dp+UUAFAtKwNaOsh/ioSeQnWlZcfw==} dependencies: - '@types/react': 18.2.5 + '@types/react': 18.2.6 dev: false /@types/react-transition-group@4.4.5: resolution: {integrity: sha512-juKD/eiSM3/xZYzjuzH6ZwpP+/lejltmiS3QEzV/vmb/Q8+HfDmxu+Baga8UEMGBqV88Nbg4l2hY/K2DkyaLLA==} dependencies: - '@types/react': 18.2.5 + '@types/react': 18.2.6 dev: false - /@types/react@18.2.5: - resolution: {integrity: sha512-RuoMedzJ5AOh23Dvws13LU9jpZHIc/k90AgmK7CecAYeWmSr3553L4u5rk4sWAPBuQosfT7HmTfG4Rg5o4nGEA==} + /@types/react@18.2.6: + resolution: {integrity: sha512-wRZClXn//zxCFW+ye/D2qY65UsYP1Fpex2YXorHc8awoNamkMZSvBxwxdYVInsHOZZd2Ppq8isnSzJL5Mpf8OA==} dependencies: '@types/prop-types': 15.7.5 '@types/scheduler': 0.16.3 From 809940c6e58ef0b38988fca4486cf427e531c96c Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 7 May 2023 02:14:22 +1000 Subject: [PATCH 10/67] build(deps): update github.com/go-ldap/ldap/v3 digest to 039466e (#5400) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2fdc809fa..c3ae71364 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/fsnotify/fsnotify v1.6.0 github.com/go-asn1-ber/asn1-ber v1.5.4 github.com/go-crypt/crypt v0.2.7 - github.com/go-ldap/ldap/v3 v3.4.5-0.20230505180221-b50d28961f34 + github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 github.com/go-rod/rod v0.112.9 github.com/go-sql-driver/mysql v1.7.1 github.com/go-webauthn/webauthn v0.5.0 diff --git a/go.sum b/go.sum index 271547b49..ed5889579 100644 --- a/go.sum +++ b/go.sum @@ -138,8 +138,8 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= -github.com/go-ldap/ldap/v3 v3.4.5-0.20230505180221-b50d28961f34 h1:i1FTHy0QwBMfp9KOPU3RfiGU3Bir3qgN+vW4v8wrrbs= -github.com/go-ldap/ldap/v3 v3.4.5-0.20230505180221-b50d28961f34/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs= +github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 h1:XgBmN9yZXIh9vJGzs2qYPb5ee8/VnOWLHHYcKXGXKME= +github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI= From 358d5332f7f10c69220482772f177b57c5d87427 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 7 May 2023 05:14:31 +1000 Subject: [PATCH 11/67] build(deps): update emotion monorepo to v11.11.0 (#5402) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 6 +- web/pnpm-lock.yaml | 150 +++++++++++++++++++++++---------------------- 2 files changed, 80 insertions(+), 76 deletions(-) diff --git a/web/package.json b/web/package.json index 1b3cd2da9..e7133e5e3 100644 --- a/web/package.json +++ b/web/package.json @@ -11,9 +11,9 @@ } }, "dependencies": { - "@emotion/cache": "11.10.8", - "@emotion/react": "11.10.8", - "@emotion/styled": "11.10.8", + "@emotion/cache": "11.11.0", + "@emotion/react": "11.11.0", + "@emotion/styled": "11.11.0", "@fortawesome/fontawesome-svg-core": "6.4.0", "@fortawesome/free-regular-svg-icons": "6.4.0", "@fortawesome/free-solid-svg-icons": "6.4.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 1b6aa85e0..c43e90f34 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -2,14 +2,14 @@ lockfileVersion: '6.0' dependencies: '@emotion/cache': - specifier: 11.10.8 - version: 11.10.8 + specifier: 11.11.0 + version: 11.11.0 '@emotion/react': - specifier: 11.10.8 - version: 11.10.8(@types/react@18.2.6)(react@18.2.0) + specifier: 11.11.0 + version: 11.11.0(@types/react@18.2.6)(react@18.2.0) '@emotion/styled': - specifier: 11.10.8 - version: 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) + specifier: 11.11.0 + version: 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) '@fortawesome/fontawesome-svg-core': specifier: 6.4.0 version: 6.4.0 @@ -27,7 +27,7 @@ dependencies: version: 5.11.16(@mui/material@5.12.3)(@types/react@18.2.6)(react@18.2.0) '@mui/material': specifier: 5.12.3 - version: 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + version: 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/styles': specifier: 5.12.3 version: 5.12.3(@types/react@18.2.6)(react@18.2.0) @@ -1724,48 +1724,52 @@ packages: '@jridgewell/trace-mapping': 0.3.9 dev: true - /@emotion/babel-plugin@11.10.8: - resolution: {integrity: sha512-gxNky50AJL3AlkbjvTARiwAqei6/tNUxDZPSKd+3jqWVM3AmdVTTdpjHorR/an/M0VJqdsuq5oGcFH+rjtyujQ==} + /@emotion/babel-plugin@11.11.0: + resolution: {integrity: sha512-m4HEDZleaaCH+XgDDsPF15Ht6wTLsgDTeR3WYj9Q/k76JtWhrJjcP4+/XlG8LGT/Rol9qUfOIztXeA84ATpqPQ==} dependencies: '@babel/helper-module-imports': 7.21.4 '@babel/runtime': 7.21.0 - '@emotion/hash': 0.9.0 - '@emotion/memoize': 0.8.0 - '@emotion/serialize': 1.1.1 + '@emotion/hash': 0.9.1 + '@emotion/memoize': 0.8.1 + '@emotion/serialize': 1.1.2 babel-plugin-macros: 3.1.0 convert-source-map: 1.9.0 escape-string-regexp: 4.0.0 find-root: 1.1.0 source-map: 0.5.7 - stylis: 4.1.4 + stylis: 4.2.0 dev: false - /@emotion/cache@11.10.8: - resolution: {integrity: sha512-5fyqGHi51LU95o7qQ/vD1jyvC4uCY5GcBT+UgP4LHdpO9jPDlXqhrRr9/wCKmfoAvh5G/F7aOh4MwQa+8uEqhA==} + /@emotion/cache@11.11.0: + resolution: {integrity: sha512-P34z9ssTCBi3e9EI1ZsWpNHcfY1r09ZO0rZbRO2ob3ZQMnFI35jB536qoXbkdesr5EUhYi22anuEJuyxifaqAQ==} dependencies: - '@emotion/memoize': 0.8.0 - '@emotion/sheet': 1.2.1 - '@emotion/utils': 1.2.0 - '@emotion/weak-memoize': 0.3.0 - stylis: 4.1.4 + '@emotion/memoize': 0.8.1 + '@emotion/sheet': 1.2.2 + '@emotion/utils': 1.2.1 + '@emotion/weak-memoize': 0.3.1 + stylis: 4.2.0 dev: false /@emotion/hash@0.9.0: resolution: {integrity: sha512-14FtKiHhy2QoPIzdTcvh//8OyBlknNs2nXRwIhG904opCby3l+9Xaf/wuPvICBF0rc1ZCNBd3nKe9cd2mecVkQ==} dev: false - /@emotion/is-prop-valid@1.2.0: - resolution: {integrity: sha512-3aDpDprjM0AwaxGE09bOPkNxHpBd+kA6jty3RnaEXdweX1DF1U3VQpPYb0g1IStAuK7SVQ1cy+bNBBKp4W3Fjg==} + /@emotion/hash@0.9.1: + resolution: {integrity: sha512-gJB6HLm5rYwSLI6PQa+X1t5CFGrv1J1TWG+sOyMCeKz2ojaj6Fnl/rZEspogG+cvqbt4AE/2eIyD2QfLKTBNlQ==} + dev: false + + /@emotion/is-prop-valid@1.2.1: + resolution: {integrity: sha512-61Mf7Ufx4aDxx1xlDeOm8aFFigGHE4z+0sKCa+IHCeZKiyP9RLD0Mmx7m8b9/Cf37f7NAvQOOJAbQQGVr5uERw==} dependencies: - '@emotion/memoize': 0.8.0 + '@emotion/memoize': 0.8.1 dev: false - /@emotion/memoize@0.8.0: - resolution: {integrity: sha512-G/YwXTkv7Den9mXDO7AhLWkE3q+I92B+VqAE+dYG4NGPaHZGvt3G8Q0p9vmE+sq7rTGphUbAvmQ9YpbfMQGGlA==} + /@emotion/memoize@0.8.1: + resolution: {integrity: sha512-W2P2c/VRW1/1tLox0mVUalvnWXxavmv/Oum2aPsRcoDJuob75FC3Y8FbpfLwUegRcxINtGUMPq0tFCvYNTBXNA==} dev: false - /@emotion/react@11.10.8(@types/react@18.2.6)(react@18.2.0): - resolution: {integrity: sha512-ZfGfiABtJ1P1OXqOBsW08EgCDp5fK6C5I8hUJauc/VcJBGSzqAirMnFslhFWnZJ/w5HxPI36XbvMV0l4KZHl+w==} + /@emotion/react@11.11.0(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-ZSK3ZJsNkwfjT3JpDAWJZlrGD81Z3ytNDsxw1LKq1o+xkmO5pnWfr6gmCC8gHEFf3nSSX/09YrG67jybNPxSUw==} peerDependencies: '@types/react': '*' react: '>=16.8.0 || 18' @@ -1774,33 +1778,33 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/babel-plugin': 11.10.8 - '@emotion/cache': 11.10.8 - '@emotion/serialize': 1.1.1 - '@emotion/use-insertion-effect-with-fallbacks': 1.0.0(react@18.2.0) - '@emotion/utils': 1.2.0 - '@emotion/weak-memoize': 0.3.0 + '@emotion/babel-plugin': 11.11.0 + '@emotion/cache': 11.11.0 + '@emotion/serialize': 1.1.2 + '@emotion/use-insertion-effect-with-fallbacks': 1.0.1(react@18.2.0) + '@emotion/utils': 1.2.1 + '@emotion/weak-memoize': 0.3.1 '@types/react': 18.2.6 hoist-non-react-statics: 3.3.2 react: 18.2.0 dev: false - /@emotion/serialize@1.1.1: - resolution: {integrity: sha512-Zl/0LFggN7+L1liljxXdsVSVlg6E/Z/olVWpfxUTxOAmi8NU7YoeWeLfi1RmnB2TATHoaWwIBRoL+FvAJiTUQA==} + /@emotion/serialize@1.1.2: + resolution: {integrity: sha512-zR6a/fkFP4EAcCMQtLOhIgpprZOwNmCldtpaISpvz348+DP4Mz8ZoKaGGCQpbzepNIUWbq4w6hNZkwDyKoS+HA==} dependencies: - '@emotion/hash': 0.9.0 - '@emotion/memoize': 0.8.0 - '@emotion/unitless': 0.8.0 - '@emotion/utils': 1.2.0 + '@emotion/hash': 0.9.1 + '@emotion/memoize': 0.8.1 + '@emotion/unitless': 0.8.1 + '@emotion/utils': 1.2.1 csstype: 3.1.2 dev: false - /@emotion/sheet@1.2.1: - resolution: {integrity: sha512-zxRBwl93sHMsOj4zs+OslQKg/uhF38MB+OMKoCrVuS0nyTkqnau+BM3WGEoOptg9Oz45T/aIGs1qbVAsEFo3nA==} + /@emotion/sheet@1.2.2: + resolution: {integrity: sha512-0QBtGvaqtWi+nx6doRwDdBIzhNdZrXUppvTM4dtZZWEGTXL/XE/yJxLMGlDT1Gt+UHH5IX1n+jkXyytE/av7OA==} dev: false - /@emotion/styled@11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0): - resolution: {integrity: sha512-gow0lF4Uw/QEdX2REMhI8v6wLOabPKJ+4HKNF0xdJ2DJdznN6fxaXpQOx6sNkyBhSUL558Rmcu1Lq/MYlVo4vw==} + /@emotion/styled@11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-hM5Nnvu9P3midq5aaXj4I+lnSfNi7Pmd4EWk1fOZ3pxookaQTNew6bp4JaCBYM4HVFZF9g7UjJmsUmC2JlxOng==} peerDependencies: '@emotion/react': ^11.0.0-rc.0 '@types/react': '*' @@ -1810,34 +1814,34 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/babel-plugin': 11.10.8 - '@emotion/is-prop-valid': 1.2.0 - '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) - '@emotion/serialize': 1.1.1 - '@emotion/use-insertion-effect-with-fallbacks': 1.0.0(react@18.2.0) - '@emotion/utils': 1.2.0 + '@emotion/babel-plugin': 11.11.0 + '@emotion/is-prop-valid': 1.2.1 + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/serialize': 1.1.2 + '@emotion/use-insertion-effect-with-fallbacks': 1.0.1(react@18.2.0) + '@emotion/utils': 1.2.1 '@types/react': 18.2.6 react: 18.2.0 dev: false - /@emotion/unitless@0.8.0: - resolution: {integrity: sha512-VINS5vEYAscRl2ZUDiT3uMPlrFQupiKgHz5AA4bCH1miKBg4qtwkim1qPmJj/4WG6TreYMY111rEFsjupcOKHw==} + /@emotion/unitless@0.8.1: + resolution: {integrity: sha512-KOEGMu6dmJZtpadb476IsZBclKvILjopjUii3V+7MnXIQCYh8W3NgNcgwo21n9LXZX6EDIKvqfjYxXebDwxKmQ==} dev: false - /@emotion/use-insertion-effect-with-fallbacks@1.0.0(react@18.2.0): - resolution: {integrity: sha512-1eEgUGmkaljiBnRMTdksDV1W4kUnmwgp7X9G8B++9GYwl1lUdqSndSriIrTJ0N7LQaoauY9JJ2yhiOYK5+NI4A==} + /@emotion/use-insertion-effect-with-fallbacks@1.0.1(react@18.2.0): + resolution: {integrity: sha512-jT/qyKZ9rzLErtrjGgdkMBn2OP8wl0G3sQlBb3YPryvKHsjvINUhVaPFfP+fpBcOkmrVOVEEHQFJ7nbj2TH2gw==} peerDependencies: react: '>=16.8.0 || 18' dependencies: react: 18.2.0 dev: false - /@emotion/utils@1.2.0: - resolution: {integrity: sha512-sn3WH53Kzpw8oQ5mgMmIzzyAaH2ZqFEbozVVBSYp538E06OSE6ytOp7pRAjNQR+Q/orwqdQYJSe2m3hCOeznkw==} + /@emotion/utils@1.2.1: + resolution: {integrity: sha512-Y2tGf3I+XVnajdItskUCn6LX+VUDmP6lTL4fcqsXAv43dnlbZiuW4MWQW38rW/BVWSE7Q/7+XQocmpnRYILUmg==} dev: false - /@emotion/weak-memoize@0.3.0: - resolution: {integrity: sha512-AHPmaAx+RYfZz0eYu6Gviiagpmiyw98ySSlQvCUhVGDRtDFe4DBS0x1bSjdF3gqUDYOczB+yYvBTtEylYSdRhg==} + /@emotion/weak-memoize@0.3.1: + resolution: {integrity: sha512-EsBwpc7hBUJWAsNPBmJy4hxWx12v6bshQsldrVmjxJoc3isbxhOrF2IcCpaXxfvq03NwkI7sbsOLXbYuqF/8Ww==} dev: false /@esbuild/android-arm64@0.17.18: @@ -2267,7 +2271,7 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/is-prop-valid': 1.2.0 + '@emotion/is-prop-valid': 1.2.1 '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) '@popperjs/core': 2.11.7 @@ -2295,12 +2299,12 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@mui/material': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@mui/material': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@types/react': 18.2.6 react: 18.2.0 dev: false - /@mui/material@5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): + /@mui/material@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): resolution: {integrity: sha512-xNmKlrEN4HsTaKFNLZfc7ie7CXx2YqEeO//hsXZx2p3MGtDdeMr2sV3jC4hsFs57RhQlF79weY7uVvC8xSuVbg==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2318,11 +2322,11 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) '@mui/base': 5.0.0-alpha.128(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/core-downloads-tracker': 5.12.3 - '@mui/system': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react@18.2.0) + '@mui/system': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0) '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) '@types/react': 18.2.6 @@ -2353,7 +2357,7 @@ packages: react: 18.2.0 dev: false - /@mui/styled-engine@5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(react@18.2.0): + /@mui/styled-engine@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(react@18.2.0): resolution: {integrity: sha512-AhZtiRyT8Bjr7fufxE/mLS+QJ3LxwX1kghIcM2B2dvJzSSg9rnIuXDXM959QfUVIM3C8U4x3mgVoPFMQJvc4/g==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2367,9 +2371,9 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/cache': 11.10.8 - '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) + '@emotion/cache': 11.11.0 + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) csstype: 3.1.2 prop-types: 15.8.1 react: 18.2.0 @@ -2406,7 +2410,7 @@ packages: react: 18.2.0 dev: false - /@mui/system@5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(@types/react@18.2.6)(react@18.2.0): + /@mui/system@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-JB/6sypHqeJCqwldWeQ1MKkijH829EcZAKKizxbU2MJdxGG5KSwZvTBa5D9qiJUA1hJFYYupjiuy9ZdJt6rV6w==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2423,10 +2427,10 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/react': 11.10.8(@types/react@18.2.6)(react@18.2.0) - '@emotion/styled': 11.10.8(@emotion/react@11.10.8)(@types/react@18.2.6)(react@18.2.0) + '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) + '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) '@mui/private-theming': 5.12.3(@types/react@18.2.6)(react@18.2.0) - '@mui/styled-engine': 5.12.3(@emotion/react@11.10.8)(@emotion/styled@11.10.8)(react@18.2.0) + '@mui/styled-engine': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(react@18.2.0) '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) '@types/react': 18.2.6 @@ -7071,8 +7075,8 @@ packages: acorn: 8.8.2 dev: true - /stylis@4.1.4: - resolution: {integrity: sha512-USf5pszRYwuE6hg9by0OkKChkQYEXfkeTtm0xKw+jqQhwyjCVLdYyMBK7R+n7dhzsblAWJnGxju4vxq5eH20GQ==} + /stylis@4.2.0: + resolution: {integrity: sha512-Orov6g6BB1sDfYgzWfTHDOxamtX1bE/zo104Dh9e6fqJ3PooipYyfJ0pUmrZO2wAvO8YbEyeFrkV91XTsGMSrw==} dev: false /supports-color@5.5.0: From 90d190121d538318ca2b1358f77b890a1cbe1b9d Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sun, 7 May 2023 15:48:26 +1000 Subject: [PATCH 12/67] feat(server): listen on unix sockets (#5038) This allows listening on unix sockets. Signed-off-by: James Elliott --- cmd/authelia-gen/helpers.go | 4 + config.template.yml | 7 +- .../first-factor/introduction.md | 3 + .../en/configuration/first-factor/ldap.md | 3 + .../identity-providers/open-id-connect.md | 19 +- .../en/configuration/miscellaneous/ntp.md | 4 +- .../en/configuration/miscellaneous/server.md | 31 +- .../en/configuration/notifications/smtp.md | 3 + .../en/configuration/prologue/common.md | 149 +++-- .../configuration/second-factor/webauthn.md | 4 +- .../en/configuration/security/regulation.md | 8 +- .../en/configuration/session/introduction.md | 24 +- .../content/en/configuration/storage/mysql.md | 3 + .../en/configuration/storage/postgres.md | 3 + .../en/configuration/telemetry/metrics.md | 18 +- docs/data/configkeys.json | 2 +- internal/configuration/config.template.yml | 7 +- internal/configuration/decode_hooks.go | 97 ++- internal/configuration/decode_hooks_test.go | 4 +- internal/configuration/deprecation.go | 45 +- internal/configuration/helpers.go | 8 + internal/configuration/koanf_util.go | 17 +- internal/configuration/provider_test.go | 4 +- internal/configuration/schema/const.go | 19 +- internal/configuration/schema/keys.go | 3 + internal/configuration/schema/server.go | 15 +- internal/configuration/schema/telemetry.go | 9 +- internal/configuration/schema/types.go | 387 ++++++++++-- internal/configuration/schema/types_test.go | 588 +++++++++++++++++- internal/configuration/template_test.go | 2 +- .../test_resources/config.filtered.yml | 3 +- .../configuration/test_resources/config.yml | 3 +- .../test_resources/config_alt.yml | 3 +- .../test_resources/config_bad_keys.yml | 3 +- .../test_resources/config_bad_quoting.yml | 3 +- .../config_domain_bad_regex.yml | 3 +- .../test_resources/config_domain_regex.yml | 3 +- .../test_resources/config_oidc.yml | 3 +- .../config_smtp_sender_blank.yml | 3 +- .../config_smtp_sender_invalid.yml | 3 +- .../test_resources/config_with_secret.yml | 3 +- .../validator/configuration_test.go | 3 +- internal/configuration/validator/const.go | 18 +- .../configuration/validator/const_test.go | 4 + internal/configuration/validator/server.go | 71 ++- .../configuration/validator/server_test.go | 115 +++- internal/configuration/validator/telemetry.go | 11 +- .../configuration/validator/telemetry_test.go | 70 ++- internal/server/server.go | 41 +- internal/server/server_test.go | 5 + .../suites/ActiveDirectory/configuration.yml | 2 +- internal/suites/BypassAll/configuration.yml | 2 +- internal/suites/CLI/configuration.yml | 2 +- internal/suites/Caddy/configuration.yml | 2 +- internal/suites/Docker/configuration.yml | 2 +- internal/suites/DuoPush/configuration.yml | 2 +- internal/suites/Envoy/configuration.yml | 2 +- internal/suites/HAProxy/configuration.yml | 2 +- .../suites/HighAvailability/configuration.yml | 2 +- internal/suites/LDAP/configuration.yml | 2 +- internal/suites/MariaDB/configuration.yml | 2 +- .../MultiCookieDomain/configuration.yml | 2 +- internal/suites/MySQL/configuration.yml | 2 +- internal/suites/NetworkACL/configuration.yml | 2 +- internal/suites/OIDC/configuration.yml | 2 +- internal/suites/OIDCTraefik/configuration.yml | 2 +- .../suites/OneFactorOnly/configuration.yml | 2 +- internal/suites/PathPrefix/configuration.yml | 2 +- internal/suites/Postgres/configuration.yml | 2 +- .../suites/ShortTimeouts/configuration.yml | 2 +- internal/suites/Standalone/configuration.yml | 2 +- internal/suites/Traefik/configuration.yml | 2 +- internal/suites/Traefik2/configuration.yml | 2 +- 73 files changed, 1594 insertions(+), 313 deletions(-) diff --git a/cmd/authelia-gen/helpers.go b/cmd/authelia-gen/helpers.go index a587b18a5..c244ad06b 100644 --- a/cmd/authelia-gen/helpers.go +++ b/cmd/authelia-gen/helpers.go @@ -62,6 +62,10 @@ var decodedTypes = []reflect.Type{ reflect.TypeOf(url.URL{}), reflect.TypeOf(time.Duration(0)), reflect.TypeOf(schema.Address{}), + reflect.TypeOf(schema.AddressTCP{}), + reflect.TypeOf(schema.AddressUDP{}), + reflect.TypeOf(schema.AddressLDAP{}), + reflect.TypeOf(schema.AddressSMTP{}), reflect.TypeOf(schema.X509CertificateChain{}), reflect.TypeOf(schema.PasswordDigest{}), reflect.TypeOf(rsa.PrivateKey{}), diff --git a/config.template.yml b/config.template.yml index 3bc54dbc5..d5b0852ac 100644 --- a/config.template.yml +++ b/config.template.yml @@ -37,11 +37,8 @@ default_2fa_method: "" ## server: - ## The address to listen on. - host: 0.0.0.0 - - ## The port to listen on. - port: 9091 + ## The address to listen on. This must be a TCP or unix socket. + address: "tcp://:9091" ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. diff --git a/docs/content/en/configuration/first-factor/introduction.md b/docs/content/en/configuration/first-factor/introduction.md index 434d601cb..0a81430a7 100644 --- a/docs/content/en/configuration/first-factor/introduction.md +++ b/docs/content/en/configuration/first-factor/introduction.md @@ -41,6 +41,9 @@ This section describes the individual configuration options. {{< confkey type="duration" default="5m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + This setting controls the interval at which details are refreshed from the backend. Particularly useful for [LDAP](#ldap). diff --git a/docs/content/en/configuration/first-factor/ldap.md b/docs/content/en/configuration/first-factor/ldap.md index a1f73f7df..598a1683d 100644 --- a/docs/content/en/configuration/first-factor/ldap.md +++ b/docs/content/en/configuration/first-factor/ldap.md @@ -150,6 +150,9 @@ authentication_backend: {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The timeout for dialing an LDAP connection. ### start_tls diff --git a/docs/content/en/configuration/identity-providers/open-id-connect.md b/docs/content/en/configuration/identity-providers/open-id-connect.md index f3fc3f15e..e01cc1e53 100644 --- a/docs/content/en/configuration/identity-providers/open-id-connect.md +++ b/docs/content/en/configuration/identity-providers/open-id-connect.md @@ -203,6 +203,9 @@ key data for the first certificate in the chain. {{< confkey type="duration" default="1h" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default. For more information read these docs about [token lifespan]. @@ -210,6 +213,9 @@ For more information read these docs about [token lifespan]. {{< confkey type="duration" default="1m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to obtain the other token types. For more information read these docs about [token lifespan]. @@ -217,12 +223,18 @@ obtain the other token types. For more information read these docs about [token {{< confkey type="duration" default="1h" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of an ID token. For more information read these docs about [token lifespan]. ### refresh_token_lifespan {{< confkey type="string" default="90m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum lifetime of a refresh token. The refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an up-to-date expiration. For more information read these docs about [token lifespan]. @@ -288,6 +300,9 @@ When enabled all authorization requests must use the [Pushed Authorization Reque {{< confkey type="duration" default="5m" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated `request_uri` being utilized by a client. @@ -568,8 +583,8 @@ Configures the consent mode. The following table describes the different modes: {{< confkey type="duration" default="1w" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`. diff --git a/docs/content/en/configuration/miscellaneous/ntp.md b/docs/content/en/configuration/miscellaneous/ntp.md index 860beaccb..1542b6b20 100644 --- a/docs/content/en/configuration/miscellaneous/ntp.md +++ b/docs/content/en/configuration/miscellaneous/ntp.md @@ -53,8 +53,8 @@ Determines the NTP version supported. Valid values are 3 or 4. {{< confkey type="duration" default="3s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* This is used to tune the acceptable desync from the time reported from the NTP server. diff --git a/docs/content/en/configuration/miscellaneous/server.md b/docs/content/en/configuration/miscellaneous/server.md index b679dc406..0021c4f25 100644 --- a/docs/content/en/configuration/miscellaneous/server.md +++ b/docs/content/en/configuration/miscellaneous/server.md @@ -21,8 +21,7 @@ aliases: ```yaml server: - host: 0.0.0.0 - port: 9091 + address: "tcp://:9091" path: "" disable_healthcheck: false tls: @@ -58,24 +57,34 @@ server: ## Options -## host +### address -{{< confkey type="string" default="0.0.0.0" required="no" >}} +{{< confkey type="address" default="tcp://:9091" required="no" >}} -Defines the address to listen on. See also [port](#port). Should typically be `0.0.0.0` or `127.0.0.1`, the former for -containerized environments and the later for daemonized environments like init.d and systemd. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -Note: If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: +Configures the listener address for the Main HTTP Server. The address itself is a listener and the scheme must either be +the `unix` scheme or one of the `tcp` schemes. + +__Example:__ ```yaml -host: "[fd00:1111:2222:3333::1]" +server: + address: tcp://127.0.0.1:9091 ``` -### port +```yaml +server: + address: unix:///var/run/authelia.sock +``` -{{< confkey type="integer" default="9091" required="no" >}} +### umask -Defines the port to listen on. See also [host](#host). +{{< confkey type="int" required="no" >}} + +If set temporarily changes the Umask during the creation of the unix domain socket if configured as such in the +[address](#address). ### path diff --git a/docs/content/en/configuration/notifications/smtp.md b/docs/content/en/configuration/notifications/smtp.md index 876450a90..07fb3d82b 100644 --- a/docs/content/en/configuration/notifications/smtp.md +++ b/docs/content/en/configuration/notifications/smtp.md @@ -142,6 +142,9 @@ STARTTLS negotiation is not required for this port, the connection is implicitly {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The SMTP connection timeout. ### username diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index 48aadb745..8aa6a2d3e 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -14,9 +14,17 @@ aliases: - /c/common --- -## Duration Notation Format +## Syntax -We have implemented a string/integer based notation for configuration options that take a duration of time. This section +The following represent common syntax used within the configuration which have specific format requirements that are +used in multiple areas. This is intended on assisting in understanding these specific values, and not as a specific +guide on configuring any particular instance. + +### Duration + +The base type for this syntax is a string, and it also handles integers however this is discouraged. + +We have implemented a string/integer based syntax for configuration options that take a duration of time. This section describes the implementation of this. You can use this implementation in various areas of configuration such as: * session: @@ -41,9 +49,9 @@ The following is ignored: While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. -### Unit Legend +#### Unit Legend -#### Short Units +##### Short Units These values have been available for a long time. @@ -57,7 +65,7 @@ These values have been available for a long time. | Minutes | m | | Seconds | s | -#### Long Units +##### Long Units These values are more human readable but have only been available since v4.38.0. @@ -72,7 +80,7 @@ These values are more human readable but have only been available since v4.38.0. | Seconds | `second`, `seconds` | | Milliseconds | `millisecond`, `milliseconds` | -### Examples +#### Examples | Desired Value | Configuration Examples | |:---------------------:|:-------------------------------------:| @@ -80,14 +88,35 @@ These values are more human readable but have only been available since v4.38.0. | 1 day | `1d` or `24h` or `86400` or `86400s` | | 10 hours | `10h` or `600m` or `9h60m` or `36000` | -## Address +### Address -The address type is a string that takes the following format: +The base type for this syntax is a string. + +The address type is a string that indicates how to configure a listener or connector, which are the two primary +categories of addresses. + +The address values take the following formats: ```text -[://][:] +[://][:] +[://]: +unix:// ``` +Examples: + +```text +0.0.0.0 +tcp://0.0.0.0 +tcp://0.0.0.0:9091 +tcp://:9091 +0.0.0.0:9091 + +udp://0.0.0.0:123 +udp://:123 + +unix:///var/lib/authelia.sock +``` The square brackets indicate optional sections, and the angled brackets indicate required sections. The following sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration requirement that one of these is provided. @@ -95,22 +124,51 @@ requirement that one of these is provided. ### scheme The entire scheme is optional, but if the scheme host delimiter `://` is in the string, the scheme must be present. The -scheme must be one of `tcp://`, or `udp://`. The default scheme is `tcp://`. +scheme must be one of the following (the listeners and connectors columns indicate support for the scheme on the +respective address type): -### ip +| Scheme | Listeners | Connectors | Default Port | Notes | +|:-------------:|:---------:|:----------:|:------------:|:-------------------------------------------------------------------------:| +| `tcp` | Yes | Yes | N/A | Standard TCP Socket which allows IPv4 and/or IPv6 addresses | +| `tcp4` | Yes | Yes | N/A | Standard TCP Socket which allows only IPv4 addresses | +| `tcp6` | Yes | Yes | N/A | Standard TCP Socket which allows only IPv6 addresses | +| `udp` | Yes | Yes | N/A | Standard UDP Socket which allows IPv4 and/or IPv6 addresses | +| `udp4` | Yes | Yes | N/A | Standard UDP Socket which allows only IPv4 addresses | +| `udp6` | Yes | Yes | N/A | Standard UDP Socket which allows only IPv6 addresses | +| `unix` | Yes | Yes | N/A | Standard Unix Domain Socket which allows only absolute paths | +| `ldap` | No | Yes | 389 | Remote LDAP connection via TCP with implicit TLS via StartTLS | +| `ldaps` | No | Yes | 636 | Remote LDAP connection via TCP with explicit TLS | +| `ldapi` | No | Yes | N/A | LDAP connection via Unix Domain Socket | +| `smtp` | No | Yes | 25 | Remote SMTP connection via TCP using implicit TLS via StartTLS | +| `submission` | No | Yes | 587 | Remote SMTP Submission connection via TCP using implicit TLS via StartTLS | +| `submissions` | No | Yes | 465 | Remote SMTP Submission connection via TCP using explicit TLS | -The IP is required. If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address -`::1` with the `tcp://` scheme and port `80`: `tcp://[::1]:80`. +If the scheme is absent, the default scheme is assumed. If the address has a `/` prefix it's assumed to be `unix`, +otherwise it's assumed to be`tcp`. If the scheme is `unix` it must be suffixed with an absolute path i.e. +`/var/local/authelia.sock` would be represented as `unix:///var/run/authelia.sock`. + +### hostname + +The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [port](#port) specified. It +can be any IP that is locally addressable or a hostname which resolves to a locally addressable IP. + +If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address `::1` with the `tcp` +scheme and port `80` the correct address would be `tcp://[::1]:80`. ### port -The entire port is optional, but if the host port delimiter `:` exists it must also include a numeric port. +The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [hostname](#hostname) +specified. -## Regular Expressions +### Regular Expressions -We have several sections of configuration that utilize regular expressions. It's recommended to validate your regex -manually either via tools like [Regex 101](https://regex101.com/) (ensure you pick the `Golang` option) or some other -means. +We have several sections of configuration that utilize regular expressions. We use the Google RE2 regular expression +engine which is the full Go regular expression syntax engine, the syntax of which is described +[here](https://github.com/google/re2/wiki/Syntax) by the authors. It's very similar to regular expression engines like +PCRE, Perl, and Python; with the major exceptions being that it doesn't have backtracking. + +It's recommended to validate your regular expressions manually either via tools like [Regex 101](https://regex101.com/) +(ensure you pick the `Golang` option) or some other means. It's important when attempting to utilize a backslash that it's utilized correctly. The YAML parser is likely to parse this as you trying to use YAML escape syntax instead of regex escape syntax. To avoid this use single quotes instead of @@ -128,19 +186,25 @@ Bad Example: domain_regex: "^(admin|secure)\.example\.com$" ``` -## TLS Configuration +## Structures + +The following represent common data structures used within the configuration which have specific requirements that are +used in multiple areas. This is intended on assisting in understanding these specific structures, and not as a specific +guide on configuring any particular instance. + +### TLS Configuration Various sections of the configuration use a uniform configuration section called TLS. Notably LDAP and SMTP. This section documents the usage. -### server_name +#### server_name {{< confkey type="string" required="no" >}} The key `server_name` overrides the name checked against the certificate in the verification process. Useful if you require an IP address for the host of the backend service but want to verify a specific certificate server name. -### skip_verify +#### skip_verify {{< confkey type="boolean" default="false" required="no" >}} @@ -148,7 +212,7 @@ The key `skip_verify` completely negates validating the certificate of the backe instead you should tweak the `server_name` option, and the global option [certificates directory](../miscellaneous/introduction.md#certificatesdirectory). -### minimum_version +#### minimum_version {{< confkey type="string" default="TLS1.2" required="no" >}} @@ -157,7 +221,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing this value. At the time of this writing `SSL3.0` will always produce errors. -### maximum_version +#### maximum_version {{< confkey type="string" default="TLS1.3" required="no" >}} @@ -166,7 +230,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing this value. At the time of this writing `SSL3.0` will always produce errors. -### certificate_chain +#### certificate_chain {{< confkey type="string" required="no" >}} @@ -175,7 +239,7 @@ the server. The value must be one or more certificates encoded in the DER base64 ([RFC4648]) encoded PEM format. -### private_key +#### private_key {{< confkey type="string" required="no" >}} @@ -189,45 +253,54 @@ is provided, in top down order, each certificate must be signed by the next cert [RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648 -## Server Buffers +### Server Buffers -### read +#### read {{< confkey type="integer" default="4096" required="no" >}} Configures the maximum request size. The default of 4096 is generally sufficient for most use cases. -### write +#### write {{< confkey type="integer" default="4096" required="no" >}} Configures the maximum response size. The default of 4096 is generally sufficient for most use cases. -## Server Timeouts +### Server Timeouts -### read +#### read {{< confkey type="duration" default="6s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the -[common options](#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* Configures the server read timeout. -### write +#### write {{< confkey type="duration" default="6s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the -[common options](#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](#duration). +Please see the [documentation](#duration) on this format for more information.* Configures the server write timeout. -### idle +#### idle {{< confkey type="duration" default="30s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the -[common options](#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](#duration). +Please see the [documentation](#duration) on this format for more information.* Configures the server idle timeout. + +## Historical References + +This contains links to historical anchors. + +##### Duration Notation Format + +See [duration common syntax](#duration). + diff --git a/docs/content/en/configuration/second-factor/webauthn.md b/docs/content/en/configuration/second-factor/webauthn.md index d560354e7..17f295559 100644 --- a/docs/content/en/configuration/second-factor/webauthn.md +++ b/docs/content/en/configuration/second-factor/webauthn.md @@ -84,8 +84,8 @@ Available Options: {{< confkey type="duration" default="60s" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* This adjusts the requested timeout for a WebAuthn interaction. diff --git a/docs/content/en/configuration/security/regulation.md b/docs/content/en/configuration/security/regulation.md index b1ea8f1df..b3e4a58e6 100644 --- a/docs/content/en/configuration/security/regulation.md +++ b/docs/content/en/configuration/security/regulation.md @@ -43,8 +43,8 @@ The number of failed login attempts before a user may be banned. Setting this op {{< confkey type="duration" default="2m" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time analyzed for failed attempts. For example if you set `max_retries` to 3 and `find_time` to `2m` this means the user must have 3 failed logins in @@ -54,8 +54,8 @@ example if you set `max_retries` to 3 and `find_time` to `2m` this means the use {{< confkey type="duration" default="5m" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time the user is banned for after meeting the `max_retries` and `find_time` configuration. After this duration the account will be able to login again. diff --git a/docs/content/en/configuration/session/introduction.md b/docs/content/en/configuration/session/introduction.md index 304cbf390..53c337396 100644 --- a/docs/content/en/configuration/session/introduction.md +++ b/docs/content/en/configuration/session/introduction.md @@ -99,8 +99,8 @@ The default `same_site` value for all `cookies` configurations. {{< confkey type="duration" default="5m" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The default `inactivity` value for all [cookies](#cookies) configurations. @@ -108,8 +108,8 @@ The default `inactivity` value for all [cookies](#cookies) configurations. {{< confkey type="duration" default="1h" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The default `expiration` value for all [cookies](#cookies) configurations. @@ -117,8 +117,8 @@ The default `expiration` value for all [cookies](#cookies) configurations. {{< confkey type="duration" default="1M" required="no" >}} -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The default `remember_me` value for all [cookies](#cookies) configurations. @@ -197,8 +197,8 @@ state but it's available as an option anyway. *__Default Value:__ This option takes its default value from the [inactivity](#inactivity) setting above.* -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time the user can be inactive for until the session is destroyed. Useful if you want long session timers but don't want unused devices to be vulnerable. @@ -209,8 +209,8 @@ but don't want unused devices to be vulnerable. *__Default Value:__ This option takes its default value from the [expiration](#expiration) setting above.* -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time before the cookie expires and the session is destroyed. This is overriden by [remember_me](#rememberme) when the remember me box is checked. @@ -221,8 +221,8 @@ The period of time before the cookie expires and the session is destroyed. This *__Default Value:__ This option takes its default value from the [remember_me](#rememberme) setting above.* -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* The period of time before the cookie expires and the session is destroyed when the remember me box is checked. Setting this to `-1` disables this feature entirely for this session cookie domain. diff --git a/docs/content/en/configuration/storage/mysql.md b/docs/content/en/configuration/storage/mysql.md index c187fbcee..d5a9f0181 100644 --- a/docs/content/en/configuration/storage/mysql.md +++ b/docs/content/en/configuration/storage/mysql.md @@ -174,6 +174,9 @@ characters and the user password is changed to this value. {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The SQL connection timeout. ### tls diff --git a/docs/content/en/configuration/storage/postgres.md b/docs/content/en/configuration/storage/postgres.md index 8e2c10977..2deab5050 100644 --- a/docs/content/en/configuration/storage/postgres.md +++ b/docs/content/en/configuration/storage/postgres.md @@ -180,6 +180,9 @@ characters and the user password is changed to this value. {{< confkey type="duration" default="5s" required="no" >}} +*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). +Please see the [documentation](../prologue/common.md#duration) on this format for more information.* + The SQL connection timeout. ### tls diff --git a/docs/content/en/configuration/telemetry/metrics.md b/docs/content/en/configuration/telemetry/metrics.md index 55e6f4dee..2f213c732 100644 --- a/docs/content/en/configuration/telemetry/metrics.md +++ b/docs/content/en/configuration/telemetry/metrics.md @@ -22,7 +22,7 @@ toc: true telemetry: metrics: enabled: false - address: "tcp://0.0.0.0:9959" + address: "tcp://:9959" buffers: read: 4096 write: 4096 @@ -44,10 +44,20 @@ Determines if the [Prometheus] HTTP Metrics Exporter is enabled. ### address -{{< confkey type="address" default="tcp://0.0.0.0:9959" required="no" >}} +{{< confkey type="address" default="tcp://:9959" required="no" >}} -Configures the listener address for the [Prometheus] HTTP Metrics Exporter. This configuration key uses the -[Address](../prologue/common.md#address) format. The scheme must be `tcp://` or empty. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* + +Configures the listener address for the [Prometheus] Metrics Exporter HTTP Server. The address itself is a listener and +the scheme must either be the `unix` scheme or one of the `tcp` schemes. + +### umask + +{{< confkey type="int" required="no" >}} + +If set temporarily changes the Umask during the creation of the unix domain socket if configured as such in the +[address](#address). ### buffers diff --git a/docs/data/configkeys.json b/docs/data/configkeys.json index bf06efb15..c140a0b24 100644 --- a/docs/data/configkeys.json +++ b/docs/data/configkeys.json @@ -1 +1 @@ -[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_URL"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file +[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_URL"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.umask","secret":false,"env":"AUTHELIA_SERVER_UMASK"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.umask","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_UMASK"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file diff --git a/internal/configuration/config.template.yml b/internal/configuration/config.template.yml index 3bc54dbc5..d5b0852ac 100644 --- a/internal/configuration/config.template.yml +++ b/internal/configuration/config.template.yml @@ -37,11 +37,8 @@ default_2fa_method: "" ## server: - ## The address to listen on. - host: 0.0.0.0 - - ## The port to listen on. - port: 9091 + ## The address to listen on. This must be a TCP or unix socket. + address: "tcp://:9091" ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. diff --git a/internal/configuration/decode_hooks.go b/internal/configuration/decode_hooks.go index f0cb8468f..caca552c6 100644 --- a/internal/configuration/decode_hooks.go +++ b/internal/configuration/decode_hooks.go @@ -219,6 +219,8 @@ func StringToRegexpHookFunc() mapstructure.DecodeHookFuncType { } // StringToAddressHookFunc decodes a string into an Address or *Address. +// +//nolint:gocyclo // This is an adequately clear function even with the complexity. func StringToAddressHookFunc() mapstructure.DecodeHookFuncType { return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { var ptr bool @@ -235,26 +237,99 @@ func StringToAddressHookFunc() mapstructure.DecodeHookFuncType { } expectedType := reflect.TypeOf(schema.Address{}) + expectedTypeTCP := reflect.TypeOf(schema.AddressTCP{}) + expectedTypeUDP := reflect.TypeOf(schema.AddressUDP{}) + expectedTypeLDAP := reflect.TypeOf(schema.AddressLDAP{}) + expectedTypeSMTP := reflect.TypeOf(schema.AddressSMTP{}) - if ptr && t.Elem() != expectedType { - return data, nil - } else if !ptr && t != expectedType { - return data, nil + switch { + case ptr: + switch t.Elem() { + case expectedType: + case expectedTypeTCP: + expectedType = expectedTypeTCP + case expectedTypeUDP: + expectedType = expectedTypeUDP + case expectedTypeLDAP: + expectedType = expectedTypeLDAP + case expectedTypeSMTP: + expectedType = expectedTypeSMTP + default: + return data, nil + } + default: + switch t { + case expectedType: + break + case expectedTypeTCP: + expectedType = expectedTypeTCP + case expectedTypeUDP: + expectedType = expectedTypeUDP + case expectedTypeLDAP: + expectedType = expectedTypeLDAP + case expectedTypeSMTP: + expectedType = expectedTypeSMTP + default: + return data, nil + } } dataStr := data.(string) var result *schema.Address - if result, err = schema.NewAddressFromString(dataStr); err != nil { - return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) - } + switch expectedType { + case expectedTypeTCP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeTCP, schema.AddressSchemeUnix); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } - if ptr { - return result, nil - } + if ptr { + return &schema.AddressTCP{Address: *result}, nil + } - return *result, nil + return schema.AddressTCP{Address: *result}, nil + case expectedTypeUDP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeUDP, schema.AddressSchemeUnix); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return &schema.AddressUDP{Address: *result}, nil + } + + return schema.AddressUDP{Address: *result}, nil + case expectedTypeLDAP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeLDAP, schema.AddressSchemeLDAPI); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return &schema.AddressLDAP{Address: *result}, nil + } + + return schema.AddressLDAP{Address: *result}, nil + case expectedTypeSMTP: + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeSMTP, schema.AddressSchemeUnix); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return &schema.AddressSMTP{Address: *result}, nil + } + + return schema.AddressSMTP{Address: *result}, nil + default: + if result, err = schema.NewAddress(dataStr); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) + } + + if ptr { + return result, nil + } + + return *result, nil + } } } diff --git a/internal/configuration/decode_hooks_test.go b/internal/configuration/decode_hooks_test.go index b13d350c7..4e2ad1c03 100644 --- a/internal/configuration/decode_hooks_test.go +++ b/internal/configuration/decode_hooks_test.go @@ -756,7 +756,7 @@ func TestStringToRegexpFuncPointers(t *testing.T) { func TestStringToAddressHookFunc(t *testing.T) { mustParseAddress := func(a string) (addr schema.Address) { - addrs, err := schema.NewAddressFromString(a) + addrs, err := schema.NewAddress(a) if err != nil { panic(err) } @@ -765,7 +765,7 @@ func TestStringToAddressHookFunc(t *testing.T) { } mustParseAddressPtr := func(a string) (addr *schema.Address) { - addr, err := schema.NewAddressFromString(a) + addr, err := schema.NewAddress(a) if err != nil { panic(err) } diff --git a/internal/configuration/deprecation.go b/internal/configuration/deprecation.go index d8eae81fb..531074462 100644 --- a/internal/configuration/deprecation.go +++ b/internal/configuration/deprecation.go @@ -1,6 +1,9 @@ package configuration import ( + "fmt" + + "github.com/authelia/authelia/v4/internal/configuration/schema" "github.com/authelia/authelia/v4/internal/model" ) @@ -11,7 +14,7 @@ type Deprecation struct { NewKey string AutoMap bool MapFunc func(value any) any - ErrText string + ErrFunc func(d Deprecation, keysFinal map[string]any, value any, val *schema.StructValidator) } var deprecations = map[string]Deprecation{ @@ -21,6 +24,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.level", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "logs_file": { Version: model.SemanticVersion{Major: 4, Minor: 7}, @@ -28,6 +32,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.file_path", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "authentication_backend.ldap.skip_verify": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -35,6 +40,7 @@ var deprecations = map[string]Deprecation{ NewKey: "authentication_backend.ldap.tls.skip_verify", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "authentication_backend.ldap.minimum_tls_version": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -42,6 +48,7 @@ var deprecations = map[string]Deprecation{ NewKey: "authentication_backend.ldap.tls.minimum_version", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "notifier.smtp.disable_verify_cert": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -49,6 +56,7 @@ var deprecations = map[string]Deprecation{ NewKey: "notifier.smtp.tls.skip_verify", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "notifier.smtp.trusted_cert": { Version: model.SemanticVersion{Major: 4, Minor: 25}, @@ -56,6 +64,7 @@ var deprecations = map[string]Deprecation{ NewKey: "certificates_directory", AutoMap: false, MapFunc: nil, + ErrFunc: nil, }, "host": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -63,6 +72,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.host", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "port": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -70,6 +80,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.port", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "tls_key": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -77,6 +88,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.tls.key", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "tls_cert": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -84,6 +96,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.tls.certificate", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "log_level": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -91,6 +104,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.level", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "log_file_path": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -98,6 +112,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.file_path", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "log_format": { Version: model.SemanticVersion{Major: 4, Minor: 30}, @@ -105,6 +120,7 @@ var deprecations = map[string]Deprecation{ NewKey: "log.format", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "storage.postgres.sslmode": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -112,6 +128,7 @@ var deprecations = map[string]Deprecation{ NewKey: "storage.postgres.ssl.mode", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "authentication_backend.disable_reset_password": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -119,6 +136,7 @@ var deprecations = map[string]Deprecation{ NewKey: "authentication_backend.password_reset.disable", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.read_buffer_size": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -126,6 +144,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.buffers.read", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.write_buffer_size": { Version: model.SemanticVersion{Major: 4, Minor: 36}, @@ -133,6 +152,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.buffers.write", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "session.remember_me_duration": { Version: model.SemanticVersion{Major: 4, Minor: 38}, @@ -140,6 +160,7 @@ var deprecations = map[string]Deprecation{ NewKey: "session.remember_me", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.enable_pprof": { Version: model.SemanticVersion{Major: 4, Minor: 38}, @@ -147,6 +168,7 @@ var deprecations = map[string]Deprecation{ NewKey: "server.endpoints.enable_pprof", AutoMap: true, MapFunc: nil, + ErrFunc: nil, }, "server.enable_expvars": { Version: model.SemanticVersion{Major: 4, Minor: 38}, @@ -154,5 +176,26 @@ var deprecations = map[string]Deprecation{ NewKey: "server.endpoints.enable_expvars", AutoMap: true, MapFunc: nil, + ErrFunc: nil, + }, + "server.host": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "server.host", + NewKey: "server.address", + AutoMap: false, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'server.host' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.port' in the format of 'tcp://:': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "server.port": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "server.port", + NewKey: "server.address", + AutoMap: false, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'server.port' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.host' in the format of 'tcp://:': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, }, } diff --git a/internal/configuration/helpers.go b/internal/configuration/helpers.go index 22b793e9a..ab3f44cf5 100644 --- a/internal/configuration/helpers.go +++ b/internal/configuration/helpers.go @@ -21,6 +21,14 @@ func getEnvConfigMap(keys []string, prefix, delimiter string) (keyMap map[string } } + for _, deprecation := range deprecations { + if !deprecation.AutoMap { + continue + } + + keyMap[ToEnvironmentKey(deprecation.Key, prefix, delimiter)] = deprecation.Key + } + return keyMap, ignoredKeys } diff --git a/internal/configuration/koanf_util.go b/internal/configuration/koanf_util.go index b08320e41..0b162d9c1 100644 --- a/internal/configuration/koanf_util.go +++ b/internal/configuration/koanf_util.go @@ -66,22 +66,29 @@ func koanfRemapKeysStandard(keys map[string]any, val *schema.StructValidator, ds for key, value = range keys { if d, ok = ds[key]; ok { if !d.AutoMap { - val.Push(fmt.Errorf("invalid configuration key '%s' was replaced by '%s'", d.Key, d.NewKey)) - keysFinal[key] = value + if d.ErrFunc != nil { + d.ErrFunc(d, keysFinal, value, val) + } else { + val.Push(fmt.Errorf("invalid configuration key '%s' was replaced by '%s'", d.Key, d.NewKey)) + } + continue - } else { - val.PushWarning(fmt.Errorf("configuration key '%s' is deprecated in %s and has been replaced by '%s': "+ - "this has been automatically mapped for you but you will need to adjust your configuration to remove this message", d.Key, d.Version.String(), d.NewKey)) } if !mapHasKey(d.NewKey, keys) && !mapHasKey(d.NewKey, keysFinal) { + val.PushWarning(fmt.Errorf("configuration key '%s' is deprecated in %s and has been replaced by '%s': "+ + "this has been automatically mapped for you but you will need to adjust your configuration to remove this message", d.Key, d.Version.String(), d.NewKey)) + if d.MapFunc != nil { keysFinal[d.NewKey] = d.MapFunc(value) } else { keysFinal[d.NewKey] = value } + } else { + val.PushWarning(fmt.Errorf("configuration key '%s' is deprecated in %s and has been replaced by '%s': "+ + "this has not been automatically mapped for you because the replacement key also exists and you will need to adjust your configuration to remove this message", d.Key, d.Version.String(), d.NewKey)) } continue diff --git a/internal/configuration/provider_test.go b/internal/configuration/provider_test.go index 6c1658948..4208389ca 100644 --- a/internal/configuration/provider_test.go +++ b/internal/configuration/provider_test.go @@ -409,7 +409,9 @@ func TestShouldLoadDirectoryConfiguration(t *testing.T) { assert.NoError(t, err) assert.Len(t, val.Errors(), 0) - assert.Len(t, val.Warnings(), 0) + require.Len(t, val.Warnings(), 1) + + assert.EqualError(t, val.Warnings()[0], "configuration key 'server.port' is deprecated in 4.38.0 and has been replaced by 'server.address' when combined with the 'server.host' in the format of 'tcp://:': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") } func testSetEnv(t *testing.T, key, value string) { diff --git a/internal/configuration/schema/const.go b/internal/configuration/schema/const.go index 6f0ef781f..0e59410c5 100644 --- a/internal/configuration/schema/const.go +++ b/internal/configuration/schema/const.go @@ -105,7 +105,7 @@ const ( // regexpHasScheme checks if a string has a scheme. Valid characters for schemes include alphanumeric, hyphen, // period, and plus characters. -var regexpHasScheme = regexp.MustCompile(`^[-+.a-zA-Z\d]+://`) +var regexpHasScheme = regexp.MustCompile(`^[-+.a-zA-Z\d]*(://|:$)`) const ( blockCERTIFICATE = "CERTIFICATE" @@ -119,3 +119,20 @@ const ( ldapAttrDescription = "description" ldapAttrCommonName = "cn" ) + +// Address Schemes. +const ( + AddressSchemeTCP = "tcp" + AddressSchemeTCP4 = "tcp4" + AddressSchemeTCP6 = "tcp6" + AddressSchemeUDP = "udp" + AddressSchemeUDP4 = "udp4" + AddressSchemeUDP6 = "udp6" + AddressSchemeUnix = "unix" + AddressSchemeLDAP = "ldap" + AddressSchemeLDAPS = "ldaps" + AddressSchemeLDAPI = "ldapi" + AddressSchemeSMTP = "smtp" + AddressSchemeSUBMISSION = "submission" + AddressSchemeSUBMISSIONS = "submissions" +) diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go index 85923eb1a..ba5aaa423 100644 --- a/internal/configuration/schema/keys.go +++ b/internal/configuration/schema/keys.go @@ -237,6 +237,8 @@ var Keys = []string{ "notifier.template_path", "server.host", "server.port", + "server.address", + "server.umask", "server.path", "server.asset_path", "server.disable_healthcheck", @@ -257,6 +259,7 @@ var Keys = []string{ "server.timeouts.idle", "telemetry.metrics.enabled", "telemetry.metrics.address", + "telemetry.metrics.umask", "telemetry.metrics.buffers.read", "telemetry.metrics.buffers.write", "telemetry.metrics.timeouts.read", diff --git a/internal/configuration/schema/server.go b/internal/configuration/schema/server.go index c786567b0..46264f3c8 100644 --- a/internal/configuration/schema/server.go +++ b/internal/configuration/schema/server.go @@ -1,13 +1,15 @@ package schema import ( + "net/url" "time" ) // ServerConfiguration represents the configuration of the http server. type ServerConfiguration struct { - Host string `koanf:"host"` - Port int `koanf:"port"` + Address *AddressTCP `koanf:"address"` + UMask *int `koanf:"umask"` + Path string `koanf:"path"` AssetPath string `koanf:"asset_path"` DisableHealthcheck bool `koanf:"disable_healthcheck"` @@ -18,6 +20,12 @@ type ServerConfiguration struct { Buffers ServerBuffers `koanf:"buffers"` Timeouts ServerTimeouts `koanf:"timeouts"` + + // Deprecated: use address instead. + Host string `koanf:"host"` + + // Deprecated: use address instead. + Port int `koanf:"port"` } // ServerEndpoints is the endpoints configuration for the HTTP server. @@ -54,8 +62,7 @@ type ServerHeaders struct { // DefaultServerConfiguration represents the default values of the ServerConfiguration. var DefaultServerConfiguration = ServerConfiguration{ - Host: "0.0.0.0", - Port: 9091, + Address: &AddressTCP{Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: ":9091"}}}, Buffers: ServerBuffers{ Read: 4096, Write: 4096, diff --git a/internal/configuration/schema/telemetry.go b/internal/configuration/schema/telemetry.go index 3b0dcf3b5..f3231144e 100644 --- a/internal/configuration/schema/telemetry.go +++ b/internal/configuration/schema/telemetry.go @@ -1,7 +1,7 @@ package schema import ( - "net" + "net/url" "time" ) @@ -12,8 +12,9 @@ type TelemetryConfig struct { // TelemetryMetricsConfig represents the telemetry metrics config. type TelemetryMetricsConfig struct { - Enabled bool `koanf:"enabled"` - Address *Address `koanf:"address"` + Enabled bool `koanf:"enabled"` + Address *AddressTCP `koanf:"address"` + UMask *int `koanf:"umask"` Buffers ServerBuffers `koanf:"buffers"` Timeouts ServerTimeouts `koanf:"timeouts"` @@ -22,7 +23,7 @@ type TelemetryMetricsConfig struct { // DefaultTelemetryConfig is the default telemetry configuration. var DefaultTelemetryConfig = TelemetryConfig{ Metrics: TelemetryMetricsConfig{ - Address: &Address{true, "tcp", net.ParseIP("0.0.0.0"), 9959}, + Address: &AddressTCP{Address{true, false, 9959, &url.URL{Scheme: AddressSchemeTCP, Host: ":9959"}}}, Buffers: ServerBuffers{ Read: 4096, Write: 4096, diff --git a/internal/configuration/schema/types.go b/internal/configuration/schema/types.go index 01bbe26a0..d27c5c48a 100644 --- a/internal/configuration/schema/types.go +++ b/internal/configuration/schema/types.go @@ -13,6 +13,7 @@ import ( "net/url" "strconv" "strings" + "syscall" "time" "github.com/go-crypt/crypt" @@ -20,96 +21,386 @@ import ( "github.com/go-crypt/crypt/algorithm/plaintext" ) -// NewAddressFromString returns an *Address and error depending on the ability to parse the string as an Address. -func NewAddressFromString(a string) (addr *Address, err error) { - if len(a) == 0 { - return &Address{true, "tcp", net.ParseIP("0.0.0.0"), 0}, nil +// NewAddress returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the 'unix' scheme, and everything else without +// a scheme is the 'tcp' scheme. +func NewAddress(value string) (address *Address, err error) { + return NewAddressDefault(value, AddressSchemeTCP, AddressSchemeUnix) +} + +// NewAddressDefault returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything +// else without a scheme is the schemeDefault scheme. +func NewAddressDefault(value, schemeDefault, schemeDefaultPath string) (address *Address, err error) { + if len(value) == 0 { + return &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil } var u *url.URL - if regexpHasScheme.MatchString(a) { - u, err = url.Parse(a) + if regexpHasScheme.MatchString(value) { + u, err = url.Parse(value) } else { - u, err = url.Parse("tcp://" + a) + if strings.HasPrefix(value, "/") { + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value)) + } else { + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value)) + } } if err != nil { - return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", a, err) + return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", value, err) } return NewAddressFromURL(u) } +// NewAddressUnix returns an *Address from a path value. +func NewAddressUnix(path string) Address { + return Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}} +} + +// NewAddressFromNetworkValues returns an *Address from network values. +func NewAddressFromNetworkValues(network, host string, port int) Address { + return Address{true, false, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port)}} +} + // NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address. func NewAddressFromURL(u *url.URL) (addr *Address, err error) { addr = &Address{ - Scheme: strings.ToLower(u.Scheme), - IP: net.ParseIP(u.Hostname()), + url: u, } - if addr.IP == nil { - return nil, fmt.Errorf("could not parse ip for address '%s': %s does not appear to be an IP", u.String(), u.Hostname()) + if err = addr.validate(); err != nil { + return nil, err } - port := u.Port() - switch port { - case "": - break - default: - addr.Port, err = strconv.Atoi(port) - if err != nil { - return nil, fmt.Errorf("could not parse port for address '%s': %w", u.String(), err) - } - } - - switch addr.Scheme { - case "tcp", "udp": - break - default: - return nil, fmt.Errorf("could not parse scheme for address '%s': scheme '%s' is not valid, expected to be one of 'tcp://', 'udp://'", u.String(), addr.Scheme) - } - - addr.valid = true - return addr, nil } +// AddressTCP is just a type with an underlying type of Address. +type AddressTCP struct { + Address +} + +// AddressUDP is just a type with an underlying type of Address. +type AddressUDP struct { + Address +} + +// AddressLDAP is just a type with an underlying type of Address. +type AddressLDAP struct { + Address +} + +// AddressSMTP is just a type with an underlying type of Address. +type AddressSMTP struct { + Address +} + // Address represents an address. type Address struct { - valid bool + valid bool + socket bool + port int - Scheme string - IP net.IP - Port int + url *url.URL } // Valid returns true if the Address is valid. -func (a Address) Valid() bool { +func (a *Address) Valid() bool { return a.valid } -// String returns a string representation of the Address. -func (a Address) String() string { - if !a.valid { - return "" +// ValidateHTTP returns true if the Address is valid for a HTTP connection listener. +func (a *Address) ValidateHTTP() error { + switch a.Scheme() { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUnix: + break + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme()) } - return fmt.Sprintf("%s://%s:%d", a.Scheme, a.IP.String(), a.Port) + return nil } -// HostPort returns a string representation of the Address with just the host and port. -func (a Address) HostPort() string { - if !a.valid { +// ValidateListener returns true if the Address is valid for a connection listener. +func (a *Address) ValidateListener() error { + switch a.Scheme() { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: + break + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as '%s'", a.Scheme()) + } + + return nil +} + +// ValidateSMTP returns true if the Address is valid for a remote SMTP connection opener. +func (a *Address) ValidateSMTP() error { + switch a.Scheme() { + case AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: + break + default: + return fmt.Errorf("scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as '%s'", a.Scheme()) + } + + return nil +} + +// ValidateLDAP returns true if the Address has a value Scheme for an LDAP connection opener. +func (a *Address) ValidateLDAP() error { + switch a.Scheme() { + case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeLDAPI: + break + default: + return fmt.Errorf("scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as '%s'", a.Scheme()) + } + + return nil +} + +// IsExplicitlySecure returns true if the address is an explicitly secure. +func (a *Address) IsExplicitlySecure() bool { + switch a.Scheme() { + case AddressSchemeSUBMISSIONS, AddressSchemeLDAPS: + return true + default: + return false + } +} + +// String returns a string representation of the Address. +func (a *Address) String() string { + if !a.valid || a.url == nil { return "" } - return fmt.Sprintf("%s:%d", a.IP.String(), a.Port) + return a.url.String() +} + +// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp. +func (a *Address) Network() string { + switch scheme := a.Scheme(); scheme { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: + return scheme + default: + return AddressSchemeTCP + } +} + +// Scheme returns the *url.URL Scheme field. +func (a *Address) Scheme() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Scheme +} + +// Hostname returns the output of the *url.URL Hostname func. +func (a *Address) Hostname() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Hostname() +} + +// SocketHostname returns the correct hostname for a socket connection. +func (a *Address) SocketHostname() string { + if !a.valid || a.url == nil { + return "" + } + + if a.socket { + return a.url.Path + } + + return a.url.Hostname() +} + +// SetHostname sets the hostname preserving the port. +func (a *Address) SetHostname(hostname string) { + if !a.valid || a.url == nil { + return + } + + if port := a.url.Port(); port == "" { + a.url.Host = hostname + } else { + a.url.Host = fmt.Sprintf("%s:%s", hostname, port) + } +} + +// Port returns the port. +func (a *Address) Port() int { + return a.port +} + +// SetPort sets the port preserving the hostname. +func (a *Address) SetPort(port int) { + if !a.valid || a.url == nil { + return + } + + a.setport(port) +} + +// Host returns the *url.URL Host field. +func (a *Address) Host() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Host +} + +// NetworkAddress returns a string representation of the Address with just the host and port. +func (a *Address) NetworkAddress() string { + if !a.valid || a.url == nil { + return "" + } + + if a.socket { + return a.url.Path + } + + return a.url.Host } // Listener creates and returns a net.Listener. -func (a Address) Listener() (net.Listener, error) { - return net.Listen(a.Scheme, a.HostPort()) +func (a *Address) Listener() (net.Listener, error) { + return a.listener() +} + +// Dial creates and returns a dialed net.Conn. +func (a *Address) Dial() (net.Conn, error) { + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + return net.Dial(a.Network(), a.NetworkAddress()) +} + +// ListenerWithUMask creates and returns a net.Listener with a temporary UMask if the scheme is `unix`. +func (a *Address) ListenerWithUMask(umask int) (ln net.Listener, err error) { + if !a.socket { + return a.listener() + } + + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + umask = syscall.Umask(umask) + + ln, err = net.Listen(a.Network(), a.NetworkAddress()) + + _ = syscall.Umask(umask) + + return ln, err +} + +func (a *Address) listener() (net.Listener, error) { + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + return net.Listen(a.Network(), a.NetworkAddress()) +} + +func (a *Address) setport(port int) { + a.port = port + a.url.Host = net.JoinHostPort(a.url.Hostname(), strconv.Itoa(port)) +} + +func (a *Address) validate() (err error) { + if a.url == nil { + return fmt.Errorf("error validating the address: address url was nil") + } + + switch { + case a.url.RawQuery != "": + return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses", a.url.String()) + case a.url.RawFragment != "", a.url.Fragment != "": + return fmt.Errorf("error validating the address: the url '%s' appears to have a fragment but this is not valid for addresses", a.url.String()) + case a.url.User != nil: + return fmt.Errorf("error validating the address: the url '%s' appears to have user info but this is not valid for addresses", a.url.String()) + } + + switch a.url.Scheme { + case AddressSchemeUnix, AddressSchemeLDAPI: + if err = a.validateUnixSocket(); err != nil { + return err + } + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6: + if err = a.validateTCPUDP(); err != nil { + return err + } + case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: + if err = a.validateProtocol(); err != nil { + return err + } + } + + a.valid = true + + return nil +} + +func (a *Address) validateProtocol() (err error) { + port := a.url.Port() + + switch port { + case "": + switch a.url.Scheme { + case AddressSchemeLDAP: + a.setport(389) + case AddressSchemeLDAPS: + a.setport(636) + case AddressSchemeSMTP: + a.setport(25) + case AddressSchemeSUBMISSION: + a.setport(587) + case AddressSchemeSUBMISSIONS: + a.setport(465) + } + default: + actualPort, _ := strconv.Atoi(port) + + a.setport(actualPort) + } + + return nil +} + +func (a *Address) validateTCPUDP() (err error) { + port := a.url.Port() + + switch port { + case "": + a.setport(0) + default: + actualPort, _ := strconv.Atoi(port) + + a.setport(actualPort) + } + + return nil +} + +func (a *Address) validateUnixSocket() (err error) { + switch { + case a.url.Path == "" && a.url.Scheme != AddressSchemeLDAPI: + return fmt.Errorf("error validating the unix socket address: could not determine path from '%s'", a.url.String()) + case a.url.Host != "": + return fmt.Errorf("error validating the unix socket address: the url '%s' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", a.url.String()) + } + + a.socket = true + + return nil } var cdecoder algorithm.DecoderRegister diff --git a/internal/configuration/schema/types_test.go b/internal/configuration/schema/types_test.go index ab83941a1..aa42b4a54 100644 --- a/internal/configuration/schema/types_test.go +++ b/internal/configuration/schema/types_test.go @@ -3,10 +3,13 @@ package schema import ( "crypto" "crypto/rsa" + "crypto/tls" "crypto/x509" "encoding/pem" "fmt" "net" + "net/url" + "path/filepath" "regexp" "testing" @@ -16,42 +19,587 @@ import ( func TestNewAddressFromString(t *testing.T) { testCases := []struct { - name string - have string - expected *Address - expectedHostPort, expectedString, expectedErr string + name string + have string + expected *Address + expectedAddress, expectedString, expectedErr string }{ - {"ShouldParseBasicAddress", "tcp://0.0.0.0:9091", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 9091}, "0.0.0.0:9091", "tcp://0.0.0.0:9091", ""}, - {"ShouldParseEmptyAddress", "", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 0}, "0.0.0.0:0", "tcp://0.0.0.0:0", ""}, - {"ShouldParseAddressMissingScheme", "0.0.0.0:9091", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 9091}, "0.0.0.0:9091", "tcp://0.0.0.0:9091", ""}, - {"ShouldParseAddressMissingPort", "tcp://0.0.0.0", &Address{true, "tcp", net.ParseIP("0.0.0.0"), 0}, "0.0.0.0:0", "tcp://0.0.0.0:0", ""}, - {"ShouldNotParseUnknownScheme", "a://0.0.0.0", nil, "", "", "could not parse scheme for address 'a://0.0.0.0': scheme 'a' is not valid, expected to be one of 'tcp://', 'udp://'"}, - {"ShouldNotParseInvalidPort", "tcp://0.0.0.0:abc", nil, "", "", "could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [://][:]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host"}, - {"ShouldNotParseInvalidIP", "tcp://example.com:9091", nil, "", "", "could not parse ip for address 'tcp://example.com:9091': example.com does not appear to be an IP"}, - {"ShouldNotParseInvalidAddress", "@$@#%@#$@@", nil, "", "", "could not parse string '@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\""}, - {"ShouldNotParseInvalidAddressWithScheme", "tcp://@$@#%@#$@@", nil, "", "", "could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\""}, + { + "ShouldParseBasicAddress", + "tcp://0.0.0.0:9091", + &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + "0.0.0.0:9091", + "tcp://0.0.0.0:9091", + "", + }, + { + "ShouldParseEmptyAddress", + "", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, + ":0", + "tcp://:0", + "", + }, + { + "ShouldParseAddressMissingScheme", + "0.0.0.0:9091", + &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + "0.0.0.0:9091", + "tcp://0.0.0.0:9091", + "", + }, + { + "ShouldParseUnixAddressMissingScheme", + "/var/run/example.sock", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}}, + "/var/run/example.sock", + "unix:///var/run/example.sock", + "", + }, + { + "ShouldParseAddressMissingPort", + "tcp://0.0.0.0", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}}, + "0.0.0.0:0", + "tcp://0.0.0.0:0", + "", + }, + { + "ShouldParseUnixSocket", + "unix:///path/to/a/socket.sock", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}}, + "/path/to/a/socket.sock", + "unix:///path/to/a/socket.sock", + "", + }, + { + "ShouldNotParseUnixSocketWithHost", + "unix://ahost/path/to/a/socket.sock", + nil, + "", + "", + "error validating the unix socket address: the url 'unix://ahost/path/to/a/socket.sock' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", + }, + { + "ShouldNotParseUnixSocketWithoutPath", + "unix://nopath.com", + nil, + "", + "", + "error validating the unix socket address: could not determine path from 'unix://nopath.com'", + }, + { + "ShouldNotParseUnixSocketWithQuery", + "unix:///path/to/a/socket.sock?q=yes", + nil, + "", + "", + "error validating the address: the url 'unix:///path/to/a/socket.sock?q=yes' appears to have a query but this is not valid for addresses", + }, + { + "ShouldNotParseUnixSocketWithFragment", + "unix:///path/to/a/socket.sock#example", + nil, + "", + "", + "error validating the address: the url 'unix:///path/to/a/socket.sock#example' appears to have a fragment but this is not valid for addresses", + }, + { + "ShouldNotParseUnixSocketWithUserInfo", + "unix://user:example@/path/to/a/socket.sock", + nil, + "", + "", + "error validating the address: the url 'unix://user:example@/path/to/a/socket.sock' appears to have user info but this is not valid for addresses", + }, + { + "ShouldParseUnknownScheme", + "a://0.0.0.0", + &Address{true, false, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}}, + "0.0.0.0", + "a://0.0.0.0", + "", + }, + { + "ShouldNotParseInvalidPort", + "tcp://0.0.0.0:abc", + nil, + "", + "", + "could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [://][:]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host", + }, + { + "ShouldNotParseInvalidAddress", + "@$@#%@#$@@", + nil, + "", + "", + "could not parse string '@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", + }, + { + "ShouldNotParseInvalidAddressWithScheme", + "tcp://@$@#%@#$@@", + nil, + "", + "", + "could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", + }, + { + "ShouldSetDefaultPortLDAP", + "ldap://127.0.0.1", + &Address{true, false, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}}, + "127.0.0.1:389", + "ldap://127.0.0.1:389", + "", + }, + { + "ShouldSetDefaultPortLDAPS", + "ldaps://127.0.0.1", + &Address{true, false, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}}, + "127.0.0.1:636", + "ldaps://127.0.0.1:636", + "", + }, + { + "ShouldAllowLDAPI", + "ldapi:///abc", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}}, + "/abc", + "ldapi:///abc", + "", + }, + { + "ShouldAllowImplicitLDAPI", + "ldapi://", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + "", + "ldapi:", + "", + }, + { + "ShouldAllowImplicitLDAPINoSlash", + "ldapi:", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + "", + "ldapi:", + "", + }, + { + "ShouldSetDefaultPortSMTP", + "smtp://127.0.0.1", + &Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}}, + "127.0.0.1:25", + "smtp://127.0.0.1:25", + "", + }, + { + "ShouldSetDefaultPortSUBMISSION", + "submission://127.0.0.1", + &Address{true, false, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}}, + "127.0.0.1:587", + "submission://127.0.0.1:587", + "", + }, + { + "ShouldSetDefaultPortSUBMISSIONS", + "submissions://127.0.0.1", + &Address{true, false, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}}, + "127.0.0.1:465", + "submissions://127.0.0.1:465", + "", + }, + { + "ShouldNotOverridePort", + "ldap://127.0.0.1:123", + &Address{true, false, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}}, + "127.0.0.1:123", + "ldap://127.0.0.1:123", + "", + }, } for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { - actual, actualErr := NewAddressFromString(tc.have) + actual, actualErr := NewAddress(tc.have) if len(tc.expectedErr) != 0 { assert.EqualError(t, actualErr, tc.expectedErr) } else { assert.Nil(t, actualErr) - assert.Equal(t, actual.HostPort(), tc.expectedHostPort) - assert.Equal(t, actual.String(), tc.expectedString) + assert.Equal(t, tc.expectedAddress, actual.NetworkAddress()) + assert.Equal(t, tc.expectedString, actual.String()) + + assert.True(t, actual.Valid()) } assert.Equal(t, tc.expected, actual) + }) + } +} - if actual != nil { - assert.True(t, actual.Valid()) - assert.NotEmpty(t, actual.String()) - assert.NotEmpty(t, actual.HostPort()) +func TestAddress_ValidateErrors(t *testing.T) { + testCases := []struct { + name string + have *Address + expectedLDAP, expectedSMTP, expectedHTTP, expectedListener string + }{ + { + "ShouldValidateLDAPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}}, + "", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'ldap'", + }, + { + "ShouldValidateSMTPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'", + "", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'smtp'", + }, + { + "ShouldValidateTCPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'tcp'", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'tcp'", + "", + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + if tc.expectedLDAP == "" { + assert.NoError(t, tc.have.ValidateLDAP()) + } else { + assert.EqualError(t, tc.have.ValidateLDAP(), tc.expectedLDAP) } + + if tc.expectedSMTP == "" { + assert.NoError(t, tc.have.ValidateSMTP()) + } else { + assert.EqualError(t, tc.have.ValidateSMTP(), tc.expectedSMTP) + } + + if tc.expectedListener == "" { + assert.NoError(t, tc.have.ValidateListener()) + } else { + assert.EqualError(t, tc.have.ValidateListener(), tc.expectedListener) + } + + if tc.expectedHTTP == "" { + assert.NoError(t, tc.have.ValidateHTTP()) + } else { + assert.EqualError(t, tc.have.ValidateHTTP(), tc.expectedHTTP) + } + }) + } +} + +func TestAddress_SetHostname(t *testing.T) { + address := &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}} + + assert.Equal(t, "tcp://0.0.0.0", address.String()) + + address.SetHostname("127.0.0.1") + + assert.Equal(t, "tcp://127.0.0.1", address.String()) +} + +func TestAddress_ListenerWithUMask(t *testing.T) { + dir := t.TempDir() + + address := &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: filepath.Join(dir, "example.sock")}} + + ln, err := address.ListenerWithUMask(600) + + assert.NotNil(t, ln) + assert.NoError(t, err) + assert.NoError(t, ln.Close()) + + address = &Address{true, true, 0, nil} + + ln, err = address.ListenerWithUMask(600) + + assert.Nil(t, ln) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 0, nil} + + ln, err = address.ListenerWithUMask(600) + + assert.Nil(t, ln) + assert.EqualError(t, err, "address url is nil") +} + +func TestAddressOutputValues(t *testing.T) { + var ( + address *Address + listener net.Listener + err error + ) + + address = &Address{} + assert.EqualError(t, address.validate(), "error validating the address: address url was nil") + + address = &Address{false, false, 0, nil} + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}} + + assert.Equal(t, "tcp://0.0.0.0:8080", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:8080", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:8080", address.NetworkAddress()) + assert.Equal(t, 8080, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + address = &Address{true, false, 0, nil} + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address.SetHostname("abc123.com") + address.SetPort(50) + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}} + + assert.Equal(t, "tcp://0.0.0.0:9091", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:9091", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:9091", address.NetworkAddress()) + assert.Equal(t, 9091, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + assert.NoError(t, listener.Close()) + + address.SetPort(9092) + + assert.Equal(t, "tcp://0.0.0.0:9092", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:9092", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:9092", address.NetworkAddress()) + assert.Equal(t, 9092, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + assert.NoError(t, listener.Close()) + + address.SetHostname("example.com") + + assert.Equal(t, "tcp://example.com:9092", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "example.com:9092", address.Host()) + assert.Equal(t, "example.com", address.Hostname()) + assert.Equal(t, "example.com:9092", address.NetworkAddress()) + assert.Equal(t, 9092, address.Port()) +} + +func TestNewTLSVersion(t *testing.T) { + testCases := []struct { + name string + have string + expected *TLSVersion + err string + }{ + { + "ShouldParseTLS1.3", + "TLS1.3", + &TLSVersion{Value: tls.VersionTLS13}, + "", + }, + { + "ShouldParse1.3", + "1.3", + &TLSVersion{Value: tls.VersionTLS13}, + "", + }, + { + "ShouldParseTLS1.2", + "TLS1.2", + &TLSVersion{Value: tls.VersionTLS12}, + "", + }, + { + "ShouldParse1.2", + "1.2", + &TLSVersion{Value: tls.VersionTLS12}, + "", + }, + { + "ShouldParseTLS1.1", + "TLS1.1", + &TLSVersion{Value: tls.VersionTLS11}, + "", + }, + { + "ShouldParse1.1", + "1.1", + &TLSVersion{Value: tls.VersionTLS11}, + "", + }, + { + "ShouldParseTLS1.0", + "TLS1.0", + &TLSVersion{Value: tls.VersionTLS10}, + "", + }, + { + "ShouldParse1.0", + "1.0", + &TLSVersion{Value: tls.VersionTLS10}, + "", + }, + { + "ShouldParseSSL3.0", + "SSL3.0", + &TLSVersion{Value: tls.VersionSSL30}, //nolint:staticcheck + "", + }, + { + "ShouldNotParse3.0", + "3.0", + nil, + "supplied tls version isn't supported", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + actual, theError := NewTLSVersion(tc.have) + + if tc.err == "" { + assert.NoError(t, theError) + assert.Equal(t, tc.expected, actual) + } else { + assert.EqualError(t, theError, tc.err) + assert.Nil(t, actual) + } + }) + } +} + +func TestTLSVersion_Functions(t *testing.T) { + type expected struct { + min, max uint16 + str string + } + + testCases := []struct { + name string + have *TLSVersion + expected expected + }{ + { + "ShouldReturnCorrectValuesNotConfigured", + &TLSVersion{}, + expected{ + tls.VersionTLS12, + tls.VersionTLS13, + "", + }, + }, + { + "ShouldReturnCorrectValueTLS1.3", + &TLSVersion{Value: tls.VersionTLS13}, + expected{ + tls.VersionTLS13, + tls.VersionTLS13, + "TLS1.3", + }, + }, + { + "ShouldReturnCorrectValueTLS1.2", + &TLSVersion{Value: tls.VersionTLS12}, + expected{ + tls.VersionTLS12, + tls.VersionTLS12, + "TLS1.2", + }, + }, + { + "ShouldReturnCorrectValueTLS1.1", + &TLSVersion{Value: tls.VersionTLS11}, + expected{ + tls.VersionTLS11, + tls.VersionTLS11, + "TLS1.1", + }, + }, + { + "ShouldReturnCorrectValueTLS1.0", + &TLSVersion{Value: tls.VersionTLS10}, + expected{ + tls.VersionTLS10, + tls.VersionTLS10, + "TLS1.0", + }, + }, + { + "ShouldReturnCorrectValueSSL3.0", + &TLSVersion{Value: tls.VersionSSL30}, //nolint:staticcheck + expected{ + tls.VersionSSL30, //nolint:staticcheck + tls.VersionSSL30, //nolint:staticcheck + "SSL3.0", + }, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.expected.min, tc.have.MinVersion()) + assert.Equal(t, tc.expected.max, tc.have.MaxVersion()) + assert.Equal(t, tc.expected.str, tc.have.String()) }) } } diff --git a/internal/configuration/template_test.go b/internal/configuration/template_test.go index aab4b26ae..909b85b9d 100644 --- a/internal/configuration/template_test.go +++ b/internal/configuration/template_test.go @@ -25,7 +25,7 @@ func TestShouldGenerateConfiguration(t *testing.T) { assert.NoError(t, err) } -func TestNotShouldGenerateConfigurationifExists(t *testing.T) { +func TestNotShouldGenerateConfigurationIfExists(t *testing.T) { dir := t.TempDir() cfg := filepath.Join(dir, "config.yml") diff --git a/internal/configuration/test_resources/config.filtered.yml b/internal/configuration/test_resources/config.filtered.yml index 0a5d84daf..8917d3253 100644 --- a/internal/configuration/test_resources/config.filtered.yml +++ b/internal/configuration/test_resources/config.filtered.yml @@ -2,8 +2,7 @@ default_redirection_url: 'https://home.{{ env "ROOT_DOMAIN" }}:8080/' server: - host: '{{ env "SERVICES_SERVER" }}' - port: 9091 + address: 'tcp://{{ env "SERVICES_SERVER" }}:9091' log: level: debug diff --git a/internal/configuration/test_resources/config.yml b/internal/configuration/test_resources/config.yml index 3d6437343..9705b64f6 100644 --- a/internal/configuration/test_resources/config.yml +++ b/internal/configuration/test_resources/config.yml @@ -2,8 +2,7 @@ default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" endpoints: authz: forward-auth: diff --git a/internal/configuration/test_resources/config_alt.yml b/internal/configuration/test_resources/config_alt.yml index 7f20e787e..6697bd4b7 100644 --- a/internal/configuration/test_resources/config_alt.yml +++ b/internal/configuration/test_resources/config_alt.yml @@ -2,8 +2,7 @@ default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" log: level: debug diff --git a/internal/configuration/test_resources/config_bad_keys.yml b/internal/configuration/test_resources/config_bad_keys.yml index d0bcacd1e..8d27b1f67 100644 --- a/internal/configuration/test_resources/config_bad_keys.yml +++ b/internal/configuration/test_resources/config_bad_keys.yml @@ -6,8 +6,7 @@ logs_level: debug default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" totp: issuer: authelia.com diff --git a/internal/configuration/test_resources/config_bad_quoting.yml b/internal/configuration/test_resources/config_bad_quoting.yml index 90613b2d0..59db7a7d6 100644 --- a/internal/configuration/test_resources/config_bad_quoting.yml +++ b/internal/configuration/test_resources/config_bad_quoting.yml @@ -4,8 +4,7 @@ jwt_secret: RUtG9TnbXrOl1XLLmDgySw1DGgx9QcrtepIf1uDDBlBVKFZxkVBruYKBi32PvaU default_redirection_url: example.com server: - host: 0.0.0.0 - port: 9091 + address: "tcp://0.0.0.0:9091" log: level: debug diff --git a/internal/configuration/test_resources/config_domain_bad_regex.yml b/internal/configuration/test_resources/config_domain_bad_regex.yml index 37147b8d5..4e7be7ad4 100644 --- a/internal/configuration/test_resources/config_domain_bad_regex.yml +++ b/internal/configuration/test_resources/config_domain_bad_regex.yml @@ -2,8 +2,7 @@ default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" log: level: debug diff --git a/internal/configuration/test_resources/config_domain_regex.yml b/internal/configuration/test_resources/config_domain_regex.yml index 24f194f8b..360e1787c 100644 --- a/internal/configuration/test_resources/config_domain_regex.yml +++ b/internal/configuration/test_resources/config_domain_regex.yml @@ -2,8 +2,7 @@ default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" log: level: debug diff --git a/internal/configuration/test_resources/config_oidc.yml b/internal/configuration/test_resources/config_oidc.yml index 94a76e0bb..da72366a0 100644 --- a/internal/configuration/test_resources/config_oidc.yml +++ b/internal/configuration/test_resources/config_oidc.yml @@ -2,8 +2,7 @@ default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" log: level: debug diff --git a/internal/configuration/test_resources/config_smtp_sender_blank.yml b/internal/configuration/test_resources/config_smtp_sender_blank.yml index a07eeb60a..3af9013c0 100644 --- a/internal/configuration/test_resources/config_smtp_sender_blank.yml +++ b/internal/configuration/test_resources/config_smtp_sender_blank.yml @@ -2,8 +2,7 @@ default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" log: level: debug diff --git a/internal/configuration/test_resources/config_smtp_sender_invalid.yml b/internal/configuration/test_resources/config_smtp_sender_invalid.yml index 255c01bb1..9d0dc5b25 100644 --- a/internal/configuration/test_resources/config_smtp_sender_invalid.yml +++ b/internal/configuration/test_resources/config_smtp_sender_invalid.yml @@ -2,8 +2,7 @@ default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" log: level: debug diff --git a/internal/configuration/test_resources/config_with_secret.yml b/internal/configuration/test_resources/config_with_secret.yml index e97d9391c..6efca13c9 100644 --- a/internal/configuration/test_resources/config_with_secret.yml +++ b/internal/configuration/test_resources/config_with_secret.yml @@ -4,8 +4,7 @@ jwt_secret: secret_from_config default_redirection_url: https://home.example.com:8080/ server: - host: 127.0.0.1 - port: 9091 + address: "tcp://127.0.0.1:9091" log: level: debug diff --git a/internal/configuration/validator/configuration_test.go b/internal/configuration/validator/configuration_test.go index f40aaea1c..d39de0ff2 100644 --- a/internal/configuration/validator/configuration_test.go +++ b/internal/configuration/validator/configuration_test.go @@ -13,8 +13,7 @@ import ( func newDefaultConfig() schema.Configuration { config := schema.Configuration{} - config.Server.Host = loopback - config.Server.Port = 9090 + config.Server.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues("tcp", loopback, 9090)} config.Log.Level = "info" config.Log.Format = "text" config.JWTSecret = testJWTSecret diff --git a/internal/configuration/validator/const.go b/internal/configuration/validator/const.go index 29922efe7..8191de1eb 100644 --- a/internal/configuration/validator/const.go +++ b/internal/configuration/validator/const.go @@ -136,7 +136,7 @@ const ( // Telemetry Error constants. const ( - errFmtTelemetryMetricsScheme = "telemetry: metrics: option 'address' must have a scheme 'tcp://' but it's configured as '%s'" + errFmtTelemetryMetricsAddress = "telemetry: metrics: option 'address' with value '%s' is invalid: %w" ) // OpenID Error constants. @@ -283,12 +283,16 @@ const ( // Server Error constants. const ( - errFmtServerTLSCert = "server: tls: option 'key' must also be accompanied by option 'certificate'" - errFmtServerTLSKey = "server: tls: option 'certificate' must also be accompanied by option 'key'" - errFmtServerTLSCertFileDoesNotExist = "server: tls: file path %s provided in 'certificate' does not exist" - errFmtServerTLSKeyFileDoesNotExist = "server: tls: file path %s provided in 'key' does not exist" - errFmtServerTLSClientAuthCertFileDoesNotExist = "server: tls: client_certificates: certificates: file path %s does not exist" - errFmtServerTLSClientAuthNoAuth = "server: tls: client authentication cannot be configured if no server certificate and key are provided" + errFmtServerTLSCert = "server: tls: option 'key' must also be accompanied by option 'certificate'" + errFmtServerTLSKey = "server: tls: option 'certificate' must also be accompanied by option 'key'" + errFmtServerTLSFileNotExist = "server: tls: option '%s' the file '%s' does not exist" + errFmtServerTLSFileNotExistErr = "server: tls: option '%s' could not determine if the file '%s' exists: %w" + + errFmtServerTLSClientAuthNoAuth = "server: tls: client authentication cannot be configured if no server certificate and key are provided" + + errFmtServerAddressWarnLegacy = "server: option 'address' replaces options 'host' and 'port': these will automatically be mapped for you but we recommend adjusting your configuration: the equivalent address value based on your configuration is 'tcp://%s:%d'" + errFmtServerAddressLegacyAndModern = "server: option 'host' and 'port' can't be configured at the same time as 'address'" + errFmtServerAddress = "server: option 'address' with value '%s' is invalid: %w" errFmtServerPathNoForwardSlashes = "server: option 'path' must not contain any forward slashes" errFmtServerPathAlphaNum = "server: option 'path' must only contain alpha numeric characters" diff --git a/internal/configuration/validator/const_test.go b/internal/configuration/validator/const_test.go index 1eea835ba..c691551e7 100644 --- a/internal/configuration/validator/const_test.go +++ b/internal/configuration/validator/const_test.go @@ -14,3 +14,7 @@ const ( const ( exampleDotCom = "example.com" ) + +const ( + local25 = "127.0.0.25" +) diff --git a/internal/configuration/validator/server.go b/internal/configuration/validator/server.go index c38850634..6b71a00b0 100644 --- a/internal/configuration/validator/server.go +++ b/internal/configuration/validator/server.go @@ -10,18 +10,6 @@ import ( "github.com/authelia/authelia/v4/internal/utils" ) -// validateFileExists checks whether a file exist. -func validateFileExists(path string, validator *schema.StructValidator, errTemplate string) { - exist, err := utils.FileExists(path) - if err != nil { - validator.Push(fmt.Errorf("tls: unable to check if file %s exists: %s", path, err)) - } - - if !exist { - validator.Push(fmt.Errorf(errTemplate, path)) - } -} - // ValidateServerTLS checks a server TLS configuration is correct. func ValidateServerTLS(config *schema.Configuration, validator *schema.StructValidator) { if config.Server.TLS.Key != "" && config.Server.TLS.Certificate == "" { @@ -31,11 +19,11 @@ func ValidateServerTLS(config *schema.Configuration, validator *schema.StructVal } if config.Server.TLS.Key != "" { - validateFileExists(config.Server.TLS.Key, validator, errFmtServerTLSKeyFileDoesNotExist) + validateFileExists(config.Server.TLS.Key, validator, "key") } if config.Server.TLS.Certificate != "" { - validateFileExists(config.Server.TLS.Certificate, validator, errFmtServerTLSCertFileDoesNotExist) + validateFileExists(config.Server.TLS.Certificate, validator, "certificate") } if config.Server.TLS.Key == "" && config.Server.TLS.Certificate == "" && @@ -44,20 +32,13 @@ func ValidateServerTLS(config *schema.Configuration, validator *schema.StructVal } for _, clientCertPath := range config.Server.TLS.ClientCertificates { - validateFileExists(clientCertPath, validator, errFmtServerTLSClientAuthCertFileDoesNotExist) + validateFileExists(clientCertPath, validator, "client_certificates") } } -// ValidateServer checks a server configuration is correct. +// ValidateServer checks the server configuration is correct. func ValidateServer(config *schema.Configuration, validator *schema.StructValidator) { - if config.Server.Host == "" { - config.Server.Host = schema.DefaultServerConfiguration.Host - } - - if config.Server.Port == 0 { - config.Server.Port = schema.DefaultServerConfiguration.Port - } - + ValidateServerAddress(config, validator) ValidateServerTLS(config, validator) switch { @@ -94,6 +75,38 @@ func ValidateServer(config *schema.Configuration, validator *schema.StructValida ValidateServerEndpoints(config, validator) } +// ValidateServerAddress checks the configured server address is correct. +func ValidateServerAddress(config *schema.Configuration, validator *schema.StructValidator) { + if config.Server.Address == nil { + if config.Server.Host == "" && config.Server.Port == 0 { //nolint:staticcheck + config.Server.Address = schema.DefaultServerConfiguration.Address + } else { + host := config.Server.Host //nolint:staticcheck + port := config.Server.Port //nolint:staticcheck + + if host == "" { + host = schema.DefaultServerConfiguration.Address.Hostname() + } + + if port == 0 { + port = schema.DefaultServerConfiguration.Address.Port() + } + + config.Server.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeTCP, host, port)} + } + } else { + if config.Server.Host != "" || config.Server.Port != 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtServerAddressLegacyAndModern)) + } + + var err error + + if err = config.Server.Address.ValidateHTTP(); err != nil { + validator.Push(fmt.Errorf(errFmtServerAddress, config.Server.Address.String(), err)) + } + } +} + // ValidateServerEndpoints configures the default endpoints and checks the configuration of custom endpoints. func ValidateServerEndpoints(config *schema.Configuration, validator *schema.StructValidator) { if config.Server.Endpoints.EnableExpvars { @@ -184,3 +197,13 @@ func validateServerEndpointsAuthzStrategies(name string, strategies []schema.Ser } } } + +// validateFileExists checks whether a file exist. +func validateFileExists(path string, validator *schema.StructValidator, opt string) { + exist, err := utils.FileExists(path) + if err != nil { + validator.Push(fmt.Errorf(errFmtServerTLSFileNotExistErr, opt, path, err)) + } else if !exist { + validator.Push(fmt.Errorf(errFmtServerTLSFileNotExist, opt, path)) + } +} diff --git a/internal/configuration/validator/server_test.go b/internal/configuration/validator/server_test.go index cf330d393..82af45386 100644 --- a/internal/configuration/validator/server_test.go +++ b/internal/configuration/validator/server_test.go @@ -22,8 +22,9 @@ func TestShouldSetDefaultServerValues(t *testing.T) { assert.Len(t, validator.Errors(), 0) assert.Len(t, validator.Warnings(), 0) - assert.Equal(t, schema.DefaultServerConfiguration.Host, config.Server.Host) - assert.Equal(t, schema.DefaultServerConfiguration.Port, config.Server.Port) + assert.Equal(t, "", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 0, config.Server.Port) //nolint:staticcheck + assert.Equal(t, schema.DefaultServerConfiguration.Address, config.Server.Address) assert.Equal(t, schema.DefaultServerConfiguration.Buffers.Read, config.Server.Buffers.Read) assert.Equal(t, schema.DefaultServerConfiguration.Buffers.Write, config.Server.Buffers.Write) assert.Equal(t, schema.DefaultServerConfiguration.TLS.Key, config.Server.TLS.Key) @@ -63,6 +64,62 @@ func TestShouldParsePathCorrectly(t *testing.T) { assert.Equal(t, "/apple", config.Server.Path) } +func TestValidateServerShouldCorrectlyIdentifyValidAddressSchemes(t *testing.T) { + testCases := []struct { + have string + expected string + }{ + {schema.AddressSchemeTCP, ""}, + {schema.AddressSchemeTCP4, ""}, + {schema.AddressSchemeTCP6, ""}, + {schema.AddressSchemeUDP, "server: option 'address' with value 'udp://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp'"}, + {schema.AddressSchemeUDP4, "server: option 'address' with value 'udp4://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp4'"}, + {schema.AddressSchemeUDP6, "server: option 'address' with value 'udp6://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp6'"}, + {schema.AddressSchemeUnix, ""}, + {"http", "server: option 'address' with value 'http://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'http'"}, + } + + have := &schema.Configuration{ + Server: schema.ServerConfiguration{ + Buffers: schema.ServerBuffers{ + Read: -1, + Write: -1, + }, + Timeouts: schema.ServerTimeouts{ + Read: time.Second * -1, + Write: time.Second * -1, + Idle: time.Second * -1, + }, + }, + } + + validator := schema.NewStructValidator() + + for _, tc := range testCases { + t.Run(tc.have, func(t *testing.T) { + validator.Clear() + + switch tc.have { + case schema.AddressSchemeUnix: + have.Server.Address = &schema.AddressTCP{Address: schema.NewAddressUnix("/path/to/authelia.sock")} + default: + have.Server.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(tc.have, "", 9091)} + } + + ValidateServer(have, validator) + + assert.Len(t, validator.Warnings(), 0) + + if tc.expected == "" { + assert.Len(t, validator.Errors(), 0) + } else { + require.Len(t, validator.Errors(), 1) + assert.EqualError(t, validator.Errors()[0], tc.expected) + } + }) + } +} + func TestShouldDefaultOnNegativeValues(t *testing.T) { validator := schema.NewStructValidator() config := &schema.Configuration{ @@ -121,15 +178,43 @@ func TestShouldRaiseOnForwardSlashInPath(t *testing.T) { assert.Error(t, validator.Errors()[0], "server path must not contain any forward slashes") } -func TestShouldValidateAndUpdateHost(t *testing.T) { +func TestShouldValidateAndUpdateAddress(t *testing.T) { validator := schema.NewStructValidator() config := newDefaultConfig() - config.Server.Host = "" + config.Server.Address = nil ValidateServer(&config, validator) require.Len(t, validator.Errors(), 0) - assert.Equal(t, "0.0.0.0", config.Server.Host) + assert.Equal(t, "tcp://:9091", config.Server.Address.String()) +} + +func TestShouldRaiseErrorOnLegacyAndModernValues(t *testing.T) { + validator := schema.NewStructValidator() + config := newDefaultConfig() + config.Server.Host = local25 //nolint:staticcheck + config.Server.Port = 9999 //nolint:staticcheck + + ValidateServer(&config, validator) + + require.Len(t, validator.Errors(), 1) + assert.EqualError(t, validator.Errors()[0], "server: option 'host' and 'port' can't be configured at the same time as 'address'") +} + +func TestShouldValidateAndUpdateAddressWithOldValues(t *testing.T) { + validator := schema.NewStructValidator() + config := newDefaultConfig() + config.Server.Address = nil + config.Server.Host = local25 //nolint:staticcheck + config.Server.Port = 9999 //nolint:staticcheck + + ValidateServer(&config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + require.NotNil(t, config.Server.Address) + assert.Equal(t, "tcp://127.0.0.25:9999", config.Server.Address.String()) } func TestShouldRaiseErrorWhenTLSCertWithoutKeyIsProvided(t *testing.T) { @@ -162,7 +247,7 @@ func TestShouldRaiseErrorWhenTLSCertDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: file path /tmp/unexisting_file provided in 'certificate' does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'certificate' the file '/tmp/unexisting_file' does not exist") } func TestShouldRaiseErrorWhenTLSKeyWithoutCertIsProvided(t *testing.T) { @@ -195,7 +280,7 @@ func TestShouldRaiseErrorWhenTLSKeyDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: file path /tmp/unexisting_file provided in 'key' does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'key' the file '/tmp/unexisting_file' does not exist") } func TestShouldNotRaiseErrorWhenBothTLSCertificateAndKeyAreProvided(t *testing.T) { @@ -239,7 +324,7 @@ func TestShouldRaiseErrorWhenTLSClientCertificateDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: client_certificates: certificates: file path /tmp/unexisting does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'client_certificates' the file '/tmp/unexisting' does not exist") } func TestShouldRaiseErrorWhenTLSClientAuthIsDefinedButNotServerCertificate(t *testing.T) { @@ -265,19 +350,7 @@ func TestShouldNotUpdateConfig(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 0) - assert.Equal(t, 9090, config.Server.Port) - assert.Equal(t, loopback, config.Server.Host) -} - -func TestShouldValidateAndUpdatePort(t *testing.T) { - validator := schema.NewStructValidator() - config := newDefaultConfig() - config.Server.Port = 0 - - ValidateServer(&config, validator) - - require.Len(t, validator.Errors(), 0) - assert.Equal(t, 9091, config.Server.Port) + assert.Equal(t, "tcp://127.0.0.1:9090", config.Server.Address.String()) } func TestServerEndpointsDevelShouldWarn(t *testing.T) { diff --git a/internal/configuration/validator/telemetry.go b/internal/configuration/validator/telemetry.go index 8dc592e22..39c49273d 100644 --- a/internal/configuration/validator/telemetry.go +++ b/internal/configuration/validator/telemetry.go @@ -12,15 +12,12 @@ func ValidateTelemetry(config *schema.Configuration, validator *schema.StructVal config.Telemetry.Metrics.Address = schema.DefaultTelemetryConfig.Metrics.Address } - switch config.Telemetry.Metrics.Address.Scheme { - case "tcp": - break - default: - validator.Push(fmt.Errorf(errFmtTelemetryMetricsScheme, config.Telemetry.Metrics.Address.Scheme)) + if err := config.Telemetry.Metrics.Address.ValidateHTTP(); err != nil { + validator.Push(fmt.Errorf(errFmtTelemetryMetricsAddress, config.Telemetry.Metrics.Address.String(), err)) } - if config.Telemetry.Metrics.Address.Port == 0 { - config.Telemetry.Metrics.Address.Port = schema.DefaultTelemetryConfig.Metrics.Address.Port + if config.Telemetry.Metrics.Address.Port() == 0 { + config.Telemetry.Metrics.Address.SetPort(schema.DefaultTelemetryConfig.Metrics.Address.Port()) } if config.Telemetry.Metrics.Buffers.Read <= 0 { diff --git a/internal/configuration/validator/telemetry_test.go b/internal/configuration/validator/telemetry_test.go index 1643a5c40..e75ca5ca1 100644 --- a/internal/configuration/validator/telemetry_test.go +++ b/internal/configuration/validator/telemetry_test.go @@ -2,6 +2,7 @@ package validator import ( "testing" + "time" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" @@ -10,13 +11,13 @@ import ( ) func TestValidateTelemetry(t *testing.T) { - mustParseAddress := func(a string) *schema.Address { - addr, err := schema.NewAddressFromString(a) + mustParseAddress := func(a string) *schema.AddressTCP { + addr, err := schema.NewAddress(a) if err != nil { panic(err) } - return addr + return &schema.AddressTCP{Address: *addr} } testCases := []struct { @@ -35,13 +36,26 @@ func TestValidateTelemetry(t *testing.T) { { "ShouldSetDefaultPort", &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("tcp://0.0.0.0")}}}, - &schema.Configuration{Telemetry: schema.DefaultTelemetryConfig}, + &schema.Configuration{Telemetry: schema.TelemetryConfig{ + Metrics: schema.TelemetryMetricsConfig{ + Address: &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeTCP, "0.0.0.0", schema.DefaultTelemetryConfig.Metrics.Address.Port())}, + Buffers: schema.ServerBuffers{ + Read: 4096, + Write: 4096, + }, + Timeouts: schema.ServerTimeouts{ + Read: time.Second * 6, + Write: time.Second * 6, + Idle: time.Second * 30, + }, + }, + }}, nil, nil, }, { "ShouldSetDefaultPortAlt", - &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("tcp://0.0.0.0:0")}}}, + &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("tcp://:0")}}}, &schema.Configuration{Telemetry: schema.DefaultTelemetryConfig}, nil, nil, @@ -58,7 +72,7 @@ func TestValidateTelemetry(t *testing.T) { &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("udp://0.0.0.0")}}}, &schema.Configuration{Telemetry: schema.TelemetryConfig{Metrics: schema.TelemetryMetricsConfig{Address: mustParseAddress("udp://0.0.0.0:9959")}}}, nil, - []string{"telemetry: metrics: option 'address' must have a scheme 'tcp://' but it's configured as 'udp'"}, + []string{"telemetry: metrics: option 'address' with value 'udp://0.0.0.0:0' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp'"}, }, } @@ -99,3 +113,47 @@ func TestValidateTelemetry(t *testing.T) { }) } } + +func TestValidateTelemetryShouldCorrectlyIdentifyValidAddressSchemes(t *testing.T) { + testCases := []struct { + have string + expected string + }{ + {schema.AddressSchemeTCP, ""}, + {schema.AddressSchemeTCP4, ""}, + {schema.AddressSchemeTCP6, ""}, + {schema.AddressSchemeUDP, "telemetry: metrics: option 'address' with value 'udp://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp'"}, + {schema.AddressSchemeUDP4, "telemetry: metrics: option 'address' with value 'udp4://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp4'"}, + {schema.AddressSchemeUDP6, "telemetry: metrics: option 'address' with value 'udp6://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'udp6'"}, + {schema.AddressSchemeUnix, ""}, + {"http", "telemetry: metrics: option 'address' with value 'http://:9091' is invalid: scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'http'"}, + } + + have := &schema.Configuration{} + + validator := schema.NewStructValidator() + + for _, tc := range testCases { + t.Run(tc.have, func(t *testing.T) { + validator.Clear() + + switch tc.have { + case schema.AddressSchemeUnix: + have.Telemetry.Metrics.Address = &schema.AddressTCP{Address: schema.NewAddressUnix("/path/to/authelia.sock")} + default: + have.Telemetry.Metrics.Address = &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues(tc.have, "", 9091)} + } + + ValidateTelemetry(have, validator) + + assert.Len(t, validator.Warnings(), 0) + + if tc.expected == "" { + assert.Len(t, validator.Errors(), 0) + } else { + require.Len(t, validator.Errors(), 1) + assert.EqualError(t, validator.Errors()[0], tc.expected) + } + }) + } +} diff --git a/internal/server/server.go b/internal/server/server.go index 1841cfaa7..d1f83c9f7 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -6,7 +6,6 @@ import ( "fmt" "net" "os" - "strconv" "github.com/sirupsen/logrus" "github.com/valyala/fasthttp" @@ -34,12 +33,21 @@ func CreateDefaultServer(config *schema.Configuration, providers middlewares.Pro Logger: logging.LoggerPrintf(logrus.DebugLevel), } - address := net.JoinHostPort(config.Server.Host, strconv.Itoa(config.Server.Port)) - var ( - connectionScheme string + connectionScheme = schemeHTTP ) + switch config.Server.UMask { + case nil: + listener, err = config.Server.Address.Listener() + default: + listener, err = config.Server.Address.ListenerWithUMask(*config.Server.UMask) + } + + if err != nil { + return nil, nil, nil, false, fmt.Errorf("error occurred while attempting to initialize main server listener for address '%s': %w", config.Server.Address.String(), err) + } + if config.Server.TLS.Certificate != "" && config.Server.TLS.Key != "" { isTLS, connectionScheme = true, schemeHTTPS @@ -66,19 +74,11 @@ func CreateDefaultServer(config *schema.Configuration, providers middlewares.Pro server.TLSConfig.ClientAuth = tls.RequireAndVerifyClientCert } - if listener, err = tls.Listen("tcp", address, server.TLSConfig.Clone()); err != nil { - return nil, nil, nil, false, fmt.Errorf("unable to initialize tcp listener: %w", err) - } - } else { - connectionScheme = schemeHTTP - - if listener, err = net.Listen("tcp", address); err != nil { - return nil, nil, nil, false, fmt.Errorf("unable to initialize tcp listener: %w", err) - } + listener = tls.NewListener(listener, server.TLSConfig.Clone()) } - if err = writeHealthCheckEnv(config.Server.DisableHealthcheck, connectionScheme, config.Server.Host, - config.Server.Path, config.Server.Port); err != nil { + if err = writeHealthCheckEnv(config.Server.DisableHealthcheck, connectionScheme, config.Server.Address.Hostname(), + config.Server.Path, config.Server.Address.Port()); err != nil { return nil, nil, nil, false, fmt.Errorf("unable to configure healthcheck: %w", err) } @@ -109,8 +109,15 @@ func CreateMetricsServer(config *schema.Configuration, providers middlewares.Pro Logger: logging.LoggerPrintf(logrus.DebugLevel), } - if listener, err = config.Telemetry.Metrics.Address.Listener(); err != nil { - return nil, nil, nil, false, err + switch config.Telemetry.Metrics.UMask { + case nil: + listener, err = config.Telemetry.Metrics.Address.Listener() + default: + listener, err = config.Telemetry.Metrics.Address.ListenerWithUMask(*config.Telemetry.Metrics.UMask) + } + + if err != nil { + return nil, nil, nil, false, fmt.Errorf("error occurred while attempting to initialize metrics telemetry server listener for address '%s': %w", config.Telemetry.Metrics.Address.String(), err) } return server, listener, []string{"/metrics"}, false, nil diff --git a/internal/server/server_test.go b/internal/server/server_test.go index 18e506a4b..dd5429939 100644 --- a/internal/server/server_test.go +++ b/internal/server/server_test.go @@ -190,6 +190,7 @@ func TestShouldRaiseErrorWhenClientDoesNotSkipVerify(t *testing.T) { tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: &schema.AddressTCP{Address: schema.NewAddressFromNetworkValues("tcp", "0.0.0.0", 9091)}, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -218,6 +219,7 @@ func TestShouldServeOverTLSWhenClientDoesSkipVerify(t *testing.T) { tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -255,6 +257,7 @@ func TestShouldServeOverTLSWhenClientHasProperRootCA(t *testing.T) { tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -306,6 +309,7 @@ func TestShouldRaiseWhenMutualTLSIsConfiguredAndClientIsNotAuthenticated(t *test tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), @@ -349,6 +353,7 @@ func TestShouldServeProperlyWhenMutualTLSIsConfiguredAndClientIsAuthenticated(t tlsServerContext, err := NewTLSServerContext(schema.Configuration{ Server: schema.ServerConfiguration{ + Address: schema.DefaultServerConfiguration.Address, TLS: schema.ServerTLS{ Certificate: certificateContext.Certificates[0].CertFile.Name(), Key: certificateContext.Certificates[0].KeyFile.Name(), diff --git a/internal/suites/ActiveDirectory/configuration.yml b/internal/suites/ActiveDirectory/configuration.yml index 88c297b54..cf309813a 100644 --- a/internal/suites/ActiveDirectory/configuration.yml +++ b/internal/suites/ActiveDirectory/configuration.yml @@ -8,7 +8,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/BypassAll/configuration.yml b/internal/suites/BypassAll/configuration.yml index e5906d1dd..5611c59d7 100644 --- a/internal/suites/BypassAll/configuration.yml +++ b/internal/suites/BypassAll/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/CLI/configuration.yml b/internal/suites/CLI/configuration.yml index 9c4b95d50..798b79ab6 100644 --- a/internal/suites/CLI/configuration.yml +++ b/internal/suites/CLI/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Caddy/configuration.yml b/internal/suites/Caddy/configuration.yml index b57c30d69..8dc14b612 100644 --- a/internal/suites/Caddy/configuration.yml +++ b/internal/suites/Caddy/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: "tcp://:9091" asset_path: /config/assets/ tls: certificate: /pki/public.backend.crt diff --git a/internal/suites/Docker/configuration.yml b/internal/suites/Docker/configuration.yml index 776790973..c1d593fdb 100644 --- a/internal/suites/Docker/configuration.yml +++ b/internal/suites/Docker/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/DuoPush/configuration.yml b/internal/suites/DuoPush/configuration.yml index 59565ac2b..6e96949ac 100644 --- a/internal/suites/DuoPush/configuration.yml +++ b/internal/suites/DuoPush/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Envoy/configuration.yml b/internal/suites/Envoy/configuration.yml index f04cd8b5d..d1e59588c 100644 --- a/internal/suites/Envoy/configuration.yml +++ b/internal/suites/Envoy/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: "tcp://:9091" asset_path: /config/assets/ tls: certificate: /pki/public.backend.crt diff --git a/internal/suites/HAProxy/configuration.yml b/internal/suites/HAProxy/configuration.yml index e9685844a..664349df6 100644 --- a/internal/suites/HAProxy/configuration.yml +++ b/internal/suites/HAProxy/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/HighAvailability/configuration.yml b/internal/suites/HighAvailability/configuration.yml index 8794cbd35..32883e329 100644 --- a/internal/suites/HighAvailability/configuration.yml +++ b/internal/suites/HighAvailability/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/LDAP/configuration.yml b/internal/suites/LDAP/configuration.yml index d9c2ad7ee..ac5b4379c 100644 --- a/internal/suites/LDAP/configuration.yml +++ b/internal/suites/LDAP/configuration.yml @@ -8,7 +8,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/MariaDB/configuration.yml b/internal/suites/MariaDB/configuration.yml index cd46fe740..3ec3af71d 100644 --- a/internal/suites/MariaDB/configuration.yml +++ b/internal/suites/MariaDB/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/MultiCookieDomain/configuration.yml b/internal/suites/MultiCookieDomain/configuration.yml index d19f591f9..d47a5a80d 100644 --- a/internal/suites/MultiCookieDomain/configuration.yml +++ b/internal/suites/MultiCookieDomain/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret theme: auto server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/MySQL/configuration.yml b/internal/suites/MySQL/configuration.yml index 18a998436..87846b214 100644 --- a/internal/suites/MySQL/configuration.yml +++ b/internal/suites/MySQL/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/NetworkACL/configuration.yml b/internal/suites/NetworkACL/configuration.yml index 3c29c965e..793469eea 100644 --- a/internal/suites/NetworkACL/configuration.yml +++ b/internal/suites/NetworkACL/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/OIDC/configuration.yml b/internal/suites/OIDC/configuration.yml index 14ebd61b4..c1f77f557 100644 --- a/internal/suites/OIDC/configuration.yml +++ b/internal/suites/OIDC/configuration.yml @@ -1,6 +1,6 @@ --- server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/OIDCTraefik/configuration.yml b/internal/suites/OIDCTraefik/configuration.yml index f5e936cca..0c545972d 100644 --- a/internal/suites/OIDCTraefik/configuration.yml +++ b/internal/suites/OIDCTraefik/configuration.yml @@ -1,6 +1,6 @@ --- server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/OneFactorOnly/configuration.yml b/internal/suites/OneFactorOnly/configuration.yml index 4e54656cd..b93f37170 100644 --- a/internal/suites/OneFactorOnly/configuration.yml +++ b/internal/suites/OneFactorOnly/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/PathPrefix/configuration.yml b/internal/suites/PathPrefix/configuration.yml index 95c5861ed..e40b4f0eb 100644 --- a/internal/suites/PathPrefix/configuration.yml +++ b/internal/suites/PathPrefix/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: "tcp://:9091" path: auth tls: certificate: /pki/public.backend.crt diff --git a/internal/suites/Postgres/configuration.yml b/internal/suites/Postgres/configuration.yml index 2276a4763..cf2c31d6f 100644 --- a/internal/suites/Postgres/configuration.yml +++ b/internal/suites/Postgres/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/ShortTimeouts/configuration.yml b/internal/suites/ShortTimeouts/configuration.yml index 3a3cb945c..d0b57b826 100644 --- a/internal/suites/ShortTimeouts/configuration.yml +++ b/internal/suites/ShortTimeouts/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret default_redirection_url: https://home.example.com:8080/ server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Standalone/configuration.yml b/internal/suites/Standalone/configuration.yml index 19fba7a36..4589ead9d 100644 --- a/internal/suites/Standalone/configuration.yml +++ b/internal/suites/Standalone/configuration.yml @@ -6,7 +6,7 @@ theme: auto server: - port: 9091 + address: "tcp://:9091" tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Traefik/configuration.yml b/internal/suites/Traefik/configuration.yml index e4cb5c403..5b169f8a9 100644 --- a/internal/suites/Traefik/configuration.yml +++ b/internal/suites/Traefik/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: "tcp://:9091" asset_path: /config/assets/ tls: certificate: /pki/public.backend.crt diff --git a/internal/suites/Traefik2/configuration.yml b/internal/suites/Traefik2/configuration.yml index cf45b4ca6..ee7218872 100644 --- a/internal/suites/Traefik2/configuration.yml +++ b/internal/suites/Traefik2/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - port: 9091 + address: "tcp://:9091" asset_path: /config/assets/ tls: certificate: /pki/public.backend.crt From fb5c285c2549c344f5b24a1cae1fe724a89f11a0 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sun, 7 May 2023 16:39:17 +1000 Subject: [PATCH 13/67] feat(authentication): suport ldap over unix socket (#5397) This adds support for LDAP unix sockets using the ldapi scheme. In addition it improves all of the address related parsing significantly deprecating old options. Signed-off-by: James Elliott --- .github/FUNDING.yml | 2 +- .github/ISSUE_TEMPLATE/config.yml | 36 +- .github/ISSUE_TEMPLATE/feature-request.yml | 68 +- .yamllint.yml | 1 + .../github_issue_template_bug_report.yml.tmpl | 166 ++-- .../github_issue_template_feature.yml.tmpl | 64 +- config.template.yml | 419 +++++----- crowdin.yml | 8 +- .../en/configuration/first-factor/file.md | 12 +- .../en/configuration/first-factor/ldap.md | 84 +- .../identity-providers/open-id-connect.md | 56 +- .../en/configuration/methods/environment.md | 2 +- .../miscellaneous/introduction.md | 10 +- .../en/configuration/miscellaneous/logging.md | 8 +- .../en/configuration/miscellaneous/ntp.md | 28 +- .../miscellaneous/privacy-policy.md | 2 + .../miscellaneous/server-endpoints-authz.md | 8 +- .../en/configuration/miscellaneous/server.md | 24 +- .../en/configuration/notifications/file.md | 2 +- .../en/configuration/notifications/smtp.md | 68 +- .../en/configuration/prologue/common.md | 28 +- .../en/configuration/second-factor/duo.md | 6 +- .../time-based-one-time-password.md | 4 +- .../configuration/second-factor/webauthn.md | 8 +- .../configuration/security/access-control.md | 114 +-- .../en/configuration/security/regulation.md | 4 +- .../en/configuration/session/introduction.md | 28 +- .../content/en/configuration/session/redis.md | 22 +- .../en/configuration/storage/introduction.md | 2 +- .../content/en/configuration/storage/mysql.md | 47 +- .../en/configuration/storage/postgres.md | 49 +- .../en/configuration/storage/sqlite.md | 4 +- .../en/configuration/telemetry/metrics.md | 8 +- .../en/integration/kubernetes/istio.md | 14 +- .../integration/kubernetes/traefik-ingress.md | 62 +- .../en/integration/ldap/introduction.md | 6 +- .../openid-connect/apache-guacamole/index.md | 22 +- .../openid-connect/argocd/index.md | 38 +- .../openid-connect/bookstack/index.md | 16 +- .../cloudflare-zerotrust/index.md | 16 +- .../openid-connect/firezone/index.md | 18 +- .../frequently-asked-questions.md | 4 +- .../integration/openid-connect/gitea/index.md | 16 +- .../openid-connect/gitlab/index.md | 18 +- .../openid-connect/grafana/index.md | 18 +- .../openid-connect/harbor/index.md | 18 +- .../openid-connect/hashicorp-vault/index.md | 20 +- .../openid-connect/kasm-workspaces/index.md | 20 +- .../integration/openid-connect/komga/index.md | 32 +- .../integration/openid-connect/minio/index.md | 18 +- .../openid-connect/misago/index.md | 21 +- .../openid-connect/nextcloud/index.md | 18 +- .../openid-connect/outline/index.md | 18 +- .../openid-connect/portainer/index.md | 18 +- .../openid-connect/proxmox/index.md | 16 +- .../openid-connect/seafile/index.md | 16 +- .../openid-connect/synapse/index.md | 16 +- .../openid-connect/synology-dsm/index.md | 18 +- .../openid-connect/tailscale/index.md | 12 +- docs/content/en/integration/proxies/caddy.md | 2 +- docs/content/en/integration/proxies/envoy.md | 168 ++-- .../content/en/integration/proxies/haproxy.md | 2 +- .../proxies/nginx-proxy-manager/index.md | 38 +- docs/content/en/integration/proxies/nginx.md | 2 +- docs/content/en/integration/proxies/swag.md | 36 +- .../content/en/integration/proxies/traefik.md | 240 +++--- .../en/integration/proxies/traefikv1.md | 60 +- docs/content/en/overview/security/measures.md | 14 +- docs/content/en/reference/guides/passwords.md | 31 +- .../en/reference/guides/troubleshooting.md | 2 +- docs/data/configkeys.json | 2 +- docs/i18n/en.yaml | 22 +- .../compose/lite/authelia/configuration.yml | 3 +- .../compose/local/authelia/configuration.yml | 3 +- internal/authentication/const_test.go | 24 + internal/authentication/ldap_user_provider.go | 4 +- .../ldap_user_provider_startup.go | 2 +- .../authentication/ldap_user_provider_test.go | 98 +-- internal/configuration/config.template.yml | 419 +++++----- internal/configuration/decode_hooks.go | 2 +- internal/configuration/decode_hooks_test.go | 2 +- internal/configuration/deprecation.go | 59 +- internal/configuration/provider_test.go | 78 +- .../configuration/schema/authentication.go | 2 +- internal/configuration/schema/keys.go | 21 +- internal/configuration/schema/notifier.go | 11 +- internal/configuration/schema/ntp.go | 5 +- internal/configuration/schema/storage.go | 13 +- internal/configuration/schema/types.go | 386 --------- .../configuration/schema/types_address.go | 482 ++++++++++++ .../schema/types_address_test.go | 743 ++++++++++++++++++ internal/configuration/schema/types_test.go | 430 ---------- .../test_resources/config.deprecated.alt.yml | 173 ++++ .../test_resources/config.deprecated.yml | 173 ++++ .../test_resources/config.filtered.yml | 8 +- .../configuration/test_resources/config.yml | 160 ++-- .../test_resources/config_alt.yml | 138 ++-- .../test_resources/config_bad_keys.yml | 140 ++-- .../test_resources/config_bad_quoting.yml | 54 +- .../config_domain_bad_regex.yml | 140 ++-- .../test_resources/config_domain_regex.yml | 148 ++-- .../test_resources/config_oidc.yml | 148 ++-- .../config_smtp_sender_blank.yml | 140 ++-- .../config_smtp_sender_invalid.yml | 140 ++-- .../test_resources/config_with_secret.yml | 140 ++-- .../configuration/validator/authentication.go | 34 +- .../validator/authentication_test.go | 690 ++++++++-------- internal/configuration/validator/const.go | 29 +- .../configuration/validator/const_test.go | 26 + internal/configuration/validator/notifier.go | 38 +- .../configuration/validator/notifier_test.go | 157 ++-- internal/configuration/validator/ntp.go | 6 +- internal/configuration/validator/ntp_test.go | 12 + .../configuration/validator/server_test.go | 49 ++ internal/configuration/validator/storage.go | 38 +- .../configuration/validator/storage_test.go | 11 +- internal/notification/const.go | 4 - internal/notification/smtp_auth.go | 2 +- internal/notification/smtp_notifier.go | 8 +- internal/ntp/ntp.go | 51 +- internal/ntp/ntp_test.go | 4 +- internal/ntp/util.go | 8 + internal/storage/const.go | 5 - .../storage/sql_provider_backend_mysql.go | 22 +- .../storage/sql_provider_backend_postgres.go | 9 +- .../suites/ActiveDirectory/configuration.yml | 7 +- internal/suites/BypassAll/configuration.yml | 5 +- internal/suites/CLI/configuration.yml | 2 +- internal/suites/Caddy/configuration.yml | 7 +- internal/suites/Docker/configuration.yml | 5 +- internal/suites/DuoPush/configuration.yml | 2 +- internal/suites/Envoy/configuration.yml | 7 +- internal/suites/HAProxy/configuration.yml | 5 +- .../suites/HighAvailability/configuration.yml | 10 +- internal/suites/LDAP/configuration.yml | 7 +- internal/suites/MariaDB/configuration.yml | 8 +- .../MultiCookieDomain/configuration.yml | 9 +- internal/suites/MySQL/configuration.yml | 14 +- internal/suites/NetworkACL/configuration.yml | 5 +- internal/suites/OIDC/configuration.yml | 5 +- internal/suites/OIDCTraefik/configuration.yml | 5 +- .../suites/OneFactorOnly/configuration.yml | 2 +- internal/suites/PathPrefix/configuration.yml | 7 +- internal/suites/Postgres/configuration.yml | 14 +- .../suites/ShortTimeouts/configuration.yml | 5 +- internal/suites/Standalone/configuration.yml | 5 +- internal/suites/Traefik/configuration.yml | 7 +- internal/suites/Traefik2/configuration.yml | 7 +- .../suites/example/compose/envoy/envoy.yaml | 212 ++--- .../kube/authelia/configs/configuration.yml | 12 +- 150 files changed, 4910 insertions(+), 3676 deletions(-) create mode 100644 internal/authentication/const_test.go create mode 100644 internal/configuration/schema/types_address.go create mode 100644 internal/configuration/schema/types_address_test.go create mode 100644 internal/configuration/test_resources/config.deprecated.alt.yml create mode 100644 internal/configuration/test_resources/config.deprecated.yml diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml index e94cb1b1b..9571705f6 100644 --- a/.github/FUNDING.yml +++ b/.github/FUNDING.yml @@ -3,7 +3,7 @@ # github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2] # patreon: # Replace with a single Patreon username -open_collective: authelia-sponsors +open_collective: 'authelia-sponsors' # ko_fi: # Replace with a single Ko-fi username # tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel # community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 2a89a14ac..1bf5a3b93 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,22 +1,22 @@ --- blank_issues_enabled: false contact_links: - - name: Idea - url: https://github.com/authelia/authelia/discussions/new?category=ideas - about: Submit an Idea for Voting - - name: Question - url: https://github.com/authelia/authelia/discussions/new?category=q-a - about: Ask a Question - - name: Discussion - url: https://github.com/authelia/authelia/discussions/new - about: Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics - - name: Documentation - url: https://www.authelia.com/ - about: Read the Documentation - - name: Matrix - url: https://matrix.to/#/#community:authelia.com - about: Discuss Authelia with the Developers on Matrix which is the preferred method of contact - - name: Discord - url: https://discord.authelia.com - about: Discuss Authelia with the Developers on Discord which is bridged to Matrix + - name: 'Idea' + url: 'https://github.com/authelia/authelia/discussions/new?category=ideas' + about: 'Submit an Idea for Voting' + - name: 'Question' + url: 'https://github.com/authelia/authelia/discussions/new?category=q-a' + about: 'Ask a Question' + - name: 'Discussion' + url: 'https://github.com/authelia/authelia/discussions/new' + about: 'Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics' + - name: 'Documentation' + url: 'https://www.authelia.com/' + about: 'Read the Documentation' + - name: 'Matrix' + url: 'https://matrix.to/#/#community:authelia.com' + about: 'Discuss Authelia with the Developers on Matrix which is the preferred method of contact' + - name: 'Discord' + url: 'https://discord.authelia.com' + about: 'Discuss Authelia with the Developers on Discord which is bridged to Matrix' ... diff --git a/.github/ISSUE_TEMPLATE/feature-request.yml b/.github/ISSUE_TEMPLATE/feature-request.yml index 607f832ff..4cd251a9a 100644 --- a/.github/ISSUE_TEMPLATE/feature-request.yml +++ b/.github/ISSUE_TEMPLATE/feature-request.yml @@ -1,12 +1,12 @@ --- -name: Feature Request -description: Submit a Feature Request +name: 'Feature Request' +description: 'Submit a Feature Request' labels: - - type/feature - - status/needs-design - - priority/4/normal + - 'type/feature' + - 'status/needs-design' + - 'priority/4/normal' body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature. @@ -16,42 +16,54 @@ body: 1. Ensure there are no other similar feature requests. 2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already. 3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist. - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the feature + label: | + Description + description: | + Describe the feature validations: required: true - - type: textarea - id: use-case + - type: 'textarea' + id: 'use-case' attributes: - label: Use Case - description: Provide a use case + label: | + Use Case + description: | + Provide a use case validations: required: true - - type: textarea - id: details + - type: 'textarea' + id: 'details' attributes: - label: Details - description: Describe the feature in detail + label: | + Details + description: | + Describe the feature in detail validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/.yamllint.yml b/.yamllint.yml index 66bafeb8f..c5cb4ee41 100644 --- a/.yamllint.yml +++ b/.yamllint.yml @@ -11,6 +11,7 @@ yaml-files: ignore: | api/openapi.yml docs/pnpm-lock.yaml + docs/node_modules/ internal/configuration/test_resources/config_bad_quoting.yml web/pnpm-lock.yaml web/node_modules/ diff --git a/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl b/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl index 7fe279929..7280b9f9d 100644 --- a/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl +++ b/cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl @@ -1,12 +1,12 @@ --- -name: Bug Report -description: Report a bug +name: 'Bug Report' +description: 'Report a bug' labels: {{- range .Labels }} - - {{ . }} + - '{{ . }}' {{- end }} body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first. @@ -25,122 +25,152 @@ body: - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section. - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section. 7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues. - - type: dropdown - id: version + - type: 'dropdown' + id: 'version' attributes: - label: Version - description: What version(s) of Authelia can you reproduce this bug on? + label: | + Version + description: | + What version(s) of Authelia can you reproduce this bug on? multiple: true options: {{- range .Versions }} - - {{ . }} + - '{{ . }}' {{- end }} validations: required: true - - type: dropdown - id: deployment + - type: 'dropdown' + id: 'deployment' attributes: - label: Deployment Method - description: How are you deploying Authelia? + label: | + Deployment Method + description: | + How are you deploying Authelia? options: - - Docker - - Kubernetes - - Bare-metal - - Other + - 'Docker' + - 'Kubernetes' + - 'Bare-metal' + - 'Other' validations: required: true - - type: dropdown - id: proxy + - type: 'dropdown' + id: 'proxy' attributes: - label: Reverse Proxy - description: What reverse proxy are you using? + label: | + Reverse Proxy + description: | + What reverse proxy are you using? options: {{- range .Proxies }} - - {{ . }} + - '{{ . }}' {{- end }} validations: required: true - - type: input - id: proxy-version + - type: 'input' + id: 'proxy-version' attributes: - label: Reverse Proxy Version - description: What is the version of your reverse proxy? - placeholder: x.x.x + label: | + Reverse Proxy Version + description: | + What is the version of your reverse proxy? + placeholder: 'x.x.x' validations: required: false - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the bug. + label: | + Description + description: | + Describe the bug. validations: required: true - - type: textarea - id: reproduction + - type: 'textarea' + id: 'reproduction' attributes: - label: Reproduction - description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. + label: | + Reproduction + description: | + Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. validations: required: true - - type: textarea - id: expectations + - type: 'textarea' + id: 'expectations' attributes: - label: Expectations - description: Describe the desired or expected results. + label: | + Expectations + description: | + Describe the desired or expected results. validations: required: false - - type: textarea - id: configuration + - type: 'textarea' + id: 'configuration' attributes: - label: Configuration (Authelia) - description: Provide a complete configuration file (the template will automatically put this content in a code block). - render: yaml + label: | + Configuration (Authelia) + description: | + Provide a complete configuration file (the template will automatically put this content in a code block). + render: 'yaml' validations: required: false - - type: textarea - id: logs + - type: 'textarea' + id: 'logs' attributes: - label: Logs (Authelia) + label: | + Logs (Authelia) description: | Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide. The template will automatically put this content in a code block so you can just paste it. - render: shell + render: 'shell' validations: required: true - - type: textarea - id: logs-other + - type: 'textarea' + id: 'logs-other' attributes: - label: Logs (Proxy / Application) - description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). - render: shell + label: | + Logs (Proxy / Application) + description: | + Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). + render: 'shell' validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable. + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable. validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following. + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following. options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: This is a bug report and not a support request + - label: | + This is a bug report and not a support request required: true - - label: I have read the security policy and this bug report is not a security issue or security related issue + - label: | + I have read the security policy and this bug report is not a security issue or security related issue required: true - - label: I have either included the complete configuration file or I am sure it's unrelated to the configuration + - label: | + I have either included the complete configuration file or I am sure it's unrelated to the configuration required: true - - label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide + - label: | + I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide required: true - - label: I have checked for related proxy or application logs and included them if available + - label: | + I have checked for related proxy or application logs and included them if available required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl b/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl index c9d7ed245..04d733f8d 100644 --- a/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl +++ b/cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl @@ -1,12 +1,12 @@ --- -name: Feature Request -description: Submit a Feature Request +name: 'Feature Request' +description: 'Submit a Feature Request' labels: {{- range .Labels }} - - {{ . }} + - '{{ . }}' {{- end }} body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature. @@ -16,42 +16,54 @@ body: 1. Ensure there are no other similar feature requests. 2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already. 3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist. - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the feature + label: | + Description + description: | + Describe the feature validations: required: true - - type: textarea - id: use-case + - type: 'textarea' + id: 'use-case' attributes: - label: Use Case - description: Provide a use case + label: | + Use Case + description: | + Provide a use case validations: required: true - - type: textarea - id: details + - type: 'textarea' + id: 'details' attributes: - label: Details - description: Describe the feature in detail + label: | + Details + description: | + Describe the feature in detail validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/config.template.yml b/config.template.yml index d5b0852ac..5b7f82ad0 100644 --- a/config.template.yml +++ b/config.template.yml @@ -9,14 +9,14 @@ ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. -# certificates_directory: /config/certificates/ +# certificates_directory: '/config/certificates/' ## The theme to display: light, dark, grey, auto. -theme: light +theme: 'light' ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## set using a secret: https://www.authelia.com/c/secrets -jwt_secret: a_very_important_secret +jwt_secret: 'a_very_important_secret' ## Default redirection URL ## @@ -25,28 +25,32 @@ jwt_secret: a_very_important_secret ## in such a case. ## ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. -default_redirection_url: https://home.example.com/ +default_redirection_url: 'https://home.example.com/' ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been ## disabled. This setting must be a method that is enabled. ## Options are totp, webauthn, mobile_push. -default_2fa_method: "" +default_2fa_method: '' ## ## Server Configuration ## server: - - ## The address to listen on. This must be a TCP or unix socket. - address: "tcp://:9091" + ## The address for the Main server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'. + address: 'tcp://:9091' ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. - path: "" + path: '' ## Set the path on disk to Authelia assets. ## Useful to allow overriding of specific static assets. - # asset_path: /config/assets/ + # asset_path: '/config/assets/' ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. @@ -55,10 +59,10 @@ server: ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. tls: ## The path to the DER base64/PEM format private key. - key: "" + key: '' ## The path to the DER base64/PEM format public certificate. - certificate: "" + certificate: '' ## The list of certificates for client authentication. client_certificates: [] @@ -67,7 +71,7 @@ server: headers: ## The CSP Template. Read the docs. - csp_template: "" + csp_template: '' ## Server Buffers configuration. # buffers: @@ -87,13 +91,13 @@ server: # timeouts: ## Read timeout. - # read: 6s + # read: '6s' ## Write timeout. - # write: 6s + # write: '6s' ## Idle timeout. - # idle: 30s + # idle: '30s' ## Server Endpoints configuration. ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation. @@ -107,16 +111,16 @@ server: ## Configure the authz endpoints. # authz: # forward-auth: - # implementation: ForwardAuth + # implementation: 'ForwardAuth' # authn_strategies: [] # ext-authz: - # implementation: ExtAuthz + # implementation: 'ExtAuthz' # authn_strategies: [] # auth-request: - # implementation: AuthRequest + # implementation: 'AuthRequest' # authn_strategies: [] # legacy: - # implementation: Legacy + # implementation: 'Legacy' # authn_strategies: [] ## @@ -124,13 +128,13 @@ server: ## log: ## Level of verbosity for logs: info, debug, trace. - level: debug + level: 'debug' ## Format the logs are written as: json, text. - # format: json + # format: 'json' ## File path where the logs will be written. If not set logs are written to stdout. - # file_path: /config/authelia.log + # file_path: '/config/authelia.log' ## Whether to also log to stdout when a log_file_path is defined. # keep_stdout: false @@ -147,8 +151,13 @@ telemetry: ## Enable Metrics. enabled: false - ## The address to listen on for metrics. This should be on a different port to the main server.port value. - address: tcp://0.0.0.0:9959 + ## The address for the Metrics server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'. + address: 'tcp://:9959' ## Metrics Server Buffers configuration. # buffers: @@ -163,13 +172,13 @@ telemetry: # timeouts: ## Read timeout. - # read: 6s + # read: '6s' ## Write timeout. - # write: 6s + # write: '6s' ## Idle timeout. - # idle: 30s + # idle: '30s' ## ## TOTP Configuration @@ -180,12 +189,12 @@ totp: disable: false ## The issuer name displayed in the Authenticator application of your choice. - issuer: authelia.com + issuer: 'authelia.com' ## The TOTP algorithm to use. ## It is CRITICAL you read the documentation before changing this option: ## https://www.authelia.com/c/totp#algorithm - algorithm: sha1 + algorithm: 'sha1' ## The number of digits a user has to input. Must either be 6 or 8. ## Changing this option only affects newly generated TOTP configurations. @@ -215,18 +224,18 @@ webauthn: disable: false ## Adjust the interaction timeout for WebAuthn dialogues. - timeout: 60s + timeout: '60s' ## The display name the browser should show the user for when using WebAuthn to login/register. - display_name: Authelia + display_name: 'Authelia' ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device. ## Options are none, indirect, direct. - attestation_conveyance_preference: indirect + attestation_conveyance_preference: 'indirect' ## User verification controls if the user must make a gesture or action to confirm they are present. ## Options are required, preferred, discouraged. - user_verification: preferred + user_verification: 'preferred' ## ## Duo Push API Configuration @@ -235,10 +244,10 @@ webauthn: ## "Partner Auth API" in the management panel. # duo_api: # disable: false - # hostname: api-123456789.example.com - # integration_key: ABCDEF + # hostname: 'api-123456789.example.com' + # integration_key: 'ABCDEF' ## Secret can also be set using a secret: https://www.authelia.com/c/secrets - # secret_key: 1234567890abcdefghifjkl + # secret_key: '1234567890abcdefghifjkl' # enable_self_enrollment: false ## @@ -246,14 +255,17 @@ webauthn: ## ## This is used to validate the servers time is accurate enough to validate TOTP. ntp: - ## NTP server address. - address: "time.cloudflare.com:123" + ## The address of the NTP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'. + ## The default scheme is 'udp'. The default port is '123'. + address: 'udp://time.cloudflare.com:123' ## NTP version. version: 4 - ## Maximum allowed time offset between the host and the NTP server. - max_desync: 3s + ## Maximum allowed time offset between the host and the NTP server in duration common syntax. + max_desync: '3s' ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you ## set this to true, and can operate in a truly offline mode. @@ -279,14 +291,14 @@ authentication_backend: ## External reset password url that redirects the user to an external reset portal. This disables the internal reset ## functionality. - custom_url: "" + custom_url: '' ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. - ## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format + ## Duration Notation docs: https://www.authelia.com/c/common#duration ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval refresh_interval: 5m @@ -297,6 +309,13 @@ authentication_backend: ## because it allows Authelia to offload the stateful operations ## onto the LDAP service. # ldap: + ## The address of the LDAP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`. + ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'. + ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'. + # address: 'ldaps://127.0.0.1:636' + ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## Acceptable options are as follows: ## - 'activedirectory' - for Microsoft Active Directory. @@ -308,22 +327,18 @@ authentication_backend: ## Depending on the option here certain other values in this section have a default value, notably all of the ## attribute mappings have a default value that this config overrides, you can read more about these default values ## at https://www.authelia.com/c/ldap#defaults - # implementation: custom + # implementation: 'custom' - ## The url to the ldap server. Format: ://
[:]. - ## Scheme can be ldap or ldaps in the format (port optional). - # url: ldap://127.0.0.1 - - ## The dial timeout for LDAP. - # timeout: 5s + ## The dial timeout for LDAP in the duration common syntax. + # timeout: '5s' ## Use StartTLS with the LDAP connection. # start_tls: false # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host portion of the url option. - # server_name: ldap.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'ldap.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -334,10 +349,10 @@ authentication_backend: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -414,7 +429,7 @@ authentication_backend: ## The distinguished name of the container searched for objects in the directory information tree. ## See also: additional_users_dn, additional_groups_dn. - # base_dn: dc=example,dc=com + # base_dn: 'dc=example,dc=com' ## The attribute holding the username of the user. This attribute is used to populate the username in the session ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually @@ -424,11 +439,11 @@ authentication_backend: ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to ## follow https://datatracker.ietf.org/doc/html/rfc2307. - # username_attribute: uid + # username_attribute: 'uid' ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. - # additional_users_dn: ou=users + # additional_users_dn: 'ou=users' ## The users filter used in search queries to find the user profile based on input filled in login form. ## Various placeholders are available in the user filter which you can read about in the documentation which can @@ -442,11 +457,11 @@ authentication_backend: ## ## To allow sign in both with username and email, one can use a filter like ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) - # users_filter: (&({username_attribute}={input})(objectClass=person)) + # users_filter: '(&({username_attribute}={input})(objectClass=person))' ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. - # additional_groups_dn: ou=groups + # additional_groups_dn: 'ou=groups' ## The groups filter used in search queries to find the groups based on relevant authenticated user. ## Various placeholders are available in the groups filter which you can read about in the documentation which can @@ -454,17 +469,17 @@ authentication_backend: ## ## If your groups use the `groupOfUniqueNames` structure use this instead: ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) - # groups_filter: (&(member={dn})(objectClass=groupOfNames)) + # groups_filter: '(&(member={dn})(objectClass=groupOfNames))' ## The attribute holding the name of the group. - # group_name_attribute: cn + # group_name_attribute: 'cn' ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## first one returned by the LDAP server is used. - # mail_attribute: mail + # mail_attribute: 'mail' ## The attribute holding the display name of the user. This will be used to greet an authenticated user. - # display_name_attribute: displayName + # display_name_attribute: 'displayName' ## Follow referrals returned by the server. ## This is especially useful for environments where read-only servers exist. Only implemented for write operations. @@ -473,7 +488,7 @@ authentication_backend: ## The username and password of the admin user. # user: cn=admin,dc=example,dc=com ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## ## File (Authentication Provider) @@ -488,15 +503,15 @@ authentication_backend: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # file: - # path: /config/users_database.yml + # path: '/config/users_database.yml' # watch: false # search: # email: false # case_insensitive: false # password: - # algorithm: argon2 + # algorithm: 'argon2' # argon2: - # variant: argon2id + # variant: 'argon2id' # iterations: 3 # memory: 65536 # parallelism: 4 @@ -509,15 +524,15 @@ authentication_backend: # key_length: 32 # salt_length: 16 # pbkdf2: - # variant: sha512 + # variant: 'sha512' # iterations: 310000 # salt_length: 16 # sha2crypt: - # variant: sha512 + # variant: 'sha512' # iterations: 50000 # salt_length: 16 # bcrypt: - # variant: standard + # variant: 'standard' # cost: 12 ## @@ -601,91 +616,91 @@ privacy_policy: access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. - default_policy: deny + default_policy: 'deny' # networks: - # - name: internal + # - name: 'internal' # networks: - # - 10.10.0.0/16 - # - 192.168.2.0/24 + # - '10.10.0.0/16' + # - '192.168.2.0/24' # - name: VPN - # networks: 10.9.0.0/16 + # networks: '10.9.0.0/16' # rules: ## Rules applied to everyone # - domain: 'public.example.com' - # policy: bypass + # policy: 'bypass' ## Domain Regex examples. Generally we recommend just using a standard domain. # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: # - '^appgroup-.*\.example\.com$' # - '^appgroup2-.*\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^.*\.example\.com$' - # policy: two_factor + # policy: 'two_factor' # - domain: 'secure.example.com' - # policy: one_factor + # policy: 'one_factor' ## Network based rule, if not provided any network matches. # networks: - # - internal - # - VPN - # - 192.168.1.0/24 - # - 10.0.0.1 + # - 'internal' + # - 'VPN' + # - '192.168.1.0/24' + # - '10.0.0.1' # - domain: # - 'secure.example.com' # - 'private.example.com' - # policy: two_factor + # policy: 'two_factor' # - domain: 'singlefactor.example.com' - # policy: one_factor + # policy: 'one_factor' ## Rules applied to 'admins' group # - domain: 'mx2.mail.example.com' # subject: 'group:admins' - # policy: deny + # policy: 'deny' # - domain: '*.example.com' # subject: # - 'group:admins' # - 'group:moderators' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to 'dev' group # - domain: 'dev.example.com' # resources: # - '^/groups/dev/.*$' # subject: 'group:dev' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'john' # - domain: 'dev.example.com' # resources: # - '^/users/john/.*$' # subject: 'user:john' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'harry' # - domain: 'dev.example.com' # resources: # - '^/users/harry/.*$' # subject: 'user:harry' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'bob' # - domain: '*.mail.example.com' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' # - domain: 'dev.example.com' # resources: # - '^/users/bob/.*$' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' ## ## Session Provider Configuration @@ -720,8 +735,8 @@ session: ## Please read https://www.authelia.com/c/session#same_site # same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format + ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. + ## See: https://www.authelia.com/c/common#duration ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -745,8 +760,8 @@ session: ## or strict. Please read https://www.authelia.com/c/session#same_site same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format + ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. + ## See: https://www.authelia.com/c/common#duration ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -755,7 +770,7 @@ session: ## destroyed after 1h, or after 5m since the last time Authelia detected user activity. inactivity: '5m' - ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is + ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is ## destroyed if remember me IS NOT selected by the user. expiration: '1h' @@ -770,16 +785,16 @@ session: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # redis: - # host: 127.0.0.1 + # host: '127.0.0.1' # port: 6379 ## Use a unix socket instead - # host: /var/run/redis/redis.sock + # host: '/var/run/redis/redis.sock' ## Username used for redis authentication. This is optional and a new feature in redis 6.0. - # username: authelia + # username: 'authelia' ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: authelia + # password: 'authelia' ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). # database_index: 0 @@ -794,7 +809,7 @@ session: # tls: ## The server subject name to check the servers certificate against during the validation process. ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: myredis.example.com + # server_name: 'myredis.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -805,10 +820,10 @@ session: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -887,21 +902,21 @@ session: ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). # high_availability: ## Sentinel Name / Master Name. - # sentinel_name: mysentinel + # sentinel_name: 'mysentinel' ## Specific username for Redis Sentinel. The node username and password is configured above. - # sentinel_username: sentinel_specific_user + # sentinel_username: 'sentinel_specific_user' ## Specific password for Redis Sentinel. The node username and password is configured above. - # sentinel_password: sentinel_specific_pass + # sentinel_password: 'sentinel_specific_pass' ## The additional nodes to pre-seed the redis provider with (for sentinel). ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## For high availability to be used you must have either defined; the host above or at least one node below. # nodes: - # - host: sentinel-node1 + # - host: 'sentinel-node1' # port: 6379 - # - host: sentinel-node2 + # - host: 'sentinel-node2' # port: 6379 ## Choose the host with the lowest latency. @@ -919,14 +934,12 @@ regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 - ## The time range during which the user can attempt login before being banned. The user is banned if the - ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - find_time: 2m + ## The time range in duration common syntax during which the user can attempt login before being banned. The user is + ## banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. + find_time: '2m' - ## The length of time before a banned user can login again. Ban Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - ban_time: 5m + ## The length of time in duration common syntax before a banned user can login again. + ban_time: '5m' ## ## Storage Provider Configuration @@ -936,7 +949,7 @@ regulation: ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use ## the CLI to change this in the database if you want to change it from a previously configured value. - # encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this + # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this' ## ## Local (Storage Provider) @@ -948,25 +961,36 @@ regulation: ## # local: ## Path to the SQLite3 Database. - # path: /config/db.sqlite3 + # path: '/config/db.sqlite3' ## ## MySQL / MariaDB (Storage Provider) ## # mysql: - # host: 127.0.0.1 - # port: 3306 - # database: authelia - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the MySQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'. + # address: 'tcp://127.0.0.1:3306' + + ## The database name to use. + # database: 'authelia' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## MySQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: mysql.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'mysql.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -977,10 +1001,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1059,20 +1083,33 @@ regulation: ## PostgreSQL (Storage Provider) ## # postgres: - # host: 127.0.0.1 - # port: 5432 - # database: authelia - # schema: public - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the PostgreSQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'. + # address: 'tcp://127.0.0.1:5432' + + ## The database name to use. + # database: 'authelia' + + ## The schema name to use. + # schema: 'public' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## PostgreSQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: postgres.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'postgres.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1083,10 +1120,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1176,7 +1213,7 @@ notifier: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # filesystem: - # filename: /config/notification.txt + # filename: '/config/notification.txt' ## ## SMTP (Notification Provider) @@ -1189,36 +1226,33 @@ notifier: ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## (configure in tls section) # smtp: - ## The SMTP host to connect to. - # host: 127.0.0.1 + ## The address of the SMTP server to connect to in the address common syntax. + # address: 'smtp://127.0.0.1:25' - ## The port to connect to the SMTP host on. - # port: 1025 - - ## The connection timeout. - # timeout: 5s + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## The username used for SMTP authentication. - # username: test + # username: 'test' ## The password used for SMTP authentication. ## Can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## The sender is used to is used for the MAIL FROM command and the FROM header. ## If this is not defined and the username is an email, we use the username as this value. This can either be just ## an email address or the RFC5322 'Name ' format. - # sender: "Authelia " + # sender: 'Authelia ' ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. - # identifier: localhost + # identifier: 'localhost' ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. - # subject: "[Authelia] {title}" + # subject: '[Authelia] {title}' ## This address is used during the startup check to verify the email configuration is correct. ## It's not important what it is except if your email server only allows local delivery. - # startup_check_address: test@authelia.com + # startup_check_address: 'test@authelia.com' ## By default we require some form of TLS. This disables this check though is not advised. # disable_require_tls: false @@ -1228,8 +1262,8 @@ notifier: # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: smtp.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'smtp.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1240,10 +1274,10 @@ notifier: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1331,7 +1365,7 @@ notifier: # oidc: ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets - # hmac_secret: this_is_a_secret_abc123abc123abc + # hmac_secret: 'this_is_a_secret_abc123abc123abc' ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every @@ -1408,10 +1442,10 @@ notifier: # -----END RSA PRIVATE KEY----- ## The lifespans configure the expiration for these token types. - # access_token_lifespan: 1h - # authorize_code_lifespan: 1m - # id_token_lifespan: 1h - # refresh_token_lifespan: 90m + # access_token_lifespan: '1h' + # authorize_code_lifespan: '1m' + # id_token_lifespan: '1h' + # refresh_token_lifespan: '90m' ## Enables additional debug messages. # enable_client_debug_messages: false @@ -1421,23 +1455,23 @@ notifier: ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' ## for security reasons. - # enforce_pkce: public_clients_only + # enforce_pkce: 'public_clients_only' ## Cross-Origin Resource Sharing (CORS) settings. # cors: ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. # endpoints: - # - authorization - # - token - # - revocation - # - introspection - # - userinfo + # - 'authorization' + # - 'token' + # - 'revocation' + # - 'introspection' + # - 'userinfo' ## List of allowed origins. ## Any origin with https is permitted unless this option is configured or the ## allowed_origins_from_client_redirect_uris option is enabled. # allowed_origins: - # - https://example.com + # - 'https://example.com' ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, ## provided they have the scheme http or https and do not have the hostname of localhost. @@ -1447,71 +1481,72 @@ notifier: # clients: # - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. - # id: myapp + # id: 'myapp' ## The description to show to users when they end up on the consent screen. Defaults to the ID above. - # description: My Application + # description: 'My Application' ## The client secret is a shared secret between Authelia and the consumer of this client. - # secret: this_is_a_secret + # yamllint disable-line rule:line-length + # secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not ## necessary. Read the documentation for more information. ## The subject identifier must be the host component of a URL, which is a domain name with an optional port. - # sector_identifier: example.com + # sector_identifier: 'example.com' ## Sets the client to public. This should typically not be set, please see the documentation for usage. # public: false ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. # redirect_uris: - # - https://oidc.example.com:8080/oauth2/callback + # - 'https://oidc.example.com:8080/oauth2/callback' ## Audience this client is allowed to request. # audience: [] ## Scopes this client is allowed to request. # scopes: - # - openid - # - groups - # - email - # - profile + # - 'openid' + # - 'groups' + # - 'email' + # - 'profile' ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: - # - code + # - 'code' ## Response Modes configures which response modes this client supports. # response_modes: - # - form_post - # - query + # - 'form_post' + # - 'query' ## Grant Types configures which grants this client can obtain. ## It's not recommended to define this unless you know what you're doing. # grant_types: - # - authorization_code + # - 'authorization_code' ## The permitted client authentication method for the Token Endpoint for this client. - # token_endpoint_auth_method: client_secret_basic + # token_endpoint_auth_method: 'client_secret_basic' ## The policy to require for this client; one_factor or two_factor. - # authorization_policy: two_factor + # authorization_policy: 'two_factor' ## Enforces the use of PKCE for this client when set to true. # enforce_pkce: false ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method. ## Options are 'plain' and 'S256'. - # pkce_challenge_method: S256 + # pkce_challenge_method: 'S256' ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. - # userinfo_signing_algorithm: none + # userinfo_signing_algorithm: 'none' ## The consent mode controls how consent is obtained. - # consent_mode: auto + # consent_mode: 'auto' ## This value controls the duration a consent on this client remains remembered when the consent mode is ## configured as 'auto' or 'pre-configured'. - # pre_configured_consent_duration: 1w + # pre_configured_consent_duration: '1w' ... diff --git a/crowdin.yml b/crowdin.yml index 88613ec99..da43544d1 100644 --- a/crowdin.yml +++ b/crowdin.yml @@ -1,9 +1,9 @@ --- -pull_request_title: "i18n: update translations" -commit_message: "i18n: update translation for %original_file_name% (%language%)" +pull_request_title: 'i18n: update translations' +commit_message: 'i18n: update translation for %original_file_name% (%language%)' append_commit_message: false files: - - source: /internal/server/locales/en/* - translation: /internal/server/locales/%locale%/%original_file_name% + - source: '/internal/server/locales/en/*' + translation: '/internal/server/locales/%locale%/%original_file_name%' skip_untranslated_files: true ... diff --git a/docs/content/en/configuration/first-factor/file.md b/docs/content/en/configuration/first-factor/file.md index 896ec8aa2..97ec3e23a 100644 --- a/docs/content/en/configuration/first-factor/file.md +++ b/docs/content/en/configuration/first-factor/file.md @@ -21,15 +21,15 @@ aliases: ```yaml authentication_backend: file: - path: /config/users.yml + path: '/config/users.yml' watch: false search: email: false case_insensitive: false password: - algorithm: argon2 + algorithm: 'argon2' argon2: - variant: argon2id + variant: 'argon2id' iterations: 3 memory: 65536 parallelism: 4 @@ -42,15 +42,15 @@ authentication_backend: key_length: 32 salt_length: 16 pbkdf2: - variant: sha512 + variant: 'sha512' iterations: 310000 salt_length: 16 sha2crypt: - variant: sha512 + variant: 'sha512' iterations: 50000 salt_length: 16 bcrypt: - variant: standard + variant: 'standard' cost: 12 ``` diff --git a/docs/content/en/configuration/first-factor/ldap.md b/docs/content/en/configuration/first-factor/ldap.md index 598a1683d..aebd73f46 100644 --- a/docs/content/en/configuration/first-factor/ldap.md +++ b/docs/content/en/configuration/first-factor/ldap.md @@ -22,15 +22,15 @@ aliases: ```yaml authentication_backend: ldap: - implementation: custom - url: ldap://127.0.0.1 - timeout: 5s + address: 'ldap://127.0.0.1' + implementation: 'custom' + timeout: '5s' start_tls: false tls: - server_name: ldap.example.com + server_name: 'ldap.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -98,25 +98,54 @@ authentication_backend: 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. DO NOT USE== -----END RSA PRIVATE KEY----- - base_dn: DC=example,DC=com - additional_users_dn: OU=users - users_filter: (&({username_attribute}={input})(objectClass=person)) - username_attribute: uid - mail_attribute: mail - display_name_attribute: displayName - additional_groups_dn: OU=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn + base_dn: 'DC=example,DC=com' + additional_users_dn: 'OU=users' + users_filter: '(&({username_attribute}={input})(objectClass=person))' + username_attribute: 'uid' + mail_attribute: 'mail' + display_name_attribute: 'displayName' + additional_groups_dn: 'OU=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' permit_referrals: false permit_unauthenticated_bind: false - user: CN=admin,DC=example,DC=com - password: password + user: 'CN=admin,DC=example,DC=com' + password: 'password' ``` ## Options This section describes the individual configuration options. +### address + +{{< confkey type="string" required="yes" >}} + +*__Reference Note:__ This configuration option uses the [Address](../prologue/common.md#address) format. Please see the +[documentation](../prologue/common.md#address) on this format for more information.* + +The LDAP URL which consists of a scheme, hostname, and port. Format is `[://][:]`. The default +scheme is `ldapi` if the path is absolute otherwise it's `ldaps`, and the permitted schemes are `ldap`, `ldaps`, or +`ldapi` (a unix domain socket). + +If the scheme is `ldapi` it must be followed by an absolute path to an existing unix domain socket that the +user/group the Authelia process is running as has the appropriate permissions to access. For example if the socket is +located at `/var/run/slapd.sock` the address should be `ldapi:///var/run/slapd.sock`. + +__Examples:__ + +```yaml +authentication_backend: + ldap: + address: 'ldaps://dc1.example.com' +``` + +```yaml +authentication_backend: + ldap: + address: 'ldap://[fd00:1111:2222:3333::1]' +``` + ### implementation {{< confkey type="string" default="custom" required="no" >}} @@ -125,27 +154,6 @@ Configures the LDAP implementation used by Authelia. See the [Implementation Guide](../../reference/guides/ldap.md#implementation-guide) for information. -### url - -{{< confkey type="string" required="yes" >}} - -The LDAP URL which consists of a scheme, address, and port. Format is `://
:` or -`://
` where scheme is either `ldap` or `ldaps`. - -```yaml -authentication_backend: - ldap: - url: ldaps://dc1.example.com -``` - -If utilising an IPv6 literal address it must be enclosed by square brackets: - -```yaml -authentication_backend: - ldap: - url: ldap://[fd00:1111:2222:3333::1] -``` - ### timeout {{< confkey type="duration" default="5s" required="no" >}} diff --git a/docs/content/en/configuration/identity-providers/open-id-connect.md b/docs/content/en/configuration/identity-providers/open-id-connect.md index e01cc1e53..0b1afe399 100644 --- a/docs/content/en/configuration/identity-providers/open-id-connect.md +++ b/docs/content/en/configuration/identity-providers/open-id-connect.md @@ -33,7 +33,7 @@ More information about the beta can be found in the [roadmap](../../roadmap/acti ```yaml identity_providers: oidc: - hmac_secret: this_is_a_secret_abc123abc123abc + hmac_secret: 'this_is_a_secret_abc123abc123abc' issuer_certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -101,48 +101,48 @@ identity_providers: 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. DO NOT USE== -----END RSA PRIVATE KEY----- - access_token_lifespan: 1h - authorize_code_lifespan: 1m - id_token_lifespan: 1h - refresh_token_lifespan: 90m + access_token_lifespan: '1h' + authorize_code_lifespan: '1m' + id_token_lifespan: '1h' + refresh_token_lifespan: '90m' enable_client_debug_messages: false - enforce_pkce: public_clients_only + enforce_pkce: 'public_clients_only' cors: endpoints: - - authorization - - token - - revocation - - introspection + - 'authorization' + - 'token' + - 'revocation' + - 'introspection' allowed_origins: - - https://example.com + - 'https://example.com' allowed_origins_from_client_redirect_uris: false clients: - - id: myapp - description: My Application + - id: 'myapp' + description: 'My Application' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. sector_identifier: '' public: false - authorization_policy: two_factor - consent_mode: explicit - pre_configured_consent_duration: 1w + authorization_policy: 'two_factor' + consent_mode: 'explicit' + pre_configured_consent_duration: '1w' audience: [] scopes: - - openid - - groups - - email - - profile + - 'openid' + - 'groups' + - 'email' + - 'profile' redirect_uris: - - https://oidc.example.com:8080/oauth2/callback + - 'https://oidc.example.com:8080/oauth2/callback' grant_types: - - refresh_token - - authorization_code + - 'refresh_token' + - 'authorization_code' response_types: - - code + - 'code' response_modes: - - form_post - - query - - fragment - userinfo_signing_algorithm: none + - 'form_post' + - 'query' + - 'fragment' + userinfo_signing_algorithm: 'none' ``` ## Options diff --git a/docs/content/en/configuration/methods/environment.md b/docs/content/en/configuration/methods/environment.md index 0aec76276..0019382fc 100644 --- a/docs/content/en/configuration/methods/environment.md +++ b/docs/content/en/configuration/methods/environment.md @@ -39,7 +39,7 @@ For example this YAML configuration: ```yaml log: - level: info + level: 'info' server: buffers: read: 4096 diff --git a/docs/content/en/configuration/miscellaneous/introduction.md b/docs/content/en/configuration/miscellaneous/introduction.md index 907d0e4a5..549542bdb 100644 --- a/docs/content/en/configuration/miscellaneous/introduction.md +++ b/docs/content/en/configuration/miscellaneous/introduction.md @@ -20,14 +20,16 @@ aliases: {{< config-alert-example >}} ```yaml -certificates_directory: /config/certs/ -default_redirection_url: https://home.example.com:8080/ -jwt_secret: v3ry_important_s3cr3t -theme: light +certificates_directory: '/config/certs/' +default_redirection_url: 'https://home.example.com:8080/' +jwt_secret: 'v3ry_important_s3cr3t' +theme: 'light' ``` ## Options +This section describes the individual configuration options. + ### certificates_directory This option defines the location of additional certificates to load into the trust chain specifically for Authelia. diff --git a/docs/content/en/configuration/miscellaneous/logging.md b/docs/content/en/configuration/miscellaneous/logging.md index 31efd03b8..2320168bb 100644 --- a/docs/content/en/configuration/miscellaneous/logging.md +++ b/docs/content/en/configuration/miscellaneous/logging.md @@ -22,14 +22,16 @@ The logging section tunes the logging settings. ```yaml log: - level: info - format: text - file_path: "" + level: 'info' + format: 'text' + file_path: '' keep_stdout: false ``` ## Options +This section describes the individual configuration options. + ### level {{< confkey type="string" default="info" required="no" >}} diff --git a/docs/content/en/configuration/miscellaneous/ntp.md b/docs/content/en/configuration/miscellaneous/ntp.md index 1542b6b20..048d31692 100644 --- a/docs/content/en/configuration/miscellaneous/ntp.md +++ b/docs/content/en/configuration/miscellaneous/ntp.md @@ -27,15 +27,17 @@ unless configured otherwise. ```yaml ntp: - address: "time.cloudflare.com:123" + address: 'udp://time.cloudflare.com:123' version: 3 - max_desync: 3s + max_desync: '3s' disable_startup_check: false disable_failure: false ``` ## Options +This section describes the individual configuration options. + ### address {{< confkey type="string" default="time.cloudflare.com:123" required="no" >}} @@ -43,6 +45,28 @@ ntp: Determines the address of the NTP server to retrieve the time from. The format is `:`, and both of these are required. +### address + +{{< confkey type="address" default="udp://time.cloudflare.com:123" required="no" >}} + +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* + +Configures the address for the NTP Server. The address itself is a connector and the scheme must be `udp`, +`udp4`, or `udp6`. + +__Examples:__ + +```yaml +ntp: + address: 'udp://127.0.0.1:123' +``` + +```yaml +ntp: + address: 'udp6://[fd00:1111:2222:3333::1]:123' +``` + ### version {{< confkey type="integer" default="4" required="no" >}} diff --git a/docs/content/en/configuration/miscellaneous/privacy-policy.md b/docs/content/en/configuration/miscellaneous/privacy-policy.md index a8a3b4ee1..327b7e821 100644 --- a/docs/content/en/configuration/miscellaneous/privacy-policy.md +++ b/docs/content/en/configuration/miscellaneous/privacy-policy.md @@ -25,6 +25,8 @@ privacy_policy: ## Options +This section describes the individual configuration options. + ### enabled {{< confkey type="boolean" default="false" required="no" >}} diff --git a/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md b/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md index 1381f04c3..f62bebd93 100644 --- a/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md +++ b/docs/content/en/configuration/miscellaneous/server-endpoints-authz.md @@ -23,16 +23,16 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' authn_strategies: [] ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' authn_strategies: [] auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' authn_strategies: [] legacy: - implementation: Legacy + implementation: 'Legacy' authn_strategies: [] ``` diff --git a/docs/content/en/configuration/miscellaneous/server.md b/docs/content/en/configuration/miscellaneous/server.md index 0021c4f25..de1bfb205 100644 --- a/docs/content/en/configuration/miscellaneous/server.md +++ b/docs/content/en/configuration/miscellaneous/server.md @@ -21,37 +21,37 @@ aliases: ```yaml server: - address: "tcp://:9091" - path: "" + address: 'tcp://:9091' + path: '' disable_healthcheck: false tls: - key: "" - certificate: "" + key: '' + certificate: '' client_certificates: [] headers: - csp_template: "" + csp_template: '' buffers: read: 4096 write: 4096 timeouts: - read: 6s - write: 6s - idle: 30s + read: '6s' + write: '6s' + idle: '30s' endpoints: enable_pprof: false enable_expvars: false authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' authn_strategies: [] ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' authn_strategies: [] auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' authn_strategies: [] legacy: - implementation: Legacy + implementation: 'Legacy' authn_strategies: [] ``` diff --git a/docs/content/en/configuration/notifications/file.md b/docs/content/en/configuration/notifications/file.md index 15f55314c..1bc73dac8 100644 --- a/docs/content/en/configuration/notifications/file.md +++ b/docs/content/en/configuration/notifications/file.md @@ -27,7 +27,7 @@ This method will use the plain text email template for readability purposes. notifier: disable_startup_check: false filesystem: - filename: /config/notification.txt + filename: '/config/notification.txt' ``` ## Options diff --git a/docs/content/en/configuration/notifications/smtp.md b/docs/content/en/configuration/notifications/smtp.md index 07fb3d82b..bd879e0e5 100644 --- a/docs/content/en/configuration/notifications/smtp.md +++ b/docs/content/en/configuration/notifications/smtp.md @@ -23,23 +23,22 @@ aliases: notifier: disable_startup_check: false smtp: - host: 127.0.0.1 - port: 1025 - timeout: 5s - username: test - password: password + address: 'smtp://127.0.0.1:25' + timeout: '5s' + username: 'test' + password: 'password' sender: "Authelia " - identifier: localhost + identifier: 'localhost' subject: "[Authelia] {title}" - startup_check_address: test@authelia.com + startup_check_address: 'test@authelia.com' disable_require_tls: false disable_starttls: false disable_html_emails: false tls: - server_name: smtp.example.com + server_name: 'smtp.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -113,31 +112,34 @@ notifier: This section describes the individual configuration options. -### host +### address -{{< confkey type="integer" required="yes" >}} +{{< confkey type="address" required="yes" >}} -The hostname of the SMTP server. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: - -```yaml -host: "[fd00:1111:2222:3333::1]" -``` - -### port - -{{< confkey type="integer" required="yes" >}} - -The port the SMTP service is listening on. - -A connection is securely established with TLS after a succesful STARTTLS negotiation. - -[Port 465 is an exception][docs-security-smtp-port] when supported by the mail server as a `submissions` service port. -STARTTLS negotiation is not required for this port, the connection is implicitly established with TLS. +Configures the address for the SMTP Server. The address itself is a connector and the scheme must be `smtp`, +`submission`, or `submissions`. The only difference between these schemes are the default ports and `submissions` +requires a TLS transport per [SMTP Ports Security Measures][docs-security-smtp-port], whereas `submission` and `smtp` +use a standard TCP transport and typically enforce StartTLS. [docs-security-smtp-port]: ../../overview/security/measures.md#smtp-ports +__Examples:__ + +```yaml +notifier: + smtp: + address: 'smtp://127.0.0.1:25' +``` + +```yaml +notifier: + smtp: + address: 'submissions://[fd00:1111:2222:3333::1]:465' +``` + ### timeout {{< confkey type="duration" default="5s" required="no" >}} @@ -241,10 +243,10 @@ You need to generate an app password in order to use Gmail SMTP servers. The pro ```yaml notifier: smtp: - username: myaccount@gmail.com + username: 'myaccount@gmail.com' # Password can also be set using a secret: https://www.authelia.com/configuration/methods/secrets/ - password: yourapppassword - sender: admin@example.com - host: smtp.gmail.com + password: 'yourapppassword' + sender: 'admin@example.com' + host: 'smtp.gmail.com' port: 587 ``` diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index 8aa6a2d3e..4e8f54a95 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -92,17 +92,31 @@ These values are more human readable but have only been available since v4.38.0. The base type for this syntax is a string. -The address type is a string that indicates how to configure a listener or connector, which are the two primary -categories of addresses. +The address type is a string that indicates how to configure a listener (i.e. listening for connections) or connector +(i.e. opening remote connections), which are the two primary categories of addresses. -The address values take the following formats: + +#### Format + +This section outlines the format for these strings. The formats use a conventional POSIX format to indicate optional and +required elements. The square brackets `[]` surround optional portions, and the angled brackets `<>` surround required +portions. Required portions may exist within optional portions, in which case they are often accompanied with other +format specific text which indicates if the accompanying text exists then it is actually required, otherwise it's +entirely optional. + +The connector address values take the following formats: ```text [://][:] -[://]: unix:// ``` +The listener address values take the following additional formats: + +```text +[://]: +``` + Examples: ```text @@ -121,7 +135,7 @@ The square brackets indicate optional sections, and the angled brackets indicate sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration requirement that one of these is provided. -### scheme +#### scheme The entire scheme is optional, but if the scheme host delimiter `://` is in the string, the scheme must be present. The scheme must be one of the following (the listeners and connectors columns indicate support for the scheme on the @@ -147,7 +161,7 @@ If the scheme is absent, the default scheme is assumed. If the address has a `/` otherwise it's assumed to be`tcp`. If the scheme is `unix` it must be suffixed with an absolute path i.e. `/var/local/authelia.sock` would be represented as `unix:///var/run/authelia.sock`. -### hostname +#### hostname The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [port](#port) specified. It can be any IP that is locally addressable or a hostname which resolves to a locally addressable IP. @@ -155,7 +169,7 @@ can be any IP that is locally addressable or a hostname which resolves to a loca If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address `::1` with the `tcp` scheme and port `80` the correct address would be `tcp://[::1]:80`. -### port +#### port The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [hostname](#hostname) specified. diff --git a/docs/content/en/configuration/second-factor/duo.md b/docs/content/en/configuration/second-factor/duo.md index 6b3bebbfc..6ac7b0cd7 100644 --- a/docs/content/en/configuration/second-factor/duo.md +++ b/docs/content/en/configuration/second-factor/duo.md @@ -30,9 +30,9 @@ section of the configuration. ```yaml duo_api: disable: false - hostname: api-123456789.example.com - integration_key: ABCDEF - secret_key: 1234567890abcdefghifjkl + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' + secret_key: '1234567890abcdefghifjkl' enable_self_enrollment: false ``` diff --git a/docs/content/en/configuration/second-factor/time-based-one-time-password.md b/docs/content/en/configuration/second-factor/time-based-one-time-password.md index 9b2279389..1ca1c216a 100644 --- a/docs/content/en/configuration/second-factor/time-based-one-time-password.md +++ b/docs/content/en/configuration/second-factor/time-based-one-time-password.md @@ -31,8 +31,8 @@ and many only support SHA1. ```yaml totp: disable: false - issuer: authelia.com - algorithm: sha1 + issuer: 'authelia.com' + algorithm: 'sha1' digits: 6 period: 30 skew: 1 diff --git a/docs/content/en/configuration/second-factor/webauthn.md b/docs/content/en/configuration/second-factor/webauthn.md index 17f295559..fd8966a71 100644 --- a/docs/content/en/configuration/second-factor/webauthn.md +++ b/docs/content/en/configuration/second-factor/webauthn.md @@ -21,10 +21,10 @@ aliases: ```yaml webauthn: disable: false - display_name: Authelia - attestation_conveyance_preference: indirect - user_verification: preferred - timeout: 60s + display_name: 'Authelia' + attestation_conveyance_preference: 'indirect' + user_verification: 'preferred' + timeout: '60s' ``` ## Options diff --git a/docs/content/en/configuration/security/access-control.md b/docs/content/en/configuration/security/access-control.md index 5edc77b46..b4d43a15d 100644 --- a/docs/content/en/configuration/security/access-control.md +++ b/docs/content/en/configuration/security/access-control.md @@ -21,9 +21,9 @@ aliases: ```yaml access_control: - default_policy: deny + default_policy: 'deny' networks: - - name: internal + - name: 'internal' networks: - '10.0.0.0/8' - '172.16.0.0/12' @@ -31,7 +31,7 @@ access_control: rules: - domain: 'private.example.com' domain_regex: '^(\d+\-)?priv-img.example.com$' - policy: one_factor + policy: 'one_factor' networks: - 'internal' - '1.1.1.1' @@ -40,8 +40,8 @@ access_control: - ['user:fred'] - ['group:admins'] methods: - - GET - - HEAD + - 'GET' + - 'HEAD' resources: - '^/api.*' query: @@ -154,10 +154,10 @@ different ways.* access_control: rules: - domain: '*.example.com' - policy: bypass + policy: 'bypass' - domain: - '*.example.com' - policy: bypass + policy: 'bypass' ``` *Multiple domains matched. These rules will match either `apple.example.com` or `orange.example.com`. All rules in this @@ -167,11 +167,11 @@ list are effectively the same rule just expressed in different ways.* access_control: rules: - domain: ['apple.example.com', 'banana.example.com'] - policy: bypass + policy: 'bypass' - domain: - - apple.example.com - - banana.example.com - policy: bypass + - 'apple.example.com' + - 'banana.example.com' + policy: 'bypass' ``` *Multiple domains matched either via a static domain or via a [domain_regex]. This rule will match @@ -217,7 +217,7 @@ access_control: - domain_regex: - '^user-(?P\w+)\.example\.com$' - '^group-(?P\w+)\.example\.com$' - policy: one_factor + policy: 'one_factor' ``` *Multiple domains example, one with a static domain and one with a regex domain. This will match requests to @@ -228,7 +228,7 @@ access_control: rules: - domain: 'protected.example.com' - domain_regex: '^(img|data)-private\.example\.com' - policy: one_factor + policy: 'one_factor' ``` #### policy @@ -267,14 +267,14 @@ ways.* ```yaml access_control: rules: - - domain: example.com - policy: two_factor + - domain: 'example.com' + policy: 'two_factor' subject: - 'user:john' - ['group:admin', 'group:app-name'] - 'group:super-admin' - - domain: example.com - policy: two_factor + - domain: 'example.com' + policy: 'two_factor' subject: - ['user:john'] - ['group:admin', 'group:app-name'] @@ -287,15 +287,15 @@ expressed in different ways.* ```yaml access_control: rules: - - domain: example.com - policy: one_factor + - domain: 'example.com' + policy: 'one_factor' subject: 'group:super-admin' - - domain: example.com - policy: one_factor + - domain: 'example.com' + policy: 'one_factor' subject: - 'group:super-admin' - - domain: example.com - policy: one_factor + - domain: 'example.com' + policy: 'one_factor' subject: - ['group:super-admin'] ``` @@ -332,10 +332,10 @@ relevant methods are listed in this table: ```yaml access_control: rules: - - domain: example.com - policy: bypass + - domain: 'example.com' + policy: 'bypass' methods: - - OPTIONS + - 'OPTIONS' ``` #### networks @@ -369,28 +369,28 @@ rules in this list are effectively the same rule just expressed in different way ```yaml access_control: - default_policy: two_factor + default_policy: 'two_factor' networks: - - name: internal + - name: 'internal' networks: - '10.0.0.0/8' - '172.16.0.0/12' - '192.168.0.0/18' rules: - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' networks: - '10.0.0.0/8' - '172.16.0.0/12' - '192.168.0.0/18' - '112.134.145.167/32' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' networks: - 'internal' - '112.134.145.167/32' - - domain: secure.example.com - policy: two_factor + - domain: 'secure.example.com' + policy: 'two_factor' ``` #### resources @@ -425,8 +425,8 @@ likely save you a lot of time if you do it for all resource rules. ```yaml access_control: rules: - - domain: app.example.com - policy: bypass + - domain: 'app.example.com' + policy: 'bypass' resources: - '^/api([/?].*)?$' ``` @@ -471,8 +471,8 @@ defaults to `present`. ```yaml access_control: rules: - - domain: app.example.com - policy: bypass + - domain: 'app.example.com' + policy: 'bypass' query: - - operator: 'present' key: 'secure' @@ -549,13 +549,13 @@ a match for that request. - domain: - 'example.com' - '*.example.com' - policy: bypass + policy: 'bypass' resources: - '^/api$' - '^/api/' - domain: - 'app.example.com' - policy: two_factor + policy: 'two_factor' ``` [Rule Matching Concept 1]: #rule-matching-concept-1-sequential-order @@ -607,25 +607,25 @@ Here is a detailed example of an example access control section: ```yaml access_control: - default_policy: deny + default_policy: 'deny' networks: - - name: internal + - name: 'internal' networks: - '10.10.0.0/16' - '192.168.2.0/24' - - name: VPN - networks: 10.9.0.0/16 + - name: 'VPN' + networks: '10.9.0.0/16' rules: - domain: 'public.example.com' - policy: bypass + policy: 'bypass' - domain: '*.example.com' - policy: bypass + policy: 'bypass' methods: - - OPTIONS + - 'OPTIONS' - domain: 'secure.example.com' - policy: one_factor + policy: 'one_factor' networks: - 'internal' - 'VPN' @@ -635,37 +635,37 @@ access_control: - domain: - 'secure.example.com' - 'private.example.com' - policy: two_factor + policy: 'two_factor' - domain: 'singlefactor.example.com' - policy: one_factor + policy: 'one_factor' - domain: 'mx2.mail.example.com' subject: 'group:admins' - policy: deny + policy: 'deny' - domain: '*.example.com' subject: - 'group:admins' - 'group:moderators' - policy: two_factor + policy: 'two_factor' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - '^/groups/dev/.*$' subject: 'group:dev' - policy: two_factor + policy: 'two_factor' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - '^/users/john/.*$' subject: - ['group:dev', 'user:john'] - 'group:admins' - policy: two_factor + policy: 'two_factor' - domain: '{user}.example.com' - policy: bypass + policy: 'bypass' ``` [RFC7231]: https://datatracker.ietf.org/doc/html/rfc7231 diff --git a/docs/content/en/configuration/security/regulation.md b/docs/content/en/configuration/security/regulation.md index b3e4a58e6..3c818095d 100644 --- a/docs/content/en/configuration/security/regulation.md +++ b/docs/content/en/configuration/security/regulation.md @@ -25,8 +25,8 @@ authentication attempts. This helps prevent brute-force attacks. ```yaml regulation: max_retries: 3 - find_time: 2m - ban_time: 5m + find_time: '2m' + ban_time: '5m' ``` ## Options diff --git a/docs/content/en/configuration/session/introduction.md b/docs/content/en/configuration/session/introduction.md index 53c337396..323cd505d 100644 --- a/docs/content/en/configuration/session/introduction.md +++ b/docs/content/en/configuration/session/introduction.md @@ -24,22 +24,20 @@ the session cookie behaviour and the domains which Authelia can service authoriz ```yaml session: - secret: insecure_session_secret - - name: authelia_session - same_site: lax - inactivity: 5m - expiration: 1h - remember_me: 1M - + secret: 'insecure_session_secret' + name: 'authelia_session' + same_site: 'lax' + inactivity: '5m' + expiration: '1h' + remember_me: '1M' cookies: - - domain: example.com - authelia_url: https://auth.example.com - name: authelia_session - same_site: lax - inactivity: 5m - expiration: 1h - remember_me: 1d + - domain: 'example.com' + authelia_url: 'https://auth.example.com' + name: 'authelia_session' + same_site: 'lax' + inactivity: '5m' + expiration: '1h' + remember_me: '1d' ``` ## Providers diff --git a/docs/content/en/configuration/session/redis.md b/docs/content/en/configuration/session/redis.md index b36d51d08..fe8a8de01 100644 --- a/docs/content/en/configuration/session/redis.md +++ b/docs/content/en/configuration/session/redis.md @@ -25,18 +25,18 @@ this option and we highly recommend it in production environments. It requires y ```yaml session: redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 - username: authelia - password: authelia + username: 'authelia' + password: 'authelia' database_index: 0 maximum_active_connections: 8 minimum_idle_connections: 0 tls: - server_name: myredis.example.com + server_name: 'myredis.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -105,15 +105,15 @@ session: DO NOT USE== -----END RSA PRIVATE KEY----- high_availability: - sentinel_name: mysentinel + sentinel_name: 'mysentinel' # If `sentinel_username` is supplied, Authelia will connect using ACL-based # authentication. Otherwise, it will use traditional `requirepass` auth. - sentinel_username: sentinel_user - sentinel_password: sentinel_specific_pass + sentinel_username: 'sentinel_user' + sentinel_password: 'sentinel_specific_pass' nodes: - - host: sentinel-node1 + - host: 'sentinel-node1' port: 26379 - - host: sentinel-node2 + - host: 'sentinel-node2' port: 26379 route_by_latency: false route_randomly: false diff --git a/docs/content/en/configuration/storage/introduction.md b/docs/content/en/configuration/storage/introduction.md index 97fcf08bf..8f7a44efc 100644 --- a/docs/content/en/configuration/storage/introduction.md +++ b/docs/content/en/configuration/storage/introduction.md @@ -25,7 +25,7 @@ The available storage backends are listed in the table of contents below. ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' local: {} mysql: {} postgres: {} diff --git a/docs/content/en/configuration/storage/mysql.md b/docs/content/en/configuration/storage/mysql.md index d5a9f0181..bbe02ff0a 100644 --- a/docs/content/en/configuration/storage/mysql.md +++ b/docs/content/en/configuration/storage/mysql.md @@ -26,19 +26,18 @@ guide for supported version information. ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia - password: mypassword - timeout: 5s + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' + password: 'mypassword' + timeout: '5s' tls: - server_name: mysql.example.com + server_name: 'mysql.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -116,33 +115,35 @@ This section describes the individual configuration options. See the [encryption_key docs](introduction.md#encryption_key). -### host +### address -{{< confkey type="string" default="localhost" required="no" >}} +{{< confkey type="address" required="yes" >}} -The database server host. This can also be a unix socket. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: +Configures the address for the MySQL/MariaDB Server. The address itself is a connector and the scheme must either be +the `unix` scheme or one of the `tcp` schemes. + +__Examples:__ ```yaml storage: mysql: - host: "[fd00:1111:2222:3333::1]" + address: 'tcp://127.0.0.1:3306' ``` -If utilizing a unix socket it must have the `/` prefix: - ```yaml storage: mysql: - host: /var/run/mysqld.sock + address: 'tcp://[fd00:1111:2222:3333::1]:3306' ``` -### port - -{{< confkey type="integer" default="3306" required="no" >}} - -The port the database server is listening on. +```yaml +storage: + mysql: + address: 'unix:///var/run/mysqld.sock' +``` ### database diff --git a/docs/content/en/configuration/storage/postgres.md b/docs/content/en/configuration/storage/postgres.md index 2deab5050..f7ca07238 100644 --- a/docs/content/en/configuration/storage/postgres.md +++ b/docs/content/en/configuration/storage/postgres.md @@ -25,19 +25,18 @@ guide for supported version information. ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' postgres: - host: 127.0.0.1 - port: 5432 - database: authelia - schema: public - username: authelia - password: mypassword + address: 'tcp://127.0.0.1:5432' + database: 'authelia' + schema: 'public' + username: 'authelia' + password: 'mypassword' tls: - server_name: postgres.example.com + server_name: 'postgres.example.com' skip_verify: false - minimum_version: TLS1.2 - maximum_version: TLS1.3 + minimum_version: 'TLS1.2' + maximum_version: 'TLS1.3' certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -113,35 +112,37 @@ This section describes the individual configuration options. ### encryption_key -See the [encryption_key docs](introduction.md#encryption_key). +See the [encryption_key docs](introduction.md#encryptionkey). -### host +### address -{{< confkey type="string" required="yes" >}} +{{< confkey type="address" required="yes" >}} -The database server host. This can also be a unix socket. +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* -If utilising an IPv6 literal address it must be enclosed by square brackets and quoted: +Configures the address for the PostgreSQL Server. The address itself is a connector and the scheme must either be +the `unix` scheme or one of the `tcp` schemes. + +__Examples:__ ```yaml storage: postgres: - host: "[fd00:1111:2222:3333::1]" + address: 'tcp://127.0.0.1:5432' ``` -If utilizing a unix socket it must have the `/` prefix: - ```yaml storage: postgres: - host: /var/run/postgres.sock + address: 'tcp://[fd00:1111:2222:3333::1]:5432' ``` -### port - -{{< confkey type="integer" default="5432" required="no" >}} - -The port the database server is listening on. +```yaml +storage: + postgres: + address: 'unix:///var/run/postgres.sock' +``` ### database diff --git a/docs/content/en/configuration/storage/sqlite.md b/docs/content/en/configuration/storage/sqlite.md index 631003a7e..417388a4d 100644 --- a/docs/content/en/configuration/storage/sqlite.md +++ b/docs/content/en/configuration/storage/sqlite.md @@ -28,9 +28,9 @@ but this requires you setup an external database such as [PostgreSQL](postgres.m ```yaml storage: - encryption_key: a_very_important_secret + encryption_key: 'a_very_important_secret' local: - path: /config/db.sqlite3 + path: '/config/db.sqlite3' ``` ## Options diff --git a/docs/content/en/configuration/telemetry/metrics.md b/docs/content/en/configuration/telemetry/metrics.md index 2f213c732..4e277752d 100644 --- a/docs/content/en/configuration/telemetry/metrics.md +++ b/docs/content/en/configuration/telemetry/metrics.md @@ -22,14 +22,14 @@ toc: true telemetry: metrics: enabled: false - address: "tcp://:9959" + address: 'tcp://:9959' buffers: read: 4096 write: 4096 timeouts: - read: 6s - write: 6s - idle: 30s + read: '6s' + write: '6s' + idle: '30s' ``` ## Options diff --git a/docs/content/en/integration/kubernetes/istio.md b/docs/content/en/integration/kubernetes/istio.md index 60360c6b0..9201d50c5 100644 --- a/docs/content/en/integration/kubernetes/istio.md +++ b/docs/content/en/integration/kubernetes/istio.md @@ -30,8 +30,8 @@ This is an example IstioOperator manifest adjusted to authenticate with Authelia portions of the resource that you add as well as context. You will need to adapt it to your needs. ```yaml -apiVersion: install.istio.io/v1alpha1 -kind: IstioOperator +apiVersion: 'install.istio.io/v1alpha1' +kind: 'IstioOperator' spec: meshConfig: extensionProviders: @@ -63,13 +63,13 @@ spec: The following [Authorization Policy] applies the above filter extension provider to the `nextcloud.example.com` domain: ```yaml -apiVersion: security.istio.io/v1beta1 -kind: AuthorizationPolicy +apiVersion: 'security.istio.io/v1beta1' +kind: 'AuthorizationPolicy' metadata: - name: nextcloud - namespace: apps + name: 'nextcloud' + namespace: 'apps' spec: - action: CUSTOM + action: 'CUSTOM' provider: name: 'authelia' rules: diff --git a/docs/content/en/integration/kubernetes/traefik-ingress.md b/docs/content/en/integration/kubernetes/traefik-ingress.md index 3a50d8e9e..d2ffd2d38 100644 --- a/docs/content/en/integration/kubernetes/traefik-ingress.md +++ b/docs/content/en/integration/kubernetes/traefik-ingress.md @@ -51,14 +51,14 @@ __SHOULD NOT__ be applied to the Authelia [Ingress] / [IngressRoute] itself.* {{< details "middleware.yml" >}} ```yaml --- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware +apiVersion: 'traefik.containo.us/v1alpha1' +kind: 'Middleware' metadata: - name: forwardauth-authelia - namespace: default + name: 'forwardauth-authelia' + namespace: 'default' labels: - app.kubernetes.io/instance: authelia - app.kubernetes.io/name: authelia + app.kubernetes.io/instance: 'authelia' + app.kubernetes.io/name: 'authelia' spec: forwardAuth: address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth' @@ -85,25 +85,25 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat {{< details "ingress.yml" >}} ```yaml --- -apiVersion: networking.k8s.io/v1 -kind: Ingress +apiVersion: 'networking.k8s.io/v1' +kind: 'Ingress' metadata: - name: app - namespace: default + name: 'app' + namespace: 'default' annotations: - traefik.ingress.kubernetes.io/router.entryPoints: websecure - traefik.ingress.kubernetes.io/router.middlewares: default-forwardauth-authelia@kubernetescrd - traefik.ingress.kubernetes.io/router.tls: "true" + traefik.ingress.kubernetes.io/router.entryPoints: 'websecure' + traefik.ingress.kubernetes.io/router.middlewares: 'default-forwardauth-authelia@kubernetescrd' + traefik.ingress.kubernetes.io/router.tls: 'true' spec: rules: - - host: app.example.com + - host: 'app.example.com' http: paths: - - path: /bar - pathType: Prefix + - path: '/bar' + pathType: 'Prefix' backend: service: - name: app + name: 'app' port: number: 80 ... @@ -119,27 +119,27 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat {{< details "ingressRoute.yml" >}} ```yaml --- -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute +apiVersion: 'traefik.containo.us/v1alpha1' +kind: 'IngressRoute' metadata: - name: app - namespace: default + name: 'app' + namespace: 'default' spec: entryPoints: - - websecure + - 'websecure' routes: - - kind: Rule - match: Host(`app.example.com`) + - kind: 'Rule' + match: 'Host(`app.example.com`)' middlewares: - - name: forwardauth-authelia - namespace: default + - name: 'forwardauth-authelia' + namespace: 'default' services: - - kind: Service - name: app - namespace: default + - kind: 'Service' + name: 'app' + namespace: 'default' port: 80 - scheme: http - strategy: RoundRobin + scheme: 'http' + strategy: 'RoundRobin' weight: 10 ... ``` diff --git a/docs/content/en/integration/ldap/introduction.md b/docs/content/en/integration/ldap/introduction.md index 596caa125..6988ee9e7 100644 --- a/docs/content/en/integration/ldap/introduction.md +++ b/docs/content/en/integration/ldap/introduction.md @@ -44,8 +44,8 @@ In your Authelia configuration you will need to enter and update the following v ```yaml ldap: + address: 'ldap://OpenLDAP:1389' implementation: custom - url: ldap://OpenLDAP:1389 timeout: 5s start_tls: false tls: @@ -91,8 +91,8 @@ In your Authelia configuration you will need to enter and update the following v ```yaml ldap: + address: 'ldaps://ldap.example.com' implementation: custom - url: ldaps://ldap.example.com timeout: 5s start_tls: false tls: @@ -134,8 +134,8 @@ In your Authelia configuration you will need to enter and update the following v ```yaml ldap: + address: 'ldap://lldap:3890' implementation: custom - url: ldap://lldap:3890 timeout: 5s start_tls: false base_dn: dc=example,DC=com diff --git a/docs/content/en/integration/openid-connect/apache-guacamole/index.md b/docs/content/en/integration/openid-connect/apache-guacamole/index.md index 856ed202f..ac21220f2 100644 --- a/docs/content/en/integration/openid-connect/apache-guacamole/index.md +++ b/docs/content/en/integration/openid-connect/apache-guacamole/index.md @@ -62,23 +62,23 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: guacamole - description: Apache Guacamole + - id: 'guacamole' + description: 'Apache Guacamole' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://guacamole.example.com + - 'https://guacamole.example.com' scopes: - - openid - - profile - - groups - - email + - 'openid' + - 'profile' + - 'groups' + - 'email' response_types: - - id_token + - 'id_token' grant_types: - - implicit - userinfo_signing_algorithm: none + - 'implicit' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/argocd/index.md b/docs/content/en/integration/openid-connect/argocd/index.md index b37fd2e1d..43071cced 100644 --- a/docs/content/en/integration/openid-connect/argocd/index.md +++ b/docs/content/en/integration/openid-connect/argocd/index.md @@ -65,32 +65,32 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: argocd - description: Argo CD + - id: 'argocd' + description: 'Argo CD' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://argocd.example.com/auth/callback + - 'https://argocd.example.com/auth/callback' scopes: - - openid - - groups - - email - - profile - userinfo_signing_algorithm: none - - id: argocd-cli - description: Argo CD (CLI) + - 'openid' + - 'groups' + - 'email' + - 'profile' + userinfo_signing_algorithm: 'none' + - id: 'argocd-cli' + description: 'Argo CD (CLI)' public: true - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - http://localhost:8085/auth/callback + - 'http://localhost:8085/auth/callback' scopes: - - openid - - groups - - email - - profile - - offline_access - userinfo_signing_algorithm: none + - 'openid' + - 'groups' + - 'email' + - 'profile' + - 'offline_access' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/bookstack/index.md b/docs/content/en/integration/openid-connect/bookstack/index.md index 73e8214a2..3d8ef133c 100644 --- a/docs/content/en/integration/openid-connect/bookstack/index.md +++ b/docs/content/en/integration/openid-connect/bookstack/index.md @@ -67,18 +67,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: bookstack - description: BookStack + - id: 'bookstack' + description: 'BookStack' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://bookstack.example.com/oidc/callback + - 'https://bookstack.example.com/oidc/callback' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md b/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md index eecf2c9fc..2259f473a 100644 --- a/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md +++ b/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md @@ -75,18 +75,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: cloudflare - description: Cloudflare ZeroTrust + - id: 'cloudflare' + description: 'Cloudflare ZeroTrust' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://example-team.cloudflareaccess.com/cdn-cgi/access/callback + - 'https://example-team.cloudflareaccess.com/cdn-cgi/access/callback' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/firezone/index.md b/docs/content/en/integration/openid-connect/firezone/index.md index 39728c5a1..121c49cc3 100644 --- a/docs/content/en/integration/openid-connect/firezone/index.md +++ b/docs/content/en/integration/openid-connect/firezone/index.md @@ -76,20 +76,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: firezone - description: Firezone + - id: 'firezone' + description: 'Firezone' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' enforce_pkce: true - pkce_challenge_method: S256 + pkce_challenge_method: 'S256' redirect_uris: - - https://firezone.example.com/auth/oidc/authelia/callback + - 'https://firezone.example.com/auth/oidc/authelia/callback' scopes: - - openid - - email - - profile - userinfo_signing_algorithm: none + - 'openid' + - 'email' + - 'profile' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/frequently-asked-questions.md b/docs/content/en/integration/openid-connect/frequently-asked-questions.md index 0862e1f1a..e7557003c 100644 --- a/docs/content/en/integration/openid-connect/frequently-asked-questions.md +++ b/docs/content/en/integration/openid-connect/frequently-asked-questions.md @@ -132,7 +132,7 @@ services: ## Mandatory that the proxy is on the same network as the application, and that it has this alias. proxy: aliases: - - auth.example.com + - 'auth.example.com' authelia: networks: proxy: {} @@ -140,7 +140,7 @@ networks: proxy: ## An external network can be created manually and shared between multiple compose files. This is NOT mandatory. external: true - name: proxy-net + name: 'proxy-net' ``` ```console diff --git a/docs/content/en/integration/openid-connect/gitea/index.md b/docs/content/en/integration/openid-connect/gitea/index.md index c51fdc238..ed4c691c9 100644 --- a/docs/content/en/integration/openid-connect/gitea/index.md +++ b/docs/content/en/integration/openid-connect/gitea/index.md @@ -86,18 +86,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: gitea - description: Gitea + - id: 'gitea' + description: 'Gitea' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://gitea.example.com/user/oauth2/authelia/callback + - 'https://gitea.example.com/user/oauth2/authelia/callback' scopes: - - openid - - email - - profile - userinfo_signing_algorithm: none + - 'openid' + - 'email' + - 'profile' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/gitlab/index.md b/docs/content/en/integration/openid-connect/gitlab/index.md index 72bc826bd..71ba8d01c 100644 --- a/docs/content/en/integration/openid-connect/gitlab/index.md +++ b/docs/content/en/integration/openid-connect/gitlab/index.md @@ -78,19 +78,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: gitlab - description: GitLab + - id: 'gitlab' + description: 'GitLab' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://gitlab.example.com/users/auth/openid_connect/callback + - 'https://gitlab.example.com/users/auth/openid_connect/callback' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/grafana/index.md b/docs/content/en/integration/openid-connect/grafana/index.md index 45fc15f79..245b588c6 100644 --- a/docs/content/en/integration/openid-connect/grafana/index.md +++ b/docs/content/en/integration/openid-connect/grafana/index.md @@ -96,19 +96,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: grafana - description: Grafana + - id: 'grafana' + description: 'Grafana' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://grafana.example.com/login/generic_oauth + - 'https://grafana.example.com/login/generic_oauth' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/harbor/index.md b/docs/content/en/integration/openid-connect/harbor/index.md index 42d42909b..2c8223657 100644 --- a/docs/content/en/integration/openid-connect/harbor/index.md +++ b/docs/content/en/integration/openid-connect/harbor/index.md @@ -69,19 +69,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: harbor - description: Harbor + - id: 'harbor' + description: 'Harbor' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://harbor.example.com/c/oidc/callback + - 'https://harbor.example.com/c/oidc/callback' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/hashicorp-vault/index.md b/docs/content/en/integration/openid-connect/hashicorp-vault/index.md index 2f14beb74..8c5a9713c 100644 --- a/docs/content/en/integration/openid-connect/hashicorp-vault/index.md +++ b/docs/content/en/integration/openid-connect/hashicorp-vault/index.md @@ -52,20 +52,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: vault - description: HashiCorp Vault + - id: 'vault' + description: 'HashiCorp Vault' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://vault.example.com/oidc/callback - - https://vault.example.com/ui/vault/auth/oidc/oidc/callback + - 'https://vault.example.com/oidc/callback' + - 'https://vault.example.com/ui/vault/auth/oidc/oidc/callback' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/kasm-workspaces/index.md b/docs/content/en/integration/openid-connect/kasm-workspaces/index.md index 2860bcbf1..873c04098 100644 --- a/docs/content/en/integration/openid-connect/kasm-workspaces/index.md +++ b/docs/content/en/integration/openid-connect/kasm-workspaces/index.md @@ -67,20 +67,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: kasm - description: Kasm Workspaces + - id: 'kasm' + description: 'Kasm Workspaces' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://kasm.example.com/api/oidc_callback + - 'https://kasm.example.com/api/oidc_callback' scopes: - - openid - - profile - - groups - - email - consent_mode: implicit - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + consent_mode: 'implicit' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/komga/index.md b/docs/content/en/integration/openid-connect/komga/index.md index d07272e71..2299af893 100644 --- a/docs/content/en/integration/openid-connect/komga/index.md +++ b/docs/content/en/integration/openid-connect/komga/index.md @@ -50,16 +50,16 @@ spring: client: registration: authelia: - client-id: `komga` - client-secret: `insecure_secret` - client-name: Authelia - scope: openid,profile,email - authorization-grant-type: authorization_code + client-id: 'komga' + client-secret: 'insecure_secret' + client-name: 'Authelia' + scope: 'openid,profile,email' + authorization-grant-type: 'authorization_code' redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/login/oauth2/code/authelia" provider: authelia: - issuer-uri: https://auth.example.com - user-name-attribute: preferred_username + issuer-uri: 'https://auth.example.com' + user-name-attribute: 'preferred_username' ```` ### Authelia @@ -74,20 +74,20 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: komga - description: Komga + - id: 'komga' + description: 'Komga' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://komga.example.com/login/oauth2/code/authelia + - 'https://komga.example.com/login/oauth2/code/authelia' scopes: - - openid - - profile - - email + - 'openid' + - 'profile' + - 'email' grant_types: - - authorization_code - userinfo_signing_algorithm: none + - 'authorization_code' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/minio/index.md b/docs/content/en/integration/openid-connect/minio/index.md index 6a0b2c801..8b3067002 100644 --- a/docs/content/en/integration/openid-connect/minio/index.md +++ b/docs/content/en/integration/openid-connect/minio/index.md @@ -72,19 +72,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: minio - description: MinIO + - id: 'minio' + description: 'MinIO' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://minio.example.com/apps/oidc_login/oidc + - 'https://minio.example.com/apps/oidc_login/oidc' scopes: - - openid - - profile - - email - - groups - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + - 'groups' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/misago/index.md b/docs/content/en/integration/openid-connect/misago/index.md index d462c25e5..dc11c8efc 100644 --- a/docs/content/en/integration/openid-connect/misago/index.md +++ b/docs/content/en/integration/openid-connect/misago/index.md @@ -87,23 +87,24 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: misago + - id: 'misago' + description: 'Misago' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' scopes: - - openid - - profile - - email + - 'openid' + - 'profile' + - 'email' redirect_uris: - - https://misago.example.com/oauth2/complete/ + - 'https://misago.example.com/oauth2/complete/' grant_types: - - authorization_code + - 'authorization_code' response_types: - - code + - 'code' response_modes: - - query - userinfo_signing_algorithm: none + - 'query' + userinfo_signing_algorithm: 'none' ``` --- diff --git a/docs/content/en/integration/openid-connect/nextcloud/index.md b/docs/content/en/integration/openid-connect/nextcloud/index.md index 83249dc46..540e2069e 100644 --- a/docs/content/en/integration/openid-connect/nextcloud/index.md +++ b/docs/content/en/integration/openid-connect/nextcloud/index.md @@ -95,19 +95,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: nextcloud - description: NextCloud + - id: 'nextcloud' + description: 'NextCloud' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://nextcloud.example.com/apps/oidc_login/oidc + - 'https://nextcloud.example.com/apps/oidc_login/oidc' scopes: - - openid - - profile - - email - - groups - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + - 'groups' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/outline/index.md b/docs/content/en/integration/openid-connect/outline/index.md index c01c7720a..1a330e0f8 100644 --- a/docs/content/en/integration/openid-connect/outline/index.md +++ b/docs/content/en/integration/openid-connect/outline/index.md @@ -69,19 +69,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: outline - description: Outline + - id: 'outline' + description: 'Outline' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://outline.example.com/auth/oidc.callback + - 'https://outline.example.com/auth/oidc.callback' scopes: - - openid - - offline_access - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'offline_access' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/portainer/index.md b/docs/content/en/integration/openid-connect/portainer/index.md index 511461cdc..e50a282da 100644 --- a/docs/content/en/integration/openid-connect/portainer/index.md +++ b/docs/content/en/integration/openid-connect/portainer/index.md @@ -70,19 +70,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: portainer - description: Portainer + - id: 'portainer' + description: 'Portainer' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://portainer.example.com + - 'https://portainer.example.com' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/proxmox/index.md b/docs/content/en/integration/openid-connect/proxmox/index.md index f7ba35255..17eefafc9 100644 --- a/docs/content/en/integration/openid-connect/proxmox/index.md +++ b/docs/content/en/integration/openid-connect/proxmox/index.md @@ -74,18 +74,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: proxmox - description: Proxmox + - id: 'proxmox' + description: 'Proxmox' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://proxmox.example.com + - 'https://proxmox.example.com' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/seafile/index.md b/docs/content/en/integration/openid-connect/seafile/index.md index 0a1d5d021..41b4e1482 100644 --- a/docs/content/en/integration/openid-connect/seafile/index.md +++ b/docs/content/en/integration/openid-connect/seafile/index.md @@ -78,18 +78,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: seafile - description: Seafile + - id: 'seafile' + description: 'Seafile' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://seafile.example.com/oauth/callback/ + - 'https://seafile.example.com/oauth/callback/' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/synapse/index.md b/docs/content/en/integration/openid-connect/synapse/index.md index 13428e28f..1927f306e 100644 --- a/docs/content/en/integration/openid-connect/synapse/index.md +++ b/docs/content/en/integration/openid-connect/synapse/index.md @@ -72,18 +72,18 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: synapse - description: Synapse + - id: 'synapse' + description: 'Synapse' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://synapse.example.com/_synapse/client/oidc/callback + - 'https://synapse.example.com/_synapse/client/oidc/callback' scopes: - - openid - - profile - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/synology-dsm/index.md b/docs/content/en/integration/openid-connect/synology-dsm/index.md index e6de3acec..a5dcd075e 100644 --- a/docs/content/en/integration/openid-connect/synology-dsm/index.md +++ b/docs/content/en/integration/openid-connect/synology-dsm/index.md @@ -74,19 +74,19 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: synology-dsm - description: Synology DSM + - id: 'synology-dsm' + description: 'Synology DSM' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. public: false - authorization_policy: two_factor + authorization_policy: 'two_factor' redirect_uris: - - https://dsm.example.com + - 'https://dsm.example.com' scopes: - - openid - - profile - - groups - - email - userinfo_signing_algorithm: none + - 'openid' + - 'profile' + - 'groups' + - 'email' + userinfo_signing_algorithm: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/tailscale/index.md b/docs/content/en/integration/openid-connect/tailscale/index.md index 2129f4155..3a3f927dd 100644 --- a/docs/content/en/integration/openid-connect/tailscale/index.md +++ b/docs/content/en/integration/openid-connect/tailscale/index.md @@ -84,15 +84,15 @@ identity_providers: ## The other portions of the mandatory OpenID Connect 1.0 configuration go here. ## See: https://www.authelia.com/c/oidc clients: - - id: tailscale - description: Tailscale SSO + - id: 'tailscale' + description: 'Tailscale' secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. redirect_uris: - - https://login.tailscale.com/a/oauth_response + - 'https://login.tailscale.com/a/oauth_response' scopes: - - openid - - email - - profile + - 'openid' + - 'email' + - 'profile' ``` ## See Also diff --git a/docs/content/en/integration/proxies/caddy.md b/docs/content/en/integration/proxies/caddy.md index 850538aaa..7e2496ce7 100644 --- a/docs/content/en/integration/proxies/caddy.md +++ b/docs/content/en/integration/proxies/caddy.md @@ -101,7 +101,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration diff --git a/docs/content/en/integration/proxies/envoy.md b/docs/content/en/integration/proxies/envoy.md index af37d3cc8..8a50de23f 100644 --- a/docs/content/en/integration/proxies/envoy.md +++ b/docs/content/en/integration/proxies/envoy.md @@ -75,7 +75,7 @@ server: endpoints: authz: ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' ``` ## Configuration @@ -97,47 +97,47 @@ Support for [Envoy] is possible with Authelia v4.37.0 and higher via the [Envoy] version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: envoy: - container_name: envoy - image: envoyproxy/envoy:v1.24 - restart: unless-stopped + container_name: 'envoy' + image: 'envoyproxy/envoy:v1.24' + restart: 'unless-stopped' networks: net: {} ports: - '80:8080' - '443:8443' volumes: - - ${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro - - ${PWD}/data/certificates:/certificates:ro + - '${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro' + - '${PWD}/data/certificates:/certificates:ro' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: {} expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: - TZ: "Australia/Melbourne" + TZ: 'Australia/Melbourne' nextcloud: - container_name: nextcloud - image: linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' ``` {{< /details >}} @@ -145,92 +145,92 @@ services: ```yaml static_resources: listeners: - - name: listener_http + - name: 'listener_http' address: socket_address: - address: 0.0.0.0 + address: '0.0.0.0' port_value: 8080 filter_chains: - filters: - - name: envoy.filters.network.http_connection_manager + - name: 'envoy.filters.network.http_connection_manager' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - codec_type: auto - stat_prefix: ingress_http + "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager' + codec_type: 'auto' + stat_prefix: 'ingress_http' route_config: - name: local_route + name: 'local_route' virtual_hosts: - - name: backend - domains: ["*"] + - name: 'backend' + domains: ['*'] routes: - match: - prefix: "/" + prefix: '/' redirect: https_redirect: true http_filters: - - name: envoy.filters.http.router + - name: 'envoy.filters.http.router' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router - - name: listener_https + "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router' + - name: 'listener_https' address: socket_address: - address: 0.0.0.0 + address: '0.0.0.0' port_value: 8443 filter_chains: - filters: - - name: envoy.filters.network.http_connection_manager + - name: 'envoy.filters.network.http_connection_manager' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - stat_prefix: ingress_http + "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager' + stat_prefix: 'ingress_http' use_remote_address: true skip_xff_append: false route_config: - name: local_route + name: 'local_route' virtual_hosts: - - name: whoami_service + - name: 'whoami_service' domains: ["nextcloud.example.com"] routes: - match: prefix: "/" route: - cluster: nextcloud - - name: authelia_service - domains: ["auth.example.com"] + cluster: 'nextcloud' + - name: 'authelia_service' + domains: ['auth.example.com'] typed_per_filter_config: envoy.filters.http.ext_authz: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' disabled: true routes: - match: - prefix: "/" + prefix: '/' route: - cluster: authelia + cluster: 'authelia' http_filters: - - name: envoy.filters.http.ext_authz + - name: 'envoy.filters.http.ext_authz' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz - transport_api_version: v3 + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz' + transport_api_version: 'v3' allowed_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - exact: accept - - exact: cookie + - exact: 'authorization' + - exact: 'proxy-authorization' + - exact: 'accept' + - exact: 'cookie' http_service: - path_prefix: /api/authz/ext-authz/ + path_prefix: '/api/authz/ext-authz/' server_uri: - uri: authelia:9091 - cluster: authelia - timeout: 0.25s + uri: 'authelia:9091' + cluster: 'authelia' + timeout: '0.25s' authorization_request: allowed_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - exact: accept - - exact: cookie + - exact: 'authorization' + - exact: 'proxy-authorization' + - exact: 'accept' + - exact: 'cookie' headers_to_add: - - key: X-Forwarded-Proto + - key: 'X-Forwarded-Proto' value: '%REQ(:SCHEME)%' ## The following commented lines are for configuring the Authelia URL in the proxy. We ## strongly suggest this is configured in the Session Cookies section of the Authelia configuration. @@ -239,52 +239,52 @@ static_resources: authorization_response: allowed_upstream_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - prefix: remote- - - prefix: authelia- + - exact: 'authorization' + - exact: 'proxy-authorization' + - prefix: 'remote-' + - prefix: 'authelia-' allowed_client_headers: patterns: - - exact: set-cookie + - exact: 'set-cookie' allowed_client_headers_on_success: patterns: - - exact: set-cookie + - exact: 'set-cookie' failure_mode_allow: false - - name: envoy.filters.http.router + - name: 'envoy.filters.http.router' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router' clusters: - - name: nextcloud - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'nextcloud' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: nextcloud + cluster_name: 'nextcloud' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: nextcloud + address: 'nextcloud' port_value: 80 - - name: authelia - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'authelia' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: authelia + cluster_name: 'authelia' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: authelia + address: 'authelia' port_value: 9091 layered_runtime: layers: - - name: static_layer_0 + - name: 'static_layer_0' static_layer: envoy: resource_limits: diff --git a/docs/content/en/integration/proxies/haproxy.md b/docs/content/en/integration/proxies/haproxy.md index 12b9f98a1..d7f5efd66 100644 --- a/docs/content/en/integration/proxies/haproxy.md +++ b/docs/content/en/integration/proxies/haproxy.md @@ -104,7 +104,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration diff --git a/docs/content/en/integration/proxies/nginx-proxy-manager/index.md b/docs/content/en/integration/proxies/nginx-proxy-manager/index.md index b260455dd..c57968712 100644 --- a/docs/content/en/integration/proxies/nginx-proxy-manager/index.md +++ b/docs/content/en/integration/proxies/nginx-proxy-manager/index.md @@ -75,13 +75,13 @@ version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: nginx: - container_name: nginx - image: jc21/nginx-proxy-manager - restart: unless-stopped + container_name: 'nginx' + image: 'jc21/nginx-proxy-manager' + restart: 'unless-stopped' networks: net: aliases: [] @@ -90,44 +90,44 @@ services: - '81:81' - '443:443' volumes: - - ${PWD}/data/nginx-proxy-manager/data:/data - - ${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt - - ${PWD}/data/nginx/snippets:/snippets:ro + - '${PWD}/data/nginx-proxy-manager/data:/data' + - '${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt' + - '${PWD}/data/nginx/snippets:/snippets:ro' environment: TZ: 'Australia/Melbourne' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: TZ: 'Australia/Melbourne' nextcloud: - container_name: nextcloud - image: lscr.io/linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'lscr.io/linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: PUID: '1000' PGID: '1000' TZ: 'Australia/Melbourne' whoami: - container_name: whoami - image: docker.io/traefik/whoami - restart: unless-stopped + container_name: 'whoami' + image: 'docker.io/traefik/whoami' + restart: 'unless-stopped' networks: net: aliases: [] diff --git a/docs/content/en/integration/proxies/nginx.md b/docs/content/en/integration/proxies/nginx.md index 8d185e697..c8419f909 100644 --- a/docs/content/en/integration/proxies/nginx.md +++ b/docs/content/en/integration/proxies/nginx.md @@ -90,7 +90,7 @@ server: endpoints: authz: auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' ``` ## Docker Compose diff --git a/docs/content/en/integration/proxies/swag.md b/docs/content/en/integration/proxies/swag.md index 8f39865d5..f936ac7fa 100644 --- a/docs/content/en/integration/proxies/swag.md +++ b/docs/content/en/integration/proxies/swag.md @@ -156,13 +156,13 @@ version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: swag: - container_name: swag - image: lscr.io/linuxserver/swag - restart: unless-stopped + container_name: 'swag' + image: 'lscr.io/linuxserver/swag' + restart: 'unless-stopped' networks: net: aliases: [] @@ -170,7 +170,7 @@ services: - '80:80' - '443:443' volumes: - - ${PWD}/data/swag:/config + - '${PWD}/data/swag:/config' ## Uncomment the line below if you want to use the Authelia configuration snippets. #- ${PWD}/data/nginx/snippets:/snippets:ro environment: @@ -184,40 +184,40 @@ services: ONLY_SUBDOMAINS: 'false' STAGING: 'true' cap_add: - - NET_ADMIN + - 'NET_ADMIN' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: TZ: 'Australia/Melbourne' nextcloud: - container_name: nextcloud - image: lscr.io/linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'lscr.io/linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: aliases: [] expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: PUID: '1000' PGID: '1000' TZ: 'Australia/Melbourne' whoami: - container_name: whoami - image: docker.io/traefik/whoami - restart: unless-stopped + container_name: 'whoami' + image: 'docker.io/traefik/whoami' + restart: 'unless-stopped' networks: net: aliases: [] diff --git a/docs/content/en/integration/proxies/traefik.md b/docs/content/en/integration/proxies/traefik.md index d5553e95d..8d6b084aa 100644 --- a/docs/content/en/integration/proxies/traefik.md +++ b/docs/content/en/integration/proxies/traefik.md @@ -75,7 +75,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration @@ -130,9 +130,9 @@ networks: driver: bridge services: traefik: - container_name: traefik - image: traefik:v2.9 - restart: unless-stopped + container_name: 'traefik' + image: 'traefik:v2.9' + restart: 'unless-stopped' command: - '--api=true' - '--api.dashboard=true' @@ -164,11 +164,11 @@ services: networks: net: {} ports: - - "80:8080" - - "443:8443" + - '80:8080' + - '443:8443' volumes: - - /var/run/docker.sock:/var/run/docker.sock - - ${PWD}/data/traefik:/config + - '/var/run/docker.sock:/var/run/docker.sock' + - '${PWD}/data/traefik:/config' labels: - 'traefik.enable=true' - 'traefik.http.routers.api.rule=Host(`traefik.example.com`)' @@ -177,15 +177,15 @@ services: - 'traefik.http.routers.api.service=api@internal' - 'traefik.http.routers.api.middlewares=authelia@docker' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: {} expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config + - '${PWD}/data/authelia/config:/config' environment: TZ: "Australia/Melbourne" labels: @@ -200,20 +200,20 @@ services: - 'traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true' - 'traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' nextcloud: - container_name: nextcloud - image: linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' - 'traefik.http.routers.nextcloud.rule=Host(`nextcloud.example.com`)' @@ -221,19 +221,19 @@ services: - 'traefik.http.routers.nextcloud.tls=true' - 'traefik.http.routers.nextcloud.middlewares=authelia@docker' heimdall: - container_name: heimdall - image: linuxserver/heimdall - restart: unless-stopped + container_name: 'heimdall' + image: 'linuxserver/heimdall' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/heimdall/config:/config + - '${PWD}/data/heimdall/config:/config' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' - 'traefik.http.routers.heimdall.rule=Host(`heimdall.example.com`)' @@ -264,12 +264,12 @@ This example uses a `docker-compose.yml` similar to the one above however it has version: "3.8" networks: net: - driver: bridge + driver: 'bridge' services: traefik: - container_name: traefik - image: traefik:v2.9 - restart: unless-stopped + container_name: 'traefik' + image: 'traefik:v2.9' + restart: 'unless-stopped' command: - '--api=true' - '--api.dashboard=true' @@ -294,74 +294,74 @@ services: networks: net: {} ports: - - "80:8080" - - "443:8443" + - '80:8080' + - '443:8443' volumes: - - /var/run/docker.sock:/var/run/docker.sock - - ${PWD}/data/traefik/config:/config - - ${PWD}/data/traefik/certificates:/certificates + - '/var/run/docker.sock:/var/run/docker.sock' + - '${PWD}/data/traefik/config:/config' + - '${PWD}/data/traefik/certificates:/certificates' labels: - 'traefik.enable=true' authelia: - container_name: authelia - image: authelia/authelia - restart: unless-stopped + container_name: 'authelia' + image: 'authelia/authelia' + restart: 'unless-stopped' networks: net: {} expose: - 9091 volumes: - - ${PWD}/data/authelia/config:/config - - ${PWD}/data/authelia/certificates:/certificates + - '${PWD}/data/authelia/config:/config' + - '${PWD}/data/authelia/certificates:/certificates' environment: - TZ: "Australia/Melbourne" + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' nextcloud: - container_name: nextcloud - image: linuxserver/nextcloud - restart: unless-stopped + container_name: 'nextcloud' + image: 'linuxserver/nextcloud' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/nextcloud/config:/config - - ${PWD}/data/nextcloud/data:/data + - '${PWD}/data/nextcloud/config:/config' + - '${PWD}/data/nextcloud/data:/data' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' heimdall: - container_name: heimdall - image: linuxserver/heimdall - restart: unless-stopped + container_name: 'heimdall' + image: 'linuxserver/heimdall' + restart: 'unless-stopped' networks: net: {} expose: - 443 volumes: - - ${PWD}/data/heimdall/config:/config + - '${PWD}/data/heimdall/config:/config' environment: - PUID: "1000" - PGID: "1000" - TZ: "Australia/Melbourne" + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' labels: - 'traefik.enable=true' whoami: - container_name: whoami - image: traefik/whoami:latest - restart: unless-stopped + container_name: 'whoami' + image: 'traefik/whoami:latest' + restart: 'unless-stopped' networks: net: {} expose: - 80 environment: - TZ: "Australia/Melbourne" + TZ: 'Australia/Melbourne' labels: - - "traefik.enable=true" + - 'traefik.enable=true' ... ``` {{< /details >}} @@ -391,16 +391,16 @@ entryPoints: tls: options: modern: - minVersion: "VersionTLS13" + minVersion: 'VersionTLS13' intermediate: - minVersion: "VersionTLS12" + minVersion: 'VersionTLS12' cipherSuites: - - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" - - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" - - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" - - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" - - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305" - - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" + - 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256' + - 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256' + - 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' + - 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384' + - 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305' + - 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305' http: middlewares: authelia: @@ -418,9 +418,9 @@ http: - 'Remote-Email' - 'Remote-Name' tls: - ca: /certificates/ca.public.crt - cert: /certificates/traefik.public.crt - key: /certificates/traefik.private.pem + ca: '/certificates/ca.public.crt' + cert: '/certificates/traefik.public.crt' + key: '/certificates/traefik.private.pem' authelia-basic: forwardAuth: address: 'https://authelia:9091/api/verify?auth=basic' @@ -433,86 +433,86 @@ http: - 'Remote-Email' - 'Remote-Name' tls: - ca: /certificates/ca.public.crt - cert: /certificates/traefik.public.crt - key: /certificates/traefik.private.pem + ca: '/certificates/ca.public.crt' + cert: '/certificates/traefik.public.crt' + key: '/certificates/traefik.private.pem' routers: traefik: - rule: Host(`traefik.example.com`) - entryPoints: websecure - service: api@internal + rule: 'Host(`traefik.example.com`)' + entryPoints: 'websecure' + service: 'api@internal' middlewares: - - authelia@file + - 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' whoami: - rule: Host(`whoami.example.com`) - entryPoints: websecure - service: whoami-net@docker + rule: 'Host(`whoami.example.com`)' + entryPoints: 'websecure' + service: 'whoami-net@docker' middlewares: - - authelia@file + - 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' nextcloud: - rule: Host(`nextcloud.example.com`) - entryPoints: websecure - service: nextcloud-net@docker + rule: 'Host(`nextcloud.example.com`)' + entryPoints: 'websecure' + service: 'nextcloud-net@docker' middlewares: - - authelia@file + - 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' heimdall: - rule: Host(`heimdall.example.com`) - entryPoints: websecure - service: heimdall-net@docker + rule: 'Host(`heimdall.example.com`)' + entryPoints: 'websecure' + service: 'heimdall-net@docker' middlewares: - - authelia-basic@file + - 'authelia-basic@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' authelia: - rule: Host(`auth.example.com`) - entryPoints: websecure - service: authelia@file + rule: 'Host(`auth.example.com`)' + entryPoints: 'websecure' + service: 'authelia@file' tls: - options: modern@file - certResolver: default + options: 'modern@file' + certResolver: 'default' domains: - - main: "example.com" + - main: 'example.com' sans: - - "*.example.com" + - '*.example.com' services: authelia: loadBalancer: servers: - - url: https://authelia:9091/ - serversTransport: autheliaMutualTLS + - url: 'https://authelia:9091/' + serversTransport: 'autheliaMutualTLS' serversTransports: autheliaMutualTLS: certificates: - - certFile: /certificates/traefik.public.crt - keyFile: /certificates/traefik.private.pem + - certFile: '/certificates/traefik.public.crt' + keyFile: '/certificates/traefik.private.pem' rootCAs: - - /certificates/ca.public.crt + - '/certificates/ca.public.crt' ... ``` {{< /details >}} diff --git a/docs/content/en/integration/proxies/traefikv1.md b/docs/content/en/integration/proxies/traefikv1.md index 0519782ca..3aa1195d0 100644 --- a/docs/content/en/integration/proxies/traefikv1.md +++ b/docs/content/en/integration/proxies/traefikv1.md @@ -88,7 +88,7 @@ server: endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' ``` ## Configuration @@ -119,15 +119,15 @@ version: '3' networks: net: - driver: bridge + driver: 'bridge' services: traefik: - image: traefik:v1.7.34-alpine - container_name: traefik + image: 'traefik:v1.7.34-alpine' + container_name: 'traefik' volumes: - - /var/run/docker.sock:/var/run/docker.sock + - '/var/run/docker.sock:/var/run/docker.sock' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:traefik.example.com' - 'traefik.port=8081' @@ -135,7 +135,7 @@ services: - '80:80' - '443:443' - '8081:8081' - restart: unless-stopped + restart: 'unless-stopped' command: - '--api' - '--api.entrypoint=api' @@ -151,27 +151,27 @@ services: # - '--entryPoints=Name:https Address::443 TLS ForwardedHeaders.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7 ProxyProtocol.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7' - '--entryPoints=Name:api Address::8081' authelia: - image: authelia/authelia - container_name: authelia + image: 'authelia/authelia' + container_name: 'authelia' volumes: - - /path/to/authelia:/config + - '/path/to/authelia:/config' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:auth.example.com' expose: - 9091 - restart: unless-stopped + restart: 'unless-stopped' environment: - - TZ=Australia/Melbourne + TZ: 'Australia/Melbourne' nextcloud: - image: linuxserver/nextcloud - container_name: nextcloud + image: 'linuxserver/nextcloud' + container_name: 'nextcloud' volumes: - - /path/to/nextcloud/config:/config - - /path/to/nextcloud/data:/data + - '/path/to/nextcloud/config:/config' + - '/path/to/nextcloud/data:/data' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:nextcloud.example.com' - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth' @@ -182,18 +182,18 @@ services: - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' expose: - 443 - restart: unless-stopped + restart: 'unless-stopped' environment: - - PUID=1000 - - PGID=1000 - - TZ=Australia/Melbourne + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' heimdall: - image: linuxserver/heimdall - container_name: heimdall + image: 'linuxserver/heimdall' + container_name: 'heimdall' volumes: - - /path/to/heimdall/config:/config + - '/path/to/heimdall/config:/config' networks: - - net + - 'net' labels: - 'traefik.frontend.rule=Host:heimdall.example.com' - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth/basic' @@ -201,11 +201,11 @@ services: - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name' expose: - 443 - restart: unless-stopped + restart: 'unless-stopped' environment: - - PUID=1000 - - PGID=1000 - - TZ=Australia/Melbourne + PUID: '1000' + PGID: '1000' + TZ: 'Australia/Melbourne' ``` ## See Also diff --git a/docs/content/en/overview/security/measures.md b/docs/content/en/overview/security/measures.md index 88714dd16..41e91c60b 100644 --- a/docs/content/en/overview/security/measures.md +++ b/docs/content/en/overview/security/measures.md @@ -160,7 +160,7 @@ values. As such all SMTP connections require the following: -1. A TLS Connection (STARTTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated +1. A TLS Connection (StartTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated connections require it as well_) 2. Valid X509 Certificate presented to the client during the TLS handshake @@ -207,22 +207,22 @@ for SMTP servers that allow unauthenticated relaying (bad practice). ### SMTP Ports -All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via STARTTLS. +All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via StartTLS. The [`submissions` service][service-submissions] (_typically port 465_) is an exception to this rule, where the -connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [port for -SMTP][docs-config-smtp-port] is set to `465`, Authelia will initiate TLS connections without requiring STARTTLS +connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [scheme for +SMTP][docs-config-smtp-port] is set to `submissions`, Authelia will initiate TLS connections without requiring StartTLS negotiation. -When the `submissions` service port is available, it [should be preferred][port-465] over any STARTTLS port for +When the `submissions` service port is available, it [should be preferred][port-465] over any StartTLS port for submitting mail. **NOTE:** Prior to 2018, port 465 was previously assigned for a similar purpose known as [`smtps`][port-465] (_A TLS only equivalent of the `smtp` port 25_), which it had been deprecated for. Port 465 has since been re-assigned for only supporting mail submission (_which unlike SMTP transfers via port 25, [requires authentication][smtp-auth]_), similar -to port 587 (_the `submission` port, a common alternative that uses STARTTLS instead_). +to port 587 (_the `submission` port, a common alternative that uses StartTLS instead_). -[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#port +[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#address [cleartext]: https://cwe.mitre.org/data/definitions/312.html [service-submissions]: https://datatracker.ietf.org/doc/html/rfc8314#section-7.3 [port-465]: https://datatracker.ietf.org/doc/html/rfc8314#section-3.3 diff --git a/docs/content/en/reference/guides/passwords.md b/docs/content/en/reference/guides/passwords.md index a21fc3bf0..e90749354 100644 --- a/docs/content/en/reference/guides/passwords.md +++ b/docs/content/en/reference/guides/passwords.md @@ -26,30 +26,31 @@ The format of the [YAML] file is as follows: users: john: disabled: false - displayname: "John Doe" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: john.doe@authelia.com + displayname: 'John Doe' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'john.doe@authelia.com' groups: - - admins - - dev + - 'admins' + - 'dev' harry: disabled: false - displayname: "Harry Potter" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: harry.potter@authelia.com + displayname: 'Harry Potter' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'harry.potter@authelia.com' groups: [] bob: disabled: false - displayname: "Bob Dylan" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: bob.dylan@authelia.com + displayname: 'Bob Dylan' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'bob.dylan@authelia.com' groups: - - dev + - 'dev' james: disabled: false - displayname: "James Dean" - password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM" - email: james.dean@authelia.com + displayname: 'James Dean' + password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM' + email: 'james.dean@authelia.com' + groups: [] ``` ## Passwords diff --git a/docs/content/en/reference/guides/troubleshooting.md b/docs/content/en/reference/guides/troubleshooting.md index 6dd6a864a..d8811ecfa 100644 --- a/docs/content/en/reference/guides/troubleshooting.md +++ b/docs/content/en/reference/guides/troubleshooting.md @@ -2,7 +2,7 @@ title: "Troubleshooting" description: "This guide describes and helps users provide information during troubleshooting including sanitization etc" lead: "This guide describes and helps users provide troubleshooting information." -date: 2023-05-01T11:30:07+10:00 +date: 2023-05-01T12:36:02+10:00 draft: false images: [] menu: diff --git a/docs/data/configkeys.json b/docs/data/configkeys.json index c140a0b24..ecc9213cf 100644 --- a/docs/data/configkeys.json +++ b/docs/data/configkeys.json @@ -1 +1 @@ -[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_URL"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.umask","secret":false,"env":"AUTHELIA_SERVER_UMASK"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.umask","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_UMASK"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file +[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.address","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDRESS"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.address","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_ADDRESS"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.address","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_ADDRESS"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_ADDRESS"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.umask","secret":false,"env":"AUTHELIA_SERVER_UMASK"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.umask","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_UMASK"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file diff --git a/docs/i18n/en.yaml b/docs/i18n/en.yaml index 4994b7e52..9d0a5ee56 100644 --- a/docs/i18n/en.yaml +++ b/docs/i18n/en.yaml @@ -1,19 +1,19 @@ --- -- id: get-started - translation: "Get Started" +- id: 'get-started' + translation: 'Get Started' -- id: on-this-page - translation: "On this page" +- id: 'on-this-page' + translation: 'On this page' -- id: search-text - translation: "Search..." +- id: 'search-text' + translation: 'Search...' -- id: 404-title - translation: "Page not found :(" +- id: '404-title' + translation: 'Page not found :(' -- id: 404-text +- id: '404-text' translation: "The page you are looking for doesn't exist or has been moved. If you followed a link to get to this page please report it if it was on this site, the official GitHub repository, or the logs on the latest version." # yamllint disable-line rule:line-length -- id: browse - translation: "Browse" +- id: 'browse' + translation: 'Browse' ... diff --git a/examples/compose/lite/authelia/configuration.yml b/examples/compose/lite/authelia/configuration.yml index d9841d310..bd06a5dd3 100644 --- a/examples/compose/lite/authelia/configuration.yml +++ b/examples/compose/lite/authelia/configuration.yml @@ -8,8 +8,7 @@ jwt_secret: a_very_important_secret default_redirection_url: https://public.example.com server: - host: 0.0.0.0 - port: 9091 + address: 'tcp://:9091' log: level: debug diff --git a/examples/compose/local/authelia/configuration.yml b/examples/compose/local/authelia/configuration.yml index 42b770e6c..c19b62167 100644 --- a/examples/compose/local/authelia/configuration.yml +++ b/examples/compose/local/authelia/configuration.yml @@ -7,8 +7,7 @@ jwt_secret: a_very_important_secret default_redirection_url: https://public.example.com server: - host: 0.0.0.0 - port: 9091 + address: 'tcp://:9091' log: level: debug diff --git a/internal/authentication/const_test.go b/internal/authentication/const_test.go new file mode 100644 index 000000000..3829c3eb5 --- /dev/null +++ b/internal/authentication/const_test.go @@ -0,0 +1,24 @@ +package authentication + +import ( + "github.com/authelia/authelia/v4/internal/configuration/schema" +) + +const ( + testLDAPURL = "ldap://127.0.0.1:389" + testLDAPSURL = "ldaps://127.0.0.1:389" +) + +var ( + testLDAPAddress = MustParseAddress(testLDAPURL) + testLDAPSAddress = MustParseAddress(testLDAPSURL) +) + +func MustParseAddress(input string) *schema.AddressLDAP { + address, err := schema.NewAddress(input) + if err != nil { + panic(err) + } + + return &schema.AddressLDAP{Address: *address} +} diff --git a/internal/authentication/ldap_user_provider.go b/internal/authentication/ldap_user_provider.go index 56ad08c6f..d2bb2603f 100644 --- a/internal/authentication/ldap_user_provider.go +++ b/internal/authentication/ldap_user_provider.go @@ -107,7 +107,7 @@ func (p *LDAPUserProvider) CheckUserPassword(username string, password string) ( return false, err } - if clientUser, err = p.connectCustom(p.config.URL, profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil { + if clientUser, err = p.connectCustom(p.config.Address.String(), profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil { return false, fmt.Errorf("authentication failed. Cause: %w", err) } @@ -234,7 +234,7 @@ func (p *LDAPUserProvider) UpdatePassword(username, password string) (err error) } func (p *LDAPUserProvider) connect() (client LDAPClient, err error) { - return p.connectCustom(p.config.URL, p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...) + return p.connectCustom(p.config.Address.String(), p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...) } func (p *LDAPUserProvider) connectCustom(url, username, password string, startTLS bool, opts ...ldap.DialOpt) (client LDAPClient, err error) { diff --git a/internal/authentication/ldap_user_provider_startup.go b/internal/authentication/ldap_user_provider_startup.go index edf668587..076b02fd4 100644 --- a/internal/authentication/ldap_user_provider_startup.go +++ b/internal/authentication/ldap_user_provider_startup.go @@ -31,7 +31,7 @@ func (p *LDAPUserProvider) StartupCheck() (err error) { "attribute when users reset their password via Authelia.") } - if p.features.Extensions.TLS && !p.config.StartTLS && !strings.HasPrefix(p.config.URL, "ldaps://") { + if p.features.Extensions.TLS && !p.config.StartTLS && !p.config.Address.IsExplicitlySecure() { p.log.Error("Your LDAP Server supports TLS but you don't appear to be utilizing it. We strongly " + "recommend using the scheme 'ldaps://' or enabling the StartTLS option to secure connections with your " + "LDAP Server.") diff --git a/internal/authentication/ldap_user_provider_test.go b/internal/authentication/ldap_user_provider_test.go index ebda277a6..97c9dc749 100644 --- a/internal/authentication/ldap_user_provider_test.go +++ b/internal/authentication/ldap_user_provider_test.go @@ -25,7 +25,7 @@ func TestShouldCreateRawConnectionWhenSchemeIsLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", }, @@ -57,7 +57,7 @@ func TestShouldCreateTLSConnectionWhenSchemeIsLDAPS(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldaps://127.0.0.1:389", + Address: testLDAPSAddress, User: "cn=admin,dc=example,dc=com", Password: "password", }, @@ -107,7 +107,7 @@ func TestEscapeSpecialCharsInGroupsFilter(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldaps://127.0.0.1:389", + Address: testLDAPSAddress, GroupsFilter: "(|(member={dn})(uid={username})(uid={input}))", }, false, @@ -165,7 +165,7 @@ func TestShouldCheckLDAPServerExtensions(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -230,7 +230,7 @@ func TestShouldNotCheckLDAPServerExtensionsWhenRootDSEReturnsMoreThanOneEntry(t provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -296,7 +296,7 @@ func TestShouldCheckLDAPServerControlTypes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -361,7 +361,7 @@ func TestShouldNotEnablePasswdModifyExtensionOrControlTypes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -426,7 +426,7 @@ func TestShouldReturnCheckServerConnectError(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -459,7 +459,7 @@ func TestShouldReturnCheckServerSearchError(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -521,7 +521,7 @@ func TestShouldEscapeUserInput(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsersFilter: "(|({username_attribute}={input})({mail_attribute}={input}))", UsernameAttribute: "uid", @@ -555,7 +555,7 @@ func TestShouldReturnEmailWhenAttributeSameAsUsername(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "mail", @@ -626,7 +626,7 @@ func TestShouldReturnUsernameAndBlankDisplayNameWhenAttributesTheSame(t *testing provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -697,7 +697,7 @@ func TestShouldReturnBlankEmailAndDisplayNameWhenAttrsLenZero(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -771,7 +771,7 @@ func TestShouldCombineUsernameFilterAndUsersFilter(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", UsernameAttribute: "uid", UsersFilter: "(&({username_attribute}={input})(&(objectCategory=person)(objectClass=user)))", @@ -822,7 +822,7 @@ func TestShouldNotCrashWhenGroupsAreNotRetrievedFromLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -895,7 +895,7 @@ func TestShouldNotCrashWhenEmailsAreNotRetrievedFromLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -956,7 +956,7 @@ func TestShouldReturnUsernameFromLDAP(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1029,7 +1029,7 @@ func TestShouldReturnUsernameFromLDAPWithReferrals(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1121,7 +1121,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsInErrorAndResult(t *testing.T) provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1246,7 +1246,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsErr(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1333,7 +1333,7 @@ func TestShouldNotUpdateUserPasswordConnect(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1400,7 +1400,7 @@ func TestShouldNotUpdateUserPasswordGetDetails(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1477,7 +1477,7 @@ func TestShouldUpdateUserPassword(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1585,7 +1585,7 @@ func TestShouldUpdateUserPasswordMSAD(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1695,7 +1695,7 @@ func TestShouldUpdateUserPasswordMSADWithReferrals(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1823,7 +1823,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralConnectErr(t *test provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -1942,7 +1942,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralModifyErr(t *testi provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2074,7 +2074,7 @@ func TestShouldUpdateUserPasswordMSADWithoutReferrals(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2187,7 +2187,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtension(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2294,7 +2294,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferrals(t *testing.T provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2421,7 +2421,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithoutReferrals(t *testin provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2534,7 +2534,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralConne provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2652,7 +2652,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralPassw provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -2784,7 +2784,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHints(t *testing provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "sAMAccountName", @@ -2895,7 +2895,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHintsDeprecated( provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "sAMAccountName", @@ -3006,7 +3006,7 @@ func TestShouldUpdateUserPasswordActiveDirectory(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "activedirectory", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "sAMAccountName", @@ -3117,7 +3117,7 @@ func TestShouldUpdateUserPasswordBasic(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ Implementation: "custom", - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "uid=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3224,7 +3224,7 @@ func TestShouldReturnErrorWhenMultipleUsernameAttributes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3290,7 +3290,7 @@ func TestShouldReturnErrorWhenZeroUsernameAttributes(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3356,7 +3356,7 @@ func TestShouldReturnErrorWhenUsernameAttributeNotReturned(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3418,7 +3418,7 @@ func TestShouldReturnErrorWhenMultipleUsersFound(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3501,7 +3501,7 @@ func TestShouldReturnErrorWhenNoDN(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3567,7 +3567,7 @@ func TestShouldCheckValidUserPassword(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3635,7 +3635,7 @@ func TestShouldNotCheckValidUserPasswordWithConnectError(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3674,7 +3674,7 @@ func TestShouldCheckInvalidUserPassword(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3742,7 +3742,7 @@ func TestShouldCallStartTLSWhenEnabled(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3817,7 +3817,7 @@ func TestShouldParseDynamicConfiguration(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3866,7 +3866,7 @@ func TestShouldCallStartTLSWithInsecureSkipVerifyWhenSkipVerifyTrue(t *testing.T provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldap://127.0.0.1:389", + Address: testLDAPAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", @@ -3949,7 +3949,7 @@ func TestShouldReturnLDAPSAlreadySecuredWhenStartTLSAttempted(t *testing.T) { provider := NewLDAPUserProviderWithFactory( schema.LDAPAuthenticationBackend{ - URL: "ldaps://127.0.0.1:389", + Address: testLDAPSAddress, User: "cn=admin,dc=example,dc=com", Password: "password", UsernameAttribute: "uid", diff --git a/internal/configuration/config.template.yml b/internal/configuration/config.template.yml index d5b0852ac..5b7f82ad0 100644 --- a/internal/configuration/config.template.yml +++ b/internal/configuration/config.template.yml @@ -9,14 +9,14 @@ ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. -# certificates_directory: /config/certificates/ +# certificates_directory: '/config/certificates/' ## The theme to display: light, dark, grey, auto. -theme: light +theme: 'light' ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## set using a secret: https://www.authelia.com/c/secrets -jwt_secret: a_very_important_secret +jwt_secret: 'a_very_important_secret' ## Default redirection URL ## @@ -25,28 +25,32 @@ jwt_secret: a_very_important_secret ## in such a case. ## ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. -default_redirection_url: https://home.example.com/ +default_redirection_url: 'https://home.example.com/' ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been ## disabled. This setting must be a method that is enabled. ## Options are totp, webauthn, mobile_push. -default_2fa_method: "" +default_2fa_method: '' ## ## Server Configuration ## server: - - ## The address to listen on. This must be a TCP or unix socket. - address: "tcp://:9091" + ## The address for the Main server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'. + address: 'tcp://:9091' ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. - path: "" + path: '' ## Set the path on disk to Authelia assets. ## Useful to allow overriding of specific static assets. - # asset_path: /config/assets/ + # asset_path: '/config/assets/' ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. @@ -55,10 +59,10 @@ server: ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. tls: ## The path to the DER base64/PEM format private key. - key: "" + key: '' ## The path to the DER base64/PEM format public certificate. - certificate: "" + certificate: '' ## The list of certificates for client authentication. client_certificates: [] @@ -67,7 +71,7 @@ server: headers: ## The CSP Template. Read the docs. - csp_template: "" + csp_template: '' ## Server Buffers configuration. # buffers: @@ -87,13 +91,13 @@ server: # timeouts: ## Read timeout. - # read: 6s + # read: '6s' ## Write timeout. - # write: 6s + # write: '6s' ## Idle timeout. - # idle: 30s + # idle: '30s' ## Server Endpoints configuration. ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation. @@ -107,16 +111,16 @@ server: ## Configure the authz endpoints. # authz: # forward-auth: - # implementation: ForwardAuth + # implementation: 'ForwardAuth' # authn_strategies: [] # ext-authz: - # implementation: ExtAuthz + # implementation: 'ExtAuthz' # authn_strategies: [] # auth-request: - # implementation: AuthRequest + # implementation: 'AuthRequest' # authn_strategies: [] # legacy: - # implementation: Legacy + # implementation: 'Legacy' # authn_strategies: [] ## @@ -124,13 +128,13 @@ server: ## log: ## Level of verbosity for logs: info, debug, trace. - level: debug + level: 'debug' ## Format the logs are written as: json, text. - # format: json + # format: 'json' ## File path where the logs will be written. If not set logs are written to stdout. - # file_path: /config/authelia.log + # file_path: '/config/authelia.log' ## Whether to also log to stdout when a log_file_path is defined. # keep_stdout: false @@ -147,8 +151,13 @@ telemetry: ## Enable Metrics. enabled: false - ## The address to listen on for metrics. This should be on a different port to the main server.port value. - address: tcp://0.0.0.0:9959 + ## The address for the Metrics server to listen on in the address common syntax. + ## Formats: + ## - [://][:] + ## - [://][hostname]: + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'. + address: 'tcp://:9959' ## Metrics Server Buffers configuration. # buffers: @@ -163,13 +172,13 @@ telemetry: # timeouts: ## Read timeout. - # read: 6s + # read: '6s' ## Write timeout. - # write: 6s + # write: '6s' ## Idle timeout. - # idle: 30s + # idle: '30s' ## ## TOTP Configuration @@ -180,12 +189,12 @@ totp: disable: false ## The issuer name displayed in the Authenticator application of your choice. - issuer: authelia.com + issuer: 'authelia.com' ## The TOTP algorithm to use. ## It is CRITICAL you read the documentation before changing this option: ## https://www.authelia.com/c/totp#algorithm - algorithm: sha1 + algorithm: 'sha1' ## The number of digits a user has to input. Must either be 6 or 8. ## Changing this option only affects newly generated TOTP configurations. @@ -215,18 +224,18 @@ webauthn: disable: false ## Adjust the interaction timeout for WebAuthn dialogues. - timeout: 60s + timeout: '60s' ## The display name the browser should show the user for when using WebAuthn to login/register. - display_name: Authelia + display_name: 'Authelia' ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device. ## Options are none, indirect, direct. - attestation_conveyance_preference: indirect + attestation_conveyance_preference: 'indirect' ## User verification controls if the user must make a gesture or action to confirm they are present. ## Options are required, preferred, discouraged. - user_verification: preferred + user_verification: 'preferred' ## ## Duo Push API Configuration @@ -235,10 +244,10 @@ webauthn: ## "Partner Auth API" in the management panel. # duo_api: # disable: false - # hostname: api-123456789.example.com - # integration_key: ABCDEF + # hostname: 'api-123456789.example.com' + # integration_key: 'ABCDEF' ## Secret can also be set using a secret: https://www.authelia.com/c/secrets - # secret_key: 1234567890abcdefghifjkl + # secret_key: '1234567890abcdefghifjkl' # enable_self_enrollment: false ## @@ -246,14 +255,17 @@ webauthn: ## ## This is used to validate the servers time is accurate enough to validate TOTP. ntp: - ## NTP server address. - address: "time.cloudflare.com:123" + ## The address of the NTP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'. + ## The default scheme is 'udp'. The default port is '123'. + address: 'udp://time.cloudflare.com:123' ## NTP version. version: 4 - ## Maximum allowed time offset between the host and the NTP server. - max_desync: 3s + ## Maximum allowed time offset between the host and the NTP server in duration common syntax. + max_desync: '3s' ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you ## set this to true, and can operate in a truly offline mode. @@ -279,14 +291,14 @@ authentication_backend: ## External reset password url that redirects the user to an external reset portal. This disables the internal reset ## functionality. - custom_url: "" + custom_url: '' ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. - ## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format + ## Duration Notation docs: https://www.authelia.com/c/common#duration ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval refresh_interval: 5m @@ -297,6 +309,13 @@ authentication_backend: ## because it allows Authelia to offload the stateful operations ## onto the LDAP service. # ldap: + ## The address of the LDAP server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`. + ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'. + ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'. + # address: 'ldaps://127.0.0.1:636' + ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## Acceptable options are as follows: ## - 'activedirectory' - for Microsoft Active Directory. @@ -308,22 +327,18 @@ authentication_backend: ## Depending on the option here certain other values in this section have a default value, notably all of the ## attribute mappings have a default value that this config overrides, you can read more about these default values ## at https://www.authelia.com/c/ldap#defaults - # implementation: custom + # implementation: 'custom' - ## The url to the ldap server. Format: ://
[:]. - ## Scheme can be ldap or ldaps in the format (port optional). - # url: ldap://127.0.0.1 - - ## The dial timeout for LDAP. - # timeout: 5s + ## The dial timeout for LDAP in the duration common syntax. + # timeout: '5s' ## Use StartTLS with the LDAP connection. # start_tls: false # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host portion of the url option. - # server_name: ldap.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'ldap.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -334,10 +349,10 @@ authentication_backend: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -414,7 +429,7 @@ authentication_backend: ## The distinguished name of the container searched for objects in the directory information tree. ## See also: additional_users_dn, additional_groups_dn. - # base_dn: dc=example,dc=com + # base_dn: 'dc=example,dc=com' ## The attribute holding the username of the user. This attribute is used to populate the username in the session ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually @@ -424,11 +439,11 @@ authentication_backend: ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to ## follow https://datatracker.ietf.org/doc/html/rfc2307. - # username_attribute: uid + # username_attribute: 'uid' ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. - # additional_users_dn: ou=users + # additional_users_dn: 'ou=users' ## The users filter used in search queries to find the user profile based on input filled in login form. ## Various placeholders are available in the user filter which you can read about in the documentation which can @@ -442,11 +457,11 @@ authentication_backend: ## ## To allow sign in both with username and email, one can use a filter like ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) - # users_filter: (&({username_attribute}={input})(objectClass=person)) + # users_filter: '(&({username_attribute}={input})(objectClass=person))' ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. - # additional_groups_dn: ou=groups + # additional_groups_dn: 'ou=groups' ## The groups filter used in search queries to find the groups based on relevant authenticated user. ## Various placeholders are available in the groups filter which you can read about in the documentation which can @@ -454,17 +469,17 @@ authentication_backend: ## ## If your groups use the `groupOfUniqueNames` structure use this instead: ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) - # groups_filter: (&(member={dn})(objectClass=groupOfNames)) + # groups_filter: '(&(member={dn})(objectClass=groupOfNames))' ## The attribute holding the name of the group. - # group_name_attribute: cn + # group_name_attribute: 'cn' ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## first one returned by the LDAP server is used. - # mail_attribute: mail + # mail_attribute: 'mail' ## The attribute holding the display name of the user. This will be used to greet an authenticated user. - # display_name_attribute: displayName + # display_name_attribute: 'displayName' ## Follow referrals returned by the server. ## This is especially useful for environments where read-only servers exist. Only implemented for write operations. @@ -473,7 +488,7 @@ authentication_backend: ## The username and password of the admin user. # user: cn=admin,dc=example,dc=com ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## ## File (Authentication Provider) @@ -488,15 +503,15 @@ authentication_backend: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # file: - # path: /config/users_database.yml + # path: '/config/users_database.yml' # watch: false # search: # email: false # case_insensitive: false # password: - # algorithm: argon2 + # algorithm: 'argon2' # argon2: - # variant: argon2id + # variant: 'argon2id' # iterations: 3 # memory: 65536 # parallelism: 4 @@ -509,15 +524,15 @@ authentication_backend: # key_length: 32 # salt_length: 16 # pbkdf2: - # variant: sha512 + # variant: 'sha512' # iterations: 310000 # salt_length: 16 # sha2crypt: - # variant: sha512 + # variant: 'sha512' # iterations: 50000 # salt_length: 16 # bcrypt: - # variant: standard + # variant: 'standard' # cost: 12 ## @@ -601,91 +616,91 @@ privacy_policy: access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. - default_policy: deny + default_policy: 'deny' # networks: - # - name: internal + # - name: 'internal' # networks: - # - 10.10.0.0/16 - # - 192.168.2.0/24 + # - '10.10.0.0/16' + # - '192.168.2.0/24' # - name: VPN - # networks: 10.9.0.0/16 + # networks: '10.9.0.0/16' # rules: ## Rules applied to everyone # - domain: 'public.example.com' - # policy: bypass + # policy: 'bypass' ## Domain Regex examples. Generally we recommend just using a standard domain. # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^(?P\w+)\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: # - '^appgroup-.*\.example\.com$' # - '^appgroup2-.*\.example\.com$' - # policy: one_factor + # policy: 'one_factor' # - domain_regex: '^.*\.example\.com$' - # policy: two_factor + # policy: 'two_factor' # - domain: 'secure.example.com' - # policy: one_factor + # policy: 'one_factor' ## Network based rule, if not provided any network matches. # networks: - # - internal - # - VPN - # - 192.168.1.0/24 - # - 10.0.0.1 + # - 'internal' + # - 'VPN' + # - '192.168.1.0/24' + # - '10.0.0.1' # - domain: # - 'secure.example.com' # - 'private.example.com' - # policy: two_factor + # policy: 'two_factor' # - domain: 'singlefactor.example.com' - # policy: one_factor + # policy: 'one_factor' ## Rules applied to 'admins' group # - domain: 'mx2.mail.example.com' # subject: 'group:admins' - # policy: deny + # policy: 'deny' # - domain: '*.example.com' # subject: # - 'group:admins' # - 'group:moderators' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to 'dev' group # - domain: 'dev.example.com' # resources: # - '^/groups/dev/.*$' # subject: 'group:dev' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'john' # - domain: 'dev.example.com' # resources: # - '^/users/john/.*$' # subject: 'user:john' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'harry' # - domain: 'dev.example.com' # resources: # - '^/users/harry/.*$' # subject: 'user:harry' - # policy: two_factor + # policy: 'two_factor' ## Rules applied to user 'bob' # - domain: '*.mail.example.com' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' # - domain: 'dev.example.com' # resources: # - '^/users/bob/.*$' # subject: 'user:bob' - # policy: two_factor + # policy: 'two_factor' ## ## Session Provider Configuration @@ -720,8 +735,8 @@ session: ## Please read https://www.authelia.com/c/session#same_site # same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format + ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. + ## See: https://www.authelia.com/c/common#duration ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -745,8 +760,8 @@ session: ## or strict. Please read https://www.authelia.com/c/session#same_site same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format. - ## See: https://www.authelia.com/c/common#duration-notation-format + ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. + ## See: https://www.authelia.com/c/common#duration ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -755,7 +770,7 @@ session: ## destroyed after 1h, or after 5m since the last time Authelia detected user activity. inactivity: '5m' - ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is + ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is ## destroyed if remember me IS NOT selected by the user. expiration: '1h' @@ -770,16 +785,16 @@ session: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # redis: - # host: 127.0.0.1 + # host: '127.0.0.1' # port: 6379 ## Use a unix socket instead - # host: /var/run/redis/redis.sock + # host: '/var/run/redis/redis.sock' ## Username used for redis authentication. This is optional and a new feature in redis 6.0. - # username: authelia + # username: 'authelia' ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: authelia + # password: 'authelia' ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). # database_index: 0 @@ -794,7 +809,7 @@ session: # tls: ## The server subject name to check the servers certificate against during the validation process. ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: myredis.example.com + # server_name: 'myredis.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -805,10 +820,10 @@ session: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -887,21 +902,21 @@ session: ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). # high_availability: ## Sentinel Name / Master Name. - # sentinel_name: mysentinel + # sentinel_name: 'mysentinel' ## Specific username for Redis Sentinel. The node username and password is configured above. - # sentinel_username: sentinel_specific_user + # sentinel_username: 'sentinel_specific_user' ## Specific password for Redis Sentinel. The node username and password is configured above. - # sentinel_password: sentinel_specific_pass + # sentinel_password: 'sentinel_specific_pass' ## The additional nodes to pre-seed the redis provider with (for sentinel). ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## For high availability to be used you must have either defined; the host above or at least one node below. # nodes: - # - host: sentinel-node1 + # - host: 'sentinel-node1' # port: 6379 - # - host: sentinel-node2 + # - host: 'sentinel-node2' # port: 6379 ## Choose the host with the lowest latency. @@ -919,14 +934,12 @@ regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 - ## The time range during which the user can attempt login before being banned. The user is banned if the - ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - find_time: 2m + ## The time range in duration common syntax during which the user can attempt login before being banned. The user is + ## banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. + find_time: '2m' - ## The length of time before a banned user can login again. Ban Time accepts duration notation. - ## See: https://www.authelia.com/c/common#duration-notation-format - ban_time: 5m + ## The length of time in duration common syntax before a banned user can login again. + ban_time: '5m' ## ## Storage Provider Configuration @@ -936,7 +949,7 @@ regulation: ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use ## the CLI to change this in the database if you want to change it from a previously configured value. - # encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this + # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this' ## ## Local (Storage Provider) @@ -948,25 +961,36 @@ regulation: ## # local: ## Path to the SQLite3 Database. - # path: /config/db.sqlite3 + # path: '/config/db.sqlite3' ## ## MySQL / MariaDB (Storage Provider) ## # mysql: - # host: 127.0.0.1 - # port: 3306 - # database: authelia - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the MySQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'. + # address: 'tcp://127.0.0.1:3306' + + ## The database name to use. + # database: 'authelia' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## MySQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: mysql.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'mysql.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -977,10 +1001,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1059,20 +1083,33 @@ regulation: ## PostgreSQL (Storage Provider) ## # postgres: - # host: 127.0.0.1 - # port: 5432 - # database: authelia - # schema: public - # username: authelia - ## Password can also be set using a secret: https://www.authelia.com/c/secrets - # password: mypassword - # timeout: 5s + ## The address of the PostgreSQL server to connect to in the address common syntax. + ## Format: [://][:]. + ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`. + ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'. + # address: 'tcp://127.0.0.1:5432' + + ## The database name to use. + # database: 'authelia' + + ## The schema name to use. + # schema: 'public' + + ## The username used for SQL authentication. + # username: 'authelia' + + ## The password used for SQL authentication. + ## Can also be set using a secret: https://www.authelia.com/c/secrets + # password: 'mypassword' + + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## PostgreSQL TLS settings. Configuring this requires TLS. # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: postgres.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'postgres.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1083,10 +1120,10 @@ regulation: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1176,7 +1213,7 @@ notifier: ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # filesystem: - # filename: /config/notification.txt + # filename: '/config/notification.txt' ## ## SMTP (Notification Provider) @@ -1189,36 +1226,33 @@ notifier: ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## (configure in tls section) # smtp: - ## The SMTP host to connect to. - # host: 127.0.0.1 + ## The address of the SMTP server to connect to in the address common syntax. + # address: 'smtp://127.0.0.1:25' - ## The port to connect to the SMTP host on. - # port: 1025 - - ## The connection timeout. - # timeout: 5s + ## The connection timeout in the duration common syntax. + # timeout: '5s' ## The username used for SMTP authentication. - # username: test + # username: 'test' ## The password used for SMTP authentication. ## Can also be set using a secret: https://www.authelia.com/c/secrets - # password: password + # password: 'password' ## The sender is used to is used for the MAIL FROM command and the FROM header. ## If this is not defined and the username is an email, we use the username as this value. This can either be just ## an email address or the RFC5322 'Name ' format. - # sender: "Authelia " + # sender: 'Authelia ' ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. - # identifier: localhost + # identifier: 'localhost' ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. - # subject: "[Authelia] {title}" + # subject: '[Authelia] {title}' ## This address is used during the startup check to verify the email configuration is correct. ## It's not important what it is except if your email server only allows local delivery. - # startup_check_address: test@authelia.com + # startup_check_address: 'test@authelia.com' ## By default we require some form of TLS. This disables this check though is not advised. # disable_require_tls: false @@ -1228,8 +1262,8 @@ notifier: # tls: ## The server subject name to check the servers certificate against during the validation process. - ## This option is not required if the certificate has a SAN which matches the host option. - # server_name: smtp.example.com + ## This option is not required if the certificate has a SAN which matches the address options hostname. + # server_name: 'smtp.example.com' ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the ## certificate or the certificate of the authority signing the certificate to the certificates directory which is @@ -1240,10 +1274,10 @@ notifier: # skip_verify: false ## Minimum TLS version for the connection. - # minimum_version: TLS1.2 + # minimum_version: 'TLS1.2' ## Maximum TLS version for the connection. - # maximum_version: TLS1.3 + # maximum_version: 'TLS1.3' ## The certificate chain used with the private_key if the server requests TLS Client Authentication ## i.e. Mutual TLS. @@ -1331,7 +1365,7 @@ notifier: # oidc: ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets - # hmac_secret: this_is_a_secret_abc123abc123abc + # hmac_secret: 'this_is_a_secret_abc123abc123abc' ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every @@ -1408,10 +1442,10 @@ notifier: # -----END RSA PRIVATE KEY----- ## The lifespans configure the expiration for these token types. - # access_token_lifespan: 1h - # authorize_code_lifespan: 1m - # id_token_lifespan: 1h - # refresh_token_lifespan: 90m + # access_token_lifespan: '1h' + # authorize_code_lifespan: '1m' + # id_token_lifespan: '1h' + # refresh_token_lifespan: '90m' ## Enables additional debug messages. # enable_client_debug_messages: false @@ -1421,23 +1455,23 @@ notifier: ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' ## for security reasons. - # enforce_pkce: public_clients_only + # enforce_pkce: 'public_clients_only' ## Cross-Origin Resource Sharing (CORS) settings. # cors: ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. # endpoints: - # - authorization - # - token - # - revocation - # - introspection - # - userinfo + # - 'authorization' + # - 'token' + # - 'revocation' + # - 'introspection' + # - 'userinfo' ## List of allowed origins. ## Any origin with https is permitted unless this option is configured or the ## allowed_origins_from_client_redirect_uris option is enabled. # allowed_origins: - # - https://example.com + # - 'https://example.com' ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, ## provided they have the scheme http or https and do not have the hostname of localhost. @@ -1447,71 +1481,72 @@ notifier: # clients: # - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. - # id: myapp + # id: 'myapp' ## The description to show to users when they end up on the consent screen. Defaults to the ID above. - # description: My Application + # description: 'My Application' ## The client secret is a shared secret between Authelia and the consumer of this client. - # secret: this_is_a_secret + # yamllint disable-line rule:line-length + # secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not ## necessary. Read the documentation for more information. ## The subject identifier must be the host component of a URL, which is a domain name with an optional port. - # sector_identifier: example.com + # sector_identifier: 'example.com' ## Sets the client to public. This should typically not be set, please see the documentation for usage. # public: false ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. # redirect_uris: - # - https://oidc.example.com:8080/oauth2/callback + # - 'https://oidc.example.com:8080/oauth2/callback' ## Audience this client is allowed to request. # audience: [] ## Scopes this client is allowed to request. # scopes: - # - openid - # - groups - # - email - # - profile + # - 'openid' + # - 'groups' + # - 'email' + # - 'profile' ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: - # - code + # - 'code' ## Response Modes configures which response modes this client supports. # response_modes: - # - form_post - # - query + # - 'form_post' + # - 'query' ## Grant Types configures which grants this client can obtain. ## It's not recommended to define this unless you know what you're doing. # grant_types: - # - authorization_code + # - 'authorization_code' ## The permitted client authentication method for the Token Endpoint for this client. - # token_endpoint_auth_method: client_secret_basic + # token_endpoint_auth_method: 'client_secret_basic' ## The policy to require for this client; one_factor or two_factor. - # authorization_policy: two_factor + # authorization_policy: 'two_factor' ## Enforces the use of PKCE for this client when set to true. # enforce_pkce: false ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method. ## Options are 'plain' and 'S256'. - # pkce_challenge_method: S256 + # pkce_challenge_method: 'S256' ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. - # userinfo_signing_algorithm: none + # userinfo_signing_algorithm: 'none' ## The consent mode controls how consent is obtained. - # consent_mode: auto + # consent_mode: 'auto' ## This value controls the duration a consent on this client remains remembered when the consent mode is ## configured as 'auto' or 'pre-configured'. - # pre_configured_consent_duration: 1w + # pre_configured_consent_duration: '1w' ... diff --git a/internal/configuration/decode_hooks.go b/internal/configuration/decode_hooks.go index caca552c6..1eabcfa7d 100644 --- a/internal/configuration/decode_hooks.go +++ b/internal/configuration/decode_hooks.go @@ -300,7 +300,7 @@ func StringToAddressHookFunc() mapstructure.DecodeHookFuncType { return schema.AddressUDP{Address: *result}, nil case expectedTypeLDAP: - if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeLDAP, schema.AddressSchemeLDAPI); err != nil { + if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeLDAPS, schema.AddressSchemeLDAPI); err != nil { return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err) } diff --git a/internal/configuration/decode_hooks_test.go b/internal/configuration/decode_hooks_test.go index 4e2ad1c03..f9642c170 100644 --- a/internal/configuration/decode_hooks_test.go +++ b/internal/configuration/decode_hooks_test.go @@ -838,7 +838,7 @@ func TestStringToAddressHookFunc(t *testing.T) { name: "ShouldFailDecode", have: "tcp://&!@^#*&!@#&*@!:2020", expected: schema.Address{}, - err: "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [://][:]: parse \"tcp://&!@^\": invalid character \"^\" in host name", + err: "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [://][:]: parse \"tcp://&!@^\": invalid character \"^\" in host name", decode: false, }, } diff --git a/internal/configuration/deprecation.go b/internal/configuration/deprecation.go index 531074462..5fb997a42 100644 --- a/internal/configuration/deprecation.go +++ b/internal/configuration/deprecation.go @@ -13,6 +13,7 @@ type Deprecation struct { Key string NewKey string AutoMap bool + Keep bool MapFunc func(value any) any ErrFunc func(d Deprecation, keysFinal map[string]any, value any, val *schema.StructValidator) } @@ -183,9 +184,10 @@ var deprecations = map[string]Deprecation{ Key: "server.host", NewKey: "server.address", AutoMap: false, + Keep: true, MapFunc: nil, ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { - val.PushWarning(fmt.Errorf("configuration key 'server.host' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.port' in the format of 'tcp://:': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + val.PushWarning(fmt.Errorf("configuration key 'server.host' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) }, }, "server.port": { @@ -193,9 +195,62 @@ var deprecations = map[string]Deprecation{ Key: "server.port", NewKey: "server.address", AutoMap: false, + Keep: true, MapFunc: nil, ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { - val.PushWarning(fmt.Errorf("configuration key 'server.port' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.host' in the format of 'tcp://:': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + val.PushWarning(fmt.Errorf("configuration key 'server.port' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) }, }, + "storage.mysql.host": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.mysql.host", + NewKey: "storage.mysql.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.host' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "storage.mysql.port": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.mysql.port", + NewKey: "storage.mysql.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.port' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "storage.postgres.host": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.postgres.host", + NewKey: "storage.postgres.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.host' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "storage.postgres.port": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "storage.postgres.port", + NewKey: "storage.postgres.address", + AutoMap: false, + Keep: true, + MapFunc: nil, + ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) { + val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.port' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String())) + }, + }, + "authentication_backend.ldap.url": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "authentication_backend.ldap.url", + NewKey: "authentication_backend.ldap.address", + AutoMap: true, + MapFunc: nil, + ErrFunc: nil, + }, } diff --git a/internal/configuration/provider_test.go b/internal/configuration/provider_test.go index 4208389ca..98915016b 100644 --- a/internal/configuration/provider_test.go +++ b/internal/configuration/provider_test.go @@ -120,7 +120,7 @@ func TestShouldValidateConfigurationWithFilters(t *testing.T) { require.Len(t, val.Warnings(), 0) assert.Equal(t, "api-123456789.example.org", config.DuoAPI.Hostname) - assert.Equal(t, "10.10.10.10", config.Notifier.SMTP.Host) + assert.Equal(t, "smtp://10.10.10.10:1025", config.Notifier.SMTP.Address.String()) assert.Equal(t, "10.10.10.10", config.Session.Redis.Host) require.Len(t, config.IdentityProviders.OIDC.Clients, 3) @@ -135,7 +135,7 @@ func TestShouldNotIgnoreInvalidEnvs(t *testing.T) { testSetEnv(t, "STORAGE_MYSQL", "a bad env") testSetEnv(t, "JWT_SECRET", "an env jwt secret") testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_PASSWORD", "an env authentication backend ldap password") - testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "an env authentication backend ldap password") + testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_ADDRESS", "an env authentication backend ldap password") val := schema.NewStructValidator() keys, _, err := Load(val, NewDefaultSources([]string{"./test_resources/config.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) @@ -145,9 +145,10 @@ func TestShouldNotIgnoreInvalidEnvs(t *testing.T) { validator.ValidateKeys(keys, DefaultEnvPrefix, val) require.Len(t, val.Warnings(), 1) - assert.Len(t, val.Errors(), 0) + assert.Len(t, val.Errors(), 1) assert.EqualError(t, val.Warnings()[0], fmt.Sprintf("configuration environment variable not expected: %sSTORAGE_MYSQL", DefaultEnvPrefix)) + assert.EqualError(t, val.Errors()[0], "error occurred during unmarshalling configuration: 1 error(s) decoding:\n\n* error decoding 'authentication_backend.ldap.address': could not decode 'an env authentication backend ldap password' to a *schema.AddressLDAP: could not parse string 'an env authentication backend ldap password' as address: expected format is [://][:]: parse \"ldaps://an env authentication backend ldap password\": invalid character \" \" in host name") } func TestShouldValidateAndRaiseErrorsOnNormalConfigurationAndSecret(t *testing.T) { @@ -268,6 +269,75 @@ func TestShouldValidateAndRaiseErrorsOnBadConfiguration(t *testing.T) { assert.Equal(t, "debug", c.Log.Level) } +func TestShouldValidateDeprecatedEnvNames(t *testing.T) { + testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "ldap://from-env") + + val := schema.NewStructValidator() + keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + + validator.ValidateKeys(keys, DefaultEnvPrefix, val) + + assert.Len(t, val.Errors(), 0) + require.Len(t, val.Warnings(), 1) + + assert.EqualError(t, val.Warnings()[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has not been automatically mapped for you because the replacement key also exists and you will need to adjust your configuration to remove this message") + + assert.Equal(t, "ldap://127.0.0.1:389", c.AuthenticationBackend.LDAP.Address.String()) +} + +func TestShouldValidateDeprecatedEnvNamesWithDeprecatedKeys(t *testing.T) { + testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "ldap://from-env") + + val := schema.NewStructValidator() + keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.deprecated.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + + validator.ValidateKeys(keys, DefaultEnvPrefix, val) + + assert.Len(t, val.Errors(), 0) + + warnings := val.Warnings() + require.Len(t, warnings, 3) + + sort.Sort(utils.ErrSliceSortAlphabetical(warnings)) + + assert.EqualError(t, warnings[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has been automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[1], "configuration key 'storage.mysql.host' is deprecated in 4.38.0 and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[2], "configuration key 'storage.mysql.port' is deprecated in 4.38.0 and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + + assert.Equal(t, "ldap://from-env:389", c.AuthenticationBackend.LDAP.Address.String()) +} + +func TestShouldValidateDeprecatedEnvNamesWithDeprecatedKeysAlt(t *testing.T) { + val := schema.NewStructValidator() + keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.deprecated.alt.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + + validator.ValidateKeys(keys, DefaultEnvPrefix, val) + + assert.Len(t, val.Errors(), 0) + + warnings := val.Warnings() + require.Len(t, warnings, 3) + + sort.Sort(utils.ErrSliceSortAlphabetical(warnings)) + + assert.EqualError(t, warnings[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has been automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[1], "configuration key 'storage.postgres.host' is deprecated in 4.38.0 and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.port' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, warnings[2], "configuration key 'storage.postgres.port' is deprecated in 4.38.0 and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + + val.Clear() + + validator.ValidateConfiguration(c, val) + + require.NotNil(t, c.Storage.PostgreSQL.Address) + assert.Equal(t, "tcp://127.0.0.1:5432", c.Storage.PostgreSQL.Address.String()) +} + func TestShouldRaiseErrOnInvalidNotifierSMTPSender(t *testing.T) { val := schema.NewStructValidator() keys, _, err := Load(val, NewDefaultSources([]string{"./test_resources/config_smtp_sender_invalid.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) @@ -411,7 +481,7 @@ func TestShouldLoadDirectoryConfiguration(t *testing.T) { assert.Len(t, val.Errors(), 0) require.Len(t, val.Warnings(), 1) - assert.EqualError(t, val.Warnings()[0], "configuration key 'server.port' is deprecated in 4.38.0 and has been replaced by 'server.address' when combined with the 'server.host' in the format of 'tcp://:': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") + assert.EqualError(t, val.Warnings()[0], "configuration key 'server.port' is deprecated in 4.38.0 and has been replaced by 'server.address' when combined with the 'server.host' in the format of '[tcp://][:]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message") } func testSetEnv(t *testing.T, key, value string) { diff --git a/internal/configuration/schema/authentication.go b/internal/configuration/schema/authentication.go index c44954c9d..876982498 100644 --- a/internal/configuration/schema/authentication.go +++ b/internal/configuration/schema/authentication.go @@ -95,8 +95,8 @@ type SCryptPassword struct { // LDAPAuthenticationBackend represents the configuration related to LDAP server. type LDAPAuthenticationBackend struct { + Address *AddressLDAP `koanf:"address"` Implementation string `koanf:"implementation"` - URL string `koanf:"url"` Timeout time.Duration `koanf:"timeout"` StartTLS bool `koanf:"start_tls"` TLS *TLSConfig `koanf:"tls"` diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go index ba5aaa423..ac5dbca3e 100644 --- a/internal/configuration/schema/keys.go +++ b/internal/configuration/schema/keys.go @@ -85,8 +85,8 @@ var Keys = []string{ "authentication_backend.file.password.salt_length", "authentication_backend.file.search.email", "authentication_backend.file.search.case_insensitive", + "authentication_backend.ldap.address", "authentication_backend.ldap.implementation", - "authentication_backend.ldap.url", "authentication_backend.ldap.timeout", "authentication_backend.ldap.start_tls", "authentication_backend.ldap.tls.minimum_version", @@ -184,24 +184,26 @@ var Keys = []string{ "regulation.find_time", "regulation.ban_time", "storage.local.path", - "storage.mysql.host", - "storage.mysql.port", + "storage.mysql.address", "storage.mysql.database", "storage.mysql.username", "storage.mysql.password", "storage.mysql.timeout", + "storage.mysql.host", + "storage.mysql.port", "storage.mysql.tls.minimum_version", "storage.mysql.tls.maximum_version", "storage.mysql.tls.skip_verify", "storage.mysql.tls.server_name", "storage.mysql.tls.private_key", "storage.mysql.tls.certificate_chain", - "storage.postgres.host", - "storage.postgres.port", + "storage.postgres.address", "storage.postgres.database", "storage.postgres.username", "storage.postgres.password", "storage.postgres.timeout", + "storage.postgres.host", + "storage.postgres.port", "storage.postgres.schema", "storage.postgres.tls.minimum_version", "storage.postgres.tls.maximum_version", @@ -216,8 +218,7 @@ var Keys = []string{ "storage.encryption_key", "notifier.disable_startup_check", "notifier.filesystem.filename", - "notifier.smtp.host", - "notifier.smtp.port", + "notifier.smtp.address", "notifier.smtp.timeout", "notifier.smtp.username", "notifier.smtp.password", @@ -234,9 +235,9 @@ var Keys = []string{ "notifier.smtp.tls.server_name", "notifier.smtp.tls.private_key", "notifier.smtp.tls.certificate_chain", + "notifier.smtp.host", + "notifier.smtp.port", "notifier.template_path", - "server.host", - "server.port", "server.address", "server.umask", "server.path", @@ -257,6 +258,8 @@ var Keys = []string{ "server.timeouts.read", "server.timeouts.write", "server.timeouts.idle", + "server.host", + "server.port", "telemetry.metrics.enabled", "telemetry.metrics.address", "telemetry.metrics.umask", diff --git a/internal/configuration/schema/notifier.go b/internal/configuration/schema/notifier.go index a95b935f1..d554e6d64 100644 --- a/internal/configuration/schema/notifier.go +++ b/internal/configuration/schema/notifier.go @@ -3,6 +3,7 @@ package schema import ( "crypto/tls" "net/mail" + "net/url" "time" ) @@ -13,8 +14,7 @@ type FileSystemNotifierConfiguration struct { // SMTPNotifierConfiguration represents the configuration of the SMTP server to send emails with. type SMTPNotifierConfiguration struct { - Host string `koanf:"host"` - Port int `koanf:"port"` + Address *AddressSMTP `koanf:"address"` Timeout time.Duration `koanf:"timeout"` Username string `koanf:"username"` Password string `koanf:"password"` @@ -26,6 +26,12 @@ type SMTPNotifierConfiguration struct { DisableHTMLEmails bool `koanf:"disable_html_emails"` DisableStartTLS bool `koanf:"disable_starttls"` TLS *TLSConfig `koanf:"tls"` + + // Deprecated: use address instead. + Host string `koanf:"host"` + + // Deprecated: use address instead. + Port int `koanf:"port"` } // NotifierConfiguration represents the configuration of the notifier to use when sending notifications to users. @@ -38,6 +44,7 @@ type NotifierConfiguration struct { // DefaultSMTPNotifierConfiguration represents default configuration parameters for the SMTP notifier. var DefaultSMTPNotifierConfiguration = SMTPNotifierConfiguration{ + Address: &AddressSMTP{Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "localhost:25"}}}, Timeout: time.Second * 5, Subject: "[Authelia] {title}", Identifier: "localhost", diff --git a/internal/configuration/schema/ntp.go b/internal/configuration/schema/ntp.go index a9fdd3d2e..2cfce4b1d 100644 --- a/internal/configuration/schema/ntp.go +++ b/internal/configuration/schema/ntp.go @@ -1,12 +1,13 @@ package schema import ( + "net/url" "time" ) // NTPConfiguration represents the configuration related to ntp server. type NTPConfiguration struct { - Address string `koanf:"address"` + Address *AddressUDP `koanf:"address"` Version int `koanf:"version"` MaximumDesync time.Duration `koanf:"max_desync"` DisableStartupCheck bool `koanf:"disable_startup_check"` @@ -15,7 +16,7 @@ type NTPConfiguration struct { // DefaultNTPConfiguration represents default configuration parameters for the NTP server. var DefaultNTPConfiguration = NTPConfiguration{ - Address: "time.cloudflare.com:123", + Address: &AddressUDP{Address{valid: true, socket: false, port: 123, url: &url.URL{Scheme: AddressSchemeUDP, Host: "time.cloudflare.com:123"}}}, Version: 4, MaximumDesync: time.Second * 3, } diff --git a/internal/configuration/schema/storage.go b/internal/configuration/schema/storage.go index d8eb93808..3dc2836f0 100644 --- a/internal/configuration/schema/storage.go +++ b/internal/configuration/schema/storage.go @@ -2,6 +2,7 @@ package schema import ( "crypto/tls" + "net/url" "time" ) @@ -12,12 +13,17 @@ type LocalStorageConfiguration struct { // SQLStorageConfiguration represents the configuration of the SQL database. type SQLStorageConfiguration struct { - Host string `koanf:"host"` - Port int `koanf:"port"` + Address *AddressTCP `koanf:"address"` Database string `koanf:"database"` Username string `koanf:"username"` Password string `koanf:"password"` Timeout time.Duration `koanf:"timeout"` + + // Deprecated: use address instead. + Host string `koanf:"host"` + + // Deprecated: use address instead. + Port int `koanf:"port"` } // MySQLStorageConfiguration represents the configuration of a MySQL database. @@ -68,6 +74,9 @@ var DefaultMySQLStorageConfiguration = MySQLStorageConfiguration{ // DefaultPostgreSQLStorageConfiguration represents the default PostgreSQL configuration. var DefaultPostgreSQLStorageConfiguration = PostgreSQLStorageConfiguration{ + SQLStorageConfiguration: SQLStorageConfiguration{ + Address: &AddressTCP{Address{true, false, 5432, &url.URL{Scheme: AddressSchemeTCP, Host: "localhost:5432"}}}, + }, Schema: "public", TLS: &TLSConfig{ MinimumVersion: TLSVersion{tls.VersionTLS12}, diff --git a/internal/configuration/schema/types.go b/internal/configuration/schema/types.go index d27c5c48a..bc5bd988c 100644 --- a/internal/configuration/schema/types.go +++ b/internal/configuration/schema/types.go @@ -9,11 +9,7 @@ import ( "crypto/x509" "encoding/pem" "fmt" - "net" - "net/url" - "strconv" "strings" - "syscall" "time" "github.com/go-crypt/crypt" @@ -21,388 +17,6 @@ import ( "github.com/go-crypt/crypt/algorithm/plaintext" ) -// NewAddress returns an *Address and error depending on the ability to parse the string as an Address. -// It also assumes any value without a scheme which looks like a path is the 'unix' scheme, and everything else without -// a scheme is the 'tcp' scheme. -func NewAddress(value string) (address *Address, err error) { - return NewAddressDefault(value, AddressSchemeTCP, AddressSchemeUnix) -} - -// NewAddressDefault returns an *Address and error depending on the ability to parse the string as an Address. -// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything -// else without a scheme is the schemeDefault scheme. -func NewAddressDefault(value, schemeDefault, schemeDefaultPath string) (address *Address, err error) { - if len(value) == 0 { - return &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil - } - - var u *url.URL - - if regexpHasScheme.MatchString(value) { - u, err = url.Parse(value) - } else { - if strings.HasPrefix(value, "/") { - u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value)) - } else { - u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value)) - } - } - - if err != nil { - return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", value, err) - } - - return NewAddressFromURL(u) -} - -// NewAddressUnix returns an *Address from a path value. -func NewAddressUnix(path string) Address { - return Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}} -} - -// NewAddressFromNetworkValues returns an *Address from network values. -func NewAddressFromNetworkValues(network, host string, port int) Address { - return Address{true, false, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port)}} -} - -// NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address. -func NewAddressFromURL(u *url.URL) (addr *Address, err error) { - addr = &Address{ - url: u, - } - - if err = addr.validate(); err != nil { - return nil, err - } - - return addr, nil -} - -// AddressTCP is just a type with an underlying type of Address. -type AddressTCP struct { - Address -} - -// AddressUDP is just a type with an underlying type of Address. -type AddressUDP struct { - Address -} - -// AddressLDAP is just a type with an underlying type of Address. -type AddressLDAP struct { - Address -} - -// AddressSMTP is just a type with an underlying type of Address. -type AddressSMTP struct { - Address -} - -// Address represents an address. -type Address struct { - valid bool - socket bool - port int - - url *url.URL -} - -// Valid returns true if the Address is valid. -func (a *Address) Valid() bool { - return a.valid -} - -// ValidateHTTP returns true if the Address is valid for a HTTP connection listener. -func (a *Address) ValidateHTTP() error { - switch a.Scheme() { - case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUnix: - break - default: - return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme()) - } - - return nil -} - -// ValidateListener returns true if the Address is valid for a connection listener. -func (a *Address) ValidateListener() error { - switch a.Scheme() { - case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: - break - default: - return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as '%s'", a.Scheme()) - } - - return nil -} - -// ValidateSMTP returns true if the Address is valid for a remote SMTP connection opener. -func (a *Address) ValidateSMTP() error { - switch a.Scheme() { - case AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: - break - default: - return fmt.Errorf("scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as '%s'", a.Scheme()) - } - - return nil -} - -// ValidateLDAP returns true if the Address has a value Scheme for an LDAP connection opener. -func (a *Address) ValidateLDAP() error { - switch a.Scheme() { - case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeLDAPI: - break - default: - return fmt.Errorf("scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as '%s'", a.Scheme()) - } - - return nil -} - -// IsExplicitlySecure returns true if the address is an explicitly secure. -func (a *Address) IsExplicitlySecure() bool { - switch a.Scheme() { - case AddressSchemeSUBMISSIONS, AddressSchemeLDAPS: - return true - default: - return false - } -} - -// String returns a string representation of the Address. -func (a *Address) String() string { - if !a.valid || a.url == nil { - return "" - } - - return a.url.String() -} - -// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp. -func (a *Address) Network() string { - switch scheme := a.Scheme(); scheme { - case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: - return scheme - default: - return AddressSchemeTCP - } -} - -// Scheme returns the *url.URL Scheme field. -func (a *Address) Scheme() string { - if !a.valid || a.url == nil { - return "" - } - - return a.url.Scheme -} - -// Hostname returns the output of the *url.URL Hostname func. -func (a *Address) Hostname() string { - if !a.valid || a.url == nil { - return "" - } - - return a.url.Hostname() -} - -// SocketHostname returns the correct hostname for a socket connection. -func (a *Address) SocketHostname() string { - if !a.valid || a.url == nil { - return "" - } - - if a.socket { - return a.url.Path - } - - return a.url.Hostname() -} - -// SetHostname sets the hostname preserving the port. -func (a *Address) SetHostname(hostname string) { - if !a.valid || a.url == nil { - return - } - - if port := a.url.Port(); port == "" { - a.url.Host = hostname - } else { - a.url.Host = fmt.Sprintf("%s:%s", hostname, port) - } -} - -// Port returns the port. -func (a *Address) Port() int { - return a.port -} - -// SetPort sets the port preserving the hostname. -func (a *Address) SetPort(port int) { - if !a.valid || a.url == nil { - return - } - - a.setport(port) -} - -// Host returns the *url.URL Host field. -func (a *Address) Host() string { - if !a.valid || a.url == nil { - return "" - } - - return a.url.Host -} - -// NetworkAddress returns a string representation of the Address with just the host and port. -func (a *Address) NetworkAddress() string { - if !a.valid || a.url == nil { - return "" - } - - if a.socket { - return a.url.Path - } - - return a.url.Host -} - -// Listener creates and returns a net.Listener. -func (a *Address) Listener() (net.Listener, error) { - return a.listener() -} - -// Dial creates and returns a dialed net.Conn. -func (a *Address) Dial() (net.Conn, error) { - if a.url == nil { - return nil, fmt.Errorf("address url is nil") - } - - return net.Dial(a.Network(), a.NetworkAddress()) -} - -// ListenerWithUMask creates and returns a net.Listener with a temporary UMask if the scheme is `unix`. -func (a *Address) ListenerWithUMask(umask int) (ln net.Listener, err error) { - if !a.socket { - return a.listener() - } - - if a.url == nil { - return nil, fmt.Errorf("address url is nil") - } - - umask = syscall.Umask(umask) - - ln, err = net.Listen(a.Network(), a.NetworkAddress()) - - _ = syscall.Umask(umask) - - return ln, err -} - -func (a *Address) listener() (net.Listener, error) { - if a.url == nil { - return nil, fmt.Errorf("address url is nil") - } - - return net.Listen(a.Network(), a.NetworkAddress()) -} - -func (a *Address) setport(port int) { - a.port = port - a.url.Host = net.JoinHostPort(a.url.Hostname(), strconv.Itoa(port)) -} - -func (a *Address) validate() (err error) { - if a.url == nil { - return fmt.Errorf("error validating the address: address url was nil") - } - - switch { - case a.url.RawQuery != "": - return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses", a.url.String()) - case a.url.RawFragment != "", a.url.Fragment != "": - return fmt.Errorf("error validating the address: the url '%s' appears to have a fragment but this is not valid for addresses", a.url.String()) - case a.url.User != nil: - return fmt.Errorf("error validating the address: the url '%s' appears to have user info but this is not valid for addresses", a.url.String()) - } - - switch a.url.Scheme { - case AddressSchemeUnix, AddressSchemeLDAPI: - if err = a.validateUnixSocket(); err != nil { - return err - } - case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6: - if err = a.validateTCPUDP(); err != nil { - return err - } - case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: - if err = a.validateProtocol(); err != nil { - return err - } - } - - a.valid = true - - return nil -} - -func (a *Address) validateProtocol() (err error) { - port := a.url.Port() - - switch port { - case "": - switch a.url.Scheme { - case AddressSchemeLDAP: - a.setport(389) - case AddressSchemeLDAPS: - a.setport(636) - case AddressSchemeSMTP: - a.setport(25) - case AddressSchemeSUBMISSION: - a.setport(587) - case AddressSchemeSUBMISSIONS: - a.setport(465) - } - default: - actualPort, _ := strconv.Atoi(port) - - a.setport(actualPort) - } - - return nil -} - -func (a *Address) validateTCPUDP() (err error) { - port := a.url.Port() - - switch port { - case "": - a.setport(0) - default: - actualPort, _ := strconv.Atoi(port) - - a.setport(actualPort) - } - - return nil -} - -func (a *Address) validateUnixSocket() (err error) { - switch { - case a.url.Path == "" && a.url.Scheme != AddressSchemeLDAPI: - return fmt.Errorf("error validating the unix socket address: could not determine path from '%s'", a.url.String()) - case a.url.Host != "": - return fmt.Errorf("error validating the unix socket address: the url '%s' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", a.url.String()) - } - - a.socket = true - - return nil -} - var cdecoder algorithm.DecoderRegister // DecodePasswordDigest returns a new PasswordDigest if it can be decoded. diff --git a/internal/configuration/schema/types_address.go b/internal/configuration/schema/types_address.go new file mode 100644 index 000000000..c33dcf6c0 --- /dev/null +++ b/internal/configuration/schema/types_address.go @@ -0,0 +1,482 @@ +package schema + +import ( + "fmt" + "net" + "net/url" + "strconv" + "strings" + "syscall" +) + +// NewAddress returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the 'unix' scheme, and everything else without +// a scheme is the 'tcp' scheme. +func NewAddress(value string) (address *Address, err error) { + return NewAddressDefault(value, AddressSchemeTCP, AddressSchemeUnix) +} + +// NewAddressDefault returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything +// else without a scheme is the schemeDefault scheme. +func NewAddressDefault(value, schemeDefault, schemeDefaultPath string) (address *Address, err error) { + if len(value) == 0 { + return &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil + } + + var u *url.URL + + if regexpHasScheme.MatchString(value) { + u, err = url.Parse(value) + } else { + if strings.HasPrefix(value, "/") { + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value)) + } else { + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value)) + } + } + + if err != nil { + return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", value, err) + } + + return NewAddressFromURL(u) +} + +// NewAddressFromNetworkValuesDefault returns an *Address and error depending on the ability to parse the string as an Address. +// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything +// else without a scheme is the schemeDefault scheme. +func NewAddressFromNetworkValuesDefault(value string, port int, schemeDefault, schemeDefaultPath string) (address *Address, err error) { + var u *url.URL + + if regexpHasScheme.MatchString(value) { + u, err = url.Parse(value) + } else { + switch { + case strings.HasPrefix(value, "/"): + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value)) + case port > 0: + u, err = url.Parse(fmt.Sprintf("%s://%s:%d", schemeDefault, value, port)) + default: + u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value)) + } + } + + if err != nil { + return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [://][:]: %w", value, err) + } + + return NewAddressFromURL(u) +} + +// NewAddressUnix returns an *Address from a path value. +func NewAddressUnix(path string) Address { + return Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}} +} + +// NewAddressFromNetworkValues returns an *Address from network values. +func NewAddressFromNetworkValues(network, host string, port int) Address { + return Address{true, false, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port)}} +} + +// NewSMTPAddress returns an *AddressSMTP from SMTP values. +func NewSMTPAddress(scheme, host string, port int) *AddressSMTP { + if port == 0 { + switch scheme { + case AddressSchemeSUBMISSIONS: + port = 465 + case AddressSchemeSUBMISSION: + port = 587 + default: + port = 25 + } + } + + if scheme == "" { + switch port { + case 465: + scheme = AddressSchemeSUBMISSIONS + case 587: + scheme = AddressSchemeSUBMISSION + default: + scheme = AddressSchemeSMTP + } + } + + return &AddressSMTP{Address: Address{true, false, port, &url.URL{Scheme: scheme, Host: fmt.Sprintf("%s:%d", host, port)}}} +} + +// NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address. +func NewAddressFromURL(u *url.URL) (addr *Address, err error) { + addr = &Address{ + url: u, + } + + if err = addr.validate(); err != nil { + return nil, err + } + + return addr, nil +} + +// AddressTCP is just a type with an underlying type of Address. +type AddressTCP struct { + Address +} + +// AddressUDP is just a type with an underlying type of Address. +type AddressUDP struct { + Address +} + +// AddressLDAP is just a type with an underlying type of Address. +type AddressLDAP struct { + Address +} + +// AddressSMTP is just a type with an underlying type of Address. +type AddressSMTP struct { + Address +} + +// Address represents an address. +type Address struct { + valid bool + socket bool + port int + + url *url.URL +} + +// Valid returns true if the Address is valid. +func (a *Address) Valid() bool { + return a.valid +} + +// IsUnixDomainSocket returns true if the address has been determined to be a Unix Domain Socket. +func (a *Address) IsUnixDomainSocket() bool { + return a.socket +} + +// IsTCP returns true if the address is one of the TCP schemes (not including application schemes that use TCP). +func (a *Address) IsTCP() bool { + switch a.Scheme() { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6: + return true + default: + return false + } +} + +// IsUDP returns true if the address is one of the UDP schemes (not including application schemes that use UDP). +func (a *Address) IsUDP() bool { + switch a.Scheme() { + case AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6: + return true + default: + return false + } +} + +// IsExplicitlySecure returns true if the address is an explicitly secure. +func (a *Address) IsExplicitlySecure() bool { + switch a.Scheme() { + case AddressSchemeSUBMISSIONS, AddressSchemeLDAPS: + return true + default: + return false + } +} + +// ValidateListener returns true if the Address is valid for a connection listener. +func (a *Address) ValidateListener() error { + switch a.Scheme() { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: + break + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as '%s'", a.Scheme()) + } + + return nil +} + +// ValidateHTTP returns true if the Address is valid for a HTTP connection listener. +func (a *Address) ValidateHTTP() error { + if a.IsTCP() { + return nil + } + + switch a.Scheme() { + case AddressSchemeUnix: + return nil + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme()) + } +} + +// ValidateSMTP returns true if the Address is valid for a remote SMTP connection opener. +func (a *Address) ValidateSMTP() error { + switch a.Scheme() { + case AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: + return nil + default: + return fmt.Errorf("scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as '%s'", a.Scheme()) + } +} + +// ValidateSQL returns true if the Address is valid for a remote SQL connection opener. +func (a *Address) ValidateSQL() error { + if a.IsTCP() { + return nil + } + + switch a.Scheme() { + case AddressSchemeUnix: + return nil + default: + return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme()) + } +} + +// ValidateLDAP returns true if the Address has a value Scheme for an LDAP connection opener. +func (a *Address) ValidateLDAP() error { + switch a.Scheme() { + case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeLDAPI: + return nil + default: + return fmt.Errorf("scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as '%s'", a.Scheme()) + } +} + +// String returns a string representation of the Address. +func (a *Address) String() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.String() +} + +// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp. +func (a *Address) Network() string { + switch scheme := a.Scheme(); scheme { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: + return scheme + default: + return AddressSchemeTCP + } +} + +// Scheme returns the *url.URL Scheme field. +func (a *Address) Scheme() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Scheme +} + +// Hostname returns the output of the *url.URL Hostname func. +func (a *Address) Hostname() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Hostname() +} + +// SocketHostname returns the correct hostname for a socket connection. +func (a *Address) SocketHostname() string { + if !a.valid || a.url == nil { + return "" + } + + if a.socket { + return a.url.Path + } + + return a.url.Hostname() +} + +// SetHostname sets the hostname preserving the port. +func (a *Address) SetHostname(hostname string) { + if !a.valid || a.url == nil { + return + } + + if port := a.url.Port(); port == "" { + a.url.Host = hostname + } else { + a.url.Host = fmt.Sprintf("%s:%s", hostname, port) + } +} + +// Port returns the port. +func (a *Address) Port() int { + return a.port +} + +// SetPort sets the port preserving the hostname. +func (a *Address) SetPort(port int) { + if !a.valid || a.url == nil { + return + } + + a.setport(port) +} + +// Host returns the *url.URL Host field. +func (a *Address) Host() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Host +} + +// NetworkAddress returns a string representation of the Address with just the host and port. +func (a *Address) NetworkAddress() string { + if !a.valid || a.url == nil { + return "" + } + + if a.socket { + return a.url.Path + } + + return a.url.Host +} + +// Listener creates and returns a net.Listener. +func (a *Address) Listener() (net.Listener, error) { + return a.listener() +} + +// Dial creates and returns a dialed net.Conn. +func (a *Address) Dial() (net.Conn, error) { + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + return net.Dial(a.Network(), a.NetworkAddress()) +} + +// ListenerWithUMask creates and returns a net.Listener with a temporary UMask if the scheme is `unix`. +func (a *Address) ListenerWithUMask(umask int) (ln net.Listener, err error) { + if !a.socket { + return a.listener() + } + + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + umask = syscall.Umask(umask) + + ln, err = net.Listen(a.Network(), a.NetworkAddress()) + + _ = syscall.Umask(umask) + + return ln, err +} + +func (a *Address) listener() (net.Listener, error) { + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + return net.Listen(a.Network(), a.NetworkAddress()) +} + +func (a *Address) setport(port int) { + a.port = port + a.url.Host = net.JoinHostPort(a.url.Hostname(), strconv.Itoa(port)) +} + +func (a *Address) validate() (err error) { + if a.url == nil { + return fmt.Errorf("error validating the address: address url was nil") + } + + switch { + case a.url.RawQuery != "": + return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses", a.url.String()) + case a.url.RawFragment != "", a.url.Fragment != "": + return fmt.Errorf("error validating the address: the url '%s' appears to have a fragment but this is not valid for addresses", a.url.String()) + case a.url.User != nil: + return fmt.Errorf("error validating the address: the url '%s' appears to have user info but this is not valid for addresses", a.url.String()) + } + + switch a.url.Scheme { + case AddressSchemeUnix, AddressSchemeLDAPI: + if err = a.validateUnixSocket(); err != nil { + return err + } + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6: + if err = a.validateTCPUDP(); err != nil { + return err + } + case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS: + if err = a.validateProtocol(); err != nil { + return err + } + } + + a.valid = true + + return nil +} + +func (a *Address) validateProtocol() (err error) { + port := a.url.Port() + + switch port { + case "": + switch a.url.Scheme { + case AddressSchemeLDAP: + a.setport(389) + case AddressSchemeLDAPS: + a.setport(636) + case AddressSchemeSMTP: + a.setport(25) + case AddressSchemeSUBMISSION: + a.setport(587) + case AddressSchemeSUBMISSIONS: + a.setport(465) + } + default: + actualPort, _ := strconv.Atoi(port) + + a.setport(actualPort) + } + + return nil +} + +func (a *Address) validateTCPUDP() (err error) { + port := a.url.Port() + + switch port { + case "": + a.setport(0) + default: + actualPort, _ := strconv.Atoi(port) + + a.setport(actualPort) + } + + return nil +} + +func (a *Address) validateUnixSocket() (err error) { + switch { + case a.url.Path == "" && a.url.Scheme != AddressSchemeLDAPI: + return fmt.Errorf("error validating the unix socket address: could not determine path from '%s'", a.url.String()) + case a.url.Host != "": + return fmt.Errorf("error validating the unix socket address: the url '%s' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", a.url.String()) + } + + a.socket = true + + return nil +} diff --git a/internal/configuration/schema/types_address_test.go b/internal/configuration/schema/types_address_test.go new file mode 100644 index 000000000..f40393d60 --- /dev/null +++ b/internal/configuration/schema/types_address_test.go @@ -0,0 +1,743 @@ +package schema + +import ( + "net" + "net/url" + "path/filepath" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestNewAddressFromString(t *testing.T) { + testCases := []struct { + name string + have string + expected *Address + expectedAddress, expectedString, expectedErr string + }{ + { + "ShouldParseBasicAddress", + "tcp://0.0.0.0:9091", + &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + "0.0.0.0:9091", + "tcp://0.0.0.0:9091", + "", + }, + { + "ShouldParseEmptyAddress", + "", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, + ":0", + "tcp://:0", + "", + }, + { + "ShouldParseAddressMissingScheme", + "0.0.0.0:9091", + &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + "0.0.0.0:9091", + "tcp://0.0.0.0:9091", + "", + }, + { + "ShouldParseUnixAddressMissingScheme", + "/var/run/example.sock", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}}, + "/var/run/example.sock", + "unix:///var/run/example.sock", + "", + }, + { + "ShouldParseAddressMissingPort", + "tcp://0.0.0.0", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}}, + "0.0.0.0:0", + "tcp://0.0.0.0:0", + "", + }, + { + "ShouldParseUnixSocket", + "unix:///path/to/a/socket.sock", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}}, + "/path/to/a/socket.sock", + "unix:///path/to/a/socket.sock", + "", + }, + { + "ShouldNotParseUnixSocketWithHost", + "unix://ahost/path/to/a/socket.sock", + nil, + "", + "", + "error validating the unix socket address: the url 'unix://ahost/path/to/a/socket.sock' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", + }, + { + "ShouldNotParseUnixSocketWithoutPath", + "unix://nopath.com", + nil, + "", + "", + "error validating the unix socket address: could not determine path from 'unix://nopath.com'", + }, + { + "ShouldNotParseUnixSocketWithQuery", + "unix:///path/to/a/socket.sock?q=yes", + nil, + "", + "", + "error validating the address: the url 'unix:///path/to/a/socket.sock?q=yes' appears to have a query but this is not valid for addresses", + }, + { + "ShouldNotParseUnixSocketWithFragment", + "unix:///path/to/a/socket.sock#example", + nil, + "", + "", + "error validating the address: the url 'unix:///path/to/a/socket.sock#example' appears to have a fragment but this is not valid for addresses", + }, + { + "ShouldNotParseUnixSocketWithUserInfo", + "unix://user:example@/path/to/a/socket.sock", + nil, + "", + "", + "error validating the address: the url 'unix://user:example@/path/to/a/socket.sock' appears to have user info but this is not valid for addresses", + }, + { + "ShouldParseUnknownScheme", + "a://0.0.0.0", + &Address{true, false, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}}, + "0.0.0.0", + "a://0.0.0.0", + "", + }, + { + "ShouldNotParseInvalidPort", + "tcp://0.0.0.0:abc", + nil, + "", + "", + "could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [://][:]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host", + }, + { + "ShouldNotParseInvalidAddress", + "@$@#%@#$@@", + nil, + "", + "", + "could not parse string '@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", + }, + { + "ShouldNotParseInvalidAddressWithScheme", + "tcp://@$@#%@#$@@", + nil, + "", + "", + "could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", + }, + { + "ShouldSetDefaultPortLDAP", + "ldap://127.0.0.1", + &Address{true, false, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}}, + "127.0.0.1:389", + "ldap://127.0.0.1:389", + "", + }, + { + "ShouldSetDefaultPortLDAPS", + "ldaps://127.0.0.1", + &Address{true, false, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}}, + "127.0.0.1:636", + "ldaps://127.0.0.1:636", + "", + }, + { + "ShouldAllowLDAPI", + "ldapi:///abc", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}}, + "/abc", + "ldapi:///abc", + "", + }, + { + "ShouldAllowImplicitLDAPI", + "ldapi://", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + "", + "ldapi:", + "", + }, + { + "ShouldAllowImplicitLDAPINoSlash", + "ldapi:", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + "", + "ldapi:", + "", + }, + { + "ShouldSetDefaultPortSMTP", + "smtp://127.0.0.1", + &Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}}, + "127.0.0.1:25", + "smtp://127.0.0.1:25", + "", + }, + { + "ShouldSetDefaultPortSUBMISSION", + "submission://127.0.0.1", + &Address{true, false, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}}, + "127.0.0.1:587", + "submission://127.0.0.1:587", + "", + }, + { + "ShouldSetDefaultPortSUBMISSIONS", + "submissions://127.0.0.1", + &Address{true, false, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}}, + "127.0.0.1:465", + "submissions://127.0.0.1:465", + "", + }, + { + "ShouldNotOverridePort", + "ldap://127.0.0.1:123", + &Address{true, false, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}}, + "127.0.0.1:123", + "ldap://127.0.0.1:123", + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + actual, actualErr := NewAddress(tc.have) + + if len(tc.expectedErr) != 0 { + assert.EqualError(t, actualErr, tc.expectedErr) + } else { + assert.Nil(t, actualErr) + + assert.Equal(t, tc.expectedAddress, actual.NetworkAddress()) + assert.Equal(t, tc.expectedString, actual.String()) + + assert.True(t, actual.Valid()) + } + + assert.Equal(t, tc.expected, actual) + }) + } +} + +func TestAddress_ValidateErrors(t *testing.T) { + testCases := []struct { + name string + have *Address + expectedLDAP, expectedSMTP, expectedHTTP, expectedSQL, expectedListener string + }{ + { + "ShouldValidateLDAPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}}, + "", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'ldap'", + }, + { + "ShouldValidateSMTPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'", + "", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'", + "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'smtp'", + }, + { + "ShouldValidateTCPAddress", + &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'tcp'", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'tcp'", + "", + "", + "", + }, + { + "ShouldValidateUnixSocket", + &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/socket"}}, + "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'unix'", + "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'unix'", + "", + "", + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + if tc.expectedLDAP == "" { + assert.NoError(t, tc.have.ValidateLDAP()) + } else { + assert.EqualError(t, tc.have.ValidateLDAP(), tc.expectedLDAP) + } + + if tc.expectedSMTP == "" { + assert.NoError(t, tc.have.ValidateSMTP()) + } else { + assert.EqualError(t, tc.have.ValidateSMTP(), tc.expectedSMTP) + } + + if tc.expectedHTTP == "" { + assert.NoError(t, tc.have.ValidateHTTP()) + } else { + assert.EqualError(t, tc.have.ValidateHTTP(), tc.expectedHTTP) + } + + if tc.expectedSQL == "" { + assert.NoError(t, tc.have.ValidateSQL()) + } else { + assert.EqualError(t, tc.have.ValidateSQL(), tc.expectedSQL) + } + + if tc.expectedListener == "" { + assert.NoError(t, tc.have.ValidateListener()) + } else { + assert.EqualError(t, tc.have.ValidateListener(), tc.expectedListener) + } + }) + } +} + +func TestAddress_SetHostname(t *testing.T) { + address := &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}} + + assert.Equal(t, "tcp://0.0.0.0", address.String()) + + address.SetHostname("127.0.0.1") + + assert.Equal(t, "tcp://127.0.0.1", address.String()) +} + +func TestAddress_ListenerWithUMask(t *testing.T) { + dir := t.TempDir() + + address := &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: filepath.Join(dir, "example.sock")}} + + ln, err := address.ListenerWithUMask(600) + + assert.NotNil(t, ln) + assert.NoError(t, err) + assert.NoError(t, ln.Close()) + + address = &Address{true, true, 0, nil} + + ln, err = address.ListenerWithUMask(600) + + assert.Nil(t, ln) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 0, nil} + + ln, err = address.ListenerWithUMask(600) + + assert.Nil(t, ln) + assert.EqualError(t, err, "address url is nil") +} + +func TestAddressOutputValues(t *testing.T) { + var ( + address *Address + listener net.Listener + err error + ) + + address = &Address{} + assert.EqualError(t, address.validate(), "error validating the address: address url was nil") + + address = &Address{false, false, 0, nil} + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}} + + assert.Equal(t, "tcp://0.0.0.0:8080", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:8080", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:8080", address.NetworkAddress()) + assert.Equal(t, 8080, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + address = &Address{true, false, 0, nil} + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address.SetHostname("abc123.com") + address.SetPort(50) + + assert.Equal(t, "", address.String()) + assert.Equal(t, "", address.Scheme()) + assert.Equal(t, "", address.Host()) + assert.Equal(t, "", address.Hostname()) + assert.Equal(t, "", address.NetworkAddress()) + assert.Equal(t, 0, address.Port()) + + listener, err = address.Listener() + + assert.Nil(t, listener) + assert.EqualError(t, err, "address url is nil") + + address = &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}} + + assert.Equal(t, "tcp://0.0.0.0:9091", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:9091", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:9091", address.NetworkAddress()) + assert.Equal(t, 9091, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + assert.NoError(t, listener.Close()) + + address.SetPort(9092) + + assert.Equal(t, "tcp://0.0.0.0:9092", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "0.0.0.0:9092", address.Host()) + assert.Equal(t, "0.0.0.0", address.Hostname()) + assert.Equal(t, "0.0.0.0:9092", address.NetworkAddress()) + assert.Equal(t, 9092, address.Port()) + + listener, err = address.Listener() + + assert.NotNil(t, listener) + assert.NoError(t, err) + + assert.NoError(t, listener.Close()) + + address.SetHostname("example.com") + + assert.Equal(t, "tcp://example.com:9092", address.String()) + assert.Equal(t, "tcp", address.Scheme()) + assert.Equal(t, "example.com:9092", address.Host()) + assert.Equal(t, "example.com", address.Hostname()) + assert.Equal(t, "example.com:9092", address.NetworkAddress()) + assert.Equal(t, 9092, address.Port()) +} + +func TestNewAddressUnix(t *testing.T) { + have := NewAddressUnix("/abc/123") + + require.NotNil(t, have) + assert.Equal(t, "unix:///abc/123", have.String()) +} + +func TestNewAddressFromNetworkValues(t *testing.T) { + have := NewAddressFromNetworkValues(AddressSchemeUDP, "av", 1) + + require.NotNil(t, have) + assert.Equal(t, "udp://av:1", have.String()) +} + +func TestNewSMTPAddress(t *testing.T) { + testCases := []struct { + name string + haveScheme string + haveHost string + havePort int + expected string + expectedNetwork, expectedScheme string + expectedHostname string + expectedPort int + expectedExplicitTLS bool + }{ + { + "ShouldParseUnknownSchemePort25", + "", + "hosta", + 25, + "smtp://hosta:25", + "tcp", + "smtp", + "hosta", + 25, + false, + }, + { + "ShouldParseUnknownSchemePort465", + "", + "hostb", + 465, + "submissions://hostb:465", + "tcp", + "submissions", + "hostb", + 465, + true, + }, + { + "ShouldParseUnknownSchemePort587", + "", + "hostc", + 587, + "submission://hostc:587", + "tcp", + "submission", + "hostc", + 587, + false, + }, + { + "ShouldParseUnknownPortSchemeSMTP", + "smtp", + "hostd", + 0, + "smtp://hostd:25", + "tcp", + "smtp", + "hostd", + 25, + false, + }, + { + "ShouldParseUnknownPortSchemeSUBMISSION", + "submission", + "hoste", + 0, + "submission://hoste:587", + "tcp", + "submission", + "hoste", + 587, + false, + }, + { + "ShouldParseUnknownPortSchemeSUBMISSIONS", + "submissions", + "hostf", + 0, + "submissions://hostf:465", + "tcp", + "submissions", + "hostf", + 465, + true, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + have := NewSMTPAddress(tc.haveScheme, tc.haveHost, tc.havePort) + + assert.Equal(t, tc.expected, have.String()) + assert.Equal(t, tc.expectedScheme, have.Scheme()) + assert.Equal(t, tc.expectedNetwork, have.Network()) + assert.Equal(t, tc.expectedHostname, have.Hostname()) + assert.Equal(t, tc.expectedHostname, have.SocketHostname()) + assert.Equal(t, tc.expectedPort, have.Port()) + assert.Equal(t, tc.expectedExplicitTLS, have.IsExplicitlySecure()) + }) + } +} + +func TestAddress_SocketHostname(t *testing.T) { + testCases := []struct { + name string + have Address + expected string + }{ + { + "ShouldReturnHostname", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "examplea:80"}}, + "examplea", + }, + { + "ShouldReturnPath", + Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, + "/abc/123", + }, + { + "ShouldReturnNothing", + Address{false, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, + "", + }, + { + "ShouldReturnNothingNil", + Address{true, true, 80, nil}, + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.expected, tc.have.SocketHostname()) + }) + } +} + +func TestAddress_IsTCP_IsUDP(t *testing.T) { + testCases := []struct { + name string + have Address + isTCP bool + isUDP bool + }{ + { + "ShouldReturnTrueTCP", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta"}}, + true, + false, + }, + { + "ShouldReturnTrueTCP4", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP4, Host: "tcphostb"}}, + true, + false, + }, + { + "ShouldReturnTrueTCP6", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP6, Host: "tcphostc"}}, + true, + false, + }, + { + "ShouldReturnFalseUDP", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP, Host: "tcphostd"}}, + false, + true, + }, + { + "ShouldReturnFalseUDP4", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP4, Host: "tcphoste"}}, + false, + true, + }, + { + "ShouldReturnFalseUDP6", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP6, Host: "tcphostf"}}, + false, + true, + }, + { + "ShouldReturnFalseSMTP", + Address{true, false, 80, &url.URL{Scheme: AddressSchemeSMTP, Host: "tcphostg"}}, + false, + false, + }, + { + "ShouldReturnFalseUnix", + Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Host: "tcphosth"}}, + false, + false, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.isTCP, tc.have.IsTCP()) + assert.Equal(t, tc.isUDP, tc.have.IsUDP()) + }) + } +} + +func TestNewAddressFromNetworkValuesDefault(t *testing.T) { + testCases := []struct { + name string + haveHost string + havePort int + haveSchemeDefault string + haveSchemeDefaultPath string + expected string + expectedErr string + }{ + { + "ShouldParseTCPWithTCPUnix", + "cba", + 80, + AddressSchemeTCP, + AddressSchemeUnix, + "tcp://cba:80", + "", + }, + { + "ShouldParseTCPWithTCPUnixNoPort", + "cba", + 0, + AddressSchemeTCP, + AddressSchemeUnix, + "tcp://cba:0", + "", + }, + { + "ShouldParseUnixWithTCPUnix", + "/abc/123", + 80, + AddressSchemeTCP, + AddressSchemeUnix, + "unix:///abc/123", + "", + }, + { + "ShouldParseUnixWithScheme", + "unix:///abc/123", + 0, + AddressSchemeTCP, + AddressSchemeUnix, + "unix:///abc/123", + "", + }, + { + "ShouldErrBadURL", + "tcp://127.0.0.1:abc", + 0, + AddressSchemeTCP, + AddressSchemeUnix, + "", + "could not parse string 'tcp://127.0.0.1:abc' as address: expected format is [://][:]: parse \"tcp://127.0.0.1:abc\": invalid port \":abc\" after host", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + actual, theError := NewAddressFromNetworkValuesDefault(tc.haveHost, tc.havePort, tc.haveSchemeDefault, tc.haveSchemeDefaultPath) + + if tc.expectedErr == "" { + require.NoError(t, theError) + assert.Equal(t, tc.expected, actual.String()) + } else { + assert.EqualError(t, theError, tc.expectedErr) + assert.Nil(t, actual) + } + }) + } +} diff --git a/internal/configuration/schema/types_test.go b/internal/configuration/schema/types_test.go index aa42b4a54..886b9ce32 100644 --- a/internal/configuration/schema/types_test.go +++ b/internal/configuration/schema/types_test.go @@ -7,9 +7,6 @@ import ( "crypto/x509" "encoding/pem" "fmt" - "net" - "net/url" - "path/filepath" "regexp" "testing" @@ -17,433 +14,6 @@ import ( "github.com/stretchr/testify/require" ) -func TestNewAddressFromString(t *testing.T) { - testCases := []struct { - name string - have string - expected *Address - expectedAddress, expectedString, expectedErr string - }{ - { - "ShouldParseBasicAddress", - "tcp://0.0.0.0:9091", - &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, - "0.0.0.0:9091", - "tcp://0.0.0.0:9091", - "", - }, - { - "ShouldParseEmptyAddress", - "", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, - ":0", - "tcp://:0", - "", - }, - { - "ShouldParseAddressMissingScheme", - "0.0.0.0:9091", - &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, - "0.0.0.0:9091", - "tcp://0.0.0.0:9091", - "", - }, - { - "ShouldParseUnixAddressMissingScheme", - "/var/run/example.sock", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}}, - "/var/run/example.sock", - "unix:///var/run/example.sock", - "", - }, - { - "ShouldParseAddressMissingPort", - "tcp://0.0.0.0", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}}, - "0.0.0.0:0", - "tcp://0.0.0.0:0", - "", - }, - { - "ShouldParseUnixSocket", - "unix:///path/to/a/socket.sock", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}}, - "/path/to/a/socket.sock", - "unix:///path/to/a/socket.sock", - "", - }, - { - "ShouldNotParseUnixSocketWithHost", - "unix://ahost/path/to/a/socket.sock", - nil, - "", - "", - "error validating the unix socket address: the url 'unix://ahost/path/to/a/socket.sock' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", - }, - { - "ShouldNotParseUnixSocketWithoutPath", - "unix://nopath.com", - nil, - "", - "", - "error validating the unix socket address: could not determine path from 'unix://nopath.com'", - }, - { - "ShouldNotParseUnixSocketWithQuery", - "unix:///path/to/a/socket.sock?q=yes", - nil, - "", - "", - "error validating the address: the url 'unix:///path/to/a/socket.sock?q=yes' appears to have a query but this is not valid for addresses", - }, - { - "ShouldNotParseUnixSocketWithFragment", - "unix:///path/to/a/socket.sock#example", - nil, - "", - "", - "error validating the address: the url 'unix:///path/to/a/socket.sock#example' appears to have a fragment but this is not valid for addresses", - }, - { - "ShouldNotParseUnixSocketWithUserInfo", - "unix://user:example@/path/to/a/socket.sock", - nil, - "", - "", - "error validating the address: the url 'unix://user:example@/path/to/a/socket.sock' appears to have user info but this is not valid for addresses", - }, - { - "ShouldParseUnknownScheme", - "a://0.0.0.0", - &Address{true, false, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}}, - "0.0.0.0", - "a://0.0.0.0", - "", - }, - { - "ShouldNotParseInvalidPort", - "tcp://0.0.0.0:abc", - nil, - "", - "", - "could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [://][:]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host", - }, - { - "ShouldNotParseInvalidAddress", - "@$@#%@#$@@", - nil, - "", - "", - "could not parse string '@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", - }, - { - "ShouldNotParseInvalidAddressWithScheme", - "tcp://@$@#%@#$@@", - nil, - "", - "", - "could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [://][:]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"", - }, - { - "ShouldSetDefaultPortLDAP", - "ldap://127.0.0.1", - &Address{true, false, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}}, - "127.0.0.1:389", - "ldap://127.0.0.1:389", - "", - }, - { - "ShouldSetDefaultPortLDAPS", - "ldaps://127.0.0.1", - &Address{true, false, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}}, - "127.0.0.1:636", - "ldaps://127.0.0.1:636", - "", - }, - { - "ShouldAllowLDAPI", - "ldapi:///abc", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}}, - "/abc", - "ldapi:///abc", - "", - }, - { - "ShouldAllowImplicitLDAPI", - "ldapi://", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, - "", - "ldapi:", - "", - }, - { - "ShouldAllowImplicitLDAPINoSlash", - "ldapi:", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, - "", - "ldapi:", - "", - }, - { - "ShouldSetDefaultPortSMTP", - "smtp://127.0.0.1", - &Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}}, - "127.0.0.1:25", - "smtp://127.0.0.1:25", - "", - }, - { - "ShouldSetDefaultPortSUBMISSION", - "submission://127.0.0.1", - &Address{true, false, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}}, - "127.0.0.1:587", - "submission://127.0.0.1:587", - "", - }, - { - "ShouldSetDefaultPortSUBMISSIONS", - "submissions://127.0.0.1", - &Address{true, false, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}}, - "127.0.0.1:465", - "submissions://127.0.0.1:465", - "", - }, - { - "ShouldNotOverridePort", - "ldap://127.0.0.1:123", - &Address{true, false, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}}, - "127.0.0.1:123", - "ldap://127.0.0.1:123", - "", - }, - } - - for _, tc := range testCases { - t.Run(tc.name, func(t *testing.T) { - actual, actualErr := NewAddress(tc.have) - - if len(tc.expectedErr) != 0 { - assert.EqualError(t, actualErr, tc.expectedErr) - } else { - assert.Nil(t, actualErr) - - assert.Equal(t, tc.expectedAddress, actual.NetworkAddress()) - assert.Equal(t, tc.expectedString, actual.String()) - - assert.True(t, actual.Valid()) - } - - assert.Equal(t, tc.expected, actual) - }) - } -} - -func TestAddress_ValidateErrors(t *testing.T) { - testCases := []struct { - name string - have *Address - expectedLDAP, expectedSMTP, expectedHTTP, expectedListener string - }{ - { - "ShouldValidateLDAPAddress", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}}, - "", - "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'", - "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'", - "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'ldap'", - }, - { - "ShouldValidateSMTPAddress", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}}, - "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'", - "", - "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'", - "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'smtp'", - }, - { - "ShouldValidateTCPAddress", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}}, - "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'tcp'", - "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'tcp'", - "", - "", - }, - } - - for _, tc := range testCases { - t.Run(tc.name, func(t *testing.T) { - if tc.expectedLDAP == "" { - assert.NoError(t, tc.have.ValidateLDAP()) - } else { - assert.EqualError(t, tc.have.ValidateLDAP(), tc.expectedLDAP) - } - - if tc.expectedSMTP == "" { - assert.NoError(t, tc.have.ValidateSMTP()) - } else { - assert.EqualError(t, tc.have.ValidateSMTP(), tc.expectedSMTP) - } - - if tc.expectedListener == "" { - assert.NoError(t, tc.have.ValidateListener()) - } else { - assert.EqualError(t, tc.have.ValidateListener(), tc.expectedListener) - } - - if tc.expectedHTTP == "" { - assert.NoError(t, tc.have.ValidateHTTP()) - } else { - assert.EqualError(t, tc.have.ValidateHTTP(), tc.expectedHTTP) - } - }) - } -} - -func TestAddress_SetHostname(t *testing.T) { - address := &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}} - - assert.Equal(t, "tcp://0.0.0.0", address.String()) - - address.SetHostname("127.0.0.1") - - assert.Equal(t, "tcp://127.0.0.1", address.String()) -} - -func TestAddress_ListenerWithUMask(t *testing.T) { - dir := t.TempDir() - - address := &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: filepath.Join(dir, "example.sock")}} - - ln, err := address.ListenerWithUMask(600) - - assert.NotNil(t, ln) - assert.NoError(t, err) - assert.NoError(t, ln.Close()) - - address = &Address{true, true, 0, nil} - - ln, err = address.ListenerWithUMask(600) - - assert.Nil(t, ln) - assert.EqualError(t, err, "address url is nil") - - address = &Address{true, false, 0, nil} - - ln, err = address.ListenerWithUMask(600) - - assert.Nil(t, ln) - assert.EqualError(t, err, "address url is nil") -} - -func TestAddressOutputValues(t *testing.T) { - var ( - address *Address - listener net.Listener - err error - ) - - address = &Address{} - assert.EqualError(t, address.validate(), "error validating the address: address url was nil") - - address = &Address{false, false, 0, nil} - - assert.Equal(t, "", address.String()) - assert.Equal(t, "", address.Scheme()) - assert.Equal(t, "", address.Host()) - assert.Equal(t, "", address.Hostname()) - assert.Equal(t, "", address.NetworkAddress()) - assert.Equal(t, 0, address.Port()) - - listener, err = address.Listener() - - assert.Nil(t, listener) - assert.EqualError(t, err, "address url is nil") - - address = &Address{true, false, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}} - - assert.Equal(t, "tcp://0.0.0.0:8080", address.String()) - assert.Equal(t, "tcp", address.Scheme()) - assert.Equal(t, "0.0.0.0:8080", address.Host()) - assert.Equal(t, "0.0.0.0", address.Hostname()) - assert.Equal(t, "0.0.0.0:8080", address.NetworkAddress()) - assert.Equal(t, 8080, address.Port()) - - listener, err = address.Listener() - - assert.NotNil(t, listener) - assert.NoError(t, err) - - address = &Address{true, false, 0, nil} - - assert.Equal(t, "", address.String()) - assert.Equal(t, "", address.Scheme()) - assert.Equal(t, "", address.Host()) - assert.Equal(t, "", address.Hostname()) - assert.Equal(t, "", address.NetworkAddress()) - assert.Equal(t, 0, address.Port()) - - listener, err = address.Listener() - - assert.Nil(t, listener) - assert.EqualError(t, err, "address url is nil") - - address.SetHostname("abc123.com") - address.SetPort(50) - - assert.Equal(t, "", address.String()) - assert.Equal(t, "", address.Scheme()) - assert.Equal(t, "", address.Host()) - assert.Equal(t, "", address.Hostname()) - assert.Equal(t, "", address.NetworkAddress()) - assert.Equal(t, 0, address.Port()) - - listener, err = address.Listener() - - assert.Nil(t, listener) - assert.EqualError(t, err, "address url is nil") - - address = &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}} - - assert.Equal(t, "tcp://0.0.0.0:9091", address.String()) - assert.Equal(t, "tcp", address.Scheme()) - assert.Equal(t, "0.0.0.0:9091", address.Host()) - assert.Equal(t, "0.0.0.0", address.Hostname()) - assert.Equal(t, "0.0.0.0:9091", address.NetworkAddress()) - assert.Equal(t, 9091, address.Port()) - - listener, err = address.Listener() - - assert.NotNil(t, listener) - assert.NoError(t, err) - - assert.NoError(t, listener.Close()) - - address.SetPort(9092) - - assert.Equal(t, "tcp://0.0.0.0:9092", address.String()) - assert.Equal(t, "tcp", address.Scheme()) - assert.Equal(t, "0.0.0.0:9092", address.Host()) - assert.Equal(t, "0.0.0.0", address.Hostname()) - assert.Equal(t, "0.0.0.0:9092", address.NetworkAddress()) - assert.Equal(t, 9092, address.Port()) - - listener, err = address.Listener() - - assert.NotNil(t, listener) - assert.NoError(t, err) - - assert.NoError(t, listener.Close()) - - address.SetHostname("example.com") - - assert.Equal(t, "tcp://example.com:9092", address.String()) - assert.Equal(t, "tcp", address.Scheme()) - assert.Equal(t, "example.com:9092", address.Host()) - assert.Equal(t, "example.com", address.Hostname()) - assert.Equal(t, "example.com:9092", address.NetworkAddress()) - assert.Equal(t, 9092, address.Port()) -} - func TestNewTLSVersion(t *testing.T) { testCases := []struct { name string diff --git a/internal/configuration/test_resources/config.deprecated.alt.yml b/internal/configuration/test_resources/config.deprecated.alt.yml new file mode 100644 index 000000000..9ea5f9cd6 --- /dev/null +++ b/internal/configuration/test_resources/config.deprecated.alt.yml @@ -0,0 +1,173 @@ +--- +default_redirection_url: https://home.example.com:8080/ + +server: + address: "tcp://127.0.0.1:9091" + endpoints: + authz: + forward-auth: + implementation: ForwardAuth + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + ext-authz: + implementation: ExtAuthz + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + auth-request: + implementation: AuthRequest + authn_strategies: + - name: HeaderAuthRequestProxyAuthorization + - name: CookieSession + legacy: + implementation: Legacy + +log: + level: debug + +totp: + issuer: authelia.com + +duo_api: + hostname: api-123456789.example.com + integration_key: ABCDEF + +authentication_backend: + ldap: + url: 'ldap://127.0.0.1' + tls: + private_key: | + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758 + cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn + ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5 + Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa + rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp + EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU + L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+ + Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm + 9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7 + 8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV + I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7 + CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE + hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi + jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q + E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b + CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn + jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio + Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ + Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX + bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1 + otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj + HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd + tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM + USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 + 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== + -----END RSA PRIVATE KEY----- + base_dn: dc=example,dc=com + username_attribute: uid + additional_users_dn: ou=users + users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + additional_groups_dn: ou=groups + groups_filter: (&(member={dn})(objectClass=groupOfNames)) + group_name_attribute: cn + mail_attribute: mail + user: cn=admin,dc=example,dc=com + +access_control: + default_policy: deny + + rules: + # Rules applied to everyone + - domain: public.example.com + policy: bypass + + - domain: secure.example.com + policy: one_factor + # Network based rule, if not provided any network matches. + networks: + - 192.168.1.0/24 + - domain: secure.example.com + policy: two_factor + + - domain: [singlefactor.example.com, onefactor.example.com] + policy: one_factor + + # Rules applied to 'admins' group + - domain: "mx2.mail.example.com" + subject: "group:admins" + policy: deny + - domain: "*.example.com" + subject: "group:admins" + policy: two_factor + + # Rules applied to 'dev' group + - domain: dev.example.com + resources: + - "^/groups/dev/.*$" + subject: "group:dev" + policy: two_factor + + # Rules applied to user 'john' + - domain: dev.example.com + resources: + - "^/users/john/.*$" + subject: "user:john" + policy: two_factor + + # Rules applied to 'dev' group and user 'john' + - domain: dev.example.com + resources: + - "^/deny-all.*$" + subject: ["group:dev", "user:john"] + policy: deny + + # Rules applied to user 'harry' + - domain: dev.example.com + resources: + - "^/users/harry/.*$" + subject: "user:harry" + policy: two_factor + + # Rules applied to user 'bob' + - domain: "*.mail.example.com" + subject: "user:bob" + policy: two_factor + - domain: "dev.example.com" + resources: + - "^/users/bob/.*$" + subject: "user:bob" + policy: two_factor + +session: + name: authelia_session + expiration: 3600000 # 1 hour + inactivity: 300000 # 5 minutes + domain: example.com + redis: + host: 127.0.0.1 + port: 6379 + high_availability: + sentinel_name: test + +regulation: + max_retries: 3 + find_time: 120 + ban_time: 300 + +storage: + postgres: + host: 127.0.0.1 + port: 5432 + database: authelia + username: authelia + +notifier: + smtp: + username: test + host: 127.0.0.1 + port: 1025 + sender: admin@example.com + disable_require_tls: true +... diff --git a/internal/configuration/test_resources/config.deprecated.yml b/internal/configuration/test_resources/config.deprecated.yml new file mode 100644 index 000000000..24a577b4f --- /dev/null +++ b/internal/configuration/test_resources/config.deprecated.yml @@ -0,0 +1,173 @@ +--- +default_redirection_url: https://home.example.com:8080/ + +server: + address: "tcp://127.0.0.1:9091" + endpoints: + authz: + forward-auth: + implementation: ForwardAuth + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + ext-authz: + implementation: ExtAuthz + authn_strategies: + - name: HeaderProxyAuthorization + - name: CookieSession + auth-request: + implementation: AuthRequest + authn_strategies: + - name: HeaderAuthRequestProxyAuthorization + - name: CookieSession + legacy: + implementation: Legacy + +log: + level: debug + +totp: + issuer: authelia.com + +duo_api: + hostname: api-123456789.example.com + integration_key: ABCDEF + +authentication_backend: + ldap: + url: 'ldap://127.0.0.1' + tls: + private_key: | + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758 + cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn + ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5 + Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa + rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp + EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU + L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+ + Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm + 9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7 + 8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV + I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7 + CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE + hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi + jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q + E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b + CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn + jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio + Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ + Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX + bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1 + otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj + HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd + tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM + USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 + 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== + -----END RSA PRIVATE KEY----- + base_dn: dc=example,dc=com + username_attribute: uid + additional_users_dn: ou=users + users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + additional_groups_dn: ou=groups + groups_filter: (&(member={dn})(objectClass=groupOfNames)) + group_name_attribute: cn + mail_attribute: mail + user: cn=admin,dc=example,dc=com + +access_control: + default_policy: deny + + rules: + # Rules applied to everyone + - domain: public.example.com + policy: bypass + + - domain: secure.example.com + policy: one_factor + # Network based rule, if not provided any network matches. + networks: + - 192.168.1.0/24 + - domain: secure.example.com + policy: two_factor + + - domain: [singlefactor.example.com, onefactor.example.com] + policy: one_factor + + # Rules applied to 'admins' group + - domain: "mx2.mail.example.com" + subject: "group:admins" + policy: deny + - domain: "*.example.com" + subject: "group:admins" + policy: two_factor + + # Rules applied to 'dev' group + - domain: dev.example.com + resources: + - "^/groups/dev/.*$" + subject: "group:dev" + policy: two_factor + + # Rules applied to user 'john' + - domain: dev.example.com + resources: + - "^/users/john/.*$" + subject: "user:john" + policy: two_factor + + # Rules applied to 'dev' group and user 'john' + - domain: dev.example.com + resources: + - "^/deny-all.*$" + subject: ["group:dev", "user:john"] + policy: deny + + # Rules applied to user 'harry' + - domain: dev.example.com + resources: + - "^/users/harry/.*$" + subject: "user:harry" + policy: two_factor + + # Rules applied to user 'bob' + - domain: "*.mail.example.com" + subject: "user:bob" + policy: two_factor + - domain: "dev.example.com" + resources: + - "^/users/bob/.*$" + subject: "user:bob" + policy: two_factor + +session: + name: authelia_session + expiration: 3600000 # 1 hour + inactivity: 300000 # 5 minutes + domain: example.com + redis: + host: 127.0.0.1 + port: 6379 + high_availability: + sentinel_name: test + +regulation: + max_retries: 3 + find_time: 120 + ban_time: 300 + +storage: + mysql: + host: 127.0.0.1 + port: 3306 + database: authelia + username: authelia + +notifier: + smtp: + username: test + host: 127.0.0.1 + port: 1025 + sender: admin@example.com + disable_require_tls: true +... diff --git a/internal/configuration/test_resources/config.filtered.yml b/internal/configuration/test_resources/config.filtered.yml index 8917d3253..aa7f5ca27 100644 --- a/internal/configuration/test_resources/config.filtered.yml +++ b/internal/configuration/test_resources/config.filtered.yml @@ -16,7 +16,7 @@ duo_api: authentication_backend: ldap: - url: 'ldap://{{ env "SERVICES_SERVER" }}' + address: 'ldap://{{ env "SERVICES_SERVER" }}' tls: private_key: | -----BEGIN RSA PRIVATE KEY----- @@ -161,16 +161,14 @@ regulation: storage: mysql: - host: '{{ env "SERVICES_SERVER" }}' - port: 3306 + address: 'tcp://{{ env "SERVICES_SERVER" }}:3306' database: authelia username: authelia notifier: smtp: username: test - host: '{{ env "SERVICES_SERVER" }}' - port: 1025 + address: 'smtp://{{ env "SERVICES_SERVER" }}:1025' sender: 'admin@{{ env "ROOT_DOMAIN" }}' disable_require_tls: true diff --git a/internal/configuration/test_resources/config.yml b/internal/configuration/test_resources/config.yml index 9705b64f6..816e422ce 100644 --- a/internal/configuration/test_resources/config.yml +++ b/internal/configuration/test_resources/config.yml @@ -1,41 +1,41 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' endpoints: authz: forward-auth: - implementation: ForwardAuth + implementation: 'ForwardAuth' authn_strategies: - - name: HeaderProxyAuthorization - - name: CookieSession + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' ext-authz: - implementation: ExtAuthz + implementation: 'ExtAuthz' authn_strategies: - - name: HeaderProxyAuthorization - - name: CookieSession + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' auth-request: - implementation: AuthRequest + implementation: 'AuthRequest' authn_strategies: - - name: HeaderAuthRequestProxyAuthorization - - name: CookieSession + - name: 'HeaderAuthRequestProxyAuthorization' + - name: 'CookieSession' legacy: - implementation: Legacy + implementation: 'Legacy' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 + address: 'ldap://127.0.0.1' tls: private_key: | -----BEGIN RSA PRIVATE KEY----- @@ -65,109 +65,107 @@ authentication_backend: USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== -----END RSA PRIVATE KEY----- - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_alt.yml b/internal/configuration/test_resources/config_alt.yml index 6697bd4b7..ec9177f72 100644 --- a/internal/configuration/test_resources/config_alt.yml +++ b/internal/configuration/test_resources/config_alt.yml @@ -1,124 +1,122 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes remember_me: -1 - domain: example.com + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: postgres: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:5432' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: Admin + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'Admin ' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_bad_keys.yml b/internal/configuration/test_resources/config_bad_keys.yml index 8d27b1f67..fc898ac75 100644 --- a/internal/configuration/test_resources/config_bad_keys.yml +++ b/internal/configuration/test_resources/config_bad_keys.yml @@ -1,124 +1,122 @@ --- -loggy_file: /config/svc.log +loggy_file: '/config/svc.log' -logs_level: debug +logs_level: 'debug' -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_bad_quoting.yml b/internal/configuration/test_resources/config_bad_quoting.yml index 59db7a7d6..3bf7c4be0 100644 --- a/internal/configuration/test_resources/config_bad_quoting.yml +++ b/internal/configuration/test_resources/config_bad_quoting.yml @@ -1,56 +1,54 @@ --- -jwt_secret: RUtG9TnbXrOl1XLLmDgySw1DGgx9QcrtepIf1uDDBlBVKFZxkVBruYKBi32PvaU +jwt_secret: 'RUtG9TnbXrOl1XLLmDgySw1DGgx9QcrtepIf1uDDBlBVKFZxkVBruYKBi32PvaU' -default_redirection_url: example.com +default_redirection_url: 'example.com' server: - address: "tcp://0.0.0.0:9091" + address: 'tcp://:9091' log: - level: debug + level: 'debug' totp: - issuer: example.com + issuer: 'example.com' period: 30 skew: 1 authentication_backend: file: - path: /config/users_database.yml + path: '/config/users_database.yml' access_control: - default_policy: deny + default_policy: 'deny' rules: - - domain: example.com - policy: bypass - - domain: *.example.com - policy: one_factor + - domain: 'example.com' + policy: 'bypass' + - domain: '*.example.com' + policy: 'one_factor' session: - name: authelia_session - secret: TVPMIcDFbBwhnW3kLJzKhdjeHhtqisr7m28FgRY8oLh2A4lwuV2jV2ZGdGbh4aa - expiration: 3600 - inactivity: 300 - domain: example.com + name: 'authelia_session' + secret: 'TVPMIcDFbBwhnW3kLJzKhdjeHhtqisr7m28FgRY8oLh2A4lwuV2jV2ZGdGbh4aa' + expiration: '1h' + inactivity: '5m' + domain: 'example.com' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: example.com - port: 3306 - database: authelia - username: authelia - password: example.com + address: 'tcp://example.com:3306' + database: 'authelia' + username: 'authelia' + password: 'example.com' notifier: smtp: - username: example.com - password: example.com - host: smtp.gmail.com - port: 465 - sender: example.com + address: 'submissions://smtp.gmail.com:465' + username: 'example.com' + password: 'example.com' + sender: 'example.com' ... diff --git a/internal/configuration/test_resources/config_domain_bad_regex.yml b/internal/configuration/test_resources/config_domain_bad_regex.yml index 4e7be7ad4..7c8250dae 100644 --- a/internal/configuration/test_resources/config_domain_bad_regex.yml +++ b/internal/configuration/test_resources/config_domain_bad_regex.yml @@ -1,125 +1,123 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain_regex: ^\K(public|public2).example.com$ - policy: bypass + - domain_regex: '^\K(public|public2).example.com$' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_domain_regex.yml b/internal/configuration/test_resources/config_domain_regex.yml index 360e1787c..78a486d21 100644 --- a/internal/configuration/test_resources/config_domain_regex.yml +++ b/internal/configuration/test_resources/config_domain_regex.yml @@ -1,131 +1,129 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain_regex: ^(public|public2).example.com$ - policy: bypass + - domain_regex: '^(public|public2).example.com$' + policy: 'bypass' - - domain_regex: ^portfolio-(?P[a-zA-Z0-9]+).example.com$ - policy: one_factor + - domain_regex: '^portfolio-(?P[a-zA-Z0-9]+).example.com$' + policy: 'one_factor' - - domain_regex: ^portfolio-(?P[a-zA-Z0-9]+)-(?P[a-zA-Z0-9]+).example.com$ - policy: one_factor + - domain_regex: '^portfolio-(?P[a-zA-Z0-9]+)-(?P[a-zA-Z0-9]+).example.com$' + policy: 'one_factor' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_oidc.yml b/internal/configuration/test_resources/config_oidc.yml index da72366a0..076d5ae82 100644 --- a/internal/configuration/test_resources/config_oidc.yml +++ b/internal/configuration/test_resources/config_oidc.yml @@ -1,136 +1,134 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true identity_providers: oidc: cors: allowed_origins: - - https://google.com - - https://example.com + - 'https://google.com' + - 'https://example.com' clients: - - id: abc + - id: 'abc' secret: '123' - consent_mode: explicit + consent_mode: 'explicit' ... diff --git a/internal/configuration/test_resources/config_smtp_sender_blank.yml b/internal/configuration/test_resources/config_smtp_sender_blank.yml index 3af9013c0..0fe8205a5 100644 --- a/internal/configuration/test_resources/config_smtp_sender_blank.yml +++ b/internal/configuration/test_resources/config_smtp_sender_blank.yml @@ -1,125 +1,123 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: "" + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: '' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_smtp_sender_invalid.yml b/internal/configuration/test_resources/config_smtp_sender_invalid.yml index 9d0dc5b25..8d2b55a35 100644 --- a/internal/configuration/test_resources/config_smtp_sender_invalid.yml +++ b/internal/configuration/test_resources/config_smtp_sender_invalid.yml @@ -1,125 +1,123 @@ --- -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 high_availability: - sentinel_name: test + sentinel_name: 'test' regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin' disable_require_tls: true ... diff --git a/internal/configuration/test_resources/config_with_secret.yml b/internal/configuration/test_resources/config_with_secret.yml index 6efca13c9..aa2b3acc9 100644 --- a/internal/configuration/test_resources/config_with_secret.yml +++ b/internal/configuration/test_resources/config_with_secret.yml @@ -1,125 +1,123 @@ --- -jwt_secret: secret_from_config +jwt_secret: 'secret_from_config' -default_redirection_url: https://home.example.com:8080/ +default_redirection_url: 'https://home.example.com:8080/' server: - address: "tcp://127.0.0.1:9091" + address: 'tcp://127.0.0.1:9091' log: - level: debug + level: 'debug' totp: - issuer: authelia.com + issuer: 'authelia.com' duo_api: - hostname: api-123456789.example.com - integration_key: ABCDEF + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' authentication_backend: ldap: - url: ldap://127.0.0.1 - base_dn: dc=example,dc=com - username_attribute: uid - additional_users_dn: ou=users - users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - additional_groups_dn: ou=groups - groups_filter: (&(member={dn})(objectClass=groupOfNames)) - group_name_attribute: cn - mail_attribute: mail - user: cn=admin,dc=example,dc=com + address: 'ldap://127.0.0.1' + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' access_control: - default_policy: deny + default_policy: 'deny' rules: # Rules applied to everyone - - domain: public.example.com - policy: bypass + - domain: 'public.example.com' + policy: 'bypass' - - domain: secure.example.com - policy: one_factor + - domain: 'secure.example.com' + policy: 'one_factor' # Network based rule, if not provided any network matches. networks: - - 192.168.1.0/24 - - domain: secure.example.com - policy: two_factor + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' - - domain: [singlefactor.example.com, onefactor.example.com] - policy: one_factor + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' # Rules applied to 'admins' group - - domain: "mx2.mail.example.com" - subject: "group:admins" - policy: deny - - domain: "*.example.com" - subject: "group:admins" - policy: two_factor + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' # Rules applied to 'dev' group - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/groups/dev/.*$" - subject: "group:dev" - policy: two_factor + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' # Rules applied to user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/john/.*$" - subject: "user:john" - policy: two_factor + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' # Rules applied to 'dev' group and user 'john' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/deny-all.*$" - subject: ["group:dev", "user:john"] - policy: deny + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' # Rules applied to user 'harry' - - domain: dev.example.com + - domain: 'dev.example.com' resources: - - "^/users/harry/.*$" - subject: "user:harry" - policy: two_factor + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' # Rules applied to user 'bob' - - domain: "*.mail.example.com" - subject: "user:bob" - policy: two_factor - - domain: "dev.example.com" + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' resources: - - "^/users/bob/.*$" - subject: "user:bob" - policy: two_factor + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' session: - name: authelia_session - expiration: 3600000 # 1 hour - inactivity: 300000 # 5 minutes - domain: example.com + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' redis: - host: 127.0.0.1 + host: '127.0.0.1' port: 6379 regulation: max_retries: 3 - find_time: 120 - ban_time: 300 + find_time: '2m' + ban_time: '5m' storage: mysql: - host: 127.0.0.1 - port: 3306 - database: authelia - username: authelia + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' notifier: smtp: - username: test - host: 127.0.0.1 - port: 1025 - sender: admin@example.com + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' disable_require_tls: true ... diff --git a/internal/configuration/validator/authentication.go b/internal/configuration/validator/authentication.go index fb209f179..cf90832bc 100644 --- a/internal/configuration/validator/authentication.go +++ b/internal/configuration/validator/authentication.go @@ -2,7 +2,6 @@ package validator import ( "fmt" - "net/url" "strings" "github.com/go-crypt/crypt/algorithm/argon2" @@ -323,11 +322,7 @@ func validateLDAPAuthenticationBackend(config *schema.AuthenticationBackend, val defaultTLS := validateLDAPAuthenticationBackendImplementation(config, validator) - if config.LDAP.URL == "" { - validator.Push(fmt.Errorf(errFmtLDAPAuthBackendMissingOption, "url")) - } else { - defaultTLS.ServerName = validateLDAPAuthenticationBackendURL(config.LDAP, validator) - } + defaultTLS.ServerName = validateLDAPAuthenticationAddress(config.LDAP, validator) if config.LDAP.TLS == nil { config.LDAP.TLS = &schema.TLSConfig{} @@ -428,27 +423,22 @@ func setDefaultImplementationLDAPAuthenticationBackendProfileAttributes(config * } } -func validateLDAPAuthenticationBackendURL(config *schema.LDAPAuthenticationBackend, validator *schema.StructValidator) (hostname string) { +func validateLDAPAuthenticationAddress(config *schema.LDAPAuthenticationBackend, validator *schema.StructValidator) (hostname string) { + if config.Address == nil { + validator.Push(fmt.Errorf(errFmtLDAPAuthBackendMissingOption, "address")) + + return + } + var ( - parsedURL *url.URL - err error + err error ) - if parsedURL, err = url.Parse(config.URL); err != nil { - validator.Push(fmt.Errorf(errFmtLDAPAuthBackendURLNotParsable, err)) - - return + if err = config.Address.ValidateLDAP(); err != nil { + validator.Push(fmt.Errorf(errFmtLDAPAuthBackendAddress, config.Address.String(), err)) } - if parsedURL.Scheme != schemeLDAP && parsedURL.Scheme != schemeLDAPS { - validator.Push(fmt.Errorf(errFmtLDAPAuthBackendURLInvalidScheme, parsedURL.Scheme)) - - return - } - - config.URL = parsedURL.String() - - return parsedURL.Hostname() + return config.Address.Hostname() } func validateLDAPRequiredParameters(config *schema.AuthenticationBackend, validator *schema.StructValidator) { diff --git a/internal/configuration/validator/authentication_test.go b/internal/configuration/validator/authentication_test.go index 9abec6e1a..fa5c4830d 100644 --- a/internal/configuration/validator/authentication_test.go +++ b/internal/configuration/validator/authentication_test.go @@ -26,7 +26,7 @@ func TestShouldRaiseErrorWhenBothBackendsProvided(t *testing.T) { require.Len(t, validator.Errors(), 7) assert.EqualError(t, validator.Errors()[0], "authentication_backend: please ensure only one of the 'file' or 'ldap' backend is configured") - assert.EqualError(t, validator.Errors()[1], "authentication_backend: ldap: option 'url' is required") + assert.EqualError(t, validator.Errors()[1], "authentication_backend: ldap: option 'address' is required") assert.EqualError(t, validator.Errors()[2], "authentication_backend: ldap: option 'user' is required") assert.EqualError(t, validator.Errors()[3], "authentication_backend: ldap: option 'password' is required") assert.EqualError(t, validator.Errors()[4], "authentication_backend: ldap: option 'base_dn' is required") @@ -61,8 +61,8 @@ func (suite *FileBasedAuthenticationBackend) SetupTest() { func (suite *FileBasedAuthenticationBackend) TestShouldValidateCompleteConfiguration() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenNoPathProvided() { @@ -70,38 +70,38 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenNoPathProvi ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: option 'path' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: option 'path' is required") } func (suite *FileBasedAuthenticationBackend) TestShouldSetDefaultConfigurationWhenBlank() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal(0, suite.config.File.Password.KeyLength) - suite.Assert().Equal(0, suite.config.File.Password.Iterations) - suite.Assert().Equal(0, suite.config.File.Password.SaltLength) - suite.Assert().Equal("", suite.config.File.Password.Algorithm) - suite.Assert().Equal(0, suite.config.File.Password.Memory) - suite.Assert().Equal(0, suite.config.File.Password.Parallelism) + suite.Equal(0, suite.config.File.Password.KeyLength) + suite.Equal(0, suite.config.File.Password.Iterations) + suite.Equal(0, suite.config.File.Password.SaltLength) + suite.Equal("", suite.config.File.Password.Algorithm) + suite.Equal(0, suite.config.File.Password.Memory) + suite.Equal(0, suite.config.File.Password.Parallelism) ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.DefaultPasswordConfig.KeyLength, suite.config.File.Password.KeyLength) - suite.Assert().Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) - suite.Assert().Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) - suite.Assert().Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) - suite.Assert().Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) - suite.Assert().Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) + suite.Equal(schema.DefaultPasswordConfig.KeyLength, suite.config.File.Password.KeyLength) + suite.Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) + suite.Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) + suite.Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) + suite.Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) + suite.Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationSHA512() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: digestSHA512, @@ -111,18 +111,18 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(8, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(8, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationSHA512ButNotOverride() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: digestSHA512, @@ -137,18 +137,18 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA256, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(50000, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(12, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA256, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(50000, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(12, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationSHA512Alt() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: digestSHA512, @@ -158,18 +158,18 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(16, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(1000000, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(16, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationArgon2() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: "argon2id", @@ -182,21 +182,21 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("argon2", suite.config.File.Password.Algorithm) - suite.Assert().Equal("argon2id", suite.config.File.Password.Argon2.Variant) - suite.Assert().Equal(4, suite.config.File.Password.Argon2.Iterations) - suite.Assert().Equal(1048576, suite.config.File.Password.Argon2.Memory) - suite.Assert().Equal(4, suite.config.File.Password.Argon2.Parallelism) - suite.Assert().Equal(64, suite.config.File.Password.Argon2.KeyLength) - suite.Assert().Equal(64, suite.config.File.Password.Argon2.SaltLength) + suite.Equal("argon2", suite.config.File.Password.Algorithm) + suite.Equal("argon2id", suite.config.File.Password.Argon2.Variant) + suite.Equal(4, suite.config.File.Password.Argon2.Iterations) + suite.Equal(1048576, suite.config.File.Password.Argon2.Memory) + suite.Equal(4, suite.config.File.Password.Argon2.Parallelism) + suite.Equal(64, suite.config.File.Password.Argon2.KeyLength) + suite.Equal(64, suite.config.File.Password.Argon2.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationArgon2ButNotOverride() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password = schema.Password{ Algorithm: "argon2id", @@ -217,102 +217,102 @@ func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfiguratio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("argon2", suite.config.File.Password.Algorithm) - suite.Assert().Equal("argon2d", suite.config.File.Password.Argon2.Variant) - suite.Assert().Equal(1, suite.config.File.Password.Argon2.Iterations) - suite.Assert().Equal(2048, suite.config.File.Password.Argon2.Memory) - suite.Assert().Equal(1, suite.config.File.Password.Argon2.Parallelism) - suite.Assert().Equal(32, suite.config.File.Password.Argon2.KeyLength) - suite.Assert().Equal(32, suite.config.File.Password.Argon2.SaltLength) + suite.Equal("argon2", suite.config.File.Password.Algorithm) + suite.Equal("argon2d", suite.config.File.Password.Argon2.Variant) + suite.Equal(1, suite.config.File.Password.Argon2.Iterations) + suite.Equal(2048, suite.config.File.Password.Argon2.Memory) + suite.Equal(1, suite.config.File.Password.Argon2.Parallelism) + suite.Equal(32, suite.config.File.Password.Argon2.KeyLength) + suite.Equal(32, suite.config.File.Password.Argon2.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldMigrateLegacyConfigurationWhenOnlySHA512Set() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = digestSHA512 ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) - suite.Assert().Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) - suite.Assert().Equal(schema.DefaultPasswordConfig.SHA2Crypt.Iterations, suite.config.File.Password.SHA2Crypt.Iterations) - suite.Assert().Equal(schema.DefaultPasswordConfig.SHA2Crypt.SaltLength, suite.config.File.Password.SHA2Crypt.SaltLength) + suite.Equal(hashSHA2Crypt, suite.config.File.Password.Algorithm) + suite.Equal(digestSHA512, suite.config.File.Password.SHA2Crypt.Variant) + suite.Equal(schema.DefaultPasswordConfig.SHA2Crypt.Iterations, suite.config.File.Password.SHA2Crypt.Iterations) + suite.Equal(schema.DefaultPasswordConfig.SHA2Crypt.SaltLength, suite.config.File.Password.SHA2Crypt.SaltLength) } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidArgon2Variant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = "argon2" suite.config.File.Password.Argon2.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'variant' must be one of 'argon2id', 'id', 'argon2i', 'i', 'argon2d', or 'd' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'variant' must be one of 'argon2id', 'id', 'argon2i', 'i', 'argon2d', or 'd' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidSHA2CryptVariant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = hashSHA2Crypt suite.config.File.Password.SHA2Crypt.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'variant' must be one of 'sha256' or 'sha512' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'variant' must be one of 'sha256' or 'sha512' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidSHA2CryptSaltLength() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = hashSHA2Crypt suite.config.File.Password.SHA2Crypt.SaltLength = 40 ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '40' but must be less than or equal to '16'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '40' but must be less than or equal to '16'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidPBKDF2Variant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = "pbkdf2" suite.config.File.Password.PBKDF2.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'variant' must be one of 'sha1', 'sha224', 'sha256', 'sha384', or 'sha512' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'variant' must be one of 'sha1', 'sha224', 'sha256', 'sha384', or 'sha512' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorOnInvalidBCryptVariant() { suite.config.File.Password = schema.Password{} - suite.Assert().Equal("", suite.config.File.Password.Algorithm) + suite.Equal("", suite.config.File.Password.Algorithm) suite.config.File.Password.Algorithm = "bcrypt" suite.config.File.Password.BCrypt.Variant = testInvalid ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'variant' must be one of 'standard' or 'sha256' but it's configured as 'invalid'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'variant' must be one of 'standard' or 'sha256' but it's configured as 'invalid'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOptionsTooLow() { @@ -321,11 +321,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOp ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1000'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1000'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOptionsTooHigh() { @@ -334,11 +334,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSHA2CryptOp ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '999999999999' but must be less than or equal to '999999999'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '99' but must be less than or equal to '16'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: sha2crypt: option 'iterations' is configured as '999999999999' but must be less than or equal to '999999999'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: sha2crypt: option 'salt_length' is configured as '99' but must be less than or equal to '16'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2OptionsTooLow() { @@ -347,11 +347,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '-1' but must be greater than or equal to '100000'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '-1' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '-1' but must be greater than or equal to '100000'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '-1' but must be greater than or equal to '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2OptionsTooHigh() { @@ -360,11 +360,11 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenPBKDF2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 2) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '2147483649' but must be less than or equal to '2147483647'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '2147483650' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: pbkdf2: option 'iterations' is configured as '2147483649' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: pbkdf2: option 'salt_length' is configured as '2147483650' but must be less than or equal to '2147483647'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptionsTooLow() { @@ -372,10 +372,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '-1' but must be greater than or equal to '10'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '-1' but must be greater than or equal to '10'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptionsTooHigh() { @@ -383,10 +383,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '900' but must be less than or equal to '31'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: bcrypt: option 'cost' is configured as '900' but must be less than or equal to '31'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptionsTooLow() { @@ -398,14 +398,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '-21' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '-11' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '-77' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '7' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '-21' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '-11' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '-77' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '7' but must be greater than or equal to '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptionsTooHigh() { @@ -417,14 +417,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenSCryptOptio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '59' but must be less than or equal to '58'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '360287970189639672' but must be less than or equal to '36028797018963967'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '1073741825' but must be less than or equal to '1073741823'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '1374389534409' but must be less than or equal to '137438953440'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '2147483647' but must be less than or equal to '1024'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: scrypt: option 'iterations' is configured as '59' but must be less than or equal to '58'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: scrypt: option 'block_size' is configured as '360287970189639672' but must be less than or equal to '36028797018963967'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: scrypt: option 'parallelism' is configured as '1073741825' but must be less than or equal to '1073741823'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: scrypt: option 'key_length' is configured as '1374389534409' but must be less than or equal to '137438953440'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: scrypt: option 'salt_length' is configured as '2147483647' but must be less than or equal to '1024'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2OptionsTooLow() { @@ -436,14 +436,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '-1' but must be greater than or equal to '1'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '-1' but must be greater than or equal to '8'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '1' but must be greater than or equal to '4'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '-1' but must be greater than or equal to '1'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '-1' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '1' but must be greater than or equal to '4'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '-1' but must be greater than or equal to '1'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2OptionsTooHigh() { @@ -455,14 +455,14 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Optio ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 5) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '9999999999' but must be less than or equal to '2147483647'") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '16777216' but must be less than or equal to '16777215'") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '4294967296' but must be less than or equal to '4294967295'") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '9999999998' but must be less than or equal to '2147483647'") - suite.Assert().EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '9999999997' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'iterations' is configured as '9999999999' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: file: password: argon2: option 'parallelism' is configured as '16777216' but must be less than or equal to '16777215'") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: file: password: argon2: option 'memory' is configured as '4294967296' but must be less than or equal to '4294967295'") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: file: password: argon2: option 'key_length' is configured as '9999999998' but must be less than or equal to '2147483647'") + suite.EqualError(suite.validator.Errors()[4], "authentication_backend: file: password: argon2: option 'salt_length' is configured as '9999999997' but must be less than or equal to '2147483647'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2MemoryTooLow() { @@ -471,10 +471,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Memor ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '4' but must be greater than or equal to '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '4' but must be greater than or equal to '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2MemoryTooLowMultiplier() { @@ -483,10 +483,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenArgon2Memor ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '8' but must be greater than or equal to '32' or '4' (the value of 'parallelism) multiplied by '8'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: argon2: option 'memory' is configured as '8' but must be greater than or equal to '32' or '4' (the value of 'parallelism) multiplied by '8'") } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBadAlgorithmDefined() { @@ -494,10 +494,10 @@ func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenBadAlgorith ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: option 'algorithm' must be one of 'sha2crypt', 'pbkdf2', 'scrypt', 'bcrypt', or 'argon2' but it's configured as 'bogus'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: file: password: option 'algorithm' must be one of 'sha2crypt', 'pbkdf2', 'scrypt', 'bcrypt', or 'argon2' but it's configured as 'bogus'") } func (suite *FileBasedAuthenticationBackend) TestShouldSetDefaultValues() { @@ -509,30 +509,30 @@ func (suite *FileBasedAuthenticationBackend) TestShouldSetDefaultValues() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) - suite.Assert().Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) - suite.Assert().Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) - suite.Assert().Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) - suite.Assert().Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) + suite.Equal(schema.DefaultPasswordConfig.Algorithm, suite.config.File.Password.Algorithm) + suite.Equal(schema.DefaultPasswordConfig.Iterations, suite.config.File.Password.Iterations) + suite.Equal(schema.DefaultPasswordConfig.SaltLength, suite.config.File.Password.SaltLength) + suite.Equal(schema.DefaultPasswordConfig.Memory, suite.config.File.Password.Memory) + suite.Equal(schema.DefaultPasswordConfig.Parallelism, suite.config.File.Password.Parallelism) } func (suite *FileBasedAuthenticationBackend) TestShouldRaiseErrorWhenResetURLIsInvalid() { suite.config.PasswordReset.CustomURL = url.URL{Scheme: "ldap", Host: "google.com"} suite.config.PasswordReset.Disable = true - suite.Assert().True(suite.config.PasswordReset.Disable) + suite.True(suite.config.PasswordReset.Disable) ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: password_reset: option 'custom_url' is configured to 'ldap://google.com' which has the scheme 'ldap' but the scheme must be either 'http' or 'https'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: password_reset: option 'custom_url' is configured to 'ldap://google.com' which has the scheme 'ldap' but the scheme must be either 'http' or 'https'") - suite.Assert().True(suite.config.PasswordReset.Disable) + suite.True(suite.config.PasswordReset.Disable) } func (suite *FileBasedAuthenticationBackend) TestShouldNotRaiseErrorWhenResetURLIsValid() { @@ -540,22 +540,22 @@ func (suite *FileBasedAuthenticationBackend) TestShouldNotRaiseErrorWhenResetURL ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *FileBasedAuthenticationBackend) TestShouldConfigureDisableResetPasswordWhenCustomURL() { suite.config.PasswordReset.CustomURL = url.URL{Scheme: "https", Host: "google.com"} suite.config.PasswordReset.Disable = true - suite.Assert().True(suite.config.PasswordReset.Disable) + suite.True(suite.config.PasswordReset.Disable) ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().False(suite.config.PasswordReset.Disable) + suite.False(suite.config.PasswordReset.Disable) } func TestFileBasedAuthenticationBackend(t *testing.T) { @@ -573,7 +573,7 @@ func (suite *LDAPAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationCustom - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -585,8 +585,8 @@ func (suite *LDAPAuthenticationBackendSuite) SetupTest() { func (suite *LDAPAuthenticationBackendSuite) TestShouldValidateCompleteConfiguration() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *LDAPAuthenticationBackendSuite) TestShouldValidateDefaultImplementationAndUsernameAttribute() { @@ -594,11 +594,11 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldValidateDefaultImplementa suite.config.LDAP.UsernameAttribute = "" ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) + suite.Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) - suite.Assert().Equal(suite.config.LDAP.UsernameAttribute, schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.UsernameAttribute) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Equal(suite.config.LDAP.UsernameAttribute, schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.UsernameAttribute) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenImplementationIsInvalidMSAD() { @@ -606,20 +606,20 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenImplementat ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'implementation' must be one of 'custom', 'activedirectory', 'rfc2307bis', 'freeipa', 'lldap', or 'glauth' but it's configured as 'masd'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'implementation' must be one of 'custom', 'activedirectory', 'rfc2307bis', 'freeipa', 'lldap', or 'glauth' but it's configured as 'masd'") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenURLNotProvided() { - suite.config.LDAP.URL = "" + suite.config.LDAP.Address = nil ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'url' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'address' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenUserNotProvided() { @@ -627,10 +627,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenUserNotProv ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'user' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'user' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordNotProvided() { @@ -638,10 +638,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordNot ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'password' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'password' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPasswordNotProvidedWithPermitUnauthenticatedBind() { @@ -650,10 +650,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPassword ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when password reset is enabled") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when password reset is enabled") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordProvidedWithPermitUnauthenticatedBind() { @@ -663,10 +663,39 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenPasswordPro ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when a password is specified") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'permit_unauthenticated_bind' can't be enabled when a password is specified") +} + +func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultPorts() { + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("ldap://abc")} + + ValidateAuthenticationBackend(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal("ldap://abc:389", suite.config.LDAP.Address.String()) + + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("ldaps://abc")} + + ValidateAuthenticationBackend(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal("ldaps://abc:636", suite.config.LDAP.Address.String()) + + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("ldapi:///a/path")} + + ValidateAuthenticationBackend(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal("ldapi:///a/path", suite.config.LDAP.Address.String()) } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPermitUnauthenticatedBindConfiguredCorrectly() { @@ -676,7 +705,7 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseErrorWhenPermitUn ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 0) } @@ -685,10 +714,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorWhenBaseDNNotPr ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'base_dn' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'base_dn' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyGroupsFilter() { @@ -696,10 +725,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyGroupsFilter( ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyUsersFilter() { @@ -707,10 +736,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnEmptyUsersFilter() ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' is required") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' is required") } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseOnEmptyUsernameAttribute() { @@ -718,8 +747,8 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotRaiseOnEmptyUsernameAt ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnBadRefreshInterval() { @@ -727,19 +756,19 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnBadRefreshInterval ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: option 'refresh_interval' is configured to 'blah' but it must be either a duration notation or one of 'disable', or 'always': could not parse 'blah' as a duration") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: option 'refresh_interval' is configured to 'blah' but it must be either a duration notation or one of 'disable', or 'always': could not parse 'blah' as a duration") } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultImplementation() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) + suite.Equal(schema.LDAPImplementationCustom, suite.config.LDAP.Implementation) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorOnBadFilterPlaceholders() { @@ -748,50 +777,50 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseErrorOnBadFilterPlac ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().True(suite.validator.HasErrors()) + suite.Len(suite.validator.Warnings(), 0) + suite.True(suite.validator.HasErrors()) suite.Require().Len(suite.validator.Errors(), 4) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") - suite.Assert().EqualError(suite.validator.Errors()[1], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") - suite.Assert().EqualError(suite.validator.Errors()[2], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{1}' has been removed, please use '{username}' instead") - suite.Assert().EqualError(suite.validator.Errors()[3], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") + suite.EqualError(suite.validator.Errors()[1], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{0}' has been removed, please use '{input}' instead") + suite.EqualError(suite.validator.Errors()[2], "authentication_backend: ldap: option 'groups_filter' has an invalid placeholder: '{1}' has been removed, please use '{username}' instead") + suite.EqualError(suite.validator.Errors()[3], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultGroupNameAttribute() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("cn", suite.config.LDAP.GroupNameAttribute) + suite.Equal("cn", suite.config.LDAP.GroupNameAttribute) } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultMailAttribute() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("mail", suite.config.LDAP.MailAttribute) + suite.Equal("mail", suite.config.LDAP.MailAttribute) } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultDisplayNameAttribute() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("displayName", suite.config.LDAP.DisplayNameAttribute) + suite.Equal("displayName", suite.config.LDAP.DisplayNameAttribute) } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultRefreshInterval() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("5m", suite.config.RefreshInterval) + suite.Equal("5m", suite.config.RefreshInterval) } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenUsersFilterDoesNotContainEnclosingParenthesis() { @@ -799,10 +828,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenUsersFilterDoesN ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain enclosing parenthesis: '{username_attribute}={input}' should probably be '({username_attribute}={input})'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain enclosing parenthesis: '{username_attribute}={input}' should probably be '({username_attribute}={input})'") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenGroupsFilterDoesNotContainEnclosingParenthesis() { @@ -810,20 +839,20 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenGroupsFilterDoes ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' must contain enclosing parenthesis: 'cn={input}' should probably be '(cn={input})'") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'groups_filter' must contain enclosing parenthesis: 'cn={input}' should probably be '(cn={input})'") } func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseWhenUsersFilterDoesNotContainUsernameAttribute() { suite.config.LDAP.UsersFilter = "(&({mail_attribute}={input})(objectClass=person))" ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{username_attribute}' but it's absent") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{username_attribute}' but it's absent") } func (suite *LDAPAuthenticationBackendSuite) TestShouldHelpDetectNoInputPlaceholder() { @@ -831,10 +860,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldHelpDetectNoInputPlacehol ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'users_filter' must contain the placeholder '{input}' but it's absent") } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultTLSMinimumVersion() { @@ -842,10 +871,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultTLSMinimumVersi ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.TLS.MinimumVersion.Value, suite.config.LDAP.TLS.MinimumVersion.MinVersion()) + suite.Equal(schema.DefaultLDAPAuthenticationBackendConfigurationImplementationCustom.TLS.MinimumVersion.Value, suite.config.LDAP.TLS.MinimumVersion.MinVersion()) } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowSSL30() { @@ -855,10 +884,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowSSL30() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") } func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowTLSVerMinGreaterThanVerMax() { @@ -869,10 +898,10 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldNotAllowTLSVerMinGreaterT ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.2") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.2") } func TestLDAPAuthenticationBackend(t *testing.T) { @@ -890,7 +919,7 @@ func (suite *ActiveDirectoryAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationActiveDirectory - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -900,40 +929,40 @@ func (suite *ActiveDirectoryAuthenticationBackendSuite) SetupTest() { func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldSetActiveDirectoryDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -951,51 +980,42 @@ func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldOnlySetDefault ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationActiveDirectory.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldRaiseErrorOnInvalidURLWithHTTP() { - suite.config.LDAP.URL = "http://dc1:389" + suite.config.LDAP.Address = &schema.AddressLDAP{Address: MustParseAddress("http://dc1:389")} - validateLDAPAuthenticationBackendURL(suite.config.LDAP, suite.validator) + validateLDAPAuthenticationAddress(suite.config.LDAP, suite.validator) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'url' must have either the 'ldap' or 'ldaps' scheme but it's configured as 'http'") -} - -func (suite *ActiveDirectoryAuthenticationBackendSuite) TestShouldRaiseErrorOnInvalidURLWithBadCharacters() { - suite.config.LDAP.URL = "ldap://dc1:abc" - - validateLDAPAuthenticationBackendURL(suite.config.LDAP, suite.validator) - - suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'url' could not be parsed: parse \"ldap://dc1:abc\": invalid port \":abc\" after host") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: ldap: option 'address' with value 'http://dc1:389' is invalid: scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'http'") } func TestActiveDirectoryAuthenticationBackend(t *testing.T) { @@ -1013,7 +1033,7 @@ func (suite *RFC2307bisAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationRFC2307bis - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1023,34 +1043,34 @@ func (suite *RFC2307bisAuthenticationBackendSuite) SetupTest() { func (suite *RFC2307bisAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1068,34 +1088,34 @@ func (suite *RFC2307bisAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNo ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationRFC2307bis.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1115,7 +1135,7 @@ func (suite *FreeIPAAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationFreeIPA - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1125,34 +1145,34 @@ func (suite *FreeIPAAuthenticationBackendSuite) SetupTest() { func (suite *FreeIPAAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1170,31 +1190,31 @@ func (suite *FreeIPAAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNotMa ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationFreeIPA.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1214,7 +1234,7 @@ func (suite *LLDAPAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationLLDAP - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1224,34 +1244,34 @@ func (suite *LLDAPAuthenticationBackendSuite) SetupTest() { func (suite *LLDAPAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1269,34 +1289,34 @@ func (suite *LLDAPAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNotManu ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationLLDAP.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1316,7 +1336,7 @@ func (suite *GLAuthAuthenticationBackendSuite) SetupTest() { suite.config = schema.AuthenticationBackend{} suite.config.LDAP = &schema.LDAPAuthenticationBackend{} suite.config.LDAP.Implementation = schema.LDAPImplementationGLAuth - suite.config.LDAP.URL = testLDAPURL + suite.config.LDAP.Address = &schema.AddressLDAP{Address: *testLDAPAddress} suite.config.LDAP.User = testLDAPUser suite.config.LDAP.Password = testLDAPPassword suite.config.LDAP.BaseDN = testLDAPBaseDN @@ -1326,34 +1346,34 @@ func (suite *GLAuthAuthenticationBackendSuite) SetupTest() { func (suite *GLAuthAuthenticationBackendSuite) TestShouldSetDefaults() { ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.Timeout, suite.config.LDAP.Timeout) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().Equal( + suite.Equal( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } @@ -1371,34 +1391,34 @@ func (suite *GLAuthAuthenticationBackendSuite) TestShouldOnlySetDefaultsIfNotMan ValidateAuthenticationBackend(&suite.config, suite.validator) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalUsersDN, suite.config.LDAP.AdditionalUsersDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.AdditionalGroupsDN, suite.config.LDAP.AdditionalGroupsDN) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.Timeout, suite.config.LDAP.Timeout) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsersFilter, suite.config.LDAP.UsersFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.UsernameAttribute, suite.config.LDAP.UsernameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.DisplayNameAttribute, suite.config.LDAP.DisplayNameAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.MailAttribute, suite.config.LDAP.MailAttribute) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupsFilter, suite.config.LDAP.GroupsFilter) - suite.Assert().NotEqual( + suite.NotEqual( schema.DefaultLDAPAuthenticationBackendConfigurationImplementationGLAuth.GroupNameAttribute, suite.config.LDAP.GroupNameAttribute) } diff --git a/internal/configuration/validator/const.go b/internal/configuration/validator/const.go index 8191de1eb..d96bfc1bb 100644 --- a/internal/configuration/validator/const.go +++ b/internal/configuration/validator/const.go @@ -45,8 +45,6 @@ const ( // Scheme constants. const ( - schemeLDAP = "ldap" - schemeLDAPS = "ldaps" schemeHTTP = "http" schemeHTTPS = "https" ) @@ -61,7 +59,10 @@ const ( errFmtNotifierFileSystemFileNameNotConfigured = "notifier: filesystem: option 'filename' is required" errFmtNotifierSMTPNotConfigured = "notifier: smtp: option '%s' is required" errFmtNotifierSMTPTLSConfigInvalid = "notifier: smtp: tls: %w" - errFmtNotifierStartTlsDisabled = "notifier: smtp: option 'disable_starttls' is enabled: " + + errFmtNotifierSMTPAddress = "notifier: smtp: option 'address' with value '%s' is invalid: %w" + errFmtNotifierSMTPAddressLegacyAndModern = "notifier: smtp: option 'host' and 'port' can't be configured at the same time as 'address'" + + errFmtNotifierStartTlsDisabled = "notifier: smtp: option 'disable_starttls' is enabled: " + "opportunistic STARTTLS is explicitly disabled which means all emails will be sent insecurely over plaintext " + "and this setting is only necessary for non-compliant SMTP servers which advertise they support STARTTLS " + "when they actually don't support STARTTLS" @@ -103,10 +104,7 @@ const ( errSuffixMustBeOneOf errFmtLDAPAuthBackendFilterReplacedPlaceholders = "authentication_backend: ldap: option " + "'%s' has an invalid placeholder: '%s' has been removed, please use '%s' instead" - errFmtLDAPAuthBackendURLNotParsable = "authentication_backend: ldap: option " + - "'url' could not be parsed: %w" - errFmtLDAPAuthBackendURLInvalidScheme = "authentication_backend: ldap: option " + - "'url' must have either the 'ldap' or 'ldaps' scheme but it's configured as '%s'" + errFmtLDAPAuthBackendAddress = "authentication_backend: ldap: option 'address' with value '%s' is invalid: %w" errFmtLDAPAuthBackendFilterEnclosingParenthesis = "authentication_backend: ldap: option " + "'%s' must contain enclosing parenthesis: '%s' should probably be '(%s)'" errFmtLDAPAuthBackendFilterMissingPlaceholder = "authentication_backend: ldap: option " + @@ -123,11 +121,14 @@ const ( // Storage Error constants. const ( - errStrStorage = "storage: configuration for a 'local', 'mysql' or 'postgres' database must be provided" - errStrStorageEncryptionKeyMustBeProvided = "storage: option 'encryption_key' is required" - errStrStorageEncryptionKeyTooShort = "storage: option 'encryption_key' must be 20 characters or longer" - errFmtStorageUserPassMustBeProvided = "storage: %s: option 'username' and 'password' are required" //nolint:gosec - errFmtStorageOptionMustBeProvided = "storage: %s: option '%s' is required" + errStrStorage = "storage: configuration for a 'local', 'mysql' or 'postgres' database must be provided" + errStrStorageEncryptionKeyMustBeProvided = "storage: option 'encryption_key' is required" + errStrStorageEncryptionKeyTooShort = "storage: option 'encryption_key' must be 20 characters or longer" + errFmtStorageUserPassMustBeProvided = "storage: %s: option 'username' and 'password' are required" //nolint:gosec + errFmtStorageOptionMustBeProvided = "storage: %s: option '%s' is required" + errFmtStorageOptionAddressConflictWithHostPort = "storage: %s: option 'host' and 'port' can't be configured at the same time as 'address'" + errFmtStorageFailedToConvertHostPortToAddress = "storage: %s: option 'address' failed to parse options 'host' and 'port' as address: %w" + errFmtStorageTLSConfigInvalid = "storage: %s: tls: %w" errFmtStoragePostgreSQLInvalidSSLMode = "storage: postgres: ssl: option 'mode' must be one of %s but it's configured as '%s'" errFmtStoragePostgreSQLInvalidSSLAndTLSConfig = "storage: postgres: can't define both 'tls' and 'ssl' configuration options" @@ -246,7 +247,8 @@ const ( // NTP Error constants. const ( - errFmtNTPVersion = "ntp: option 'version' must be either 3 or 4 but it's configured as '%d'" + errFmtNTPVersion = "ntp: option 'version' must be either 3 or 4 but it's configured as '%d'" + errFmtNTPAddressScheme = "ntp: option 'address' with value '%s' is invalid: %w" ) // Session error constants. @@ -290,7 +292,6 @@ const ( errFmtServerTLSClientAuthNoAuth = "server: tls: client authentication cannot be configured if no server certificate and key are provided" - errFmtServerAddressWarnLegacy = "server: option 'address' replaces options 'host' and 'port': these will automatically be mapped for you but we recommend adjusting your configuration: the equivalent address value based on your configuration is 'tcp://%s:%d'" errFmtServerAddressLegacyAndModern = "server: option 'host' and 'port' can't be configured at the same time as 'address'" errFmtServerAddress = "server: option 'address' with value '%s' is invalid: %w" diff --git a/internal/configuration/validator/const_test.go b/internal/configuration/validator/const_test.go index c691551e7..2ae760b5d 100644 --- a/internal/configuration/validator/const_test.go +++ b/internal/configuration/validator/const_test.go @@ -1,5 +1,9 @@ package validator +import ( + "github.com/authelia/authelia/v4/internal/configuration/schema" +) + // Test constants. const ( testInvalid = "invalid" @@ -18,3 +22,25 @@ const ( const ( local25 = "127.0.0.25" ) + +var ( + testLDAPAddress = MustParseAddressPtr(testLDAPURL) +) + +func MustParseAddressPtr(input string) *schema.Address { + address, err := schema.NewAddress(input) + if err != nil { + panic(err) + } + + return address +} + +func MustParseAddress(input string) schema.Address { + address, err := schema.NewAddress(input) + if err != nil { + panic(err) + } + + return *address +} diff --git a/internal/configuration/validator/notifier.go b/internal/configuration/validator/notifier.go index b3515188f..eaa64508b 100644 --- a/internal/configuration/validator/notifier.go +++ b/internal/configuration/validator/notifier.go @@ -54,18 +54,12 @@ func validateNotifierTemplates(config *schema.NotifierConfiguration, validator * } func validateSMTPNotifier(config *schema.SMTPNotifierConfiguration, validator *schema.StructValidator) { + validateSMTPNotifierAddress(config, validator) + if config.StartupCheckAddress.Address == "" { config.StartupCheckAddress = schema.DefaultSMTPNotifierConfiguration.StartupCheckAddress } - if config.Host == "" { - validator.Push(fmt.Errorf(errFmtNotifierSMTPNotConfigured, "host")) - } - - if config.Port == 0 { - validator.Push(fmt.Errorf(errFmtNotifierSMTPNotConfigured, "port")) - } - if config.Timeout == 0 { config.Timeout = schema.DefaultSMTPNotifierConfiguration.Timeout } @@ -87,11 +81,14 @@ func validateSMTPNotifier(config *schema.SMTPNotifierConfiguration, validator *s } configDefaultTLS := &schema.TLSConfig{ - ServerName: config.Host, MinimumVersion: schema.DefaultSMTPNotifierConfiguration.TLS.MinimumVersion, MaximumVersion: schema.DefaultSMTPNotifierConfiguration.TLS.MaximumVersion, } + if config.Address != nil { + configDefaultTLS.ServerName = config.Address.Hostname() + } + if err := ValidateTLSConfig(config.TLS, configDefaultTLS); err != nil { validator.Push(fmt.Errorf(errFmtNotifierSMTPTLSConfigInvalid, err)) } @@ -100,3 +97,26 @@ func validateSMTPNotifier(config *schema.SMTPNotifierConfiguration, validator *s validator.PushWarning(fmt.Errorf(errFmtNotifierStartTlsDisabled)) } } + +func validateSMTPNotifierAddress(config *schema.SMTPNotifierConfiguration, validator *schema.StructValidator) { + if config.Address == nil { + if config.Host == "" && config.Port == 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtNotifierSMTPNotConfigured, "address")) + } else { + host := config.Host //nolint:staticcheck + port := config.Port //nolint:staticcheck + + config.Address = schema.NewSMTPAddress("", host, port) + } + } else { + if config.Host != "" || config.Port != 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtNotifierSMTPAddressLegacyAndModern)) + } + + var err error + + if err = config.Address.ValidateSMTP(); err != nil { + validator.Push(fmt.Errorf(errFmtNotifierSMTPAddress, config.Address.String(), err)) + } + } +} diff --git a/internal/configuration/validator/notifier_test.go b/internal/configuration/validator/notifier_test.go index 17819993f..e3c764153 100644 --- a/internal/configuration/validator/notifier_test.go +++ b/internal/configuration/validator/notifier_test.go @@ -22,11 +22,10 @@ type NotifierSuite struct { func (suite *NotifierSuite) SetupTest() { suite.validator = schema.NewStructValidator() suite.config.SMTP = &schema.SMTPNotifierConfiguration{ + Address: &schema.AddressSMTP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeSMTP, exampleDotCom, 25)}, Username: "john", Password: "password", Sender: mail.Address{Name: "Authelia", Address: "authelia@example.com"}, - Host: exampleDotCom, - Port: 25, } suite.config.FileSystem = nil } @@ -37,25 +36,25 @@ Common Tests. func (suite *NotifierSuite) TestShouldEnsureAtLeastSMTPOrFilesystemIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) suite.config.SMTP = nil ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], errFmtNotifierNotConfigured) + suite.EqualError(suite.validator.Errors()[0], errFmtNotifierNotConfigured) } func (suite *NotifierSuite) TestShouldEnsureEitherSMTPOrFilesystemIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Errors(), 0) suite.config.FileSystem = &schema.FileSystemNotifierConfiguration{ Filename: "test", @@ -63,12 +62,12 @@ func (suite *NotifierSuite) TestShouldEnsureEitherSMTPOrFilesystemIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], errFmtNotifierMultipleConfigured) + suite.EqualError(suite.validator.Errors()[0], errFmtNotifierMultipleConfigured) } /* @@ -77,57 +76,104 @@ SMTP Tests. func (suite *NotifierSuite) TestSMTPShouldSetTLSDefaults() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) - suite.Assert().Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) - suite.Assert().False(suite.config.SMTP.TLS.SkipVerify) + suite.Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) } -func (suite *NotifierSuite) TestSMTPShouldDefaultStartupCheckAddress() { - suite.Assert().Equal(mail.Address{Name: "", Address: ""}, suite.config.SMTP.StartupCheckAddress) +func (suite *NotifierSuite) TestSMTPShouldSetDefaultsWithLegacyAddress() { + suite.config.SMTP.Address = nil + suite.config.SMTP.Host = "xyz" //nolint:staticcheck + suite.config.SMTP.Port = 123 //nolint:staticcheck ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal(mail.Address{Name: "Authelia Test", Address: "test@authelia.com"}, suite.config.SMTP.StartupCheckAddress) + suite.Equal(&schema.AddressSMTP{Address: MustParseAddress("smtp://xyz:123")}, suite.config.SMTP.Address) + suite.Equal("xyz", suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) +} + +func (suite *NotifierSuite) TestSMTPShouldErrorWithAddressAndLegacyAddress() { + suite.config.SMTP.Host = "fgh" //nolint:staticcheck + suite.config.SMTP.Port = 123 //nolint:staticcheck + + ValidateNotifier(&suite.config, suite.validator) + + suite.Equal(&schema.AddressSMTP{Address: MustParseAddress("smtp://example.com:25")}, suite.config.SMTP.Address) + suite.Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) + + suite.Len(suite.validator.Warnings(), 0) + suite.Require().Len(suite.validator.Errors(), 1) + + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: option 'host' and 'port' can't be configured at the same time as 'address'") +} + +func (suite *NotifierSuite) TestSMTPShouldErrorWithInvalidAddressScheme() { + suite.config.SMTP.Address = &schema.AddressSMTP{Address: MustParseAddress("udp://example.com:25")} + + ValidateNotifier(&suite.config, suite.validator) + + suite.Equal(&schema.AddressSMTP{Address: MustParseAddress("udp://example.com:25")}, suite.config.SMTP.Address) + suite.Equal(exampleDotCom, suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS12), suite.config.SMTP.TLS.MinimumVersion.Value) + suite.False(suite.config.SMTP.TLS.SkipVerify) + + suite.Len(suite.validator.Warnings(), 0) + suite.Require().Len(suite.validator.Errors(), 1) + + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: option 'address' with value 'udp://example.com:25' is invalid: scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'udp'") +} + +func (suite *NotifierSuite) TestSMTPShouldDefaultStartupCheckAddress() { + suite.Equal(mail.Address{Name: "", Address: ""}, suite.config.SMTP.StartupCheckAddress) + + ValidateNotifier(&suite.config, suite.validator) + + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) + + suite.Equal(mail.Address{Name: "Authelia Test", Address: "test@authelia.com"}, suite.config.SMTP.StartupCheckAddress) } func (suite *NotifierSuite) TestSMTPShouldDefaultTLSServerNameToHost() { - suite.config.SMTP.Host = "google.com" + suite.config.SMTP.Address.SetHostname("google.com") suite.config.SMTP.TLS = &schema.TLSConfig{ MinimumVersion: schema.TLSVersion{Value: tls.VersionTLS11}, } ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().Equal("google.com", suite.config.SMTP.TLS.ServerName) - suite.Assert().Equal(uint16(tls.VersionTLS11), suite.config.SMTP.TLS.MinimumVersion.MinVersion()) - suite.Assert().False(suite.config.SMTP.TLS.SkipVerify) + suite.Equal("google.com", suite.config.SMTP.TLS.ServerName) + suite.Equal(uint16(tls.VersionTLS11), suite.config.SMTP.TLS.MinimumVersion.MinVersion()) + suite.False(suite.config.SMTP.TLS.SkipVerify) } func (suite *NotifierSuite) TestSMTPShouldErrorOnSSL30() { - suite.config.SMTP.Host = exampleDotCom suite.config.SMTP.TLS = &schema.TLSConfig{ MinimumVersion: schema.TLSVersion{Value: tls.VersionSSL30}, //nolint:staticcheck } ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option 'minimum_version' is invalid: minimum version is TLS1.0 but SSL3.0 was configured") } func (suite *NotifierSuite) TestSMTPShouldErrorOnTLSMinVerGreaterThanMaxVer() { - suite.config.SMTP.Host = exampleDotCom suite.config.SMTP.TLS = &schema.TLSConfig{ MinimumVersion: schema.TLSVersion{Value: tls.VersionTLS13}, MaximumVersion: schema.TLSVersion{Value: tls.VersionTLS10}, @@ -135,45 +181,40 @@ func (suite *NotifierSuite) TestSMTPShouldErrorOnTLSMinVerGreaterThanMaxVer() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.0") + suite.EqualError(suite.validator.Errors()[0], "notifier: smtp: tls: option combination of 'minimum_version' and 'maximum_version' is invalid: minimum version TLS1.3 is greater than the maximum version TLS1.0") } func (suite *NotifierSuite) TestSMTPShouldWarnOnDisabledSTARTTLS() { - suite.config.SMTP.Host = exampleDotCom suite.config.SMTP.DisableStartTLS = true ValidateNotifier(&suite.config, suite.validator) suite.Require().Len(suite.validator.Warnings(), 1) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.Assert().EqualError(suite.validator.Warnings()[0], "notifier: smtp: option 'disable_starttls' is enabled: opportunistic STARTTLS is explicitly disabled which means all emails will be sent insecurely over plaintext and this setting is only necessary for non-compliant SMTP servers which advertise they support STARTTLS when they actually don't support STARTTLS") + suite.EqualError(suite.validator.Warnings()[0], "notifier: smtp: option 'disable_starttls' is enabled: opportunistic STARTTLS is explicitly disabled which means all emails will be sent insecurely over plaintext and this setting is only necessary for non-compliant SMTP servers which advertise they support STARTTLS when they actually don't support STARTTLS") } func (suite *NotifierSuite) TestSMTPShouldEnsureHostAndPortAreProvided() { suite.config.FileSystem = nil ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) - suite.config.SMTP.Host = "" - suite.config.SMTP.Port = 0 + suite.config.SMTP.Address = nil ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().True(suite.validator.HasErrors()) - errors := suite.validator.Errors() - suite.Require().Len(errors, 2) + suite.Len(suite.validator.Warnings(), 0) + suite.Require().Len(errors, 1) - suite.Assert().EqualError(errors[0], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "host")) - suite.Assert().EqualError(errors[1], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "port")) + suite.EqualError(errors[0], "notifier: smtp: option 'address' is required") } func (suite *NotifierSuite) TestSMTPShouldEnsureSenderIsProvided() { @@ -181,12 +222,12 @@ func (suite *NotifierSuite) TestSMTPShouldEnsureSenderIsProvided() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "sender")) + suite.EqualError(suite.validator.Errors()[0], fmt.Sprintf(errFmtNotifierSMTPNotConfigured, "sender")) } func (suite *NotifierSuite) TestTemplatesEmptyDir() { @@ -196,8 +237,8 @@ func (suite *NotifierSuite) TestTemplatesEmptyDir() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) } func (suite *NotifierSuite) TestTemplatesEmptyDirNoExist() { @@ -209,8 +250,8 @@ func (suite *NotifierSuite) TestTemplatesEmptyDirNoExist() { ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 1) assert.EqualError(suite.T(), suite.validator.Errors()[0], fmt.Sprintf("notifier: option 'template_path' refers to location '%s' which does not exist", p)) } @@ -225,19 +266,19 @@ func (suite *NotifierSuite) TestFileShouldEnsureFilenameIsProvided() { } ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) - suite.Assert().Len(suite.validator.Errors(), 0) + suite.Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Errors(), 0) suite.config.FileSystem.Filename = "" ValidateNotifier(&suite.config, suite.validator) - suite.Assert().Len(suite.validator.Warnings(), 0) + suite.Len(suite.validator.Warnings(), 0) suite.Require().True(suite.validator.HasErrors()) - suite.Assert().Len(suite.validator.Errors(), 1) + suite.Len(suite.validator.Errors(), 1) - suite.Assert().EqualError(suite.validator.Errors()[0], errFmtNotifierFileSystemFileNameNotConfigured) + suite.EqualError(suite.validator.Errors()[0], errFmtNotifierFileSystemFileNameNotConfigured) } func TestNotifierSuite(t *testing.T) { diff --git a/internal/configuration/validator/ntp.go b/internal/configuration/validator/ntp.go index d3914c961..42aa1ce61 100644 --- a/internal/configuration/validator/ntp.go +++ b/internal/configuration/validator/ntp.go @@ -8,10 +8,14 @@ import ( // ValidateNTP validates and update NTP configuration. func ValidateNTP(config *schema.Configuration, validator *schema.StructValidator) { - if config.NTP.Address == "" { + if config.NTP.Address == nil { config.NTP.Address = schema.DefaultNTPConfiguration.Address } + if !config.NTP.Address.IsUDP() { + validator.Push(fmt.Errorf(errFmtNTPAddressScheme, config.NTP.Address.String(), fmt.Errorf("scheme must be one of 'udp', 'udp4', or 'udp6' but is configured as '%s'", config.NTP.Address.Scheme()))) + } + if config.NTP.Version == 0 { config.NTP.Version = schema.DefaultNTPConfiguration.Version } else if config.NTP.Version < 3 || config.NTP.Version > 4 { diff --git a/internal/configuration/validator/ntp_test.go b/internal/configuration/validator/ntp_test.go index 0bae5b830..39ffe7907 100644 --- a/internal/configuration/validator/ntp_test.go +++ b/internal/configuration/validator/ntp_test.go @@ -51,3 +51,15 @@ func TestShouldRaiseErrorOnInvalidNTPVersion(t *testing.T) { assert.EqualError(t, validator.Errors()[0], "ntp: option 'version' must be either 3 or 4 but it's configured as '1'") } + +func TestShouldRaiseErrorOnInvalidNTPScheme(t *testing.T) { + validator := schema.NewStructValidator() + config := newDefaultNTPConfig() + config.NTP.Address = &schema.AddressUDP{Address: MustParseAddress("tcp://abc:123")} + + ValidateNTP(&config, validator) + + require.Len(t, validator.Errors(), 1) + + assert.EqualError(t, validator.Errors()[0], "ntp: option 'address' with value 'tcp://abc:123' is invalid: scheme must be one of 'udp', 'udp4', or 'udp6' but is configured as 'tcp'") +} diff --git a/internal/configuration/validator/server_test.go b/internal/configuration/validator/server_test.go index 82af45386..8c0c9d56b 100644 --- a/internal/configuration/validator/server_test.go +++ b/internal/configuration/validator/server_test.go @@ -35,6 +35,55 @@ func TestShouldSetDefaultServerValues(t *testing.T) { assert.Equal(t, schema.DefaultServerConfiguration.Endpoints.Authz, config.Server.Endpoints.Authz) } +func TestShouldSetDefaultServerValuesWithLegacyAddress(t *testing.T) { + validator := schema.NewStructValidator() + config := &schema.Configuration{ + Server: schema.ServerConfiguration{ + Host: "abc", + Port: 123, + }, + } + + ValidateServer(config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + assert.Equal(t, "abc", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 123, config.Server.Port) //nolint:staticcheck + assert.Equal(t, &schema.AddressTCP{Address: MustParseAddress("tcp://abc:123")}, config.Server.Address) + + config = &schema.Configuration{ + Server: schema.ServerConfiguration{ + Host: "abc", + }, + } + + ValidateServer(config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + assert.Equal(t, "abc", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 0, config.Server.Port) //nolint:staticcheck + assert.Equal(t, &schema.AddressTCP{Address: MustParseAddress("tcp://abc:9091")}, config.Server.Address) + + config = &schema.Configuration{ + Server: schema.ServerConfiguration{ + Port: 123, + }, + } + + ValidateServer(config, validator) + + assert.Len(t, validator.Errors(), 0) + assert.Len(t, validator.Warnings(), 0) + + assert.Equal(t, "", config.Server.Host) //nolint:staticcheck + assert.Equal(t, 123, config.Server.Port) //nolint:staticcheck + assert.Equal(t, &schema.AddressTCP{Address: MustParseAddress("tcp://:123")}, config.Server.Address) +} + func TestShouldSetDefaultConfig(t *testing.T) { validator := schema.NewStructValidator() config := &schema.Configuration{} diff --git a/internal/configuration/validator/storage.go b/internal/configuration/validator/storage.go index 035ac62e8..0f6f1dad6 100644 --- a/internal/configuration/validator/storage.go +++ b/internal/configuration/validator/storage.go @@ -31,12 +31,29 @@ func ValidateStorage(config schema.StorageConfiguration, validator *schema.Struc } func validateSQLConfiguration(config *schema.SQLStorageConfiguration, validator *schema.StructValidator, provider string) { - if config.Timeout == 0 { - config.Timeout = schema.DefaultSQLStorageConfiguration.Timeout - } + if config.Address == nil { + if config.Host == "" { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtStorageOptionMustBeProvided, provider, "address")) + } else { + host := config.Host //nolint:staticcheck + port := config.Port //nolint:staticcheck - if config.Host == "" { - validator.Push(fmt.Errorf(errFmtStorageOptionMustBeProvided, provider, "host")) + if address, err := schema.NewAddressFromNetworkValuesDefault(host, port, schema.AddressSchemeTCP, schema.AddressSchemeUnix); err != nil { + validator.Push(fmt.Errorf(errFmtStorageFailedToConvertHostPortToAddress, provider, err)) + } else { + config.Address = &schema.AddressTCP{Address: *address} + } + } + } else { + if config.Host != "" || config.Port != 0 { //nolint:staticcheck + validator.Push(fmt.Errorf(errFmtStorageOptionAddressConflictWithHostPort, provider)) + } + + var err error + + if err = config.Address.ValidateSQL(); err != nil { + validator.Push(fmt.Errorf(errFmtServerAddress, config.Address.String(), err)) + } } if config.Username == "" || config.Password == "" { @@ -46,6 +63,10 @@ func validateSQLConfiguration(config *schema.SQLStorageConfiguration, validator if config.Database == "" { validator.Push(fmt.Errorf(errFmtStorageOptionMustBeProvided, provider, "database")) } + + if config.Timeout == 0 { + config.Timeout = schema.DefaultSQLStorageConfiguration.Timeout + } } func validateMySQLConfiguration(config *schema.MySQLStorageConfiguration, validator *schema.StructValidator) { @@ -53,11 +74,14 @@ func validateMySQLConfiguration(config *schema.MySQLStorageConfiguration, valida if config.TLS != nil { configDefaultTLS := &schema.TLSConfig{ - ServerName: config.Host, MinimumVersion: schema.DefaultMySQLStorageConfiguration.TLS.MinimumVersion, MaximumVersion: schema.DefaultMySQLStorageConfiguration.TLS.MaximumVersion, } + if config.Address != nil { + configDefaultTLS.ServerName = config.Address.Hostname() + } + if err := ValidateTLSConfig(config.TLS, configDefaultTLS); err != nil { validator.Push(fmt.Errorf(errFmtStorageTLSConfigInvalid, "mysql", err)) } @@ -76,7 +100,7 @@ func validatePostgreSQLConfiguration(config *schema.PostgreSQLStorageConfigurati validator.Push(fmt.Errorf(errFmtStoragePostgreSQLInvalidSSLAndTLSConfig)) case config.TLS != nil: configDefaultTLS := &schema.TLSConfig{ - ServerName: config.Host, + ServerName: config.Address.Hostname(), MinimumVersion: schema.DefaultPostgreSQLStorageConfiguration.TLS.MinimumVersion, MaximumVersion: schema.DefaultPostgreSQLStorageConfiguration.TLS.MaximumVersion, } diff --git a/internal/configuration/validator/storage_test.go b/internal/configuration/validator/storage_test.go index f69bffab1..1001add41 100644 --- a/internal/configuration/validator/storage_test.go +++ b/internal/configuration/validator/storage_test.go @@ -61,7 +61,7 @@ func (suite *StorageSuite) TestShouldValidateMySQLHostUsernamePasswordAndDatabas ValidateStorage(suite.config, suite.validator) suite.Require().Len(suite.validator.Errors(), 3) - suite.Assert().EqualError(suite.validator.Errors()[0], "storage: mysql: option 'host' is required") + suite.Assert().EqualError(suite.validator.Errors()[0], "storage: mysql: option 'address' is required") suite.Assert().EqualError(suite.validator.Errors()[1], "storage: mysql: option 'username' and 'password' are required") suite.Assert().EqualError(suite.validator.Errors()[2], "storage: mysql: option 'database' is required") @@ -83,7 +83,7 @@ func (suite *StorageSuite) TestShouldValidateMySQLHostUsernamePasswordAndDatabas func (suite *StorageSuite) TestShouldSetDefaultMySQLTLSServerName() { suite.config.MySQL = &schema.MySQLStorageConfiguration{ SQLStorageConfiguration: schema.SQLStorageConfiguration{ - Host: "mysql1", + Address: &schema.AddressTCP{Address: MustParseAddress("tcp://mysql:1234")}, Username: "myuser", Password: "pass", Database: "database", @@ -98,7 +98,8 @@ func (suite *StorageSuite) TestShouldSetDefaultMySQLTLSServerName() { suite.Assert().Len(suite.validator.Warnings(), 0) suite.Assert().Len(suite.validator.Errors(), 0) - suite.Assert().Equal(suite.config.MySQL.Host, suite.config.MySQL.TLS.ServerName) + suite.Assert().Equal(suite.config.MySQL.Address.Hostname(), suite.config.MySQL.TLS.ServerName) + suite.Assert().Equal("mysql", suite.config.MySQL.TLS.ServerName) } func (suite *StorageSuite) TestShouldRaiseErrorOnInvalidMySQLTLSVersion() { @@ -150,7 +151,7 @@ func (suite *StorageSuite) TestShouldValidatePostgreSQLHostUsernamePasswordAndDa ValidateStorage(suite.config, suite.validator) suite.Require().Len(suite.validator.Errors(), 3) - suite.Assert().EqualError(suite.validator.Errors()[0], "storage: postgres: option 'host' is required") + suite.Assert().EqualError(suite.validator.Errors()[0], "storage: postgres: option 'address' is required") suite.Assert().EqualError(suite.validator.Errors()[1], "storage: postgres: option 'username' and 'password' are required") suite.Assert().EqualError(suite.validator.Errors()[2], "storage: postgres: option 'database' is required") @@ -230,7 +231,7 @@ func (suite *StorageSuite) TestShouldSetDefaultPostgreSQLTLSServerName() { suite.Assert().Len(suite.validator.Warnings(), 0) suite.Assert().Len(suite.validator.Errors(), 0) - suite.Assert().Equal(suite.config.PostgreSQL.Host, suite.config.PostgreSQL.TLS.ServerName) + suite.Assert().Equal(suite.config.PostgreSQL.Address.Hostname(), suite.config.PostgreSQL.TLS.ServerName) } func (suite *StorageSuite) TestShouldRaiseErrorOnInvalidPostgreSQLTLSVersion() { diff --git a/internal/notification/const.go b/internal/notification/const.go index f244ebef3..55b3a0052 100644 --- a/internal/notification/const.go +++ b/internal/notification/const.go @@ -5,10 +5,6 @@ const ( fileNotifierHeader = "Date: %s\nRecipient: %s\nSubject: %s\n" ) -const ( - smtpPortSUBMISSIONS = 465 -) - const ( posixNewLine = "\n" ) diff --git a/internal/notification/smtp_auth.go b/internal/notification/smtp_auth.go index 5901f9209..2cf34e4c2 100644 --- a/internal/notification/smtp_auth.go +++ b/internal/notification/smtp_auth.go @@ -20,7 +20,7 @@ func NewOpportunisticSMTPAuth(config *schema.SMTPNotifierConfiguration) *Opportu return &OpportunisticSMTPAuth{ username: config.Username, password: config.Password, - host: config.Host, + host: config.Address.Hostname(), } } diff --git a/internal/notification/smtp_notifier.go b/internal/notification/smtp_notifier.go index a7533e67b..41a873933 100644 --- a/internal/notification/smtp_notifier.go +++ b/internal/notification/smtp_notifier.go @@ -28,14 +28,14 @@ func NewSMTPNotifier(config *schema.SMTPNotifierConfiguration, certPool *x509.Ce } opts := []gomail.Option{ - gomail.WithPort(config.Port), + gomail.WithPort(config.Address.Port()), gomail.WithTLSConfig(tlsconfig), gomail.WithHELO(config.Identifier), gomail.WithTimeout(config.Timeout), gomail.WithoutNoop(), } - ssl := config.Port == smtpPortSUBMISSIONS + ssl := config.Address.IsExplicitlySecure() if ssl { opts = append(opts, gomail.WithSSL()) @@ -86,7 +86,7 @@ type SMTPNotifier struct { func (n *SMTPNotifier) StartupCheck() (err error) { var client *gomail.Client - if client, err = gomail.NewClient(n.config.Host, n.opts...); err != nil { + if client, err = gomail.NewClient(n.config.Address.Hostname(), n.opts...); err != nil { return fmt.Errorf("failed to establish client: %w", err) } @@ -139,7 +139,7 @@ func (n *SMTPNotifier) Send(ctx context.Context, recipient mail.Address, subject var client *gomail.Client - if client, err = gomail.NewClient(n.config.Host, n.opts...); err != nil { + if client, err = gomail.NewClient(n.config.Address.Hostname(), n.opts...); err != nil { return fmt.Errorf("notifier: smtp: failed to establish client: %w", err) } diff --git a/internal/ntp/ntp.go b/internal/ntp/ntp.go index fe8ba1964..2d5d55a01 100644 --- a/internal/ntp/ntp.go +++ b/internal/ntp/ntp.go @@ -3,6 +3,7 @@ package ntp import ( "encoding/binary" "errors" + "fmt" "net" "time" @@ -20,19 +21,37 @@ func NewProvider(config *schema.NTPConfiguration) *Provider { // StartupCheck implements the startup check provider interface. func (p *Provider) StartupCheck() (err error) { - conn, err := net.Dial("udp", p.config.Address) - if err != nil { - p.log.Warnf("Could not connect to NTP server to validate the system time is properly synchronized: %+v", err) + var offset time.Duration + + if offset, err = p.GetOffset(); err != nil { + p.log.WithError(err).Warnf("Could not determine the clock offset due to an error") return nil } - defer conn.Close() + if offset > p.config.MaximumDesync { + return errors.New("the system clock is not synchronized accurately enough with the configured NTP server") + } - if err := conn.SetDeadline(time.Now().Add(5 * time.Second)); err != nil { - p.log.Warnf("Could not connect to NTP server to validate the system time is properly synchronized: %+v", err) + return nil +} - return nil +// GetOffset returns the current offset for this provider. +func (p *Provider) GetOffset() (offset time.Duration, err error) { + var conn net.Conn + + if conn, err = net.Dial(p.config.Address.Network(), p.config.Address.NetworkAddress()); err != nil { + return offset, fmt.Errorf("error occurred during dial: %w", err) + } + + defer func() { + if closeErr := conn.Close(); closeErr != nil { + p.log.WithError(err).Error("Error occurred closing connection with NTP sever") + } + }() + + if err = conn.SetDeadline(time.Now().Add(5 * time.Second)); err != nil { + return offset, fmt.Errorf("error occurred setting connection deadline: %w", err) } version := ntpV4 @@ -42,27 +61,19 @@ func (p *Provider) StartupCheck() (err error) { req := &ntpPacket{LeapVersionMode: ntpLeapVersionClientMode(version)} - if err := binary.Write(conn, binary.BigEndian, req); err != nil { - p.log.Warnf("Could not write to the NTP server socket to validate the system time is properly synchronized: %+v", err) - - return nil + if err = binary.Write(conn, binary.BigEndian, req); err != nil { + return offset, fmt.Errorf("error occurred writing ntp packet request to the connection: %w", err) } now := time.Now() resp := &ntpPacket{} - if err := binary.Read(conn, binary.BigEndian, resp); err != nil { - p.log.Warnf("Could not read from the NTP server socket to validate the system time is properly synchronized: %+v", err) - - return nil + if err = binary.Read(conn, binary.BigEndian, resp); err != nil { + return offset, fmt.Errorf("error occurred reading ntp packet response to the connection: %w", err) } ntpTime := ntpPacketToTime(resp) - if result := ntpIsOffsetTooLarge(p.config.MaximumDesync, now, ntpTime); result { - return errors.New("the system clock is not synchronized accurately enough with the configured NTP server") - } - - return nil + return calcOffset(now, ntpTime), nil } diff --git a/internal/ntp/ntp_test.go b/internal/ntp/ntp_test.go index de88edfc3..2f3bf92cb 100644 --- a/internal/ntp/ntp_test.go +++ b/internal/ntp/ntp_test.go @@ -13,7 +13,7 @@ import ( func TestShouldCheckNTPV4(t *testing.T) { config := &schema.Configuration{ NTP: schema.NTPConfiguration{ - Address: "time.cloudflare.com:123", + Address: &schema.AddressUDP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeUDP, "time.cloudflare.com", 123)}, Version: 4, MaximumDesync: time.Second * 3, }, @@ -30,7 +30,7 @@ func TestShouldCheckNTPV4(t *testing.T) { func TestShouldCheckNTPV3(t *testing.T) { config := &schema.Configuration{ NTP: schema.NTPConfiguration{ - Address: "time.cloudflare.com:123", + Address: &schema.AddressUDP{Address: schema.NewAddressFromNetworkValues(schema.AddressSchemeUDP, "time.cloudflare.com", 123)}, Version: 3, MaximumDesync: time.Second * 3, }, diff --git a/internal/ntp/util.go b/internal/ntp/util.go index 4e590c6d1..67be2faed 100644 --- a/internal/ntp/util.go +++ b/internal/ntp/util.go @@ -38,3 +38,11 @@ func ntpIsOffsetTooLarge(maxOffset time.Duration, first, second time.Time) (tooL return offset > maxOffset } + +func calcOffset(first, second time.Time) time.Duration { + if first.After(second) { + return first.Sub(second) + } + + return second.Sub(first) +} diff --git a/internal/storage/const.go b/internal/storage/const.go index 286d39620..2dec1b5e4 100644 --- a/internal/storage/const.go +++ b/internal/storage/const.go @@ -81,11 +81,6 @@ func (s OAuth2SessionType) Table() string { } } -const ( - sqlNetworkTypeTCP = "tcp" - sqlNetworkTypeUnixSocket = "unix" -) - const ( encryptionNameCheck = "check" ) diff --git a/internal/storage/sql_provider_backend_mysql.go b/internal/storage/sql_provider_backend_mysql.go index 32cc7de16..5ff2e531a 100644 --- a/internal/storage/sql_provider_backend_mysql.go +++ b/internal/storage/sql_provider_backend_mysql.go @@ -2,8 +2,6 @@ package storage import ( "crypto/x509" - "fmt" - "path" "time" "github.com/go-sql-driver/mysql" @@ -35,17 +33,8 @@ func NewMySQLProvider(config *schema.Configuration, caCertPool *x509.CertPool) ( func dsnMySQL(config *schema.MySQLStorageConfiguration, caCertPool *x509.CertPool) (dataSourceName string) { dsnConfig := mysql.NewConfig() - switch { - case path.IsAbs(config.Host): - dsnConfig.Net = sqlNetworkTypeUnixSocket - dsnConfig.Addr = config.Host - case config.Port == 0: - dsnConfig.Net = sqlNetworkTypeTCP - dsnConfig.Addr = fmt.Sprintf("%s:%d", config.Host, 3306) - default: - dsnConfig.Net = sqlNetworkTypeTCP - dsnConfig.Addr = fmt.Sprintf("%s:%d", config.Host, config.Port) - } + dsnConfig.Net = config.Address.Network() + dsnConfig.Addr = config.Address.NetworkAddress() if config.TLS != nil { _ = mysql.RegisterTLSConfig("storage", utils.NewTLSConfig(config.TLS, caCertPool)) @@ -53,13 +42,6 @@ func dsnMySQL(config *schema.MySQLStorageConfiguration, caCertPool *x509.CertPoo dsnConfig.TLSConfig = "storage" } - switch config.Port { - case 0: - dsnConfig.Addr = config.Host - default: - dsnConfig.Addr = fmt.Sprintf("%s:%d", config.Host, config.Port) - } - dsnConfig.DBName = config.Database dsnConfig.User = config.Username dsnConfig.Passwd = config.Password diff --git a/internal/storage/sql_provider_backend_postgres.go b/internal/storage/sql_provider_backend_postgres.go index 252ec3e0e..ef7054951 100644 --- a/internal/storage/sql_provider_backend_postgres.go +++ b/internal/storage/sql_provider_backend_postgres.go @@ -6,7 +6,6 @@ import ( "errors" "fmt" "os" - "path" "github.com/jackc/pgx/v5" "github.com/jackc/pgx/v5/stdlib" @@ -136,8 +135,8 @@ func NewPostgreSQLProvider(config *schema.Configuration, caCertPool *x509.CertPo func dsnPostgreSQL(config *schema.PostgreSQLStorageConfiguration, globalCACertPool *x509.CertPool) (dsn string) { dsnConfig, _ := pgx.ParseConfig("") - dsnConfig.Host = config.Host - dsnConfig.Port = uint16(config.Port) + dsnConfig.Host = config.Address.SocketHostname() + dsnConfig.Port = uint16(config.Address.Port()) dsnConfig.Database = config.Database dsnConfig.User = config.Username dsnConfig.Password = config.Password @@ -147,7 +146,7 @@ func dsnPostgreSQL(config *schema.PostgreSQLStorageConfiguration, globalCACertPo "search_path": config.Schema, } - if dsnConfig.Port == 0 && !path.IsAbs(dsnConfig.Host) { + if dsnConfig.Port == 0 && config.Address.IsUnixDomainSocket() { dsnConfig.Port = 5432 } @@ -190,7 +189,7 @@ func loadPostgreSQLTLSConfig(config *schema.PostgreSQLStorageConfiguration, glob tlsConfig.VerifyPeerCertificate = newPostgreSQLVerifyCAFunc(tlsConfig) case config.SSL.Mode == "verify-full": tlsConfig.InsecureSkipVerify = false - tlsConfig.ServerName = config.Host + tlsConfig.ServerName = config.Address.Hostname() } } diff --git a/internal/suites/ActiveDirectory/configuration.yml b/internal/suites/ActiveDirectory/configuration.yml index cf309813a..a16d41a22 100644 --- a/internal/suites/ActiveDirectory/configuration.yml +++ b/internal/suites/ActiveDirectory/configuration.yml @@ -8,7 +8,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -18,8 +18,8 @@ log: authentication_backend: ldap: + address: 'ldap://sambaldap' implementation: activedirectory - url: ldap://sambaldap tls: skip_verify: true start_tls: true @@ -65,8 +65,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/BypassAll/configuration.yml b/internal/suites/BypassAll/configuration.yml index 5611c59d7..7802b6493 100644 --- a/internal/suites/BypassAll/configuration.yml +++ b/internal/suites/BypassAll/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -48,8 +48,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/CLI/configuration.yml b/internal/suites/CLI/configuration.yml index 798b79ab6..e27f5a1d1 100644 --- a/internal/suites/CLI/configuration.yml +++ b/internal/suites/CLI/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Caddy/configuration.yml b/internal/suites/Caddy/configuration.yml index 8dc14b612..a1b55633d 100644 --- a/internal/suites/Caddy/configuration.yml +++ b/internal/suites/Caddy/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - address: "tcp://:9091" - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -52,8 +52,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Docker/configuration.yml b/internal/suites/Docker/configuration.yml index c1d593fdb..70692bb00 100644 --- a/internal/suites/Docker/configuration.yml +++ b/internal/suites/Docker/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -85,8 +85,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/DuoPush/configuration.yml b/internal/suites/DuoPush/configuration.yml index 6e96949ac..3235ce73c 100644 --- a/internal/suites/DuoPush/configuration.yml +++ b/internal/suites/DuoPush/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/Envoy/configuration.yml b/internal/suites/Envoy/configuration.yml index d1e59588c..4ec2d94fd 100644 --- a/internal/suites/Envoy/configuration.yml +++ b/internal/suites/Envoy/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - address: "tcp://:9091" - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -55,8 +55,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/HAProxy/configuration.yml b/internal/suites/HAProxy/configuration.yml index 664349df6..2a0c29bbb 100644 --- a/internal/suites/HAProxy/configuration.yml +++ b/internal/suites/HAProxy/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -46,8 +46,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/HighAvailability/configuration.yml b/internal/suites/HighAvailability/configuration.yml index 32883e329..8aece0597 100644 --- a/internal/suites/HighAvailability/configuration.yml +++ b/internal/suites/HighAvailability/configuration.yml @@ -6,7 +6,7 @@ jwt_secret: unsecure_secret server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -19,7 +19,7 @@ totp: authentication_backend: ldap: - url: ldap://openldap + address: 'ldap://openldap' base_dn: dc=example,dc=com username_attribute: uid additional_users_dn: ou=users @@ -114,16 +114,14 @@ regulation: storage: encryption_key: a_not_so_secure_encryption_key mysql: - host: mariadb - port: 3306 + address: 'tcp://mariadb:3306' database: authelia username: admin password: password notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/LDAP/configuration.yml b/internal/suites/LDAP/configuration.yml index ac5b4379c..1847f411e 100644 --- a/internal/suites/LDAP/configuration.yml +++ b/internal/suites/LDAP/configuration.yml @@ -8,7 +8,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -18,7 +18,7 @@ log: authentication_backend: ldap: - url: ldaps://openldap + address: 'ldaps://openldap' tls: skip_verify: true base_dn: dc=example,dc=com @@ -69,8 +69,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/MariaDB/configuration.yml b/internal/suites/MariaDB/configuration.yml index 3ec3af71d..3b7fb220f 100644 --- a/internal/suites/MariaDB/configuration.yml +++ b/internal/suites/MariaDB/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -32,8 +32,7 @@ session: storage: encryption_key: a_not_so_secure_encryption_key mysql: - host: mariadb - port: 3306 + address: 'tcp://mariadb:3306' database: authelia username: admin password: password @@ -71,8 +70,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/MultiCookieDomain/configuration.yml b/internal/suites/MultiCookieDomain/configuration.yml index d47a5a80d..c4dd3fa1b 100644 --- a/internal/suites/MultiCookieDomain/configuration.yml +++ b/internal/suites/MultiCookieDomain/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret theme: auto server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -15,7 +15,7 @@ server: telemetry: metrics: enabled: true - address: tcp://0.0.0.0:9959 + address: 'tcp://:9959' log: level: debug @@ -187,13 +187,12 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ntp: ## NTP server address - address: "time.cloudflare.com:123" + address: 'udp://time.cloudflare.com:123' ## ntp version version: 4 ## "maximum desynchronization" is the allowed offset time between the host and the ntp server diff --git a/internal/suites/MySQL/configuration.yml b/internal/suites/MySQL/configuration.yml index 87846b214..2427b915e 100644 --- a/internal/suites/MySQL/configuration.yml +++ b/internal/suites/MySQL/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -33,11 +33,10 @@ session: storage: encryption_key: a_not_so_secure_encryption_key mysql: - host: mysql - port: 3306 - database: authelia - username: admin - password: password + address: 'tcp://mysql:3306' + database: 'authelia' + username: 'admin' + password: 'password' # TOTP Issuer Name # @@ -72,8 +71,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/NetworkACL/configuration.yml b/internal/suites/NetworkACL/configuration.yml index 793469eea..309d1ba4a 100644 --- a/internal/suites/NetworkACL/configuration.yml +++ b/internal/suites/NetworkACL/configuration.yml @@ -4,7 +4,7 @@ ############################################################### server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -70,8 +70,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/OIDC/configuration.yml b/internal/suites/OIDC/configuration.yml index c1f77f557..e2c640839 100644 --- a/internal/suites/OIDC/configuration.yml +++ b/internal/suites/OIDC/configuration.yml @@ -1,6 +1,6 @@ --- server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -55,8 +55,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true diff --git a/internal/suites/OIDCTraefik/configuration.yml b/internal/suites/OIDCTraefik/configuration.yml index 0c545972d..be074e1f6 100644 --- a/internal/suites/OIDCTraefik/configuration.yml +++ b/internal/suites/OIDCTraefik/configuration.yml @@ -1,6 +1,6 @@ --- server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -56,8 +56,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true diff --git a/internal/suites/OneFactorOnly/configuration.yml b/internal/suites/OneFactorOnly/configuration.yml index b93f37170..21f6cc5f0 100644 --- a/internal/suites/OneFactorOnly/configuration.yml +++ b/internal/suites/OneFactorOnly/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem diff --git a/internal/suites/PathPrefix/configuration.yml b/internal/suites/PathPrefix/configuration.yml index e40b4f0eb..441b88b20 100644 --- a/internal/suites/PathPrefix/configuration.yml +++ b/internal/suites/PathPrefix/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - address: "tcp://:9091" - path: auth + address: 'tcp://:9091' + path: 'auth' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -47,8 +47,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Postgres/configuration.yml b/internal/suites/Postgres/configuration.yml index cf2c31d6f..d4c60290d 100644 --- a/internal/suites/Postgres/configuration.yml +++ b/internal/suites/Postgres/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: very_important_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -32,11 +32,10 @@ session: storage: encryption_key: a_not_so_secure_encryption_key postgres: - host: postgres - port: 5432 - database: authelia - username: admin - password: password + address: 'tcp://postgres:5432' + database: 'authelia' + username: 'admin' + password: 'password' # TOTP Issuer Name # @@ -71,8 +70,7 @@ regulation: notifier: # Use a SMTP server for sending notifications smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/ShortTimeouts/configuration.yml b/internal/suites/ShortTimeouts/configuration.yml index d0b57b826..e330dca6c 100644 --- a/internal/suites/ShortTimeouts/configuration.yml +++ b/internal/suites/ShortTimeouts/configuration.yml @@ -7,7 +7,7 @@ jwt_secret: unsecure_secret default_redirection_url: https://home.example.com:8080/ server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -77,8 +77,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Standalone/configuration.yml b/internal/suites/Standalone/configuration.yml index 4589ead9d..255afeeae 100644 --- a/internal/suites/Standalone/configuration.yml +++ b/internal/suites/Standalone/configuration.yml @@ -6,7 +6,7 @@ theme: auto server: - address: "tcp://:9091" + address: 'tcp://:9091' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -94,8 +94,7 @@ regulation: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ntp: diff --git a/internal/suites/Traefik/configuration.yml b/internal/suites/Traefik/configuration.yml index 5b169f8a9..2276926be 100644 --- a/internal/suites/Traefik/configuration.yml +++ b/internal/suites/Traefik/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - address: "tcp://:9091" - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -47,8 +47,7 @@ access_control: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/Traefik2/configuration.yml b/internal/suites/Traefik2/configuration.yml index ee7218872..a77c46b13 100644 --- a/internal/suites/Traefik2/configuration.yml +++ b/internal/suites/Traefik2/configuration.yml @@ -6,8 +6,8 @@ jwt_secret: unsecure_secret server: - address: "tcp://:9091" - asset_path: /config/assets/ + address: 'tcp://:9091' + asset_path: '/config/assets/' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -61,8 +61,7 @@ ntp: notifier: smtp: - host: smtp - port: 1025 + address: 'smtp://smtp:1025' sender: admin@example.com disable_require_tls: true ... diff --git a/internal/suites/example/compose/envoy/envoy.yaml b/internal/suites/example/compose/envoy/envoy.yaml index 2e7248e7f..2c4935e42 100644 --- a/internal/suites/example/compose/envoy/envoy.yaml +++ b/internal/suites/example/compose/envoy/envoy.yaml @@ -7,240 +7,240 @@ admin: port_value: 9901 static_resources: listeners: - - name: listener_0 + - name: 'listener_0' address: socket_address: - address: 0.0.0.0 + address: '0.0.0.0' port_value: 8080 filter_chains: - filters: - - name: envoy.filters.network.http_connection_manager + - name: 'envoy.filters.network.http_connection_manager' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager # yamllint disable-line rule:line-length - stat_prefix: ingress_http + "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager' # yamllint disable-line rule:line-length + stat_prefix: 'ingress_http' use_remote_address: true skip_xff_append: false access_log: - - name: envoy.access_loggers.stdout + - name: 'envoy.access_loggers.stdout' typed_config: - "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog + "@type": 'type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog' route_config: - name: local_route + name: 'local_route' virtual_hosts: - - name: login_service - domains: ["login.example.com:8080"] + - name: 'login_service' + domains: ['login.example.com:8080'] typed_per_filter_config: envoy.filters.http.ext_authz: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' disabled: true routes: - match: - prefix: "/.well-known/" + prefix: '/.well-known/' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - prefix: "/api/" + prefix: '/api/' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - prefix: "/locales/" + prefix: '/locales/' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - path: "/devworkflow" + path: '/devworkflow' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - path: "/jwks.json" + path: '/jwks.json' route: - cluster: authelia-backend + cluster: 'authelia-backend' - match: - prefix: "/" + prefix: '/' route: - cluster: authelia-frontend - - name: mail_service - domains: ["mail.example.com:8080"] + cluster: 'authelia-frontend' + - name: 'mail_service' + domains: ['mail.example.com:8080'] typed_per_filter_config: envoy.filters.http.ext_authz: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute' disabled: true routes: - match: - prefix: "/" + prefix: '/' route: - cluster: smtp - - name: http_service - domains: ["*.example.com:8080"] + cluster: 'smtp' + - name: 'http_service' + domains: ['*.example.com:8080'] routes: - match: - prefix: "/headers" + prefix: '/headers' route: - cluster: httpbin + cluster: 'httpbin' - match: - prefix: "/" + prefix: '/' route: - cluster: nginx-backend + cluster: 'nginx-backend' http_filters: - - name: envoy.filters.http.ext_authz + - name: 'envoy.filters.http.ext_authz' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz - transport_api_version: v3 + "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz' + transport_api_version: 'v3' allowed_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - exact: accept - - exact: cookie + - exact: 'authorization' + - exact: 'proxy-authorization' + - exact: 'accept' + - exact: 'cookie' http_service: - path_prefix: /api/authz/ext-authz/ + path_prefix: '/api/authz/ext-authz/' server_uri: - uri: authelia-backend:9091 - cluster: authelia-backend - timeout: 0.25s + uri: 'authelia-backend:9091' + cluster: 'authelia-backend' + timeout: '0.25s' authorization_request: headers_to_add: - - key: X-Forwarded-Proto + - key: 'X-Forwarded-Proto' value: '%REQ(:SCHEME)%' authorization_response: allowed_upstream_headers: patterns: - - exact: authorization - - exact: proxy-authorization - - prefix: remote- - - prefix: authelia- + - exact: 'authorization' + - exact: 'proxy-authorization' + - prefix: 'remote-' + - prefix: 'authelia-' allowed_client_headers: patterns: - - exact: set-cookie + - exact: 'set-cookie' allowed_client_headers_on_success: patterns: - - exact: set-cookie + - exact: 'set-cookie' failure_mode_allow: false - - name: envoy.filters.http.router + - name: 'envoy.filters.http.router' typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router' transport_socket: - name: envoy.transport_sockets.tls + name: 'envoy.transport_sockets.tls' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext' common_tls_context: tls_certificates: - certificate_chain: - filename: /pki/public.chain.pem + filename: '/pki/public.chain.pem' private_key: - filename: /pki/private.pem + filename: '/pki/private.pem' clusters: - - name: authelia-frontend + - name: 'authelia-frontend' transport_socket_matches: - - name: "enableTLS" + - name: 'enableTLS' match: enableTLS: true transport_socket: - name: envoy.transport_sockets.tls + name: 'envoy.transport_sockets.tls' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext' common_tls_context: {} - - name: "defaultTLSDisabled" + - name: 'defaultTLSDisabled' match: {} transport_socket: - name: envoy.transport_sockets.raw_buffer + name: 'envoy.transport_sockets.raw_buffer' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer - connect_timeout: 0.25s - type: strict_dns - dns_lookup_family: V4_ONLY - lb_policy: round_robin + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer' + connect_timeout: '0.25s' + type: 'strict_dns' + dns_lookup_family: 'V4_ONLY' + lb_policy: 'round_robin' load_assignment: - cluster_name: authelia-frontend + cluster_name: 'authelia-frontend' endpoints: - locality: - region: dev + region: 'dev' priority: 0 lb_endpoints: - endpoint: health_check_config: - hostname: authelia-frontend + hostname: 'authelia-frontend' port_value: 3000 address: socket_address: - address: authelia-frontend + address: 'authelia-frontend' port_value: 3000 - locality: - region: ci + region: 'ci' priority: 1 lb_endpoints: - endpoint: address: socket_address: - address: authelia-backend + address: 'authelia-backend' port_value: 9091 metadata: filter_metadata: envoy.transport_socket_match: enableTLS: true - - name: authelia-backend - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'authelia-backend' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: authelia-backend + cluster_name: 'authelia-backend' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: authelia-backend + address: 'authelia-backend' port_value: 9091 transport_socket: - name: envoy.transport_sockets.tls + name: 'envoy.transport_sockets.tls' typed_config: - "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + "@type": 'type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext' common_tls_context: {} - - name: smtp - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'smtp' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: smtp + cluster_name: 'smtp' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: smtp + address: 'smtp' port_value: 1080 - - name: httpbin - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'httpbin' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: httpbin + cluster_name: 'httpbin' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: httpbin + address: 'httpbin' port_value: 8000 - - name: nginx-backend - connect_timeout: 0.25s - type: logical_dns - dns_lookup_family: v4_only - lb_policy: round_robin + - name: 'nginx-backend' + connect_timeout: '0.25s' + type: 'logical_dns' + dns_lookup_family: 'v4_only' + lb_policy: 'round_robin' load_assignment: - cluster_name: nginx-backend + cluster_name: 'nginx-backend' endpoints: - lb_endpoints: - endpoint: address: socket_address: - address: nginx-backend + address: 'nginx-backend' port_value: 80 layered_runtime: layers: - - name: static_layer_0 + - name: 'static_layer_0' static_layer: envoy: resource_limits: diff --git a/internal/suites/example/kube/authelia/configs/configuration.yml b/internal/suites/example/kube/authelia/configs/configuration.yml index 8b8dc8180..edb8e04d7 100644 --- a/internal/suites/example/kube/authelia/configs/configuration.yml +++ b/internal/suites/example/kube/authelia/configs/configuration.yml @@ -6,7 +6,7 @@ default_redirection_url: https://home.example.com:8080 server: - port: 443 + address: 'tcp://:443' tls: certificate: /pki/public.backend.crt key: /pki/private.backend.pem @@ -16,7 +16,7 @@ log: authentication_backend: ldap: - url: ldaps://ldap-service + address: 'ldaps://ldap-service' tls: skip_verify: true base_dn: dc=example,dc=com @@ -102,15 +102,13 @@ regulation: storage: mysql: - host: mariadb-service - port: 3306 + address: 'tcp://mariadb-service:3306' database: authelia username: admin notifier: smtp: - host: "mailcatcher-service" - port: 1025 - sender: admin@example.com + address: 'smtp://mailcatcher-service:1025' + sender: 'admin@example.com' disable_require_tls: true ... From b219a85e1280d161fbfa8c51b7bc918ed104bb84 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sun, 7 May 2023 17:51:35 +1000 Subject: [PATCH 14/67] refactor(model): use recommended semver regex (#5403) Signed-off-by: James Elliott --- internal/model/const.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/model/const.go b/internal/model/const.go index 085ef8946..3fc1604f0 100644 --- a/internal/model/const.go +++ b/internal/model/const.go @@ -22,7 +22,7 @@ const ( SecondFactorMethodDuo = "mobile_push" ) -var reSemanticVersion = regexp.MustCompile(`^v?(?P\d+)\.(?P\d+)\.(?P\d+)(\-(?P[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*))?(\+(?P[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*))?$`) +var reSemanticVersion = regexp.MustCompile(`^v?(?P0|[1-9]\d*)\.(?P0|[1-9]\d*)\.(?P0|[1-9]\d*)(?:-(?P(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+(?P[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`) const ( semverRegexpGroupPreRelease = "PreRelease" From 2116422b79673c17b20c31e8975aff2f97ce1b6a Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sun, 7 May 2023 17:52:47 +1000 Subject: [PATCH 15/67] docs: totp reference (#5404) Adds documentation for supported TOTP apps. Closes #2650 Signed-off-by: James Elliott --- .../time-based-one-time-password.md | 10 ++--- .../time-based-one-time-password-apps.md | 43 +++++++++++++++++++ 2 files changed, 47 insertions(+), 6 deletions(-) create mode 100644 docs/content/en/reference/integrations/time-based-one-time-password-apps.md diff --git a/docs/content/en/configuration/second-factor/time-based-one-time-password.md b/docs/content/en/configuration/second-factor/time-based-one-time-password.md index 1ca1c216a..09993d4bd 100644 --- a/docs/content/en/configuration/second-factor/time-based-one-time-password.md +++ b/docs/content/en/configuration/second-factor/time-based-one-time-password.md @@ -65,9 +65,8 @@ by Authelia from others. *__Important Note:__ Many TOTP applications do not support this option. It is strongly advised you find out which applications your users use and test them before changing this option. It is insufficient to test that the application -can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden] -is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option -please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).* +can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the +[Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.* [Bitwarden]: https://bitwarden.com/ @@ -88,9 +87,8 @@ information. *__Important Note:__ Some TOTP applications do not support this option. It is strongly advised you find out which applications your users use and test them before changing this option. It is insufficient to test that the application -can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden] -is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option -please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).* +can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the +[Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.* The number of digits a user needs to input to perform authentication. It's generally not recommended for this to be altered as many TOTP applications do not support anything other than 6. What's worse is some TOTP applications allow diff --git a/docs/content/en/reference/integrations/time-based-one-time-password-apps.md b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md new file mode 100644 index 000000000..1800e9365 --- /dev/null +++ b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md @@ -0,0 +1,43 @@ +--- +title: "Time-based OTP Applications" +description: "A Time-based OTP Application integration reference guide" +lead: "This section contains a Time-based OTP Application integration reference guide for Authelia." +date: 2022-11-19T16:47:09+11:00 +draft: false +images: [] +menu: + reference: + parent: "integrations" +weight: 320 +toc: true +--- + +## Settings + +Authelia allows for a wide variety of time-based OTP settings. There are several applications which can support these +algorithms and this matrix is a guide on applications that have been tested that work. It should not be assumed if an +application is on this list that the information is correct for the current version of a product and it's likely they +may now support some that were not previously supported, or in rare cases they may support less than they previously +did. + + +| Application | Algorithm: SHA1 | Algorithm: SHA256 | Algorithm: SHA512 | Digits: 6 | Digits 8 | +|:----------------------:|:------------------------------:|:------------------------------:|:------------------------------:|:------------------------------:|:-------------------------------:| +| [Google Authenticator] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | +| [Bitwarden] | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | +| [Yubico Authenticator] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | {{% support support="full" %}} | +| [Authenticator Plus] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | +| [1Password] | {{% support support="full" %}} | {{% support support="full" %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | +| [Ravio] | {{% support support="full" %}} | {{% support support="full" %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | +| [Authy] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | +| [Aegis] | {{% support support="full" %}} | {{% support %}} | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | + +[Google Authenticator]: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US&pli=1 +[Bitwarden]: https://bitwarden.com/ +[Yubico Authenticator]: https://www.yubico.com/products/yubico-authenticator/ +[Authenticator Plus]: https://www.authenticatorplus.com/ +[1Password]: https://1password.com/ +[Ravio]: https://raivo-otp.com/ +[Authy]: https://authy.com/ +[Aegis]: https://getaegis.app/ + From 3abad065a3dadec6a9e1b470f37f2f1a06c51c5e Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sun, 7 May 2023 20:28:21 +1000 Subject: [PATCH 16/67] docs: fix totp support header (#5405) Signed-off-by: James Elliott --- .../time-based-one-time-password-apps.md | 20 +------------ docs/data/support.json | 12 ++++++++ .../shortcodes/table-totp-support.html | 28 +++++++++++++++++++ 3 files changed, 41 insertions(+), 19 deletions(-) create mode 100644 docs/data/support.json create mode 100644 docs/layouts/shortcodes/table-totp-support.html diff --git a/docs/content/en/reference/integrations/time-based-one-time-password-apps.md b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md index 1800e9365..92aacfc5a 100644 --- a/docs/content/en/reference/integrations/time-based-one-time-password-apps.md +++ b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md @@ -20,24 +20,6 @@ application is on this list that the information is correct for the current vers may now support some that were not previously supported, or in rare cases they may support less than they previously did. +{{< table-totp-support >}} -| Application | Algorithm: SHA1 | Algorithm: SHA256 | Algorithm: SHA512 | Digits: 6 | Digits 8 | -|:----------------------:|:------------------------------:|:------------------------------:|:------------------------------:|:------------------------------:|:-------------------------------:| -| [Google Authenticator] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | -| [Bitwarden] | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | -| [Yubico Authenticator] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | {{% support support="full" %}} | -| [Authenticator Plus] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | -| [1Password] | {{% support support="full" %}} | {{% support support="full" %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | -| [Ravio] | {{% support support="full" %}} | {{% support support="full" %}} | {{% support %}} | {{% support support="full" %}} | {{% support %}} | -| [Authy] | {{% support support="full" %}} | {{% support %}} | {{% support %}} | {{% support %}} | {{% support support="full" %}} | -| [Aegis] | {{% support support="full" %}} | {{% support %}} | {{% support support="full" %}} | {{% support support="full" %}} | {{% support support="full" %}} | - -[Google Authenticator]: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US&pli=1 -[Bitwarden]: https://bitwarden.com/ -[Yubico Authenticator]: https://www.yubico.com/products/yubico-authenticator/ -[Authenticator Plus]: https://www.authenticatorplus.com/ -[1Password]: https://1password.com/ -[Ravio]: https://raivo-otp.com/ -[Authy]: https://authy.com/ -[Aegis]: https://getaegis.app/ diff --git a/docs/data/support.json b/docs/data/support.json new file mode 100644 index 000000000..507f9af16 --- /dev/null +++ b/docs/data/support.json @@ -0,0 +1,12 @@ +{ + "totp": [ + {"name": "Google Authenticator", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US&pli=1"}, + {"name": "Bitwarden", "clear": true, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://bitwarden.com/"}, + {"name": "Yubico Authenticator", "clear": true, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": true}, "url": "https://www.yubico.com/products/yubico-authenticator/"}, + {"name": "Authenticator Plus", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://www.authenticatorplus.com/"}, + {"name": "1Password", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://1password.com/"}, + {"name": "Ravio", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://raivo-otp.com/"}, + {"name": "Authy", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": false, "eight": true}, "url": "https://authy.com/"}, + {"name": "Aegis", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://getaegis.app/"} + ] +} diff --git a/docs/layouts/shortcodes/table-totp-support.html b/docs/layouts/shortcodes/table-totp-support.html new file mode 100644 index 000000000..4513d672b --- /dev/null +++ b/docs/layouts/shortcodes/table-totp-support.html @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + + {{- range $.Site.Data.support.totp }} + + + + + + + + + {{- end }} + +
ApplicationAlgorithmDigits
SHA1SHA256SHA51268
{{ .name }}
\ No newline at end of file From 713f8e9ab77babcdc1eed05dd7c91626b771ff24 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 8 May 2023 13:30:49 +1000 Subject: [PATCH 17/67] fix(configuration): fail to parse large int duration (#5408) Large integers used with the duration common syntax failed to parse if they exceeded the ability to fit into an int32. Signed-off-by: James Elliott --- internal/configuration/const.go | 6 + internal/configuration/decode_hooks.go | 44 +++-- internal/configuration/decode_hooks_test.go | 31 ++++ internal/configuration/provider_test.go | 13 ++ .../test_resources/config.durations.yml | 171 ++++++++++++++++++ 5 files changed, 254 insertions(+), 11 deletions(-) create mode 100644 internal/configuration/test_resources/config.durations.yml diff --git a/internal/configuration/const.go b/internal/configuration/const.go index cc9b5a6fb..7ec14716c 100644 --- a/internal/configuration/const.go +++ b/internal/configuration/const.go @@ -2,6 +2,8 @@ package configuration import ( "errors" + "math" + "time" ) // DefaultEnvPrefix is the default environment prefix. @@ -38,6 +40,10 @@ const ( errFmtDecodeHookCouldNotParseEmptyValue = "could not decode an empty value to a %s%s: %w" ) +const ( + durationMax = time.Duration(math.MaxInt64) +) + // IMPORTANT: There is an uppercase copy of this in github.com/authelia/authelia/internal/templates named // envSecretSuffixes. // Make sure you update these at the same time. diff --git a/internal/configuration/decode_hooks.go b/internal/configuration/decode_hooks.go index 1eabcfa7d..c9d4be4f5 100644 --- a/internal/configuration/decode_hooks.go +++ b/internal/configuration/decode_hooks.go @@ -9,6 +9,7 @@ import ( "net/url" "reflect" "regexp" + "strconv" "strings" "time" @@ -112,19 +113,14 @@ func StringToURLHookFunc() mapstructure.DecodeHookFuncType { } // ToTimeDurationHookFunc converts string and integer types to a time.Duration. +// +//nolint:gocyclo // Function is necessarily complex though flows well due to switch statement usage. func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType { return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { - var ptr bool - - switch f.Kind() { - case reflect.String, reflect.Int, reflect.Int32, reflect.Int64: - // We only allow string and integer from kinds to match. - break - default: - return data, nil - } - - prefixType := "" + var ( + ptr bool + prefixType string + ) if t.Kind() == reflect.Ptr { ptr = true @@ -139,6 +135,14 @@ func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType { return data, nil } + switch f.Kind() { + case reflect.String, reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Float64: + // We only allow string and integer from kinds to match. + break + default: + return data, nil + } + var result time.Duration switch { @@ -151,11 +155,29 @@ func ToTimeDurationHookFunc() mapstructure.DecodeHookFuncType { case f.Kind() == reflect.Int: seconds := data.(int) + result = time.Second * time.Duration(seconds) + case f.Kind() == reflect.Int8: + seconds := data.(int8) + + result = time.Second * time.Duration(seconds) + case f.Kind() == reflect.Int16: + seconds := data.(int16) + result = time.Second * time.Duration(seconds) case f.Kind() == reflect.Int32: seconds := data.(int32) result = time.Second * time.Duration(seconds) + case f.Kind() == reflect.Float64: + fseconds := data.(float64) + + if fseconds > durationMax.Seconds() { + result = durationMax + } else { + seconds, _ := strconv.Atoi(fmt.Sprintf("%.0f", fseconds)) + + result = time.Second * time.Duration(seconds) + } case f == expectedType: result = data.(time.Duration) case f.Kind() == reflect.Int64: diff --git a/internal/configuration/decode_hooks_test.go b/internal/configuration/decode_hooks_test.go index f9642c170..6a3b9d0df 100644 --- a/internal/configuration/decode_hooks_test.go +++ b/internal/configuration/decode_hooks_test.go @@ -6,6 +6,7 @@ import ( "crypto/rsa" "crypto/x509" "encoding/pem" + "math" "net/mail" "net/url" "reflect" @@ -345,12 +346,36 @@ func TestToTimeDurationHookFunc(t *testing.T) { want: time.Second * 60, decode: true, }, + { + desc: "ShouldDecodeInt8ToSeconds", + have: int8(90), + want: time.Second * 90, + decode: true, + }, + { + desc: "ShouldDecodeInt16ToSeconds", + have: int16(90), + want: time.Second * 90, + decode: true, + }, { desc: "ShouldDecodeInt32ToSeconds", have: int32(90), want: time.Second * 90, decode: true, }, + { + desc: "ShouldDecodeFloat64ToSeconds", + have: float64(90), + want: time.Second * 90, + decode: true, + }, + { + desc: "ShouldDecodeFloat64ToSeconds", + have: math.MaxFloat64, + want: time.Duration(math.MaxInt64), + decode: true, + }, { desc: "ShouldDecodeInt64ToSeconds", have: int64(120), @@ -375,6 +400,12 @@ func TestToTimeDurationHookFunc(t *testing.T) { want: time.Duration(0), decode: true, }, + { + desc: "ShouldSkipParsingBoolean", + have: true, + want: time.Duration(0), + decode: false, + }, { desc: "ShouldNotDecodeFromBool", have: true, diff --git a/internal/configuration/provider_test.go b/internal/configuration/provider_test.go index 98915016b..27f363d4f 100644 --- a/internal/configuration/provider_test.go +++ b/internal/configuration/provider_test.go @@ -7,6 +7,7 @@ import ( "runtime" "sort" "testing" + "time" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" @@ -86,6 +87,18 @@ func TestShouldHaveNotifier(t *testing.T) { assert.NotNil(t, config.Notifier) } +func TestShouldParseLargeIntegerDurations(t *testing.T) { + val := schema.NewStructValidator() + _, config, err := Load(val, NewDefaultSources([]string{"./test_resources/config.durations.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + assert.Len(t, val.Errors(), 0) + assert.Len(t, val.Warnings(), 0) + + assert.Equal(t, durationMax, config.Regulation.FindTime) + assert.Equal(t, time.Second*1000, config.Regulation.BanTime) +} + func TestShouldValidateConfigurationWithEnv(t *testing.T) { testSetEnv(t, "SESSION_SECRET", "abc") testSetEnv(t, "STORAGE_MYSQL_PASSWORD", "abc") diff --git a/internal/configuration/test_resources/config.durations.yml b/internal/configuration/test_resources/config.durations.yml new file mode 100644 index 000000000..f20f5d3be --- /dev/null +++ b/internal/configuration/test_resources/config.durations.yml @@ -0,0 +1,171 @@ +--- +default_redirection_url: 'https://home.example.com:8080/' + +server: + address: 'tcp://127.0.0.1:9091' + endpoints: + authz: + forward-auth: + implementation: 'ForwardAuth' + authn_strategies: + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' + ext-authz: + implementation: 'ExtAuthz' + authn_strategies: + - name: 'HeaderProxyAuthorization' + - name: 'CookieSession' + auth-request: + implementation: 'AuthRequest' + authn_strategies: + - name: 'HeaderAuthRequestProxyAuthorization' + - name: 'CookieSession' + legacy: + implementation: 'Legacy' + +log: + level: 'debug' + +totp: + issuer: 'authelia.com' + +duo_api: + hostname: 'api-123456789.example.com' + integration_key: 'ABCDEF' + +authentication_backend: + ldap: + address: 'ldap://127.0.0.1' + tls: + private_key: | + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758 + cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn + ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5 + Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa + rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp + EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU + L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+ + Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm + 9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7 + 8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV + I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7 + CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE + hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi + jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q + E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b + CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn + jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio + Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ + Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX + bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1 + otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj + HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd + tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM + USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 + 1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== + -----END RSA PRIVATE KEY----- + base_dn: 'dc=example,dc=com' + username_attribute: 'uid' + additional_users_dn: 'ou=users' + users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))' + additional_groups_dn: 'ou=groups' + groups_filter: '(&(member={dn})(objectClass=groupOfNames))' + group_name_attribute: 'cn' + mail_attribute: 'mail' + user: 'cn=admin,dc=example,dc=com' + +access_control: + default_policy: 'deny' + + rules: + # Rules applied to everyone + - domain: 'public.example.com' + policy: 'bypass' + + - domain: 'secure.example.com' + policy: 'one_factor' + # Network based rule, if not provided any network matches. + networks: + - '192.168.1.0/24' + - domain: 'secure.example.com' + policy: 'two_factor' + + - domain: ['singlefactor.example.com', 'onefactor.example.com'] + policy: 'one_factor' + + # Rules applied to 'admins' group + - domain: 'mx2.mail.example.com' + subject: 'group:admins' + policy: 'deny' + - domain: '*.example.com' + subject: 'group:admins' + policy: 'two_factor' + + # Rules applied to 'dev' group + - domain: 'dev.example.com' + resources: + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: 'two_factor' + + # Rules applied to user 'john' + - domain: 'dev.example.com' + resources: + - '^/users/john/.*$' + subject: 'user:john' + policy: 'two_factor' + + # Rules applied to 'dev' group and user 'john' + - domain: 'dev.example.com' + resources: + - '^/deny-all.*$' + subject: ['group:dev', 'user:john'] + policy: 'deny' + + # Rules applied to user 'harry' + - domain: 'dev.example.com' + resources: + - '^/users/harry/.*$' + subject: 'user:harry' + policy: 'two_factor' + + # Rules applied to user 'bob' + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: 'two_factor' + - domain: 'dev.example.com' + resources: + - '^/users/bob/.*$' + subject: 'user:bob' + policy: 'two_factor' + +session: + name: 'authelia_session' + expiration: '1h' # 1 hour + inactivity: '5m' # 5 minutes + domain: 'example.com' + redis: + host: '127.0.0.1' + port: 6379 + high_availability: + sentinel_name: 'test' + +regulation: + max_retries: 3 + find_time: 123456789123456789123 + ban_time: 1.0e3 + +storage: + mysql: + address: 'tcp://127.0.0.1:3306' + database: 'authelia' + username: 'authelia' + +notifier: + smtp: + address: 'smtp://127.0.0.1:1025' + username: 'test' + sender: 'admin@example.com' + disable_require_tls: true +... From a0deacff554e176688a4bcf91961bcdd44a76600 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 8 May 2023 13:51:17 +1000 Subject: [PATCH 18/67] refactor: misc consistency fixes (#5406) Misc consistency fixes to docs and related content. Signed-off-by: James Elliott --- .github/ISSUE_TEMPLATE/bug-report.yml | 254 ++++++++++-------- config.template.yml | 53 ++-- .../en/configuration/miscellaneous/server.md | 18 +- .../en/configuration/prologue/common.md | 62 +++-- .../en/configuration/telemetry/metrics.md | 12 +- .../time-based-one-time-password-apps.md | 2 +- internal/configuration/config.template.yml | 53 ++-- .../validator/authentication_test.go | 2 +- internal/configuration/validator/const.go | 2 +- 9 files changed, 242 insertions(+), 216 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug-report.yml b/.github/ISSUE_TEMPLATE/bug-report.yml index 5edf31148..aad2618b9 100644 --- a/.github/ISSUE_TEMPLATE/bug-report.yml +++ b/.github/ISSUE_TEMPLATE/bug-report.yml @@ -1,12 +1,12 @@ --- -name: Bug Report -description: Report a bug +name: 'Bug Report' +description: 'Report a bug' labels: - - type/bug/unconfirmed - - status/needs-triage - - priority/4/normal + - 'type/bug/unconfirmed' + - 'status/needs-triage' + - 'priority/4/normal' body: - - type: markdown + - type: 'markdown' attributes: value: | Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first. @@ -25,160 +25,190 @@ body: - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section. - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section. 7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues. - - type: dropdown - id: version + - type: 'dropdown' + id: 'version' attributes: - label: Version - description: What version(s) of Authelia can you reproduce this bug on? + label: | + Version + description: | + What version(s) of Authelia can you reproduce this bug on? multiple: true options: - - v4.37.5 - - v4.37.4 - - v4.37.3 - - v4.37.2 - - v4.37.1 - - v4.37.0 - - v4.36.9 - - v4.36.8 - - v4.36.7 - - v4.36.6 - - v4.36.5 - - v4.36.4 - - v4.36.3 - - v4.36.2 - - v4.36.1 - - v4.36.0 - - v4.35.6 - - v4.35.5 - - v4.35.4 - - v4.35.3 - - v4.35.2 - - v4.35.1 - - v4.35.0 - - v4.34.6 - - v4.34.5 - - v4.34.4 - - v4.34.3 - - v4.34.2 - - v4.34.1 - - v4.34.0 - - v4.33.2 - - v4.33.1 - - v4.33.0 - - v4.32.2 - - v4.32.1 - - v4.32.0 + - 'v4.37.5' + - 'v4.37.4' + - 'v4.37.3' + - 'v4.37.2' + - 'v4.37.1' + - 'v4.37.0' + - 'v4.36.9' + - 'v4.36.8' + - 'v4.36.7' + - 'v4.36.6' + - 'v4.36.5' + - 'v4.36.4' + - 'v4.36.3' + - 'v4.36.2' + - 'v4.36.1' + - 'v4.36.0' + - 'v4.35.6' + - 'v4.35.5' + - 'v4.35.4' + - 'v4.35.3' + - 'v4.35.2' + - 'v4.35.1' + - 'v4.35.0' + - 'v4.34.6' + - 'v4.34.5' + - 'v4.34.4' + - 'v4.34.3' + - 'v4.34.2' + - 'v4.34.1' + - 'v4.34.0' + - 'v4.33.2' + - 'v4.33.1' + - 'v4.33.0' + - 'v4.32.2' + - 'v4.32.1' + - 'v4.32.0' validations: required: true - - type: dropdown - id: deployment + - type: 'dropdown' + id: 'deployment' attributes: - label: Deployment Method - description: How are you deploying Authelia? + label: | + Deployment Method + description: | + How are you deploying Authelia? options: - - Docker - - Kubernetes - - Bare-metal - - Other + - 'Docker' + - 'Kubernetes' + - 'Bare-metal' + - 'Other' validations: required: true - - type: dropdown - id: proxy + - type: 'dropdown' + id: 'proxy' attributes: - label: Reverse Proxy - description: What reverse proxy are you using? + label: | + Reverse Proxy + description: | + What reverse proxy are you using? options: - - Caddy - - Traefik - - Envoy - - Istio - - NGINX - - SWAG - - NGINX Proxy Manager - - HAProxy + - 'Caddy' + - 'Traefik' + - 'Envoy' + - 'Istio' + - 'NGINX' + - 'SWAG' + - 'NGINX Proxy Manager' + - 'HAProxy' validations: required: true - - type: input - id: proxy-version + - type: 'input' + id: 'proxy-version' attributes: - label: Reverse Proxy Version - description: What is the version of your reverse proxy? - placeholder: x.x.x + label: | + Reverse Proxy Version + description: | + What is the version of your reverse proxy? + placeholder: 'x.x.x' validations: required: false - - type: textarea - id: description + - type: 'textarea' + id: 'description' attributes: - label: Description - description: Describe the bug. + label: | + Description + description: | + Describe the bug. validations: required: true - - type: textarea - id: reproduction + - type: 'textarea' + id: 'reproduction' attributes: - label: Reproduction - description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. + label: | + Reproduction + description: | + Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved. validations: required: true - - type: textarea - id: expectations + - type: 'textarea' + id: 'expectations' attributes: - label: Expectations - description: Describe the desired or expected results. + label: | + Expectations + description: | + Describe the desired or expected results. validations: required: false - - type: textarea - id: configuration + - type: 'textarea' + id: 'configuration' attributes: - label: Configuration (Authelia) - description: Provide a complete configuration file (the template will automatically put this content in a code block). - render: yaml + label: | + Configuration (Authelia) + description: | + Provide a complete configuration file (the template will automatically put this content in a code block). + render: 'yaml' validations: required: false - - type: textarea - id: logs + - type: 'textarea' + id: 'logs' attributes: - label: Logs (Authelia) + label: | + Logs (Authelia) description: | Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide. The template will automatically put this content in a code block so you can just paste it. - render: shell + render: 'shell' validations: required: true - - type: textarea - id: logs-other + - type: 'textarea' + id: 'logs-other' attributes: - label: Logs (Proxy / Application) - description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). - render: shell + label: | + Logs (Proxy / Application) + description: | + Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block). + render: 'shell' validations: required: false - - type: textarea - id: documentation + - type: 'textarea' + id: 'documentation' attributes: - label: Documentation - description: Provide any relevant specification or other documentation if applicable. + label: | + Documentation + description: | + Provide any relevant specification or other documentation if applicable. validations: required: false - - type: checkboxes - id: checklist + - type: 'checkboxes' + id: 'checklist' attributes: - label: Pre-Submission Checklist - description: By submitting this issue confirm all of the following. + label: | + Pre-Submission Checklist + description: | + By submitting this issue confirm all of the following. options: - - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) + - label: | + I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct) required: true - - label: This is a bug report and not a support request + - label: | + This is a bug report and not a support request required: true - - label: I have read the security policy and this bug report is not a security issue or security related issue + - label: | + I have read the security policy and this bug report is not a security issue or security related issue required: true - - label: I have either included the complete configuration file or I am sure it's unrelated to the configuration + - label: | + I have either included the complete configuration file or I am sure it's unrelated to the configuration required: true - - label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide + - label: | + I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide required: true - - label: I have checked for related proxy or application logs and included them if available + - label: | + I have checked for related proxy or application logs and included them if available required: true - - label: I have checked for related issues and checked the documentation + - label: | + I have checked for related issues and checked the documentation required: true ... diff --git a/config.template.yml b/config.template.yml index 5b7f82ad0..2319109de 100644 --- a/config.template.yml +++ b/config.template.yml @@ -90,13 +90,13 @@ server: ## Server Timeouts configuration. # timeouts: - ## Read timeout. + ## Read timeout in the duration common syntax. # read: '6s' - ## Write timeout. + ## Write timeout in the duration common syntax. # write: '6s' - ## Idle timeout. + ## Idle timeout in the duration common syntax. # idle: '30s' ## Server Endpoints configuration. @@ -171,13 +171,13 @@ telemetry: ## Metrics Server Timeouts configuration. # timeouts: - ## Read timeout. + ## Read timeout in the duration common syntax. # read: '6s' - ## Write timeout. + ## Write timeout in the duration common syntax. # write: '6s' - ## Idle timeout. + ## Idle timeout in the duration common syntax. # idle: '30s' ## @@ -223,7 +223,7 @@ webauthn: ## Disable WebAuthn. disable: false - ## Adjust the interaction timeout for WebAuthn dialogues. + ## The interaction timeout for WebAuthn dialogues in the duration common syntax. timeout: '60s' ## The display name the browser should show the user for when using WebAuthn to login/register. @@ -264,7 +264,7 @@ ntp: ## NTP version. version: 4 - ## Maximum allowed time offset between the host and the NTP server in duration common syntax. + ## Maximum allowed time offset between the host and the NTP server in the duration common syntax. max_desync: '3s' ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you @@ -293,14 +293,13 @@ authentication_backend: ## functionality. custom_url: '' - ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + ## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. - ## Duration Notation docs: https://www.authelia.com/c/common#duration ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval - refresh_interval: 5m + refresh_interval: '5m' ## ## LDAP (Authentication Provider) @@ -736,7 +735,6 @@ session: # same_site: 'lax' ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. - ## See: https://www.authelia.com/c/common#duration ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -753,30 +751,19 @@ session: ## this value to -1 disables remember me for this session cookie domain. # remember_me: '1M' - ## Cookie Session Domain default 'name' value. The name of the session cookie. + ## Cookie Session Domain default 'name' value. name: 'authelia_session' - ## Cookie Session Domain default 'same_site' value. Sets the Cookie SameSite value. Possible options are none, lax, - ## or strict. Please read https://www.authelia.com/c/session#same_site + ## Cookie Session Domain default 'same_site' value. same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. - ## See: https://www.authelia.com/c/common#duration - ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure - ## because a stolen cookie will last longer giving attackers more time to spy or attack. - - ## Cookie Session Domain default 'inactivity' value. The inactivity time before the session is reset. If expiration is - ## set to 1h, and this is set to 5m, if the user does not select the remember me option their session will get - ## destroyed after 1h, or after 5m since the last time Authelia detected user activity. + ## Cookie Session Domain default 'inactivity' value. inactivity: '5m' - ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is - ## destroyed if remember me IS NOT selected by the user. + ## Cookie Session Domain default 'expiration' value. expiration: '1h' - ## Cookie Session Domain default 'remember_me' value. The time before the cookie expires and the session is destroyed - ## if remember me IS selected by the user. Setting this value to -1 disables remember me for all session cookie - ## domains which do not have a specific 'remember_me' value. + ## Cookie Session Domain default 'remember_me' value. remember_me: '1M' ## @@ -934,11 +921,11 @@ regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 - ## The time range in duration common syntax during which the user can attempt login before being banned. The user is - ## banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. + ## The time range during which the user can attempt login before being banned in the duration common syntax. The user + ## is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. find_time: '2m' - ## The length of time in duration common syntax before a banned user can login again. + ## The length of time before a banned user can login again in the duration common syntax. ban_time: '5m' ## @@ -1441,7 +1428,7 @@ notifier: # DO NOT USE== # -----END RSA PRIVATE KEY----- - ## The lifespans configure the expiration for these token types. + ## The lifespans configure the expiration for these token types in the duration common syntax. # access_token_lifespan: '1h' # authorize_code_lifespan: '1m' # id_token_lifespan: '1h' @@ -1547,6 +1534,6 @@ notifier: # consent_mode: 'auto' ## This value controls the duration a consent on this client remains remembered when the consent mode is - ## configured as 'auto' or 'pre-configured'. + ## configured as 'auto' or 'pre-configured' in the duration common syntax. # pre_configured_consent_duration: '1w' ... diff --git a/docs/content/en/configuration/miscellaneous/server.md b/docs/content/en/configuration/miscellaneous/server.md index de1bfb205..e0cc0a538 100644 --- a/docs/content/en/configuration/miscellaneous/server.md +++ b/docs/content/en/configuration/miscellaneous/server.md @@ -22,6 +22,7 @@ aliases: ```yaml server: address: 'tcp://:9091' + umask: 0022 path: '' disable_healthcheck: false tls: @@ -67,7 +68,7 @@ see the [documentation](../prologue/common.md#address) on this format for more i Configures the listener address for the Main HTTP Server. The address itself is a listener and the scheme must either be the `unix` scheme or one of the `tcp` schemes. -__Example:__ +__Examples:__ ```yaml server: @@ -83,8 +84,15 @@ server: {{< confkey type="int" required="no" >}} -If set temporarily changes the Umask during the creation of the unix domain socket if configured as such in the -[address](#address). +If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the +[address](#address). Typically this should be set before the process is actually running and users should not use this +option, however it's recognized in various specific scenarios this may not be completely adequate. + +One such example is when you want the proxy to have permission to the socket but not the files, in which case running a +umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has +permission to the socket. + +This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly. ### path @@ -203,11 +211,11 @@ Enables the go [pprof](https://pkg.go.dev/net/http/pprof) endpoints. #### enable_expvars +{{< confkey type="boolean" default="false" required="no" >}} + *__Security Note:__ This is a developer endpoint. __DO NOT__ enable it unless you know why you're enabling it. __DO NOT__ enable this in production.* -{{< confkey type="boolean" default="false" required="no" >}} - Enables the go [expvar](https://pkg.go.dev/expvar) endpoints. #### authz diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index 4e8f54a95..bea8f06dc 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -24,24 +24,9 @@ guide on configuring any particular instance. The base type for this syntax is a string, and it also handles integers however this is discouraged. -We have implemented a string/integer based syntax for configuration options that take a duration of time. This section -describes the implementation of this. You can use this implementation in various areas of configuration such as: - -* session: - * expiration - * inactivity - * remember_me -* regulation: - * ban_time - * find_time -* ntp: - * max_desync -* webauthn: - * timeout - -The way this format works is you can either configure an integer or a string in the specific configuration areas. If you -supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in blocks -of quantities and units (number followed by a unit letter). For example `5h` indicates a quantity of 5 units of `h`. +If you supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in +blocks of quantities and units (number followed by a unit letter). For example `5h` indicates a quantity of 5 units +of `h`. The following is ignored: - all spaces @@ -104,20 +89,44 @@ portions. Required portions may exist within optional portions, in which case th format specific text which indicates if the accompanying text exists then it is actually required, otherwise it's entirely optional. -The connector address values take the following formats: +The square brackets indicate optional sections, and the angled brackets indicate required sections. The following +sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration +requirement that one of these is provided. + +##### Hostname + +The following format represents the hostname format. It's valid for both a listener and connector in most instances. +Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and port +are optional. The default for these when not provided varies. ```text [://][:] +``` + +##### Port + +The following format represents the port format. It's valid only for a listener in most instances. +Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and +hostname are optional. The default for the scheme when not provided varies, and the default for the hostname is all +available addresses when not provided. + +```text +[://][hostname]: +``` + +##### Unix Domain Socket + +The following format represents the unix domain socket format. It's valid for both a listener and connector in most +instances. Refer to the individual documentation for an option for clarity. In this format as per the notation there +are no optional portions. + +```text unix:// ``` -The listener address values take the following additional formats: +##### Examples -```text -[://]: -``` - -Examples: +Various examples for these formats. ```text 0.0.0.0 @@ -131,9 +140,6 @@ udp://:123 unix:///var/lib/authelia.sock ``` -The square brackets indicate optional sections, and the angled brackets indicate required sections. The following -sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration -requirement that one of these is provided. #### scheme diff --git a/docs/content/en/configuration/telemetry/metrics.md b/docs/content/en/configuration/telemetry/metrics.md index 4e277752d..21779ed0b 100644 --- a/docs/content/en/configuration/telemetry/metrics.md +++ b/docs/content/en/configuration/telemetry/metrics.md @@ -23,6 +23,7 @@ telemetry: metrics: enabled: false address: 'tcp://:9959' + umask: 0022 buffers: read: 4096 write: 4096 @@ -56,8 +57,15 @@ the scheme must either be the `unix` scheme or one of the `tcp` schemes. {{< confkey type="int" required="no" >}} -If set temporarily changes the Umask during the creation of the unix domain socket if configured as such in the -[address](#address). +If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the +[address](#address). Typically this should be set before the process is actually running and users should not use this +option, however it's recognized in various specific scenarios this may not be completely adequate. + +One such example is when you want the proxy to have permission to the socket but not the files, in which case running a +umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has +permission to the socket. + +This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly. ### buffers diff --git a/docs/content/en/reference/integrations/time-based-one-time-password-apps.md b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md index 92aacfc5a..2d8c63931 100644 --- a/docs/content/en/reference/integrations/time-based-one-time-password-apps.md +++ b/docs/content/en/reference/integrations/time-based-one-time-password-apps.md @@ -2,7 +2,7 @@ title: "Time-based OTP Applications" description: "A Time-based OTP Application integration reference guide" lead: "This section contains a Time-based OTP Application integration reference guide for Authelia." -date: 2022-11-19T16:47:09+11:00 +date: 2023-05-07T17:52:47+10:00 draft: false images: [] menu: diff --git a/internal/configuration/config.template.yml b/internal/configuration/config.template.yml index 5b7f82ad0..2319109de 100644 --- a/internal/configuration/config.template.yml +++ b/internal/configuration/config.template.yml @@ -90,13 +90,13 @@ server: ## Server Timeouts configuration. # timeouts: - ## Read timeout. + ## Read timeout in the duration common syntax. # read: '6s' - ## Write timeout. + ## Write timeout in the duration common syntax. # write: '6s' - ## Idle timeout. + ## Idle timeout in the duration common syntax. # idle: '30s' ## Server Endpoints configuration. @@ -171,13 +171,13 @@ telemetry: ## Metrics Server Timeouts configuration. # timeouts: - ## Read timeout. + ## Read timeout in the duration common syntax. # read: '6s' - ## Write timeout. + ## Write timeout in the duration common syntax. # write: '6s' - ## Idle timeout. + ## Idle timeout in the duration common syntax. # idle: '30s' ## @@ -223,7 +223,7 @@ webauthn: ## Disable WebAuthn. disable: false - ## Adjust the interaction timeout for WebAuthn dialogues. + ## The interaction timeout for WebAuthn dialogues in the duration common syntax. timeout: '60s' ## The display name the browser should show the user for when using WebAuthn to login/register. @@ -264,7 +264,7 @@ ntp: ## NTP version. version: 4 - ## Maximum allowed time offset between the host and the NTP server in duration common syntax. + ## Maximum allowed time offset between the host and the NTP server in the duration common syntax. max_desync: '3s' ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you @@ -293,14 +293,13 @@ authentication_backend: ## functionality. custom_url: '' - ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + ## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. - ## Duration Notation docs: https://www.authelia.com/c/common#duration ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval - refresh_interval: 5m + refresh_interval: '5m' ## ## LDAP (Authentication Provider) @@ -736,7 +735,6 @@ session: # same_site: 'lax' ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. - ## See: https://www.authelia.com/c/common#duration ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. @@ -753,30 +751,19 @@ session: ## this value to -1 disables remember me for this session cookie domain. # remember_me: '1M' - ## Cookie Session Domain default 'name' value. The name of the session cookie. + ## Cookie Session Domain default 'name' value. name: 'authelia_session' - ## Cookie Session Domain default 'same_site' value. Sets the Cookie SameSite value. Possible options are none, lax, - ## or strict. Please read https://www.authelia.com/c/session#same_site + ## Cookie Session Domain default 'same_site' value. same_site: 'lax' - ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax. - ## See: https://www.authelia.com/c/common#duration - ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure - ## because a stolen cookie will last longer giving attackers more time to spy or attack. - - ## Cookie Session Domain default 'inactivity' value. The inactivity time before the session is reset. If expiration is - ## set to 1h, and this is set to 5m, if the user does not select the remember me option their session will get - ## destroyed after 1h, or after 5m since the last time Authelia detected user activity. + ## Cookie Session Domain default 'inactivity' value. inactivity: '5m' - ## Cookie Session Domain default 'expiration' value. The time before the session cookie expires and the session is - ## destroyed if remember me IS NOT selected by the user. + ## Cookie Session Domain default 'expiration' value. expiration: '1h' - ## Cookie Session Domain default 'remember_me' value. The time before the cookie expires and the session is destroyed - ## if remember me IS selected by the user. Setting this value to -1 disables remember me for all session cookie - ## domains which do not have a specific 'remember_me' value. + ## Cookie Session Domain default 'remember_me' value. remember_me: '1M' ## @@ -934,11 +921,11 @@ regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 - ## The time range in duration common syntax during which the user can attempt login before being banned. The user is - ## banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. + ## The time range during which the user can attempt login before being banned in the duration common syntax. The user + ## is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window. find_time: '2m' - ## The length of time in duration common syntax before a banned user can login again. + ## The length of time before a banned user can login again in the duration common syntax. ban_time: '5m' ## @@ -1441,7 +1428,7 @@ notifier: # DO NOT USE== # -----END RSA PRIVATE KEY----- - ## The lifespans configure the expiration for these token types. + ## The lifespans configure the expiration for these token types in the duration common syntax. # access_token_lifespan: '1h' # authorize_code_lifespan: '1m' # id_token_lifespan: '1h' @@ -1547,6 +1534,6 @@ notifier: # consent_mode: 'auto' ## This value controls the duration a consent on this client remains remembered when the consent mode is - ## configured as 'auto' or 'pre-configured'. + ## configured as 'auto' or 'pre-configured' in the duration common syntax. # pre_configured_consent_duration: '1w' ... diff --git a/internal/configuration/validator/authentication_test.go b/internal/configuration/validator/authentication_test.go index fa5c4830d..a606348ce 100644 --- a/internal/configuration/validator/authentication_test.go +++ b/internal/configuration/validator/authentication_test.go @@ -759,7 +759,7 @@ func (suite *LDAPAuthenticationBackendSuite) TestShouldRaiseOnBadRefreshInterval suite.Len(suite.validator.Warnings(), 0) suite.Require().Len(suite.validator.Errors(), 1) - suite.EqualError(suite.validator.Errors()[0], "authentication_backend: option 'refresh_interval' is configured to 'blah' but it must be either a duration notation or one of 'disable', or 'always': could not parse 'blah' as a duration") + suite.EqualError(suite.validator.Errors()[0], "authentication_backend: option 'refresh_interval' is configured to 'blah' but it must be either in duration common syntax or one of 'disable', or 'always': could not parse 'blah' as a duration") } func (suite *LDAPAuthenticationBackendSuite) TestShouldSetDefaultImplementation() { diff --git a/internal/configuration/validator/const.go b/internal/configuration/validator/const.go index d96bfc1bb..63be6a4fc 100644 --- a/internal/configuration/validator/const.go +++ b/internal/configuration/validator/const.go @@ -79,7 +79,7 @@ const ( errFmtAuthBackendMultipleConfigured = "authentication_backend: please ensure only one of the 'file' or 'ldap' " + "backend is configured" errFmtAuthBackendRefreshInterval = "authentication_backend: option 'refresh_interval' is configured to '%s' but " + - "it must be either a duration notation or one of 'disable', or 'always': %w" + "it must be either in duration common syntax or one of 'disable', or 'always': %w" errFmtAuthBackendPasswordResetCustomURLScheme = "authentication_backend: password_reset: option 'custom_url' is" + " configured to '%s' which has the scheme '%s' but the scheme must be either 'http' or 'https'" From d77bd901da35fde93c8f39e8132c64b18a391bac Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 8 May 2023 14:08:28 +1000 Subject: [PATCH 19/67] docs: fix netlify next (#5409) Signed-off-by: James Elliott --- docs/config/next/config.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/config/next/config.toml b/docs/config/next/config.toml index e0b6dd4bd..f11ccfc89 100644 --- a/docs/config/next/config.toml +++ b/docs/config/next/config.toml @@ -1 +1 @@ -baseurl = "https://authelia-staging.netlify.app/" +baseurl = "https://authelia-next.netlify.app/" From 41afaa5cc25b2159486bd419181e2a113f9dea92 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 8 May 2023 14:26:12 +1000 Subject: [PATCH 20/67] docs: factorize (#5410) Signed-off-by: James Elliott --- .../en/configuration/prologue/common.md | 39 ++++++------------- 1 file changed, 12 insertions(+), 27 deletions(-) diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index bea8f06dc..5d6162dc3 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -36,34 +36,19 @@ While you can use multiple of these blocks in combination, we suggest keeping it #### Unit Legend -##### Short Units +The following is a legend for the unit formats available in this syntax. The long form units are only available from +v4.38.0 or newer. -These values have been available for a long time. - -| Unit | Associated Letter | -|:-------:|:-----------------:| -| Years | y | -| Months | M | -| Weeks | w | -| Days | d | -| Hours | h | -| Minutes | m | -| Seconds | s | - -##### Long Units - -These values are more human readable but have only been available since v4.38.0. - -| Unit | Human Readable Long Unit | -|:------------:|:-----------------------------:| -| Years | `year`, `years` | -| Months | `month`, `months` | -| Weeks | `week`, `weeks` | -| Days | `day`, `days` | -| Hours | `hour`, `hours` | -| Minutes | `minute`, `minutes` | -| Seconds | `second`, `seconds` | -| Milliseconds | `millisecond`, `milliseconds` | +| Unit | Short Unit | Human Readable Long Unit | +|:------------:|:----------:|:-----------------------------:| +| Years | `y` | `year`, `years` | +| Months | `M` | `month`, `months` | +| Weeks | `w` | `week`, `weeks` | +| Days | `d` | `day`, `days` | +| Hours | `h` | `hour`, `hours` | +| Minutes | `m` | `minute`, `minutes` | +| Seconds | `s` | `second`, `seconds` | +| Milliseconds | `ms` | `millisecond`, `milliseconds` | #### Examples From 998ffe52551a741c2540d8ca2957573c203677ec Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 8 May 2023 15:57:11 +1000 Subject: [PATCH 21/67] refactor: strip word and from duration (#5412) Signed-off-by: James Elliott --- .../content/en/configuration/prologue/common.md | 17 ++++++++++------- internal/utils/time.go | 2 ++ internal/utils/time_test.go | 17 +++++++++++++++++ 3 files changed, 29 insertions(+), 7 deletions(-) diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index 5d6162dc3..06455d23d 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -28,11 +28,14 @@ If you supply an integer, it is considered a representation of seconds. If you s blocks of quantities and units (number followed by a unit letter). For example `5h` indicates a quantity of 5 units of `h`. -The following is ignored: +The following is ignored or stripped from the input: - all spaces - leading zeros + - the word `and` -While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. +While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. In +addition it's important to note that the format while somewhat human readable still requires you closely follow the +expected formats. #### Unit Legend @@ -52,11 +55,11 @@ v4.38.0 or newer. #### Examples -| Desired Value | Configuration Examples | -|:---------------------:|:-------------------------------------:| -| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` | -| 1 day | `1d` or `24h` or `86400` or `86400s` | -| 10 hours | `10h` or `600m` or `9h60m` or `36000` | +| Desired Value | Configuration Examples (Short) | Configuration Examples (Long) | +|:---------------------:|:-------------------------------------:|:---------------------------------------:| +| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` | `1 hour and 30 mninutes` | +| 1 day | `1d` or `24h` or `86400` or `86400s` | `1 day` | +| 10 hours | `10h` or `600m` or `9h60m` or `36000` | `10 hours` | ### Address diff --git a/internal/utils/time.go b/internal/utils/time.go index c044f899a..19884784a 100644 --- a/internal/utils/time.go +++ b/internal/utils/time.go @@ -13,6 +13,8 @@ func StandardizeDurationString(input string) (output string, err error) { return "0s", nil } + input = strings.ReplaceAll(input, "and", "") + matches := reDurationStandard.FindAllStringSubmatch(strings.ReplaceAll(input, " ", ""), -1) if len(matches) == 0 { diff --git a/internal/utils/time_test.go b/internal/utils/time_test.go index 39b011fa6..d1e1b6681 100644 --- a/internal/utils/time_test.go +++ b/internal/utils/time_test.go @@ -109,6 +109,23 @@ func TestParseDurationString(t *testing.T) { } } +func TestStandardizeDurationString(t *testing.T) { + var ( + actual string + err error + ) + + actual, err = StandardizeDurationString("1 hour and 20 minutes") + + assert.NoError(t, err) + assert.Equal(t, "1h20m", actual) + + actual, err = StandardizeDurationString("1 hour and 20 minutes") + + assert.NoError(t, err) + assert.Equal(t, "1h20m", actual) +} + func TestParseDurationString_ShouldNotParseDurationStringWithOutOfOrderQuantitiesAndUnits(t *testing.T) { duration, err := ParseDurationString("h1") From 83cd09db799277b9409eedd01286208f8bef5a8e Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 8 May 2023 16:02:59 +1000 Subject: [PATCH 22/67] docs: factorize (#5411) Signed-off-by: James Elliott --- .../content/en/configuration/first-factor/ldap.md | 11 +++++++---- .../en/configuration/miscellaneous/server.md | 14 ++++++++++---- .../en/configuration/notifications/smtp.md | 7 +++++-- docs/content/en/configuration/prologue/common.md | 15 +++++++++++++++ docs/content/en/configuration/session/redis.md | 8 ++++++-- docs/content/en/configuration/storage/mysql.md | 6 +++++- docs/content/en/configuration/storage/postgres.md | 6 +++++- .../content/en/configuration/telemetry/metrics.md | 14 ++++++++++---- 8 files changed, 63 insertions(+), 18 deletions(-) diff --git a/docs/content/en/configuration/first-factor/ldap.md b/docs/content/en/configuration/first-factor/ldap.md index aebd73f46..5e6a7815c 100644 --- a/docs/content/en/configuration/first-factor/ldap.md +++ b/docs/content/en/configuration/first-factor/ldap.md @@ -121,8 +121,8 @@ This section describes the individual configuration options. {{< confkey type="string" required="yes" >}} -*__Reference Note:__ This configuration option uses the [Address](../prologue/common.md#address) format. Please see the -[documentation](../prologue/common.md#address) on this format for more information.* +*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please +see the [documentation](../prologue/common.md#address) on this format for more information.* The LDAP URL which consists of a scheme, hostname, and port. Format is `[://][:]`. The default scheme is `ldapi` if the path is absolute otherwise it's `ldaps`, and the permitted schemes are `ldap`, `ldaps`, or @@ -173,8 +173,11 @@ URL's are slightly more secure. ### tls -Controls the TLS connection validation process. You can see how to configure the tls -section [here](../prologue/common.md#tls-configuration). +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + +Controls the TLS connection validation parameters for either StartTLS or the TLS socket. ### base_dn diff --git a/docs/content/en/configuration/miscellaneous/server.md b/docs/content/en/configuration/miscellaneous/server.md index e0cc0a538..683590747 100644 --- a/docs/content/en/configuration/miscellaneous/server.md +++ b/docs/content/en/configuration/miscellaneous/server.md @@ -190,13 +190,19 @@ research about how browsers utilize and understand this header before attempting ### buffers -Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server buffers common structure](../prologue/common.md#server-buffers). Please see the +[documentation](../prologue/common.md#server-buffers) on this structure for more information.* + +Configures the server buffers. ### timeouts -Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the +[documentation](../prologue/common.md#server-timeouts) on this structure for more information.* + +Configures the server timeouts. ### endpoints diff --git a/docs/content/en/configuration/notifications/smtp.md b/docs/content/en/configuration/notifications/smtp.md index bd879e0e5..8c537e58c 100644 --- a/docs/content/en/configuration/notifications/smtp.md +++ b/docs/content/en/configuration/notifications/smtp.md @@ -232,8 +232,11 @@ mixed emails which contain both HTML and text so this option is rarely necessary ### tls -Controls the TLS connection validation process. You can see how to configure the tls section -[here](../prologue/common.md#tls-configuration). +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + +Controls the TLS connection validation parameters for either StartTLS or the TLS socket. ## Using Gmail diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index 06455d23d..67446637e 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -205,6 +205,11 @@ guide on configuring any particular instance. Various sections of the configuration use a uniform configuration section called TLS. Notably LDAP and SMTP. This section documents the usage. +Various sections of the configuration use a uniform configuration section called `tls` which configure TLS socket and +TLS verification parameters. Notably the [LDAP](../first-factor/ldap.md#tls), [SMTP](../notifications/smtp.md#tls), +[PostgreSQL](../storage/postgres.md#tls), [MySQL](../storage/mysql.md#tls), and [Redis](../session/redis.md#tls) +sections. This section documents the common parts of this structure. + #### server_name {{< confkey type="string" required="no" >}} @@ -263,6 +268,11 @@ is provided, in top down order, each certificate must be signed by the next cert ### Server Buffers +Various sections of the configuration use a uniform configuration section called `buffers` which configure HTTP server +buffers. Notably the [server](../miscellaneous/server.md#buffers) and +[metrics telemetry](../telemetry/metrics.md#buffers) sections. This section documents the common parts of this +structure. + #### read {{< confkey type="integer" default="4096" required="no" >}} @@ -277,6 +287,11 @@ Configures the maximum response size. The default of 4096 is generally sufficien ### Server Timeouts +Various sections of the configuration use a uniform configuration section called `timeouts` which configure HTTP server +timeouts. Notably the [server](../miscellaneous/server.md#timeouts) and +[metrics telemetry](../telemetry/metrics.md#timeouts) sections. This section documents the common parts of this +structure. + #### read {{< confkey type="duration" default="6s" required="no" >}} diff --git a/docs/content/en/configuration/session/redis.md b/docs/content/en/configuration/session/redis.md index fe8a8de01..e663a4b42 100644 --- a/docs/content/en/configuration/session/redis.md +++ b/docs/content/en/configuration/session/redis.md @@ -182,8 +182,12 @@ is useful if there are long delays in establishing connections. ### tls -If defined enables [redis] over TLS, and additionally controls the TLS connection validation process. You can see how to -configure the tls section [here](../prologue/common.md#tls-configuration). +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + +If defined enables connecting to [redis] over a TLS socket, and additionally controls the TLS connection +validation parameters. ### high_availability diff --git a/docs/content/en/configuration/storage/mysql.md b/docs/content/en/configuration/storage/mysql.md index bbe02ff0a..f638d0c45 100644 --- a/docs/content/en/configuration/storage/mysql.md +++ b/docs/content/en/configuration/storage/mysql.md @@ -182,8 +182,12 @@ The SQL connection timeout. ### tls +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + If defined enables connecting to [MySQL] or [MariaDB] over a TLS socket, and additionally controls the TLS connection -validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration). +validation parameters. [MySQL]: https://www.mysql.com/ [MariaDB]: https://mariadb.org/ diff --git a/docs/content/en/configuration/storage/postgres.md b/docs/content/en/configuration/storage/postgres.md index f7ca07238..993f3c978 100644 --- a/docs/content/en/configuration/storage/postgres.md +++ b/docs/content/en/configuration/storage/postgres.md @@ -188,7 +188,11 @@ The SQL connection timeout. ### tls +*__Reference Note:__ This configuration option uses the +[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the +[documentation](../prologue/common.md#tls-configuration) on this structure for more information.* + If defined enables connecting to [PostgreSQL] over a TLS socket, and additionally controls the TLS connection -validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration). +validation parameters. [PostgreSQL]: https://www.postgresql.org/ diff --git a/docs/content/en/configuration/telemetry/metrics.md b/docs/content/en/configuration/telemetry/metrics.md index 21779ed0b..4c9b3acbf 100644 --- a/docs/content/en/configuration/telemetry/metrics.md +++ b/docs/content/en/configuration/telemetry/metrics.md @@ -69,13 +69,19 @@ This value should typically be prefixed with a `0` to ensure the relevant parser ### buffers -Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server buffers common structure](../prologue/common.md#server-buffers). Please see the +[documentation](../prologue/common.md#server-buffers) on this structure for more information.* + +Configures the server buffers. ### timeouts -Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more -information. +*__Reference Note:__ This configuration option uses the +[Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the +[documentation](../prologue/common.md#server-timeouts) on this structure for more information.* + +Configures the server timeouts. ## See More From 47001336828a9cde61172b847be7ecb8ad5c6f8d Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 8 May 2023 20:30:32 +1000 Subject: [PATCH 23/67] docs: fix typo (#5413) Signed-off-by: James Elliott --- docs/content/en/configuration/prologue/common.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index 67446637e..b4c10dbc5 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -55,11 +55,11 @@ v4.38.0 or newer. #### Examples -| Desired Value | Configuration Examples (Short) | Configuration Examples (Long) | -|:---------------------:|:-------------------------------------:|:---------------------------------------:| -| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` | `1 hour and 30 mninutes` | -| 1 day | `1d` or `24h` or `86400` or `86400s` | `1 day` | -| 10 hours | `10h` or `600m` or `9h60m` or `36000` | `10 hours` | +| Desired Value | Configuration Examples (Short) | Configuration Examples (Long) | +|:---------------------:|:-------------------------------------:|:--------------------------------------:| +| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` | `1 hour and 30 minutes` | +| 1 day | `1d` or `24h` or `86400` or `86400s` | `1 day` | +| 10 hours | `10h` or `600m` or `9h60m` or `36000` | `10 hours` | ### Address From 104b784122c4e31ff2155969026842118bd8e0a2 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 9 May 2023 08:19:54 +1000 Subject: [PATCH 24/67] build(deps): update typescript-eslint monorepo to v5.59.5 (#5415) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 4 +- web/pnpm-lock.yaml | 124 +++++++++++++++++++++------------------------ 2 files changed, 60 insertions(+), 68 deletions(-) diff --git a/web/package.json b/web/package.json index e7133e5e3..0b4113346 100644 --- a/web/package.json +++ b/web/package.json @@ -76,8 +76,8 @@ "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", "@types/zxcvbn": "4.4.1", - "@typescript-eslint/eslint-plugin": "5.59.2", - "@typescript-eslint/parser": "5.59.2", + "@typescript-eslint/eslint-plugin": "5.59.5", + "@typescript-eslint/parser": "5.59.5", "@vitejs/plugin-react": "4.0.0", "@vitest/coverage-istanbul": "0.31.0", "esbuild": "0.17.18", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index c43e90f34..ab4c61cd9 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -106,11 +106,11 @@ devDependencies: specifier: 4.4.1 version: 4.4.1 '@typescript-eslint/eslint-plugin': - specifier: 5.59.2 - version: 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + specifier: 5.59.5 + version: 5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4) '@typescript-eslint/parser': - specifier: 5.59.2 - version: 5.59.2(eslint@8.40.0)(typescript@5.0.4) + specifier: 5.59.5 + version: 5.59.5(eslint@8.40.0)(typescript@5.0.4) '@vitejs/plugin-react': specifier: 4.0.0 version: 4.0.0(vite@4.3.5) @@ -134,10 +134,10 @@ devDependencies: version: 1.0.5 eslint-import-resolver-typescript: specifier: 3.5.5 - version: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0) + version: 3.5.5(@typescript-eslint/parser@5.59.5)(eslint-plugin-import@2.27.5)(eslint@8.40.0) eslint-plugin-import: specifier: 2.27.5 - version: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + version: 2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) eslint-plugin-jsx-a11y: specifier: 6.7.1 version: 6.7.1(eslint@8.40.0) @@ -2906,8 +2906,8 @@ packages: resolution: {integrity: sha512-3NoqvZC2W5gAC5DZbTpCeJ251vGQmgcWIHQJGq2J240HY6ErQ9aWKkwfoKJlHLx+A83WPNTZ9+3cd2ILxbvr1w==} dev: true - /@typescript-eslint/eslint-plugin@5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-yVrXupeHjRxLDcPKL10sGQ/QlVrA8J5IYOEWVqk0lJaSZP7X5DfnP7Ns3cc74/blmbipQ1htFNVGsHX6wsYm0A==} + /@typescript-eslint/eslint-plugin@5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-feA9xbVRWJZor+AnLNAr7A8JRWeZqHUf4T9tlP+TN04b05pFVhO5eN7/O93Y/1OUlLMHKbnJisgDURs/qvtqdg==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: '@typescript-eslint/parser': ^5.0.0 @@ -2918,16 +2918,16 @@ packages: optional: true dependencies: '@eslint-community/regexpp': 4.5.0 - '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) - '@typescript-eslint/scope-manager': 5.59.2 - '@typescript-eslint/type-utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.5 + '@typescript-eslint/type-utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 eslint: 8.40.0 grapheme-splitter: 1.0.4 ignore: 5.2.4 natural-compare-lite: 1.4.0 - semver: 7.4.0 + semver: 7.5.0 tsutils: 3.21.0(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: @@ -2947,8 +2947,8 @@ packages: - typescript dev: true - /@typescript-eslint/parser@5.59.2(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-uq0sKyw6ao1iFOZZGk9F8Nro/8+gfB5ezl1cA06SrqbgJAt0SRoFhb9pXaHvkrxUpZaoLxt8KlovHNk8Gp6/HQ==} + /@typescript-eslint/parser@5.59.5(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-NJXQC4MRnF9N9yWqQE2/KLRSOLvrrlZb48NGVfBa+RuPMN6B7ZcK5jZOvhuygv4D64fRKnZI4L4p8+M+rfeQuw==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -2957,9 +2957,9 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/scope-manager': 5.59.2 - '@typescript-eslint/types': 5.59.2 - '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.5 + '@typescript-eslint/types': 5.59.5 + '@typescript-eslint/typescript-estree': 5.59.5(typescript@5.0.4) debug: 4.3.4 eslint: 8.40.0 typescript: 5.0.4 @@ -2975,16 +2975,16 @@ packages: '@typescript-eslint/visitor-keys': 5.58.0 dev: true - /@typescript-eslint/scope-manager@5.59.2: - resolution: {integrity: sha512-dB1v7ROySwQWKqQ8rEWcdbTsFjh2G0vn8KUyvTXdPoyzSL6lLGkiXEV5CvpJsEe9xIdKV+8Zqb7wif2issoOFA==} + /@typescript-eslint/scope-manager@5.59.5: + resolution: {integrity: sha512-jVecWwnkX6ZgutF+DovbBJirZcAxgxC0EOHYt/niMROf8p4PwxxG32Qdhj/iIQQIuOflLjNkxoXyArkcIP7C3A==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: - '@typescript-eslint/types': 5.59.2 - '@typescript-eslint/visitor-keys': 5.59.2 + '@typescript-eslint/types': 5.59.5 + '@typescript-eslint/visitor-keys': 5.59.5 dev: true - /@typescript-eslint/type-utils@5.59.2(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-b1LS2phBOsEy/T381bxkkywfQXkV1dWda/z0PhnIy3bC5+rQWQDS7fk9CSpcXBccPY27Z6vBEuaPBCKCgYezyQ==} + /@typescript-eslint/type-utils@5.59.5(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-4eyhS7oGym67/pSxA2mmNq7X164oqDYNnZCUayBwJZIRVvKpBCMBzFnFxjeoDeShjtO6RQBHBuwybuX3POnDqg==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: '*' @@ -2993,8 +2993,8 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/typescript-estree': 5.59.5(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 eslint: 8.40.0 tsutils: 3.21.0(typescript@5.0.4) @@ -3008,8 +3008,8 @@ packages: engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true - /@typescript-eslint/types@5.59.2: - resolution: {integrity: sha512-LbJ/HqoVs2XTGq5shkiKaNTuVv5tTejdHgfdjqRUGdYhjW1crm/M7og2jhVskMt8/4wS3T1+PfFvL1K3wqYj4w==} + /@typescript-eslint/types@5.59.5: + resolution: {integrity: sha512-xkfRPHbqSH4Ggx4eHRIO/eGL8XL4Ysb4woL8c87YuAo8Md7AUjyWKa9YMwTL519SyDPrfEgKdewjkxNCVeJW7w==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true @@ -3034,8 +3034,8 @@ packages: - supports-color dev: true - /@typescript-eslint/typescript-estree@5.59.2(typescript@5.0.4): - resolution: {integrity: sha512-+j4SmbwVmZsQ9jEyBMgpuBD0rKwi9RxRpjX71Brr73RsYnEr3Lt5QZ624Bxphp8HUkSKfqGnPJp1kA5nl0Sh7Q==} + /@typescript-eslint/typescript-estree@5.59.5(typescript@5.0.4): + resolution: {integrity: sha512-+XXdLN2CZLZcD/mO7mQtJMvCkzRfmODbeSKuMY/yXbGkzvA9rJyDY5qDYNoiz2kP/dmyAxXquL2BvLQLJFPQIg==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: typescript: '*' @@ -3043,12 +3043,12 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/types': 5.59.2 - '@typescript-eslint/visitor-keys': 5.59.2 + '@typescript-eslint/types': 5.59.5 + '@typescript-eslint/visitor-keys': 5.59.5 debug: 4.3.4 globby: 11.1.0 is-glob: 4.0.3 - semver: 7.4.0 + semver: 7.5.0 tsutils: 3.21.0(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: @@ -3075,8 +3075,8 @@ packages: - typescript dev: true - /@typescript-eslint/utils@5.59.2(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-kSuF6/77TZzyGPhGO4uVp+f0SBoYxCDf+lW3GKhtKru/L8k/Hd7NFQxyWUeY7Z/KGB2C6Fe3yf2vVi4V9TsCSQ==} + /@typescript-eslint/utils@5.59.5(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-sCEHOiw+RbyTii9c3/qN74hYDPNORb8yWCoPLmB7BIflhplJ65u2PBpdRla12e3SSTJ2erRkPjz7ngLHhUegxA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -3084,12 +3084,12 @@ packages: '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@types/json-schema': 7.0.11 '@types/semver': 7.3.13 - '@typescript-eslint/scope-manager': 5.59.2 - '@typescript-eslint/types': 5.59.2 - '@typescript-eslint/typescript-estree': 5.59.2(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.5 + '@typescript-eslint/types': 5.59.5 + '@typescript-eslint/typescript-estree': 5.59.5(typescript@5.0.4) eslint: 8.40.0 eslint-scope: 5.1.1 - semver: 7.4.0 + semver: 7.5.0 transitivePeerDependencies: - supports-color - typescript @@ -3103,11 +3103,11 @@ packages: eslint-visitor-keys: 3.4.1 dev: true - /@typescript-eslint/visitor-keys@5.59.2: - resolution: {integrity: sha512-EEpsO8m3RASrKAHI9jpavNv9NlEUebV4qmF1OWxSTtKSFBpC1NCmWazDQHFivRf0O1DV11BA645yrLEVQ0/Lig==} + /@typescript-eslint/visitor-keys@5.59.5: + resolution: {integrity: sha512-qL+Oz+dbeBRTeyJTIy0eniD3uvqU7x+y1QceBismZ41hd4aBSRh8UAw4pZP0+XzLuPZmx4raNMq/I+59W2lXKA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: - '@typescript-eslint/types': 5.59.2 + '@typescript-eslint/types': 5.59.5 eslint-visitor-keys: 3.4.1 dev: true @@ -4386,14 +4386,14 @@ packages: '@babel/core': 7.21.4 '@babel/eslint-parser': 7.21.3(@babel/core@7.21.4)(eslint@8.40.0) '@rushstack/eslint-patch': 1.2.0 - '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) - '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/eslint-plugin': 5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) babel-preset-react-app: 10.0.1 confusing-browser-globals: 1.0.11 eslint: 8.40.0 eslint-plugin-flowtype: 8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.40.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) - eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.5)(eslint@8.40.0)(typescript@5.0.4) eslint-plugin-jsx-a11y: 6.7.1(eslint@8.40.0) eslint-plugin-react: 7.32.2(eslint@8.40.0) eslint-plugin-react-hooks: 4.6.0(eslint@8.40.0) @@ -4422,7 +4422,7 @@ packages: - supports-color dev: true - /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0): + /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.5)(eslint-plugin-import@2.27.5)(eslint@8.40.0): resolution: {integrity: sha512-TdJqPHs2lW5J9Zpe17DZNQuDnox4xo2o+0tE7Pggain9Rbc19ik8kFtXdxZ250FVx2kF4vlt2RSf4qlUpG7bhw==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -4432,8 +4432,8 @@ packages: debug: 4.3.4 enhanced-resolve: 5.12.0 eslint: 8.40.0 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) get-tsconfig: 4.5.0 globby: 13.1.3 is-core-module: 2.12.0 @@ -4446,7 +4446,7 @@ packages: - supports-color dev: true - /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): + /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-j4GT+rqzCoRKHwURX7pddtIPGySnX9Si/cgMI5ztrcqOPtk5dDEeZ34CQVPphnqkJytlc97Vuk05Um2mJ3gEQA==} engines: {node: '>=4'} peerDependencies: @@ -4467,11 +4467,11 @@ packages: eslint-import-resolver-webpack: optional: true dependencies: - '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) debug: 3.2.7 eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.2)(eslint-plugin-import@2.27.5)(eslint@8.40.0) + eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.5)(eslint-plugin-import@2.27.5)(eslint@8.40.0) transitivePeerDependencies: - supports-color dev: true @@ -4491,7 +4491,7 @@ packages: string-natural-compare: 3.0.1 dev: true - /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): + /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-LmEt3GVofgiGuiE+ORpnvP+kAm3h6MLZJ4Q5HCyHADofsb4VzXFsRiWj3c0OFiV+3DWFh0qg3v9gcPlfc3zRow==} engines: {node: '>=4'} peerDependencies: @@ -4501,7 +4501,7 @@ packages: '@typescript-eslint/parser': optional: true dependencies: - '@typescript-eslint/parser': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) array-includes: 3.1.6 array.prototype.flat: 1.3.1 array.prototype.flatmap: 1.3.1 @@ -4509,7 +4509,7 @@ packages: doctrine: 2.1.0 eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.2)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) has: 1.0.3 is-core-module: 2.12.0 is-glob: 4.0.3 @@ -4524,7 +4524,7 @@ packages: - supports-color dev: true - /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.2)(eslint@8.40.0)(typescript@5.0.4): + /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.5)(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-PWLUEXeeF7C9QGKqvdSbzLOiLTx+bno7/HC9eefePfEb257QFHg7ye3dh80AZVkaa/RQsBB1Q/ORQvg2X7F0NQ==} engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0} peerDependencies: @@ -4537,7 +4537,7 @@ packages: jest: optional: true dependencies: - '@typescript-eslint/eslint-plugin': 5.59.2(@typescript-eslint/parser@5.59.2)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/eslint-plugin': 5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4) '@typescript-eslint/experimental-utils': 5.58.0(eslint@8.40.0)(typescript@5.0.4) eslint: 8.40.0 transitivePeerDependencies: @@ -4626,7 +4626,7 @@ packages: peerDependencies: eslint: ^7.5.0 || ^8.0.0 dependencies: - '@typescript-eslint/utils': 5.59.2(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) eslint: 8.40.0 transitivePeerDependencies: - supports-color @@ -6818,14 +6818,6 @@ packages: hasBin: true dev: true - /semver@7.4.0: - resolution: {integrity: sha512-RgOxM8Mw+7Zus0+zcLEUn8+JfoLpj/huFTItQy2hsM4khuC1HYRDp0cU482Ewn/Fcy6bCjufD8vAj7voC66KQw==} - engines: {node: '>=10'} - hasBin: true - dependencies: - lru-cache: 6.0.0 - dev: true - /semver@7.5.0: resolution: {integrity: sha512-+XC0AD/R7Q2mPSRuy2Id0+CGTZ98+8f+KvwirxOKIEyid+XSx6HbC63p+O4IndTHuX5Z+JxQ0TghCkO5Cg/2HA==} engines: {node: '>=10'} From a7e190f3e0e84f6416a5e857d1bf21577645a3e8 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 9 May 2023 12:08:20 +1000 Subject: [PATCH 25/67] build(deps): update dependency @types/node to v20.1.1 (#5414) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index 0b4113346..67583f005 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.1.0", + "@types/node": "20.1.1", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index ab4c61cd9..d24634ebc 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.1.0 - version: 20.1.0 + specifier: 20.1.1 + version: 20.1.1 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.5 - version: 4.3.5(@types/node@20.1.0) + version: 4.3.5(@types/node@20.1.1) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.5) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.1.0 + '@types/node': 20.1.1 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.1)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.1.0)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.1)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2195,7 +2195,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.1.0 + '@types/node': 20.1.1 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2731,7 +2731,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.1.0 + '@types/node': 20.1.1 dev: true /@types/chai-subset@1.3.3: @@ -2747,7 +2747,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.1.0 + '@types/node': 20.1.1 dev: true /@types/eslint@8.37.0: @@ -2764,7 +2764,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.1.0 + '@types/node': 20.1.1 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2821,8 +2821,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.1.0: - resolution: {integrity: sha512-O+z53uwx64xY7D6roOi4+jApDGFg0qn6WHcxe5QeqjMaTezBO/mxdfFXIVAVVyNWKx84OmPB3L8kbVYOTeN34A==} + /@types/node@20.1.1: + resolution: {integrity: sha512-uKBEevTNb+l6/aCQaKVnUModfEMjAl98lw2Si9P5y4hLu9tm6AlX2ZIoXZX6Wh9lJueYPrGPKk5WMCNHg/u6/A==} dev: true /@types/normalize-package-data@2.4.1: @@ -2879,7 +2879,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.1.0 + '@types/node': 20.1.1 dev: true /@types/stack-utils@2.0.1: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.5(@types/node@20.1.0) + vite: 4.3.5(@types/node@20.1.1) transitivePeerDependencies: - supports-color dev: true @@ -3742,7 +3742,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.1)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3751,9 +3751,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.1.0 + '@types/node': 20.1.1 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.1.0)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.1)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5646,7 +5646,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.1.0 + '@types/node': 20.1.1 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7188,7 +7188,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.1.0)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.1)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7207,7 +7207,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.1.0 + '@types/node': 20.1.1 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7405,7 +7405,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@20.1.0): + /vite-node@0.31.0(@types/node@20.1.1): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7415,7 +7415,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.5(@types/node@20.1.0) + vite: 4.3.5(@types/node@20.1.1) transitivePeerDependencies: - '@types/node' - less @@ -7436,7 +7436,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.5(@types/node@20.1.0) + vite: 4.3.5(@types/node@20.1.1) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.5): @@ -7448,7 +7448,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.5(@types/node@20.1.0) + vite: 4.3.5(@types/node@20.1.1) transitivePeerDependencies: - supports-color dev: true @@ -7461,7 +7461,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.5(@types/node@20.1.0) + vite: 4.3.5(@types/node@20.1.1) transitivePeerDependencies: - rollup - supports-color @@ -7478,7 +7478,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.5(@types/node@20.1.0) + vite: 4.3.5(@types/node@20.1.1) transitivePeerDependencies: - supports-color - typescript @@ -7518,7 +7518,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.5(@types/node@20.1.0): + /vite@4.3.5(@types/node@20.1.1): resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7543,7 +7543,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.1.0 + '@types/node': 20.1.1 esbuild: 0.17.18 postcss: 8.4.23 rollup: 3.21.0 @@ -7602,7 +7602,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 20.1.0 + '@types/node': 20.1.1 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7623,8 +7623,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.5(@types/node@20.1.0) - vite-node: 0.31.0(@types/node@20.1.0) + vite: 4.3.5(@types/node@20.1.1) + vite-node: 0.31.0(@types/node@20.1.1) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 3a752f5ac98d29d9be5f6351c1290d672cb6538f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 9 May 2023 12:21:18 +1000 Subject: [PATCH 26/67] build(deps): update module golang.org/x/net to v0.10.0 (#5417) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c3ae71364..ed06ac659 100644 --- a/go.mod +++ b/go.mod @@ -45,7 +45,7 @@ require ( github.com/trustelem/zxcvbn v1.0.1 github.com/valyala/fasthttp v1.47.0 github.com/wneessen/go-mail v0.3.9 - golang.org/x/net v0.9.0 + golang.org/x/net v0.10.0 golang.org/x/sync v0.2.0 golang.org/x/term v0.8.0 golang.org/x/text v0.9.0 diff --git a/go.sum b/go.sum index ed5889579..4c99bb8ec 100644 --- a/go.sum +++ b/go.sum @@ -565,8 +565,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= -golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= -golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= +golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M= +golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= From 6c472d86279cc375110b5fc32cfc7bfdafd6b4b0 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Tue, 9 May 2023 21:25:56 +1000 Subject: [PATCH 27/67] refactor(configuration): umask from query (#5416) Signed-off-by: James Elliott --- .../en/configuration/miscellaneous/server.md | 15 - .../en/configuration/prologue/common.md | 12 + .../en/configuration/telemetry/metrics.md | 15 - docs/data/configkeys.json | 2 +- internal/configuration/schema/const.go | 14 +- internal/configuration/schema/keys.go | 2 - internal/configuration/schema/notifier.go | 2 +- internal/configuration/schema/server.go | 12 +- internal/configuration/schema/storage.go | 2 +- internal/configuration/schema/telemetry.go | 8 +- .../configuration/schema/types_address.go | 155 ++++++---- .../schema/types_address_test.go | 280 +++++++++++++----- internal/server/server.go | 18 +- 13 files changed, 340 insertions(+), 197 deletions(-) diff --git a/docs/content/en/configuration/miscellaneous/server.md b/docs/content/en/configuration/miscellaneous/server.md index 683590747..865329991 100644 --- a/docs/content/en/configuration/miscellaneous/server.md +++ b/docs/content/en/configuration/miscellaneous/server.md @@ -22,7 +22,6 @@ aliases: ```yaml server: address: 'tcp://:9091' - umask: 0022 path: '' disable_healthcheck: false tls: @@ -80,20 +79,6 @@ server: address: unix:///var/run/authelia.sock ``` -### umask - -{{< confkey type="int" required="no" >}} - -If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the -[address](#address). Typically this should be set before the process is actually running and users should not use this -option, however it's recognized in various specific scenarios this may not be completely adequate. - -One such example is when you want the proxy to have permission to the socket but not the files, in which case running a -umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has -permission to the socket. - -This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly. - ### path {{< confkey type="string " required="no" >}} diff --git a/docs/content/en/configuration/prologue/common.md b/docs/content/en/configuration/prologue/common.md index b4c10dbc5..f6762411d 100644 --- a/docs/content/en/configuration/prologue/common.md +++ b/docs/content/en/configuration/prologue/common.md @@ -108,10 +108,22 @@ The following format represents the unix domain socket format. It's valid for bo instances. Refer to the individual documentation for an option for clarity. In this format as per the notation there are no optional portions. +The Unix Domain Socket format also accepts a query string. The following query parameters control certain behaviour of +this address type. + +| Parameter | Listeners | Connectors | Purpose | +|:---------:|:---------:|:----------:|:------------------------------------------------------------------------------------------------------------------------------------:| +| `umask` | Yes | No | Sets the umask prior to creating the socket and restores it after creating it. The value must be an octal number with 3 or 4 digits. | + + ```text unix:// ``` +```text +unix://?umask=0022 +``` + ##### Examples Various examples for these formats. diff --git a/docs/content/en/configuration/telemetry/metrics.md b/docs/content/en/configuration/telemetry/metrics.md index 4c9b3acbf..deb30d329 100644 --- a/docs/content/en/configuration/telemetry/metrics.md +++ b/docs/content/en/configuration/telemetry/metrics.md @@ -23,7 +23,6 @@ telemetry: metrics: enabled: false address: 'tcp://:9959' - umask: 0022 buffers: read: 4096 write: 4096 @@ -53,20 +52,6 @@ see the [documentation](../prologue/common.md#address) on this format for more i Configures the listener address for the [Prometheus] Metrics Exporter HTTP Server. The address itself is a listener and the scheme must either be the `unix` scheme or one of the `tcp` schemes. -### umask - -{{< confkey type="int" required="no" >}} - -If set temporarily changes the umask during the creation of the unix domain socket if configured as such in the -[address](#address). Typically this should be set before the process is actually running and users should not use this -option, however it's recognized in various specific scenarios this may not be completely adequate. - -One such example is when you want the proxy to have permission to the socket but not the files, in which case running a -umask of `0077` by default is good, and running a umask of `0027` so that the group Authelia is running as has -permission to the socket. - -This value should typically be prefixed with a `0` to ensure the relevant parsers handle it correctly. - ### buffers *__Reference Note:__ This configuration option uses the diff --git a/docs/data/configkeys.json b/docs/data/configkeys.json index ecc9213cf..cdbb3a02c 100644 --- a/docs/data/configkeys.json +++ b/docs/data/configkeys.json @@ -1 +1 @@ -[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.address","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDRESS"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.address","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_ADDRESS"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.address","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_ADDRESS"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_ADDRESS"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.umask","secret":false,"env":"AUTHELIA_SERVER_UMASK"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.umask","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_UMASK"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file +[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.address","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDRESS"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.address","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_ADDRESS"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.address","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_ADDRESS"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_ADDRESS"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file diff --git a/internal/configuration/schema/const.go b/internal/configuration/schema/const.go index 0e59410c5..9c5621c2d 100644 --- a/internal/configuration/schema/const.go +++ b/internal/configuration/schema/const.go @@ -103,9 +103,17 @@ const ( TOTPSecretSizeMinimum = 20 ) -// regexpHasScheme checks if a string has a scheme. Valid characters for schemes include alphanumeric, hyphen, -// period, and plus characters. -var regexpHasScheme = regexp.MustCompile(`^[-+.a-zA-Z\d]*(://|:$)`) +var ( + // regexpHasScheme checks if a string has a scheme. Valid characters for schemes include alphanumeric, hyphen, + // period, and plus characters. + regexpHasScheme = regexp.MustCompile(`^[-+.a-zA-Z\d]*(://|:$)`) + + regexpIsUmask = regexp.MustCompile(`^[0-7]{3,4}$`) +) + +const ( + addressQueryParamUmask = "umask" +) const ( blockCERTIFICATE = "CERTIFICATE" diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go index ac5dbca3e..6bbddf150 100644 --- a/internal/configuration/schema/keys.go +++ b/internal/configuration/schema/keys.go @@ -239,7 +239,6 @@ var Keys = []string{ "notifier.smtp.port", "notifier.template_path", "server.address", - "server.umask", "server.path", "server.asset_path", "server.disable_healthcheck", @@ -262,7 +261,6 @@ var Keys = []string{ "server.port", "telemetry.metrics.enabled", "telemetry.metrics.address", - "telemetry.metrics.umask", "telemetry.metrics.buffers.read", "telemetry.metrics.buffers.write", "telemetry.metrics.timeouts.read", diff --git a/internal/configuration/schema/notifier.go b/internal/configuration/schema/notifier.go index d554e6d64..9a3d862d0 100644 --- a/internal/configuration/schema/notifier.go +++ b/internal/configuration/schema/notifier.go @@ -44,7 +44,7 @@ type NotifierConfiguration struct { // DefaultSMTPNotifierConfiguration represents default configuration parameters for the SMTP notifier. var DefaultSMTPNotifierConfiguration = SMTPNotifierConfiguration{ - Address: &AddressSMTP{Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "localhost:25"}}}, + Address: &AddressSMTP{Address{true, false, -1, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "localhost:25"}}}, Timeout: time.Second * 5, Subject: "[Authelia] {title}", Identifier: "localhost", diff --git a/internal/configuration/schema/server.go b/internal/configuration/schema/server.go index 46264f3c8..65ac03099 100644 --- a/internal/configuration/schema/server.go +++ b/internal/configuration/schema/server.go @@ -7,12 +7,10 @@ import ( // ServerConfiguration represents the configuration of the http server. type ServerConfiguration struct { - Address *AddressTCP `koanf:"address"` - UMask *int `koanf:"umask"` - - Path string `koanf:"path"` - AssetPath string `koanf:"asset_path"` - DisableHealthcheck bool `koanf:"disable_healthcheck"` + Address *AddressTCP `koanf:"address"` + Path string `koanf:"path"` + AssetPath string `koanf:"asset_path"` + DisableHealthcheck bool `koanf:"disable_healthcheck"` TLS ServerTLS `koanf:"tls"` Headers ServerHeaders `koanf:"headers"` @@ -62,7 +60,7 @@ type ServerHeaders struct { // DefaultServerConfiguration represents the default values of the ServerConfiguration. var DefaultServerConfiguration = ServerConfiguration{ - Address: &AddressTCP{Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: ":9091"}}}, + Address: &AddressTCP{Address{true, false, -1, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: ":9091"}}}, Buffers: ServerBuffers{ Read: 4096, Write: 4096, diff --git a/internal/configuration/schema/storage.go b/internal/configuration/schema/storage.go index 3dc2836f0..0d7b318ed 100644 --- a/internal/configuration/schema/storage.go +++ b/internal/configuration/schema/storage.go @@ -75,7 +75,7 @@ var DefaultMySQLStorageConfiguration = MySQLStorageConfiguration{ // DefaultPostgreSQLStorageConfiguration represents the default PostgreSQL configuration. var DefaultPostgreSQLStorageConfiguration = PostgreSQLStorageConfiguration{ SQLStorageConfiguration: SQLStorageConfiguration{ - Address: &AddressTCP{Address{true, false, 5432, &url.URL{Scheme: AddressSchemeTCP, Host: "localhost:5432"}}}, + Address: &AddressTCP{Address{true, false, -1, 5432, &url.URL{Scheme: AddressSchemeTCP, Host: "localhost:5432"}}}, }, Schema: "public", TLS: &TLSConfig{ diff --git a/internal/configuration/schema/telemetry.go b/internal/configuration/schema/telemetry.go index f3231144e..10f804f4d 100644 --- a/internal/configuration/schema/telemetry.go +++ b/internal/configuration/schema/telemetry.go @@ -12,10 +12,8 @@ type TelemetryConfig struct { // TelemetryMetricsConfig represents the telemetry metrics config. type TelemetryMetricsConfig struct { - Enabled bool `koanf:"enabled"` - Address *AddressTCP `koanf:"address"` - UMask *int `koanf:"umask"` - + Enabled bool `koanf:"enabled"` + Address *AddressTCP `koanf:"address"` Buffers ServerBuffers `koanf:"buffers"` Timeouts ServerTimeouts `koanf:"timeouts"` } @@ -23,7 +21,7 @@ type TelemetryMetricsConfig struct { // DefaultTelemetryConfig is the default telemetry configuration. var DefaultTelemetryConfig = TelemetryConfig{ Metrics: TelemetryMetricsConfig{ - Address: &AddressTCP{Address{true, false, 9959, &url.URL{Scheme: AddressSchemeTCP, Host: ":9959"}}}, + Address: &AddressTCP{Address{true, false, -1, 9959, &url.URL{Scheme: AddressSchemeTCP, Host: ":9959"}}}, Buffers: ServerBuffers{ Read: 4096, Write: 4096, diff --git a/internal/configuration/schema/types_address.go b/internal/configuration/schema/types_address.go index c33dcf6c0..a68bad701 100644 --- a/internal/configuration/schema/types_address.go +++ b/internal/configuration/schema/types_address.go @@ -21,7 +21,7 @@ func NewAddress(value string) (address *Address, err error) { // else without a scheme is the schemeDefault scheme. func NewAddressDefault(value, schemeDefault, schemeDefaultPath string) (address *Address, err error) { if len(value) == 0 { - return &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil + return &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil } var u *url.URL @@ -71,12 +71,17 @@ func NewAddressFromNetworkValuesDefault(value string, port int, schemeDefault, s // NewAddressUnix returns an *Address from a path value. func NewAddressUnix(path string) Address { - return Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}} + return Address{true, true, -1, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}} } // NewAddressFromNetworkValues returns an *Address from network values. func NewAddressFromNetworkValues(network, host string, port int) Address { - return Address{true, false, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port)}} + return NewAddressFromNetworkPathValues(network, host, port, "") +} + +// NewAddressFromNetworkPathValues returns an *Address from network values and a path. +func NewAddressFromNetworkPathValues(network, host string, port int, path string) Address { + return Address{true, false, -1, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port), Path: path}} } // NewSMTPAddress returns an *AddressSMTP from SMTP values. @@ -103,13 +108,14 @@ func NewSMTPAddress(scheme, host string, port int) *AddressSMTP { } } - return &AddressSMTP{Address: Address{true, false, port, &url.URL{Scheme: scheme, Host: fmt.Sprintf("%s:%d", host, port)}}} + return &AddressSMTP{Address: Address{true, false, -1, port, &url.URL{Scheme: scheme, Host: fmt.Sprintf("%s:%d", host, port)}}} } // NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address. func NewAddressFromURL(u *url.URL) (addr *Address, err error) { addr = &Address{ - url: u, + url: u, + umask: -1, } if err = addr.validate(); err != nil { @@ -143,6 +149,7 @@ type AddressSMTP struct { type Address struct { valid bool socket bool + umask int port int url *url.URL @@ -153,6 +160,15 @@ func (a *Address) Valid() bool { return a.valid } +// Umask returns the formatted umask or an empty string. +func (a *Address) Umask() string { + if a.umask == -1 { + return "" + } + + return fmt.Sprintf("%04s", strconv.FormatInt(int64(a.umask), 8)) +} + // IsUnixDomainSocket returns true if the address has been determined to be a Unix Domain Socket. func (a *Address) IsUnixDomainSocket() bool { return a.socket @@ -257,16 +273,6 @@ func (a *Address) String() string { return a.url.String() } -// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp. -func (a *Address) Network() string { - switch scheme := a.Scheme(); scheme { - case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: - return scheme - default: - return AddressSchemeTCP - } -} - // Scheme returns the *url.URL Scheme field. func (a *Address) Scheme() string { if !a.valid || a.url == nil { @@ -276,6 +282,15 @@ func (a *Address) Scheme() string { return a.url.Scheme } +// Host returns the *url.URL Host field. +func (a *Address) Host() string { + if !a.valid || a.url == nil { + return "" + } + + return a.url.Host +} + // Hostname returns the output of the *url.URL Hostname func. func (a *Address) Hostname() string { if !a.valid || a.url == nil { @@ -285,19 +300,6 @@ func (a *Address) Hostname() string { return a.url.Hostname() } -// SocketHostname returns the correct hostname for a socket connection. -func (a *Address) SocketHostname() string { - if !a.valid || a.url == nil { - return "" - } - - if a.socket { - return a.url.Path - } - - return a.url.Hostname() -} - // SetHostname sets the hostname preserving the port. func (a *Address) SetHostname(hostname string) { if !a.valid || a.url == nil { @@ -325,13 +327,36 @@ func (a *Address) SetPort(port int) { a.setport(port) } -// Host returns the *url.URL Host field. -func (a *Address) Host() string { +// Path returns the path. +func (a *Address) Path() string { if !a.valid || a.url == nil { return "" } - return a.url.Host + return a.url.Path +} + +// SocketHostname returns the correct hostname for a socket connection. +func (a *Address) SocketHostname() string { + if !a.valid || a.url == nil { + return "" + } + + if a.socket { + return a.url.Path + } + + return a.url.Hostname() +} + +// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp. +func (a *Address) Network() string { + switch scheme := a.Scheme(); scheme { + case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix: + return scheme + default: + return AddressSchemeTCP + } } // NetworkAddress returns a string representation of the Address with just the host and port. @@ -348,46 +373,33 @@ func (a *Address) NetworkAddress() string { } // Listener creates and returns a net.Listener. -func (a *Address) Listener() (net.Listener, error) { - return a.listener() +func (a *Address) Listener() (ln net.Listener, err error) { + if a.url == nil { + return nil, fmt.Errorf("address url is nil") + } + + if a.socket && a.umask != -1 { + umask := syscall.Umask(a.umask) + + ln, err = net.Listen(a.Network(), a.NetworkAddress()) + + _ = syscall.Umask(umask) + + return ln, err + } + + return net.Listen(a.Network(), a.NetworkAddress()) } // Dial creates and returns a dialed net.Conn. func (a *Address) Dial() (net.Conn, error) { - if a.url == nil { + if !a.valid || a.url == nil { return nil, fmt.Errorf("address url is nil") } return net.Dial(a.Network(), a.NetworkAddress()) } -// ListenerWithUMask creates and returns a net.Listener with a temporary UMask if the scheme is `unix`. -func (a *Address) ListenerWithUMask(umask int) (ln net.Listener, err error) { - if !a.socket { - return a.listener() - } - - if a.url == nil { - return nil, fmt.Errorf("address url is nil") - } - - umask = syscall.Umask(umask) - - ln, err = net.Listen(a.Network(), a.NetworkAddress()) - - _ = syscall.Umask(umask) - - return ln, err -} - -func (a *Address) listener() (net.Listener, error) { - if a.url == nil { - return nil, fmt.Errorf("address url is nil") - } - - return net.Listen(a.Network(), a.NetworkAddress()) -} - func (a *Address) setport(port int) { a.port = port a.url.Host = net.JoinHostPort(a.url.Hostname(), strconv.Itoa(port)) @@ -399,8 +411,8 @@ func (a *Address) validate() (err error) { } switch { - case a.url.RawQuery != "": - return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses", a.url.String()) + case a.url.RawQuery != "" && a.url.Scheme != AddressSchemeUnix: + return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses with the '%s' scheme", a.url.String(), a.url.Scheme) case a.url.RawFragment != "", a.url.Fragment != "": return fmt.Errorf("error validating the address: the url '%s' appears to have a fragment but this is not valid for addresses", a.url.String()) case a.url.User != nil: @@ -469,6 +481,8 @@ func (a *Address) validateTCPUDP() (err error) { } func (a *Address) validateUnixSocket() (err error) { + umask := -1 + switch { case a.url.Path == "" && a.url.Scheme != AddressSchemeLDAPI: return fmt.Errorf("error validating the unix socket address: could not determine path from '%s'", a.url.String()) @@ -476,7 +490,22 @@ func (a *Address) validateUnixSocket() (err error) { return fmt.Errorf("error validating the unix socket address: the url '%s' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", a.url.String()) } + if a.url.Query().Has(addressQueryParamUmask) { + v := a.url.Query().Get(addressQueryParamUmask) + + if !regexpIsUmask.MatchString(v) { + return fmt.Errorf("error validating the unix socket address: could not parse address '%s': the address has a umask value of '%s' which does not appear to be a valid octal string", a.url.String(), v) + } + + var p int64 + + p, _ = strconv.ParseInt(v, 8, 0) + + umask = int(p) + } + a.socket = true + a.umask = umask return nil } diff --git a/internal/configuration/schema/types_address_test.go b/internal/configuration/schema/types_address_test.go index f40393d60..c30a2e09b 100644 --- a/internal/configuration/schema/types_address_test.go +++ b/internal/configuration/schema/types_address_test.go @@ -1,6 +1,7 @@ package schema import ( + "fmt" "net" "net/url" "path/filepath" @@ -20,7 +21,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldParseBasicAddress", "tcp://0.0.0.0:9091", - &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + &Address{true, false, -1, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, "0.0.0.0:9091", "tcp://0.0.0.0:9091", "", @@ -28,7 +29,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldParseEmptyAddress", "", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, + &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, ":0", "tcp://:0", "", @@ -36,7 +37,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldParseAddressMissingScheme", "0.0.0.0:9091", - &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, + &Address{true, false, -1, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}, "0.0.0.0:9091", "tcp://0.0.0.0:9091", "", @@ -44,7 +45,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldParseUnixAddressMissingScheme", "/var/run/example.sock", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}}, + &Address{true, true, -1, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}}, "/var/run/example.sock", "unix:///var/run/example.sock", "", @@ -52,15 +53,23 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldParseAddressMissingPort", "tcp://0.0.0.0", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}}, + &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}}, "0.0.0.0:0", "tcp://0.0.0.0:0", "", }, + { + "ShouldNotParseAddressWithQuery", + "tcp://0.0.0.0?umask=0022", + nil, + "0.0.0.0:0", + "tcp://0.0.0.0:0", + "error validating the address: the url 'tcp://0.0.0.0?umask=0022' appears to have a query but this is not valid for addresses with the 'tcp' scheme", + }, { "ShouldParseUnixSocket", "unix:///path/to/a/socket.sock", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}}, + &Address{true, true, -1, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}}, "/path/to/a/socket.sock", "unix:///path/to/a/socket.sock", "", @@ -82,12 +91,12 @@ func TestNewAddressFromString(t *testing.T) { "error validating the unix socket address: could not determine path from 'unix://nopath.com'", }, { - "ShouldNotParseUnixSocketWithQuery", - "unix:///path/to/a/socket.sock?q=yes", - nil, + "ShouldParseUnixSocketWithQuery", + "unix:///path/to/a/socket.sock?umask=0022", + &Address{true, true, 18, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock", RawQuery: "umask=0022"}}, + "/path/to/a/socket.sock", + "unix:///path/to/a/socket.sock?umask=0022", "", - "", - "error validating the address: the url 'unix:///path/to/a/socket.sock?q=yes' appears to have a query but this is not valid for addresses", }, { "ShouldNotParseUnixSocketWithFragment", @@ -108,7 +117,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldParseUnknownScheme", "a://0.0.0.0", - &Address{true, false, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}}, + &Address{true, false, -1, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}}, "0.0.0.0", "a://0.0.0.0", "", @@ -140,7 +149,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldSetDefaultPortLDAP", "ldap://127.0.0.1", - &Address{true, false, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}}, + &Address{true, false, -1, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}}, "127.0.0.1:389", "ldap://127.0.0.1:389", "", @@ -148,7 +157,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldSetDefaultPortLDAPS", "ldaps://127.0.0.1", - &Address{true, false, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}}, + &Address{true, false, -1, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}}, "127.0.0.1:636", "ldaps://127.0.0.1:636", "", @@ -156,7 +165,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldAllowLDAPI", "ldapi:///abc", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}}, + &Address{true, true, -1, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}}, "/abc", "ldapi:///abc", "", @@ -164,7 +173,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldAllowImplicitLDAPI", "ldapi://", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + &Address{true, true, -1, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, "", "ldapi:", "", @@ -172,7 +181,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldAllowImplicitLDAPINoSlash", "ldapi:", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, + &Address{true, true, -1, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}}, "", "ldapi:", "", @@ -180,7 +189,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldSetDefaultPortSMTP", "smtp://127.0.0.1", - &Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}}, + &Address{true, false, -1, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}}, "127.0.0.1:25", "smtp://127.0.0.1:25", "", @@ -188,7 +197,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldSetDefaultPortSUBMISSION", "submission://127.0.0.1", - &Address{true, false, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}}, + &Address{true, false, -1, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}}, "127.0.0.1:587", "submission://127.0.0.1:587", "", @@ -196,7 +205,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldSetDefaultPortSUBMISSIONS", "submissions://127.0.0.1", - &Address{true, false, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}}, + &Address{true, false, -1, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}}, "127.0.0.1:465", "submissions://127.0.0.1:465", "", @@ -204,7 +213,7 @@ func TestNewAddressFromString(t *testing.T) { { "ShouldNotOverridePort", "ldap://127.0.0.1:123", - &Address{true, false, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}}, + &Address{true, false, -1, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}}, "127.0.0.1:123", "ldap://127.0.0.1:123", "", @@ -239,7 +248,7 @@ func TestAddress_ValidateErrors(t *testing.T) { }{ { "ShouldValidateLDAPAddress", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}}, + &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}}, "", "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'", "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'", @@ -248,7 +257,7 @@ func TestAddress_ValidateErrors(t *testing.T) { }, { "ShouldValidateSMTPAddress", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}}, + &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}}, "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'", "", "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'", @@ -257,7 +266,7 @@ func TestAddress_ValidateErrors(t *testing.T) { }, { "ShouldValidateTCPAddress", - &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}}, + &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}}, "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'tcp'", "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'tcp'", "", @@ -266,7 +275,7 @@ func TestAddress_ValidateErrors(t *testing.T) { }, { "ShouldValidateUnixSocket", - &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/socket"}}, + &Address{true, true, -1, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/socket"}}, "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'unix'", "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'unix'", "", @@ -311,7 +320,7 @@ func TestAddress_ValidateErrors(t *testing.T) { } func TestAddress_SetHostname(t *testing.T) { - address := &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}} + address := &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}} assert.Equal(t, "tcp://0.0.0.0", address.String()) @@ -320,32 +329,6 @@ func TestAddress_SetHostname(t *testing.T) { assert.Equal(t, "tcp://127.0.0.1", address.String()) } -func TestAddress_ListenerWithUMask(t *testing.T) { - dir := t.TempDir() - - address := &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: filepath.Join(dir, "example.sock")}} - - ln, err := address.ListenerWithUMask(600) - - assert.NotNil(t, ln) - assert.NoError(t, err) - assert.NoError(t, ln.Close()) - - address = &Address{true, true, 0, nil} - - ln, err = address.ListenerWithUMask(600) - - assert.Nil(t, ln) - assert.EqualError(t, err, "address url is nil") - - address = &Address{true, false, 0, nil} - - ln, err = address.ListenerWithUMask(600) - - assert.Nil(t, ln) - assert.EqualError(t, err, "address url is nil") -} - func TestAddressOutputValues(t *testing.T) { var ( address *Address @@ -356,7 +339,7 @@ func TestAddressOutputValues(t *testing.T) { address = &Address{} assert.EqualError(t, address.validate(), "error validating the address: address url was nil") - address = &Address{false, false, 0, nil} + address = &Address{false, false, -1, 0, nil} assert.Equal(t, "", address.String()) assert.Equal(t, "", address.Scheme()) @@ -370,7 +353,7 @@ func TestAddressOutputValues(t *testing.T) { assert.Nil(t, listener) assert.EqualError(t, err, "address url is nil") - address = &Address{true, false, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}} + address = &Address{true, false, -1, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}} assert.Equal(t, "tcp://0.0.0.0:8080", address.String()) assert.Equal(t, "tcp", address.Scheme()) @@ -384,7 +367,7 @@ func TestAddressOutputValues(t *testing.T) { assert.NotNil(t, listener) assert.NoError(t, err) - address = &Address{true, false, 0, nil} + address = &Address{true, false, -1, 0, nil} assert.Equal(t, "", address.String()) assert.Equal(t, "", address.Scheme()) @@ -413,7 +396,7 @@ func TestAddressOutputValues(t *testing.T) { assert.Nil(t, listener) assert.EqualError(t, err, "address url is nil") - address = &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}} + address = &Address{true, false, -1, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}} assert.Equal(t, "tcp://0.0.0.0:9091", address.String()) assert.Equal(t, "tcp", address.Scheme()) @@ -570,6 +553,132 @@ func TestNewSMTPAddress(t *testing.T) { } } +func TestAddress_Dial(t *testing.T) { + testCases := []struct { + name string + have Address + success bool + err string + }{ + { + "ShouldNotDialNil", + Address{true, false, -1, 0, nil}, + false, + "address url is nil", + }, + { + "ShouldNotDialInvalid", + Address{false, false, -1, 0, &url.URL{}}, + false, + "address url is nil", + }, + { + "ShouldNotDialInvalidAddress", + Address{true, false, -1, 0, &url.URL{Scheme: "abc", Host: "127.0.0.1:0"}}, + false, + "dial tcp 127.0.0.1:0: connect: connection refused", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + conn, err := tc.have.Dial() + + defer func(c net.Conn) { + if c == nil { + return + } + + conn.Close() + }(conn) + + if tc.success { + + } else { + assert.Nil(t, conn) + if tc.err != "" { + assert.EqualError(t, err, tc.err) + } else { + assert.NotNil(t, err) + } + } + }) + } +} + +func TestAddress_UnixDomainSocket(t *testing.T) { + dir := t.TempDir() + + testCases := []struct { + name string + have string + socket bool + path string + strUmask string + umask int + err string + }{ + { + "ShouldNotBeSocket", + "tcp://:9091", + false, + "", + "", + -1, + "", + }, + { + "ShouldParseSocket", + fmt.Sprintf("unix://%s", filepath.Join(dir, "example.sock")), + true, + filepath.Join(dir, "example.sock"), + "", + -1, + "", + }, + { + "ShouldParseSocketWithUmask", + fmt.Sprintf("unix://%s?umask=0022", filepath.Join(dir, "example.sock")), + true, + filepath.Join(dir, "example.sock"), + "0022", + 18, + "", + }, + { + "ShouldParseSocketWithBadUmask", + fmt.Sprintf("unix://%s?umask=abc", filepath.Join(dir, "example.sock")), + true, + "", + "", + -1, + fmt.Sprintf("error validating the unix socket address: could not parse address 'unix://%s?umask=abc': the address has a umask value of 'abc' which does not appear to be a valid octal string", filepath.Join(dir, "example.sock")), + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + actual, err := NewAddress(tc.have) + + if tc.err == "" { + assert.Equal(t, tc.socket, actual.IsUnixDomainSocket()) + assert.Equal(t, tc.path, actual.Path()) + assert.Equal(t, tc.strUmask, actual.Umask()) + assert.Equal(t, tc.umask, actual.umask) + + ln, err := actual.Listener() + + assert.NoError(t, err) + assert.NotNil(t, ln) + + assert.NoError(t, ln.Close()) + } else { + assert.EqualError(t, err, tc.err) + } + }) + } +} + func TestAddress_SocketHostname(t *testing.T) { testCases := []struct { name string @@ -578,22 +687,22 @@ func TestAddress_SocketHostname(t *testing.T) { }{ { "ShouldReturnHostname", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "examplea:80"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "examplea:80"}}, "examplea", }, { "ShouldReturnPath", - Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, + Address{true, true, -1, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, "/abc/123", }, { "ShouldReturnNothing", - Address{false, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, + Address{false, true, -1, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}}, "", }, { "ShouldReturnNothingNil", - Address{true, true, 80, nil}, + Address{true, true, -1, 80, nil}, "", }, } @@ -605,6 +714,41 @@ func TestAddress_SocketHostname(t *testing.T) { } } +func TestAddress_Path(t *testing.T) { + testCases := []struct { + name string + have Address + expected string + }{ + { + "ShouldReturnEmptyPath", + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta"}}, + "", + }, + { + "ShouldReturnPath", + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta", Path: "/apath"}}, + "/apath", + }, + { + "ShouldNotReturnPathInvalid", + Address{false, false, -1, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta", Path: "/apath"}}, + "", + }, + { + "ShouldNotReturnPathNil", + Address{true, false, -1, 80, nil}, + "", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.expected, tc.have.Path()) + }) + } +} + func TestAddress_IsTCP_IsUDP(t *testing.T) { testCases := []struct { name string @@ -614,49 +758,49 @@ func TestAddress_IsTCP_IsUDP(t *testing.T) { }{ { "ShouldReturnTrueTCP", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta"}}, true, false, }, { "ShouldReturnTrueTCP4", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP4, Host: "tcphostb"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeTCP4, Host: "tcphostb"}}, true, false, }, { "ShouldReturnTrueTCP6", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP6, Host: "tcphostc"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeTCP6, Host: "tcphostc"}}, true, false, }, { "ShouldReturnFalseUDP", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP, Host: "tcphostd"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeUDP, Host: "tcphostd"}}, false, true, }, { "ShouldReturnFalseUDP4", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP4, Host: "tcphoste"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeUDP4, Host: "tcphoste"}}, false, true, }, { "ShouldReturnFalseUDP6", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP6, Host: "tcphostf"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeUDP6, Host: "tcphostf"}}, false, true, }, { "ShouldReturnFalseSMTP", - Address{true, false, 80, &url.URL{Scheme: AddressSchemeSMTP, Host: "tcphostg"}}, + Address{true, false, -1, 80, &url.URL{Scheme: AddressSchemeSMTP, Host: "tcphostg"}}, false, false, }, { "ShouldReturnFalseUnix", - Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Host: "tcphosth"}}, + Address{true, true, -1, 80, &url.URL{Scheme: AddressSchemeUnix, Host: "tcphosth"}}, false, false, }, diff --git a/internal/server/server.go b/internal/server/server.go index d1f83c9f7..59d2d5d92 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -37,14 +37,7 @@ func CreateDefaultServer(config *schema.Configuration, providers middlewares.Pro connectionScheme = schemeHTTP ) - switch config.Server.UMask { - case nil: - listener, err = config.Server.Address.Listener() - default: - listener, err = config.Server.Address.ListenerWithUMask(*config.Server.UMask) - } - - if err != nil { + if listener, err = config.Server.Address.Listener(); err != nil { return nil, nil, nil, false, fmt.Errorf("error occurred while attempting to initialize main server listener for address '%s': %w", config.Server.Address.String(), err) } @@ -109,14 +102,7 @@ func CreateMetricsServer(config *schema.Configuration, providers middlewares.Pro Logger: logging.LoggerPrintf(logrus.DebugLevel), } - switch config.Telemetry.Metrics.UMask { - case nil: - listener, err = config.Telemetry.Metrics.Address.Listener() - default: - listener, err = config.Telemetry.Metrics.Address.ListenerWithUMask(*config.Telemetry.Metrics.UMask) - } - - if err != nil { + if listener, err = config.Telemetry.Metrics.Address.Listener(); err != nil { return nil, nil, nil, false, fmt.Errorf("error occurred while attempting to initialize metrics telemetry server listener for address '%s': %w", config.Telemetry.Metrics.Address.String(), err) } From 53c5994a0324abceb62a867811da07db64213460 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Tue, 9 May 2023 21:36:14 +1000 Subject: [PATCH 28/67] docs: fix openapi (#5419) Signed-off-by: James Elliott --- api/openapi.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/api/openapi.yml b/api/openapi.yml index 004897111..e1fa890f0 100644 --- a/api/openapi.yml +++ b/api/openapi.yml @@ -200,6 +200,9 @@ paths: location: description: Redirect Location for user authorization example: '{{ $redir }}' + schema: + type: string + format: uri set-cookie: description: Sets a new cookie value schema: @@ -210,6 +213,9 @@ paths: location: description: Redirect Location for user authorization example: '{{ $redir }}' + schema: + type: string + format: uri set-cookie: description: Sets a new cookie value schema: @@ -273,6 +279,9 @@ paths: location: description: Redirect Location for user authorization example: '{{ $redir }}' + schema: + type: string + format: uri set-cookie: description: Sets a new cookie value schema: @@ -283,6 +292,9 @@ paths: location: description: Redirect Location for user authorization example: '{{ $redir }}' + schema: + type: string + format: uri set-cookie: description: Sets a new cookie value schema: @@ -342,6 +354,9 @@ paths: location: description: Redirect Location for user authorization example: '{{ $redir }}' + schema: + type: string + format: uri set-cookie: description: Sets a new cookie value schema: @@ -352,6 +367,9 @@ paths: location: description: Redirect Location for user authorization example: '{{ $redir }}' + schema: + type: string + format: uri set-cookie: description: Sets a new cookie value schema: @@ -411,6 +429,9 @@ paths: location: description: Redirect Location for user authorization example: '{{ $redir }}' + schema: + type: string + format: uri set-cookie: description: Sets a new cookie value schema: From 73334fbb2ba4702d86dd30d8ce1729956ce9f3a1 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 10 May 2023 02:04:42 +1000 Subject: [PATCH 29/67] build(deps): update module github.com/ory/x to v0.0.555 (#5420) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index ed06ac659..9569bfa4d 100644 --- a/go.mod +++ b/go.mod @@ -33,7 +33,7 @@ require ( github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 github.com/ory/fosite v0.44.0 github.com/ory/herodot v0.10.2 - github.com/ory/x v0.0.554 + github.com/ory/x v0.0.555 github.com/otiai10/copy v1.11.0 github.com/pkg/errors v0.9.1 github.com/pquerna/otp v1.4.0 diff --git a/go.sum b/go.sum index 4c99bb8ec..f29d3fce2 100644 --- a/go.sum +++ b/go.sum @@ -331,8 +331,8 @@ github.com/ory/go-convenience v0.1.0 h1:zouLKfF2GoSGnJwGq+PE/nJAE6dj2Zj5QlTgmMTs github.com/ory/go-convenience v0.1.0/go.mod h1:uEY/a60PL5c12nYz4V5cHY03IBmwIAEm8TWB0yn9KNs= github.com/ory/herodot v0.10.2 h1:gGvNMHgAwWzdP/eo+roSiT5CGssygHSjDU7MSQNlJ4E= github.com/ory/herodot v0.10.2/go.mod h1:MMNmY6MG1uB6fnXYFaHoqdV23DTWctlPsmRCeq/2+wc= -github.com/ory/x v0.0.554 h1:w4GQ74uZpxEzKSeIfKBRIiX4LHrAS3zuEexdKyRtBaE= -github.com/ory/x v0.0.554/go.mod h1:oRVemI3SQQOLvOCJWIRinHQKlgmay/NbwSyRUIsS/Yk= +github.com/ory/x v0.0.555 h1:Etg6yUnrXP5YVTlpgipRh+hDLMavldbTURj+Mb0kdIY= +github.com/ory/x v0.0.555/go.mod h1:oRVemI3SQQOLvOCJWIRinHQKlgmay/NbwSyRUIsS/Yk= github.com/otiai10/copy v1.11.0 h1:OKBD80J/mLBrwnzXqGtFCzprFSGioo30JcmR4APsNwc= github.com/otiai10/copy v1.11.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww= github.com/otiai10/mint v1.5.1 h1:XaPLeE+9vGbuyEHem1JNk3bYc7KKqyI/na0/mLd/Kks= From 70df11be166667e3502a5074b1b75483aa0aba24 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 10 May 2023 13:06:31 +1000 Subject: [PATCH 30/67] build(deps): update alpine docker tag to v3.18.0 (#5421) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- Dockerfile | 2 +- Dockerfile.coverage | 2 +- Dockerfile.dev | 2 +- internal/suites/example/compose/samba/Dockerfile | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 2a6343b6a..24e7d1aff 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ # =================================== # ===== Authelia official image ===== # =================================== -FROM alpine:3.17.3 +FROM alpine:3.18.0 ARG TARGETOS ARG TARGETARCH diff --git a/Dockerfile.coverage b/Dockerfile.coverage index 0b43f5ae3..88a60f1e9 100644 --- a/Dockerfile.coverage +++ b/Dockerfile.coverage @@ -46,7 +46,7 @@ RUN \ # =================================== # ===== Authelia official image ===== # =================================== -FROM alpine:3.17.3 +FROM alpine:3.18.0 RUN apk --no-cache add ca-certificates tzdata diff --git a/Dockerfile.dev b/Dockerfile.dev index 81d51cc97..1d0e5637f 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -43,7 +43,7 @@ RUN \ # =================================== # ===== Authelia official image ===== # =================================== -FROM alpine:3.17.3 +FROM alpine:3.18.0 WORKDIR /app diff --git a/internal/suites/example/compose/samba/Dockerfile b/internal/suites/example/compose/samba/Dockerfile index dda5d4556..3efa7af45 100644 --- a/internal/suites/example/compose/samba/Dockerfile +++ b/internal/suites/example/compose/samba/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.17.3 +FROM alpine:3.18.0 RUN \ apk add --no-cache \ From ea25cc223188587326600e32982c749e15f22298 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 11 May 2023 05:17:14 +1000 Subject: [PATCH 31/67] build(deps): update dependency @mui/material to v5.13.0 (#5423) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 32 ++++++++++++++++---------------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/web/package.json b/web/package.json index 67583f005..2ec18eabe 100644 --- a/web/package.json +++ b/web/package.json @@ -19,7 +19,7 @@ "@fortawesome/free-solid-svg-icons": "6.4.0", "@fortawesome/react-fontawesome": "0.2.0", "@mui/icons-material": "5.11.16", - "@mui/material": "5.12.3", + "@mui/material": "5.13.0", "@mui/styles": "5.12.3", "axios": "1.4.0", "broadcast-channel": "5.1.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index d24634ebc..d347cd3e4 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -24,10 +24,10 @@ dependencies: version: 0.2.0(@fortawesome/fontawesome-svg-core@6.4.0)(react@18.2.0) '@mui/icons-material': specifier: 5.11.16 - version: 5.11.16(@mui/material@5.12.3)(@types/react@18.2.6)(react@18.2.0) + version: 5.11.16(@mui/material@5.13.0)(@types/react@18.2.6)(react@18.2.0) '@mui/material': - specifier: 5.12.3 - version: 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + specifier: 5.13.0 + version: 5.13.0(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/styles': specifier: 5.12.3 version: 5.12.3(@types/react@18.2.6)(react@18.2.0) @@ -2259,8 +2259,8 @@ packages: tsconfig-paths: 3.14.2 dev: true - /@mui/base@5.0.0-alpha.128(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-wub3wxNN+hUp8hzilMlXX3sZrPo75vsy1cXEQpqdTfIFlE9HprP1jlulFiPg5tfPst2OKmygXr2hhmgvAKRrzQ==} + /@mui/base@5.0.0-beta.0(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-ap+juKvt8R8n3cBqd/pGtZydQ4v2I/hgJKnvJRGjpSh3RvsvnDHO4rXov8MHQlH6VqpOekwgilFLGxMZjNTucA==} engines: {node: '>=12.0.0'} peerDependencies: '@types/react': ^17.0.0 || ^18.0.0 || 18 @@ -2283,11 +2283,11 @@ packages: react-is: 18.2.0 dev: false - /@mui/core-downloads-tracker@5.12.3: - resolution: {integrity: sha512-yiJZ+knaknPHuRKhRk4L6XiwppwkAahVal3LuYpvBH7GkA2g+D9WLEXOEnNYtVFUggyKf6fWGLGnx0iqzkU5YA==} + /@mui/core-downloads-tracker@5.13.0: + resolution: {integrity: sha512-5nXz2k8Rv2ZjtQY6kXirJVyn2+ODaQuAJmXSJtLDUQDKWp3PFUj6j3bILqR0JGOs9R5ejgwz3crLKsl6GwjwkQ==} dev: false - /@mui/icons-material@5.11.16(@mui/material@5.12.3)(@types/react@18.2.6)(react@18.2.0): + /@mui/icons-material@5.11.16(@mui/material@5.13.0)(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-oKkx9z9Kwg40NtcIajF9uOXhxiyTZrrm9nmIJ4UjkU2IdHpd4QVLbCc/5hZN/y0C6qzi2Zlxyr9TGddQx2vx2A==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2299,13 +2299,13 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@mui/material': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@mui/material': 5.13.0(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@types/react': 18.2.6 react: 18.2.0 dev: false - /@mui/material@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-xNmKlrEN4HsTaKFNLZfc7ie7CXx2YqEeO//hsXZx2p3MGtDdeMr2sV3jC4hsFs57RhQlF79weY7uVvC8xSuVbg==} + /@mui/material@5.13.0(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-ckS+9tCpAzpdJdaTF+btF0b6mF9wbXg/EVKtnoAWYi0UKXoXBAVvEUMNpLGA5xdpCdf+A6fPbVUEHs9TsfU+Yw==} engines: {node: '>=12.0.0'} peerDependencies: '@emotion/react': ^11.5.0 @@ -2324,13 +2324,13 @@ packages: '@babel/runtime': 7.21.0 '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) - '@mui/base': 5.0.0-alpha.128(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) - '@mui/core-downloads-tracker': 5.12.3 + '@mui/base': 5.0.0-beta.0(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@mui/core-downloads-tracker': 5.13.0 '@mui/system': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0) '@mui/types': 7.2.4(@types/react@18.2.6) '@mui/utils': 5.12.3(react@18.2.0) '@types/react': 18.2.6 - '@types/react-transition-group': 4.4.5 + '@types/react-transition-group': 4.4.6 clsx: 1.2.1 csstype: 3.1.2 prop-types: 15.8.1 @@ -2855,8 +2855,8 @@ packages: '@types/react': 18.2.6 dev: false - /@types/react-transition-group@4.4.5: - resolution: {integrity: sha512-juKD/eiSM3/xZYzjuzH6ZwpP+/lejltmiS3QEzV/vmb/Q8+HfDmxu+Baga8UEMGBqV88Nbg4l2hY/K2DkyaLLA==} + /@types/react-transition-group@4.4.6: + resolution: {integrity: sha512-VnCdSxfcm08KjsJVQcfBmhEQAPnLB8G08hAxn39azX1qYBQ/5RVQuoHuKIcfKOdncuaUvEpFKFzEvbtIMsfVew==} dependencies: '@types/react': 18.2.6 dev: false From 4abfc91cb6cd6d694b01a9c4f017983bb6e10dc0 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 11 May 2023 05:32:30 +1000 Subject: [PATCH 32/67] build(deps): update dependency @types/node to v20.1.2 (#5422) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index 2ec18eabe..c849c3064 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.1.1", + "@types/node": "20.1.2", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index d347cd3e4..9a1ba5311 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.1.1 - version: 20.1.1 + specifier: 20.1.2 + version: 20.1.2 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.5 - version: 4.3.5(@types/node@20.1.1) + version: 4.3.5(@types/node@20.1.2) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.5) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.1.1 + '@types/node': 20.1.2 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.1)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.2)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.1.1)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.2)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2195,7 +2195,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.1.1 + '@types/node': 20.1.2 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2731,7 +2731,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.1.1 + '@types/node': 20.1.2 dev: true /@types/chai-subset@1.3.3: @@ -2747,7 +2747,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.1.1 + '@types/node': 20.1.2 dev: true /@types/eslint@8.37.0: @@ -2764,7 +2764,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.1.1 + '@types/node': 20.1.2 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2821,8 +2821,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.1.1: - resolution: {integrity: sha512-uKBEevTNb+l6/aCQaKVnUModfEMjAl98lw2Si9P5y4hLu9tm6AlX2ZIoXZX6Wh9lJueYPrGPKk5WMCNHg/u6/A==} + /@types/node@20.1.2: + resolution: {integrity: sha512-CTO/wa8x+rZU626cL2BlbCDzydgnFNgc19h4YvizpTO88MFQxab8wqisxaofQJ/9bLGugRdWIuX/TbIs6VVF6g==} dev: true /@types/normalize-package-data@2.4.1: @@ -2879,7 +2879,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.1.1 + '@types/node': 20.1.2 dev: true /@types/stack-utils@2.0.1: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.5(@types/node@20.1.1) + vite: 4.3.5(@types/node@20.1.2) transitivePeerDependencies: - supports-color dev: true @@ -3742,7 +3742,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.1)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.2)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3751,9 +3751,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.1.1 + '@types/node': 20.1.2 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.1.1)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.2)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5646,7 +5646,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.1.1 + '@types/node': 20.1.2 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7188,7 +7188,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.1.1)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.2)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7207,7 +7207,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.1.1 + '@types/node': 20.1.2 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7405,7 +7405,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@20.1.1): + /vite-node@0.31.0(@types/node@20.1.2): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7415,7 +7415,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.5(@types/node@20.1.1) + vite: 4.3.5(@types/node@20.1.2) transitivePeerDependencies: - '@types/node' - less @@ -7436,7 +7436,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.5(@types/node@20.1.1) + vite: 4.3.5(@types/node@20.1.2) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.5): @@ -7448,7 +7448,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.5(@types/node@20.1.1) + vite: 4.3.5(@types/node@20.1.2) transitivePeerDependencies: - supports-color dev: true @@ -7461,7 +7461,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.5(@types/node@20.1.1) + vite: 4.3.5(@types/node@20.1.2) transitivePeerDependencies: - rollup - supports-color @@ -7478,7 +7478,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.5(@types/node@20.1.1) + vite: 4.3.5(@types/node@20.1.2) transitivePeerDependencies: - supports-color - typescript @@ -7518,7 +7518,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.5(@types/node@20.1.1): + /vite@4.3.5(@types/node@20.1.2): resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7543,7 +7543,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.1.1 + '@types/node': 20.1.2 esbuild: 0.17.18 postcss: 8.4.23 rollup: 3.21.0 @@ -7602,7 +7602,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 20.1.1 + '@types/node': 20.1.2 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7623,8 +7623,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.5(@types/node@20.1.1) - vite-node: 0.31.0(@types/node@20.1.1) + vite: 4.3.5(@types/node@20.1.2) + vite-node: 0.31.0(@types/node@20.1.2) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 62a9f917c1a1d379eae300b59b2ab5c52e92499a Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 11 May 2023 21:26:51 +1000 Subject: [PATCH 33/67] build(deps): update dependency happy-dom to v9.11.0 (#5424) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/web/package.json b/web/package.json index c849c3064..6e87987b3 100644 --- a/web/package.json +++ b/web/package.json @@ -91,7 +91,7 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.10.9", + "happy-dom": "9.11.0", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 9a1ba5311..2a5a48dbd 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -151,8 +151,8 @@ devDependencies: specifier: 4.6.0 version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.10.9 - version: 9.10.9 + specifier: 9.11.0 + version: 9.11.0 husky: specifier: 8.0.3 version: 8.0.3 @@ -182,7 +182,7 @@ devDependencies: version: 4.2.0(typescript@5.0.4)(vite@4.3.5) vitest: specifier: 0.31.0 - version: 0.31.0(happy-dom@9.10.9) + version: 0.31.0(happy-dom@9.11.0) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -3143,7 +3143,7 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.0(happy-dom@9.10.9) + vitest: 0.31.0(happy-dom@9.11.0) transitivePeerDependencies: - supports-color dev: true @@ -5156,8 +5156,8 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.10.9: - resolution: {integrity: sha512-3RnOyu6buPMpDAyOpp8yfR5Xi/k2p5MhrDwlG/dgpVHkptFN5IqubdbGOQU5luB7ANh6a08GOuiB+Bo9JCzCBw==} + /happy-dom@9.11.0: + resolution: {integrity: sha512-wTZP0G+GLKvBtuitHVD/qrjEZQppSxZJ8mp2sF1uEZjXLnruoSgoVvPh/XkZEjG2ZT0aNgz5VYgTYWIs6XQeRQ==} dependencies: css.escape: 1.5.1 he: 1.2.0 @@ -7569,7 +7569,7 @@ packages: - terser dev: true - /vitest@0.31.0(happy-dom@9.10.9): + /vitest@0.31.0(happy-dom@9.11.0): resolution: {integrity: sha512-JwWJS9p3GU9GxkG7eBSmr4Q4x4bvVBSswaCFf1PBNHiPx00obfhHRJfgHcnI0ffn+NMlIh9QGvG75FlaIBdKGA==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7614,7 +7614,7 @@ packages: chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.10.9 + happy-dom: 9.11.0 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 From 7dcab4b9fb5113f9999f27ee71b3b3379fb65678 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 12 May 2023 04:43:03 +1000 Subject: [PATCH 34/67] build(deps): update dependency happy-dom to v9.13.0 (#5426) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/web/package.json b/web/package.json index 6e87987b3..e1f10e012 100644 --- a/web/package.json +++ b/web/package.json @@ -91,7 +91,7 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.11.0", + "happy-dom": "9.13.0", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 2a5a48dbd..96be50b99 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -151,8 +151,8 @@ devDependencies: specifier: 4.6.0 version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.11.0 - version: 9.11.0 + specifier: 9.13.0 + version: 9.13.0 husky: specifier: 8.0.3 version: 8.0.3 @@ -182,7 +182,7 @@ devDependencies: version: 4.2.0(typescript@5.0.4)(vite@4.3.5) vitest: specifier: 0.31.0 - version: 0.31.0(happy-dom@9.11.0) + version: 0.31.0(happy-dom@9.13.0) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -3143,7 +3143,7 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.0(happy-dom@9.11.0) + vitest: 0.31.0(happy-dom@9.13.0) transitivePeerDependencies: - supports-color dev: true @@ -5156,8 +5156,8 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.11.0: - resolution: {integrity: sha512-wTZP0G+GLKvBtuitHVD/qrjEZQppSxZJ8mp2sF1uEZjXLnruoSgoVvPh/XkZEjG2ZT0aNgz5VYgTYWIs6XQeRQ==} + /happy-dom@9.13.0: + resolution: {integrity: sha512-/gBB1MmiFTg5U7IwZz2r69tHSGBnzMabw+cvxHcckCpvOaJx+XA7K4AiP84HAFfk8zKqAq3X4Px9EkuUCnTeDg==} dependencies: css.escape: 1.5.1 he: 1.2.0 @@ -7569,7 +7569,7 @@ packages: - terser dev: true - /vitest@0.31.0(happy-dom@9.11.0): + /vitest@0.31.0(happy-dom@9.13.0): resolution: {integrity: sha512-JwWJS9p3GU9GxkG7eBSmr4Q4x4bvVBSswaCFf1PBNHiPx00obfhHRJfgHcnI0ffn+NMlIh9QGvG75FlaIBdKGA==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7614,7 +7614,7 @@ packages: chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.11.0 + happy-dom: 9.13.0 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 From 94b8b05fe368cc3162197d52fba3ee606dac0bef Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 12 May 2023 10:17:56 +1000 Subject: [PATCH 35/67] build(deps): update dependency happy-dom to v9.13.1 (#5428) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/web/package.json b/web/package.json index e1f10e012..a27658c8c 100644 --- a/web/package.json +++ b/web/package.json @@ -91,7 +91,7 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.13.0", + "happy-dom": "9.13.1", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 96be50b99..cbfbe6f85 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -151,8 +151,8 @@ devDependencies: specifier: 4.6.0 version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.13.0 - version: 9.13.0 + specifier: 9.13.1 + version: 9.13.1 husky: specifier: 8.0.3 version: 8.0.3 @@ -182,7 +182,7 @@ devDependencies: version: 4.2.0(typescript@5.0.4)(vite@4.3.5) vitest: specifier: 0.31.0 - version: 0.31.0(happy-dom@9.13.0) + version: 0.31.0(happy-dom@9.13.1) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -3143,7 +3143,7 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.0(happy-dom@9.13.0) + vitest: 0.31.0(happy-dom@9.13.1) transitivePeerDependencies: - supports-color dev: true @@ -5156,8 +5156,8 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.13.0: - resolution: {integrity: sha512-/gBB1MmiFTg5U7IwZz2r69tHSGBnzMabw+cvxHcckCpvOaJx+XA7K4AiP84HAFfk8zKqAq3X4Px9EkuUCnTeDg==} + /happy-dom@9.13.1: + resolution: {integrity: sha512-JAMroi7AJi7Ypn6MjxBi2qGVfPay3FORtPn7A+J6Wn1tP+8BTv8conDFS/s2FR2K7ssfwZ3tTUxNCocjEIRgZw==} dependencies: css.escape: 1.5.1 he: 1.2.0 @@ -7569,7 +7569,7 @@ packages: - terser dev: true - /vitest@0.31.0(happy-dom@9.13.0): + /vitest@0.31.0(happy-dom@9.13.1): resolution: {integrity: sha512-JwWJS9p3GU9GxkG7eBSmr4Q4x4bvVBSswaCFf1PBNHiPx00obfhHRJfgHcnI0ffn+NMlIh9QGvG75FlaIBdKGA==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7614,7 +7614,7 @@ packages: chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.13.0 + happy-dom: 9.13.1 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 From 1d99e4243606ccf92f89ab6d3786eb0f8ae1b489 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 12 May 2023 15:40:35 +1000 Subject: [PATCH 36/67] build(deps): update mariadb docker tag to v10.11.3 (#5429) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- internal/suites/example/compose/mariadb/docker-compose.yml | 2 +- internal/suites/example/kube/storage/mariadb.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/suites/example/compose/mariadb/docker-compose.yml b/internal/suites/example/compose/mariadb/docker-compose.yml index b11f351fd..e1f9301d0 100644 --- a/internal/suites/example/compose/mariadb/docker-compose.yml +++ b/internal/suites/example/compose/mariadb/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: mariadb: - image: mariadb:10.11.2 + image: mariadb:10.11.3 environment: - MYSQL_ROOT_PASSWORD=rootpassword - MYSQL_USER=admin diff --git a/internal/suites/example/kube/storage/mariadb.yml b/internal/suites/example/kube/storage/mariadb.yml index e20129778..860aea44e 100644 --- a/internal/suites/example/kube/storage/mariadb.yml +++ b/internal/suites/example/kube/storage/mariadb.yml @@ -18,7 +18,7 @@ spec: spec: containers: - name: mariadb - image: mariadb:10.11.2 + image: mariadb:10.11.3 ports: - containerPort: 3306 readinessProbe: From eda5574b9d75cbabc94d8bb9ea7159d49da7046e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 12 May 2023 15:52:21 +1000 Subject: [PATCH 37/67] build(deps): update dependency happy-dom to v9.16.0 (#5430) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 29 ++++++++++++----------------- 2 files changed, 13 insertions(+), 18 deletions(-) diff --git a/web/package.json b/web/package.json index a27658c8c..43d00a6f8 100644 --- a/web/package.json +++ b/web/package.json @@ -91,7 +91,7 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.13.1", + "happy-dom": "9.16.0", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index cbfbe6f85..b160e45e9 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -151,8 +151,8 @@ devDependencies: specifier: 4.6.0 version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.13.1 - version: 9.13.1 + specifier: 9.16.0 + version: 9.16.0 husky: specifier: 8.0.3 version: 8.0.3 @@ -182,7 +182,7 @@ devDependencies: version: 4.2.0(typescript@5.0.4)(vite@4.3.5) vitest: specifier: 0.31.0 - version: 0.31.0(happy-dom@9.13.1) + version: 0.31.0(happy-dom@9.16.0) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -2649,7 +2649,7 @@ packages: engines: {node: '>=14'} dependencies: '@babel/types': 7.21.4 - entities: 4.4.0 + entities: 4.5.0 dev: true /@svgr/plugin-jsx@7.0.0: @@ -3143,7 +3143,7 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.0(happy-dom@9.13.1) + vitest: 0.31.0(happy-dom@9.16.0) transitivePeerDependencies: - supports-color dev: true @@ -4014,8 +4014,8 @@ packages: tapable: 2.2.1 dev: true - /entities@4.4.0: - resolution: {integrity: sha512-oYp7156SP8LkeGD0GF85ad1X9Ai79WtRsZ2gxJqtBuzH+98YUV6jkHEKlZkMbcrjJjIVJNIDP/3WL9wQkoPbWA==} + /entities@4.5.0: + resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==} engines: {node: '>=0.12'} dev: true @@ -5156,11 +5156,11 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.13.1: - resolution: {integrity: sha512-JAMroi7AJi7Ypn6MjxBi2qGVfPay3FORtPn7A+J6Wn1tP+8BTv8conDFS/s2FR2K7ssfwZ3tTUxNCocjEIRgZw==} + /happy-dom@9.16.0: + resolution: {integrity: sha512-goq7grRjIiV2Svb251LWQOo/xm04za2mJ9+assbZJx1KnaVOX1gZBBp4MHbiFNkR6JW7UL81iCtZxCVu+qU5ng==} dependencies: css.escape: 1.5.1 - he: 1.2.0 + entities: 4.5.0 iconv-lite: 0.6.3 webidl-conversions: 7.0.0 whatwg-encoding: 2.0.0 @@ -5214,11 +5214,6 @@ packages: dependencies: function-bind: 1.1.1 - /he@1.2.0: - resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==} - hasBin: true - dev: true - /hoist-non-react-statics@3.3.2: resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==} dependencies: @@ -7569,7 +7564,7 @@ packages: - terser dev: true - /vitest@0.31.0(happy-dom@9.13.1): + /vitest@0.31.0(happy-dom@9.16.0): resolution: {integrity: sha512-JwWJS9p3GU9GxkG7eBSmr4Q4x4bvVBSswaCFf1PBNHiPx00obfhHRJfgHcnI0ffn+NMlIh9QGvG75FlaIBdKGA==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7614,7 +7609,7 @@ packages: chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.13.1 + happy-dom: 9.16.0 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 From ca1d36a214229047162dfeed1bc7e4619394b64a Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 12 May 2023 11:36:58 +0000 Subject: [PATCH 38/67] build(deps): update dependency @types/node to v20.1.3 (#5427) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index 43d00a6f8..82e141bf0 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.1.2", + "@types/node": "20.1.3", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index b160e45e9..c8f8a2e6a 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.1.2 - version: 20.1.2 + specifier: 20.1.3 + version: 20.1.3 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.5 - version: 4.3.5(@types/node@20.1.2) + version: 4.3.5(@types/node@20.1.3) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.5) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.1.2 + '@types/node': 20.1.3 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.2)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.3)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.1.2)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.3)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2195,7 +2195,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.1.2 + '@types/node': 20.1.3 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2731,7 +2731,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.1.2 + '@types/node': 20.1.3 dev: true /@types/chai-subset@1.3.3: @@ -2747,7 +2747,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.1.2 + '@types/node': 20.1.3 dev: true /@types/eslint@8.37.0: @@ -2764,7 +2764,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.1.2 + '@types/node': 20.1.3 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2821,8 +2821,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.1.2: - resolution: {integrity: sha512-CTO/wa8x+rZU626cL2BlbCDzydgnFNgc19h4YvizpTO88MFQxab8wqisxaofQJ/9bLGugRdWIuX/TbIs6VVF6g==} + /@types/node@20.1.3: + resolution: {integrity: sha512-NP2yfZpgmf2eDRPmgGq+fjGjSwFgYbihA8/gK+ey23qT9RkxsgNTZvGOEpXgzIGqesTYkElELLgtKoMQTys5vA==} dev: true /@types/normalize-package-data@2.4.1: @@ -2879,7 +2879,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.1.2 + '@types/node': 20.1.3 dev: true /@types/stack-utils@2.0.1: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.5(@types/node@20.1.2) + vite: 4.3.5(@types/node@20.1.3) transitivePeerDependencies: - supports-color dev: true @@ -3742,7 +3742,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.2)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.3)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3751,9 +3751,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.1.2 + '@types/node': 20.1.3 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.1.2)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.3)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5641,7 +5641,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.1.2 + '@types/node': 20.1.3 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7183,7 +7183,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.1.2)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.3)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7202,7 +7202,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.1.2 + '@types/node': 20.1.3 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7400,7 +7400,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@20.1.2): + /vite-node@0.31.0(@types/node@20.1.3): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7410,7 +7410,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.5(@types/node@20.1.2) + vite: 4.3.5(@types/node@20.1.3) transitivePeerDependencies: - '@types/node' - less @@ -7431,7 +7431,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.5(@types/node@20.1.2) + vite: 4.3.5(@types/node@20.1.3) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.5): @@ -7443,7 +7443,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.5(@types/node@20.1.2) + vite: 4.3.5(@types/node@20.1.3) transitivePeerDependencies: - supports-color dev: true @@ -7456,7 +7456,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.5(@types/node@20.1.2) + vite: 4.3.5(@types/node@20.1.3) transitivePeerDependencies: - rollup - supports-color @@ -7473,7 +7473,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.5(@types/node@20.1.2) + vite: 4.3.5(@types/node@20.1.3) transitivePeerDependencies: - supports-color - typescript @@ -7513,7 +7513,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.5(@types/node@20.1.2): + /vite@4.3.5(@types/node@20.1.3): resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7538,7 +7538,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.1.2 + '@types/node': 20.1.3 esbuild: 0.17.18 postcss: 8.4.23 rollup: 3.21.0 @@ -7597,7 +7597,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 20.1.2 + '@types/node': 20.1.3 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7618,8 +7618,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.5(@types/node@20.1.2) - vite-node: 0.31.0(@types/node@20.1.2) + vite: 4.3.5(@types/node@20.1.3) + vite-node: 0.31.0(@types/node@20.1.3) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 14084e1ae1c7b1a3399ca4f3c8012c70f5812d43 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 13 May 2023 11:21:01 +1000 Subject: [PATCH 39/67] build(deps): update dependency esbuild to v0.17.19 (#5433) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 142 ++++++++++++++++++++++----------------------- 2 files changed, 72 insertions(+), 72 deletions(-) diff --git a/web/package.json b/web/package.json index 82e141bf0..50bec6b22 100644 --- a/web/package.json +++ b/web/package.json @@ -80,7 +80,7 @@ "@typescript-eslint/parser": "5.59.5", "@vitejs/plugin-react": "4.0.0", "@vitest/coverage-istanbul": "0.31.0", - "esbuild": "0.17.18", + "esbuild": "0.17.19", "eslint": "8.40.0", "eslint-config-prettier": "8.8.0", "eslint-config-react-app": "7.0.1", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index c8f8a2e6a..c122a9eb5 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -118,8 +118,8 @@ devDependencies: specifier: 0.31.0 version: 0.31.0(vitest@0.31.0) esbuild: - specifier: 0.17.18 - version: 0.17.18 + specifier: 0.17.19 + version: 0.17.19 eslint: specifier: 8.40.0 version: 8.40.0 @@ -1844,8 +1844,8 @@ packages: resolution: {integrity: sha512-EsBwpc7hBUJWAsNPBmJy4hxWx12v6bshQsldrVmjxJoc3isbxhOrF2IcCpaXxfvq03NwkI7sbsOLXbYuqF/8Ww==} dev: false - /@esbuild/android-arm64@0.17.18: - resolution: {integrity: sha512-/iq0aK0eeHgSC3z55ucMAHO05OIqmQehiGay8eP5l/5l+iEr4EIbh4/MI8xD9qRFjqzgkc0JkX0LculNC9mXBw==} + /@esbuild/android-arm64@0.17.19: + resolution: {integrity: sha512-KBMWvEZooR7+kzY0BtbTQn0OAYY7CsiydT63pVEaPtVYF0hXbUaOyZog37DKxK7NF3XacBJOpYT4adIJh+avxA==} engines: {node: '>=12'} cpu: [arm64] os: [android] @@ -1862,8 +1862,8 @@ packages: dev: true optional: true - /@esbuild/android-arm@0.17.18: - resolution: {integrity: sha512-EmwL+vUBZJ7mhFCs5lA4ZimpUH3WMAoqvOIYhVQwdIgSpHC8ImHdsRyhHAVxpDYUSm0lWvd63z0XH1IlImS2Qw==} + /@esbuild/android-arm@0.17.19: + resolution: {integrity: sha512-rIKddzqhmav7MSmoFCmDIb6e2W57geRsM94gV2l38fzhXMwq7hZoClug9USI2pFRGL06f4IOPHHpFNOkWieR8A==} engines: {node: '>=12'} cpu: [arm] os: [android] @@ -1871,8 +1871,8 @@ packages: dev: true optional: true - /@esbuild/android-x64@0.17.18: - resolution: {integrity: sha512-x+0efYNBF3NPW2Xc5bFOSFW7tTXdAcpfEg2nXmxegm4mJuVeS+i109m/7HMiOQ6M12aVGGFlqJX3RhNdYM2lWg==} + /@esbuild/android-x64@0.17.19: + resolution: {integrity: sha512-uUTTc4xGNDT7YSArp/zbtmbhO0uEEK9/ETW29Wk1thYUJBz3IVnvgEiEwEa9IeLyvnpKrWK64Utw2bgUmDveww==} engines: {node: '>=12'} cpu: [x64] os: [android] @@ -1880,8 +1880,8 @@ packages: dev: true optional: true - /@esbuild/darwin-arm64@0.17.18: - resolution: {integrity: sha512-6tY+djEAdF48M1ONWnQb1C+6LiXrKjmqjzPNPWXhu/GzOHTHX2nh8Mo2ZAmBFg0kIodHhciEgUBtcYCAIjGbjQ==} + /@esbuild/darwin-arm64@0.17.19: + resolution: {integrity: sha512-80wEoCfF/hFKM6WE1FyBHc9SfUblloAWx6FJkFWTWiCoht9Mc0ARGEM47e67W9rI09YoUxJL68WHfDRYEAvOhg==} engines: {node: '>=12'} cpu: [arm64] os: [darwin] @@ -1889,8 +1889,8 @@ packages: dev: true optional: true - /@esbuild/darwin-x64@0.17.18: - resolution: {integrity: sha512-Qq84ykvLvya3dO49wVC9FFCNUfSrQJLbxhoQk/TE1r6MjHo3sFF2tlJCwMjhkBVq3/ahUisj7+EpRSz0/+8+9A==} + /@esbuild/darwin-x64@0.17.19: + resolution: {integrity: sha512-IJM4JJsLhRYr9xdtLytPLSH9k/oxR3boaUIYiHkAawtwNOXKE8KoU8tMvryogdcT8AU+Bflmh81Xn6Q0vTZbQw==} engines: {node: '>=12'} cpu: [x64] os: [darwin] @@ -1898,8 +1898,8 @@ packages: dev: true optional: true - /@esbuild/freebsd-arm64@0.17.18: - resolution: {integrity: sha512-fw/ZfxfAzuHfaQeMDhbzxp9mc+mHn1Y94VDHFHjGvt2Uxl10mT4CDavHm+/L9KG441t1QdABqkVYwakMUeyLRA==} + /@esbuild/freebsd-arm64@0.17.19: + resolution: {integrity: sha512-pBwbc7DufluUeGdjSU5Si+P3SoMF5DQ/F/UmTSb8HXO80ZEAJmrykPyzo1IfNbAoaqw48YRpv8shwd1NoI0jcQ==} engines: {node: '>=12'} cpu: [arm64] os: [freebsd] @@ -1907,8 +1907,8 @@ packages: dev: true optional: true - /@esbuild/freebsd-x64@0.17.18: - resolution: {integrity: sha512-FQFbRtTaEi8ZBi/A6kxOC0V0E9B/97vPdYjY9NdawyLd4Qk5VD5g2pbWN2VR1c0xhzcJm74HWpObPszWC+qTew==} + /@esbuild/freebsd-x64@0.17.19: + resolution: {integrity: sha512-4lu+n8Wk0XlajEhbEffdy2xy53dpR06SlzvhGByyg36qJw6Kpfk7cp45DR/62aPH9mtJRmIyrXAS5UWBrJT6TQ==} engines: {node: '>=12'} cpu: [x64] os: [freebsd] @@ -1916,8 +1916,8 @@ packages: dev: true optional: true - /@esbuild/linux-arm64@0.17.18: - resolution: {integrity: sha512-R7pZvQZFOY2sxUG8P6A21eq6q+eBv7JPQYIybHVf1XkQYC+lT7nDBdC7wWKTrbvMXKRaGudp/dzZCwL/863mZQ==} + /@esbuild/linux-arm64@0.17.19: + resolution: {integrity: sha512-ct1Tg3WGwd3P+oZYqic+YZF4snNl2bsnMKRkb3ozHmnM0dGWuxcPTTntAF6bOP0Sp4x0PjSF+4uHQ1xvxfRKqg==} engines: {node: '>=12'} cpu: [arm64] os: [linux] @@ -1925,8 +1925,8 @@ packages: dev: true optional: true - /@esbuild/linux-arm@0.17.18: - resolution: {integrity: sha512-jW+UCM40LzHcouIaqv3e/oRs0JM76JfhHjCavPxMUti7VAPh8CaGSlS7cmyrdpzSk7A+8f0hiedHqr/LMnfijg==} + /@esbuild/linux-arm@0.17.19: + resolution: {integrity: sha512-cdmT3KxjlOQ/gZ2cjfrQOtmhG4HJs6hhvm3mWSRDPtZ/lP5oe8FWceS10JaSJC13GBd4eH/haHnqf7hhGNLerA==} engines: {node: '>=12'} cpu: [arm] os: [linux] @@ -1934,8 +1934,8 @@ packages: dev: true optional: true - /@esbuild/linux-ia32@0.17.18: - resolution: {integrity: sha512-ygIMc3I7wxgXIxk6j3V00VlABIjq260i967Cp9BNAk5pOOpIXmd1RFQJQX9Io7KRsthDrQYrtcx7QCof4o3ZoQ==} + /@esbuild/linux-ia32@0.17.19: + resolution: {integrity: sha512-w4IRhSy1VbsNxHRQpeGCHEmibqdTUx61Vc38APcsRbuVgK0OPEnQ0YD39Brymn96mOx48Y2laBQGqgZ0j9w6SQ==} engines: {node: '>=12'} cpu: [ia32] os: [linux] @@ -1952,8 +1952,8 @@ packages: dev: true optional: true - /@esbuild/linux-loong64@0.17.18: - resolution: {integrity: sha512-bvPG+MyFs5ZlwYclCG1D744oHk1Pv7j8psF5TfYx7otCVmcJsEXgFEhQkbhNW8otDHL1a2KDINW20cfCgnzgMQ==} + /@esbuild/linux-loong64@0.17.19: + resolution: {integrity: sha512-2iAngUbBPMq439a+z//gE+9WBldoMp1s5GWsUSgqHLzLJ9WoZLZhpwWuym0u0u/4XmZ3gpHmzV84PonE+9IIdQ==} engines: {node: '>=12'} cpu: [loong64] os: [linux] @@ -1961,8 +1961,8 @@ packages: dev: true optional: true - /@esbuild/linux-mips64el@0.17.18: - resolution: {integrity: sha512-oVqckATOAGuiUOa6wr8TXaVPSa+6IwVJrGidmNZS1cZVx0HqkTMkqFGD2HIx9H1RvOwFeWYdaYbdY6B89KUMxA==} + /@esbuild/linux-mips64el@0.17.19: + resolution: {integrity: sha512-LKJltc4LVdMKHsrFe4MGNPp0hqDFA1Wpt3jE1gEyM3nKUvOiO//9PheZZHfYRfYl6AwdTH4aTcXSqBerX0ml4A==} engines: {node: '>=12'} cpu: [mips64el] os: [linux] @@ -1970,8 +1970,8 @@ packages: dev: true optional: true - /@esbuild/linux-ppc64@0.17.18: - resolution: {integrity: sha512-3dLlQO+b/LnQNxgH4l9rqa2/IwRJVN9u/bK63FhOPB4xqiRqlQAU0qDU3JJuf0BmaH0yytTBdoSBHrb2jqc5qQ==} + /@esbuild/linux-ppc64@0.17.19: + resolution: {integrity: sha512-/c/DGybs95WXNS8y3Ti/ytqETiW7EU44MEKuCAcpPto3YjQbyK3IQVKfF6nbghD7EcLUGl0NbiL5Rt5DMhn5tg==} engines: {node: '>=12'} cpu: [ppc64] os: [linux] @@ -1979,8 +1979,8 @@ packages: dev: true optional: true - /@esbuild/linux-riscv64@0.17.18: - resolution: {integrity: sha512-/x7leOyDPjZV3TcsdfrSI107zItVnsX1q2nho7hbbQoKnmoeUWjs+08rKKt4AUXju7+3aRZSsKrJtaRmsdL1xA==} + /@esbuild/linux-riscv64@0.17.19: + resolution: {integrity: sha512-FC3nUAWhvFoutlhAkgHf8f5HwFWUL6bYdvLc/TTuxKlvLi3+pPzdZiFKSWz/PF30TB1K19SuCxDTI5KcqASJqA==} engines: {node: '>=12'} cpu: [riscv64] os: [linux] @@ -1988,8 +1988,8 @@ packages: dev: true optional: true - /@esbuild/linux-s390x@0.17.18: - resolution: {integrity: sha512-cX0I8Q9xQkL/6F5zWdYmVf5JSQt+ZfZD2bJudZrWD+4mnUvoZ3TDDXtDX2mUaq6upMFv9FlfIh4Gfun0tbGzuw==} + /@esbuild/linux-s390x@0.17.19: + resolution: {integrity: sha512-IbFsFbxMWLuKEbH+7sTkKzL6NJmG2vRyy6K7JJo55w+8xDk7RElYn6xvXtDW8HCfoKBFK69f3pgBJSUSQPr+4Q==} engines: {node: '>=12'} cpu: [s390x] os: [linux] @@ -1997,8 +1997,8 @@ packages: dev: true optional: true - /@esbuild/linux-x64@0.17.18: - resolution: {integrity: sha512-66RmRsPlYy4jFl0vG80GcNRdirx4nVWAzJmXkevgphP1qf4dsLQCpSKGM3DUQCojwU1hnepI63gNZdrr02wHUA==} + /@esbuild/linux-x64@0.17.19: + resolution: {integrity: sha512-68ngA9lg2H6zkZcyp22tsVt38mlhWde8l3eJLWkyLrp4HwMUr3c1s/M2t7+kHIhvMjglIBrFpncX1SzMckomGw==} engines: {node: '>=12'} cpu: [x64] os: [linux] @@ -2006,8 +2006,8 @@ packages: dev: true optional: true - /@esbuild/netbsd-x64@0.17.18: - resolution: {integrity: sha512-95IRY7mI2yrkLlTLb1gpDxdC5WLC5mZDi+kA9dmM5XAGxCME0F8i4bYH4jZreaJ6lIZ0B8hTrweqG1fUyW7jbg==} + /@esbuild/netbsd-x64@0.17.19: + resolution: {integrity: sha512-CwFq42rXCR8TYIjIfpXCbRX0rp1jo6cPIUPSaWwzbVI4aOfX96OXY8M6KNmtPcg7QjYeDmN+DD0Wp3LaBOLf4Q==} engines: {node: '>=12'} cpu: [x64] os: [netbsd] @@ -2015,8 +2015,8 @@ packages: dev: true optional: true - /@esbuild/openbsd-x64@0.17.18: - resolution: {integrity: sha512-WevVOgcng+8hSZ4Q3BKL3n1xTv5H6Nb53cBrtzzEjDbbnOmucEVcZeGCsCOi9bAOcDYEeBZbD2SJNBxlfP3qiA==} + /@esbuild/openbsd-x64@0.17.19: + resolution: {integrity: sha512-cnq5brJYrSZ2CF6c35eCmviIN3k3RczmHz8eYaVlNasVqsNY+JKohZU5MKmaOI+KkllCdzOKKdPs762VCPC20g==} engines: {node: '>=12'} cpu: [x64] os: [openbsd] @@ -2024,8 +2024,8 @@ packages: dev: true optional: true - /@esbuild/sunos-x64@0.17.18: - resolution: {integrity: sha512-Rzf4QfQagnwhQXVBS3BYUlxmEbcV7MY+BH5vfDZekU5eYpcffHSyjU8T0xucKVuOcdCsMo+Ur5wmgQJH2GfNrg==} + /@esbuild/sunos-x64@0.17.19: + resolution: {integrity: sha512-vCRT7yP3zX+bKWFeP/zdS6SqdWB8OIpaRq/mbXQxTGHnIxspRtigpkUcDMlSCOejlHowLqII7K2JKevwyRP2rg==} engines: {node: '>=12'} cpu: [x64] os: [sunos] @@ -2033,8 +2033,8 @@ packages: dev: true optional: true - /@esbuild/win32-arm64@0.17.18: - resolution: {integrity: sha512-Kb3Ko/KKaWhjeAm2YoT/cNZaHaD1Yk/pa3FTsmqo9uFh1D1Rfco7BBLIPdDOozrObj2sahslFuAQGvWbgWldAg==} + /@esbuild/win32-arm64@0.17.19: + resolution: {integrity: sha512-yYx+8jwowUstVdorcMdNlzklLYhPxjniHWFKgRqH7IFlUEa0Umu3KuYplf1HUZZ422e3NU9F4LGb+4O0Kdcaag==} engines: {node: '>=12'} cpu: [arm64] os: [win32] @@ -2042,8 +2042,8 @@ packages: dev: true optional: true - /@esbuild/win32-ia32@0.17.18: - resolution: {integrity: sha512-0/xUMIdkVHwkvxfbd5+lfG7mHOf2FRrxNbPiKWg9C4fFrB8H0guClmaM3BFiRUYrznVoyxTIyC/Ou2B7QQSwmw==} + /@esbuild/win32-ia32@0.17.19: + resolution: {integrity: sha512-eggDKanJszUtCdlVs0RB+h35wNlb5v4TWEkq4vZcmVt5u/HiDZrTXe2bWFQUez3RgNHwx/x4sk5++4NSSicKkw==} engines: {node: '>=12'} cpu: [ia32] os: [win32] @@ -2051,8 +2051,8 @@ packages: dev: true optional: true - /@esbuild/win32-x64@0.17.18: - resolution: {integrity: sha512-qU25Ma1I3NqTSHJUOKi9sAH1/Mzuvlke0ioMJRthLXKm7JiSKVwFghlGbDLOO2sARECGhja4xYfRAZNPAkooYg==} + /@esbuild/win32-x64@0.17.19: + resolution: {integrity: sha512-lAhycmKnVOuRYNtRtatQR1LPQf2oYCkRGkSFnseDAKPl8lu5SOsK/e1sXe5a0Pc5kHIHe6P2I/ilntNv2xf3cA==} engines: {node: '>=12'} cpu: [x64] os: [win32] @@ -4312,34 +4312,34 @@ packages: esbuild-windows-arm64: 0.15.18 dev: true - /esbuild@0.17.18: - resolution: {integrity: sha512-z1lix43jBs6UKjcZVKOw2xx69ffE2aG0PygLL5qJ9OS/gy0Ewd1gW/PUQIOIQGXBHWNywSc0floSKoMFF8aK2w==} + /esbuild@0.17.19: + resolution: {integrity: sha512-XQ0jAPFkK/u3LcVRcvVHQcTIqD6E2H1fvZMA5dQPSOWb3suUbWbfbRf94pjc0bNzRYLfIrDRQXr7X+LHIm5oHw==} engines: {node: '>=12'} hasBin: true requiresBuild: true optionalDependencies: - '@esbuild/android-arm': 0.17.18 - '@esbuild/android-arm64': 0.17.18 - '@esbuild/android-x64': 0.17.18 - '@esbuild/darwin-arm64': 0.17.18 - '@esbuild/darwin-x64': 0.17.18 - '@esbuild/freebsd-arm64': 0.17.18 - '@esbuild/freebsd-x64': 0.17.18 - '@esbuild/linux-arm': 0.17.18 - '@esbuild/linux-arm64': 0.17.18 - '@esbuild/linux-ia32': 0.17.18 - '@esbuild/linux-loong64': 0.17.18 - '@esbuild/linux-mips64el': 0.17.18 - '@esbuild/linux-ppc64': 0.17.18 - '@esbuild/linux-riscv64': 0.17.18 - '@esbuild/linux-s390x': 0.17.18 - '@esbuild/linux-x64': 0.17.18 - '@esbuild/netbsd-x64': 0.17.18 - '@esbuild/openbsd-x64': 0.17.18 - '@esbuild/sunos-x64': 0.17.18 - '@esbuild/win32-arm64': 0.17.18 - '@esbuild/win32-ia32': 0.17.18 - '@esbuild/win32-x64': 0.17.18 + '@esbuild/android-arm': 0.17.19 + '@esbuild/android-arm64': 0.17.19 + '@esbuild/android-x64': 0.17.19 + '@esbuild/darwin-arm64': 0.17.19 + '@esbuild/darwin-x64': 0.17.19 + '@esbuild/freebsd-arm64': 0.17.19 + '@esbuild/freebsd-x64': 0.17.19 + '@esbuild/linux-arm': 0.17.19 + '@esbuild/linux-arm64': 0.17.19 + '@esbuild/linux-ia32': 0.17.19 + '@esbuild/linux-loong64': 0.17.19 + '@esbuild/linux-mips64el': 0.17.19 + '@esbuild/linux-ppc64': 0.17.19 + '@esbuild/linux-riscv64': 0.17.19 + '@esbuild/linux-s390x': 0.17.19 + '@esbuild/linux-x64': 0.17.19 + '@esbuild/netbsd-x64': 0.17.19 + '@esbuild/openbsd-x64': 0.17.19 + '@esbuild/sunos-x64': 0.17.19 + '@esbuild/win32-arm64': 0.17.19 + '@esbuild/win32-ia32': 0.17.19 + '@esbuild/win32-x64': 0.17.19 dev: true /escalade@3.1.1: @@ -7539,7 +7539,7 @@ packages: optional: true dependencies: '@types/node': 20.1.3 - esbuild: 0.17.18 + esbuild: 0.17.19 postcss: 8.4.23 rollup: 3.21.0 optionalDependencies: From e37f19c170ba9ab92fedb519f045a345919651bb Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sat, 13 May 2023 13:19:47 +1000 Subject: [PATCH 40/67] build: allow users to set the umask easily (#5407) This adds an easy way for users to set a UMASK in the container. Signed-off-by: James Elliott --- .../en/integration/deployment/docker.md | 44 ++++++++++++++++--- entrypoint.sh | 4 +- 2 files changed, 41 insertions(+), 7 deletions(-) diff --git a/docs/content/en/integration/deployment/docker.md b/docs/content/en/integration/deployment/docker.md index 3aee92211..b063d057c 100644 --- a/docs/content/en/integration/deployment/docker.md +++ b/docs/content/en/integration/deployment/docker.md @@ -18,6 +18,44 @@ The [Docker] container is deployed with the following image names: * [docker.io/authelia/authelia](https://hub.docker.com/r/authelia/authelia) * [ghcr.io/authelia/authelia](https://github.com/authelia/authelia/pkgs/container/authelia) +## Get Started + +It's __*strongly recommended*__ that users setting up *Authelia* for the first time take a look at our +[Get Started](../prologue/get-started.md) guide. This takes you through various steps which are essential to +bootstrapping *Authelia*. + +## Container + +### Environment Variables + +Several environment variables apply specifically to the official container. This table documents them. It is important +to note these environment variables are specific to the container and have no effect on the *Authelia* daemon itself and +this section is not meant to document the daemon environment variables. + +| Name | Default | Usage | +|:-----:|:-------:|:---------------------------------------------------------------------------------------------:| +| PUID | 0 | If the container is running as UID 0, it will drop privileges to this UID via the entrypoint | +| PGID | 0 | If the container is running as UID 0, it will drop privileges to this GID via the entrypoint | +| UMASK | N/A | If set the container will run with the provided UMASK by running the `umask ${UMASK}` command | + +### Permission Context + +By default the container runs as the configured [Docker] daemon user. Users can control this behaviour in several ways. + +The first and recommended way is instructing the [Docker] daemon to run the *Authelia* container as another user. See +the [docker run] or [Docker Compose file reference documentation](https://docs.docker.com/compose/compose-file/05-services/#user) +for more information. The best part of this method is the process will never have privileged access, and the only +negative is the user must manually configure the filesystem permissions correctly. + +The second method is by using the environment variables listed above. The downside to this method is that the entrypoint +itself will run as UID 0 (root). The advantage is the container will automatically set owner and permissions on the +filesystem correctly. + +The last method which is beyond our documentation or support is using the +[user namespace](https://docs.docker.com/engine/security/userns-remap/) facility [Docker] provides. + +[docker run]: https://docs.docker.com/engine/reference/commandline/run/ + ## Docker Compose We provide two main [Docker Compose] examples which can be utilized to help test *Authelia* or can be adapted into your @@ -27,12 +65,6 @@ existing [Docker Compose]. * [Bundle: lite](#lite) * [Bundle: local](#local) -### Get Started - -It's __*strongly recommended*__ that users setting up *Authelia* for the first time take a look at our -[Get Started](../prologue/get-started.md) guide. This takes you through various steps which are essential to -bootstrapping *Authelia*. - ### Standalone Example The following examples are [Docker Compose] deployments with just *Authelia* and no bundled applications or diff --git a/entrypoint.sh b/entrypoint.sh index f331a2209..6927aad5b 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,5 +1,7 @@ #!/bin/sh +[[ ! -z ${UMASK} ]] && umask ${UMASK} + if [[ ! -z ${1} ]] && [[ ${1} != "--config" ]]; then exec "$@" elif [[ $(id -u) != 0 ]] || [[ $(id -g) != 0 ]]; then @@ -7,4 +9,4 @@ elif [[ $(id -u) != 0 ]] || [[ $(id -g) != 0 ]]; then else chown -R ${PUID}:${PGID} /config exec su-exec ${PUID}:${PGID} authelia "$@" -fi \ No newline at end of file +fi From 26dd3f4995ff5f0a4473da7329e53c832502ba63 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 14 May 2023 12:34:23 +1000 Subject: [PATCH 41/67] build(deps): update dependency @types/node to v20.1.4 (#5435) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index 50bec6b22..3cecc3178 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.1.3", + "@types/node": "20.1.4", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index c122a9eb5..0ffa79673 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.1.3 - version: 20.1.3 + specifier: 20.1.4 + version: 20.1.4 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.5 - version: 4.3.5(@types/node@20.1.3) + version: 4.3.5(@types/node@20.1.4) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.5) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.1.3 + '@types/node': 20.1.4 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.3)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.4)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.1.3)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.4)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2195,7 +2195,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.1.3 + '@types/node': 20.1.4 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2731,7 +2731,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.1.3 + '@types/node': 20.1.4 dev: true /@types/chai-subset@1.3.3: @@ -2747,7 +2747,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.1.3 + '@types/node': 20.1.4 dev: true /@types/eslint@8.37.0: @@ -2764,7 +2764,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.1.3 + '@types/node': 20.1.4 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2821,8 +2821,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.1.3: - resolution: {integrity: sha512-NP2yfZpgmf2eDRPmgGq+fjGjSwFgYbihA8/gK+ey23qT9RkxsgNTZvGOEpXgzIGqesTYkElELLgtKoMQTys5vA==} + /@types/node@20.1.4: + resolution: {integrity: sha512-At4pvmIOki8yuwLtd7BNHl3CiWNbtclUbNtScGx4OHfBd4/oWoJC8KRCIxXwkdndzhxOsPXihrsOoydxBjlE9Q==} dev: true /@types/normalize-package-data@2.4.1: @@ -2879,7 +2879,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.1.3 + '@types/node': 20.1.4 dev: true /@types/stack-utils@2.0.1: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.5(@types/node@20.1.3) + vite: 4.3.5(@types/node@20.1.4) transitivePeerDependencies: - supports-color dev: true @@ -3742,7 +3742,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.3)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.4)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3751,9 +3751,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.1.3 + '@types/node': 20.1.4 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.1.3)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.4)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5641,7 +5641,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.1.3 + '@types/node': 20.1.4 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7183,7 +7183,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.1.3)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.4)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7202,7 +7202,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.1.3 + '@types/node': 20.1.4 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7400,7 +7400,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@20.1.3): + /vite-node@0.31.0(@types/node@20.1.4): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7410,7 +7410,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.5(@types/node@20.1.3) + vite: 4.3.5(@types/node@20.1.4) transitivePeerDependencies: - '@types/node' - less @@ -7431,7 +7431,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.5(@types/node@20.1.3) + vite: 4.3.5(@types/node@20.1.4) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.5): @@ -7443,7 +7443,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.5(@types/node@20.1.3) + vite: 4.3.5(@types/node@20.1.4) transitivePeerDependencies: - supports-color dev: true @@ -7456,7 +7456,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.5(@types/node@20.1.3) + vite: 4.3.5(@types/node@20.1.4) transitivePeerDependencies: - rollup - supports-color @@ -7473,7 +7473,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.5(@types/node@20.1.3) + vite: 4.3.5(@types/node@20.1.4) transitivePeerDependencies: - supports-color - typescript @@ -7513,7 +7513,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.5(@types/node@20.1.3): + /vite@4.3.5(@types/node@20.1.4): resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7538,7 +7538,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.1.3 + '@types/node': 20.1.4 esbuild: 0.17.19 postcss: 8.4.23 rollup: 3.21.0 @@ -7597,7 +7597,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 20.1.3 + '@types/node': 20.1.4 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7618,8 +7618,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.5(@types/node@20.1.3) - vite-node: 0.31.0(@types/node@20.1.3) + vite: 4.3.5(@types/node@20.1.4) + vite-node: 0.31.0(@types/node@20.1.4) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From c729d33da6a1de84bd20c17c6b2bf10dc5d74cc1 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 14 May 2023 05:03:01 +0000 Subject: [PATCH 42/67] build(deps): update dependency happy-dom to v9.18.3 (#5431) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/web/package.json b/web/package.json index 3cecc3178..42f57be4c 100644 --- a/web/package.json +++ b/web/package.json @@ -91,7 +91,7 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.16.0", + "happy-dom": "9.18.3", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 0ffa79673..6d765fb6a 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -151,8 +151,8 @@ devDependencies: specifier: 4.6.0 version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.16.0 - version: 9.16.0 + specifier: 9.18.3 + version: 9.18.3 husky: specifier: 8.0.3 version: 8.0.3 @@ -182,7 +182,7 @@ devDependencies: version: 4.2.0(typescript@5.0.4)(vite@4.3.5) vitest: specifier: 0.31.0 - version: 0.31.0(happy-dom@9.16.0) + version: 0.31.0(happy-dom@9.18.3) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -3143,7 +3143,7 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.0(happy-dom@9.16.0) + vitest: 0.31.0(happy-dom@9.18.3) transitivePeerDependencies: - supports-color dev: true @@ -5156,8 +5156,8 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.16.0: - resolution: {integrity: sha512-goq7grRjIiV2Svb251LWQOo/xm04za2mJ9+assbZJx1KnaVOX1gZBBp4MHbiFNkR6JW7UL81iCtZxCVu+qU5ng==} + /happy-dom@9.18.3: + resolution: {integrity: sha512-b7iMGYeIXvUryNultA0AHEVU0FPpb2djJ/xSVlMDfP7HG4z7FomdqkCEpWtSv1zDL+t1gRUoBbpqFCoUBvjYtg==} dependencies: css.escape: 1.5.1 entities: 4.5.0 @@ -7564,7 +7564,7 @@ packages: - terser dev: true - /vitest@0.31.0(happy-dom@9.16.0): + /vitest@0.31.0(happy-dom@9.18.3): resolution: {integrity: sha512-JwWJS9p3GU9GxkG7eBSmr4Q4x4bvVBSswaCFf1PBNHiPx00obfhHRJfgHcnI0ffn+NMlIh9QGvG75FlaIBdKGA==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7609,7 +7609,7 @@ packages: chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.16.0 + happy-dom: 9.18.3 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 From 1dbfbc5f888f9d428ab023d0fd5919dd055b4354 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 15 May 2023 09:51:59 +1000 Subject: [PATCH 43/67] feat(oidc): client_secret_jwt client auth (#5253) This adds the authentication machinery for the client_secret_jwt to the Default Client Authentication Strategy. Signed-off-by: James Elliott --- config.template.yml | 4 + .../identity-providers/open-id-connect.md | 9 +- .../openid-connect/introduction.md | 2 +- internal/configuration/config.template.yml | 4 + .../schema/identity_providers.go | 3 +- internal/configuration/schema/keys.go | 1 + internal/configuration/validator/const.go | 14 +- .../validator/identity_providers.go | 29 +- .../validator/identity_providers_test.go | 185 +- internal/handlers/handler_oidc_token_test.go | 1512 +++++++++++++++++ internal/handlers/handler_oidc_userinfo.go | 4 +- internal/oidc/client.go | 9 +- internal/oidc/client_auth.go | 331 ++++ internal/oidc/client_test.go | 14 +- internal/oidc/const.go | 40 +- internal/oidc/const_test.go | 62 +- internal/oidc/discovery.go | 12 +- internal/oidc/errors.go | 2 +- internal/oidc/keys.go | 8 +- internal/oidc/keys_test.go | 2 +- internal/oidc/provider.go | 1 + internal/oidc/provider_test.go | 45 +- internal/oidc/store_test.go | 10 +- internal/oidc/types.go | 12 + internal/oidc/types_test.go | 8 - 25 files changed, 2170 insertions(+), 153 deletions(-) create mode 100644 internal/handlers/handler_oidc_token_test.go create mode 100644 internal/oidc/client_auth.go diff --git a/config.template.yml b/config.template.yml index 2319109de..69270a5d0 100644 --- a/config.template.yml +++ b/config.template.yml @@ -1517,6 +1517,10 @@ notifier: ## The permitted client authentication method for the Token Endpoint for this client. # token_endpoint_auth_method: 'client_secret_basic' + ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using + ## the 'client_secret_jwt' token_endpoint_auth_method. + # token_endpoint_auth_signing_alg: HS256 + ## The policy to require for this client; one_factor or two_factor. # authorization_policy: 'two_factor' diff --git a/docs/content/en/configuration/identity-providers/open-id-connect.md b/docs/content/en/configuration/identity-providers/open-id-connect.md index 0b1afe399..6ac8d1249 100644 --- a/docs/content/en/configuration/identity-providers/open-id-connect.md +++ b/docs/content/en/configuration/identity-providers/open-id-connect.md @@ -555,11 +555,18 @@ more information. The registered client authentication mechanism used by this client for the [Token Endpoint]. If no method is defined the confidential client type will accept any supported method. The public client type defaults to `none` as this is required by the specification. This may be required as a breaking change in future versions. -Supported values are `client_secret_basic`, `client_secret_post`, and `none`. +Supported values are `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, and `none`. See the [integration guide](../../integration/openid-connect/introduction.md#client-authentication-method) for more information. +#### token_endpoint_auth_signing_alg + +{{< confkey type="string" default="HS256" required="no" >}} + +The JWT signing algorithm accepted when the [token_endpoint_auth_method](#tokenendpointauthmethod) is configured as +`client_secret_jwt`. Supported values are `HS256`, `HS385`, and `HS512`. + #### consent_mode {{< confkey type="string" default="auto" required="no" >}} diff --git a/docs/content/en/integration/openid-connect/introduction.md b/docs/content/en/integration/openid-connect/introduction.md index 37cca969d..043124f99 100644 --- a/docs/content/en/integration/openid-connect/introduction.md +++ b/docs/content/en/integration/openid-connect/introduction.md @@ -174,7 +174,7 @@ specification and the [OAuth 2.0 - Client Types] specification for more informat |:------------------------------------:|:-----------------------------:|:----------------------:|:-----------------------:|:--------------------------------------------------------:| | Secret via HTTP Basic Auth Scheme | `client_secret_basic` | `confidential` | N/A | N/A | | Secret via HTTP POST Body | `client_secret_post` | `confidential` | N/A | N/A | -| JWT (signed by secret) | `client_secret_jwt` | Not Supported | N/A | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` | +| JWT (signed by secret) | `client_secret_jwt` | `confidential` | N/A | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` | | JWT (signed by private key) | `private_key_jwt` | Not Supported | N/A | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` | | [OAuth 2.0 Mutual-TLS] | `tls_client_auth` | Not Supported | N/A | N/A | | [OAuth 2.0 Mutual-TLS] (Self Signed) | `self_signed_tls_client_auth` | Not Supported | N/A | N/A | diff --git a/internal/configuration/config.template.yml b/internal/configuration/config.template.yml index 2319109de..69270a5d0 100644 --- a/internal/configuration/config.template.yml +++ b/internal/configuration/config.template.yml @@ -1517,6 +1517,10 @@ notifier: ## The permitted client authentication method for the Token Endpoint for this client. # token_endpoint_auth_method: 'client_secret_basic' + ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using + ## the 'client_secret_jwt' token_endpoint_auth_method. + # token_endpoint_auth_signing_alg: HS256 + ## The policy to require for this client; one_factor or two_factor. # authorization_policy: 'two_factor' diff --git a/internal/configuration/schema/identity_providers.go b/internal/configuration/schema/identity_providers.go index d253a4d07..a89f923ad 100644 --- a/internal/configuration/schema/identity_providers.go +++ b/internal/configuration/schema/identity_providers.go @@ -64,7 +64,8 @@ type OpenIDConnectClientConfiguration struct { ResponseTypes []string `koanf:"response_types"` ResponseModes []string `koanf:"response_modes"` - TokenEndpointAuthMethod string `koanf:"token_endpoint_auth_method"` + TokenEndpointAuthMethod string `koanf:"token_endpoint_auth_method"` + TokenEndpointAuthSigningAlg string `koanf:"token_endpoint_auth_signing_alg"` Policy string `koanf:"authorization_policy"` diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go index 6bbddf150..ec7947e1a 100644 --- a/internal/configuration/schema/keys.go +++ b/internal/configuration/schema/keys.go @@ -46,6 +46,7 @@ var Keys = []string{ "identity_providers.oidc.clients[].response_types", "identity_providers.oidc.clients[].response_modes", "identity_providers.oidc.clients[].token_endpoint_auth_method", + "identity_providers.oidc.clients[].token_endpoint_auth_signing_alg", "identity_providers.oidc.clients[].authorization_policy", "identity_providers.oidc.clients[].enforce_par", "identity_providers.oidc.clients[].enforce_pkce", diff --git a/internal/configuration/validator/const.go b/internal/configuration/validator/const.go index 63be6a4fc..f9933e372 100644 --- a/internal/configuration/validator/const.go +++ b/internal/configuration/validator/const.go @@ -161,9 +161,10 @@ const ( errFmtOIDCClientsWithEmptyID = "identity_providers: oidc: clients: option 'id' is required but was absent on the clients in positions %s" errFmtOIDCClientsDeprecated = "identity_providers: oidc: clients: warnings for clients above indicate deprecated functionality and it's strongly suggested these issues are checked and fixed if they're legitimate issues or reported if they are not as in a future version these warnings will become errors" - errFmtOIDCClientInvalidSecret = "identity_providers: oidc: client '%s': option 'secret' is required" - errFmtOIDCClientInvalidSecretPlainText = "identity_providers: oidc: client '%s': option 'secret' is plaintext but it should be a hashed value as plaintext values are deprecated and will be removed when oidc becomes stable" - errFmtOIDCClientPublicInvalidSecret = "identity_providers: oidc: client '%s': option 'secret' is " + + errFmtOIDCClientInvalidSecret = "identity_providers: oidc: client '%s': option 'secret' is required" + errFmtOIDCClientInvalidSecretPlainText = "identity_providers: oidc: client '%s': option 'secret' is plaintext but for clients not using the 'token_endpoint_auth_method' of 'client_secret_jwt' it should be a hashed value as plaintext values are deprecated with the exception of 'client_secret_jwt' and will be removed when oidc becomes stable" + errFmtOIDCClientInvalidSecretNotPlainText = "identity_providers: oidc: client '%s': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'" + errFmtOIDCClientPublicInvalidSecret = "identity_providers: oidc: client '%s': option 'secret' is " + "required to be empty when option 'public' is true" errFmtOIDCClientRedirectURICantBeParsed = "identity_providers: oidc: client '%s': option 'redirect_uris' has an " + "invalid value: redirect uri '%s' could not be parsed: %v" @@ -183,6 +184,8 @@ const ( "'token_endpoint_auth_method' must be one of %s when configured as the confidential client type unless it only includes implicit flow response types such as %s but it's configured as '%s'" errFmtOIDCClientInvalidTokenEndpointAuthMethodPublic = "identity_providers: oidc: client '%s': option " + "'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as '%s'" + errFmtOIDCClientInvalidTokenEndpointAuthSigAlg = "identity_providers: oidc: client '%s': option " + + "'token_endpoint_auth_signing_alg' must be %s when option 'token_endpoint_auth_method' is %s" errFmtOIDCClientInvalidSectorIdentifier = "identity_providers: oidc: client '%s': option " + "'sector_identifier' with value '%s': must be a URL with only the host component for example '%s' but it has a %s with the value '%s'" errFmtOIDCClientInvalidSectorIdentifierWithoutValue = "identity_providers: oidc: client '%s': option " + @@ -413,7 +416,7 @@ var ( validOIDCCORSEndpoints = []string{oidc.EndpointAuthorization, oidc.EndpointPushedAuthorizationRequest, oidc.EndpointToken, oidc.EndpointIntrospection, oidc.EndpointRevocation, oidc.EndpointUserinfo} validOIDCClientScopes = []string{oidc.ScopeOpenID, oidc.ScopeEmail, oidc.ScopeProfile, oidc.ScopeGroups, oidc.ScopeOfflineAccess} - validOIDCClientUserinfoAlgorithms = []string{oidc.SigningAlgorithmNone, oidc.SigningAlgorithmRSAWithSHA256} + validOIDCClientUserinfoAlgorithms = []string{oidc.SigningAlgNone, oidc.SigningAlgRSAUsingSHA256} validOIDCClientConsentModes = []string{auto, oidc.ClientConsentModeImplicit.String(), oidc.ClientConsentModeExplicit.String(), oidc.ClientConsentModePreConfigured.String()} validOIDCClientResponseModes = []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery, oidc.ResponseModeFragment} validOIDCClientResponseTypes = []string{oidc.ResponseTypeAuthorizationCodeFlow, oidc.ResponseTypeImplicitFlowIDToken, oidc.ResponseTypeImplicitFlowToken, oidc.ResponseTypeImplicitFlowBoth, oidc.ResponseTypeHybridFlowIDToken, oidc.ResponseTypeHybridFlowToken, oidc.ResponseTypeHybridFlowBoth} @@ -422,8 +425,9 @@ var ( validOIDCClientResponseTypesRefreshToken = []string{oidc.ResponseTypeAuthorizationCodeFlow, oidc.ResponseTypeHybridFlowIDToken, oidc.ResponseTypeHybridFlowToken, oidc.ResponseTypeHybridFlowBoth} validOIDCClientGrantTypes = []string{oidc.GrantTypeImplicit, oidc.GrantTypeRefreshToken, oidc.GrantTypeAuthorizationCode} - validOIDCClientTokenEndpointAuthMethods = []string{oidc.ClientAuthMethodNone, oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic} + validOIDCClientTokenEndpointAuthMethods = []string{oidc.ClientAuthMethodNone, oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic, oidc.ClientAuthMethodClientSecretJWT} validOIDCClientTokenEndpointAuthMethodsConfidential = []string{oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic} + validOIDCClientTokenEndpointAuthSigAlgs = []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512} ) var ( diff --git a/internal/configuration/validator/identity_providers.go b/internal/configuration/validator/identity_providers.go index cb61e31db..21ba0aab1 100644 --- a/internal/configuration/validator/identity_providers.go +++ b/internal/configuration/validator/identity_providers.go @@ -193,8 +193,13 @@ func validateOIDCClient(c int, config *schema.OpenIDConnectConfiguration, val *s } else { if config.Clients[c].Secret == nil { val.Push(fmt.Errorf(errFmtOIDCClientInvalidSecret, config.Clients[c].ID)) - } else if config.Clients[c].Secret.IsPlainText() { - val.PushWarning(fmt.Errorf(errFmtOIDCClientInvalidSecretPlainText, config.Clients[c].ID)) + } else { + switch { + case config.Clients[c].Secret.IsPlainText() && config.Clients[c].TokenEndpointAuthMethod != oidc.ClientAuthMethodClientSecretJWT: + val.PushWarning(fmt.Errorf(errFmtOIDCClientInvalidSecretPlainText, config.Clients[c].ID)) + case !config.Clients[c].Secret.IsPlainText() && config.Clients[c].TokenEndpointAuthMethod == oidc.ClientAuthMethodClientSecretJWT: + val.Push(fmt.Errorf(errFmtOIDCClientInvalidSecretNotPlainText, config.Clients[c].ID)) + } } } @@ -222,7 +227,7 @@ func validateOIDCClient(c int, config *schema.OpenIDConnectConfiguration, val *s validateOIDCClientGrantTypes(c, config, val, errDeprecatedFunc) validateOIDCClientRedirectURIs(c, config, val, errDeprecatedFunc) - validateOIDCClientTokenEndpointAuthMethod(c, config, val) + validateOIDCClientTokenEndpointAuth(c, config, val) validateOIDDClientUserinfoAlgorithm(c, config, val) validateOIDCClientSectorIdentifier(c, config, val) @@ -481,13 +486,9 @@ func validateOIDCClientRedirectURIs(c int, config *schema.OpenIDConnectConfigura } } -func validateOIDCClientTokenEndpointAuthMethod(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { +func validateOIDCClientTokenEndpointAuth(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { implcit := len(config.Clients[c].ResponseTypes) != 0 && utils.IsStringSliceContainsAll(config.Clients[c].ResponseTypes, validOIDCClientResponseTypesImplicitFlow) - if config.Clients[c].TokenEndpointAuthMethod == "" && (config.Clients[c].Public || implcit) { - config.Clients[c].TokenEndpointAuthMethod = oidc.ClientAuthMethodNone - } - switch { case config.Clients[c].TokenEndpointAuthMethod == "": break @@ -501,6 +502,18 @@ func validateOIDCClientTokenEndpointAuthMethod(c int, config *schema.OpenIDConne val.Push(fmt.Errorf(errFmtOIDCClientInvalidTokenEndpointAuthMethodPublic, config.Clients[c].ID, config.Clients[c].TokenEndpointAuthMethod)) } + + switch config.Clients[c].TokenEndpointAuthMethod { + case "": + break + case oidc.ClientAuthMethodClientSecretJWT: + switch { + case config.Clients[c].TokenEndpointAuthSigningAlg == "": + config.Clients[c].TokenEndpointAuthSigningAlg = oidc.SigningAlgHMACUsingSHA256 + case !utils.IsStringInSlice(config.Clients[c].TokenEndpointAuthSigningAlg, validOIDCClientTokenEndpointAuthSigAlgs): + val.Push(fmt.Errorf(errFmtOIDCClientInvalidTokenEndpointAuthSigAlg, config.Clients[c].ID, strJoinOr(validOIDCClientTokenEndpointAuthSigAlgs), config.Clients[c].TokenEndpointAuthMethod)) + } + } } func validateOIDDClientUserinfoAlgorithm(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { diff --git a/internal/configuration/validator/identity_providers_test.go b/internal/configuration/validator/identity_providers_test.go index bdb11f3d0..e00b76141 100644 --- a/internal/configuration/validator/identity_providers_test.go +++ b/internal/configuration/validator/identity_providers_test.go @@ -758,7 +758,7 @@ func TestValidateIdentityProvidersShouldRaiseWarningOnPlainTextClients(t *testin assert.Len(t, validator.Errors(), 0) require.Len(t, validator.Warnings(), 1) - assert.EqualError(t, validator.Warnings()[0], "identity_providers: oidc: client 'client-with-invalid-secret_standard': option 'secret' is plaintext but it should be a hashed value as plaintext values are deprecated and will be removed when oidc becomes stable") + assert.EqualError(t, validator.Warnings()[0], "identity_providers: oidc: client 'client-with-invalid-secret_standard': option 'secret' is plaintext but for clients not using the 'token_endpoint_auth_method' of 'client_secret_jwt' it should be a hashed value as plaintext values are deprecated with the exception of 'client_secret_jwt' and will be removed when oidc becomes stable") } // All valid schemes are supported as defined in https://datatracker.ietf.org/doc/html/rfc8252#section-7.1 @@ -1445,51 +1445,6 @@ func TestValidateOIDCClients(t *testing.T) { nil, nil, }, - { - "ShouldSetDefaultTokenEndpointClientAuthMethodPublicClientType", - func(have *schema.OpenIDConnectConfiguration) { - have.Clients[0].Public = true - have.Clients[0].Secret = nil - }, - func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, oidc.ClientAuthMethodNone, have.Clients[0].TokenEndpointAuthMethod) - }, - tcv{ - nil, - nil, - nil, - nil, - }, - tcv{ - []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, - []string{oidc.ResponseTypeAuthorizationCodeFlow}, - []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, - []string{oidc.GrantTypeAuthorizationCode}, - }, - nil, - nil, - }, - { - "ShouldSetDefaultTokenEndpointClientAuthMethodConfidentialClientTypeImplicitFlow", - nil, - func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, oidc.ClientAuthMethodNone, have.Clients[0].TokenEndpointAuthMethod) - }, - tcv{ - nil, - []string{oidc.ResponseTypeImplicitFlowIDToken, oidc.ResponseTypeImplicitFlowToken, oidc.ResponseTypeImplicitFlowBoth}, - nil, - nil, - }, - tcv{ - []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, - []string{oidc.ResponseTypeImplicitFlowIDToken, oidc.ResponseTypeImplicitFlowToken, oidc.ResponseTypeImplicitFlowBoth}, - []string{oidc.ResponseModeFormPost, oidc.ResponseModeFragment}, - []string{oidc.GrantTypeImplicit}, - }, - nil, - nil, - }, { "ShouldNotOverrideValidClientAuthMethod", func(have *schema.OpenIDConnectConfiguration) { @@ -1535,7 +1490,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', or 'client_secret_basic' but it's configured as 'client_credentials'", + "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', 'client_secret_basic', or 'client_secret_jwt' but it's configured as 'client_credentials'", }, }, { @@ -1619,7 +1574,7 @@ func TestValidateOIDCClients(t *testing.T) { "ShouldSetDefaultUserInfoAlg", nil, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, oidc.SigningAlgorithmNone, have.Clients[0].UserinfoSigningAlgorithm) + assert.Equal(t, oidc.SigningAlgNone, have.Clients[0].UserinfoSigningAlgorithm) }, tcv{ nil, @@ -1639,10 +1594,10 @@ func TestValidateOIDCClients(t *testing.T) { { "ShouldNotOverrideUserInfoAlg", func(have *schema.OpenIDConnectConfiguration) { - have.Clients[0].UserinfoSigningAlgorithm = oidc.SigningAlgorithmRSAWithSHA256 + have.Clients[0].UserinfoSigningAlgorithm = oidc.SigningAlgRSAUsingSHA256 }, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, oidc.SigningAlgorithmRSAWithSHA256, have.Clients[0].UserinfoSigningAlgorithm) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, have.Clients[0].UserinfoSigningAlgorithm) }, tcv{ nil, @@ -1827,6 +1782,131 @@ func TestValidateOIDCClients(t *testing.T) { nil, nil, }, + { + "ShouldRaiseErrorOnIncorrectlyConfiguredTokenEndpointClientAuthMethodClientSecretJWT", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT + have.Clients[0].Secret = MustDecodeSecret("$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng") + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: client 'test': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'", + }, + }, + { + "ShouldNotRaiseWarningOrErrorOnCorrectlyConfiguredTokenEndpointClientAuthMethodClientSecretJWT", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT + have.Clients[0].Secret = MustDecodeSecret("$plaintext$abc123") + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + nil, + }, + { + "ShouldSetDefaultTokenEndpointAuthSigAlg", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT + have.Clients[0].Secret = MustDecodeSecret("$plaintext$abc123") + }, + func(t *testing.T, have *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.SigningAlgHMACUsingSHA256, have.Clients[0].TokenEndpointAuthSigningAlg) + }, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + nil, + }, + { + "ShouldRaiseErrorOnInvalidPublicTokenAuthAlg", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT + have.Clients[0].TokenEndpointAuthSigningAlg = oidc.SigningAlgHMACUsingSHA256 + have.Clients[0].Secret = nil + have.Clients[0].Public = true + }, + func(t *testing.T, have *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.SigningAlgHMACUsingSHA256, have.Clients[0].TokenEndpointAuthSigningAlg) + }, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as 'client_secret_jwt'", + }, + }, + { + "ShouldRaiseErrorOnInvalidTokenAuthAlgClientTypeConfidential", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT + have.Clients[0].TokenEndpointAuthSigningAlg = "abcinvalid" + have.Clients[0].Secret = MustDecodeSecret("$plaintext$abc123") + }, + func(t *testing.T, have *schema.OpenIDConnectConfiguration) { + assert.Equal(t, "abcinvalid", have.Clients[0].TokenEndpointAuthSigningAlg) + }, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: client 'test': option 'token_endpoint_auth_signing_alg' must be 'HS256', 'HS384', or 'HS512' when option 'token_endpoint_auth_method' is client_secret_jwt", + }, + }, } errDeprecatedFunc := func() {} @@ -1891,10 +1971,9 @@ func TestValidateOIDCClientTokenEndpointAuthMethod(t *testing.T) { errs []string }{ {"ShouldSetDefaultValueConfidential", "", false, "", nil}, - {"ShouldSetDefaultValuePublic", "", true, oidc.ClientAuthMethodNone, nil}, {"ShouldErrorOnInvalidValue", "abc", false, "abc", []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', or 'client_secret_basic' but it's configured as 'abc'", + "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', 'client_secret_basic', or 'client_secret_jwt' but it's configured as 'abc'", }, }, {"ShouldErrorOnInvalidValueForPublicClient", "client_secret_post", true, "client_secret_post", @@ -1923,7 +2002,7 @@ func TestValidateOIDCClientTokenEndpointAuthMethod(t *testing.T) { val := schema.NewStructValidator() - validateOIDCClientTokenEndpointAuthMethod(0, have, val) + validateOIDCClientTokenEndpointAuth(0, have, val) assert.Equal(t, tc.expected, have.Clients[0].TokenEndpointAuthMethod) assert.Len(t, val.Warnings(), 0) diff --git a/internal/handlers/handler_oidc_token_test.go b/internal/handlers/handler_oidc_token_test.go new file mode 100644 index 000000000..52aacbbd9 --- /dev/null +++ b/internal/handlers/handler_oidc_token_test.go @@ -0,0 +1,1512 @@ +package handlers + +import ( + "context" + "crypto/ecdsa" + "crypto/rsa" + "crypto/sha256" + "crypto/x509" + "database/sql" + "encoding/base64" + "encoding/pem" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "testing" + "time" + + "github.com/golang-jwt/jwt/v4" + "github.com/golang/mock/gomock" + "github.com/google/uuid" + "github.com/ory/fosite" + "github.com/stretchr/testify/suite" + "github.com/valyala/fasthttp" + + "github.com/authelia/authelia/v4/internal/authorization" + "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/mocks" + "github.com/authelia/authelia/v4/internal/model" + "github.com/authelia/authelia/v4/internal/oidc" +) + +func TestClientAuthenticationStrategySuite(t *testing.T) { + suite.Run(t, &ClientAuthenticationStrategySuite{}) +} + +type ClientAuthenticationStrategySuite struct { + suite.Suite + + issuerURL *url.URL + + ctrl *gomock.Controller + store *mocks.MockStorage + provider *oidc.OpenIDConnectProvider +} + +func (s *ClientAuthenticationStrategySuite) GetIssuerURL() *url.URL { + if s.issuerURL == nil { + s.issuerURL = MustParseRequestURI("https://auth.example.com") + } + + return s.issuerURL +} + +func (s *ClientAuthenticationStrategySuite) GetTokenURL() *url.URL { + return s.GetIssuerURL().JoinPath(oidc.EndpointPathToken) +} + +func (s *ClientAuthenticationStrategySuite) GetBaseRequest(body io.Reader) (r *http.Request) { + var err error + + r, err = http.NewRequest(http.MethodPost, s.GetTokenURL().String(), body) + + s.Require().NoError(err) + s.Require().NotNil(r) + + r.Header.Set(fasthttp.HeaderContentType, "application/x-www-form-urlencoded") + + return r +} + +func (s *ClientAuthenticationStrategySuite) GetRequest(values *url.Values) (r *http.Request) { + var body io.Reader + + if values != nil { + body = strings.NewReader(values.Encode()) + } + + r = s.GetBaseRequest(body) + + s.Require().NoError(r.ParseForm()) + + return r +} + +func (s *ClientAuthenticationStrategySuite) GetAssertionValues(token string) *url.Values { + values := &url.Values{} + + values.Set(oidc.FormParameterClientAssertionType, oidc.ClientAssertionJWTBearerType) + + if token != "" { + values.Set(oidc.FormParameterClientAssertion, token) + } + + return values +} + +func (s *ClientAuthenticationStrategySuite) GetClientValues(id string) *url.Values { + values := &url.Values{} + + values.Set(oidc.FormParameterClientID, id) + + return values +} + +func (s *ClientAuthenticationStrategySuite) GetClientValuesPost(id, secret string) *url.Values { + values := s.GetClientValues(id) + + values.Set(oidc.FormParameterClientSecret, secret) + + return values +} + +func (s *ClientAuthenticationStrategySuite) GetClientSecretBasicRequest(id, secret string) (r *http.Request) { + values := s.GetClientValues(id) + + r = s.GetRequest(values) + + r.SetBasicAuth(id, secret) + + return r +} + +func (s *ClientAuthenticationStrategySuite) GetClientSecretPostRequest(id, secret string) (r *http.Request) { + values := s.GetClientValuesPost(id, secret) + + return s.GetRequest(values) +} + +func (s *ClientAuthenticationStrategySuite) GetAssertionRequest(token string) (r *http.Request) { + values := s.GetAssertionValues(token) + + return s.GetRequest(values) +} + +func (s *ClientAuthenticationStrategySuite) GetCtx() oidc.OpenIDConnectContext { + return &oidc.MockOpenIDConnectContext{ + Context: context.Background(), + MockIssuerURL: s.GetIssuerURL(), + } +} + +func (s *ClientAuthenticationStrategySuite) SetupTest() { + s.ctrl = gomock.NewController(s.T()) + s.store = mocks.NewMockStorage(s.ctrl) + + var err error + + secret := MustDecodeSecret("$plaintext$client-secret") + + s.provider, err = oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + IssuerCertificateChain: schema.X509CertificateChain{}, + IssuerPrivateKey: MustParseRSAPrivateKey(exampleRSAPrivateKey), + HMACSecret: "abc123", + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "hs256", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgHMACUsingSHA256, + }, + { + ID: "hs384", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgHMACUsingSHA384, + }, + { + ID: "hs512", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgHMACUsingSHA512, + }, + { + ID: "rs256", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAUsingSHA256, + }, + { + ID: "rs384", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAUsingSHA384, + }, + { + ID: "rs512", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAUsingSHA512, + }, + { + ID: "ps256", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAPSSUsingSHA256, + }, + { + ID: "ps384", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAPSSUsingSHA384, + }, + { + ID: "ps512", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAPSSUsingSHA512, + }, + { + ID: "es256", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgECDSAUsingP256AndSHA256, + }, + { + ID: "es384", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgECDSAUsingP384AndSHA384, + }, + { + ID: "es512", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgECDSAUsingP521AndSHA512, + }, + { + ID: "hs5122", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgHMACUsingSHA512, + }, + { + ID: "hashed", + Secret: MustDecodeSecret("$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng"), + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgHMACUsingSHA512, + }, + { + ID: oidc.ClientAuthMethodClientSecretBasic, + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretBasic, + TokenEndpointAuthSigningAlg: oidc.SigningAlgNone, + }, + { + ID: oidc.ClientAuthMethodNone, + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodNone, + TokenEndpointAuthSigningAlg: oidc.SigningAlgNone, + }, + { + ID: oidc.ClientAuthMethodClientSecretPost, + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretPost, + TokenEndpointAuthSigningAlg: oidc.SigningAlgNone, + }, + { + ID: "bad_method", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: "bad_method", + TokenEndpointAuthSigningAlg: oidc.SigningAlgNone, + }, + { + ID: "base", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + }, + { + ID: "public", + Public: true, + Policy: authorization.OneFactor.String(), + TokenEndpointAuthMethod: oidc.ClientAuthMethodNone, + RedirectURIs: []string{ + "https://client.example.com", + }, + }, + { + ID: "public-nomethod", + Public: true, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + }, + { + ID: "public-basic", + Public: true, + Policy: authorization.OneFactor.String(), + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretBasic, + RedirectURIs: []string{ + "https://client.example.com", + }, + }, + }, + }, s.store, nil) + + s.Require().NoError(err) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldValidateAssertionHS256() { + assertion := NewAssertion("hs256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS256, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.NoError(ErrorToRFC6749ErrorTest(err)) + s.Require().NotNil(client) + s.Equal("hs256", client.GetID()) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldValidateAssertionHS384() { + assertion := NewAssertion("hs384", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS384, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.NoError(ErrorToRFC6749ErrorTest(err)) + s.Require().NotNil(client) + s.Equal("hs384", client.GetID()) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldValidateAssertionHS512() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.NoError(ErrorToRFC6749ErrorTest(err)) + s.Require().NotNil(client) + s.Equal("hs512", client.GetID()) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnMismatchedAlg() { + assertion := NewAssertion("rs256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The 'client_assertion' uses signing algorithm 'HS512' but the requested OAuth 2.0 Client enforces signing algorithm 'RS256'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnMismatchedAlgSameMethod() { + assertion := NewAssertion("hs256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The 'client_assertion' uses signing algorithm 'HS512' but the requested OAuth 2.0 Client enforces signing algorithm 'HS256'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysRS256() { + assertion := NewAssertion("rs256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS256, assertion) + + token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysRS384() { + assertion := NewAssertion("rs384", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS384, assertion) + + token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysRS512() { + assertion := NewAssertion("rs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS512, assertion) + + token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysPS256() { + assertion := NewAssertion("ps256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS256, assertion) + + token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysPS384() { + assertion := NewAssertion("ps384", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS384, assertion) + + token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysPS512() { + assertion := NewAssertion("ps512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS512, assertion) + + token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysES256() { + assertion := NewAssertion("es256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES256, assertion) + + token, err := assertionJWT.SignedString(MustParseECPrivateKey(exampleECP256PrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysES384() { + assertion := NewAssertion("es384", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES384, assertion) + + token, err := assertionJWT.SignedString(MustParseECPrivateKey(exampleECP384PrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysES512() { + assertion := NewAssertion("es512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES512, assertion) + + token, err := assertionJWT.SignedString(MustParseECPrivateKey(exampleECP521PrivateKey)) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnJTIKnown() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(fosite.ErrJTIKnown), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "The jti was already used.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldValidateJWTWithArbitraryClaims() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + a := assertion.ToMapClaims() + a["aaa"] = "abc" + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, a) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.NoError(ErrorToRFC6749ErrorTest(err)) + s.Require().NotNil(client) + s.Equal("hs512", client.GetID()) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithMissingSubClaim() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + a := assertion.ToMapClaims() + delete(a, oidc.ClaimSubject) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, a) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The claim 'sub' from the client_assertion JSON Web Token is undefined.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithInvalidExpClaim() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + a := assertion.ToMapClaims() + a[oidc.ClaimExpirationTime] = "not a number" + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, a) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Unable to verify the integrity of the 'client_assertion' value. The token is expired.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithMissingIssClaim() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + a := assertion.ToMapClaims() + delete(a, oidc.ClaimIssuer) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, a) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Claim 'iss' from 'client_assertion' must match the 'client_id' of the OAuth 2.0 Client.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithInvalidAudClaim() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertion.Audience = []string{"notvalid"} + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Claim 'audience' from 'client_assertion' must match the authorization server's token endpoint 'https://auth.example.com/api/oidc/token'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithInvalidAssertionType() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + v := s.GetAssertionValues(token) + + v.Set(oidc.FormParameterClientAssertionType, "not_valid") + + r := s.GetRequest(v) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Unknown client_assertion_type 'not_valid'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithMissingJTIClaim() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + a := assertion.ToMapClaims() + delete(a, oidc.ClaimJWTID) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, a) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Claim 'jti' from 'client_assertion' must be set but is not.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithMismatchedIssClaim() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertion.Issuer = "hs256" + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Claim 'iss' from 'client_assertion' must match the 'client_id' of the OAuth 2.0 Client.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldValidateClientSecretPost() { + r := s.GetClientSecretPostRequest(oidc.ClientAuthMethodClientSecretPost, "client-secret") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + s.Equal(oidc.ClientAuthMethodClientSecretPost, client.GetID()) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldErrorClientSecretPostOnClientSecretBasicClient() { + r := s.GetClientSecretPostRequest(oidc.ClientAuthMethodClientSecretBasic, "client-secret") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'client_secret_basic', but method 'client_secret_post' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_post'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldErrorClientSecretPostWrongSecret() { + r := s.GetClientSecretPostRequest(oidc.ClientAuthMethodClientSecretPost, "client-secret-bad") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The provided client secret did not match the registered client secret.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldValidateClientSecretBasic() { + r := s.GetClientSecretBasicRequest(oidc.ClientAuthMethodClientSecretBasic, "client-secret") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + s.Equal(oidc.ClientAuthMethodClientSecretBasic, client.GetID()) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnClientSecretPostWithoutClientID() { + r := s.GetRequest(&url.Values{oidc.FormParameterClientSecret: []string{"client-secret"}}) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_request") + s.EqualError(ErrorToRFC6749ErrorTest(err), "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Client credentials missing or malformed in both HTTP Authorization header and HTTP POST body.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnClientSecretBasicWithMalformedClientID() { + r := s.GetRequest(&url.Values{oidc.FormParameterRequestURI: []string{"not applicable"}}) + + r.Header.Set(fasthttp.HeaderAuthorization, fmt.Sprintf("Basic %s", base64.StdEncoding.EncodeToString([]byte("abc@#%!@#(*%)#@!:client-secret")))) + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_request") + s.EqualError(ErrorToRFC6749ErrorTest(err), "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The client id in the HTTP authorization header could not be decoded from 'application/x-www-form-urlencoded'. invalid URL escape '%!@'") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnClientSecretBasicWithMalformedClientSecret() { + r := s.GetRequest(&url.Values{oidc.FormParameterRequestURI: []string{"not applicable"}}) + + r.Header.Set(fasthttp.HeaderAuthorization, fmt.Sprintf("Basic %s", base64.StdEncoding.EncodeToString([]byte("hs512:abc@#%!@#(*%)#@!")))) + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_request") + s.EqualError(ErrorToRFC6749ErrorTest(err), "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The client secret in the HTTP authorization header could not be decoded from 'application/x-www-form-urlencoded'. invalid URL escape '%!@'") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldErrorClientSecretBasicOnClientSecretPostClient() { + r := s.GetClientSecretBasicRequest(oidc.ClientAuthMethodClientSecretPost, "client-secret") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'client_secret_post', but method 'client_secret_basic' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_basic'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldErrorClientSecretBasicWrongSecret() { + r := s.GetClientSecretBasicRequest(oidc.ClientAuthMethodClientSecretBasic, "client-secret-bad") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The provided client secret did not match the registered client secret.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldErrorClientSecretBasicOnPublic() { + r := s.GetClientSecretBasicRequest("public", "client-secret") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'none', but method 'client_secret_basic' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_basic'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldErrorClientSecretBasicOnPublicWithBasic() { + r := s.GetClientSecretBasicRequest("public-basic", "client-secret") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'client_secret_basic', but method 'none' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'none'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldErrorClientSecretBasicOnInvalidClient() { + r := s.GetClientSecretBasicRequest("not-a-client", "client-secret") + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). invalid_client") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldValidatePublic() { + v := s.GetClientValues("public") + + r := s.GetRequest(v) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + s.Equal("public", client.GetID()) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithMismatchedFormClientID() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertion.Issuer = "hs5122" + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + values := s.GetAssertionValues(token) + + values.Set(oidc.FormParameterClientID, "hs5122") + + r := s.GetRequest(values) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Claim 'sub' from 'client_assertion' must match the 'client_id' of the OAuth 2.0 Client.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithMismatchedFormClientIDWithIss() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + values := s.GetAssertionValues(token) + + values.Set(oidc.FormParameterClientID, "hs5122") + + r := s.GetRequest(values) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Claim 'iss' from 'client_assertion' must match the 'client_id' of the OAuth 2.0 Client.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailWithMissingClient() { + assertion := NewAssertion("noclient", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). invalid_client") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailBadSecret() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret-wrong")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Unable to verify the integrity of the 'client_assertion' value. The signature is invalid.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailMethodNone() { + assertion := NewAssertion(oidc.ClientAuthMethodNone, s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). This requested OAuth 2.0 client does not support client authentication, however 'client_assertion' was provided in the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailAssertionMethodClientSecretPost() { + assertion := NewAssertion(oidc.ClientAuthMethodClientSecretPost, s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). This requested OAuth 2.0 client only supports client authentication method 'client_secret_post', however 'client_assertion' was provided in the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailAssertionMethodBad() { + assertion := NewAssertion("bad_method", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). This requested OAuth 2.0 client only supports client authentication method 'bad_method', however that method is not supported by this server.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailAssertionBaseClient() { + assertion := NewAssertion("base", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_request") + s.EqualError(ErrorToRFC6749ErrorTest(err), "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The client configuration does not support OpenID Connect specific authentication methods.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailAssertionMethodClientSecretBasic() { + assertion := NewAssertion(oidc.ClientAuthMethodClientSecretBasic, s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). This requested OAuth 2.0 client only supports client authentication method 'client_secret_basic', however 'client_assertion' was provided in the request.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailHashedSecret() { + assertion := NewAssertion("hashed", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). This client does not support authentication method 'client_secret_jwt' as the client secret is not in plaintext.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailExpiredToken() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Minute*-3), time.Unix(time.Now().Add(time.Minute*-1).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Unable to verify the integrity of the 'client_assertion' value. The token is expired.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailNotYetValid() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Minute*-3), time.Unix(time.Now().Add(time.Minute*1).Unix(), 0)) + + assertion.NotBefore = jwt.NewNumericDate(time.Now().Add(time.Second * 10)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + s.NoError(r.ParseForm()) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Unable to verify the integrity of the 'client_assertion' value. The token isn't valid yet.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailTokenUsedBeforeIssued() { + assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Minute*3), time.Unix(time.Now().Add(time.Minute*8).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) + + token, err := assertionJWT.SignedString([]byte("client-secret")) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Unable to verify the integrity of the 'client_assertion' value. The token was used before it was issued.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailMalformed() { + r := s.GetAssertionRequest("bad token") + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_client") + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Unable to verify the integrity of the 'client_assertion' value. The token is malformed.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldFailMissingAssertion() { + r := s.GetAssertionRequest("") + + ctx := s.GetCtx() + + client, err := s.provider.DefaultClientAuthenticationStrategy(ctx, r, r.PostForm) + + s.EqualError(err, "invalid_request") + s.EqualError(ErrorToRFC6749ErrorTest(err), "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The client_assertion request parameter must be set when using client_assertion_type of 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'.") + s.Nil(client) +} + +type RegisteredClaims struct { + jwt.RegisteredClaims +} + +func (r *RegisteredClaims) ToMapClaims() jwt.MapClaims { + claims := jwt.MapClaims{} + + if r.ID != "" { + claims[oidc.ClaimJWTID] = r.ID + } + + if r.Subject != "" { + claims[oidc.ClaimSubject] = r.Subject + } + + if r.Issuer != "" { + claims[oidc.ClaimIssuer] = r.Issuer + } + + if len(r.Audience) != 0 { + claims[oidc.ClaimAudience] = r.Audience + } + + if r.NotBefore != nil { + claims[oidc.ClaimNotBefore] = r.NotBefore + } + + if r.ExpiresAt != nil { + claims[oidc.ClaimExpirationTime] = r.ExpiresAt + } + + if r.IssuedAt != nil { + claims[oidc.ClaimIssuedAt] = r.IssuedAt + } + + return claims +} + +func NewAssertion(clientID string, tokenURL *url.URL, iat, exp time.Time) RegisteredClaims { + return RegisteredClaims{ + jwt.RegisteredClaims{ + ID: uuid.Must(uuid.NewRandom()).String(), + Issuer: clientID, + Audience: []string{ + tokenURL.String(), + }, + Subject: clientID, + IssuedAt: jwt.NewNumericDate(iat), + ExpiresAt: jwt.NewNumericDate(exp), + }, + } +} + +type RFC6749ErrorTest struct { + *fosite.RFC6749Error +} + +func (err *RFC6749ErrorTest) Error() string { + return err.WithExposeDebug(true).GetDescription() +} + +func ErrorToRFC6749ErrorTest(err error) (rfc error) { + if err == nil { + return nil + } + + ferr := fosite.ErrorToRFC6749Error(err) + + return &RFC6749ErrorTest{ferr} +} + +func MustDecodeSecret(value string) *schema.PasswordDigest { + if secret, err := schema.DecodePasswordDigest(value); err != nil { + panic(err) + } else { + return secret + } +} + +func MustParseRequestURI(input string) *url.URL { + if requestURI, err := url.ParseRequestURI(input); err != nil { + panic(err) + } else { + return requestURI + } +} + +func MustParseRSAPrivateKey(data string) *rsa.PrivateKey { + block, _ := pem.Decode([]byte(data)) + if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { + panic("not pem encoded") + } + + if block.Type != "RSA PRIVATE KEY" { + panic("not private key") + } + + key, err := x509.ParsePKCS1PrivateKey(block.Bytes) + if err != nil { + panic(err) + } + + return key +} + +func MustParseECPrivateKey(data string) *ecdsa.PrivateKey { + block, _ := pem.Decode([]byte(data)) + if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { + panic("not pem encoded") + } + + if block.Type != "EC PRIVATE KEY" { + panic("not private key") + } + + key, err := x509.ParseECPrivateKey(block.Bytes) + if err != nil { + panic(err) + } + + return key +} + +const exampleRSAPrivateKey = ` +-----BEGIN RSA PRIVATE KEY----- +MIIEpQIBAAKCAQEA60Vuz1N1wUHiCDIlbz8gE0dWPCmHEWnXKchEEISqIJ6j5Eah +Q/GwX3WK0UV5ATRvWhg6o7/WfrLYcAsi4w79TgMjJHLWIY/jzAS3quEtzOLlLSWZ +9FR9SomQm3T/ETOS8IvSGrksIj0WgX35jB1NnbqSTRnYx7Cg/TBJjmiaqd0b9G/8 +LlReaihwGf8tvPgnteWIdon3EI2MKDBkaesRjpL98Cz7VvD7dajseAlUh9jQWVge +sN8qnm8pNPFAYsgxf//Jf0RfsND6H70zKKybDmyct4T4o/8qjivw4ly0XkArDCUj +Qx2KUF7nN+Bo9wwnNppjdnsOPUbus8o1a9vY1QIDAQABAoIBAQDl1SBY3PlN36SF +yScUtCALdUbi4taVxkVxBbioQlFIKHGGkRD9JN/dgSApK6r36FdXNhAi40cQ4nnZ +iqd8FKqTSTFNa/mPM9ee+ITMI8nwOz8SiYcKTndPF2/yzapXDYDgCFcpz/czQ2X2 +/i+IFyA5k4dUVomVGhFLBZ71xW5BvGUBMUH0XkeR5+c4gLvgR209BlpBHlkX4tUQ ++RQoxbKpkntl0mjqf91zcOe4LJVsXZFyN+NVSzLEbGC3lVSSiyjVQH3s7ExnTaHi +PpwSoXzu5QJj5xRit/1B3/LEGpIlPGFrkhMzBDTN+HYV/VLbCHJzjg5GVJawA82E +h2BY6YWJAoGBAPmGaZL5ggnTVR2XVBLDKbwL/sesqiPZk45B+I5eObHl+v236JH9 +RPMjdE10jOR1TzfQdmE2/RboKhiVn+osS+2W6VXSo7sMsSM1bLBPYhnwrNIqzrX8 +Vgi2bCl2S8ZhVo2R8c5WUaD0Gpxs6hwPIMOQWWwxDlsbg/UoLrhD3X4XAoGBAPFg +VSvaWQdDVAqjM42ObhZtWxeLfEAcxRQDMQq7btrTwBZSrtP3S3Egu66cp/4PT4VD +Hc8tYyT2rNETiqT6b2Rm1MgeoJ8wRqte6ZXSQVVQUOd42VG04O3aaleAGhXjEkM2 +avctRdKHDhQdIt+riPgaNj4FdYpmQ5zIrcZtBr/zAoGBAOBXzBX7xMHmwxEe3NUd +qSlMM579C9+9oF/3ymzeJMtgtcBmGHEhoFtmVgvJrV8+ZaIOCFExam2tASQnaqbV +etK7q0ChaNok+CJqxzThupcN/6PaHw4aOJQOx8KjfE95dqNEQ367txqaPk7D0dy2 +cUPDRdLzbC/X1lWV8iNzyPGzAoGBAN4R2epRpYz4Fa7/vWNkAcaib6c2zmaR0YN6 ++Di+ftvW6yfehDhBkWgQTHv2ZtxoK6oYOKmuQUP1qsNkbi8gtTEzJlrDStWKbcom +tVMAsNkT3otHdPEmL7bFNwcvtVAjrF6oBztHrLBnTr2UnMwZnhdczkC7dwuQ0G3D +d5VSI16fAoGAY7eeVDkic73GbZmtZibuodvPJ/z85RIBOrzf3ColO4jGI6Ej/EnD +rMEe/mRC27CJzS9L9Jc0Kt66mGSvodDGl0nBsXGNfPog0cGwweCVN0Eo2VJZbRTT +UoU05/Pvu2h3/E8gGTBY0/WPSo06YUsICjVDWNuOIa/7IY7SyE6Xxn0= +-----END RSA PRIVATE KEY-----` + +const exampleECP256PrivateKey = ` +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEID1fSsJ8qyEqj2DVkrshaNiXqaSDX7qViASRkyGGJFbEoAoGCCqGSM49 +AwEHoUQDQgAENnBG+bBJIaIa+bRlHaLiXD86RAy+Ef9CVdAfpPGoNRfkOTcrrIV7 +2wv3Y5e0he63Tn9iVAFYRFexK1mjFw7TfA== +-----END EC PRIVATE KEY-----` + +const exampleECP384PrivateKey = ` +-----BEGIN EC PRIVATE KEY----- +MIGkAgEBBDBPoOfapxtgZ8XNE7Wwdlw+9oDc6x4m57MITZyWzN62jkFUAYsvPJDF +9+g+e8CT5yqgBwYFK4EEACKhZANiAAQ2uZ0HIIxIavyjGyX13tIZVOaRB4+D64dF +s3DXDrpXcuDTSohw9xBW5sLDqRVu2LkBsCUFXtEJUHgC+O7wToNw8nh+KdDrcu/J +miNqbvEHuvlSlHWyx9HH8kAEuu1+SZg= +-----END EC PRIVATE KEY-----` + +const exampleECP521PrivateKey = ` +-----BEGIN EC PRIVATE KEY----- +MIHcAgEBBEIBT07AnitDd1Z01bl5W5VW8/vTWyu7w3MSqEmCeKcM19p/TAJAeS8L +6UOig2fTUeuMeA2PoOUjI2Bid927VsWcxE2gBwYFK4EEACOhgYkDgYYABAGnV9mu +xY0E7/k8b+glOOMaN0+Qt70H9OmSz6tC8tU3EayRwFlNPch9TlvEpbCS3MsDE9dN +78EpFx45MUqzzdZcOgAu+EUC9Zas1YVK+WMo0GFy+XtFq3kxubOclBb52M/63mcd +zZnA8aAu9iTK9YPfcw1YWTJliNdKUoxmGVV5Ca1W4w== +-----END EC PRIVATE KEY-----` diff --git a/internal/handlers/handler_oidc_userinfo.go b/internal/handlers/handler_oidc_userinfo.go index c3dc4f9e6..33b827bbe 100644 --- a/internal/handlers/handler_oidc_userinfo.go +++ b/internal/handlers/handler_oidc_userinfo.go @@ -100,7 +100,7 @@ func OpenIDConnectUserinfo(ctx *middlewares.AutheliaCtx, rw http.ResponseWriter, ctx.Logger.Tracef("UserInfo Response with id '%s' on client with id '%s' is being sent with the following claims: %+v", requester.GetID(), clientID, claims) switch client.GetUserinfoSigningAlgorithm() { - case oidc.SigningAlgorithmRSAWithSHA256: + case oidc.SigningAlgRSAUsingSHA256: var jti uuid.UUID if jti, err = uuid.NewRandom(); err != nil { @@ -126,7 +126,7 @@ func OpenIDConnectUserinfo(ctx *middlewares.AutheliaCtx, rw http.ResponseWriter, rw.Header().Set(fasthttp.HeaderContentType, "application/jwt") _, _ = rw.Write([]byte(token)) - case oidc.SigningAlgorithmNone, "": + case oidc.SigningAlgNone, "": ctx.Providers.OpenIDConnect.Write(rw, req, claims) default: ctx.Providers.OpenIDConnect.WriteError(rw, req, errors.WithStack(fosite.ErrServerError.WithHintf("Unsupported UserInfo signing algorithm '%s'.", client.GetUserinfoSigningAlgorithm()))) diff --git a/internal/oidc/client.go b/internal/oidc/client.go index 71b43d867..6a100cdbe 100644 --- a/internal/oidc/client.go +++ b/internal/oidc/client.go @@ -47,8 +47,9 @@ func NewClient(config schema.OpenIDConnectClientConfiguration) (client Client) { if config.TokenEndpointAuthMethod != "" && config.TokenEndpointAuthMethod != "auto" { client = &FullClient{ - BaseClient: base, - TokenEndpointAuthMethod: config.TokenEndpointAuthMethod, + BaseClient: base, + TokenEndpointAuthMethod: config.TokenEndpointAuthMethod, + TokenEndpointAuthSigningAlgorithm: config.TokenEndpointAuthSigningAlg, } } else { client = base @@ -133,7 +134,7 @@ func (c *BaseClient) GetResponseModes() []fosite.ResponseModeType { // GetUserinfoSigningAlgorithm returns the UserinfoSigningAlgorithm. func (c *BaseClient) GetUserinfoSigningAlgorithm() string { if c.UserinfoSigningAlgorithm == "" { - c.UserinfoSigningAlgorithm = SigningAlgorithmNone + c.UserinfoSigningAlgorithm = SigningAlgNone } return c.UserinfoSigningAlgorithm @@ -306,7 +307,7 @@ func (c *FullClient) GetTokenEndpointAuthMethod() string { // authentication methods. func (c *FullClient) GetTokenEndpointAuthSigningAlgorithm() string { if c.TokenEndpointAuthSigningAlgorithm == "" { - c.TokenEndpointAuthSigningAlgorithm = SigningAlgorithmRSAWithSHA256 + c.TokenEndpointAuthSigningAlgorithm = SigningAlgRSAUsingSHA256 } return c.TokenEndpointAuthSigningAlgorithm diff --git a/internal/oidc/client_auth.go b/internal/oidc/client_auth.go new file mode 100644 index 000000000..c852153bc --- /dev/null +++ b/internal/oidc/client_auth.go @@ -0,0 +1,331 @@ +package oidc + +import ( + "context" + "crypto/ecdsa" + "crypto/rsa" + "encoding/json" + "fmt" + "net/http" + "net/url" + "time" + + "github.com/go-crypt/crypt/algorithm/plaintext" + "github.com/golang-jwt/jwt/v4" + "github.com/ory/fosite" + "github.com/ory/x/errorsx" + "github.com/pkg/errors" + "gopkg.in/square/go-jose.v2" + + "github.com/authelia/authelia/v4/internal/configuration/schema" +) + +// DefaultClientAuthenticationStrategy is a copy of fosite's with the addition of the client_secret_jwt method and some +// minor superficial changes. +// +//nolint:gocyclo // Complexity is necessary to remain in feature parity. +func (p *OpenIDConnectProvider) DefaultClientAuthenticationStrategy(ctx context.Context, r *http.Request, form url.Values) (client fosite.Client, err error) { + if assertionType := form.Get(FormParameterClientAssertionType); assertionType == ClientAssertionJWTBearerType { + assertion := form.Get(FormParameterClientAssertion) + if len(assertion) == 0 { + return nil, errorsx.WithStack(fosite.ErrInvalidRequest.WithHintf("The client_assertion request parameter must be set when using client_assertion_type of '%s'.", ClientAssertionJWTBearerType)) + } + + var ( + token *jwt.Token + clientID string + ) + + token, err = jwt.ParseWithClaims(assertion, jwt.MapClaims{}, func(t *jwt.Token) (any, error) { + clientID, _, err = clientCredentialsFromRequestBody(form, false) + if err != nil { + return nil, err + } + + if clientID == "" { + claims := t.Claims.(jwt.MapClaims) + + if sub, ok := claims[ClaimSubject].(string); !ok { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("The claim 'sub' from the client_assertion JSON Web Token is undefined.")) + } else { + clientID = sub + } + } + + if client, err = p.Store.GetClient(ctx, clientID); err != nil { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithWrap(err).WithDebug(err.Error())) + } + + oidcClient, ok := client.(*FullClient) + if !ok { + return nil, errorsx.WithStack(fosite.ErrInvalidRequest.WithHint("The client configuration does not support OpenID Connect specific authentication methods.")) + } + + switch oidcClient.GetTokenEndpointAuthMethod() { + case ClientAuthMethodPrivateKeyJWT, ClientAuthMethodClientSecretJWT: + break + case ClientAuthMethodNone: + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("This requested OAuth 2.0 client does not support client authentication, however 'client_assertion' was provided in the request.")) + case ClientAuthMethodClientSecretPost: + fallthrough + case ClientAuthMethodClientSecretBasic: + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("This requested OAuth 2.0 client only supports client authentication method '%s', however 'client_assertion' was provided in the request.", oidcClient.GetTokenEndpointAuthMethod())) + default: + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("This requested OAuth 2.0 client only supports client authentication method '%s', however that method is not supported by this server.", oidcClient.GetTokenEndpointAuthMethod())) + } + + if oidcClient.GetTokenEndpointAuthSigningAlgorithm() != fmt.Sprintf("%s", t.Header[JWTHeaderKeyAlgorithm]) { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The 'client_assertion' uses signing algorithm '%s' but the requested OAuth 2.0 Client enforces signing algorithm '%s'.", t.Header[JWTHeaderKeyAlgorithm], oidcClient.GetTokenEndpointAuthSigningAlgorithm())) + } + + switch t.Method { + case jwt.SigningMethodRS256, jwt.SigningMethodRS384, jwt.SigningMethodRS512: + return p.findClientPublicJWK(ctx, oidcClient, t, true) + case jwt.SigningMethodES256, jwt.SigningMethodES384, jwt.SigningMethodES512: + return p.findClientPublicJWK(ctx, oidcClient, t, false) + case jwt.SigningMethodPS256, jwt.SigningMethodPS384, jwt.SigningMethodPS512: + return p.findClientPublicJWK(ctx, oidcClient, t, true) + case jwt.SigningMethodHS256, jwt.SigningMethodHS384, jwt.SigningMethodHS512: + if spd, ok := oidcClient.Secret.(*schema.PasswordDigest); ok { + if secret, ok := spd.Digest.(*plaintext.Digest); ok { + return secret.Key(), nil + } + } + + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("This client does not support authentication method 'client_secret_jwt' as the client secret is not in plaintext.")) + default: + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The 'client_assertion' request parameter uses unsupported signing algorithm '%s'.", t.Header[JWTHeaderKeyAlgorithm])) + } + }) + + if err != nil { + var r *fosite.RFC6749Error + + if errors.As(err, &r) { + return nil, err + } + + var e *jwt.ValidationError + + if errors.As(err, &e) { + rfc := fosite.ErrInvalidClient.WithHint("Unable to verify the integrity of the 'client_assertion' value.").WithWrap(err) + + switch { + case e.Errors&jwt.ValidationErrorMalformed != 0: + return nil, errorsx.WithStack(rfc.WithDebug("The token is malformed.")) + case e.Errors&jwt.ValidationErrorIssuedAt != 0: + return nil, errorsx.WithStack(rfc.WithDebug("The token was used before it was issued.")) + case e.Errors&jwt.ValidationErrorExpired != 0: + return nil, errorsx.WithStack(rfc.WithDebug("The token is expired.")) + case e.Errors&jwt.ValidationErrorNotValidYet != 0: + return nil, errorsx.WithStack(rfc.WithDebug("The token isn't valid yet.")) + case e.Errors&jwt.ValidationErrorSignatureInvalid != 0: + return nil, errorsx.WithStack(rfc.WithDebug("The signature is invalid.")) + } + + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("Unable to verify the integrity of the 'client_assertion' value.").WithWrap(err).WithDebug(err.Error())) + } + + return nil, err + } else if err = token.Claims.Valid(); err != nil { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("Unable to verify the request object because its claims could not be validated, check if the expiry time is set correctly.").WithWrap(err).WithDebug(err.Error())) + } + + claims := token.Claims.(jwt.MapClaims) + + tokenURL := p.Config.GetTokenURL(ctx) + + var jti string + + if !claims.VerifyIssuer(clientID, true) { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("Claim 'iss' from 'client_assertion' must match the 'client_id' of the OAuth 2.0 Client.")) + } else if tokenURL == "" { + return nil, errorsx.WithStack(fosite.ErrMisconfiguration.WithHint("The authorization server's token endpoint URL has not been set.")) + } else if sub, ok := claims[ClaimSubject].(string); !ok || sub != clientID { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("Claim 'sub' from 'client_assertion' must match the 'client_id' of the OAuth 2.0 Client.")) + } else if jti, ok = claims[ClaimJWTID].(string); !ok || len(jti) == 0 { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("Claim 'jti' from 'client_assertion' must be set but is not.")) + } else if p.Store.ClientAssertionJWTValid(ctx, jti) != nil { + return nil, errorsx.WithStack(fosite.ErrJTIKnown.WithHint("Claim 'jti' from 'client_assertion' MUST only be used once.")) + } + + err = nil + + var expiry int64 + + switch exp := claims[ClaimExpirationTime].(type) { + case float64: + expiry = int64(exp) + case int64: + expiry = exp + case json.Number: + expiry, err = exp.Int64() + default: + err = fosite.ErrInvalidClient.WithHint("Unable to type assert the expiry time from claims. This should not happen as we validate the expiry time already earlier with token.Claims.Valid()") + } + + if err != nil { + return nil, errorsx.WithStack(err) + } + + if err = p.Store.SetClientAssertionJWT(ctx, jti, time.Unix(expiry, 0)); err != nil { + return nil, err + } + + var found bool + + if auds, ok := claims[ClaimAudience].([]any); ok { + for _, aud := range auds { + if a, ok := aud.(string); ok && a == tokenURL { + found = true + break + } + } + } + + if !found { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("Claim 'audience' from 'client_assertion' must match the authorization server's token endpoint '%s'.", tokenURL)) + } + + return client, nil + } else if len(assertionType) > 0 { + return nil, errorsx.WithStack(fosite.ErrInvalidRequest.WithHintf("Unknown client_assertion_type '%s'.", assertionType)) + } + + clientID, clientSecret, err := clientCredentialsFromRequest(r, form) + if err != nil { + return nil, err + } + + if client, err = p.Store.GetClient(ctx, clientID); err != nil { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithWrap(err).WithDebug(err.Error())) + } + + if oidcClient, ok := client.(fosite.OpenIDConnectClient); ok { + method := oidcClient.GetTokenEndpointAuthMethod() + + if form.Get(FormParameterClientID) != "" && form.Get(FormParameterClientSecret) != "" && method != ClientAuthMethodClientSecretPost { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The OAuth 2.0 Client supports client authentication method '%s', but method 'client_secret_post' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_post'.", method)) + } else if _, secret, basicOk := r.BasicAuth(); basicOk && secret != "" && method != ClientAuthMethodClientSecretBasic { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The OAuth 2.0 Client supports client authentication method '%s', but method 'client_secret_basic' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_basic'.", method)) + } else if method != ClientAuthMethodNone && client.IsPublic() { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The OAuth 2.0 Client supports client authentication method '%s', but method 'none' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'none'.", method)) + } + } + + if client.IsPublic() { + return client, nil + } + + if err = p.checkClientSecret(ctx, client, []byte(clientSecret)); err != nil { + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithWrap(err).WithDebug(err.Error())) + } + + return client, nil +} + +func (p *OpenIDConnectProvider) checkClientSecret(ctx context.Context, client fosite.Client, clientSecret []byte) (err error) { + if err = p.Config.GetSecretsHasher(ctx).Compare(ctx, client.GetHashedSecret(), clientSecret); err == nil { + return nil + } + + cc, ok := client.(fosite.ClientWithSecretRotation) + if !ok { + return err + } + + for _, hash := range cc.GetRotatedHashes() { + if err = p.Config.GetSecretsHasher(ctx).Compare(ctx, hash, clientSecret); err == nil { + return nil + } + } + + return err +} + +func (p *OpenIDConnectProvider) findClientPublicJWK(ctx context.Context, oidcClient fosite.OpenIDConnectClient, t *jwt.Token, expectsRSAKey bool) (any, error) { + if set := oidcClient.GetJSONWebKeys(); set != nil { + return findPublicKey(t, set, expectsRSAKey) + } + + if location := oidcClient.GetJSONWebKeysURI(); len(location) > 0 { + keys, err := p.Config.GetJWKSFetcherStrategy(ctx).Resolve(ctx, location, false) + if err != nil { + return nil, err + } + + if key, err := findPublicKey(t, keys, expectsRSAKey); err == nil { + return key, nil + } + + keys, err = p.Config.GetJWKSFetcherStrategy(ctx).Resolve(ctx, location, true) + if err != nil { + return nil, err + } + + return findPublicKey(t, keys, expectsRSAKey) + } + + return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("The OAuth 2.0 Client has no JSON Web Keys set registered, but they are needed to complete the request.")) +} + +func findPublicKey(t *jwt.Token, set *jose.JSONWebKeySet, expectsRSAKey bool) (any, error) { + keys := set.Keys + if len(keys) == 0 { + return nil, errorsx.WithStack(fosite.ErrInvalidRequest.WithHintf("The retrieved JSON Web Key Set does not contain any key.")) + } + + kid, ok := t.Header[JWTHeaderKeyIdentifier].(string) + if ok { + keys = set.Key(kid) + } + + if len(keys) == 0 { + return nil, errorsx.WithStack(fosite.ErrInvalidRequest.WithHintf("The JSON Web Token uses signing key with kid '%s', which could not be found.", kid)) + } + + for _, key := range keys { + if key.Use != KeyUseSignature { + continue + } + + if expectsRSAKey { + if k, ok := key.Key.(*rsa.PublicKey); ok { + return k, nil + } + } else { + if k, ok := key.Key.(*ecdsa.PublicKey); ok { + return k, nil + } + } + } + + if expectsRSAKey { + return nil, errorsx.WithStack(fosite.ErrInvalidRequest.WithHintf("Unable to find RSA public key with use='sig' for kid '%s' in JSON Web Key Set.", kid)) + } else { + return nil, errorsx.WithStack(fosite.ErrInvalidRequest.WithHintf("Unable to find ECDSA public key with use='sig' for kid '%s' in JSON Web Key Set.", kid)) + } +} + +func clientCredentialsFromRequest(r *http.Request, form url.Values) (clientID, clientSecret string, err error) { + if id, secret, ok := r.BasicAuth(); !ok { + return clientCredentialsFromRequestBody(form, true) + } else if clientID, err = url.QueryUnescape(id); err != nil { + return "", "", errorsx.WithStack(fosite.ErrInvalidRequest.WithHint("The client id in the HTTP authorization header could not be decoded from 'application/x-www-form-urlencoded'.").WithWrap(err).WithDebug(err.Error())) + } else if clientSecret, err = url.QueryUnescape(secret); err != nil { + return "", "", errorsx.WithStack(fosite.ErrInvalidRequest.WithHint("The client secret in the HTTP authorization header could not be decoded from 'application/x-www-form-urlencoded'.").WithWrap(err).WithDebug(err.Error())) + } + + return clientID, clientSecret, nil +} + +func clientCredentialsFromRequestBody(form url.Values, forceID bool) (clientID, clientSecret string, err error) { + clientID = form.Get(FormParameterClientID) + clientSecret = form.Get(FormParameterClientSecret) + + if clientID == "" && forceID { + return "", "", errorsx.WithStack(fosite.ErrInvalidRequest.WithHint("Client credentials missing or malformed in both HTTP Authorization header and HTTP POST body.")) + } + + return clientID, clientSecret, nil +} diff --git a/internal/oidc/client_test.go b/internal/oidc/client_test.go index a4be63346..ece18b278 100644 --- a/internal/oidc/client_test.go +++ b/internal/oidc/client_test.go @@ -27,7 +27,7 @@ func TestNewClient(t *testing.T) { bclient, ok := client.(*BaseClient) require.True(t, ok) assert.Equal(t, "", bclient.UserinfoSigningAlgorithm) - assert.Equal(t, SigningAlgorithmNone, client.GetUserinfoSigningAlgorithm()) + assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlgorithm()) _, ok = client.(*FullClient) assert.False(t, ok) @@ -64,9 +64,9 @@ func TestNewClient(t *testing.T) { assert.Equal(t, "", fclient.UserinfoSigningAlgorithm) assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.TokenEndpointAuthMethod) assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.GetTokenEndpointAuthMethod()) - assert.Equal(t, SigningAlgorithmNone, client.GetUserinfoSigningAlgorithm()) + assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlgorithm()) assert.Equal(t, "", fclient.TokenEndpointAuthSigningAlgorithm) - assert.Equal(t, SigningAlgorithmRSAWithSHA256, fclient.GetTokenEndpointAuthSigningAlgorithm()) + assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.GetTokenEndpointAuthSigningAlgorithm()) assert.Equal(t, "", fclient.RequestObjectSigningAlgorithm) assert.Equal(t, "", fclient.GetRequestObjectSigningAlgorithm()) assert.Equal(t, "", fclient.JSONWebKeysURI) @@ -545,11 +545,3 @@ func TestClient_IsPublic(t *testing.T) { c.Public = true assert.True(t, c.IsPublic()) } - -func MustDecodeSecret(value string) *schema.PasswordDigest { - if secret, err := schema.DecodePasswordDigest(value); err != nil { - panic(err) - } else { - return secret - } -} diff --git a/internal/oidc/const.go b/internal/oidc/const.go index 3680923c3..2143236af 100644 --- a/internal/oidc/const.go +++ b/internal/oidc/const.go @@ -40,6 +40,11 @@ const ( ClaimClientIdentifier = "client_id" ) +const ( + // ClientAssertionJWTBearerType is the JWT bearer assertion. + ClientAssertionJWTBearerType = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" //nolint:gosec // False Positive. +) + const ( lifespanTokenDefault = time.Hour lifespanRefreshTokenDefault = time.Hour * 24 * 30 @@ -75,6 +80,8 @@ const ( const ( ClientAuthMethodClientSecretBasic = "client_secret_basic" ClientAuthMethodClientSecretPost = "client_secret_post" + ClientAuthMethodClientSecretJWT = "client_secret_jwt" + ClientAuthMethodPrivateKeyJWT = "private_key_jwt" ClientAuthMethodNone = "none" ) @@ -89,10 +96,30 @@ const ( ResponseTypeHybridFlowBoth = "code id_token token" ) -// Signing Algorithm strings. +// JWS Algorithm strings. +// See: https://datatracker.ietf.org/doc/html/rfc7518#section-3.1 const ( - SigningAlgorithmNone = none - SigningAlgorithmRSAWithSHA256 = "RS256" + SigningAlgNone = none + + SigningAlgRSAUsingSHA256 = "RS256" + SigningAlgRSAUsingSHA384 = "RS384" + SigningAlgRSAUsingSHA512 = "RS512" + + SigningAlgRSAPSSUsingSHA256 = "PS256" + SigningAlgRSAPSSUsingSHA384 = "PS384" + SigningAlgRSAPSSUsingSHA512 = "PS512" + + SigningAlgECDSAUsingP256AndSHA256 = "ES256" + SigningAlgECDSAUsingP384AndSHA384 = "ES384" + SigningAlgECDSAUsingP521AndSHA512 = "ES512" + + SigningAlgHMACUsingSHA256 = "HS256" + SigningAlgHMACUsingSHA384 = "HS384" + SigningAlgHMACUsingSHA512 = "HS512" +) + +const ( + KeyUseSignature = "sig" ) // Subject Type strings. @@ -108,10 +135,14 @@ const ( ) const ( + FormParameterClientID = "client_id" + FormParameterClientSecret = "client_secret" FormParameterRequestURI = "request_uri" FormParameterResponseMode = "response_mode" FormParameterCodeChallenge = "code_challenge" FormParameterCodeChallengeMethod = "code_challenge_method" + FormParameterClientAssertionType = "client_assertion_type" + FormParameterClientAssertion = "client_assertion" ) const ( @@ -135,6 +166,9 @@ const ( const ( // JWTHeaderKeyIdentifier is the JWT Header referencing the JWS Key Identifier used to sign a token. JWTHeaderKeyIdentifier = "kid" + + // JWTHeaderKeyAlgorithm is the JWT Header referencing the JWS Key algorithm used to sign a token. + JWTHeaderKeyAlgorithm = "alg" ) const ( diff --git a/internal/oidc/const_test.go b/internal/oidc/const_test.go index b5e3d915b..0208df15f 100644 --- a/internal/oidc/const_test.go +++ b/internal/oidc/const_test.go @@ -1,12 +1,56 @@ package oidc -const ( - myclient = "myclient" - myclientdesc = "My Client" - onefactor = "one_factor" - twofactor = "two_factor" - examplecom = "https://example.com" - examplecomsid = "example.com" - badsecret = "$plaintext$a_bad_secret" - badhmac = "asbdhaaskmdlkamdklasmdlkams" +import ( + "crypto/rsa" + "crypto/x509" + "encoding/pem" + "net/url" + + "github.com/authelia/authelia/v4/internal/configuration/schema" ) + +const ( + myclient = "myclient" + myclientdesc = "My Client" + onefactor = "one_factor" + twofactor = "two_factor" + examplecom = "https://example.com" + examplecomsid = "example.com" + badsecret = "$plaintext$a_bad_secret" + badhmac = "asbdhaaskmdlkamdklasmdlkams" + exampleIssuerPrivateKey = "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAvcMVMB2vEbqI6PlSNJ4HmUyMxBDJ5iY7FS+zDDAHOZBg9S3S\nKcAn1CZcnyL0VvJ7wcdhR6oTnOwR94eKvzUyJZ+GL2hTMm27dubEYsNdhoCl6N3X\nyEEohNfoxiiCYraVauX8X3M9jFzbEz9+pacaDbHB2syaJ1qFmMNR+HSu2jPzOo7M\nlqKIOgUzA0741MaYNt47AEVg4XU5ORLdolbAkItmYg1QbyFndg9H5IvwKkYaXTGE\nlgDBcPUC0yVjAC15Mguquq+jZeQay+6PSbHTD8PQMOkLjyChI2xEhVNbdCXe676R\ncMW2R/gjrcK23zmtmTWRfdC1iZLSlHO+bJj9vQIDAQABAoIBAEZvkP/JJOCJwqPn\nV3IcbmmilmV4bdi1vByDFgyiDyx4wOSA24+PubjvfFW9XcCgRPuKjDtTj/AhWBHv\nB7stfa2lZuNV7/u562mZArA+IAr62Zp0LdIxDV8x3T8gbjVB3HhPYbv0RJZDKTYd\nzV6jhfIrVu9mHpoY6ZnodhapCPYIyk/d49KBIHZuAc25CUjMXgTeaVtf0c996036\nUxW6ef33wAOJAvW0RCvbXAJfmBeEq2qQlkjTIlpYx71fhZWexHifi8Ouv3Zonc+1\n/P2Adq5uzYVBT92f9RKHg9QxxNzVrLjSMaxyvUtWQCAQfW0tFIRdqBGsHYsQrFtI\nF4yzv8ECgYEA7ntpyN9HD9Z9lYQzPCR73sFCLM+ID99aVij0wHuxK97bkSyyvkLd\n7MyTaym3lg1UEqWNWBCLvFULZx7F0Ah6qCzD4ymm3Bj/ADpWWPgljBI0AFml+HHs\nhcATmXUrj5QbLyhiP2gmJjajp1o/rgATx6ED66seSynD6JOH8wUhhZUCgYEAy7OA\n06PF8GfseNsTqlDjNF0K7lOqd21S0prdwrsJLiVzUlfMM25MLE0XLDUutCnRheeh\nIlcuDoBsVTxz6rkvFGD74N+pgXlN4CicsBq5ofK060PbqCQhSII3fmHobrZ9Cr75\nHmBjAxHx998SKaAAGbBbcYGUAp521i1pH5CEPYkCgYEAkUd1Zf0+2RMdZhwm6hh/\nrW+l1I6IoMK70YkZsLipccRNld7Y9LbfYwYtODcts6di9AkOVfueZJiaXbONZfIE\nZrb+jkAteh9wGL9xIrnohbABJcV3Kiaco84jInUSmGDtPokncOENfHIEuEpuSJ2b\nbx1TuhmAVuGWivR0+ULC7RECgYEAgS0cDRpWc9Xzh9Cl7+PLsXEvdWNpPsL9OsEq\n0Ep7z9+/+f/jZtoTRCS/BTHUpDvAuwHglT5j3p5iFMt5VuiIiovWLwynGYwrbnNS\nqfrIrYKUaH1n1oDS+oBZYLQGCe9/7EifAjxtjYzbvSyg//SPG7tSwfBCREbpZXj2\nqSWkNsECgYA/mCDzCTlrrWPuiepo6kTmN+4TnFA+hJI6NccDVQ+jvbqEdoJ4SW4L\nzqfZSZRFJMNpSgIqkQNRPJqMP0jQ5KRtJrjMWBnYxktwKz9fDg2R2MxdFgMF2LH2\nHEMMhFHlv8NDjVOXh1KwRoltNGVWYsSrD9wKU9GhRCEfmNCGrvBcEg==\n-----END RSA PRIVATE KEY-----" +) + +func MustDecodeSecret(value string) *schema.PasswordDigest { + if secret, err := schema.DecodePasswordDigest(value); err != nil { + panic(err) + } else { + return secret + } +} + +func MustParseRequestURI(input string) *url.URL { + if requestURI, err := url.ParseRequestURI(input); err != nil { + panic(err) + } else { + return requestURI + } +} + +func MustParseRSAPrivateKey(data string) *rsa.PrivateKey { + block, _ := pem.Decode([]byte(data)) + if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { + panic("not pem encoded") + } + + if block.Type != "RSA PRIVATE KEY" { + panic("not private key") + } + + key, err := x509.ParsePKCS1PrivateKey(block.Bytes) + if err != nil { + panic(err) + } + + return key +} diff --git a/internal/oidc/discovery.go b/internal/oidc/discovery.go index e57bad146..7ce180fbf 100644 --- a/internal/oidc/discovery.go +++ b/internal/oidc/discovery.go @@ -62,8 +62,14 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration TokenEndpointAuthMethodsSupported: []string{ ClientAuthMethodClientSecretBasic, ClientAuthMethodClientSecretPost, + ClientAuthMethodClientSecretJWT, ClientAuthMethodNone, }, + TokenEndpointAuthSigningAlgValuesSupported: []string{ + SigningAlgHMACUsingSHA256, + SigningAlgHMACUsingSHA384, + SigningAlgHMACUsingSHA512, + }, }, OAuth2DiscoveryOptions: OAuth2DiscoveryOptions{ CodeChallengeMethodsSupported: []string{ @@ -77,11 +83,11 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration OpenIDConnectDiscoveryOptions: OpenIDConnectDiscoveryOptions{ IDTokenSigningAlgValuesSupported: []string{ - SigningAlgorithmRSAWithSHA256, + SigningAlgRSAUsingSHA256, }, UserinfoSigningAlgValuesSupported: []string{ - SigningAlgorithmNone, - SigningAlgorithmRSAWithSHA256, + SigningAlgNone, + SigningAlgRSAUsingSHA256, }, }, OpenIDConnectFrontChannelLogoutDiscoveryOptions: &OpenIDConnectFrontChannelLogoutDiscoveryOptions{}, diff --git a/internal/oidc/errors.go b/internal/oidc/errors.go index 58464568c..4041bbda4 100644 --- a/internal/oidc/errors.go +++ b/internal/oidc/errors.go @@ -6,7 +6,7 @@ import ( "github.com/ory/fosite" ) -var errPasswordsDoNotMatch = errors.New("the passwords don't match") +var errPasswordsDoNotMatch = errors.New("The provided client secret did not match the registered client secret.") var ( // ErrIssuerCouldNotDerive is sent when the issuer couldn't be determined from the headers. diff --git a/internal/oidc/keys.go b/internal/oidc/keys.go index f3b0928cc..3ca47d414 100644 --- a/internal/oidc/keys.go +++ b/internal/oidc/keys.go @@ -125,8 +125,8 @@ func NewJWK(chain schema.X509CertificateChain, key *rsa.PrivateKey) (j *JWK, err } jwk := &jose.JSONWebKey{ - Algorithm: SigningAlgorithmRSAWithSHA256, - Use: "sig", + Algorithm: SigningAlgRSAUsingSHA256, + Use: KeyUseSignature, Key: &key.PublicKey, } @@ -170,8 +170,8 @@ func (j *JWK) JSONWebKey() (jwk *jose.JSONWebKey) { jwk = &jose.JSONWebKey{ Key: &j.key.PublicKey, KeyID: j.id, - Algorithm: "RS256", - Use: "sig", + Algorithm: SigningAlgRSAUsingSHA256, + Use: KeyUseSignature, Certificates: j.chain.Certificates(), } diff --git a/internal/oidc/keys_test.go b/internal/oidc/keys_test.go index 1e15973ea..0405227b3 100644 --- a/internal/oidc/keys_test.go +++ b/internal/oidc/keys_test.go @@ -17,7 +17,7 @@ func TestKeyManager_AddActiveJWK(t *testing.T) { assert.Nil(t, manager.jwk) assert.Nil(t, manager.Strategy()) - j, err := manager.AddActiveJWK(schema.X509CertificateChain{}, mustParseRSAPrivateKey(exampleIssuerPrivateKey)) + j, err := manager.AddActiveJWK(schema.X509CertificateChain{}, MustParseRSAPrivateKey(exampleIssuerPrivateKey)) require.NoError(t, err) require.NotNil(t, j) require.NotNil(t, manager.jwk) diff --git a/internal/oidc/provider.go b/internal/oidc/provider.go index b8333351b..3238a1c83 100644 --- a/internal/oidc/provider.go +++ b/internal/oidc/provider.go @@ -36,6 +36,7 @@ func NewOpenIDConnectProvider(config *schema.OpenIDConnectConfiguration, store s } provider.Config.LoadHandlers(provider.Store, provider.KeyManager.Strategy()) + provider.Config.Strategy.ClientAuthentication = provider.DefaultClientAuthenticationStrategy provider.discovery = NewOpenIDConnectWellKnownConfiguration(config) diff --git a/internal/oidc/provider_test.go b/internal/oidc/provider_test.go index 4a1a0b115..51ed6e4e6 100644 --- a/internal/oidc/provider_test.go +++ b/internal/oidc/provider_test.go @@ -1,9 +1,6 @@ package oidc import ( - "crypto/rsa" - "crypto/x509" - "encoding/pem" "net/url" "testing" @@ -13,8 +10,6 @@ import ( "github.com/authelia/authelia/v4/internal/configuration/schema" ) -var exampleIssuerPrivateKey = "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAvcMVMB2vEbqI6PlSNJ4HmUyMxBDJ5iY7FS+zDDAHOZBg9S3S\nKcAn1CZcnyL0VvJ7wcdhR6oTnOwR94eKvzUyJZ+GL2hTMm27dubEYsNdhoCl6N3X\nyEEohNfoxiiCYraVauX8X3M9jFzbEz9+pacaDbHB2syaJ1qFmMNR+HSu2jPzOo7M\nlqKIOgUzA0741MaYNt47AEVg4XU5ORLdolbAkItmYg1QbyFndg9H5IvwKkYaXTGE\nlgDBcPUC0yVjAC15Mguquq+jZeQay+6PSbHTD8PQMOkLjyChI2xEhVNbdCXe676R\ncMW2R/gjrcK23zmtmTWRfdC1iZLSlHO+bJj9vQIDAQABAoIBAEZvkP/JJOCJwqPn\nV3IcbmmilmV4bdi1vByDFgyiDyx4wOSA24+PubjvfFW9XcCgRPuKjDtTj/AhWBHv\nB7stfa2lZuNV7/u562mZArA+IAr62Zp0LdIxDV8x3T8gbjVB3HhPYbv0RJZDKTYd\nzV6jhfIrVu9mHpoY6ZnodhapCPYIyk/d49KBIHZuAc25CUjMXgTeaVtf0c996036\nUxW6ef33wAOJAvW0RCvbXAJfmBeEq2qQlkjTIlpYx71fhZWexHifi8Ouv3Zonc+1\n/P2Adq5uzYVBT92f9RKHg9QxxNzVrLjSMaxyvUtWQCAQfW0tFIRdqBGsHYsQrFtI\nF4yzv8ECgYEA7ntpyN9HD9Z9lYQzPCR73sFCLM+ID99aVij0wHuxK97bkSyyvkLd\n7MyTaym3lg1UEqWNWBCLvFULZx7F0Ah6qCzD4ymm3Bj/ADpWWPgljBI0AFml+HHs\nhcATmXUrj5QbLyhiP2gmJjajp1o/rgATx6ED66seSynD6JOH8wUhhZUCgYEAy7OA\n06PF8GfseNsTqlDjNF0K7lOqd21S0prdwrsJLiVzUlfMM25MLE0XLDUutCnRheeh\nIlcuDoBsVTxz6rkvFGD74N+pgXlN4CicsBq5ofK060PbqCQhSII3fmHobrZ9Cr75\nHmBjAxHx998SKaAAGbBbcYGUAp521i1pH5CEPYkCgYEAkUd1Zf0+2RMdZhwm6hh/\nrW+l1I6IoMK70YkZsLipccRNld7Y9LbfYwYtODcts6di9AkOVfueZJiaXbONZfIE\nZrb+jkAteh9wGL9xIrnohbABJcV3Kiaco84jInUSmGDtPokncOENfHIEuEpuSJ2b\nbx1TuhmAVuGWivR0+ULC7RECgYEAgS0cDRpWc9Xzh9Cl7+PLsXEvdWNpPsL9OsEq\n0Ep7z9+/+f/jZtoTRCS/BTHUpDvAuwHglT5j3p5iFMt5VuiIiovWLwynGYwrbnNS\nqfrIrYKUaH1n1oDS+oBZYLQGCe9/7EifAjxtjYzbvSyg//SPG7tSwfBCREbpZXj2\nqSWkNsECgYA/mCDzCTlrrWPuiepo6kTmN+4TnFA+hJI6NccDVQ+jvbqEdoJ4SW4L\nzqfZSZRFJMNpSgIqkQNRPJqMP0jQ5KRtJrjMWBnYxktwKz9fDg2R2MxdFgMF2LH2\nHEMMhFHlv8NDjVOXh1KwRoltNGVWYsSrD9wKU9GhRCEfmNCGrvBcEg==\n-----END RSA PRIVATE KEY-----" - func TestOpenIDConnectProvider_NewOpenIDConnectProvider_NotConfigured(t *testing.T) { provider, err := NewOpenIDConnectProvider(nil, nil, nil) @@ -25,7 +20,7 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_NotConfigured(t *testing func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing.T) { provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), EnablePKCEPlainChallenge: true, HMACSecret: badhmac, Clients: []schema.OpenIDConnectClientConfiguration{ @@ -57,7 +52,7 @@ func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GoodConfiguration(t *testing.T) { provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), HMACSecret: badhmac, Clients: []schema.OpenIDConnectClientConfiguration{ { @@ -97,7 +92,7 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GoodConfiguration(t *tes func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfiguration(t *testing.T) { provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), HMACSecret: "asbdhaaskmdlkamdklasmdlkams", Clients: []schema.OpenIDConnectClientConfiguration{ { @@ -152,9 +147,10 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowToken) assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowBoth) - assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 3) + assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 4) assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretPost) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretJWT) assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodNone) assert.Len(t, disco.GrantTypesSupported, 3) @@ -163,11 +159,11 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow assert.Contains(t, disco.GrantTypesSupported, GrantTypeImplicit) assert.Len(t, disco.IDTokenSigningAlgValuesSupported, 1) - assert.Contains(t, disco.IDTokenSigningAlgValuesSupported, SigningAlgorithmRSAWithSHA256) + assert.Contains(t, disco.IDTokenSigningAlgValuesSupported, SigningAlgRSAUsingSHA256) assert.Len(t, disco.UserinfoSigningAlgValuesSupported, 2) - assert.Contains(t, disco.UserinfoSigningAlgValuesSupported, SigningAlgorithmRSAWithSHA256) - assert.Contains(t, disco.UserinfoSigningAlgValuesSupported, SigningAlgorithmNone) + assert.Contains(t, disco.UserinfoSigningAlgValuesSupported, SigningAlgRSAUsingSHA256) + assert.Contains(t, disco.UserinfoSigningAlgValuesSupported, SigningAlgNone) assert.Len(t, disco.RequestObjectSigningAlgValuesSupported, 0) @@ -195,7 +191,7 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOAuth2WellKnownConfiguration(t *testing.T) { provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), HMACSecret: "asbdhaaskmdlkamdklasmdlkams", Clients: []schema.OpenIDConnectClientConfiguration{ { @@ -249,9 +245,10 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOAuth2WellKnownConfig assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowToken) assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowBoth) - assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 3) + assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 4) assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretPost) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretJWT) assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodNone) assert.Len(t, disco.GrantTypesSupported, 3) @@ -283,7 +280,7 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOAuth2WellKnownConfig func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfigurationWithPlainPKCE(t *testing.T) { provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), HMACSecret: "asbdhaaskmdlkamdklasmdlkams", EnablePKCEPlainChallenge: true, Clients: []schema.OpenIDConnectClientConfiguration{ @@ -306,21 +303,3 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow assert.Equal(t, PKCEChallengeMethodSHA256, disco.CodeChallengeMethodsSupported[0]) assert.Equal(t, PKCEChallengeMethodPlain, disco.CodeChallengeMethodsSupported[1]) } - -func mustParseRSAPrivateKey(data string) *rsa.PrivateKey { - block, _ := pem.Decode([]byte(data)) - if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { - panic("not pem encoded") - } - - if block.Type != "RSA PRIVATE KEY" { - panic("not private key") - } - - key, err := x509.ParsePKCS1PrivateKey(block.Bytes) - if err != nil { - panic(err) - } - - return key -} diff --git a/internal/oidc/store_test.go b/internal/oidc/store_test.go index def1d4e8e..47e15c424 100644 --- a/internal/oidc/store_test.go +++ b/internal/oidc/store_test.go @@ -15,7 +15,7 @@ import ( func TestOpenIDConnectStore_GetClientPolicy(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), Clients: []schema.OpenIDConnectClientConfiguration{ { ID: myclient, @@ -47,7 +47,7 @@ func TestOpenIDConnectStore_GetClientPolicy(t *testing.T) { func TestOpenIDConnectStore_GetInternalClient(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), Clients: []schema.OpenIDConnectClientConfiguration{ { ID: myclient, @@ -82,7 +82,7 @@ func TestOpenIDConnectStore_GetInternalClient_ValidClient(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), Clients: []schema.OpenIDConnectClientConfiguration{c1}, }, nil) @@ -110,7 +110,7 @@ func TestOpenIDConnectStore_GetInternalClient_InvalidClient(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), Clients: []schema.OpenIDConnectClientConfiguration{c1}, }, nil) @@ -122,7 +122,7 @@ func TestOpenIDConnectStore_GetInternalClient_InvalidClient(t *testing.T) { func TestOpenIDConnectStore_IsValidClientID(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: mustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), Clients: []schema.OpenIDConnectClientConfiguration{ { ID: myclient, diff --git a/internal/oidc/types.go b/internal/oidc/types.go index 8606fe3a3..6346a3ae2 100644 --- a/internal/oidc/types.go +++ b/internal/oidc/types.go @@ -958,3 +958,15 @@ type OpenIDConnectContext interface { IssuerURL() (issuerURL *url.URL, err error) } + +// MockOpenIDConnectContext is a minimal implementation of OpenIDConnectContext for the purpose of testing. +type MockOpenIDConnectContext struct { + context.Context + + MockIssuerURL *url.URL +} + +// IssuerURL returns the MockIssuerURL. +func (m *MockOpenIDConnectContext) IssuerURL() (issuerURL *url.URL, err error) { + return m.MockIssuerURL, nil +} diff --git a/internal/oidc/types_test.go b/internal/oidc/types_test.go index d604ad009..a17f3e3ad 100644 --- a/internal/oidc/types_test.go +++ b/internal/oidc/types_test.go @@ -96,11 +96,3 @@ func TestNewSessionWithAuthorizeRequest(t *testing.T) { assert.NotNil(t, session.Claims.Extra) assert.Nil(t, session.Claims.AuthenticationMethodsReferences) } - -func MustParseRequestURI(input string) *url.URL { - if requestURI, err := url.ParseRequestURI(input); err != nil { - panic(err) - } else { - return requestURI - } -} From cef374cdc184ca15fb516507d9f16356d15a0b95 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 15 May 2023 10:03:19 +1000 Subject: [PATCH 44/67] feat(oidc): multiple jwk algorithms (#5279) This adds support for multiple JWK algorithms and keys and allows for per-client algorithm choices. Signed-off-by: James Elliott --- config.template.yml | 4 + .../identity-providers/open-id-connect.md | 178 ++-- .../openid-connect/introduction.md | 33 + internal/commands/context.go | 4 +- internal/commands/crypto.go | 4 +- internal/commands/crypto_helper.go | 4 +- internal/configuration/config.template.yml | 4 + internal/configuration/decode_hooks.go | 24 + .../configuration/koanf_callbacks_test.go | 1 + internal/configuration/provider.go | 1 + internal/configuration/provider_test.go | 31 + .../schema/identity_providers.go | 18 +- internal/configuration/schema/keys.go | 8 + internal/configuration/schema/shared.go | 9 + internal/configuration/schema/types.go | 26 + .../test_resources/config_oidc_modern.yml | 211 +++++ .../test_resources/crypto/ECDSA_P224.crt | 9 + .../test_resources/crypto/ECDSA_P224.pem | 5 + .../test_resources/crypto/ECDSA_P256.crt | 10 + .../test_resources/crypto/ECDSA_P256.pem | 5 + .../crypto/ECDSA_P256_PKCS8.crt | 10 + .../crypto/ECDSA_P256_PKCS8.pem | 5 + .../test_resources/crypto/ECDSA_P384.crt | 11 + .../test_resources/crypto/ECDSA_P384.pem | 6 + .../crypto/ECDSA_P384_PKCS8.crt | 11 + .../crypto/ECDSA_P384_PKCS8.pem | 6 + .../test_resources/crypto/ECDSA_P521.crt | 13 + .../test_resources/crypto/ECDSA_P521.pem | 7 + .../crypto/ECDSA_P521_PKCS8.crt | 13 + .../crypto/ECDSA_P521_PKCS8.pem | 8 + .../test_resources/crypto/ED25519_PKCS8.crt | 8 + .../test_resources/crypto/ED25519_PKCS8.pem | 3 + .../test_resources/crypto/RSA_1024.crt | 13 + .../test_resources/crypto/RSA_1024.pem | 15 + .../test_resources/crypto/RSA_2048.crt | 18 + .../test_resources/crypto/RSA_2048.pem | 27 + .../crypto/RSA_2048_PAIR_PRIVATE.pem | 27 + .../crypto/RSA_2048_PAIR_PUBLIC.pem | 8 + .../test_resources/crypto/RSA_2048_PKCS8.crt | 18 + .../test_resources/crypto/RSA_2048_PKCS8.pem | 28 + .../test_resources/crypto/RSA_4096.crt | 29 + .../test_resources/crypto/RSA_4096.pem | 51 + internal/configuration/validator/const.go | 5 +- .../validator/identity_providers.go | 202 +++- .../validator/identity_providers_test.go | 885 ++++++++++++------ internal/configuration/validator/util.go | 51 + internal/handlers/handler_jwks.go | 4 +- .../handlers/handler_oidc_authorization.go | 2 +- internal/handlers/handler_oidc_token_test.go | 7 +- internal/handlers/handler_oidc_userinfo.go | 22 +- internal/oidc/client.go | 24 +- internal/oidc/client_test.go | 48 +- internal/oidc/const_test.go | 149 ++- internal/oidc/core_strategy_hmac_test.go | 80 ++ internal/oidc/discovery.go | 42 + internal/oidc/discovery_test.go | 43 +- internal/oidc/keys.go | 499 +++++++--- internal/oidc/keys_test.go | 456 ++++++++- internal/oidc/provider.go | 15 +- internal/oidc/provider_test.go | 106 ++- internal/oidc/store_test.go | 10 +- internal/oidc/types.go | 14 +- internal/oidc/util.go | 92 ++ internal/utils/const.go | 1 + internal/utils/crypto.go | 139 ++- 65 files changed, 3167 insertions(+), 653 deletions(-) create mode 100644 internal/configuration/test_resources/config_oidc_modern.yml create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P224.crt create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P224.pem create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P256.crt create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P256.pem create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.crt create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.pem create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P384.crt create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P384.pem create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.crt create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.pem create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P521.crt create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P521.pem create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.crt create mode 100644 internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.pem create mode 100644 internal/configuration/test_resources/crypto/ED25519_PKCS8.crt create mode 100644 internal/configuration/test_resources/crypto/ED25519_PKCS8.pem create mode 100644 internal/configuration/test_resources/crypto/RSA_1024.crt create mode 100644 internal/configuration/test_resources/crypto/RSA_1024.pem create mode 100644 internal/configuration/test_resources/crypto/RSA_2048.crt create mode 100644 internal/configuration/test_resources/crypto/RSA_2048.pem create mode 100644 internal/configuration/test_resources/crypto/RSA_2048_PAIR_PRIVATE.pem create mode 100644 internal/configuration/test_resources/crypto/RSA_2048_PAIR_PUBLIC.pem create mode 100644 internal/configuration/test_resources/crypto/RSA_2048_PKCS8.crt create mode 100644 internal/configuration/test_resources/crypto/RSA_2048_PKCS8.pem create mode 100644 internal/configuration/test_resources/crypto/RSA_4096.crt create mode 100644 internal/configuration/test_resources/crypto/RSA_4096.pem diff --git a/config.template.yml b/config.template.yml index 69270a5d0..dbeb986f3 100644 --- a/config.template.yml +++ b/config.template.yml @@ -1521,6 +1521,10 @@ notifier: ## the 'client_secret_jwt' token_endpoint_auth_method. # token_endpoint_auth_signing_alg: HS256 + ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using + ## the 'client_secret_jwt' token_endpoint_auth_method. + # token_endpoint_auth_signing_alg: HS256 + ## The policy to require for this client; one_factor or two_factor. # authorization_policy: 'two_factor' diff --git a/docs/content/en/configuration/identity-providers/open-id-connect.md b/docs/content/en/configuration/identity-providers/open-id-connect.md index 6ac8d1249..05e550e2c 100644 --- a/docs/content/en/configuration/identity-providers/open-id-connect.md +++ b/docs/content/en/configuration/identity-providers/open-id-connect.md @@ -28,12 +28,12 @@ More information about the beta can be found in the [roadmap](../../roadmap/acti ## Configuration -{{< config-alert-example >}} +The following snippet provides a sample-configuration for the OIDC identity provider explaining each field in detail. ```yaml identity_providers: oidc: - hmac_secret: 'this_is_a_secret_abc123abc123abc' + hmac_secret: this_is_a_secret_abc123abc123abc issuer_certificate_chain: | -----BEGIN CERTIFICATE----- MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw @@ -101,54 +101,59 @@ identity_providers: 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. DO NOT USE== -----END RSA PRIVATE KEY----- - access_token_lifespan: '1h' - authorize_code_lifespan: '1m' - id_token_lifespan: '1h' - refresh_token_lifespan: '90m' + issuer_jwks: + - key_id: '' + algorithm: 'RS256' + key: | + + certificate_chain: | + + access_token_lifespan: 1h + authorize_code_lifespan: 1m + id_token_lifespan: 1h + refresh_token_lifespan: 90m enable_client_debug_messages: false - enforce_pkce: 'public_clients_only' + enforce_pkce: public_clients_only cors: endpoints: - - 'authorization' - - 'token' - - 'revocation' - - 'introspection' + - authorization + - token + - revocation + - introspection allowed_origins: - - 'https://example.com' + - https://example.com allowed_origins_from_client_redirect_uris: false clients: - - id: 'myapp' - description: 'My Application' + - id: myapp + description: My Application secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. sector_identifier: '' public: false - authorization_policy: 'two_factor' - consent_mode: 'explicit' - pre_configured_consent_duration: '1w' + authorization_policy: two_factor + consent_mode: explicit + pre_configured_consent_duration: 1w audience: [] scopes: - - 'openid' - - 'groups' - - 'email' - - 'profile' + - openid + - groups + - email + - profile redirect_uris: - - 'https://oidc.example.com:8080/oauth2/callback' + - https://oidc.example.com:8080/oauth2/callback grant_types: - - 'refresh_token' - - 'authorization_code' + - refresh_token + - authorization_code response_types: - - 'code' + - code response_modes: - - 'form_post' - - 'query' - - 'fragment' - userinfo_signing_algorithm: 'none' + - form_post + - query + - fragment + userinfo_signing_algorithm: none ``` ## Options -This section describes the individual configuration options. - ### hmac_secret {{< confkey type="string" required="yes" >}} @@ -163,23 +168,6 @@ It's __strongly recommended__ this is a [Random Alphanumeric String](../../reference/guides/generating-secure-values.md#generating-a-random-alphanumeric-string) with 64 or more characters. -### issuer_certificate_chain - -{{< confkey type="string" required="no" >}} - -The certificate chain/bundle to be used with the [issuer_private_key](#issuer_private_key) DER base64 ([RFC4648]) -encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t] -JSON key's in the JWKs [Discoverable Endpoint](../../integration/openid-connect/introduction.md#discoverable-endpoints) -as per [RFC7517]. - -[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517 -[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 -[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8 - -The first certificate in the chain must have the public key for the [issuer_private_key](#issuerprivatekey), each -certificate in the chain must be valid for the current date, and each certificate in the chain should be signed by the -certificate immediately following it if present. - ### issuer_private_key {{< confkey type="string" required="yes" >}} @@ -199,13 +187,85 @@ The private key *__MUST__*: If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public key data for the first certificate in the chain. +### issuer_certificate_chain + +{{< confkey type="string" required="no" >}} + +The certificate chain/bundle to be used with the [issuer_private_key](#issuer_private_key) DER base64 ([RFC4648]) +encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t] +JSON key's in the JWKs [Discoverable Endpoint](../../integration/openid-connect/introduction.md#discoverable-endpoints) +as per [RFC7517]. + +[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517 +[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 +[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8 + +The first certificate in the chain must have the public key for the [issuer_private_key](#issuerprivatekey), each +certificate in the chain must be valid for the current date, and each certificate in the chain should be signed by the +certificate immediately following it if present. + +### issuer_jwks + +{{< confkey type="list(object" required="no" >}} + +The list of JWKS instead of or in addition to the [issuer_private_key](#issuerprivatekey) and +[issuer_certificate_chain](#issuercertificatechain). Can also accept ECDSA Private Key's and Certificates. + +#### key_id + +{{< confkey type="string" default="" required="no" >}} + +Completely optional, and generally discouraged unless there is a collision between the automatically generated key id's. +If provided must be a unique string with 7 or less alphanumeric characters. + +This value is the first 7 characters of the public key thumbprint (SHA1) encoded into hexadecimal. + +#### algorithm + +{{< confkey type="string" required="no" >}} + +The algorithm for this key. This value must be unique. It's automatically detected based on the type of key. + +#### key + +{{< confkey type="string" required="yes" >}} + +The private key associated with this key entry. + +The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator +and can be done by following the +[Generating an RSA Keypair](../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide. + +The private key *__MUST__*: +* Be a PEM block encoded in the DER base64 format ([RFC4648]). +* Be one of: + * An RSA key with a key size of at least 2048 bits. + * An ECDSA private key with one of the P-256, P-384, or P-521 elliptical curves. + +If the [certificate_chain](#certificatechain) is provided the private key must include matching public +key data for the first certificate in the chain. + +#### certificate_chain + +{{< confkey type="string" required="no" >}} + +The certificate chain/bundle to be used with the [key](#key) DER base64 ([RFC4648]) +encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t] +JSON key's in the JWKs [Discoverable Endpoint](../../integration/openid-connect/introduction.md#discoverable-endpoints) +as per [RFC7517]. + +[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517 +[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 +[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8 + +The first certificate in the chain must have the public key for the [key](#key), each certificate in the chain must be +valid for the current date, and each certificate in the chain should be signed by the certificate immediately following +it if present. + ### access_token_lifespan {{< confkey type="duration" default="1h" required="no" >}} -*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). -Please see the [documentation](../prologue/common.md#duration) on this format for more information.* - The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default. For more information read these docs about [token lifespan]. @@ -213,9 +273,6 @@ For more information read these docs about [token lifespan]. {{< confkey type="duration" default="1m" required="no" >}} -*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). -Please see the [documentation](../prologue/common.md#duration) on this format for more information.* - The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to obtain the other token types. For more information read these docs about [token lifespan]. @@ -223,18 +280,12 @@ obtain the other token types. For more information read these docs about [token {{< confkey type="duration" default="1h" required="no" >}} -*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). -Please see the [documentation](../prologue/common.md#duration) on this format for more information.* - The maximum lifetime of an ID token. For more information read these docs about [token lifespan]. ### refresh_token_lifespan {{< confkey type="string" default="90m" required="no" >}} -*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). -Please see the [documentation](../prologue/common.md#duration) on this format for more information.* - The maximum lifetime of a refresh token. The refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an up-to-date expiration. For more information read these docs about [token lifespan]. @@ -300,9 +351,6 @@ When enabled all authorization requests must use the [Pushed Authorization Reque {{< confkey type="duration" default="5m" required="no" >}} -*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). -Please see the [documentation](../prologue/common.md#duration) on this format for more information.* - The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated `request_uri` being utilized by a client. @@ -590,8 +638,8 @@ Configures the consent mode. The following table describes the different modes: {{< confkey type="duration" default="1w" required="no" >}} -*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration). -Please see the [documentation](../prologue/common.md#duration) on this format for more information.* +*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see +the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`. diff --git a/docs/content/en/integration/openid-connect/introduction.md b/docs/content/en/integration/openid-connect/introduction.md index 043124f99..e1568acdd 100644 --- a/docs/content/en/integration/openid-connect/introduction.md +++ b/docs/content/en/integration/openid-connect/introduction.md @@ -101,6 +101,39 @@ This scope includes the profile information the authentication backend reports a | preferred_username | string | username | The username the user used to login with | | name | string | display_name | The users display name | +## Signing and Encryption Algorithms + +[OpenID Connect 1.0] and OAuth 2.0 support a wide variety of signature and encryption algorithms. Authelia supports +a subset of these. + +### Response Object + +Authelia's response objects can have the following signature algorithms: + +| Algorithm | Key Type | Hashing Algorithm | Use | JWK Default Conditions | Notes | +|:---------:|:-----------:|:-----------------:|:---------:|:--------------------------------------------:|:----------------------------------------------------:| +| RS256 | RSA | SHA-256 | Signature | RSA Private Key without a specific algorithm | Requires an RSA Private Key with 2048 bits or more | +| RS384 | RSA | SHA-384 | Signature | N/A | Requires an RSA Private Key with 2048 bits or more | +| RS512 | RSA | SHA-512 | Signature | N/A | Requires an RSA Private Key with 2048 bits or more | +| ES256 | ECDSA P-256 | SHA-256 | Signature | ECDSA Private Key with the P-256 curve | | +| ES384 | ECDSA P-384 | SHA-384 | Signature | ECDSA Private Key with the P-384 curve | | +| ES512 | ECDSA P-521 | SHA-512 | Signature | ECDSA Private Key with the P-521 curve | Requires an ECDSA Private Key with 2048 bits or more | +| PS256 | RSA (MGF1) | SHA-256 | Signature | N/A | Requires an RSA Private Key with 2048 bits or more | +| PS384 | RSA (MGF1) | SHA-384 | Signature | N/A | Requires an RSA Private Key with 2048 bits or more | +| PS512 | RSA (MGF1) | SHA-512 | Signature | N/A | Requires an RSA Private Key with 2048 bits or more | + +### Request Object + + +| Algorithm | Key Type | Hashing Algorithm | Use | Notes | +|:---------:|:------------------:|:-----------------:|:---------:|:--------------------------------------------------:| +| none | None | None | N/A | N/A | +| HS256 | HMAC Shared Secret | SHA-256 | Signature | [Client Authentication Method] `client_secret_jwt` | +| HS384 | HMAC Shared Secret | SHA-384 | Signature | [Client Authentication Method] `client_secret_jwt` | +| HS512 | HMAC Shared Secret | SHA-512 | Signature | [Client Authentication Method] `client_secret_jwt` | + +[Client Authentication Method]: #client-authentication-method + ## Parameters The following section describes advanced parameters which can be used in various endpoints as well as their related diff --git a/internal/commands/context.go b/internal/commands/context.go index 64282acb6..65b5250f1 100644 --- a/internal/commands/context.go +++ b/internal/commands/context.go @@ -162,9 +162,7 @@ func (ctx *CmdCtx) LoadProviders() (warns, errs []error) { ctx.providers.Notifier = notification.NewFileNotifier(*ctx.config.Notifier.FileSystem) } - if ctx.providers.OpenIDConnect, err = oidc.NewOpenIDConnectProvider(ctx.config.IdentityProviders.OIDC, ctx.providers.StorageProvider, ctx.providers.Templates); err != nil { - errs = append(errs, err) - } + ctx.providers.OpenIDConnect = oidc.NewOpenIDConnectProvider(ctx.config.IdentityProviders.OIDC, ctx.providers.StorageProvider, ctx.providers.Templates) if ctx.config.Telemetry.Metrics.Enabled { ctx.providers.Metrics = metrics.NewPrometheus() diff --git a/internal/commands/crypto.go b/internal/commands/crypto.go index 6df2a8e20..eb225886e 100644 --- a/internal/commands/crypto.go +++ b/internal/commands/crypto.go @@ -335,7 +335,7 @@ func (ctx *CmdCtx) CryptoCertificateRequestRunE(cmd *cobra.Command, _ []string) return err } - if err = utils.WriteCertificateBytesToPEM(csrPath, true, csr); err != nil { + if err = utils.WriteCertificateBytesAsPEMToPath(csrPath, true, csr); err != nil { return err } @@ -430,7 +430,7 @@ func (ctx *CmdCtx) CryptoCertificateGenerateRunE(cmd *cobra.Command, _ []string, return err } - if err = utils.WriteCertificateBytesToPEM(certificatePath, false, certificate); err != nil { + if err = utils.WriteCertificateBytesAsPEMToPath(certificatePath, false, certificate); err != nil { return err } diff --git a/internal/commands/crypto_helper.go b/internal/commands/crypto_helper.go index fd8f999f9..a4dc508af 100644 --- a/internal/commands/crypto_helper.go +++ b/internal/commands/crypto_helper.go @@ -198,7 +198,7 @@ func cryptoGenerateCertificateBundlesFromCmd(cmd *cobra.Command, b *strings.Buil b.WriteString(fmt.Sprintf("\tCertificate (chain): %s\n", pathPEM)) - if err = utils.WritePEM(pathPEM, blocks...); err != nil { + if err = utils.WritePEMBlocksToPath(pathPEM, blocks...); err != nil { return err } } @@ -220,7 +220,7 @@ func cryptoGenerateCertificateBundlesFromCmd(cmd *cobra.Command, b *strings.Buil b.WriteString(fmt.Sprintf("\tCertificate (priv-chain): %s\n", pathPEM)) - if err = utils.WritePEM(pathPEM, blocks...); err != nil { + if err = utils.WritePEMBlocksToPath(pathPEM, blocks...); err != nil { return err } } diff --git a/internal/configuration/config.template.yml b/internal/configuration/config.template.yml index 69270a5d0..dbeb986f3 100644 --- a/internal/configuration/config.template.yml +++ b/internal/configuration/config.template.yml @@ -1521,6 +1521,10 @@ notifier: ## the 'client_secret_jwt' token_endpoint_auth_method. # token_endpoint_auth_signing_alg: HS256 + ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using + ## the 'client_secret_jwt' token_endpoint_auth_method. + # token_endpoint_auth_signing_alg: HS256 + ## The policy to require for this client; one_factor or two_factor. # authorization_policy: 'two_factor' diff --git a/internal/configuration/decode_hooks.go b/internal/configuration/decode_hooks.go index c9d4be4f5..2bcfb614c 100644 --- a/internal/configuration/decode_hooks.go +++ b/internal/configuration/decode_hooks.go @@ -513,6 +513,30 @@ func StringToCryptoPrivateKeyHookFunc() mapstructure.DecodeHookFuncType { } } +// StringToCryptographicKeyHookFunc decodes strings to schema.CryptographicKey's. +func StringToCryptographicKeyHookFunc() mapstructure.DecodeHookFuncType { + return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { + if f.Kind() != reflect.String { + return data, nil + } + + field, _ := reflect.TypeOf(schema.JWK{}).FieldByName("Key") + expectedType := field.Type + + if t != expectedType { + return data, nil + } + + dataStr := data.(string) + + if value, err = utils.ParseX509FromPEM([]byte(dataStr)); err != nil { + return nil, fmt.Errorf(errFmtDecodeHookCouldNotParseBasic, "", expectedType, err) + } + + return value, nil + } +} + // StringToPrivateKeyHookFunc decodes strings to rsa.PrivateKey's. func StringToPrivateKeyHookFunc() mapstructure.DecodeHookFuncType { return func(f reflect.Type, t reflect.Type, data any) (value any, err error) { diff --git a/internal/configuration/koanf_callbacks_test.go b/internal/configuration/koanf_callbacks_test.go index 039f18637..5ea5ec914 100644 --- a/internal/configuration/koanf_callbacks_test.go +++ b/internal/configuration/koanf_callbacks_test.go @@ -21,6 +21,7 @@ func TestKoanfEnvironmentCallback(t *testing.T) { keyMap := map[string]string{ DefaultEnvPrefix + "KEY_EXAMPLE_UNDERSCORE": "key.example_underscore", } + ignoredKeys := []string{DefaultEnvPrefix + "SOME_SECRET"} callback := koanfEnvironmentCallback(keyMap, ignoredKeys, DefaultEnvPrefix, DefaultEnvDelimiter) diff --git a/internal/configuration/provider.go b/internal/configuration/provider.go index cd3294972..b6dcaffff 100644 --- a/internal/configuration/provider.go +++ b/internal/configuration/provider.go @@ -65,6 +65,7 @@ func unmarshal(ko *koanf.Koanf, val *schema.StructValidator, path string, o any) StringToX509CertificateChainHookFunc(), StringToPrivateKeyHookFunc(), StringToCryptoPrivateKeyHookFunc(), + StringToCryptographicKeyHookFunc(), StringToTLSVersionHookFunc(), StringToPasswordDigestHookFunc(), ToTimeDurationHookFunc(), diff --git a/internal/configuration/provider_test.go b/internal/configuration/provider_test.go index 27f363d4f..bae07d5d5 100644 --- a/internal/configuration/provider_test.go +++ b/internal/configuration/provider_test.go @@ -245,6 +245,37 @@ func TestShouldLoadURLList(t *testing.T) { assert.Equal(t, "https://example.com", config.IdentityProviders.OIDC.CORS.AllowedOrigins[1].String()) } +/* +func TestShouldLoadNewOIDCConfig(t *testing.T) { + val := schema.NewStructValidator() + _, config, err := Load(val, NewDefaultSources([]string{"./test_resources/config_oidc_modern.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) + + assert.NoError(t, err) + + assert.Len(t, val.Errors(), 0) + assert.Len(t, val.Warnings(), 0) + + val.Clear() + + validator.ValidateIdentityProviders(&config.IdentityProviders, val) + + assert.Len(t, val.Errors(), 0) + + assert.Len(t, config.IdentityProviders.OIDC.IssuerJWKS.Keys, 2) + assert.Equal(t, "keya", config.IdentityProviders.OIDC.IssuerJWKS.DefaultKeyID) + + assert.Equal(t, oidc.KeyUseSignature, config.IdentityProviders.OIDC.IssuerJWKS.Keys["keya"].Use) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, config.IdentityProviders.OIDC.IssuerJWKS.Keys["keya"].Algorithm) + + assert.Equal(t, oidc.KeyUseSignature, config.IdentityProviders.OIDC.IssuerJWKS.Keys["ec521"].Use) + assert.Equal(t, oidc.SigningAlgECDSAUsingP521AndSHA512, config.IdentityProviders.OIDC.IssuerJWKS.Keys["ec521"].Algorithm) + + assert.Contains(t, config.IdentityProviders.OIDC.Discovery.RegisteredJWKSigningAlgs, oidc.SigningAlgRSAUsingSHA256) + assert.Contains(t, config.IdentityProviders.OIDC.Discovery.RegisteredJWKSigningAlgs, oidc.SigningAlgECDSAUsingP521AndSHA512) +}. + +*/ + func TestShouldConfigureConsent(t *testing.T) { val := schema.NewStructValidator() keys, config, err := Load(val, NewDefaultSources([]string{"./test_resources/config_oidc.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) diff --git a/internal/configuration/schema/identity_providers.go b/internal/configuration/schema/identity_providers.go index a89f923ad..e3713718e 100644 --- a/internal/configuration/schema/identity_providers.go +++ b/internal/configuration/schema/identity_providers.go @@ -17,6 +17,8 @@ type OpenIDConnectConfiguration struct { IssuerCertificateChain X509CertificateChain `koanf:"issuer_certificate_chain"` IssuerPrivateKey *rsa.PrivateKey `koanf:"issuer_private_key"` + IssuerJWKS []JWK `koanf:"issuer_jwks"` + AccessTokenLifespan time.Duration `koanf:"access_token_lifespan"` AuthorizeCodeLifespan time.Duration `koanf:"authorize_code_lifespan"` IDTokenLifespan time.Duration `koanf:"id_token_lifespan"` @@ -32,6 +34,13 @@ type OpenIDConnectConfiguration struct { PAR OpenIDConnectPARConfiguration `koanf:"pushed_authorizations"` Clients []OpenIDConnectClientConfiguration `koanf:"clients"` + + Discovery OpenIDConnectDiscovery // MetaData value. Not configurable by users. +} + +type OpenIDConnectDiscovery struct { + DefaultKeyID string + RegisteredJWKSigningAlgs []string } // OpenIDConnectPARConfiguration represents an OpenID Connect PAR config. @@ -67,13 +76,15 @@ type OpenIDConnectClientConfiguration struct { TokenEndpointAuthMethod string `koanf:"token_endpoint_auth_method"` TokenEndpointAuthSigningAlg string `koanf:"token_endpoint_auth_signing_alg"` + IDTokenSigningAlg string `koanf:"id_token_signing_alg"` + Policy string `koanf:"authorization_policy"` EnforcePAR bool `koanf:"enforce_par"` EnforcePKCE bool `koanf:"enforce_pkce"` - PKCEChallengeMethod string `koanf:"pkce_challenge_method"` - UserinfoSigningAlgorithm string `koanf:"userinfo_signing_algorithm"` + PKCEChallengeMethod string `koanf:"pkce_challenge_method"` + UserinfoSigningAlg string `koanf:"userinfo_signing_algorithm"` ConsentMode string `koanf:"consent_mode"` ConsentPreConfiguredDuration *time.Duration `koanf:"pre_configured_consent_duration"` @@ -97,7 +108,8 @@ var DefaultOpenIDConnectClientConfiguration = OpenIDConnectClientConfiguration{ ResponseTypes: []string{"code"}, ResponseModes: []string{"form_post"}, - UserinfoSigningAlgorithm: "none", + IDTokenSigningAlg: "RS256", + UserinfoSigningAlg: "none", ConsentMode: "auto", ConsentPreConfiguredDuration: &defaultOIDCClientConsentPreConfiguredDuration, } diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go index ec7947e1a..1473226c0 100644 --- a/internal/configuration/schema/keys.go +++ b/internal/configuration/schema/keys.go @@ -20,6 +20,12 @@ var Keys = []string{ "identity_providers.oidc.hmac_secret", "identity_providers.oidc.issuer_certificate_chain", "identity_providers.oidc.issuer_private_key", + "identity_providers.oidc.issuer_jwks", + "identity_providers.oidc.issuer_jwks[].key_id", + "identity_providers.oidc.issuer_jwks[]", + "identity_providers.oidc.issuer_jwks[].algorithm", + "identity_providers.oidc.issuer_jwks[].key", + "identity_providers.oidc.issuer_jwks[].certificate_chain", "identity_providers.oidc.access_token_lifespan", "identity_providers.oidc.authorize_code_lifespan", "identity_providers.oidc.id_token_lifespan", @@ -47,6 +53,7 @@ var Keys = []string{ "identity_providers.oidc.clients[].response_modes", "identity_providers.oidc.clients[].token_endpoint_auth_method", "identity_providers.oidc.clients[].token_endpoint_auth_signing_alg", + "identity_providers.oidc.clients[].id_token_signing_alg", "identity_providers.oidc.clients[].authorization_policy", "identity_providers.oidc.clients[].enforce_par", "identity_providers.oidc.clients[].enforce_pkce", @@ -54,6 +61,7 @@ var Keys = []string{ "identity_providers.oidc.clients[].userinfo_signing_algorithm", "identity_providers.oidc.clients[].consent_mode", "identity_providers.oidc.clients[].pre_configured_consent_duration", + "identity_providers.oidc", "authentication_backend.password_reset.disable", "authentication_backend.password_reset.custom_url", "authentication_backend.refresh_interval", diff --git a/internal/configuration/schema/shared.go b/internal/configuration/schema/shared.go index 13d56b037..d244b13a7 100644 --- a/internal/configuration/schema/shared.go +++ b/internal/configuration/schema/shared.go @@ -34,3 +34,12 @@ type ServerBuffers struct { Read int `koanf:"read"` Write int `koanf:"write"` } + +// JWK represents a JWK. +type JWK struct { + KeyID string `koanf:"key_id"` + Use string + Algorithm string `koanf:"algorithm"` + Key CryptographicKey `koanf:"key"` + CertificateChain X509CertificateChain `koanf:"certificate_chain"` +} diff --git a/internal/configuration/schema/types.go b/internal/configuration/schema/types.go index bc5bd988c..6a938d781 100644 --- a/internal/configuration/schema/types.go +++ b/internal/configuration/schema/types.go @@ -1,6 +1,7 @@ package schema import ( + "bytes" "crypto" "crypto/ecdsa" "crypto/ed25519" @@ -101,6 +102,10 @@ func NewX509CertificateChain(in string) (chain *X509CertificateChain, err error) return chain, nil } +func NewX509CertificateChainFromCerts(in []*x509.Certificate) (chain X509CertificateChain) { + return X509CertificateChain{certs: in} +} + // NewTLSVersion returns a new TLSVersion given a string. func NewTLSVersion(input string) (version *TLSVersion, err error) { switch strings.ReplaceAll(strings.ToUpper(input), " ", "") { @@ -166,6 +171,9 @@ type CryptographicPrivateKey interface { Equal(x crypto.PrivateKey) bool } +// CryptographicKey represents an artificial cryptographic public or private key. +type CryptographicKey any + // X509CertificateChain is a helper struct that holds a list of *x509.Certificate's. type X509CertificateChain struct { certs []*x509.Certificate @@ -277,6 +285,24 @@ func (c *X509CertificateChain) Leaf() (leaf *x509.Certificate) { return c.certs[0] } +// EncodePEM encodes the entire chain as PEM bytes. +func (c *X509CertificateChain) EncodePEM() (encoded []byte, err error) { + buf := &bytes.Buffer{} + + for _, cert := range c.certs { + block := pem.Block{ + Type: blockCERTIFICATE, + Bytes: cert.Raw, + } + + if err = pem.Encode(buf, &block); err != nil { + return nil, err + } + } + + return buf.Bytes(), nil +} + // Validate the X509CertificateChain ensuring the certificates were provided in the correct order // (with nth being signed by the nth+1), and that all of the certificates are valid based on the current time. func (c *X509CertificateChain) Validate() (err error) { diff --git a/internal/configuration/test_resources/config_oidc_modern.yml b/internal/configuration/test_resources/config_oidc_modern.yml new file mode 100644 index 000000000..be63faba5 --- /dev/null +++ b/internal/configuration/test_resources/config_oidc_modern.yml @@ -0,0 +1,211 @@ +--- +default_redirection_url: https://home.example.com:8080/ + +server: + host: 127.0.0.1 + port: 9091 + +log: + level: debug + +totp: + issuer: authelia.com + +duo_api: + hostname: api-123456789.example.com + integration_key: ABCDEF + +authentication_backend: + ldap: + url: ldap://127.0.0.1 + base_dn: dc=example,dc=com + username_attribute: uid + additional_users_dn: ou=users + users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + additional_groups_dn: ou=groups + groups_filter: (&(member={dn})(objectClass=groupOfNames)) + group_name_attribute: cn + mail_attribute: mail + user: cn=admin,dc=example,dc=com + +access_control: + default_policy: deny + + rules: + # Rules applied to everyone + - domain: public.example.com + policy: bypass + + - domain: secure.example.com + policy: one_factor + # Network based rule, if not provided any network matches. + networks: + - 192.168.1.0/24 + - domain: secure.example.com + policy: two_factor + + - domain: [singlefactor.example.com, onefactor.example.com] + policy: one_factor + + # Rules applied to 'admins' group + - domain: "mx2.mail.example.com" + subject: "group:admins" + policy: deny + - domain: "*.example.com" + subject: "group:admins" + policy: two_factor + + # Rules applied to 'dev' group + - domain: dev.example.com + resources: + - "^/groups/dev/.*$" + subject: "group:dev" + policy: two_factor + + # Rules applied to user 'john' + - domain: dev.example.com + resources: + - "^/users/john/.*$" + subject: "user:john" + policy: two_factor + + # Rules applied to 'dev' group and user 'john' + - domain: dev.example.com + resources: + - "^/deny-all.*$" + subject: ["group:dev", "user:john"] + policy: deny + + # Rules applied to user 'harry' + - domain: dev.example.com + resources: + - "^/users/harry/.*$" + subject: "user:harry" + policy: two_factor + + # Rules applied to user 'bob' + - domain: "*.mail.example.com" + subject: "user:bob" + policy: two_factor + - domain: "dev.example.com" + resources: + - "^/users/bob/.*$" + subject: "user:bob" + policy: two_factor + +session: + name: authelia_session + expiration: 3600000 # 1 hour + inactivity: 300000 # 5 minutes + domain: example.com + redis: + host: 127.0.0.1 + port: 6379 + high_availability: + sentinel_name: test + +regulation: + max_retries: 3 + find_time: 120 + ban_time: 300 + +storage: + mysql: + host: 127.0.0.1 + port: 3306 + database: authelia + username: authelia + +notifier: + smtp: + username: test + host: 127.0.0.1 + port: 1025 + sender: admin@example.com + disable_require_tls: true + +identity_providers: + oidc: + hmac_secret: 1nb2j3kh1b23kjh1b23jh1b23j1h2b3 + issuer_jwks: + keys: + keya: + key: | + -----BEGIN RSA PRIVATE KEY----- + MIIEpQIBAAKCAQEAs5BZdREjkceDvty5c+qBski4XXiMubVyGFLazoNumhMbgjA7 + DoCLglCrIRcYd4Wn4CEe4KJzghIdfijDCIQ6V+wrm/KR3iMvBdkPYVC7vGXYY5kx + WtAT5qejuxKXHQK2/jWSO6tOxFRGxA/nE4A9cm8FH6/lfz05ci1h63gAOVQpkvcj + JMHlGqTHt93HOTBVFQpi9zpTdDKQx3yq4ttfh49vUwWBsXe640Y+soaGjTMJS8IT + kGktwOxwRfGJ1PRHVF9FnRm7nhf53hFat/k3mbbyV8rnlmVLPqZ+KIqH5/rjYh3K + Rr71WAptFnHtoiT2SNfwDh+8iqo3QlWtW24iAwIDAQABAoIBAQCLKVkbMEA3z79b + 4SZdHqaLbG5uCmpN1sBo93WaTSQfhqVwHT73u0njoe8ugv60SsJTIngSsfQBH1b6 + Gk8kv42T7HXTs4e299+Oka2oxu/oT6oHbodgkRiLTurGpd61XhBCLXR6iAZQg9wg + QQ7d/yogEMiQyTp8hQ+LXH6iBetugW0l0Uz2pbJNi4c4qqXm5BYoQaJ0RjqQI5C5 + 5ZPiX/1yn3bWbJRhSK5FfnEdO/3LclfQMvMOaipH4CXOjYcFSxVP1vVL6Jli92+j + tVApsnSZiEZ3kB4jRqDZnV9xQhfTXVyfopCNL1a3LkbE171GStd5eib7ESydTik7 + DhFqTdpZAoGBAOgEPAmFKi9z40umcN27+dd6CAXfjy2dqkuM8hGshQiGnH9bAAl+ + hhr3u5AvbxZ/qsD0KAAEReD3cY0OFTPfl2qD0nsleqUt6N6gM+j6596jVNnOlW9A + 0y0Lssobh8DrvXoDTBCL1wdcQXknoyUm8lkpVhSm6PmLFAS2lnBFJBJvAoGBAMYg + FGeSQ0kRWmmVnfibcHqHerD5FK6AvciYg/ycjKUA9Fde0gon1v/M1TWAhT6mqjjv + uSX2c3eEpzAjoJxd5bPgxfEWIM6ygn1N5fka1re5d5pHOAMJB9AAz3A3PZJP8ANt + ES51dO0rYAuKdBuza9eSyj9/JPDh7QdE47ZvP6OtAoGBAI4aAddm2uaDWOP9hcUY + mzXRBNbsDJpIpYNuSNhwTG5jW7hYuNYXyvT7Y8I0expRiPhy0YjpFQ9rHf3hcTT7 + LZbMM/6+frZqPuUTQ5ffDGJ8sLxR3Y5tKqm9L3y/jc6n073GBTFhJIragzM8Bpz7 + lJTtT06Ix8oG13Tni44pmqU7AoGBAJPS56aHSNDBs9XHnkAZqgiiAPb+QWIaCIAc + 242lOIL8fVKbGtgc9ZuSNxpeNAyUybkFk/0xLuHkBeIzEujYXkSh1s6UlhHiut3H + O2lrjv0x0n032iDZogyeLigp7zS1k/zaadFiLcWvcU/rE8p/Sl1j1qcdtHBOAU5F + Jim+Q5tZAoGAbNaUs05FPastfdmZCp5Pj1sbnRZdwUZH1AeZuhuSfbS6aA/wB3VA + i/LTu4Z3iR0M0p8HeNy/YBKl0MrRc0nE/UkV66kOQH3az/N39i2KsTBzMsvlByWd + ofwOgCjgkIviNDIXikLBEWZFwr/4mQkN91YoFY37pteS3sVYQpVbQeA= + -----END RSA PRIVATE KEY----- + certificate_chain: | + -----BEGIN CERTIFICATE----- + MIIC5jCCAc6gAwIBAgIRAMMH7qhte0VDXdnbHMy43dUwDQYJKoZIhvcNAQELBQAw + EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNMjMwNDE2MTEyMjU0WhcNMjQwNDE1MTEy + MjU0WjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP + ADCCAQoCggEBALOQWXURI5HHg77cuXPqgbJIuF14jLm1chhS2s6DbpoTG4IwOw6A + i4JQqyEXGHeFp+AhHuCic4ISHX4owwiEOlfsK5vykd4jLwXZD2FQu7xl2GOZMVrQ + E+ano7sSlx0Ctv41kjurTsRURsQP5xOAPXJvBR+v5X89OXItYet4ADlUKZL3IyTB + 5Rqkx7fdxzkwVRUKYvc6U3QykMd8quLbX4ePb1MFgbF3uuNGPrKGho0zCUvCE5Bp + LcDscEXxidT0R1RfRZ0Zu54X+d4RWrf5N5m28lfK55ZlSz6mfiiKh+f642Idyka+ + 9VgKbRZx7aIk9kjX8A4fvIqqN0JVrVtuIgMCAwEAAaM1MDMwDgYDVR0PAQH/BAQD + AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN + AQELBQADggEBAKT2CQNx/JlutnsMHYBoOLfr8Vpz3/PTx0rAgxptgp1CDkTBxIah + 7rmGuHX0qDKbqINr4DmFhkKeIPSMux11xzW6MW83ZN8WZCTkAiPPIGTNGWccJONl + lpX5dIPdpXGoXA7T31Gto3FPmsgxQ2jK/mpok20J6EFkkpUuXxSxjwO1zd56iMxQ + FuSLo8J/uI/T4aj7Wrk6fFI5z7gjP8BjVFAsYkTYUhkLatnbuQstx+R2p7hjv50G + weBOw5YW8JWLRRJ2A5FBJsZekiNdpIa+CmH7v0SICAHaTKdR3RVgQfa8zvbzW/d8 + qXsSjjBkmEkKUFoFi/fxTQuqseQC0h+P5N8= + -----END CERTIFICATE----- + ec521: + key: | + -----BEGIN EC PRIVATE KEY----- + MIHcAgEBBEIA5s1+7OZClSDG3Ro7FFJjR2J6cBFimlR/sNcZ4ljFjDaef4vNw2DU + Eq1x5gkj888I1/BXV+/KVc+dtYDGKeGSxvagBwYFK4EEACOhgYkDgYYABADXFb5h + KymYeOH8Em1VJvOsc9mUi6Gr0AAiseu5G0HofN+GzxD7GBDAE9plkRhd8QfmuwZy + S0rUlTXhvZMARuujnABxJ7FnPp81osndv/vk9ujUTZsK0UPaLJ189NuR6VwImUQK + c/xWqI9AC99VchRw6fw7smpn6lCmVkHNRJFL1Bs4iA== + -----END EC PRIVATE KEY----- + certificate_chain: | + -----BEGIN CERTIFICATE----- + MIIB4jCCAUOgAwIBAgIRAKhDsoaXc69n4uH0CB31XfswCgYIKoZIzj0EAwIwEzER + MA8GA1UEChMIQXV0aGVsaWEwHhcNMjMwNDE2MTEyMTQxWhcNMjQwNDE1MTEyMTQx + WjATMREwDwYDVQQKEwhBdXRoZWxpYTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAE + ANcVvmErKZh44fwSbVUm86xz2ZSLoavQACKx67kbQeh834bPEPsYEMAT2mWRGF3x + B+a7BnJLStSVNeG9kwBG66OcAHEnsWc+nzWiyd2/++T26NRNmwrRQ9osnXz025Hp + XAiZRApz/Faoj0AL31VyFHDp/DuyamfqUKZWQc1EkUvUGziIozUwMzAOBgNVHQ8B + Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAKBggq + hkjOPQQDAgOBjAAwgYgCQgCBXWYXKn7aANz5JC8sXLJSOkNMF6vbd/T96KoLSBT+ + +l6KKwKg5evolAKync1ksGAzNidFKqjhwG4BZj10YnowPQJCAWjb/3KeRN1RmGOc + abG/6Y0USqC3LUb/ZrtVwRYvQYZYi1R7OJx7cTJcVy1yBwfJa5IcPJwjEiQI3CXV + 3AGOvhz+ + -----END CERTIFICATE----- + cors: + allowed_origins: + - https://google.com + - https://example.com + clients: + - id: abc + secret: '123' + consent_mode: explicit +... diff --git a/internal/configuration/test_resources/crypto/ECDSA_P224.crt b/internal/configuration/test_resources/crypto/ECDSA_P224.crt new file mode 100644 index 000000000..42baa6c8a --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P224.crt @@ -0,0 +1,9 @@ +-----BEGIN CERTIFICATE----- +MIIBRzCB9qADAgECAhB51uvUDHkaxlSEs8cgoYBRMAoGCCqGSM49BAMCMBMxETAP +BgNVBAoTCEF1dGhlbGlhMCAXDTIzMDQxNzEzMTIwMloYDzIxMDAwMTAxMDAwMDAw +WjATMREwDwYDVQQKEwhBdXRoZWxpYTBOMBAGByqGSM49AgEGBSuBBAAhAzoABJa4 +oEFZqEbmsnKWXEfNWTiqyEq6YiWbVFIH/PGijaRmsYpKC2UBGsscN4DziAUHBlqX +KLA/lsRjozUwMzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw +DAYDVR0TAQH/BAIwADAKBggqhkjOPQQDAgNAADA9Ah0Aq03epx31NN1fTorB/rrz +Muu9Taw8YxaZxvjLaQIcbNHGY5bFYxi04ahvN1rYi2sJEn66SaWut+lBIw== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P224.pem b/internal/configuration/test_resources/crypto/ECDSA_P224.pem new file mode 100644 index 000000000..4f6ee7d08 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P224.pem @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MGgCAQEEHM0126u3fW5scirH39HU9FgPTZOHPxg2NgbSQQ+gBwYFK4EEACGhPAM6 +AASWuKBBWahG5rJyllxHzVk4qshKumIlm1RSB/zxoo2kZrGKSgtlARrLHDeA84gF +BwZalyiwP5bEYw== +-----END EC PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P256.crt b/internal/configuration/test_resources/crypto/ECDSA_P256.crt new file mode 100644 index 000000000..2f0748e0a --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P256.crt @@ -0,0 +1,10 @@ +-----BEGIN CERTIFICATE----- +MIIBWzCCAQKgAwIBAgIRANqK3vKflYMr/2HGVd3aOR0wCgYIKoZIzj0EAwIwEzER +MA8GA1UEChMIQXV0aGVsaWEwIBcNMjMwNDE3MTMxNjI5WhgPMjEwMDAxMDEwMDAw +MDBaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD +QgAEnnBdDSXbTgHtrc5vcJ2xz6qyGXM8PJgENjgQgn5WFVQCSZnKp08+mzeDiHrM +67KmISfxSAjoeCJV+dP6JfxIVqM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQM +MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwCgYIKoZIzj0EAwIDRwAwRAIgOo+m +1yQsTmqOaKak9MY2q7CdBI9Di8vPK/sE/x5JIPYCIA/lyI/sG1EEdLT8g3M4Joc3 +VK7cBHjmftnZL6kiS+Dn +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P256.pem b/internal/configuration/test_resources/crypto/ECDSA_P256.pem new file mode 100644 index 000000000..04eae9328 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P256.pem @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIHL87FDsqijXFhRJ5VgYiOz2ko6xxP7aP7i4v3Eowf4KoAoGCCqGSM49 +AwEHoUQDQgAEnnBdDSXbTgHtrc5vcJ2xz6qyGXM8PJgENjgQgn5WFVQCSZnKp08+ +mzeDiHrM67KmISfxSAjoeCJV+dP6JfxIVg== +-----END EC PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.crt b/internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.crt new file mode 100644 index 000000000..5e806c256 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.crt @@ -0,0 +1,10 @@ +-----BEGIN CERTIFICATE----- +MIIBXTCCAQKgAwIBAgIRAPtITpvhty9gwPvrPO1J8GYwCgYIKoZIzj0EAwIwEzER +MA8GA1UEChMIQXV0aGVsaWEwIBcNMjMwNDE4MDU0NTM5WhgPMjEwMDAxMDEwMDAw +MDBaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD +QgAEW3aPMQmzoU84DWr4UbbH8tWPMCuzLC44450JvNa8ChDto0ST+koT1Xtq75cu +JSAlxn3QeMWZ0pjlvt/woj4Y/qM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQM +MAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwCgYIKoZIzj0EAwIDSQAwRgIhAOI6 +pgq2zjf5wr1bW21HXsUmwrbyfiCz5vSlAk76QgkRAiEA7Txu5kjdEhnFUw3ORQIF +enG1sLX3iZOljfTsHTG1kug= +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.pem b/internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.pem new file mode 100644 index 000000000..f52702212 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P256_PKCS8.pem @@ -0,0 +1,5 @@ +-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgKwZ0IZaf/E54bRh6 +b9AEwZJ368O9uoJaJ4tloCjWuDOhRANCAARbdo8xCbOhTzgNavhRtsfy1Y8wK7Ms +LjjjnQm81rwKEO2jRJP6ShPVe2rvly4lICXGfdB4xZnSmOW+3/CiPhj+ +-----END PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P384.crt b/internal/configuration/test_resources/crypto/ECDSA_P384.crt new file mode 100644 index 000000000..c34b14c83 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P384.crt @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBmDCCAR6gAwIBAgIQWFgOoTSBNa4F1A+Uk5fBhTAKBggqhkjOPQQDAjATMREw +DwYDVQQKEwhBdXRoZWxpYTAgFw0yMzA0MTcxMzE1MDBaGA8yMTAwMDEwMTAwMDAw +MFowEzERMA8GA1UEChMIQXV0aGVsaWEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARq +Fk2dSauZd2mW0ZXuxZ0k2a5PInZOs3wbzjJr67RPzmPMNGt5dVHtbOTLr9MAcm21 +E6/4CLQZ+wMq4Zxuhoa02VN4lQBFOzWFPwVTa0lcOUCkJ7E7JWXiZjX80ROyqDOj +NTAzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMB +Af8EAjAAMAoGCCqGSM49BAMCA2gAMGUCMQCJHEN22ouKJr0usue9/bUsJltPrgSW +v7NjjQ9hY96JAwBQpTxX6EksQdnl44Q/LLACMHBZn3weWvq8frMOAmAvOomMsnMp +H7tweTJNXh4V8XdtR2GGxAAYbq/ShyxrpQ6LVA== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P384.pem b/internal/configuration/test_resources/crypto/ECDSA_P384.pem new file mode 100644 index 000000000..cecf7b648 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P384.pem @@ -0,0 +1,6 @@ +-----BEGIN EC PRIVATE KEY----- +MIGkAgEBBDBd2neGG9Ax14sDR0V0TYSXIBxNWZwYr7OAFd57MRUZ/+BkHvQEMOoV +umd/tOgGjEagBwYFK4EEACKhZANiAARqFk2dSauZd2mW0ZXuxZ0k2a5PInZOs3wb +zjJr67RPzmPMNGt5dVHtbOTLr9MAcm21E6/4CLQZ+wMq4Zxuhoa02VN4lQBFOzWF +PwVTa0lcOUCkJ7E7JWXiZjX80ROyqDM= +-----END EC PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.crt b/internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.crt new file mode 100644 index 000000000..8b5ddeafa --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.crt @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBmDCCAR6gAwIBAgIQfhi2ThPJEF21jbDOB9z24TAKBggqhkjOPQQDAjATMREw +DwYDVQQKEwhBdXRoZWxpYTAgFw0yMzA0MTgwNTQ0NTRaGA8yMTAwMDEwMTAwMDAw +MFowEzERMA8GA1UEChMIQXV0aGVsaWEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATV +Q1Vm2hMPPv0zUA9+jphIUa4pxviHz0wrk2GlpwBvzP/tbF1aRY7MRH+8d/JIKF7p +9wuVfOYB0mE7/fpzI33baVb8Js35IRax8EIRxsDvVevE5kcheddIGIyJ0FC3yNyj +NTAzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMB +Af8EAjAAMAoGCCqGSM49BAMCA2gAMGUCMQCT6hC9cNxVkvJb1ddNOg1E4TUg3veD +pnLvWm9iifH5dbep1Vk8idK8XvKyKfyM5F8CMF7MTdv21GjKF3Fl01zORgE9cxlo +zLNWQbB/rLpgGRkB2Emd/dCZUQwgD9iDd2eifQ== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.pem b/internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.pem new file mode 100644 index 000000000..7e0e43db6 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P384_PKCS8.pem @@ -0,0 +1,6 @@ +-----BEGIN PRIVATE KEY----- +MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDQSUy5MggN3tt+A4RV +lCcLGFICUBO27VexEuZuY75e+xYRUeDISXSlnqwQVa42Qk+hZANiAATVQ1Vm2hMP +Pv0zUA9+jphIUa4pxviHz0wrk2GlpwBvzP/tbF1aRY7MRH+8d/JIKF7p9wuVfOYB +0mE7/fpzI33baVb8Js35IRax8EIRxsDvVevE5kcheddIGIyJ0FC3yNw= +-----END PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P521.crt b/internal/configuration/test_resources/crypto/ECDSA_P521.crt new file mode 100644 index 000000000..cdb6e4fe2 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P521.crt @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB5DCCAUWgAwIBAgIRAIpQUsZLrSAJ7+PY4U0MIaYwCgYIKoZIzj0EAwIwEzER +MA8GA1UEChMIQXV0aGVsaWEwIBcNMjMwNDE3MTMxNTM2WhgPMjEwMDAxMDEwMDAw +MDBaMBMxETAPBgNVBAoTCEF1dGhlbGlhMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG +AAQAO8GuJvWACDYuO1ZhMdbrINK8AM8B2xFn5nSvAHAgYolyXz8yxLjmFT1/ifQZ +QjnocX4j/zOGIt1f1OXQvPSRaiQAzWlFIejCKChBK0hiDqfTyzDgrJGiCobL1bgr +yxO3oDg70YeN3mr0OkMvdrIBjpGpGkt5AX6XyaIau9ogZJz6gyOjNTAzMA4GA1Ud +DwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMAoG +CCqGSM49BAMCA4GMADCBiAJCAKaUek+/zGw7Tt3L5rqQhXFzWI4mfci+jD99/JHY +UT/FX2Co/tjEcyty46mMWsw6E7q6XCJ6gx38SCWe7wRdMXQMAkIA6rlkntqo6r+j +PoTtPVmbkFFc5ficw+xlmhuKblKrq+u8sbnm+J62C8pXuzSc8dtKEe0+oORD5HH9 +YGuoIKNL2vg= +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P521.pem b/internal/configuration/test_resources/crypto/ECDSA_P521.pem new file mode 100644 index 000000000..ca28662dc --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P521.pem @@ -0,0 +1,7 @@ +-----BEGIN EC PRIVATE KEY----- +MIHcAgEBBEIAe0mKO82UiFUDM3M3CgyEKkXuXnt0m2DAnW3Yf2nadim00n/XsGw7 ++ID6Zz5Xhazpx7WFNNhtrjbNQOKbsQNndPugBwYFK4EEACOhgYkDgYYABAA7wa4m +9YAINi47VmEx1usg0rwAzwHbEWfmdK8AcCBiiXJfPzLEuOYVPX+J9BlCOehxfiP/ +M4Yi3V/U5dC89JFqJADNaUUh6MIoKEErSGIOp9PLMOCskaIKhsvVuCvLE7egODvR +h43eavQ6Qy92sgGOkakaS3kBfpfJohq72iBknPqDIw== +-----END EC PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.crt b/internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.crt new file mode 100644 index 000000000..64591376c --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.crt @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB4zCCAUSgAwIBAgIQLyw4qjgh0+UtQ4W4Apd+7zAKBggqhkjOPQQDAjATMREw +DwYDVQQKEwhBdXRoZWxpYTAgFw0yMzA0MTgwNTM4NTdaGA8yMTAwMDEwMTAwMDAw +MFowEzERMA8GA1UEChMIQXV0aGVsaWEwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYA +BABUNIHCT8zGTz/gYHp5vA5DvYr1CbUuncCF2uP+Yoy56p06hD4oQKgo9K9gK03q +DCZTs0rAamxgO+PgZW3D1VZlDQAehJniclY/0Fpsc+qMrfZ5O269fTvwutUR7L/S +LXifAaW8lHcwYjgpEsaPdZUyxzKZW//usTrCHhkwSy7LXZzQ56M1MDMwDgYDVR0P +AQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwCgYI +KoZIzj0EAwIDgYwAMIGIAkIBznnm//FcYd+WRw19hRvyC9XCjmHW+M11B3kqpApv +iHueaoBIPvSZueS9fjjsNZG8qpLRVgWfVVPV8+L01z9DWrUCQgD/0sIlL4Cf5W4L +JasSbXARkm+jBj+QH5ZKA0hgpoL32I98TIEUATWSBvygXigHaD7ZEZEbxLyCL32a +uL3TmO+2wA== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.pem b/internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.pem new file mode 100644 index 000000000..abc4a567b --- /dev/null +++ b/internal/configuration/test_resources/crypto/ECDSA_P521_PKCS8.pem @@ -0,0 +1,8 @@ +-----BEGIN PRIVATE KEY----- +MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIB1bhgd0P7DBnlzyL3 +S2YcOXhRxq4KkcTcw3zEX+jn6XG2cyh16u9gLv9PJ6fHLVdFHQxrVGC6/fxH9p9S +B6B57/OhgYkDgYYABABUNIHCT8zGTz/gYHp5vA5DvYr1CbUuncCF2uP+Yoy56p06 +hD4oQKgo9K9gK03qDCZTs0rAamxgO+PgZW3D1VZlDQAehJniclY/0Fpsc+qMrfZ5 +O269fTvwutUR7L/SLXifAaW8lHcwYjgpEsaPdZUyxzKZW//usTrCHhkwSy7LXZzQ +5w== +-----END PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/ED25519_PKCS8.crt b/internal/configuration/test_resources/crypto/ED25519_PKCS8.crt new file mode 100644 index 000000000..a636982f1 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ED25519_PKCS8.crt @@ -0,0 +1,8 @@ +-----BEGIN CERTIFICATE----- +MIIBGjCBzaADAgECAhAiL/zLZb4EevlhMjiuV5DZMAUGAytlcDATMREwDwYDVQQK +EwhBdXRoZWxpYTAgFw0yMzA0MTgwNTQ4NDNaGA8yMTAwMDEwMTAwMDAwMFowEzER +MA8GA1UEChMIQXV0aGVsaWEwKjAFBgMrZXADIQBjrmjS0+DbAzaJWN+8USL8V1qU +smG9mWH96wuA6NPA4aM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsG +AQUFBwMBMAwGA1UdEwEB/wQCMAAwBQYDK2VwA0EAMuUxDvbVjJwCYhal6H1pZxOh +lJd16Aj4C7j7qHLwmWWwREkCoLK/Su1b3982OuCWrOMYMxEx4yNdwsnrKpNTBg== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/ED25519_PKCS8.pem b/internal/configuration/test_resources/crypto/ED25519_PKCS8.pem new file mode 100644 index 000000000..38a7a17b4 --- /dev/null +++ b/internal/configuration/test_resources/crypto/ED25519_PKCS8.pem @@ -0,0 +1,3 @@ +-----BEGIN PRIVATE KEY----- +MC4CAQAwBQYDK2VwBCIEIG1eby8XtRD2+eZMPFi2jvztZbBSr3wcYEeEl6Sj8k6N +-----END PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/RSA_1024.crt b/internal/configuration/test_resources/crypto/RSA_1024.crt new file mode 100644 index 000000000..993eb4d50 --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_1024.crt @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB4zCCAUygAwIBAgIRANSysyC3vJlv86Ttmi8M97owDQYJKoZIhvcNAQELBQAw +EzERMA8GA1UEChMIQXV0aGVsaWEwIBcNMjMwNDE3MTM0MTM3WhgPMjEwMDAxMDEw +MDAwMDBaMBMxETAPBgNVBAoTCEF1dGhlbGlhMIGfMA0GCSqGSIb3DQEBAQUAA4GN +ADCBiQKBgQC4ntJ/qcs9yBQihZkrF5v2Pdp6Rr8uNc4GDjuOsVGUohpwcjVobAuj +AuvCG646cnekbkJOm1bY+38F+nfWJ7ny9RYMp1ng6xWR6vpzZiPyJI89FQU3gd8f +WDI5Xn2ZvrSqfgEJhXMAWn7EPgUajlbLoPzYFCKSChIpR9umk5DBnQIDAQABozUw +MzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/ +BAIwADANBgkqhkiG9w0BAQsFAAOBgQBjpYkj+iE9XoA0q8Iq8+CYwlRwQ76jHKgy +z+0JCJE10ysuDPqRJEGJR3vfOs6VyNTGcvdCemPkTEYYAikaT4ydRNqIwefuHlx0 +7Abr/GUkZpRdTNfitAZbN4HpHpxZhx/A4yNutwGLiZSzqsn1r1VxTymSkNLa680X +84rsVRZppA== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/RSA_1024.pem b/internal/configuration/test_resources/crypto/RSA_1024.pem new file mode 100644 index 000000000..40fa6603f --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_1024.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICWwIBAAKBgQC4ntJ/qcs9yBQihZkrF5v2Pdp6Rr8uNc4GDjuOsVGUohpwcjVo +bAujAuvCG646cnekbkJOm1bY+38F+nfWJ7ny9RYMp1ng6xWR6vpzZiPyJI89FQU3 +gd8fWDI5Xn2ZvrSqfgEJhXMAWn7EPgUajlbLoPzYFCKSChIpR9umk5DBnQIDAQAB +AoGAHNF93jus5An1SqY8EIPw7nEdR3T/psDzVfKmzVFUgLUFF4RcXd5vupRcJMKZ +Ybo4fsxPQWHyHpCzdUVxq1YsKkK5qaAGjUfyHKP9yS/ZTKzA4BQJ+mOxagdZ79PB +dxrxtRWz58x++537TNGAUNziG7zaLOmdwlqul4bYjHt5FCkCQQDhPwFMbrpjT4oM +fDuy1bWS4t3X4VVBZfEQT3WeLu4qHzCnBbEszL/q3bXtKlbiqcWRwhrOvCqkmY8v +XBAb21yTAkEA0dPVHCcgXKWIytz7DOGEcBoO8ANw/918VoA9LW560pL5B1qzYAl+ +7Ecl6zoZLJPVY1BQ+HVE5tLih84hmlp3DwJAZnHQdmHaFfcEE3+ha0n1plPWkCwl +KXRi+ocZOJOhsLi02RImrfiFxR2Hc9GQ6NBMUmnU5XgBcRGCZQjbLsBLTwJAEct7 +SVXwIqtPPJUdHWyKxM8Q8T35eVmZT+S0S4QRGoaoY/1HNR/ZCcTG7HoS5HrtH+0R +0OBxJXpBB+9tXh/J9QJAJDVE0lcJWKeUl/W3P/pzCXZHdUtqoYUFuuuJyFnAAFFU +CKi6wGKnfsc0v01tVpooyThJ+4Z9eTotNGp6ke1tTA== +-----END RSA PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/RSA_2048.crt b/internal/configuration/test_resources/crypto/RSA_2048.crt new file mode 100644 index 000000000..f2eb46b6b --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_2048.crt @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC6DCCAdCgAwIBAgIRAKtA7n5MZorcd0TquNdXF74wDQYJKoZIhvcNAQELBQAw +EzERMA8GA1UEChMIQXV0aGVsaWEwIBcNMjMwNDE3MTM0NDI4WhgPMjEwMDAxMDEw +MDAwMDBaMBMxETAPBgNVBAoTCEF1dGhlbGlhMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEAugGNhIscNEpZtxdrTuRAyeGjSERuue56uF0lMDvh8YDi0alQ +y4q80FmIwfP9lWmji9IkMvf1iD0M2I55WBPrL9ddqtpdkIfLgz6eX791LKtF9n8u +PwuX2jUDtWdJrMlOIJ8wCcTjyCFzjTFujAtXGffjWt4tlKCWZZUkJqmyfBiQIag6 +ZFb1S6VXFXFpWTOIc41X2VBmzpSLnfqEDqgp/KMDja1tDYAhFh3IAFSzBpXqUGT4 +cH2wJUcrngdaiHR/2ToJRu66jK8akB35gjmKiF/Tp9pUI7/rBgPeFWDCZuuZa3k3 +brfjJkynQAoCNajfxy8cglCxAuG+jWubFDPGewIDAQABozUwMzAOBgNVHQ8BAf8E +BAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADANBgkqhkiG +9w0BAQsFAAOCAQEAoIXTZcKC13KW1GNhzx9ECFTs/gatfjkYONRz+M2wjpVGHzsn +JUPXhoT1SL9WdWYXVVCUXrQge9n9n6IccDjwddnoWL2JMXnNd2PAJLgwE2Xfd40o +U1CLTwvsVNCXjoQLyjkg+SbWGqApVS3oj+A8RTtSBbztP+CoOqbyD3Roo1sFHeE8 +PXYboT5bIIaU7DaxhItGHwVDLLOSD72FP/5i+ZmFse2EzUUdyi6d4FSjk7pZCX1T +/2w/bqk3zRemBqDwTnH+sMhPUPvcOg6AIR5YdjWYSDz45sDdgBpUZYYTPfSz2nUL +PJwsB/gk0asMwSYprat6sJ0X3xrtg1ak3a7LkQ== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/RSA_2048.pem b/internal/configuration/test_resources/crypto/RSA_2048.pem new file mode 100644 index 000000000..f901b0568 --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_2048.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAugGNhIscNEpZtxdrTuRAyeGjSERuue56uF0lMDvh8YDi0alQ +y4q80FmIwfP9lWmji9IkMvf1iD0M2I55WBPrL9ddqtpdkIfLgz6eX791LKtF9n8u +PwuX2jUDtWdJrMlOIJ8wCcTjyCFzjTFujAtXGffjWt4tlKCWZZUkJqmyfBiQIag6 +ZFb1S6VXFXFpWTOIc41X2VBmzpSLnfqEDqgp/KMDja1tDYAhFh3IAFSzBpXqUGT4 +cH2wJUcrngdaiHR/2ToJRu66jK8akB35gjmKiF/Tp9pUI7/rBgPeFWDCZuuZa3k3 +brfjJkynQAoCNajfxy8cglCxAuG+jWubFDPGewIDAQABAoIBAD7IkWUAs4du5TNo +wz7AyqGZ+MxG1P0LYv7h6dCLFeu3blgIh438iVjmL8QPwDNzkdF7H97YVVckDDb4 +eDrjlknyrtohlN1ZCLeHJlv5OurV8OqP6SM8nYf4xwSvFW4uEKHwOX3CqIP/zooE ++mRo24CXbHVacxYs0jb9jVNDikxaRh57aL9wqvg8/SUhe2T2VXzTO9z0ZYNuIyF/ +EkOLkRM1FY7o3zHuYeRN2Y/QbS7yOT4aIodHBtwvObWs8g6Sq8cSbss72x22fY8J +uPwDASy93EOfn7phx9rGq6ioy5XpZtiGHPs+dThftBoOUCq3x2PxdVjGRwnZ1LRd +kEhWm3kCgYEA8LelRt6go8tqUGj82Y+RkKlbviO7+P8Hol1B1fV+wIlLK6CRm6Mb +3PB7fRdBsxcuBFf8WfVdfIkSHEi2uG+Ehb54AySTdsgRYHSQtSYMvKyKxHcsEJ6x +5uNK425N6wVS86MGoIK5li6jpVwdnA8bE6cvEMBRMXlTTIzvwM1+AV8CgYEAxdCw +qqaS6aYBH5Ol0hUi3wW6HaLUOVGksrn3ZTfAGsgoX/mgF8qinz1NmuSzKoevvVK9 +q9TC+GDrVNQcD7s2kQQD3Ni8Jb3ok360HcqRN+n8O5+v/t7OjHSsqSRmnQX/lvWO ++65r442ziHXrhFT2CwmY3zBHXe2+MBrGHmrgRGUCgYEAkRoSbdrrOHD44Am5SSfq +1inQnJgLyjdpEa1nbyLxyfu4rU64FvpGZHMt7SSkvODfI00qV8u5E8XIffYy9pB6 +cOh0jWhx36sQFnWNeTS7fsv/RhiUHlya3pPqY5ftLhtiemyuJPlIB8iLarVRP+43 +IyynCVD0YH9DACUArNbx+r8CgYBpd9EZy2I9DPNAYLpifj5vZmBK+MvqG6uSVzCe +WNEl9l4AfdlrlfCKsma0FQepv1pluL3D5dZmE1aljcnAYXLAcsGUeEIoZU6hhUaH +M7+lbi27pHJzk1vQ60w7ilrjkZUqaZZofiCr3JtCQIznq1zbmaxWIymJ3P4wK7ZB +9X3JOQKBgQDHPBrRVP5Od7dd/C+yi7p2CujuLbV4vKczpNf7Kj+OwQZtnZxjzi95 +ObquHDkrz5+OhkvZwKNKO89UQzvhT+7gpQpZJ/gdVl1oNuZ5gAsJ4aDWX+NZ00Z0 +Nkb2HpYR8xlnt6rFV465SYun1CIz5h1sUD1T75LDK340SrMbQq2Ilw== +-----END RSA PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/RSA_2048_PAIR_PRIVATE.pem b/internal/configuration/test_resources/crypto/RSA_2048_PAIR_PRIVATE.pem new file mode 100644 index 000000000..8618ed9d9 --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_2048_PAIR_PRIVATE.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAwwT+q3AlxKeidlD706fdK9G5d+R0vK8D+eThGULFyzQfC4A3 +zmG92yWtrLcux1jsFBunjHCU7CnJTMazgMSl9K0oDIv5vZoIau+aq80Y+jP3CfyR +guqzQRwVdLZ3Z2rgFISsdhBTFXAyPpaZUfPjqlCXb5DMLoWwva8feA9PD9YOsuhV +A2aWbBYdYL0XlFP+dOCGbhB6Y+Kr3OXhXIYnFbX1bf8Jr1y+bvyf4B3zasl7awRx +lRn1kI2zpNIWFL1Srpj9NlwkcsW2ne03+JwgJtfaCRBTkZMOh1sgGC4Xjby7KrBY +21YLkpHhDJadg9NEdhD+St4MfdAQKkG3e/UWcQIDAQABAoIBABfi1bpzyvxyN9Dc +DGwZJFrInjnUDoRJv2ftI7DvX8CKyr6i3rL1f8aGr+X2rdEW0BuKY5Qs+eCPIau4 +rqW38EeuqbgXsOgLJLrMTBp8zXFfygM8Hyp0yq3P3cTk0G0nRvjcYy82wqZejpjh +4zeJcroakuHET23nTAV/nJAc9+cNbwwE41wIJ3t+xd/gECWc8LRWiwGjQJSaBVSK +D6/fKKqBMdk9QYeqM1Z/KGZW4PUw1IDgxbUXFWGAU5Vl1qYckDRVmVfrZOzyl1yM +nZ3cdTMACJ+i+T0SGUWlsZ3l8cmNryGnxE65tnQsRs6+r48/bwFh/2MgIDwy5Jle +IG36wMECgYEA12rREd1qAEDBVe9Vfz3RG//SedDhGtBcZiyZu6ndfioAW9glxRCD +j+ICiTVH6Uipz8FWIn8pHkr0uosgE1fDEW2LIH6/FAHalNhGSQc7omSfOrxgUf7H +fH/YS9sAErRDMhmPPdWj6pYO9MWG8FNiEsTspAEBLh8JFJnOzVkGv3kCgYEA58Ju +mnjj8wTkib4Tbi/CX0ZrnEiI0xAsLbAPzLhnhLvPvYvMnThSsRBbjg51fe6n/P9m +FgC1Bxd9kyY3MRRS7/7iPmMTQyOYTC83brBAFjCHiTVrQAyU1QsVhofCEsVFl8Iq +xSb9pO3A/HJCeKokxZ1WNTGbs3bylgK6XCX0eLkCgYAn1NJvsTcmcNLO5wAyFOYT +fUwXxi25XYmYQuryLkiMSYvjb6YcOB97fVjmsfloA02S4rbgjg62UTnLPGpj6Thi +gpTVH1qJgoY+O3dTjYjTUDO5Epfk0W1lceY2sHnk+3vpSZyY3GYAvFprnBKFYYWi +3tK6yIzFUGvHaWE5yxpaUQKBgAJ2/egkqv/1qFySqfA9D8slm5Vg7Buai2289p4N +xAQUX0Q7zWRKqg56Bw8+th8tv5mgOby4KzS1Gj/LY0DhX3Rv+IYDVbwcD82XnvZN +Z5EU2QwrhkV7HMYbRRJWNUkv0eqoRP4tyPrNEIVezbgszxFO+BC+w1IoTLItuz+p +o6z5AoGAeFRJrSzapMU9RSXdIxkoT6Hsalunbqw1yTedlCpqGggFujfX/GCToWB7 +PZeWUOWijK818+IR5YJbvFHx1q/4zf5CCfOHHp1TmmA9bR/622oQF6/jCrTnMTqK +0BpcWXXzh241EzE1rXpLHxnywCygxEGELRFsCR5YVFxdwPf1ZgM= +-----END RSA PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/RSA_2048_PAIR_PUBLIC.pem b/internal/configuration/test_resources/crypto/RSA_2048_PAIR_PUBLIC.pem new file mode 100644 index 000000000..84ffbac69 --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_2048_PAIR_PUBLIC.pem @@ -0,0 +1,8 @@ +-----BEGIN RSA PUBLIC KEY----- +MIIBCgKCAQEAwwT+q3AlxKeidlD706fdK9G5d+R0vK8D+eThGULFyzQfC4A3zmG9 +2yWtrLcux1jsFBunjHCU7CnJTMazgMSl9K0oDIv5vZoIau+aq80Y+jP3CfyRguqz +QRwVdLZ3Z2rgFISsdhBTFXAyPpaZUfPjqlCXb5DMLoWwva8feA9PD9YOsuhVA2aW +bBYdYL0XlFP+dOCGbhB6Y+Kr3OXhXIYnFbX1bf8Jr1y+bvyf4B3zasl7awRxlRn1 +kI2zpNIWFL1Srpj9NlwkcsW2ne03+JwgJtfaCRBTkZMOh1sgGC4Xjby7KrBY21YL +kpHhDJadg9NEdhD+St4MfdAQKkG3e/UWcQIDAQAB +-----END RSA PUBLIC KEY----- diff --git a/internal/configuration/test_resources/crypto/RSA_2048_PKCS8.crt b/internal/configuration/test_resources/crypto/RSA_2048_PKCS8.crt new file mode 100644 index 000000000..afac8a846 --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_2048_PKCS8.crt @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC6DCCAdCgAwIBAgIRAIs/ORkJgOjf/C7gnnKyjicwDQYJKoZIhvcNAQELBQAw +EzERMA8GA1UEChMIQXV0aGVsaWEwIBcNMjMwNDE4MDU0NjUwWhgPMjEwMDAxMDEw +MDAwMDBaMBMxETAPBgNVBAoTCEF1dGhlbGlhMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEA6ZPuDj+TItlSNL+rx4h2L/oxIVZzPVf/fD92b1zIILlMCAMh +MB1PbaUtxnFfkdT5OGnIQaF9aZtEk3Hf80YSVvOHSEhKKAtmN+Zd+kTvasJBZzHM +r82+ZhDKCAVkIj8+vlSSQ7plV8/m9EC4aUQE0qRCuTthqluLfLwJ+ceNnuTIuQnD +Qg10qG7+bycjPNFQuXDnU+voJ4PCQ5OVo1ZfN/u2KthtfenbqIx5Xi9JVFyA9Xik +ZDTm87OJahSi9bfbhi+3aJJOGpgOC3hEA+vNh0b6kbkbHXMaCCM26/3R/inECywd +r9FQqVyOm3eQIdPKNxwbqdMyWrgoQYSOvVliZwIDAQABozUwMzAOBgNVHQ8BAf8E +BAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADANBgkqhkiG +9w0BAQsFAAOCAQEAaDeYs35r0+bSjWQl4TlBdpcOBbceffQ4DY1OqXT7aogyGcr7 +O8wzvf4bEHAkzGo0GdvaBOp/rbJEQOmpXQaGiTg1V/5rFfi9RG/7NhOCmto8RSee +66pYYJPfUR7nv/EnfJExGCz+vhroaHlqRJJfXJjT8XCzG5KnbUm8PL5QG4GounzZ +u0+seG+lTMaxHNdLxZ9Zp5ZTbXZjQ9F5/bdvuKJnM9wD1EW6JJw05Dl1hjl2Ak0E +X34dUe0XNWirfpjntjd5mt+QpcLYJi5tqjiskrMzhoGFKh4g9lXQA3qLX2aaPAt4 +28ew+YkL7/qvP3MBE91bJ/IWtYX+3UCMke2+dw== +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/RSA_2048_PKCS8.pem b/internal/configuration/test_resources/crypto/RSA_2048_PKCS8.pem new file mode 100644 index 000000000..c4d52da65 --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_2048_PKCS8.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDpk+4OP5Mi2VI0 +v6vHiHYv+jEhVnM9V/98P3ZvXMgguUwIAyEwHU9tpS3GcV+R1Pk4achBoX1pm0ST +cd/zRhJW84dISEooC2Y35l36RO9qwkFnMcyvzb5mEMoIBWQiPz6+VJJDumVXz+b0 +QLhpRATSpEK5O2GqW4t8vAn5x42e5Mi5CcNCDXSobv5vJyM80VC5cOdT6+gng8JD +k5WjVl83+7Yq2G196duojHleL0lUXID1eKRkNObzs4lqFKL1t9uGL7dokk4amA4L +eEQD682HRvqRuRsdcxoIIzbr/dH+KcQLLB2v0VCpXI6bd5Ah08o3HBup0zJauChB +hI69WWJnAgMBAAECggEASCEkbEX5m9NcbWmbFFzxklNChLb7kz/vZ2D5o94U9vYB +op/EyeTjOEq/3f34s0H/TApuisXhwpDuFlIeBDPpSeyeJBYewEr03+JFtxk+jcs7 +AzD/snJoj4Azw1JW37SEHaZkHIIc9YcAHQE3cVpN2vZanHTX7hGi+3vd4MJc22nX +8XD/KRrosulsaFbWho2H9K1g7p3BkRQASuNm6caGVM6uvon+GqrylFgGHYAgzFXW +5ZEbybLN3yjSHag3F6LKw1LLxZ1/amy2Zz8nt5DzPajJEATFyeMGVnGXV2gv0BT+ +2Xj6U46cvHIjQtfmWCm+vWTK9cexaAjgRNZhwMwOAQKBgQDtL9kJ3Pp41g90idiO +p2mNCKh5000b3W+7HPhi2MkuPEIwzotd4Yzxm6DYxTy1UlQ3v1TnCcxGxXHSqXRL +Iq07eK+KQjxfJmTJIc5BQgiGDczj4kxrPOjIj5uGwhgpMJRyquAN+opJjOMV+FIh +rQx5XQ7ZljtGvUvEMqrHPpdD5wKBgQD8GsyVV7CsqeSyEs3SubvggOAJXoivNdg0 +Mmy6DL2ctvMH9qp038V1gdgxIuZN7Iul1qLTDKhVeS7zg7PJ2T2/06XIM6bz8FPx +6E21QfFPVbQw73VQ/2uGzsZoLPBe5sVSz/GLVlgM3bJfTPadB92RRhWNO4HEz08x +KQBnPjkdgQKBgEu2UlnLqEiaTCSvO+mNlyvl76GzyZFzhg78mG01NkMECTz7MZGu +Rgd53kZT76URusBw2vFFN2f/7u2IGg9B6nppc992dT8KSnHJ0MUUBxSDozu7KRmy +P7yF2ueRXZUIZNqVoR/VMf94caS5t734N1smUW8zfYh/NIhUhB9F45NRAoGAT7Nt +QD2T1lJzwbReK6OaePRlX7DqR3IfYwkaBIuomlXgaYEbDI3+EBM3tPkSlEoXMBu2 +KEDVKwh/xm65tTOf6PhRbgSeYHp3H4BQqOArGOjAacQac7v8U4clhKPIbkhI09B3 +zZRDi/W+wZBEWwq0iov8nkTU1tKvd5w9y2YJioECgYEA4xyF1+QV4stitX59NsES +IG/PuqxjmGtvzOLgMhfDCm/yewtAWLqXNoIoL3ogbilC/n/J+70kKOjXRwAwXBae +7JBKm3hJQm9uDYG3VSVkR4+SWpZbvSNSBdndObE9Uj0kc9+FQh7DMggSgkCP6UUl +/oyZBYhR3oBq6TyHZSS03/g= +-----END PRIVATE KEY----- diff --git a/internal/configuration/test_resources/crypto/RSA_4096.crt b/internal/configuration/test_resources/crypto/RSA_4096.crt new file mode 100644 index 000000000..0a9d3ccd2 --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_4096.crt @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIE5zCCAs+gAwIBAgIQFaK8pCAGUonNI4J2+aHgGzANBgkqhkiG9w0BAQsFADAT +MREwDwYDVQQKEwhBdXRoZWxpYTAgFw0yMzA0MTcxMzQ1MTBaGA8yMTAwMDEwMTAw +MDAwMFowEzERMA8GA1UEChMIQXV0aGVsaWEwggIiMA0GCSqGSIb3DQEBAQUAA4IC +DwAwggIKAoICAQCjdNqfv8DzXBfR4XXsskYFcUYSLx17BrQ1hQqyLCTaAluH80OE +7HyZbbklKyvw4ig5Rk8Slq1pv6JBK3dEsOWWth2BNZEQyyGXa/aa77Zj6FxdDRHb +H/retzJzxTaaiu+F50OU0PkE5clj/V5JsgKwm70GwOy6zLkGnlv0k0I8HzTYJd1u +9qfKLZpmkJ0oiR4TogEgZA+9atCxzAFbcrynEnStIrepxvad9oOlzFLxArFe5Ai8 +IsT3hgIo1SHFSVMhPdfsXVt1nIo5h2Ol2Ry932sIIDypNc70KsYgzQ4jC/6iRni4 +saKoUp9IIDCRl+zjlLM1csiufhzC8U0g+UvWFkzigTW4J+CneQk9nnb5BtfCAiir +6WjOicQJff9EuvQFYASljQypH8hunKcH9YWtT/DGRThpWRgDMMalHnEprC4uSrYy +1QajLCi0ncJIArW3SdyePc7tRebNIxY3/Phj5kMwfV+ypIso5nJyu41AQVaRT7U5 ++YHydvg3FGOa7JDUm1a27BQgpocz5yU5aazbffmPz/eRPqMa/YRsmzBLnuhkR2Fo +6aRoU0a3zQe9LcrP8gdxr2ZQqZYzdVJ2feywaeH6RN6jl3S2IlH/j71G0dyi3nSN +nC4pe7CHH/wtE6NYCzoPcpZIcDqWt1aCFKYCK1MacmWSycxzv0dzJo+CnwIDAQAB +ozUwMzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0T +AQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAL65NXfJDjTF/GeoB6s8V3fvuwviu +RVQZsbKO4i7nCgs7lFJbXDkW+ybXhq1fmOeCnD1BaF5wwBNB4rgb70PT2eGpKbC7 +7U4sgghU7CYSS5sc3dP2xAS1NaCrTAa3m8tlzPqhkR1VkZ9X16fG7kTp/CPXMKMT +zoBj+v3Iv3Gf+gSJu6a2PmvAPuV4w78PH9Lz2sZ7FkZYOYhzNgUS++vL2k53DIW9 +6mIqMhm6y9yzsxJx9FXKBWqNuqpL3Gp5KL0XWFy4JIbnpX1b0J4C8yAvF5QS8viO +3VFFcgGB5VWS6vMDAp/c6O+9Rzg0ZbfnLYAHxeSMGZ/Zkf/TnHNjKASFmEu912iH +c6ulT8hVxwTxi/P8eereFdsMib8Z0z871e/2KGZN9bwycVIsqZIllTM3vqcwc9wi +uu6eoScqx25qut2G7K2aQxtfPHmPfyh7/Ft3jZra3apzEuRE3KRBVWaSbDI2SjoP +LESJpBtFPnKOt2p9p/70iODv2lrfoMpj4eXXztJAJFUi4KkczomrU1WtJDc8J5Pp +9tBiNFR1bBKE4+9kwY+6x8LMJs94XjlbG7stoPki41qGR/8Th+n33GcIF4n9Up9l +2XR5/Iqewj2FJAkiYcalFasScU/hLTyjJzpYMOtAvVbBgvYm8IQ4Q5VBkQPPe6a4 +P+3smf8j9ywptqk= +-----END CERTIFICATE----- diff --git a/internal/configuration/test_resources/crypto/RSA_4096.pem b/internal/configuration/test_resources/crypto/RSA_4096.pem new file mode 100644 index 000000000..37cd7729f --- /dev/null +++ b/internal/configuration/test_resources/crypto/RSA_4096.pem @@ -0,0 +1,51 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIJJwIBAAKCAgEAo3Tan7/A81wX0eF17LJGBXFGEi8dewa0NYUKsiwk2gJbh/ND +hOx8mW25JSsr8OIoOUZPEpatab+iQSt3RLDllrYdgTWREMshl2v2mu+2Y+hcXQ0R +2x/63rcyc8U2morvhedDlND5BOXJY/1eSbICsJu9BsDsusy5Bp5b9JNCPB802CXd +bvanyi2aZpCdKIkeE6IBIGQPvWrQscwBW3K8pxJ0rSK3qcb2nfaDpcxS8QKxXuQI +vCLE94YCKNUhxUlTIT3X7F1bdZyKOYdjpdkcvd9rCCA8qTXO9CrGIM0OIwv+okZ4 +uLGiqFKfSCAwkZfs45SzNXLIrn4cwvFNIPlL1hZM4oE1uCfgp3kJPZ52+QbXwgIo +q+lozonECX3/RLr0BWAEpY0MqR/IbpynB/WFrU/wxkU4aVkYAzDGpR5xKawuLkq2 +MtUGoywotJ3CSAK1t0ncnj3O7UXmzSMWN/z4Y+ZDMH1fsqSLKOZycruNQEFWkU+1 +OfmB8nb4NxRjmuyQ1JtWtuwUIKaHM+clOWms2335j8/3kT6jGv2EbJswS57oZEdh +aOmkaFNGt80HvS3Kz/IHca9mUKmWM3VSdn3ssGnh+kTeo5d0tiJR/4+9RtHcot50 +jZwuKXuwhx/8LROjWAs6D3KWSHA6lrdWghSmAitTGnJlksnMc79HcyaPgp8CAwEA +AQKCAgAO31QBEwZwXiHAs/3x0mqylhLlFqpdBkghUoCdo4ya1XoUjZrIHmhb4XLm +Id52pW05gN8y9sjChXAy88x/UIUjSGC43/HaEFF3IJiokkULJBo7UTQdtvQxjYOm +qvwD5b5Tda5dfQIbYvkHAwewNuUtwo3ZbnZbrMLtCj2drERrif9Z52AVd5XevHV+ +/Yt/I7K74JKvqssP1gc1FjXNZ0wo+3HoSu9hIDxSNRrXXBbz3OXcl20ACT3Ys7XA +l1viQoCw1pqt4/StZ9ff0iTL80w9LnXjoGNEliPFbZrnYyD1KWM6yqSzUV5WaGYb +vuoMZUFll6MSquX9knX1etUkueofZE631DEtXagjdgoPwShxHzJM6dPqrelm79u0 +FWrptMCKActwGnFMOow8jDBnJ/ns7g95fKWthCZgyHhJHhs5EpNFEc1WTRuV+/Yb +564oJlgwTrSsNdBtdtmNLVFX2YqMXjeFkJuiJDFHEFpV8fMmHgVko0ihpFrohSza +ftfwCQKkd/L4huN4hMfZYwVd9rdeUqsJGXASnDu0f4Q1Bq6H9zQ//A+wBkh70Sq+ +2cYsW/GryI4h/Q5677xtKUA9IDMIz2opBBewjCJH+BRPUobcuyq/xWod217mo8gn +mHN5/8ysFPWJH42wL3aO20L0XUrps4n9ni5qW7sbiGg/VZCQyQKCAQEA2WpR4Csw +HOkhfnvay7NOEAiud/MLPLNPVzQioR+SdOqWuQ81Dx1iZf6ZkMJzKi7l/I9txG39 +QAh3aEUXStpjcmQygn+LS9zmZsaACnii/kBqNEJ7EVDkP/kL9qecgAUwSPB9xD8P +1SpcUVqcXfDpN9jQduLTHHcXgs5vUIUwFcC3OJKTMwWbSxMW2WmBsWrI/QqjprI3 +sFKHKOPs+RRALUF44L8jMnODzwbMEK1Bui+eFiNOI5QbU2cd/uVkKe+PZTMexziX +cBUa7gzrE2dDccLkVup8dRsXjZJlu2ET8VZYncLidjBzAiTy7E8hZwuHzzovvppr +c2PHvlX0JtrEvQKCAQEAwHcPEOCQP/cswnYgRSsI3uDCZN3PpiMQd1qKYiIQItKT +hBRPvYqzvDcsprSnqvcWqd6jlbvyhgZyi8xQt+Iyduib3scoOZ2w8P94B5YR3rT7 +u+BVd/A4iUxU0f8FfZ6sbwE5Q76XZdWwvFuy+lloM8y4BFe//VicA0JO7Rt4lFN2 +31WSGwa7nJuPbbIPCeY9hPQVkdgsVgSksW+TjuUxiRVUvcF60rAuErcDBnO4XcC6 +f/qGlLAUAzmQQqI0WpfldAFlYCrZi5UuJJaA7/w7h0a9MQmPx4UCcg4D1IZiyt0U +psueRzFBAndsgVLd+/v5t8Tkrz3M3/Dsw9yDg8RwiwKCAQB3gD7cjiB145YrZXxP +dpCzs3HiME6+4Hf9oIRgN3BSnxaVRUyOsEIDebuCm76dMwXqmhNlYmdOqNipEUDK +PdtnZrd0jxJLcnGZkAWUu9YrFdDKRLhMPkAXAZaXzmzw2Ok/TiBym47iRdRUSw+j +euVVcvCyR95tyO+9UCZTBcH2UuTiTX5nDu/ahfWLLrjAgcdTfmORHmgJnHL6AL2h +8oWL2m7MaYK5GlEam8vSZsi3w7CKzoEGgUO7xfPwxLkXa7tPjpeePPbP/mm86pDT +K3EguFS1iVE7NNbvU8ZjBermPeWbYSEEgYDVbuWvCZd8ghP1zS+s/keNNwz1C12V +da2pAoIBAFsBsSkM1oi4ivykuJucPsSMyL7DN6XaXLXjJR5D9xdQNRq2NAJvLI/q +Ev383G92CMxoDzgFOCdxswYxpVVd6vjZAqMzzux3iSxb0Fjd+DMzpvjumdttxn39 +jvoBOYpt1iFjFb3XyGUJx1k5jwbb8e7UdYrwJ0NXe+X6m7F4VOrmEIaIQt7urxXd +ZNO852mJ6jsM44okCsrdxTZ1iPN/oo2sfXaAn2AymIaW7SJG473JHSbYwnxaSgxA +Utt/MXxI6OGSq2nuuRFMiBYa6HsR7OAJbfpbCBaS6VYfFGaQ6PP91/8Ktxv4yUGu +UKtSEM9PFYR04KGQemjF1l7CzZkn8QMCggEAetZUlucrPeejwSaIJvxcyO59Vp73 +I5Yp6wnIQ3SZ3SIyx3GRJNU6uB8S6GR9Zu6CzdHSjuU9oBdmd4WdRle9H+8hooq0 +xWbtpZE90cXvx36Z1IqILSu1ZTJrdsCxTiU9vQmg23jRl5z8K2YnsN4ury7qiZBt +SPD051WfyTeyLG3A8gx9ugw3vyJwXgvE6d82BJvJoWS9IzuK7xGULD80zO/l18P+ +9ixzCh3rTi46FWESKu58HYNtWdTb0NolrqKexAx+IXhPBc8Zj7+Ip5u5s6XDV0Ek +tk96Zvf7GMFfPqRP6gidXeouyTu3pdcR7bCT9bVC0AcT/4n/L2D99ftFYQ== +-----END RSA PRIVATE KEY----- diff --git a/internal/configuration/validator/const.go b/internal/configuration/validator/const.go index f9933e372..ec29e700f 100644 --- a/internal/configuration/validator/const.go +++ b/internal/configuration/validator/const.go @@ -144,7 +144,7 @@ const ( const ( errFmtOIDCNoClientsConfigured = "identity_providers: oidc: option 'clients' must have one or " + "more clients configured" - errFmtOIDCNoPrivateKey = "identity_providers: oidc: option 'issuer_private_key' is required" + errFmtOIDCNoPrivateKey = "identity_providers: oidc: option 'issuer_private_key' or `issuer_jwks` is required" errFmtOIDCInvalidPrivateKeyBitSize = "identity_providers: oidc: option 'issuer_private_key' must be an RSA private key with %d bits or more but it only has %d bits" errFmtOIDCInvalidPrivateKeyMalformedMissingPublicKey = "identity_providers: oidc: option 'issuer_private_key' must be a valid RSA private key but the provided data is missing the public key bits" errFmtOIDCCertificateMismatch = "identity_providers: oidc: option 'issuer_private_key' does not appear to be the private key the certificate provided by option 'issuer_certificate_chain'" @@ -409,6 +409,7 @@ const ( attrOIDCRedirectURIs = "redirect_uris" attrOIDCTokenAuthMethod = "token_endpoint_auth_method" attrOIDCUsrSigAlg = "userinfo_signing_algorithm" + attrOIDCIDTokenSigAlg = "id_token_signing_alg" attrOIDCPKCEChallengeMethod = "pkce_challenge_method" ) @@ -416,7 +417,6 @@ var ( validOIDCCORSEndpoints = []string{oidc.EndpointAuthorization, oidc.EndpointPushedAuthorizationRequest, oidc.EndpointToken, oidc.EndpointIntrospection, oidc.EndpointRevocation, oidc.EndpointUserinfo} validOIDCClientScopes = []string{oidc.ScopeOpenID, oidc.ScopeEmail, oidc.ScopeProfile, oidc.ScopeGroups, oidc.ScopeOfflineAccess} - validOIDCClientUserinfoAlgorithms = []string{oidc.SigningAlgNone, oidc.SigningAlgRSAUsingSHA256} validOIDCClientConsentModes = []string{auto, oidc.ClientConsentModeImplicit.String(), oidc.ClientConsentModeExplicit.String(), oidc.ClientConsentModePreConfigured.String()} validOIDCClientResponseModes = []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery, oidc.ResponseModeFragment} validOIDCClientResponseTypes = []string{oidc.ResponseTypeAuthorizationCodeFlow, oidc.ResponseTypeImplicitFlowIDToken, oidc.ResponseTypeImplicitFlowToken, oidc.ResponseTypeImplicitFlowBoth, oidc.ResponseTypeHybridFlowIDToken, oidc.ResponseTypeHybridFlowToken, oidc.ResponseTypeHybridFlowBoth} @@ -428,6 +428,7 @@ var ( validOIDCClientTokenEndpointAuthMethods = []string{oidc.ClientAuthMethodNone, oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic, oidc.ClientAuthMethodClientSecretJWT} validOIDCClientTokenEndpointAuthMethodsConfidential = []string{oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic} validOIDCClientTokenEndpointAuthSigAlgs = []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512} + validOIDCIssuerJWKSigningAlgs = []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgRSAPSSUsingSHA256, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgRSAUsingSHA384, oidc.SigningAlgRSAPSSUsingSHA384, oidc.SigningAlgECDSAUsingP384AndSHA384, oidc.SigningAlgRSAUsingSHA512, oidc.SigningAlgRSAPSSUsingSHA512, oidc.SigningAlgECDSAUsingP521AndSHA512} ) var ( diff --git a/internal/configuration/validator/identity_providers.go b/internal/configuration/validator/identity_providers.go index 21ba0aab1..a716c841f 100644 --- a/internal/configuration/validator/identity_providers.go +++ b/internal/configuration/validator/identity_providers.go @@ -1,12 +1,19 @@ package validator import ( + "crypto" + "crypto/ecdsa" + "crypto/ed25519" + "crypto/rsa" "fmt" "net/url" + "sort" "strconv" "strings" "time" + "gopkg.in/square/go-jose.v2" + "github.com/authelia/authelia/v4/internal/configuration/schema" "github.com/authelia/authelia/v4/internal/oidc" "github.com/authelia/authelia/v4/internal/utils" @@ -24,26 +31,9 @@ func validateOIDC(config *schema.OpenIDConnectConfiguration, val *schema.StructV setOIDCDefaults(config) - switch { - case config.IssuerPrivateKey == nil: - val.Push(fmt.Errorf(errFmtOIDCNoPrivateKey)) - default: - if config.IssuerCertificateChain.HasCertificates() { - if !config.IssuerCertificateChain.EqualKey(config.IssuerPrivateKey) { - val.Push(fmt.Errorf(errFmtOIDCCertificateMismatch)) - } + validateOIDCIssuer(config, val) - if err := config.IssuerCertificateChain.Validate(); err != nil { - val.Push(fmt.Errorf(errFmtOIDCCertificateChain, err)) - } - } - - if config.IssuerPrivateKey.PublicKey.N == nil { - val.Push(fmt.Errorf(errFmtOIDCInvalidPrivateKeyMalformedMissingPublicKey)) - } else if config.IssuerPrivateKey.Size()*8 < 2048 { - val.Push(fmt.Errorf(errFmtOIDCInvalidPrivateKeyBitSize, 2048, config.IssuerPrivateKey.Size()*8)) - } - } + sort.Sort(oidc.SortedSigningAlgs(config.Discovery.RegisteredJWKSigningAlgs)) if config.MinimumParameterEntropy != 0 && config.MinimumParameterEntropy < 8 { val.PushWarning(fmt.Errorf(errFmtOIDCServerInsecureParameterEntropy, config.MinimumParameterEntropy)) @@ -62,6 +52,163 @@ func validateOIDC(config *schema.OpenIDConnectConfiguration, val *schema.StructV } } +func validateOIDCIssuer(config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + switch { + case config.IssuerPrivateKey != nil: + validateOIDCIssuerLegacy(config, val) + + fallthrough + case len(config.IssuerJWKS) != 0: + validateOIDCIssuerModern(config, val) + default: + val.Push(fmt.Errorf(errFmtOIDCNoPrivateKey)) + } +} + +func validateOIDCIssuerLegacy(config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + j := &jose.JSONWebKey{Key: &config.IssuerPrivateKey.PublicKey} + + thumbprint, err := j.Thumbprint(crypto.SHA1) + if err != nil { + val.Push(fmt.Errorf("identity_providers: oidc: option 'issuer_private_key' failed to calculate thumbprint to configure key id value: %w", err)) + + return + } + + config.IssuerJWKS = append(config.IssuerJWKS, schema.JWK{ + KeyID: fmt.Sprintf("%x", thumbprint)[:6], + Algorithm: oidc.SigningAlgRSAUsingSHA256, + Use: oidc.KeyUseSignature, + Key: config.IssuerPrivateKey, + CertificateChain: config.IssuerCertificateChain, + }) +} + +//nolint:gocyclo // Refactor time permitting. +func validateOIDCIssuerModern(config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + var ( + props *JWKProperties + err error + ) + + kids := make([]string, len(config.IssuerJWKS)) + + for i := 0; i < len(config.IssuerJWKS); i++ { + if key, ok := config.IssuerJWKS[i].Key.(*rsa.PrivateKey); ok && key.PublicKey.N == nil { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d: option 'key' must be a valid RSA private key but the provided data is malformed as it's missing the public key bits", i+1)) + + continue + } + + switch n := len(config.IssuerJWKS[i].KeyID); { + case n == 0: + j := jose.JSONWebKey{} + + switch key := config.IssuerJWKS[i].Key.(type) { + case schema.CryptographicPrivateKey: + j.Key = key.Public() + case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey: + j.Key = key + default: + break + } + + if j.Key == nil { + break + } + + var thumbprint []byte + + if thumbprint, err = j.Thumbprint(crypto.SHA1); err != nil { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d: option 'key' failed to calculate thumbprint to configure key id value: %w", i+1, err)) + + continue + } + + config.IssuerJWKS[i].KeyID = fmt.Sprintf("%x", thumbprint)[:6] + case n > 7: + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option `key_id`` must be 7 characters or less", i+1, config.IssuerJWKS[i].KeyID)) + } + + if config.IssuerJWKS[i].KeyID != "" && utils.IsStringInSlice(config.IssuerJWKS[i].KeyID, kids) { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key_id' must be unique", i+1, config.IssuerJWKS[i].KeyID)) + } + + kids[i] = config.IssuerJWKS[i].KeyID + + if !utils.IsStringAlphaNumeric(config.IssuerJWKS[i].KeyID) { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key_id' must only have alphanumeric characters", i+1, config.IssuerJWKS[i].KeyID)) + } + + if props, err = schemaJWKGetProperties(config.IssuerJWKS[i]); err != nil { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' failed to get key properties: %w", i+1, config.IssuerJWKS[i].KeyID, err)) + + continue + } + + switch config.IssuerJWKS[i].Use { + case "": + config.IssuerJWKS[i].Use = props.Use + case oidc.KeyUseSignature: + break + default: + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option '%s' must be one of %s but it's configured as '%s'", i+1, config.IssuerJWKS[i].KeyID, "use", strJoinOr([]string{oidc.KeyUseSignature}), config.IssuerJWKS[i].Use)) + } + + switch { + case config.IssuerJWKS[i].Algorithm == "": + config.IssuerJWKS[i].Algorithm = props.Algorithm + case utils.IsStringInSlice(config.IssuerJWKS[i].Algorithm, validOIDCIssuerJWKSigningAlgs): + break + default: + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option '%s' must be one of %s but it's configured as '%s'", i+1, config.IssuerJWKS[i].KeyID, "algorithm", strJoinOr(validOIDCIssuerJWKSigningAlgs), config.IssuerJWKS[i].Algorithm)) + } + + if config.IssuerJWKS[i].Algorithm != "" { + if utils.IsStringInSlice(config.IssuerJWKS[i].Algorithm, config.Discovery.RegisteredJWKSigningAlgs) { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'algorithm' must be unique but another key is using it", i+1, config.IssuerJWKS[i].KeyID)) + } else { + config.Discovery.RegisteredJWKSigningAlgs = append(config.Discovery.RegisteredJWKSigningAlgs, config.IssuerJWKS[i].Algorithm) + } + } + + if config.IssuerJWKS[i].Algorithm == oidc.SigningAlgRSAUsingSHA256 && config.Discovery.DefaultKeyID == "" { + config.Discovery.DefaultKeyID = config.IssuerJWKS[i].KeyID + } + + var checkEqualKey bool + + switch key := config.IssuerJWKS[i].Key.(type) { + case *rsa.PrivateKey: + checkEqualKey = true + + if key.Size() < 256 { + checkEqualKey = false + + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' is an RSA %d bit private key but it must be a RSA 2048 bit private key", i+1, config.IssuerJWKS[i].KeyID, key.Size()*8)) + } + case *ecdsa.PrivateKey: + checkEqualKey = true + default: + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' must be a *rsa.PrivateKey or *ecdsa.PrivateKey but it's a %T", i+1, config.IssuerJWKS[i].KeyID, key)) + } + + if config.IssuerJWKS[i].CertificateChain.HasCertificates() { + if checkEqualKey && !config.IssuerJWKS[i].CertificateChain.EqualKey(config.IssuerJWKS[i].Key) { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' does not appear to be the private key the certificate provided by option 'certificate_chain'", i+1, config.IssuerJWKS[i].KeyID)) + } + + if err = config.IssuerJWKS[i].CertificateChain.Validate(); err != nil { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'certificate_chain' produced an error during validation of the chain: %w", i+1, config.IssuerJWKS[i].KeyID, err)) + } + } + } + + if len(config.Discovery.RegisteredJWKSigningAlgs) != 0 && !utils.IsStringInSlice(oidc.SigningAlgRSAUsingSHA256, config.Discovery.RegisteredJWKSigningAlgs) { + val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: keys: must at least have one key supporting the '%s' algorithm but only has %s", oidc.SigningAlgRSAUsingSHA256, strJoinAnd(config.Discovery.RegisteredJWKSigningAlgs))) + } +} + func setOIDCDefaults(config *schema.OpenIDConnectConfiguration) { if config.AccessTokenLifespan == time.Duration(0) { config.AccessTokenLifespan = schema.DefaultOpenIDConnectConfiguration.AccessTokenLifespan @@ -228,7 +375,7 @@ func validateOIDCClient(c int, config *schema.OpenIDConnectConfiguration, val *s validateOIDCClientRedirectURIs(c, config, val, errDeprecatedFunc) validateOIDCClientTokenEndpointAuth(c, config, val) - validateOIDDClientUserinfoAlgorithm(c, config, val) + validateOIDDClientSigningAlgs(c, config, val) validateOIDCClientSectorIdentifier(c, config, val) } @@ -516,13 +663,18 @@ func validateOIDCClientTokenEndpointAuth(c int, config *schema.OpenIDConnectConf } } -func validateOIDDClientUserinfoAlgorithm(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { - if config.Clients[c].UserinfoSigningAlgorithm == "" { - config.Clients[c].UserinfoSigningAlgorithm = schema.DefaultOpenIDConnectClientConfiguration.UserinfoSigningAlgorithm +func validateOIDDClientSigningAlgs(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + if config.Clients[c].UserinfoSigningAlg == "" { + config.Clients[c].UserinfoSigningAlg = schema.DefaultOpenIDConnectClientConfiguration.UserinfoSigningAlg + } else if config.Clients[c].UserinfoSigningAlg != oidc.SigningAlgNone && !utils.IsStringInSlice(config.Clients[c].UserinfoSigningAlg, config.Discovery.RegisteredJWKSigningAlgs) { + val.Push(fmt.Errorf(errFmtOIDCClientInvalidValue, + config.Clients[c].ID, attrOIDCUsrSigAlg, strJoinOr(append(config.Discovery.RegisteredJWKSigningAlgs, oidc.SigningAlgNone)), config.Clients[c].UserinfoSigningAlg)) } - if !utils.IsStringInSlice(config.Clients[c].UserinfoSigningAlgorithm, validOIDCClientUserinfoAlgorithms) { + if config.Clients[c].IDTokenSigningAlg == "" { + config.Clients[c].IDTokenSigningAlg = schema.DefaultOpenIDConnectClientConfiguration.IDTokenSigningAlg + } else if !utils.IsStringInSlice(config.Clients[c].IDTokenSigningAlg, config.Discovery.RegisteredJWKSigningAlgs) { val.Push(fmt.Errorf(errFmtOIDCClientInvalidValue, - config.Clients[c].ID, attrOIDCUsrSigAlg, strJoinOr(validOIDCClientUserinfoAlgorithms), config.Clients[c].UserinfoSigningAlgorithm)) + config.Clients[c].ID, attrOIDCIDTokenSigAlg, strJoinOr(config.Discovery.RegisteredJWKSigningAlgs), config.Clients[c].IDTokenSigningAlg)) } } diff --git a/internal/configuration/validator/identity_providers_test.go b/internal/configuration/validator/identity_providers_test.go index e00b76141..93178a795 100644 --- a/internal/configuration/validator/identity_providers_test.go +++ b/internal/configuration/validator/identity_providers_test.go @@ -1,12 +1,15 @@ package validator import ( + "crypto/ecdsa" + "crypto/ed25519" "crypto/rsa" "crypto/x509" - "encoding/pem" "errors" "fmt" "net/url" + "os" + "strings" "testing" "time" @@ -30,7 +33,7 @@ func TestShouldRaiseErrorWhenInvalidOIDCServerConfiguration(t *testing.T) { require.Len(t, validator.Errors(), 2) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: option 'issuer_private_key' is required") + assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: option 'issuer_private_key' or `issuer_jwks` is required") assert.EqualError(t, validator.Errors()[1], "identity_providers: oidc: option 'clients' must have one or more clients configured") } @@ -39,14 +42,14 @@ func TestShouldNotRaiseErrorWhenCORSEndpointsValid(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, CORS: schema.OpenIDConnectCORSConfiguration{ Endpoints: []string{oidc.EndpointAuthorization, oidc.EndpointToken, oidc.EndpointIntrospection, oidc.EndpointRevocation, oidc.EndpointUserinfo}, }, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "example", - Secret: MustDecodeSecret("$plaintext$example"), + Secret: tOpenIDConnectPlainTextClientSecret, }, }, }, @@ -62,14 +65,14 @@ func TestShouldRaiseErrorWhenCORSEndpointsNotValid(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, CORS: schema.OpenIDConnectCORSConfiguration{ Endpoints: []string{oidc.EndpointAuthorization, oidc.EndpointToken, oidc.EndpointIntrospection, oidc.EndpointRevocation, oidc.EndpointUserinfo, "invalid_endpoint"}, }, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "example", - Secret: MustDecodeSecret("$plaintext$example"), + Secret: tOpenIDConnectPlainTextClientSecret, }, }, }, @@ -87,7 +90,7 @@ func TestShouldRaiseErrorWhenOIDCPKCEEnforceValueInvalid(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, EnforcePKCE: testInvalid, }, } @@ -106,7 +109,7 @@ func TestShouldRaiseErrorWhenOIDCCORSOriginsHasInvalidValues(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, CORS: schema.OpenIDConnectCORSConfiguration{ AllowedOrigins: utils.URLsFromStringSlice([]string{"https://example.com/", "https://site.example.com/subpath", "https://site.example.com?example=true", "*"}), AllowedOriginsFromClientRedirectURIs: true, @@ -114,7 +117,7 @@ func TestShouldRaiseErrorWhenOIDCCORSOriginsHasInvalidValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "myclient", - Secret: MustDecodeSecret("$plaintext$jk12nb3klqwmnelqkwenm"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: "two_factor", RedirectURIs: []string{"https://example.com/oauth2_callback", "https://localhost:566/callback", "http://an.example.com/callback", "file://a/file"}, }, @@ -141,7 +144,7 @@ func TestShouldRaiseErrorWhenOIDCServerNoClients(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, }, } @@ -187,7 +190,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-1", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: "a-policy", RedirectURIs: []string{ "https://google.com", @@ -203,13 +206,13 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-x", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{}, }, { ID: "client-x", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{}, }, @@ -223,7 +226,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-check-uri-parse", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "http://abc@%two", @@ -239,7 +242,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-check-uri-abs", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "google.com", @@ -255,7 +258,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-valid-sector", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "https://google.com", @@ -269,7 +272,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-valid-sector", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "https://google.com", @@ -283,7 +286,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-invalid-sector", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "https://google.com", @@ -305,7 +308,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-invalid-sector", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "https://google.com", @@ -322,7 +325,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-bad-consent-mode", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "https://google.com", @@ -339,7 +342,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-bad-pkce-mode", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "https://google.com", @@ -356,7 +359,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-bad-pkce-mode-s256", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: policyTwoFactor, RedirectURIs: []string{ "https://google.com", @@ -376,7 +379,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, Clients: tc.Clients, }, } @@ -400,11 +403,11 @@ func TestShouldRaiseErrorWhenOIDCClientConfiguredWithBadScopes(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "good_id", - Secret: MustDecodeSecret("$plaintext$good_secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: "two_factor", Scopes: []string{"openid", "bad_scope"}, RedirectURIs: []string{ @@ -426,11 +429,11 @@ func TestShouldRaiseErrorWhenOIDCClientConfiguredWithBadGrantTypes(t *testing.T) config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "good_id", - Secret: MustDecodeSecret(goodOpenIDConnectClientSecret), + Secret: tOpenIDConnectPBKDF2ClientSecret, Policy: "two_factor", GrantTypes: []string{"bad_grant_type"}, RedirectURIs: []string{ @@ -452,12 +455,12 @@ func TestShouldNotErrorOnCertificateValid(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerCertificateChain: MustParseX509CertificateChain(testCert1), - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerCertificateChain: certRSA2048, + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "good_id", - Secret: MustDecodeSecret(goodOpenIDConnectClientSecret), + Secret: tOpenIDConnectPBKDF2ClientSecret, Policy: "two_factor", RedirectURIs: []string{ "https://google.com/callback", @@ -478,12 +481,12 @@ func TestShouldRaiseErrorOnCertificateNotValid(t *testing.T) { config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerCertificateChain: MustParseX509CertificateChain(testCert1), - IssuerPrivateKey: MustParseRSAPrivateKey(testKey2), + IssuerCertificateChain: certRSA2048, + IssuerPrivateKey: keyRSA4096, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "good_id", - Secret: MustDecodeSecret(goodOpenIDConnectClientSecret), + Secret: tOpenIDConnectPBKDF2ClientSecret, Policy: "two_factor", RedirectURIs: []string{ "https://google.com/callback", @@ -498,115 +501,7 @@ func TestShouldRaiseErrorOnCertificateNotValid(t *testing.T) { assert.Len(t, validator.Warnings(), 0) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: option 'issuer_private_key' does not appear to be the private key the certificate provided by option 'issuer_certificate_chain'") -} - -func TestShouldRaiseErrorOnKeySizeTooSmall(t *testing.T) { - validator := schema.NewStructValidator() - config := &schema.IdentityProvidersConfiguration{ - OIDC: &schema.OpenIDConnectConfiguration{ - HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey3), - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "good_id", - Secret: MustDecodeSecret(goodOpenIDConnectClientSecret), - Policy: "two_factor", - RedirectURIs: []string{ - "https://google.com/callback", - }, - }, - }, - }, - } - - ValidateIdentityProviders(config, validator) - - assert.Len(t, validator.Warnings(), 0) - require.Len(t, validator.Errors(), 1) - - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: option 'issuer_private_key' must be an RSA private key with 2048 bits or more but it only has 1024 bits") -} - -func TestShouldRaiseErrorOnKeyInvalidPublicKey(t *testing.T) { - validator := schema.NewStructValidator() - config := &schema.IdentityProvidersConfiguration{ - OIDC: &schema.OpenIDConnectConfiguration{ - HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey3), - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "good_id", - Secret: MustDecodeSecret(goodOpenIDConnectClientSecret), - Policy: "two_factor", - RedirectURIs: []string{ - "https://google.com/callback", - }, - }, - }, - }, - } - - config.OIDC.IssuerPrivateKey.PublicKey.N = nil - - ValidateIdentityProviders(config, validator) - - assert.Len(t, validator.Warnings(), 0) - require.Len(t, validator.Errors(), 1) - - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: option 'issuer_private_key' must be a valid RSA private key but the provided data is missing the public key bits") -} - -func TestShouldRaiseErrorWhenOIDCClientConfiguredWithBadResponseModes(t *testing.T) { - validator := schema.NewStructValidator() - config := &schema.IdentityProvidersConfiguration{ - OIDC: &schema.OpenIDConnectConfiguration{ - HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "good_id", - Secret: MustDecodeSecret("$plaintext$good_secret"), - Policy: "two_factor", - ResponseModes: []string{"bad_responsemode"}, - RedirectURIs: []string{ - "https://google.com/callback", - }, - }, - }, - }, - } - - ValidateIdentityProviders(config, validator) - - require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: client 'good_id': option 'response_modes' must only have the values 'form_post', 'query', or 'fragment' but the values 'bad_responsemode' are present") -} - -func TestShouldRaiseErrorWhenOIDCClientConfiguredWithBadUserinfoAlg(t *testing.T) { - validator := schema.NewStructValidator() - config := &schema.IdentityProvidersConfiguration{ - OIDC: &schema.OpenIDConnectConfiguration{ - HMACSecret: "rLABDrx87et5KvRHVUgTm3pezWWd8LMN", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "good_id", - Secret: MustDecodeSecret("$plaintext$good_secret"), - Policy: "two_factor", - UserinfoSigningAlgorithm: "rs256", - RedirectURIs: []string{ - "https://google.com/callback", - }, - }, - }, - }, - } - - ValidateIdentityProviders(config, validator) - - require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: client 'good_id': option 'userinfo_signing_algorithm' must be one of 'none' or 'RS256' but it's configured as 'rs256'") + assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: issuer_jwks: key #1 with key id '9c7423': option 'key' does not appear to be the private key the certificate provided by option 'certificate_chain'") } func TestValidateIdentityProvidersShouldRaiseWarningOnSecurityIssue(t *testing.T) { @@ -614,12 +509,12 @@ func TestValidateIdentityProvidersShouldRaiseWarningOnSecurityIssue(t *testing.T config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "abc", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, MinimumParameterEntropy: 1, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "good_id", - Secret: MustDecodeSecret(goodOpenIDConnectClientSecret), + Secret: tOpenIDConnectPBKDF2ClientSecret, Policy: "two_factor", RedirectURIs: []string{ "https://google.com/callback", @@ -642,11 +537,11 @@ func TestValidateIdentityProvidersShouldRaiseErrorsOnInvalidClientTypes(t *testi config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "hmac1", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-with-invalid-secret", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Public: true, Policy: "two_factor", RedirectURIs: []string{ @@ -655,7 +550,7 @@ func TestValidateIdentityProvidersShouldRaiseErrorsOnInvalidClientTypes(t *testi }, { ID: "client-with-bad-redirect-uri", - Secret: MustDecodeSecret(goodOpenIDConnectClientSecret), + Secret: tOpenIDConnectPBKDF2ClientSecret, Public: false, Policy: "two_factor", RedirectURIs: []string{ @@ -680,7 +575,7 @@ func TestValidateIdentityProvidersShouldNotRaiseErrorsOnValidClientOptions(t *te config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "hmac1", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "installed-app-client", @@ -739,11 +634,11 @@ func TestValidateIdentityProvidersShouldRaiseWarningOnPlainTextClients(t *testin config := &schema.IdentityProvidersConfiguration{ OIDC: &schema.OpenIDConnectConfiguration{ HMACSecret: "hmac1", - IssuerPrivateKey: MustParseRSAPrivateKey(testKey1), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "client-with-invalid-secret_standard", - Secret: MustDecodeSecret("$plaintext$a-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: "two_factor", RedirectURIs: []string{ "https://localhost", @@ -1574,7 +1469,7 @@ func TestValidateOIDCClients(t *testing.T) { "ShouldSetDefaultUserInfoAlg", nil, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, oidc.SigningAlgNone, have.Clients[0].UserinfoSigningAlgorithm) + assert.Equal(t, oidc.SigningAlgNone, have.Clients[0].UserinfoSigningAlg) }, tcv{ nil, @@ -1594,10 +1489,10 @@ func TestValidateOIDCClients(t *testing.T) { { "ShouldNotOverrideUserInfoAlg", func(have *schema.OpenIDConnectConfiguration) { - have.Clients[0].UserinfoSigningAlgorithm = oidc.SigningAlgRSAUsingSHA256 + have.Clients[0].UserinfoSigningAlg = oidc.SigningAlgRSAUsingSHA256 }, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, have.Clients[0].UserinfoSigningAlgorithm) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, have.Clients[0].UserinfoSigningAlg) }, tcv{ nil, @@ -1617,10 +1512,10 @@ func TestValidateOIDCClients(t *testing.T) { { "ShouldRaiseErrorOnInvalidUserInfoAlg", func(have *schema.OpenIDConnectConfiguration) { - have.Clients[0].UserinfoSigningAlgorithm = "rs256" + have.Clients[0].UserinfoSigningAlg = "rs256" }, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, "rs256", have.Clients[0].UserinfoSigningAlgorithm) + assert.Equal(t, "rs256", have.Clients[0].UserinfoSigningAlg) }, tcv{ nil, @@ -1636,7 +1531,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'userinfo_signing_algorithm' must be one of 'none' or 'RS256' but it's configured as 'rs256'", + "identity_providers: oidc: client 'test': option 'userinfo_signing_algorithm' must be one of 'RS256' or 'none' but it's configured as 'rs256'", }, }, { @@ -1782,6 +1677,52 @@ func TestValidateOIDCClients(t *testing.T) { nil, nil, }, + { + "ShouldRaiseErrorOnIncorrectlyConfiguredTokenEndpointClientAuthMethodClientSecretJWT", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT + have.Clients[0].Secret = tOpenIDConnectPBKDF2ClientSecret + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: client 'test': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'", + }, + }, + { + "ShouldNotRaiseWarningOrErrorOnCorrectlyConfiguredTokenEndpointClientAuthMethodClientSecretJWT", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT + have.Clients[0].Secret = tOpenIDConnectPlainTextClientSecret + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + nil, + }, { "ShouldRaiseErrorOnIncorrectlyConfiguredTokenEndpointClientAuthMethodClientSecretJWT", func(have *schema.OpenIDConnectConfiguration) { @@ -1832,7 +1773,7 @@ func TestValidateOIDCClients(t *testing.T) { "ShouldSetDefaultTokenEndpointAuthSigAlg", func(have *schema.OpenIDConnectConfiguration) { have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT - have.Clients[0].Secret = MustDecodeSecret("$plaintext$abc123") + have.Clients[0].Secret = tOpenIDConnectPlainTextClientSecret }, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { assert.Equal(t, oidc.SigningAlgHMACUsingSHA256, have.Clients[0].TokenEndpointAuthSigningAlg) @@ -1884,11 +1825,11 @@ func TestValidateOIDCClients(t *testing.T) { "ShouldRaiseErrorOnInvalidTokenAuthAlgClientTypeConfidential", func(have *schema.OpenIDConnectConfiguration) { have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodClientSecretJWT - have.Clients[0].TokenEndpointAuthSigningAlg = "abcinvalid" - have.Clients[0].Secret = MustDecodeSecret("$plaintext$abc123") + have.Clients[0].TokenEndpointAuthSigningAlg = oidc.EndpointToken + have.Clients[0].Secret = tOpenIDConnectPlainTextClientSecret }, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, "abcinvalid", have.Clients[0].TokenEndpointAuthSigningAlg) + assert.Equal(t, oidc.EndpointToken, have.Clients[0].TokenEndpointAuthSigningAlg) }, tcv{ nil, @@ -1914,10 +1855,13 @@ func TestValidateOIDCClients(t *testing.T) { for _, tc := range testCasses { t.Run(tc.name, func(t *testing.T) { have := &schema.OpenIDConnectConfiguration{ + Discovery: schema.OpenIDConnectDiscovery{ + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "test", - Secret: MustDecodeSecret("$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng"), + Secret: tOpenIDConnectPBKDF2ClientSecret, Scopes: tc.have.Scopes, ResponseModes: tc.have.ResponseModes, ResponseTypes: tc.have.ResponseTypes, @@ -2017,6 +1961,388 @@ func TestValidateOIDCClientTokenEndpointAuthMethod(t *testing.T) { } } +func TestValidateOIDCIssuer(t *testing.T) { + frankenchain := schema.NewX509CertificateChainFromCerts([]*x509.Certificate{certRSA2048.Leaf(), certRSA1024.Leaf()}) + frankenkey := &rsa.PrivateKey{} + + *frankenkey = *keyRSA2048 + + frankenkey.PublicKey.N = nil + + testCases := []struct { + name string + have schema.OpenIDConnectConfiguration + expected schema.OpenIDConnectConfiguration + errs []string + }{ + { + "ShouldMapLegacyConfiguration", + schema.OpenIDConnectConfiguration{ + IssuerPrivateKey: keyRSA2048, + }, + schema.OpenIDConnectConfiguration{ + IssuerPrivateKey: keyRSA2048, + IssuerJWKS: []schema.JWK{ + {KeyID: "e7dfdc", Key: keyRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "e7dfdc", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + nil, + }, + { + "ShouldSetDefaultKeyValues", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: certRSA2048}, + {Key: keyECDSAP256, CertificateChain: certECDSAP256}, + {Key: keyECDSAP384, CertificateChain: certECDSAP384}, + {Key: keyECDSAP521, CertificateChain: certECDSAP521}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "e7dfdc"}, + {Key: keyECDSAP256, CertificateChain: certECDSAP256, Algorithm: oidc.SigningAlgECDSAUsingP256AndSHA256, Use: oidc.KeyUseSignature, KeyID: "29b3f2"}, + {Key: keyECDSAP384, CertificateChain: certECDSAP384, Algorithm: oidc.SigningAlgECDSAUsingP384AndSHA384, Use: oidc.KeyUseSignature, KeyID: "e968b4"}, + {Key: keyECDSAP521, CertificateChain: certECDSAP521, Algorithm: oidc.SigningAlgECDSAUsingP521AndSHA512, Use: oidc.KeyUseSignature, KeyID: "6b20c3"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "e7dfdc", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgECDSAUsingP384AndSHA384, oidc.SigningAlgECDSAUsingP521AndSHA512}, + }, + }, + nil, + }, + { + "ShouldRaiseErrorsDuplicateRSA256Keys", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: certRSA2048}, + {Key: keyRSA4096, CertificateChain: certRSA4096}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "e7dfdc"}, + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "e7dfdc", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #2 with key id '9c7423': option 'algorithm' must be unique but another key is using it", + }, + }, + { + "ShouldRaiseErrorsDuplicateRSA256Keys", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA512}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA512, Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA512}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: keys: must at least have one key supporting the 'RS256' algorithm but only has 'RS512'", + }, + }, + { + "ShouldRaiseErrorOnBadCurve", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096}, + {Key: keyECDSAP224, CertificateChain: certECDSAP224}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + {Key: keyECDSAP224, CertificateChain: certECDSAP224}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "9c7423", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #2: option 'key' failed to calculate thumbprint to configure key id value: square/go-jose: unsupported/unknown elliptic curve", + }, + }, + { + "ShouldRaiseErrorOnBadRSAKey", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA1024, CertificateChain: certRSA1024}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA1024, CertificateChain: certRSA1024, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "a9c018"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "a9c018", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id 'a9c018': option 'key' is an RSA 1024 bit private key but it must be a RSA 2048 bit private key", + }, + }, + { + "ShouldRaiseErrorOnBadAlg", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: "invalid"}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: "invalid", Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "", + RegisteredJWKSigningAlgs: []string{"invalid"}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id '9c7423': option 'algorithm' must be one of 'RS256', 'PS256', 'ES256', 'RS384', 'PS384', 'ES384', 'RS512', 'PS512', or 'ES512' but it's configured as 'invalid'", + "identity_providers: oidc: issuer_jwks: keys: must at least have one key supporting the 'RS256' algorithm but only has 'invalid'", + }, + }, + { + "ShouldRaiseErrorOnBadUse", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Use: "invalid"}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: "invalid", KeyID: "9c7423"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "9c7423", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id '9c7423': option 'use' must be one of 'sig' but it's configured as 'invalid'", + }, + }, + { + "ShouldRaiseErrorOnBadKeyIDLength", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, KeyID: "thisistoolong"}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "thisistoolong"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "thisistoolong", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id 'thisistoolong': option `key_id`` must be 7 characters or less", + }, + }, + { + "ShouldRaiseErrorOnBadKeyIDCharacters", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, KeyID: "x@x"}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "x@x"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "x@x", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id 'x@x': option 'key_id' must only have alphanumeric characters", + }, + }, + { + "ShouldRaiseErrorOnBadKeyIDDuplicates", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, KeyID: "x"}, + {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, KeyID: "x"}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "x"}, + {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "x"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "x", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgRSAPSSUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #2 with key id 'x': option 'key_id' must be unique", + }, + }, + { + "ShouldRaiseErrorOnEd25519Keys", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyEd2519, CertificateChain: certEd15519}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyEd2519, CertificateChain: certEd15519, KeyID: "d2dd94"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "", + RegisteredJWKSigningAlgs: []string(nil), + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id 'd2dd94': option 'key' must be a *rsa.PrivateKey or *ecdsa.PrivateKey but it's a ed25519.PrivateKey", + }, + }, + { + "ShouldRaiseErrorOnCertificateAsKey", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: publicRSA2048Pair}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: publicRSA2048Pair, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "904c62"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "904c62", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id '904c62': option 'key' must be a *rsa.PrivateKey or *ecdsa.PrivateKey but it's a *rsa.PublicKey", + }, + }, + { + "ShouldRaiseErrorOnInvalidChain", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: frankenchain}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: frankenchain, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "e7dfdc"}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "e7dfdc", + RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id 'e7dfdc': option 'certificate_chain' produced an error during validation of the chain: certificate #1 in chain is not signed properly by certificate #2 in chain: x509: invalid signature: parent certificate cannot sign this kind of certificate", + }, + }, + { + "ShouldRaiseErrorOnInvalidPrivateKeyN", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: frankenkey}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: frankenkey}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "", + RegisteredJWKSigningAlgs: []string(nil), + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1: option 'key' must be a valid RSA private key but the provided data is malformed as it's missing the public key bits", + }, + }, + { + "ShouldRaiseErrorOnCertForKey", + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: certRSA2048}, + }, + }, + schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{ + {Key: certRSA2048}, + }, + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "", + RegisteredJWKSigningAlgs: []string(nil), + }, + }, + []string{ + "identity_providers: oidc: issuer_jwks: key #1 with key id '': option 'key' failed to get key properties: the key type 'schema.X509CertificateChain' is unknown or not valid for the configuration", + }, + }, + } + + var n int + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + val := schema.NewStructValidator() + + validateOIDCIssuer(&tc.have, val) + + assert.Equal(t, tc.expected.Discovery.DefaultKeyID, tc.have.Discovery.DefaultKeyID) + assert.Equal(t, tc.expected.Discovery.RegisteredJWKSigningAlgs, tc.have.Discovery.RegisteredJWKSigningAlgs) + assert.Equal(t, tc.expected.IssuerPrivateKey, tc.have.IssuerPrivateKey) + assert.Equal(t, tc.expected.IssuerCertificateChain, tc.have.IssuerCertificateChain) + + n = len(tc.expected.IssuerJWKS) + + require.Len(t, tc.have.IssuerJWKS, n) + + for i := 0; i < n; i++ { + t.Run(fmt.Sprintf("Key%d", i), func(t *testing.T) { + assert.Equal(t, tc.expected.IssuerJWKS[i].Algorithm, tc.have.IssuerJWKS[i].Algorithm) + assert.Equal(t, tc.expected.IssuerJWKS[i].Use, tc.have.IssuerJWKS[i].Use) + assert.Equal(t, tc.expected.IssuerJWKS[i].KeyID, tc.have.IssuerJWKS[i].KeyID) + assert.Equal(t, tc.expected.IssuerJWKS[i].Key, tc.have.IssuerJWKS[i].Key) + assert.Equal(t, tc.expected.IssuerJWKS[i].CertificateChain, tc.have.IssuerJWKS[i].CertificateChain) + }) + } + + n = len(tc.errs) + + require.Len(t, val.Errors(), n) + + for i := 0; i < n; i++ { + assert.EqualError(t, val.Errors()[i], tc.errs[i]) + } + }) + } +} + func MustDecodeSecret(value string) *schema.PasswordDigest { if secret, err := schema.DecodePasswordDigest(value); err != nil { panic(err) @@ -2025,128 +2351,153 @@ func MustDecodeSecret(value string) *schema.PasswordDigest { } } -func MustParseRSAPrivateKey(data string) *rsa.PrivateKey { - block, _ := pem.Decode([]byte(data)) - if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { - panic("not pem encoded") +func MustLoadCrypto(alg, mod, ext string, extra ...string) any { + fparts := []string{alg, mod} + if len(extra) != 0 { + fparts = append(fparts, extra...) } - if block.Type != "RSA PRIVATE KEY" { - panic("not private key") - } + var ( + data []byte + decoded any + err error + ) - key, err := x509.ParsePKCS1PrivateKey(block.Bytes) - if err != nil { + if data, err = os.ReadFile(fmt.Sprintf(pathCrypto, strings.Join(fparts, "_"), ext)); err != nil { panic(err) } + if decoded, err = utils.ParseX509FromPEMRecursive(data); err != nil { + panic(err) + } + + return decoded +} + +func MustLoadCertificateChain(alg, op string) schema.X509CertificateChain { + decoded := MustLoadCrypto(alg, op, "crt") + + switch cert := decoded.(type) { + case *x509.Certificate: + return schema.NewX509CertificateChainFromCerts([]*x509.Certificate{cert}) + case []*x509.Certificate: + return schema.NewX509CertificateChainFromCerts(cert) + default: + panic(fmt.Errorf("the key was not a *x509.Certificate or []*x509.Certificate, it's a %T", cert)) + } +} + +func MustLoadCertificate(alg, op string) *x509.Certificate { + decoded := MustLoadCrypto(alg, op, "crt") + + cert, ok := decoded.(*x509.Certificate) + if !ok { + panic(fmt.Errorf("the key was not a *x509.Certificate, it's a %T", cert)) + } + + return cert +} + +func MustLoadEd15519PrivateKey(curve string, extra ...string) ed25519.PrivateKey { + decoded := MustLoadCrypto("ED25519", curve, "pem", extra...) + + key, ok := decoded.(ed25519.PrivateKey) + if !ok { + panic(fmt.Errorf("the key was not a ed25519.PrivateKey, it's a %T", key)) + } + return key } -func MustParseX509CertificateChain(data string) schema.X509CertificateChain { - chain, err := schema.NewX509CertificateChain(data) +func MustLoadECDSAPrivateKey(curve string, extra ...string) *ecdsa.PrivateKey { + decoded := MustLoadCrypto("ECDSA", curve, "pem", extra...) - if err != nil { - panic(err) + key, ok := decoded.(*ecdsa.PrivateKey) + if !ok { + panic(fmt.Errorf("the key was not a *ecdsa.PrivateKey, it's a %T", key)) } - return *chain + return key } -var ( - testCert1 = ` ------BEGIN CERTIFICATE----- -MIIC5jCCAc6gAwIBAgIRAJZ+6KrHw95zIDgm2arCTCgwDQYJKoZIhvcNAQELBQAw -EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNMjIwOTA4MDIyNDQyWhcNMjMwOTA4MDIy -NDQyWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP -ADCCAQoCggEBAMAE7muDAJtLsV3WgOpjrZ1JD1RlhuSOa3V+4zo2NYFQSdZW18SZ -fYYgUwLOleEy3VQ3N9MEFh/rWNHYHdsBjDvz/Q1EzAlXqthGd0Sic/UDYtrahrko -jCSkZCQ5YVO9ivMRth6XdUlu7RHVYY3aSOWPx2wiw9cdN+e4p73W6KwyzT7ezbUD -0Nng0Z7CNQTLHv3LBsLUODc4aVOvp2B4aAaw6cn990buKMvUuo2ge9gh0c5gIOM5 -dU7xOGAt7RzwCIHnG4CGAWPFuuS215ZeelgQr/9/fhtzDqSuBZw5f10vXnAyBwei -vN6Kffj2RXB+koFwBguT84A6cfmxWllGNF0CAwEAAaM1MDMwDgYDVR0PAQH/BAQD -AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN -AQELBQADggEBAFvORjj7RGoIc3q0fv6QjuncZ0Mu1/24O0smCr6tq5d6RQBRpb1M -jEsbTMLZErrHbyw/DWC75eJhW6T+6HiVTo6brBXkmDL+QGkLgRNOkZla6cnmIpmL -bf9iPmmcThscQERgYZzNg19zqK8JAQU/6PgU/N6OXTL/mQQoB972ET9dUl7lGx1Q -2l8XBe8t4QTp4t1xd3c4azxWvFNpzWBjC5eBWiVHLJmFXr4xpcnPFYFETOkvEqwt -pMQ2x895BoLrep6b+g0xeF4pmmIQwA9KrUVr++gpYaRzytaOIYwcIPMzt9iLWKQe -6ZSOrTVi8pPugYXp+LhVk/WI7r8EWtyADu0= ------END CERTIFICATE-----` +func MustLoadRSAPublicKey(bits string, extra ...string) *rsa.PublicKey { + decoded := MustLoadCrypto("RSA", bits, "pem", extra...) - testKey1 = ` ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAwATua4MAm0uxXdaA6mOtnUkPVGWG5I5rdX7jOjY1gVBJ1lbX -xJl9hiBTAs6V4TLdVDc30wQWH+tY0dgd2wGMO/P9DUTMCVeq2EZ3RKJz9QNi2tqG -uSiMJKRkJDlhU72K8xG2Hpd1SW7tEdVhjdpI5Y/HbCLD1x0357invdborDLNPt7N -tQPQ2eDRnsI1BMse/csGwtQ4NzhpU6+nYHhoBrDpyf33Ru4oy9S6jaB72CHRzmAg -4zl1TvE4YC3tHPAIgecbgIYBY8W65LbXll56WBCv/39+G3MOpK4FnDl/XS9ecDIH -B6K83op9+PZFcH6SgXAGC5PzgDpx+bFaWUY0XQIDAQABAoIBAQClcdpHcglMxOwe -kRpkWdwWAAQgUJXoSbnW86wu1NRHBfmInyyrrSBVN3aunXbQITZIQIdt3kB94haW -P6KBt5Svd2saSqOOjSWb0SMkVOCaQ/+h19VqpcASNj4+Y94y+8ZD5ofHVfJtghDr -Y7H5OhHDEZ3e0xlwODGaCyUkUY4KBv/oIlILoh4phbDYHkZH8AzDnEiyVE1JAWlN -voAQysgSU7eEnNCi1S07jl5bY+MD3XpJkAfQsJYhqYT/qetStZ12PuXjpbIr3y53 -qjCrKeWTyDN+gOznyIGuiR6nvXeQAw/o9hZiah4RuHXTPs/3GAcRXcuMR0pbgJ+B -yfX6eLK1AoGBAPKkJKPYJD2NHukAelNbT2OgeDIgJmfOIvLa73/x2hXvWwa4VwIC -POuKXtT/a02J4pYMGlaKXfHgLmaW2HPObOIjpxqgRIswsiKS1AbaDtkWnhaS1/SJ -oZ7Fk8DdX+1QT4J/fj/2uxRT0GhXdMxDpK7ekpmRE+APPCGhmOMgmWszAoGBAMqX -Ts1RdGWgDxLi15rDqdqRBARJG7Om/xC2voXVmbAb4Q+QoNrNeiIAM2usuhrVuj5V -c16m9fxswRNYqQBYyShDi5wp5a8UjfqDpzJdku2bmrBaL+XVq8PY+oTK6KS3ss8U -CGQ8P6Phz5JGavn/nDMRZ4EwEWqbEMUqJAJlpmIvAoGAQ9Wj8LJyn0qew6FAkaFL -dpzcPZdDZW35009l+a0RvWQnXJ+Yo5UglvEeRgoKY6kS0cQccOlKDl8QWdn+NZIW -WrqA8y6vOwKoKoZGBIxd7k8mb0UqXtFDf/HYtuis8tmrAN7H2vYNo0czUphwrNKU -bdcHwSsQFWns87IL3iO1AIUCgYBzmBX8jOePPN6c9hXzVoVKEshp8ZT+0uBilwLq -tk/07lNiYDGH5woy8E5mt62QtjaIbpVfgoCEwUEBWutDKWXNtYypVDabyWyhbhEu -abn2HX0L9smxqFNTcjCvKF/J7I74HQQUvVPKnIOlgMx1TOXBNcMLMXQekc/lz/+v -5nQjPQKBgQDjdJABeiy9tU0tzLWUVc5QoQKnlfSJoFLis46REb1yHwU9OjTc05Wx -5lAXdTjDmnelDdGWNWHjWOiKSkTxhvQD3jXriI5y8Sdxe3zS3ikYvbMbi97GJz0O -5oyNJo6/froW1dLkJJWR8hg2PQbtoOo6l9HHSd91BnJJ4qFbq9ZrXQ== ------END RSA PRIVATE KEY-----` + key, ok := decoded.(*rsa.PublicKey) + if !ok { + panic(fmt.Errorf("the key was not a *rsa.PublicKey, it's a %T", key)) + } - testKey2 = ` ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758 -cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn -ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5 -Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa -rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp -EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU -L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+ -Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm -9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7 -8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV -I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7 -CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE -hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi -jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q -E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b -CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn -jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio -Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ -Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX -bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1 -otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj -HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd -tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM -USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0 -1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw== ------END RSA PRIVATE KEY-----` + return key +} - testKey3 = `-----BEGIN RSA PRIVATE KEY----- -MIICXgIBAAKBgQDBi7fdmUmlpWklpgAvNUdhDrpsDVqAHuEzVApK6f6ohYAi0/q2 -+YmOwyPKDSrOc6Sy1myJtV3FbZGvYaQhnokc4bnkS9DH0lY+6Hk2vKps5PrhRY/q -1EjnfwXvzhAzb25rGFwKcSvfvndMTVvxgqXVob+3pRt9maD6HFHAh2/NCQIDAQAB -AoGACT2bfLgJ3R/FomeHkLlxe//RBMGqdX2D8QhtKWB8qR0engsS6FOHrspAVjBE -v/Cjh2pXake/f2KY1w/JX1WLZEFXja2RFPeeDiiC/4S7pKCySUVeHO9rQ4SY5Frg -/s/QWWtmq7+1iu2DXhdGJA6fIurzSoDgUXo3NGFCYqIFaAECQQDUi9AAgEljmc2q -dAUQD0KNTcJFkpTafhfPiYc2GT1vS/bArtXRmvJmbIiRfVuGbM8z5ES7JGd5FyYL -i2WCCzUBAkEA6R14GVhN8NIPWEUrzjgOvjKlc2ZHskT3dYb3djpm69TK7GjLtHyq -qO7l4VJowsXI+o/6YucagF6+rH0O0VrwCQJBAM8twYDbi63knA8MrGqtFUg7haTf -bu1Tf84y1nOrQrEcMNg9E/sOuD2SicSXlwF/SrHgTgbFQ39LSzBxnm6WkgECQQCh -AQmB98tdGLggbyXiODV2h+Rd37aFGb0QHzerIIsVNtMwlPCcp733D4kWJqTUYWZ+ -KBL3XEahgs6Os5EYZ4aBAkEAjKE+2/nBYUdHVusjMXeNsE5rqwJND5zvYzmToG7+ -xhv4RUAe4dHL4IDQoQRjhr3Nw+JYvtzBx0Iq/178xMnGKg== ------END RSA PRIVATE KEY-----` +func MustLoadRSAPrivateKey(bits string, extra ...string) *rsa.PrivateKey { + decoded := MustLoadCrypto("RSA", bits, "pem", extra...) - goodOpenIDConnectClientSecret = "$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng" //nolint:gosec + key, ok := decoded.(*rsa.PrivateKey) + if !ok { + panic(fmt.Errorf("the key was not a *rsa.PrivateKey, it's a %T", key)) + } + + return key +} + +const ( + pathCrypto = "../test_resources/crypto/%s.%s" ) + +//nolint:unused +var ( + tOpenIDConnectPBKDF2ClientSecret, tOpenIDConnectPlainTextClientSecret *schema.PasswordDigest + + // Standard RSA key pair. + publicRSA2048Pair *rsa.PublicKey + privateRSA2048Pair *rsa.PrivateKey + + // Standard RSA key / certificate pairs. + keyRSA1024, keyRSA2048, keyRSA2048PKCS8, keyRSA4096 *rsa.PrivateKey + certRSA1024, certRSA2048, certRSA4096 schema.X509CertificateChain + + // Standard ECDSA key / certificate pairs. + keyECDSAP224, keyECDSAP256, keyECDSAP384, keyECDSAP521 *ecdsa.PrivateKey + certECDSAP224, certECDSAP256, certECDSAP384, certECDSAP521 schema.X509CertificateChain + + // Standard ECDSA key / certificate pairs. + keyECDSAP256PKCS8, keyECDSAP384PKCS8, keyECDSAP521PKCS8 *ecdsa.PrivateKey + certECDSAP224PKCS8, certECDSAP256PKCS8, certECDSAP384PKCS8, certECDSAP521PKCS8 schema.X509CertificateChain + + // Ed15519 key / certificate pair. + keyEd2519 ed25519.PrivateKey + certEd15519 schema.X509CertificateChain +) + +func init() { + tOpenIDConnectPBKDF2ClientSecret = MustDecodeSecret("$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng") + tOpenIDConnectPlainTextClientSecret = MustDecodeSecret("$plaintext$example") + + publicRSA2048Pair = MustLoadRSAPublicKey("2048", "PAIR", "PUBLIC") + privateRSA2048Pair = MustLoadRSAPrivateKey("2048", "PAIR", "PRIVATE") + + keyRSA1024 = MustLoadRSAPrivateKey("1024") + keyRSA2048 = MustLoadRSAPrivateKey("2048") + keyRSA4096 = MustLoadRSAPrivateKey("4096") + keyECDSAP224 = MustLoadECDSAPrivateKey("P224") + keyECDSAP256 = MustLoadECDSAPrivateKey("P256") + keyECDSAP384 = MustLoadECDSAPrivateKey("P384") + keyECDSAP521 = MustLoadECDSAPrivateKey("P521") + keyEd2519 = MustLoadEd15519PrivateKey("PKCS8") + + keyRSA2048PKCS8 = MustLoadRSAPrivateKey("2048", "PKCS8") + keyECDSAP256PKCS8 = MustLoadECDSAPrivateKey("P256", "PKCS8") + keyECDSAP384PKCS8 = MustLoadECDSAPrivateKey("P384", "PKCS8") + keyECDSAP521PKCS8 = MustLoadECDSAPrivateKey("P521", "PKCS8") + + certRSA1024 = MustLoadCertificateChain("RSA", "1024") + certRSA2048 = MustLoadCertificateChain("RSA", "2048") + certRSA4096 = MustLoadCertificateChain("RSA", "4096") + certECDSAP224 = MustLoadCertificateChain("ECDSA", "P224") + certECDSAP256 = MustLoadCertificateChain("ECDSA", "P256") + certECDSAP384 = MustLoadCertificateChain("ECDSA", "P384") + certECDSAP521 = MustLoadCertificateChain("ECDSA", "P521") + certEd15519 = MustLoadCertificateChain("ED25519", "PKCS8") +} diff --git a/internal/configuration/validator/util.go b/internal/configuration/validator/util.go index 59b9411b1..e40f9ec4f 100644 --- a/internal/configuration/validator/util.go +++ b/internal/configuration/validator/util.go @@ -1,10 +1,17 @@ package validator import ( + "crypto/ecdsa" + "crypto/ed25519" + "crypto/elliptic" + "crypto/rsa" + "fmt" "strings" "golang.org/x/net/publicsuffix" + "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/oidc" "github.com/authelia/authelia/v4/internal/utils" ) @@ -107,3 +114,47 @@ func validateList(values, valid []string, chkDuplicate bool) (invalid, duplicate return } + +type JWKProperties struct { + Use string + Algorithm string + Bits int + Curve elliptic.Curve +} + +func schemaJWKGetProperties(jwk schema.JWK) (properties *JWKProperties, err error) { + switch key := jwk.Key.(type) { + case nil: + return nil, fmt.Errorf("private key is nil") + case ed25519.PrivateKey, ed25519.PublicKey: + return &JWKProperties{}, nil + case *rsa.PrivateKey: + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgRSAUsingSHA256, key.Size(), nil}, nil + case *rsa.PublicKey: + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgRSAUsingSHA256, key.Size(), nil}, nil + case *ecdsa.PublicKey: + switch key.Curve { + case elliptic.P256(): + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgECDSAUsingP256AndSHA256, -1, key.Curve}, nil + case elliptic.P384(): + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgECDSAUsingP384AndSHA384, -1, key.Curve}, nil + case elliptic.P521(): + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgECDSAUsingP521AndSHA512, -1, key.Curve}, nil + default: + return &JWKProperties{oidc.KeyUseSignature, "", -1, key.Curve}, nil + } + case *ecdsa.PrivateKey: + switch key.Curve { + case elliptic.P256(): + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgECDSAUsingP256AndSHA256, -1, key.Curve}, nil + case elliptic.P384(): + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgECDSAUsingP384AndSHA384, -1, key.Curve}, nil + case elliptic.P521(): + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgECDSAUsingP521AndSHA512, -1, key.Curve}, nil + default: + return &JWKProperties{oidc.KeyUseSignature, "", -1, key.Curve}, nil + } + default: + return nil, fmt.Errorf("the key type '%T' is unknown or not valid for the configuration", key) + } +} diff --git a/internal/handlers/handler_jwks.go b/internal/handlers/handler_jwks.go index 14f680711..ad0f8a43b 100644 --- a/internal/handlers/handler_jwks.go +++ b/internal/handlers/handler_jwks.go @@ -8,9 +8,9 @@ import ( // JSONWebKeySetGET returns the JSON Web Key Set. Used in OAuth 2.0 and OpenID Connect 1.0. func JSONWebKeySetGET(ctx *middlewares.AutheliaCtx) { - ctx.SetContentType("application/json") + ctx.SetContentTypeApplicationJSON() - if err := json.NewEncoder(ctx).Encode(ctx.Providers.OpenIDConnect.KeyManager.GetKeySet()); err != nil { + if err := json.NewEncoder(ctx).Encode(ctx.Providers.OpenIDConnect.KeyManager.Set(ctx)); err != nil { ctx.Error(err, "failed to serve json web key set") } } diff --git a/internal/handlers/handler_oidc_authorization.go b/internal/handlers/handler_oidc_authorization.go index 9924c5ec1..9d8ea4e4e 100644 --- a/internal/handlers/handler_oidc_authorization.go +++ b/internal/handlers/handler_oidc_authorization.go @@ -127,7 +127,7 @@ func OpenIDConnectAuthorization(ctx *middlewares.AutheliaCtx, rw http.ResponseWr ctx.Logger.Debugf("Authorization Request with id '%s' on client with id '%s' was successfully processed, proceeding to build Authorization Response", requester.GetID(), clientID) - session := oidc.NewSessionWithAuthorizeRequest(issuer, ctx.Providers.OpenIDConnect.KeyManager.GetActiveKeyID(), + session := oidc.NewSessionWithAuthorizeRequest(issuer, ctx.Providers.OpenIDConnect.KeyManager.GetKIDFromAlg(ctx, client.GetIDTokenSigningAlg()), userSession.Username, userSession.AuthenticationMethodRefs.MarshalRFC8176(), extraClaims, authTime, consent, requester) ctx.Logger.Tracef("Authorization Request with id '%s' on client with id '%s' creating session for Authorization Response for subject '%s' with username '%s' with claims: %+v", diff --git a/internal/handlers/handler_oidc_token_test.go b/internal/handlers/handler_oidc_token_test.go index 52aacbbd9..279cc4e3d 100644 --- a/internal/handlers/handler_oidc_token_test.go +++ b/internal/handlers/handler_oidc_token_test.go @@ -145,11 +145,10 @@ func (s *ClientAuthenticationStrategySuite) SetupTest() { s.ctrl = gomock.NewController(s.T()) s.store = mocks.NewMockStorage(s.ctrl) - var err error - secret := MustDecodeSecret("$plaintext$client-secret") - s.provider, err = oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + s.provider = oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + IssuerJWKS: []schema.JWK{}, IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: MustParseRSAPrivateKey(exampleRSAPrivateKey), HMACSecret: "abc123", @@ -370,8 +369,6 @@ func (s *ClientAuthenticationStrategySuite) SetupTest() { }, }, }, s.store, nil) - - s.Require().NoError(err) } func (s *ClientAuthenticationStrategySuite) TestShouldValidateAssertionHS256() { diff --git a/internal/handlers/handler_oidc_userinfo.go b/internal/handlers/handler_oidc_userinfo.go index 33b827bbe..9e98a0f4a 100644 --- a/internal/handlers/handler_oidc_userinfo.go +++ b/internal/handlers/handler_oidc_userinfo.go @@ -99,8 +99,18 @@ func OpenIDConnectUserinfo(ctx *middlewares.AutheliaCtx, rw http.ResponseWriter, ctx.Logger.Tracef("UserInfo Response with id '%s' on client with id '%s' is being sent with the following claims: %+v", requester.GetID(), clientID, claims) - switch client.GetUserinfoSigningAlgorithm() { - case oidc.SigningAlgRSAUsingSHA256: + switch alg := client.GetUserinfoSigningAlg(); alg { + case oidc.SigningAlgNone, "": + ctx.Providers.OpenIDConnect.Write(rw, req, claims) + default: + var jwk *oidc.JWK + + if jwk = ctx.Providers.OpenIDConnect.KeyManager.GetByAlg(ctx, alg); jwk == nil { + ctx.Providers.OpenIDConnect.WriteError(rw, req, errors.WithStack(fosite.ErrServerError.WithHintf("Unsupported UserInfo signing algorithm '%s'.", alg))) + + return + } + var jti uuid.UUID if jti, err = uuid.NewRandom(); err != nil { @@ -114,11 +124,11 @@ func OpenIDConnectUserinfo(ctx *middlewares.AutheliaCtx, rw http.ResponseWriter, headers := &jwt.Headers{ Extra: map[string]any{ - oidc.JWTHeaderKeyIdentifier: ctx.Providers.OpenIDConnect.KeyManager.GetActiveKeyID(), + oidc.JWTHeaderKeyIdentifier: jwk.KeyID(), }, } - if token, _, err = ctx.Providers.OpenIDConnect.KeyManager.Strategy().Generate(req.Context(), claims, headers); err != nil { + if token, _, err = jwk.Strategy().Generate(req.Context(), claims, headers); err != nil { ctx.Providers.OpenIDConnect.WriteError(rw, req, err) return @@ -126,9 +136,5 @@ func OpenIDConnectUserinfo(ctx *middlewares.AutheliaCtx, rw http.ResponseWriter, rw.Header().Set(fasthttp.HeaderContentType, "application/jwt") _, _ = rw.Write([]byte(token)) - case oidc.SigningAlgNone, "": - ctx.Providers.OpenIDConnect.Write(rw, req, claims) - default: - ctx.Providers.OpenIDConnect.WriteError(rw, req, errors.WithStack(fosite.ErrServerError.WithHintf("Unsupported UserInfo signing algorithm '%s'.", client.GetUserinfoSigningAlgorithm()))) } } diff --git a/internal/oidc/client.go b/internal/oidc/client.go index 6a100cdbe..64d1f22b3 100644 --- a/internal/oidc/client.go +++ b/internal/oidc/client.go @@ -34,7 +34,8 @@ func NewClient(config schema.OpenIDConnectClientConfiguration) (client Client) { EnforcePAR: config.EnforcePAR, - UserinfoSigningAlgorithm: config.UserinfoSigningAlgorithm, + IDTokenSigningAlg: config.IDTokenSigningAlg, + UserinfoSigningAlg: config.UserinfoSigningAlg, Policy: authorization.NewLevel(config.Policy), @@ -131,13 +132,22 @@ func (c *BaseClient) GetResponseModes() []fosite.ResponseModeType { return c.ResponseModes } -// GetUserinfoSigningAlgorithm returns the UserinfoSigningAlgorithm. -func (c *BaseClient) GetUserinfoSigningAlgorithm() string { - if c.UserinfoSigningAlgorithm == "" { - c.UserinfoSigningAlgorithm = SigningAlgNone +// GetIDTokenSigningAlg returns the IDTokenSigningAlg. +func (c *BaseClient) GetIDTokenSigningAlg() (alg string) { + if c.IDTokenSigningAlg == "" { + c.IDTokenSigningAlg = SigningAlgRSAUsingSHA256 } - return c.UserinfoSigningAlgorithm + return c.IDTokenSigningAlg +} + +// GetUserinfoSigningAlg returns the UserinfoSigningAlg. +func (c *BaseClient) GetUserinfoSigningAlg() string { + if c.UserinfoSigningAlg == "" { + c.UserinfoSigningAlg = SigningAlgNone + } + + return c.UserinfoSigningAlg } // GetPAREnforcement returns EnforcePAR. @@ -295,7 +305,7 @@ func (c *FullClient) GetTokenEndpointAuthMethod() string { if c.Public { c.TokenEndpointAuthMethod = ClientAuthMethodNone } else { - c.TokenEndpointAuthMethod = ClientAuthMethodClientSecretPost + c.TokenEndpointAuthMethod = ClientAuthMethodClientSecretBasic } } diff --git a/internal/oidc/client_test.go b/internal/oidc/client_test.go index ece18b278..814c42a3c 100644 --- a/internal/oidc/client_test.go +++ b/internal/oidc/client_test.go @@ -3,6 +3,7 @@ package oidc import ( "fmt" "testing" + "time" "github.com/ory/fosite" "github.com/stretchr/testify/assert" @@ -26,8 +27,8 @@ func TestNewClient(t *testing.T) { bclient, ok := client.(*BaseClient) require.True(t, ok) - assert.Equal(t, "", bclient.UserinfoSigningAlgorithm) - assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlgorithm()) + assert.Equal(t, "", bclient.UserinfoSigningAlg) + assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlg()) _, ok = client.(*FullClient) assert.False(t, ok) @@ -51,7 +52,7 @@ func TestNewClient(t *testing.T) { assert.Equal(t, authorization.TwoFactor, client.GetAuthorizationPolicy()) config = schema.OpenIDConnectClientConfiguration{ - TokenEndpointAuthMethod: ClientAuthMethodClientSecretBasic, + TokenEndpointAuthMethod: ClientAuthMethodClientSecretPost, } client = NewClient(config) @@ -61,18 +62,51 @@ func TestNewClient(t *testing.T) { var niljwks *jose.JSONWebKeySet require.True(t, ok) - assert.Equal(t, "", fclient.UserinfoSigningAlgorithm) - assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.TokenEndpointAuthMethod) - assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.GetTokenEndpointAuthMethod()) - assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlgorithm()) + + assert.Equal(t, "", fclient.UserinfoSigningAlg) + assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlg()) + assert.Equal(t, SigningAlgNone, fclient.UserinfoSigningAlg) + + assert.Equal(t, "", fclient.IDTokenSigningAlg) + assert.Equal(t, SigningAlgRSAUsingSHA256, client.GetIDTokenSigningAlg()) + assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.IDTokenSigningAlg) + + assert.Equal(t, ClientAuthMethodClientSecretPost, fclient.TokenEndpointAuthMethod) + assert.Equal(t, ClientAuthMethodClientSecretPost, fclient.GetTokenEndpointAuthMethod()) + assert.Equal(t, "", fclient.TokenEndpointAuthSigningAlgorithm) assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.GetTokenEndpointAuthSigningAlgorithm()) + assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.TokenEndpointAuthSigningAlgorithm) + assert.Equal(t, "", fclient.RequestObjectSigningAlgorithm) assert.Equal(t, "", fclient.GetRequestObjectSigningAlgorithm()) + + fclient.RequestObjectSigningAlgorithm = SigningAlgRSAUsingSHA256 + assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.GetRequestObjectSigningAlgorithm()) + assert.Equal(t, "", fclient.JSONWebKeysURI) assert.Equal(t, "", fclient.GetJSONWebKeysURI()) + + fclient.JSONWebKeysURI = "https://example.com" + assert.Equal(t, "https://example.com", fclient.GetJSONWebKeysURI()) + assert.Equal(t, niljwks, fclient.JSONWebKeys) assert.Equal(t, niljwks, fclient.GetJSONWebKeys()) + + assert.Equal(t, ClientConsentMode(0), fclient.Consent.Mode) + assert.Equal(t, time.Second*0, fclient.Consent.Duration) + assert.Equal(t, ClientConsent{Mode: ClientConsentModeExplicit}, fclient.GetConsentPolicy()) + + fclient.TokenEndpointAuthMethod = "" + fclient.Public = false + assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.GetTokenEndpointAuthMethod()) + assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.TokenEndpointAuthMethod) + + fclient.TokenEndpointAuthMethod = "" + fclient.Public = true + assert.Equal(t, ClientAuthMethodNone, fclient.GetTokenEndpointAuthMethod()) + assert.Equal(t, ClientAuthMethodNone, fclient.TokenEndpointAuthMethod) + assert.Equal(t, []string(nil), fclient.RequestURIs) assert.Equal(t, []string(nil), fclient.GetRequestURIs()) } diff --git a/internal/oidc/const_test.go b/internal/oidc/const_test.go index 0208df15f..73441b964 100644 --- a/internal/oidc/const_test.go +++ b/internal/oidc/const_test.go @@ -1,24 +1,29 @@ package oidc import ( + "crypto/ecdsa" + "crypto/ed25519" "crypto/rsa" "crypto/x509" - "encoding/pem" + "fmt" "net/url" + "os" + "strings" "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/utils" ) const ( - myclient = "myclient" - myclientdesc = "My Client" - onefactor = "one_factor" - twofactor = "two_factor" - examplecom = "https://example.com" - examplecomsid = "example.com" - badsecret = "$plaintext$a_bad_secret" - badhmac = "asbdhaaskmdlkamdklasmdlkams" - exampleIssuerPrivateKey = "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAvcMVMB2vEbqI6PlSNJ4HmUyMxBDJ5iY7FS+zDDAHOZBg9S3S\nKcAn1CZcnyL0VvJ7wcdhR6oTnOwR94eKvzUyJZ+GL2hTMm27dubEYsNdhoCl6N3X\nyEEohNfoxiiCYraVauX8X3M9jFzbEz9+pacaDbHB2syaJ1qFmMNR+HSu2jPzOo7M\nlqKIOgUzA0741MaYNt47AEVg4XU5ORLdolbAkItmYg1QbyFndg9H5IvwKkYaXTGE\nlgDBcPUC0yVjAC15Mguquq+jZeQay+6PSbHTD8PQMOkLjyChI2xEhVNbdCXe676R\ncMW2R/gjrcK23zmtmTWRfdC1iZLSlHO+bJj9vQIDAQABAoIBAEZvkP/JJOCJwqPn\nV3IcbmmilmV4bdi1vByDFgyiDyx4wOSA24+PubjvfFW9XcCgRPuKjDtTj/AhWBHv\nB7stfa2lZuNV7/u562mZArA+IAr62Zp0LdIxDV8x3T8gbjVB3HhPYbv0RJZDKTYd\nzV6jhfIrVu9mHpoY6ZnodhapCPYIyk/d49KBIHZuAc25CUjMXgTeaVtf0c996036\nUxW6ef33wAOJAvW0RCvbXAJfmBeEq2qQlkjTIlpYx71fhZWexHifi8Ouv3Zonc+1\n/P2Adq5uzYVBT92f9RKHg9QxxNzVrLjSMaxyvUtWQCAQfW0tFIRdqBGsHYsQrFtI\nF4yzv8ECgYEA7ntpyN9HD9Z9lYQzPCR73sFCLM+ID99aVij0wHuxK97bkSyyvkLd\n7MyTaym3lg1UEqWNWBCLvFULZx7F0Ah6qCzD4ymm3Bj/ADpWWPgljBI0AFml+HHs\nhcATmXUrj5QbLyhiP2gmJjajp1o/rgATx6ED66seSynD6JOH8wUhhZUCgYEAy7OA\n06PF8GfseNsTqlDjNF0K7lOqd21S0prdwrsJLiVzUlfMM25MLE0XLDUutCnRheeh\nIlcuDoBsVTxz6rkvFGD74N+pgXlN4CicsBq5ofK060PbqCQhSII3fmHobrZ9Cr75\nHmBjAxHx998SKaAAGbBbcYGUAp521i1pH5CEPYkCgYEAkUd1Zf0+2RMdZhwm6hh/\nrW+l1I6IoMK70YkZsLipccRNld7Y9LbfYwYtODcts6di9AkOVfueZJiaXbONZfIE\nZrb+jkAteh9wGL9xIrnohbABJcV3Kiaco84jInUSmGDtPokncOENfHIEuEpuSJ2b\nbx1TuhmAVuGWivR0+ULC7RECgYEAgS0cDRpWc9Xzh9Cl7+PLsXEvdWNpPsL9OsEq\n0Ep7z9+/+f/jZtoTRCS/BTHUpDvAuwHglT5j3p5iFMt5VuiIiovWLwynGYwrbnNS\nqfrIrYKUaH1n1oDS+oBZYLQGCe9/7EifAjxtjYzbvSyg//SPG7tSwfBCREbpZXj2\nqSWkNsECgYA/mCDzCTlrrWPuiepo6kTmN+4TnFA+hJI6NccDVQ+jvbqEdoJ4SW4L\nzqfZSZRFJMNpSgIqkQNRPJqMP0jQ5KRtJrjMWBnYxktwKz9fDg2R2MxdFgMF2LH2\nHEMMhFHlv8NDjVOXh1KwRoltNGVWYsSrD9wKU9GhRCEfmNCGrvBcEg==\n-----END RSA PRIVATE KEY-----" + pathCrypto = "../configuration/test_resources/crypto/%s.%s" + myclient = "myclient" + myclientdesc = "My Client" + onefactor = "one_factor" + twofactor = "two_factor" + examplecom = "https://example.com" + examplecomsid = "example.com" + badsecret = "$plaintext$a_bad_secret" + badhmac = "asbdhaaskmdlkamdklasmdlkams" ) func MustDecodeSecret(value string) *schema.PasswordDigest { @@ -37,20 +42,126 @@ func MustParseRequestURI(input string) *url.URL { } } -func MustParseRSAPrivateKey(data string) *rsa.PrivateKey { - block, _ := pem.Decode([]byte(data)) - if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { - panic("not pem encoded") +func MustLoadCrypto(alg, mod, ext string, extra ...string) any { + fparts := []string{alg, mod} + if len(extra) != 0 { + fparts = append(fparts, extra...) } - if block.Type != "RSA PRIVATE KEY" { - panic("not private key") - } + var ( + data []byte + decoded any + err error + ) - key, err := x509.ParsePKCS1PrivateKey(block.Bytes) - if err != nil { + if data, err = os.ReadFile(fmt.Sprintf(pathCrypto, strings.Join(fparts, "_"), ext)); err != nil { panic(err) } + if decoded, err = utils.ParseX509FromPEMRecursive(data); err != nil { + panic(err) + } + + return decoded +} + +func MustLoadCertificateChain(alg, op string) schema.X509CertificateChain { + decoded := MustLoadCrypto(alg, op, "crt") + + switch cert := decoded.(type) { + case *x509.Certificate: + return schema.NewX509CertificateChainFromCerts([]*x509.Certificate{cert}) + case []*x509.Certificate: + return schema.NewX509CertificateChainFromCerts(cert) + default: + panic(fmt.Errorf("the key was not a *x509.Certificate or []*x509.Certificate, it's a %T", cert)) + } +} + +func MustLoadCertificate(alg, op string) *x509.Certificate { + decoded := MustLoadCrypto(alg, op, "crt") + + cert, ok := decoded.(*x509.Certificate) + if !ok { + panic(fmt.Errorf("the key was not a *x509.Certificate, it's a %T", cert)) + } + + return cert +} + +func MustLoadEd15519PrivateKey(curve string, extra ...string) ed25519.PrivateKey { + decoded := MustLoadCrypto("ED25519", curve, "pem", extra...) + + key, ok := decoded.(ed25519.PrivateKey) + if !ok { + panic(fmt.Errorf("the key was not a ed25519.PrivateKey, it's a %T", key)) + } + return key } + +func MustLoadECDSAPrivateKey(curve string, extra ...string) *ecdsa.PrivateKey { + decoded := MustLoadCrypto("ECDSA", curve, "pem", extra...) + + key, ok := decoded.(*ecdsa.PrivateKey) + if !ok { + panic(fmt.Errorf("the key was not a *ecdsa.PrivateKey, it's a %T", key)) + } + + return key +} + +func MustLoadRSAPublicKey(bits string, extra ...string) *rsa.PublicKey { + decoded := MustLoadCrypto("RSA", bits, "pem", extra...) + + key, ok := decoded.(*rsa.PublicKey) + if !ok { + panic(fmt.Errorf("the key was not a *rsa.PublicKey, it's a %T", key)) + } + + return key +} + +func MustLoadRSAPrivateKey(bits string, extra ...string) *rsa.PrivateKey { + decoded := MustLoadCrypto("RSA", bits, "pem", extra...) + + key, ok := decoded.(*rsa.PrivateKey) + if !ok { + panic(fmt.Errorf("the key was not a *rsa.PrivateKey, it's a %T", key)) + } + + return key +} + +var ( + tOpenIDConnectPBKDF2ClientSecret, tOpenIDConnectPlainTextClientSecret *schema.PasswordDigest + + // Standard RSA key / certificate pairs. + keyRSA1024, keyRSA2048, keyRSA4096 *rsa.PrivateKey + certRSA1024, certRSA2048, certRSA4096 schema.X509CertificateChain + + // Standard ECDSA key / certificate pairs. + keyECDSAP224, keyECDSAP256, keyECDSAP384, keyECDSAP521 *ecdsa.PrivateKey + certECDSAP224, certECDSAP256, certECDSAP384, certECDSAP521 schema.X509CertificateChain +) + +func init() { + tOpenIDConnectPBKDF2ClientSecret = MustDecodeSecret("$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng") + tOpenIDConnectPlainTextClientSecret = MustDecodeSecret("$plaintext$example") + + keyRSA1024 = MustLoadRSAPrivateKey("1024") + keyRSA2048 = MustLoadRSAPrivateKey("2048") + keyRSA4096 = MustLoadRSAPrivateKey("4096") + keyECDSAP224 = MustLoadECDSAPrivateKey("P224") + keyECDSAP256 = MustLoadECDSAPrivateKey("P256") + keyECDSAP384 = MustLoadECDSAPrivateKey("P384") + keyECDSAP521 = MustLoadECDSAPrivateKey("P521") + + certRSA1024 = MustLoadCertificateChain("RSA", "1024") + certRSA2048 = MustLoadCertificateChain("RSA", "2048") + certRSA4096 = MustLoadCertificateChain("RSA", "4096") + certECDSAP224 = MustLoadCertificateChain("ECDSA", "P224") + certECDSAP256 = MustLoadCertificateChain("ECDSA", "P256") + certECDSAP384 = MustLoadCertificateChain("ECDSA", "P384") + certECDSAP521 = MustLoadCertificateChain("ECDSA", "P521") +} diff --git a/internal/oidc/core_strategy_hmac_test.go b/internal/oidc/core_strategy_hmac_test.go index d390d4bdb..57dc6a038 100644 --- a/internal/oidc/core_strategy_hmac_test.go +++ b/internal/oidc/core_strategy_hmac_test.go @@ -1,13 +1,93 @@ package oidc import ( + "context" "fmt" + "regexp" "strings" "testing" + "time" + "github.com/ory/fosite" + "github.com/ory/fosite/token/hmac" "github.com/stretchr/testify/assert" ) +func TestHMACStrategy(t *testing.T) { + goodsecret := []byte("R7VCSUfnKc7Y5zE84q6GstYqfMGjL4wM") + secreta := []byte("a") + + config := &Config{ + TokenEntropy: 10, + GlobalSecret: secreta, + Lifespans: LifespanConfig{ + AccessToken: time.Hour, + RefreshToken: time.Hour, + AuthorizeCode: time.Minute, + }, + } + + strategy := &HMACCoreStrategy{ + Enigma: &hmac.HMACStrategy{Config: config}, + Config: config, + } + + var ( + token, signature string + err error + ) + + ctx := context.Background() + + token, signature, err = strategy.GenerateAuthorizeCode(ctx, &fosite.Request{}) + assert.EqualError(t, err, "secret for signing HMAC-SHA512/256 is expected to be 32 byte long, got 1 byte") + assert.Empty(t, token) + assert.Empty(t, signature) + + config.GlobalSecret = goodsecret + + token, signature, err = strategy.GenerateAuthorizeCode(ctx, &fosite.Request{}) + assert.NoError(t, err) + + assert.NotEmpty(t, token) + assert.NotEmpty(t, signature) + assert.Equal(t, signature, strategy.AuthorizeCodeSignature(ctx, token)) + assert.Regexp(t, regexp.MustCompile(`^authelia_ac_`), token) + + assert.NoError(t, strategy.ValidateAuthorizeCode(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{}}, token)) + assert.NoError(t, strategy.ValidateAuthorizeCode(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{}}, token)) + assert.EqualError(t, strategy.ValidateAuthorizeCode(ctx, &fosite.Request{RequestedAt: time.Now().Add(time.Hour * -2400), Session: &fosite.DefaultSession{}}, token), "invalid_token") + assert.NoError(t, strategy.ValidateAuthorizeCode(ctx, &fosite.Request{RequestedAt: time.Now().Add(time.Hour * -2400), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.AuthorizeCode: time.Now().Add(100 * time.Hour)}}}, token)) + assert.EqualError(t, strategy.ValidateAuthorizeCode(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.AuthorizeCode: time.Now().Add(-100 * time.Second)}}}, token), "invalid_token") + + token, signature, err = strategy.GenerateRefreshToken(ctx, &fosite.Request{}) + assert.NoError(t, err) + + assert.NotEmpty(t, token) + assert.NotEmpty(t, signature) + assert.Equal(t, signature, strategy.RefreshTokenSignature(ctx, token)) + assert.Regexp(t, regexp.MustCompile(`^authelia_rt_`), token) + + assert.NoError(t, strategy.ValidateRefreshToken(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{}}, token)) + assert.NoError(t, strategy.ValidateRefreshToken(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{}}, token)) + assert.NoError(t, strategy.ValidateRefreshToken(ctx, &fosite.Request{RequestedAt: time.Now().Add(time.Hour * -2400), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.RefreshToken: time.Now().Add(100 * time.Hour)}}}, token)) + assert.EqualError(t, strategy.ValidateRefreshToken(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.RefreshToken: time.Now().Add(-100 * time.Second)}}}, token), "invalid_token") + + token, signature, err = strategy.GenerateAccessToken(ctx, &fosite.Request{}) + assert.NoError(t, err) + + assert.NotEmpty(t, token) + assert.NotEmpty(t, signature) + assert.Equal(t, signature, strategy.AccessTokenSignature(ctx, token)) + assert.Regexp(t, regexp.MustCompile(`^authelia_at_`), token) + + assert.NoError(t, strategy.ValidateAccessToken(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{}}, token)) + assert.NoError(t, strategy.ValidateAccessToken(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{}}, token)) + assert.EqualError(t, strategy.ValidateAccessToken(ctx, &fosite.Request{RequestedAt: time.Now().Add(time.Hour * -2400), Session: &fosite.DefaultSession{}}, token), "invalid_token") + assert.NoError(t, strategy.ValidateAccessToken(ctx, &fosite.Request{RequestedAt: time.Now().Add(time.Hour * -2400), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.AccessToken: time.Now().Add(100 * time.Hour)}}}, token)) + assert.EqualError(t, strategy.ValidateAccessToken(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.AccessToken: time.Now().Add(-100 * time.Second)}}}, token), "invalid_token") +} + func TestHMACCoreStrategy_TrimPrefix(t *testing.T) { testCases := []struct { name string diff --git a/internal/oidc/discovery.go b/internal/oidc/discovery.go index 7ce180fbf..5410e36ad 100644 --- a/internal/oidc/discovery.go +++ b/internal/oidc/discovery.go @@ -1,7 +1,10 @@ package oidc import ( + "sort" + "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/utils" ) // NewOpenIDConnectWellKnownConfiguration generates a new OpenIDConnectWellKnownConfiguration. @@ -75,6 +78,21 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration CodeChallengeMethodsSupported: []string{ PKCEChallengeMethodSHA256, }, + RevocationEndpointAuthMethodsSupported: []string{ + ClientAuthMethodClientSecretBasic, + ClientAuthMethodClientSecretPost, + ClientAuthMethodClientSecretJWT, + ClientAuthMethodNone, + }, + RevocationEndpointAuthSigningAlgValuesSupported: []string{ + SigningAlgHMACUsingSHA256, + SigningAlgHMACUsingSHA384, + SigningAlgHMACUsingSHA512, + }, + IntrospectionEndpointAuthMethodsSupported: []string{ + ClientAuthMethodClientSecretBasic, + ClientAuthMethodNone, + }, }, OAuth2PushedAuthorizationDiscoveryOptions: &OAuth2PushedAuthorizationDiscoveryOptions{ RequirePushedAuthorizationRequests: c.PAR.Enforce, @@ -89,6 +107,10 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration SigningAlgNone, SigningAlgRSAUsingSHA256, }, + RequestObjectSigningAlgValuesSupported: []string{ + SigningAlgNone, + SigningAlgRSAUsingSHA256, + }, }, OpenIDConnectFrontChannelLogoutDiscoveryOptions: &OpenIDConnectFrontChannelLogoutDiscoveryOptions{}, OpenIDConnectBackChannelLogoutDiscoveryOptions: &OpenIDConnectBackChannelLogoutDiscoveryOptions{}, @@ -100,6 +122,26 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration }, } + algs := make([]string, len(c.Discovery.RegisteredJWKSigningAlgs)) + + copy(algs, c.Discovery.RegisteredJWKSigningAlgs) + + for _, alg := range algs { + if !utils.IsStringInSlice(alg, config.IDTokenSigningAlgValuesSupported) { + config.IDTokenSigningAlgValuesSupported = append(config.IDTokenSigningAlgValuesSupported, alg) + } + + if !utils.IsStringInSlice(alg, config.UserinfoSigningAlgValuesSupported) { + config.UserinfoSigningAlgValuesSupported = append(config.UserinfoSigningAlgValuesSupported, alg) + } + } + + sort.Sort(SortedSigningAlgs(config.IDTokenSigningAlgValuesSupported)) + sort.Sort(SortedSigningAlgs(config.UserinfoSigningAlgValuesSupported)) + sort.Sort(SortedSigningAlgs(config.RequestObjectSigningAlgValuesSupported)) + sort.Sort(SortedSigningAlgs(config.RevocationEndpointAuthSigningAlgValuesSupported)) + sort.Sort(SortedSigningAlgs(config.TokenEndpointAuthSigningAlgValuesSupported)) + if c.EnablePKCEPlainChallenge { config.CodeChallengeMethodsSupported = append(config.CodeChallengeMethodsSupported, PKCEChallengeMethodPlain) } diff --git a/internal/oidc/discovery_test.go b/internal/oidc/discovery_test.go index 34ca1f732..b3d880f84 100644 --- a/internal/oidc/discovery_test.go +++ b/internal/oidc/discovery_test.go @@ -14,8 +14,9 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { pkcePlainChallenge bool enforcePAR bool clients map[string]Client + discovery schema.OpenIDConnectDiscovery - expectCodeChallengeMethodsSupported, expectSubjectTypesSupported []string + expectCodeChallengeMethodsSupported, expectSubjectTypesSupported, expectedIDTokenSigAlgsSupported, expectedUserInfoSigAlgsSupported []string }{ { desc: "ShouldHaveChallengeMethodsS256ANDSubjectTypesSupportedPublic", @@ -23,6 +24,20 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { clients: map[string]Client{"a": &BaseClient{}}, expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256}, expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + }, + { + desc: "ShouldIncludDiscoveryInfo", + pkcePlainChallenge: false, + clients: map[string]Client{"a": &BaseClient{}}, + discovery: schema.OpenIDConnectDiscovery{ + RegisteredJWKSigningAlgs: []string{SigningAlgECDSAUsingP521AndSHA512}, + }, + expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256}, + expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgECDSAUsingP521AndSHA512}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgECDSAUsingP521AndSHA512, SigningAlgNone}, }, { desc: "ShouldHaveChallengeMethodsS256PlainANDSubjectTypesSupportedPublic", @@ -30,6 +45,8 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { clients: map[string]Client{"a": &BaseClient{}}, expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, }, { desc: "ShouldHaveChallengeMethodsS256ANDSubjectTypesSupportedPublicPairwise", @@ -37,6 +54,8 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { clients: map[string]Client{"a": &BaseClient{SectorIdentifier: "yes"}}, expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256}, expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, }, { desc: "ShouldHaveChallengeMethodsS256PlainANDSubjectTypesSupportedPublicPairwise", @@ -44,6 +63,8 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { clients: map[string]Client{"a": &BaseClient{SectorIdentifier: "yes"}}, expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, }, { desc: "ShouldHaveTokenAuthMethodsNone", @@ -51,6 +72,8 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { clients: map[string]Client{"a": &BaseClient{SectorIdentifier: "yes"}}, expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, }, { desc: "ShouldHaveTokenAuthMethodsNone", @@ -61,6 +84,20 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { }, expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + }, + { + desc: "ShouldHaveTokenAuthMethodsNone", + pkcePlainChallenge: true, + clients: map[string]Client{ + "a": &BaseClient{SectorIdentifier: "yes"}, + "b": &BaseClient{SectorIdentifier: "yes"}, + }, + expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, + expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, }, } @@ -71,6 +108,7 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { PAR: schema.OpenIDConnectPARConfiguration{ Enforce: tc.enforcePAR, }, + Discovery: tc.discovery, } actual := NewOpenIDConnectWellKnownConfiguration(&c) @@ -89,6 +127,9 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { for _, subjectType := range actual.SubjectTypesSupported { assert.Contains(t, tc.expectSubjectTypesSupported, subjectType) } + + assert.Equal(t, tc.expectedUserInfoSigAlgsSupported, actual.UserinfoSigningAlgValuesSupported) + assert.Equal(t, tc.expectedIDTokenSigAlgsSupported, actual.IDTokenSigningAlgValuesSupported) }) } } diff --git a/internal/oidc/keys.go b/internal/oidc/keys.go index 3ca47d414..fa367fd41 100644 --- a/internal/oidc/keys.go +++ b/internal/oidc/keys.go @@ -3,181 +3,398 @@ package oidc import ( "context" "crypto" + "crypto/ecdsa" "crypto/rsa" "errors" "fmt" + "sort" "strings" - "github.com/ory/fosite/token/jwt" + "github.com/golang-jwt/jwt/v4" + fjwt "github.com/ory/fosite/token/jwt" + "github.com/ory/x/errorsx" + "gopkg.in/square/go-jose.v2" "github.com/authelia/authelia/v4/internal/configuration/schema" ) -// NewKeyManagerWithConfiguration when provided a schema.OpenIDConnectConfiguration creates a new KeyManager and adds an -// initial key to the manager. -func NewKeyManagerWithConfiguration(config *schema.OpenIDConnectConfiguration) (manager *KeyManager, err error) { - manager = NewKeyManager() +// NewKeyManager news up a KeyManager. +func NewKeyManager(config *schema.OpenIDConnectConfiguration) (manager *KeyManager) { + manager = &KeyManager{ + kids: map[string]*JWK{}, + algs: map[string]*JWK{}, + } - if _, err = manager.AddActiveJWK(config.IssuerCertificateChain, config.IssuerPrivateKey); err != nil { + for _, sjwk := range config.IssuerJWKS { + jwk := NewJWK(sjwk) + + manager.kids[sjwk.KeyID] = jwk + manager.algs[jwk.alg.Alg()] = jwk + + if jwk.kid == config.Discovery.DefaultKeyID { + manager.kid = jwk.kid + } + } + + return manager +} + +// The KeyManager type handles JWKs and signing operations. +type KeyManager struct { + kid string + kids map[string]*JWK + algs map[string]*JWK +} + +func (m *KeyManager) GetKIDFromAlgStrict(ctx context.Context, alg string) (kid string, err error) { + if jwks, ok := m.algs[alg]; ok { + return jwks.kid, nil + } + + return "", fmt.Errorf("alg not found") +} + +func (m *KeyManager) GetKIDFromAlg(ctx context.Context, alg string) string { + if jwks, ok := m.algs[alg]; ok { + return jwks.kid + } + + return m.kid +} + +func (m *KeyManager) GetByAlg(ctx context.Context, alg string) *JWK { + if jwk, ok := m.algs[alg]; ok { + return jwk + } + + return nil +} + +func (m *KeyManager) GetByKID(ctx context.Context, kid string) *JWK { + if kid == "" { + return m.kids[m.kid] + } + + if jwk, ok := m.kids[kid]; ok { + return jwk + } + + return nil +} + +func (m *KeyManager) GetByHeader(ctx context.Context, header fjwt.Mapper) (jwk *JWK, err error) { + var ( + kid string + ok bool + ) + + if header == nil { + return nil, fmt.Errorf("jwt header was nil") + } + + if kid, ok = header.Get(JWTHeaderKeyIdentifier).(string); !ok { + return nil, fmt.Errorf("jwt header did not have a kid") + } + + if jwk, ok = m.kids[kid]; !ok { + return nil, fmt.Errorf("jwt header '%s' with value '%s' does not match a managed jwk", JWTHeaderKeyIdentifier, kid) + } + + return jwk, nil +} + +func (m *KeyManager) GetByTokenString(ctx context.Context, tokenString string) (jwk *JWK, err error) { + var ( + token *jwt.Token + ) + + if token, _, err = jwt.NewParser().ParseUnverified(tokenString, jwt.MapClaims{}); err != nil { return nil, err } - return manager, nil + return m.GetByHeader(ctx, &fjwt.Headers{Extra: token.Header}) } -// NewKeyManager creates a new empty KeyManager. -func NewKeyManager() (manager *KeyManager) { - return &KeyManager{ - jwks: &jose.JSONWebKeySet{}, +func (m *KeyManager) Set(ctx context.Context) *jose.JSONWebKeySet { + keys := make([]jose.JSONWebKey, 0, len(m.kids)) + + for _, jwk := range m.kids { + keys = append(keys, jwk.JWK()) + } + + sort.Sort(SortedJSONWebKey(keys)) + + return &jose.JSONWebKeySet{ + Keys: keys, } } -// Strategy returns the fosite jwt.JWTStrategy. -func (m *KeyManager) Strategy() (strategy jwt.Signer) { - if m.jwk == nil { - return nil +func (m *KeyManager) Generate(ctx context.Context, claims fjwt.MapClaims, header fjwt.Mapper) (tokenString string, sig string, err error) { + var jwk *JWK + + if jwk, err = m.GetByHeader(ctx, header); err != nil { + return "", "", fmt.Errorf("error getting jwk from header: %w", err) } - return m.jwk.Strategy() + return jwk.Strategy().Generate(ctx, claims, header) } -// GetKeySet returns the joseJSONWebKeySet containing the rsa.PublicKey types. -func (m *KeyManager) GetKeySet() (jwks *jose.JSONWebKeySet) { - return m.jwks +func (m *KeyManager) Validate(ctx context.Context, tokenString string) (sig string, err error) { + var jwk *JWK + + if jwk, err = m.GetByTokenString(ctx, tokenString); err != nil { + return "", fmt.Errorf("error getting jwk from token string: %w", err) + } + + return jwk.Strategy().Validate(ctx, tokenString) } -// GetActiveJWK obtains the currently active jose.JSONWebKey. -func (m *KeyManager) GetActiveJWK() (jwk *jose.JSONWebKey, err error) { - if m.jwks == nil || m.jwk == nil { - return nil, errors.New("could not obtain the active JWK from an improperly configured key manager") - } - - jwks := m.jwks.Key(m.jwk.id) - - if len(jwks) == 1 { - return &jwks[0], nil - } - - if len(jwks) == 0 { - return nil, errors.New("could not find a key with the active key id") - } - - return nil, errors.New("multiple keys with the same key id") +func (m *KeyManager) Hash(ctx context.Context, in []byte) (sum []byte, err error) { + return m.GetByKID(ctx, "").Strategy().Hash(ctx, in) } -// GetActiveKeyID returns the key id of the currently active key. -func (m *KeyManager) GetActiveKeyID() (keyID string) { - if m.jwk == nil { - return "" +func (m *KeyManager) Decode(ctx context.Context, tokenString string) (token *fjwt.Token, err error) { + var jwk *JWK + + if jwk, err = m.GetByTokenString(ctx, tokenString); err != nil { + return nil, fmt.Errorf("error getting jwk from token string: %w", err) } - return m.jwk.id + return jwk.Strategy().Decode(ctx, tokenString) } -// GetActivePrivateKey returns the rsa.PrivateKey of the currently active key. -func (m *KeyManager) GetActivePrivateKey() (key *rsa.PrivateKey, err error) { - if m.jwk == nil { - return nil, errors.New("failed to retrieve active private key") +func (m *KeyManager) GetSignature(ctx context.Context, tokenString string) (sig string, err error) { + return getTokenSignature(tokenString) +} + +func (m *KeyManager) GetSigningMethodLength(ctx context.Context) (size int) { + return m.GetByKID(ctx, "").Strategy().GetSigningMethodLength(ctx) +} + +func NewJWK(s schema.JWK) (jwk *JWK) { + jwk = &JWK{ + kid: s.KeyID, + use: s.Use, + alg: jwt.GetSigningMethod(s.Algorithm), + key: s.Key.(schema.CryptographicPrivateKey), + + chain: s.CertificateChain, + thumbprint: s.CertificateChain.Thumbprint(crypto.SHA256), + thumbprintsha1: s.CertificateChain.Thumbprint(crypto.SHA1), } - return m.jwk.key, nil -} - -// AddActiveJWK is used to add a cert and key pair. -func (m *KeyManager) AddActiveJWK(chain schema.X509CertificateChain, key *rsa.PrivateKey) (jwk *JWK, err error) { - // TODO: Add a mutex when implementing key rotation to be utilized here and in methods which retrieve the JWK or JWKS. - if m.jwk, err = NewJWK(chain, key); err != nil { - return nil, err - } - - m.jwks.Keys = append(m.jwks.Keys, *m.jwk.JSONWebKey()) - - return m.jwk, nil -} - -// JWTStrategy is a decorator struct for the fosite jwt.JWTStrategy. -type JWTStrategy struct { - jwt.Signer - - id string -} - -// KeyID returns the key id. -func (s *JWTStrategy) KeyID() (id string) { - return s.id -} - -// GetPublicKeyID is a decorator func for the underlying fosite RS256JWTStrategy. -func (s *JWTStrategy) GetPublicKeyID(_ context.Context) (string, error) { - return s.id, nil -} - -// NewJWK creates a new JWK. -func NewJWK(chain schema.X509CertificateChain, key *rsa.PrivateKey) (j *JWK, err error) { - if key == nil { - return nil, fmt.Errorf("JWK is not properly initialized: missing key") - } - - j = &JWK{ - key: key, - chain: chain, - } - - jwk := &jose.JSONWebKey{ - Algorithm: SigningAlgRSAUsingSHA256, - Use: KeyUseSignature, - Key: &key.PublicKey, - } - - var thumbprint []byte - - if thumbprint, err = jwk.Thumbprint(crypto.SHA1); err != nil { - return nil, fmt.Errorf("failed to calculate SHA1 thumbprint for certificate: %w", err) - } - - j.id = strings.ToLower(fmt.Sprintf("%x", thumbprint)) - - if len(j.id) >= 7 { - j.id = j.id[:6] - } - - if len(j.id) >= 7 { - j.id = j.id[:6] - } - - return j, nil -} - -// JWK is a utility wrapper for JSON Web Key's. -type JWK struct { - id string - key *rsa.PrivateKey - chain schema.X509CertificateChain -} - -// Strategy returns the relevant jwt.JWTStrategy for this JWT. -func (j *JWK) Strategy() (strategy jwt.Signer) { - return &JWTStrategy{id: j.id, Signer: &jwt.DefaultSigner{GetPrivateKey: j.GetPrivateKey}} -} - -func (j *JWK) GetPrivateKey(ctx context.Context) (key any, err error) { - return j.key, nil -} - -// JSONWebKey returns the relevant *jose.JSONWebKey for this JWT. -func (j *JWK) JSONWebKey() (jwk *jose.JSONWebKey) { - jwk = &jose.JSONWebKey{ - Key: &j.key.PublicKey, - KeyID: j.id, - Algorithm: SigningAlgRSAUsingSHA256, - Use: KeyUseSignature, - Certificates: j.chain.Certificates(), - } - - if len(jwk.Certificates) != 0 { - jwk.CertificateThumbprintSHA1, jwk.CertificateThumbprintSHA256 = j.chain.Thumbprint(crypto.SHA1), j.chain.Thumbprint(crypto.SHA256) + switch jwk.alg { + case jwt.SigningMethodRS256, jwt.SigningMethodPS256, jwt.SigningMethodES256: + jwk.hash = crypto.SHA256 + case jwt.SigningMethodRS384, jwt.SigningMethodPS384, jwt.SigningMethodES384: + jwk.hash = crypto.SHA384 + case jwt.SigningMethodRS512, jwt.SigningMethodPS512, jwt.SigningMethodES512: + jwk.hash = crypto.SHA512 + default: + jwk.hash = crypto.SHA256 } return jwk } + +type JWK struct { + kid string + use string + alg jwt.SigningMethod + hash crypto.Hash + + key schema.CryptographicPrivateKey + chain schema.X509CertificateChain + thumbprintsha1 []byte + thumbprint []byte +} + +func (j *JWK) GetPrivateKey(ctx context.Context) (any, error) { + return j.PrivateJWK(), nil +} + +func (j *JWK) KeyID() string { + return j.kid +} + +func (j *JWK) PrivateJWK() (jwk *jose.JSONWebKey) { + return &jose.JSONWebKey{ + Key: j.key, + KeyID: j.kid, + Algorithm: j.alg.Alg(), + Use: j.use, + Certificates: j.chain.Certificates(), + CertificateThumbprintSHA1: j.thumbprintsha1, + CertificateThumbprintSHA256: j.thumbprint, + } +} + +func (j *JWK) JWK() (jwk jose.JSONWebKey) { + return j.PrivateJWK().Public() +} + +func (j *JWK) Strategy() (strategy fjwt.Signer) { + return &Signer{ + hash: j.hash, + alg: j.alg, + GetPrivateKey: j.GetPrivateKey, + } +} + +// Signer is responsible for generating and validating JWT challenges. +type Signer struct { + hash crypto.Hash + alg jwt.SigningMethod + + GetPrivateKey fjwt.GetPrivateKeyFunc +} + +func (j *Signer) GetPublicKey(ctx context.Context) (key crypto.PublicKey, err error) { + var k any + + if k, err = j.GetPrivateKey(ctx); err != nil { + return nil, err + } + + switch t := k.(type) { + case *jose.JSONWebKey: + return t.Public().Key, nil + case jose.OpaqueSigner: + return t.Public().Key, nil + case schema.CryptographicPrivateKey: + return t.Public(), nil + default: + return nil, errors.New("invalid private key type") + } +} + +// Generate generates a new authorize code or returns an error. set secret. +func (j *Signer) Generate(ctx context.Context, claims fjwt.MapClaims, header fjwt.Mapper) (tokenString string, sig string, err error) { + var key any + + if key, err = j.GetPrivateKey(ctx); err != nil { + return "", "", err + } + + switch t := key.(type) { + case *jose.JSONWebKey: + return generateToken(claims, header, j.alg, t.Key) + case jose.JSONWebKey: + return generateToken(claims, header, j.alg, t.Key) + case *rsa.PrivateKey, *ecdsa.PrivateKey: + return generateToken(claims, header, j.alg, t) + case jose.OpaqueSigner: + switch tt := t.Public().Key.(type) { + case *rsa.PrivateKey, *ecdsa.PrivateKey: + return generateToken(claims, header, j.alg, t) + default: + return "", "", fmt.Errorf("unsupported private / public key pairs: %T, %T", t, tt) + } + default: + return "", "", fmt.Errorf("unsupported private key type: %T", t) + } +} + +// Validate validates a token and returns its signature or an error if the token is not valid. +func (j *Signer) Validate(ctx context.Context, tokenString string) (sig string, err error) { + var ( + key crypto.PublicKey + ) + + if key, err = j.GetPublicKey(ctx); err != nil { + return "", err + } + + return validateToken(tokenString, key) +} + +// Decode will decode a JWT token. +func (j *Signer) Decode(ctx context.Context, tokenString string) (token *fjwt.Token, err error) { + var ( + key crypto.PublicKey + ) + + if key, err = j.GetPublicKey(ctx); err != nil { + return nil, err + } + + return decodeToken(tokenString, key) +} + +// GetSignature will return the signature of a token. +func (j *Signer) GetSignature(ctx context.Context, tokenString string) (sig string, err error) { + return getTokenSignature(tokenString) +} + +// Hash will return a given hash based on the byte input or an error upon fail. +func (j *Signer) Hash(ctx context.Context, in []byte) (sum []byte, err error) { + hash := j.hash.New() + + if _, err = hash.Write(in); err != nil { + return []byte{}, errorsx.WithStack(err) + } + + return hash.Sum([]byte{}), nil +} + +// GetSigningMethodLength will return the length of the signing method. +func (j *Signer) GetSigningMethodLength(ctx context.Context) (size int) { + return j.hash.Size() +} + +func generateToken(claims fjwt.MapClaims, header fjwt.Mapper, signingMethod jwt.SigningMethod, key any) (rawToken string, sig string, err error) { + if header == nil || claims == nil { + return "", "", errors.New("either claims or header is nil") + } + + token := jwt.NewWithClaims(signingMethod, claims) + + token.Header = assign(token.Header, header.ToMap()) + + if rawToken, err = token.SignedString(key); err != nil { + return "", "", err + } + + if sig, err = getTokenSignature(rawToken); err != nil { + return "", "", err + } + + return rawToken, sig, nil +} + +func decodeToken(tokenString string, key any) (token *fjwt.Token, err error) { + return fjwt.ParseWithClaims(tokenString, fjwt.MapClaims{}, func(*fjwt.Token) (any, error) { + return key, nil + }) +} + +func validateToken(tokenString string, key any) (sig string, err error) { + if _, err = decodeToken(tokenString, key); err != nil { + return "", err + } + + return getTokenSignature(tokenString) +} + +func getTokenSignature(tokenString string) (sig string, err error) { + parts := strings.Split(tokenString, ".") + + if len(parts) != 3 { + return "", errors.New("header, body and signature must all be set") + } + + return parts[2], nil +} + +func assign(a, b map[string]any) map[string]any { + for k, w := range b { + if _, ok := a[k]; ok { + continue + } + + a[k] = w + } + + return a +} diff --git a/internal/oidc/keys_test.go b/internal/oidc/keys_test.go index 0405227b3..70c86e418 100644 --- a/internal/oidc/keys_test.go +++ b/internal/oidc/keys_test.go @@ -1,48 +1,450 @@ package oidc import ( - "crypto" + "context" + "encoding/json" "fmt" - "strings" "testing" + fjwt "github.com/ory/fosite/token/jwt" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "gopkg.in/square/go-jose.v2" "github.com/authelia/authelia/v4/internal/configuration/schema" ) -func TestKeyManager_AddActiveJWK(t *testing.T) { - manager := NewKeyManager() - assert.Nil(t, manager.jwk) - assert.Nil(t, manager.Strategy()) +func TestKeyManager(t *testing.T) { + config := &schema.OpenIDConnectConfiguration{ + Discovery: schema.OpenIDConnectDiscovery{ + DefaultKeyID: "kid-RS256-sig", + }, + IssuerJWKS: []schema.JWK{ + { + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA256, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA384, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA512, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA256, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA384, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA512, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgECDSAUsingP256AndSHA256, + Key: keyECDSAP256, + CertificateChain: certECDSAP256, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgECDSAUsingP384AndSHA384, + Key: keyECDSAP384, + CertificateChain: certECDSAP384, + }, + { + Use: KeyUseSignature, + Algorithm: SigningAlgECDSAUsingP521AndSHA512, + Key: keyECDSAP521, + CertificateChain: certECDSAP521, + }, + }, + } - j, err := manager.AddActiveJWK(schema.X509CertificateChain{}, MustParseRSAPrivateKey(exampleIssuerPrivateKey)) - require.NoError(t, err) - require.NotNil(t, j) - require.NotNil(t, manager.jwk) - require.NotNil(t, manager.Strategy()) + for i, key := range config.IssuerJWKS { + config.IssuerJWKS[i].KeyID = fmt.Sprintf("kid-%s-%s", key.Algorithm, key.Use) + } - thumbprint, err := j.JSONWebKey().Thumbprint(crypto.SHA1) + manager := NewKeyManager(config) + + assert.NotNil(t, manager) + + assert.Len(t, manager.kids, len(config.IssuerJWKS)) + assert.Len(t, manager.algs, len(config.IssuerJWKS)) + + assert.Equal(t, "kid-RS256-sig", manager.kid) + + ctx := context.Background() + + var ( + jwk *JWK + err error + ) + + jwk = manager.GetByAlg(ctx, "notalg") + assert.Nil(t, jwk) + + jwk = manager.GetByKID(ctx, "notalg") + assert.Nil(t, jwk) + + jwk = manager.GetByKID(ctx, "") + assert.NotNil(t, jwk) + assert.Equal(t, config.Discovery.DefaultKeyID, jwk.KeyID()) + + jwk, err = manager.GetByHeader(ctx, &fjwt.Headers{Extra: map[string]any{JWTHeaderKeyIdentifier: "notalg"}}) + assert.EqualError(t, err, "jwt header 'kid' with value 'notalg' does not match a managed jwk") + assert.Nil(t, jwk) + + jwk, err = manager.GetByHeader(ctx, &fjwt.Headers{Extra: map[string]any{}}) + assert.EqualError(t, err, "jwt header did not have a kid") + assert.Nil(t, jwk) + + jwk, err = manager.GetByHeader(ctx, nil) + assert.EqualError(t, err, "jwt header was nil") + assert.Nil(t, jwk) + + kid, err := manager.GetKIDFromAlgStrict(ctx, "notalg") + assert.EqualError(t, err, "alg not found") + assert.Equal(t, "", kid) + + kid = manager.GetKIDFromAlg(ctx, "notalg") + assert.Equal(t, config.Discovery.DefaultKeyID, kid) + + set := manager.Set(ctx) + + assert.NotNil(t, set) + assert.Len(t, set.Keys, len(config.IssuerJWKS)) + + data, err := json.Marshal(&set) assert.NoError(t, err) + assert.NotNil(t, data) - kid := strings.ToLower(fmt.Sprintf("%x", thumbprint)[:6]) - assert.Equal(t, manager.jwk.id, kid) - assert.Equal(t, kid, j.JSONWebKey().KeyID) - assert.Len(t, manager.jwks.Keys, 1) + out := jose.JSONWebKeySet{} + assert.NoError(t, json.Unmarshal(data, &out)) + assert.Equal(t, *set, out) - keys := manager.jwks.Key(kid) - assert.Equal(t, keys[0].KeyID, kid) + for _, alg := range []string{SigningAlgRSAUsingSHA256, SigningAlgRSAUsingSHA384, SigningAlgRSAPSSUsingSHA512, SigningAlgRSAPSSUsingSHA256, SigningAlgRSAPSSUsingSHA384, SigningAlgRSAPSSUsingSHA512, SigningAlgECDSAUsingP256AndSHA256, SigningAlgECDSAUsingP384AndSHA384, SigningAlgECDSAUsingP521AndSHA512} { + t.Run(alg, func(t *testing.T) { + expectedKID := fmt.Sprintf("kid-%s-%s", alg, KeyUseSignature) - privKey, err := manager.GetActivePrivateKey() - assert.NoError(t, err) - assert.NotNil(t, privKey) + t.Run("ShouldGetCorrectKey", func(t *testing.T) { + jwk = manager.GetByKID(ctx, expectedKID) + assert.NotNil(t, jwk) + assert.Equal(t, expectedKID, jwk.KeyID()) - webKey, err := manager.GetActiveJWK() - assert.NoError(t, err) - assert.NotNil(t, webKey) + jwk = manager.GetByAlg(ctx, alg) + assert.NotNil(t, jwk) - keySet := manager.GetKeySet() - assert.NotNil(t, keySet) - assert.Equal(t, kid, manager.GetActiveKeyID()) + assert.Equal(t, alg, jwk.alg.Alg()) + assert.Equal(t, expectedKID, jwk.KeyID()) + + kid, err = manager.GetKIDFromAlgStrict(ctx, alg) + assert.NoError(t, err) + assert.Equal(t, expectedKID, kid) + + kid = manager.GetKIDFromAlg(ctx, alg) + assert.Equal(t, expectedKID, kid) + + jwk, err = manager.GetByHeader(ctx, &fjwt.Headers{Extra: map[string]any{JWTHeaderKeyIdentifier: expectedKID}}) + assert.NoError(t, err) + assert.NotNil(t, jwk) + + assert.Equal(t, expectedKID, jwk.KeyID()) + }) + + t.Run("ShouldUseCorrectSigner", func(t *testing.T) { + var tokenString, sig, sigb string + var token *fjwt.Token + + tokenString, sig, err = manager.Generate(ctx, fjwt.MapClaims{}, &fjwt.Headers{Extra: map[string]any{JWTHeaderKeyIdentifier: expectedKID}}) + assert.NoError(t, err) + + sigb, err = manager.GetSignature(ctx, tokenString) + assert.NoError(t, err) + assert.Equal(t, sig, sigb) + + sigb, err = manager.Validate(ctx, tokenString) + assert.NoError(t, err) + assert.Equal(t, sig, sigb) + + token, err = manager.Decode(ctx, tokenString) + assert.NoError(t, err) + assert.Equal(t, expectedKID, token.Header[JWTHeaderKeyIdentifier]) + + jwk, err = manager.GetByTokenString(ctx, tokenString) + + assert.NoError(t, err) + + sigb, err = jwk.Strategy().Validate(ctx, tokenString) + assert.NoError(t, err) + assert.Equal(t, sig, sigb) + }) + }) + } +} + +func TestJWKFunctionality(t *testing.T) { + testCases := []struct { + have schema.JWK + }{ + { + schema.JWK{ + KeyID: "rsa2048-rs256", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA256, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + }, + { + schema.JWK{ + KeyID: "rsa2048-rs384", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA384, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + }, + { + schema.JWK{ + KeyID: "rsa2048-rs512", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA512, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + }, + { + schema.JWK{ + KeyID: "rsa4096-rs256", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA256, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + }, + { + schema.JWK{ + KeyID: "rsa4096-rs384", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA384, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + }, + { + schema.JWK{ + KeyID: "rsa4096-rs512", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAUsingSHA512, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + }, + { + schema.JWK{ + KeyID: "rsa2048-rs256", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA256, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + }, + { + schema.JWK{ + KeyID: "rsa2048-ps384", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA384, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + }, + { + schema.JWK{ + KeyID: "rsa2048-ps512", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA512, + Key: keyRSA2048, + CertificateChain: certRSA2048, + }, + }, + { + schema.JWK{ + KeyID: "rsa4096-ps256", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA256, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + }, + { + schema.JWK{ + KeyID: "rsa4096-ps384", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA384, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + }, + { + schema.JWK{ + KeyID: "rsa4096-ps512", + Use: KeyUseSignature, + Algorithm: SigningAlgRSAPSSUsingSHA512, + Key: keyRSA4096, + CertificateChain: certRSA4096, + }, + }, + { + schema.JWK{ + KeyID: "ecdsaP256", + Use: KeyUseSignature, + Algorithm: SigningAlgECDSAUsingP256AndSHA256, + Key: keyECDSAP256, + CertificateChain: certECDSAP256, + }, + }, + { + schema.JWK{ + KeyID: "ecdsaP384", + Use: KeyUseSignature, + Algorithm: SigningAlgECDSAUsingP384AndSHA384, + Key: keyECDSAP384, + CertificateChain: certECDSAP384, + }, + }, + { + schema.JWK{ + KeyID: "ecdsaP521", + Use: KeyUseSignature, + Algorithm: SigningAlgECDSAUsingP521AndSHA512, + Key: keyECDSAP521, + CertificateChain: certECDSAP521, + }, + }, + } + + for _, tc := range testCases { + t.Run(tc.have.KeyID, func(t *testing.T) { + t.Run("Generating", func(t *testing.T) { + var ( + jwk *JWK + ) + + ctx := context.Background() + + jwk = NewJWK(tc.have) + + signer := jwk.Strategy() + + claims := fjwt.MapClaims{} + header := &fjwt.Headers{ + Extra: map[string]any{ + "kid": jwk.kid, + }, + } + + tokenString, sig, err := signer.Generate(ctx, claims, header) + + assert.NoError(t, err) + assert.NotEqual(t, "", tokenString) + assert.NotEqual(t, "", sig) + + sigd, err := signer.GetSignature(ctx, tokenString) + assert.NoError(t, err) + assert.Equal(t, sig, sigd) + + token, err := signer.Decode(ctx, tokenString) + assert.NoError(t, err) + assert.NotNil(t, token) + fmt.Println(tokenString) + + assert.True(t, token.Valid()) + assert.Equal(t, jwk.alg.Alg(), string(token.Method)) + + sigv, err := signer.Validate(ctx, tokenString) + assert.NoError(t, err) + assert.Equal(t, sig, sigv) + }) + + t.Run("Marshalling", func(t *testing.T) { + var ( + jwk *JWK + out jose.JSONWebKey + data []byte + err error + ) + + jwk = NewJWK(tc.have) + + strategy := jwk.Strategy() + + assert.NotNil(t, strategy) + + signer, ok := strategy.(*Signer) + + require.True(t, ok) + + assert.NotNil(t, signer) + + key, err := signer.GetPublicKey(context.Background()) + assert.NoError(t, err) + assert.NotNil(t, key) + + key, err = jwk.GetPrivateKey(context.Background()) + assert.NoError(t, err) + assert.NotNil(t, key) + + data, err = json.Marshal(jwk.JWK()) + + assert.NoError(t, err) + require.NotNil(t, data) + + assert.NoError(t, json.Unmarshal(data, &out)) + + assert.True(t, out.IsPublic()) + assert.Equal(t, tc.have.KeyID, out.KeyID) + assert.Equal(t, tc.have.KeyID, jwk.KeyID()) + assert.Equal(t, tc.have.Use, out.Use) + assert.Equal(t, tc.have.Algorithm, out.Algorithm) + assert.NotNil(t, out.Key) + assert.NotNil(t, out.Certificates) + assert.NotNil(t, out.CertificateThumbprintSHA1) + assert.NotNil(t, out.CertificateThumbprintSHA256) + assert.True(t, out.Valid()) + + data, err = json.Marshal(jwk.PrivateJWK()) + + assert.NoError(t, err) + require.NotNil(t, data) + assert.NoError(t, json.Unmarshal(data, &out)) + + assert.False(t, out.IsPublic()) + assert.Equal(t, tc.have.KeyID, out.KeyID) + assert.Equal(t, tc.have.Use, out.Use) + assert.Equal(t, tc.have.Algorithm, out.Algorithm) + assert.NotNil(t, out.Key) + assert.NotNil(t, out.Certificates) + assert.NotNil(t, out.CertificateThumbprintSHA1) + assert.NotNil(t, out.CertificateThumbprintSHA256) + assert.True(t, out.Valid()) + }) + }) + } } diff --git a/internal/oidc/provider.go b/internal/oidc/provider.go index 3238a1c83..1f7837989 100644 --- a/internal/oidc/provider.go +++ b/internal/oidc/provider.go @@ -13,34 +13,31 @@ import ( ) // NewOpenIDConnectProvider new-ups a OpenIDConnectProvider. -func NewOpenIDConnectProvider(config *schema.OpenIDConnectConfiguration, store storage.Provider, templates *templates.Provider) (provider *OpenIDConnectProvider, err error) { +func NewOpenIDConnectProvider(config *schema.OpenIDConnectConfiguration, store storage.Provider, templates *templates.Provider) (provider *OpenIDConnectProvider) { if config == nil { - return nil, nil + return nil } provider = &OpenIDConnectProvider{ JSONWriter: herodot.NewJSONWriter(nil), Store: NewStore(config, store), + KeyManager: NewKeyManager(config), Config: NewConfig(config, templates), } provider.OAuth2Provider = fosite.NewOAuth2Provider(provider.Store, provider.Config) - if provider.KeyManager, err = NewKeyManagerWithConfiguration(config); err != nil { - return nil, err - } - provider.Config.Strategy.OpenID = &openid.DefaultStrategy{ - Signer: provider.KeyManager.Strategy(), + Signer: provider.KeyManager, Config: provider.Config, } - provider.Config.LoadHandlers(provider.Store, provider.KeyManager.Strategy()) + provider.Config.LoadHandlers(provider.Store, provider.KeyManager) provider.Config.Strategy.ClientAuthentication = provider.DefaultClientAuthenticationStrategy provider.discovery = NewOpenIDConnectWellKnownConfiguration(config) - return provider, nil + return provider } // GetOAuth2WellKnownConfiguration returns the discovery document for the OAuth Configuration. diff --git a/internal/oidc/provider_test.go b/internal/oidc/provider_test.go index 51ed6e4e6..335b03ab9 100644 --- a/internal/oidc/provider_test.go +++ b/internal/oidc/provider_test.go @@ -1,6 +1,7 @@ package oidc import ( + "encoding/json" "net/url" "testing" @@ -11,16 +12,15 @@ import ( ) func TestOpenIDConnectProvider_NewOpenIDConnectProvider_NotConfigured(t *testing.T) { - provider, err := NewOpenIDConnectProvider(nil, nil, nil) + provider := NewOpenIDConnectProvider(nil, nil, nil) - assert.NoError(t, err) assert.Nil(t, provider) } func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing.T) { - provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, EnablePKCEPlainChallenge: true, HMACSecret: badhmac, Clients: []schema.OpenIDConnectClientConfiguration{ @@ -36,7 +36,7 @@ func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing }, }, nil, nil) - assert.NoError(t, err) + require.NotNil(t, provider) disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) @@ -50,9 +50,9 @@ func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing } func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GoodConfiguration(t *testing.T) { - provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, HMACSecret: badhmac, Clients: []schema.OpenIDConnectClientConfiguration{ { @@ -86,13 +86,12 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GoodConfiguration(t *tes }, nil, nil) assert.NotNil(t, provider) - assert.NoError(t, err) } func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfiguration(t *testing.T) { - provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, HMACSecret: "asbdhaaskmdlkamdklasmdlkams", Clients: []schema.OpenIDConnectClientConfiguration{ { @@ -106,7 +105,7 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow }, }, nil, nil) - assert.NoError(t, err) + require.NotNil(t, provider) disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) @@ -153,19 +152,41 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretJWT) assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodNone) + assert.Len(t, disco.RevocationEndpointAuthMethodsSupported, 4) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodClientSecretPost) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodClientSecretJWT) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodNone) + + assert.Len(t, disco.IntrospectionEndpointAuthMethodsSupported, 2) + assert.Contains(t, disco.IntrospectionEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) + assert.Contains(t, disco.IntrospectionEndpointAuthMethodsSupported, ClientAuthMethodNone) + assert.Len(t, disco.GrantTypesSupported, 3) assert.Contains(t, disco.GrantTypesSupported, GrantTypeAuthorizationCode) assert.Contains(t, disco.GrantTypesSupported, GrantTypeRefreshToken) assert.Contains(t, disco.GrantTypesSupported, GrantTypeImplicit) + assert.Len(t, disco.RevocationEndpointAuthSigningAlgValuesSupported, 3) + assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[0], SigningAlgHMACUsingSHA256) + assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[1], SigningAlgHMACUsingSHA384) + assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[2], SigningAlgHMACUsingSHA512) + + assert.Len(t, disco.TokenEndpointAuthSigningAlgValuesSupported, 3) + assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[0], SigningAlgHMACUsingSHA256) + assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[1], SigningAlgHMACUsingSHA384) + assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[2], SigningAlgHMACUsingSHA512) + assert.Len(t, disco.IDTokenSigningAlgValuesSupported, 1) assert.Contains(t, disco.IDTokenSigningAlgValuesSupported, SigningAlgRSAUsingSHA256) assert.Len(t, disco.UserinfoSigningAlgValuesSupported, 2) - assert.Contains(t, disco.UserinfoSigningAlgValuesSupported, SigningAlgRSAUsingSHA256) - assert.Contains(t, disco.UserinfoSigningAlgValuesSupported, SigningAlgNone) + assert.Equal(t, disco.UserinfoSigningAlgValuesSupported[0], SigningAlgRSAUsingSHA256) + assert.Equal(t, disco.UserinfoSigningAlgValuesSupported[1], SigningAlgNone) - assert.Len(t, disco.RequestObjectSigningAlgValuesSupported, 0) + require.Len(t, disco.RequestObjectSigningAlgValuesSupported, 2) + assert.Equal(t, SigningAlgRSAUsingSHA256, disco.RequestObjectSigningAlgValuesSupported[0]) + assert.Equal(t, SigningAlgNone, disco.RequestObjectSigningAlgValuesSupported[1]) assert.Len(t, disco.ClaimsSupported, 18) assert.Contains(t, disco.ClaimsSupported, ClaimAuthenticationMethodsReference) @@ -186,12 +207,16 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow assert.Contains(t, disco.ClaimsSupported, ClaimGroups) assert.Contains(t, disco.ClaimsSupported, ClaimPreferredUsername) assert.Contains(t, disco.ClaimsSupported, ClaimFullName) + + assert.Len(t, disco.PromptValuesSupported, 2) + assert.Contains(t, disco.PromptValuesSupported, PromptConsent) + assert.Contains(t, disco.PromptValuesSupported, PromptNone) } func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOAuth2WellKnownConfiguration(t *testing.T) { - provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, HMACSecret: "asbdhaaskmdlkamdklasmdlkams", Clients: []schema.OpenIDConnectClientConfiguration{ { @@ -205,7 +230,7 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOAuth2WellKnownConfig }, }, nil, nil) - assert.NoError(t, err) + require.NotNil(t, provider) disco := provider.GetOAuth2WellKnownConfiguration(examplecom) @@ -278,9 +303,9 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOAuth2WellKnownConfig } func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfigurationWithPlainPKCE(t *testing.T) { - provider, err := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, HMACSecret: "asbdhaaskmdlkamdklasmdlkams", EnablePKCEPlainChallenge: true, Clients: []schema.OpenIDConnectClientConfiguration{ @@ -295,7 +320,7 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow }, }, nil, nil) - assert.NoError(t, err) + require.NotNil(t, provider) disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) @@ -303,3 +328,44 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnow assert.Equal(t, PKCEChallengeMethodSHA256, disco.CodeChallengeMethodsSupported[0]) assert.Equal(t, PKCEChallengeMethodPlain, disco.CodeChallengeMethodsSupported[1]) } + +func TestNewOpenIDConnectProviderDiscovery(t *testing.T) { + provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + IssuerCertificateChain: schema.X509CertificateChain{}, + IssuerPrivateKey: keyRSA2048, + HMACSecret: "asbdhaaskmdlkamdklasmdlkams", + EnablePKCEPlainChallenge: true, + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "a-client", + Secret: MustDecodeSecret("$plaintext$a-client-secret"), + Policy: onefactor, + RedirectURIs: []string{ + "https://google.com", + }, + }, + }, + }, nil, nil) + + a := provider.GetOpenIDConnectWellKnownConfiguration("https://auth.example.com") + + data, err := json.Marshal(&a) + assert.NoError(t, err) + + b := OpenIDConnectWellKnownConfiguration{} + + assert.NoError(t, json.Unmarshal(data, &b)) + + assert.Equal(t, a, b) + + y := provider.GetOAuth2WellKnownConfiguration("https://auth.example.com") + + data, err = json.Marshal(&y) + assert.NoError(t, err) + + z := OAuth2WellKnownConfiguration{} + + assert.NoError(t, json.Unmarshal(data, &z)) + + assert.Equal(t, y, z) +} diff --git a/internal/oidc/store_test.go b/internal/oidc/store_test.go index 47e15c424..bdd5f4d69 100644 --- a/internal/oidc/store_test.go +++ b/internal/oidc/store_test.go @@ -15,7 +15,7 @@ import ( func TestOpenIDConnectStore_GetClientPolicy(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: myclient, @@ -47,7 +47,7 @@ func TestOpenIDConnectStore_GetClientPolicy(t *testing.T) { func TestOpenIDConnectStore_GetInternalClient(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: myclient, @@ -82,7 +82,7 @@ func TestOpenIDConnectStore_GetInternalClient_ValidClient(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{c1}, }, nil) @@ -110,7 +110,7 @@ func TestOpenIDConnectStore_GetInternalClient_InvalidClient(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{c1}, }, nil) @@ -122,7 +122,7 @@ func TestOpenIDConnectStore_GetInternalClient_InvalidClient(t *testing.T) { func TestOpenIDConnectStore_IsValidClientID(t *testing.T) { s := NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleIssuerPrivateKey), + IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: myclient, diff --git a/internal/oidc/types.go b/internal/oidc/types.go index 6346a3ae2..ecec14e5f 100644 --- a/internal/oidc/types.go +++ b/internal/oidc/types.go @@ -122,7 +122,8 @@ type BaseClient struct { ResponseTypes []string ResponseModes []fosite.ResponseModeType - UserinfoSigningAlgorithm string + IDTokenSigningAlg string + UserinfoSigningAlg string Policy authorization.Level @@ -150,7 +151,9 @@ type Client interface { GetSecret() algorithm.Digest GetSectorIdentifier() string GetConsentResponseBody(consent *model.OAuth2ConsentSession) ConsentGetResponseBody - GetUserinfoSigningAlgorithm() string + + GetUserinfoSigningAlg() string + GetIDTokenSigningAlg() string GetPAREnforcement() bool GetPKCEEnforcement() bool @@ -222,13 +225,6 @@ func (c ClientConsentMode) String() string { } } -// KeyManager keeps track of all of the active/inactive rsa keys and provides them to services requiring them. -// It additionally allows us to add keys for the purpose of key rotation in the future. -type KeyManager struct { - jwk *JWK - jwks *jose.JSONWebKeySet -} - // ConsentGetResponseBody schema of the response body of the consent GET endpoint. type ConsentGetResponseBody struct { ClientID string `json:"client_id"` diff --git a/internal/oidc/util.go b/internal/oidc/util.go index 2e7c14d37..6fc10cab1 100644 --- a/internal/oidc/util.go +++ b/internal/oidc/util.go @@ -4,9 +4,101 @@ import ( "strings" "github.com/ory/fosite" + "gopkg.in/square/go-jose.v2" ) // IsPushedAuthorizedRequest returns true if the requester has a PushedAuthorizationRequest redirect_uri value. func IsPushedAuthorizedRequest(r fosite.Requester, prefix string) bool { return strings.HasPrefix(r.GetRequestForm().Get(FormParameterRequestURI), prefix) } + +// SortedSigningAlgs is a sorting type which allows the use of sort.Sort to order a list of OAuth 2.0 Signing Algs. +// Sorting occurs in the order of from within the RFC's. +type SortedSigningAlgs []string + +func (algs SortedSigningAlgs) Len() int { + return len(algs) +} + +func (algs SortedSigningAlgs) Less(i, j int) bool { + return isSigningAlgLess(algs[i], algs[j]) +} + +func (algs SortedSigningAlgs) Swap(i, j int) { + algs[i], algs[j] = algs[j], algs[i] +} + +type SortedJSONWebKey []jose.JSONWebKey + +func (jwks SortedJSONWebKey) Len() int { + return len(jwks) +} + +func (jwks SortedJSONWebKey) Less(i, j int) bool { + if jwks[i].Algorithm == jwks[j].Algorithm { + return jwks[i].KeyID < jwks[j].KeyID + } + + return isSigningAlgLess(jwks[i].Algorithm, jwks[j].Algorithm) +} + +func (jwks SortedJSONWebKey) Swap(i, j int) { + jwks[i], jwks[j] = jwks[j], jwks[i] +} + +//nolint:gocyclo // Low importance func. +func isSigningAlgLess(i, j string) bool { + switch { + case i == j: + return false + case i == SigningAlgNone: + return false + case j == SigningAlgNone: + return true + default: + var ( + ip, jp string + it, jt bool + ) + + if len(i) > 2 { + it = true + ip = i[:2] + } + + if len(j) > 2 { + jt = true + jp = j[:2] + } + + switch { + case it && jt && ip == jp: + return i < j + case ip == SigningAlgPrefixHMAC: + return true + case jp == SigningAlgPrefixHMAC: + return false + case ip == SigningAlgPrefixRSAPSS: + return false + case jp == SigningAlgPrefixRSAPSS: + return true + case ip == SigningAlgPrefixRSA: + return true + case jp == SigningAlgPrefixRSA: + return false + case ip == SigningAlgPrefixECDSA: + return true + case jp == SigningAlgPrefixECDSA: + return false + default: + return false + } + } +} + +const ( + SigningAlgPrefixRSA = "RS" + SigningAlgPrefixHMAC = "HS" + SigningAlgPrefixRSAPSS = "PS" + SigningAlgPrefixECDSA = "ES" +) diff --git a/internal/utils/const.go b/internal/utils/const.go index eb53c2d93..f6f28a366 100644 --- a/internal/utils/const.go +++ b/internal/utils/const.go @@ -31,6 +31,7 @@ const ( BlockTypePKIXPublicKey = "PUBLIC KEY" BlockTypeCertificate = "CERTIFICATE" BlockTypeCertificateRequest = "CERTIFICATE REQUEST" + BlockTypeX509CRL = "X509 CRL" KeyAlgorithmRSA = "RSA" KeyAlgorithmECDSA = "ECDSA" diff --git a/internal/utils/crypto.go b/internal/utils/crypto.go index 3f177fb1e..d8afd2d4c 100644 --- a/internal/utils/crypto.go +++ b/internal/utils/crypto.go @@ -13,6 +13,7 @@ import ( "encoding/pem" "errors" "fmt" + "io" "math/big" "net" "os" @@ -188,28 +189,95 @@ func ParseX509FromPEM(data []byte) (key any, err error) { return nil, errors.New("failed to parse PEM block containing the key") } + return ParsePEMBlock(block) +} + +// ParseX509FromPEMRecursive allows returning the appropriate key type given some PEM encoded input. +// For Keys this is a single value of one of *rsa.PrivateKey, *rsa.PublicKey, *ecdsa.PrivateKey, *ecdsa.PublicKey, +// ed25519.PrivateKey, or ed25519.PublicKey. For certificates this is +// either a *X509.Certificate, or a []*X509.Certificate. +func ParseX509FromPEMRecursive(data []byte) (decoded any, err error) { + var ( + block *pem.Block + multi bool + certificates []*x509.Certificate + ) + + for i := 0; true; i++ { + block, data = pem.Decode(data) + + n := len(data) + + switch { + case block == nil: + return nil, fmt.Errorf("failed to parse PEM blocks: data does not appear to be PEM encoded") + case multi || n != 0: + switch block.Type { + case BlockTypeCertificate: + var certificate *x509.Certificate + + if certificate, err = x509.ParseCertificate(block.Bytes); err != nil { + return nil, fmt.Errorf("failed to parse PEM blocks: data contains multiple blocks but #%d had an error during parsing: %w", i, err) + } + + certificates = append(certificates, certificate) + default: + return nil, fmt.Errorf("failed to parse PEM blocks: data contains multiple blocks but #%d has a '%s' block type and should have a '%s' block type", i, block.Type, BlockTypeCertificate) + } + + multi = true + default: + if decoded, err = ParsePEMBlock(block); err != nil { + return nil, err + } + } + + if n == 0 { + break + } + } + + switch { + case multi: + return certificates, nil + default: + return decoded, nil + } +} + +// ParsePEMBlock parses a single PEM block into the relevant X509 data struct. +func ParsePEMBlock(block *pem.Block) (key any, err error) { + if block == nil { + return nil, errors.New("failed to parse PEM block as it was empty") + } + switch block.Type { case BlockTypeRSAPrivateKey: - key, err = x509.ParsePKCS1PrivateKey(block.Bytes) + return x509.ParsePKCS1PrivateKey(block.Bytes) case BlockTypeECDSAPrivateKey: - key, err = x509.ParseECPrivateKey(block.Bytes) + return x509.ParseECPrivateKey(block.Bytes) case BlockTypePKCS8PrivateKey: - key, err = x509.ParsePKCS8PrivateKey(block.Bytes) + return x509.ParsePKCS8PrivateKey(block.Bytes) case BlockTypeRSAPublicKey: - key, err = x509.ParsePKCS1PublicKey(block.Bytes) + return x509.ParsePKCS1PublicKey(block.Bytes) case BlockTypePKIXPublicKey: - key, err = x509.ParsePKIXPublicKey(block.Bytes) + return x509.ParsePKIXPublicKey(block.Bytes) case BlockTypeCertificate: - key, err = x509.ParseCertificate(block.Bytes) + return x509.ParseCertificate(block.Bytes) + case BlockTypeCertificateRequest: + return x509.ParseCertificateRequest(block.Bytes) + case BlockTypeX509CRL: + return x509.ParseRevocationList(block.Bytes) default: - return nil, fmt.Errorf("unknown block type: %s", block.Type) + switch { + case strings.Contains(block.Type, "PRIVATE KEY"): + return x509.ParsePKCS8PrivateKey(block.Bytes) + case strings.Contains(block.Type, "PUBLIC KEY"): + return x509.ParsePKIXPublicKey(block.Bytes) + default: + return nil, fmt.Errorf("unknown block type: %s", block.Type) + } } - - if err != nil { - return nil, err - } - - return key, nil } // CastX509AsCertificate converts an interface to an *x509.Certificate. @@ -306,8 +374,25 @@ func NewX509CertPool(directory string) (certPool *x509.CertPool, warnings []erro return certPool, warnings, errors } -// WriteCertificateBytesToPEM writes a certificate/csr to a file in the PEM format. -func WriteCertificateBytesToPEM(path string, csr bool, certs ...[]byte) (err error) { +// WriteCertificateBytesAsPEMToPath writes a certificate/csr to a file in the PEM format. +func WriteCertificateBytesAsPEMToPath(path string, csr bool, certs ...[]byte) (err error) { + var out *os.File + + if out, err = os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600); err != nil { + return err + } + + if err = WriteCertificateBytesAsPEMToWriter(out, csr, certs...); err != nil { + _ = out.Close() + + return err + } + + return nil +} + +// WriteCertificateBytesAsPEMToWriter writes a certificate/csr to a io.Writer in the PEM format. +func WriteCertificateBytesAsPEMToWriter(wr io.Writer, csr bool, certs ...[]byte) (err error) { blockType := BlockTypeCertificate if csr { blockType = BlockTypeCertificateRequest @@ -319,26 +404,34 @@ func WriteCertificateBytesToPEM(path string, csr bool, certs ...[]byte) (err err blocks[i] = &pem.Block{Type: blockType, Bytes: cert} } - return WritePEM(path, blocks...) + return WritePEMBlocksToWriter(wr, blocks...) } -// WritePEM writes a set of *pem.Blocks to a file. -func WritePEM(path string, blocks ...*pem.Block) (err error) { +// WritePEMBlocksToPath writes a set of *pem.Blocks to a file. +func WritePEMBlocksToPath(path string, blocks ...*pem.Block) (err error) { var out *os.File if out, err = os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600); err != nil { return err } - for _, block := range blocks { - if err = pem.Encode(out, block); err != nil { - _ = out.Close() + if err = WritePEMBlocksToWriter(out, blocks...); err != nil { + _ = out.Close() + return err + } + + return out.Close() +} + +func WritePEMBlocksToWriter(wr io.Writer, blocks ...*pem.Block) (err error) { + for _, block := range blocks { + if err = pem.Encode(wr, block); err != nil { return err } } - return out.Close() + return nil } // WriteKeyToPEM writes a key that can be encoded as a PEM to a file in the PEM format. @@ -348,7 +441,7 @@ func WriteKeyToPEM(key any, path string, pkcs8 bool) (err error) { return err } - return WritePEM(path, block) + return WritePEMBlocksToPath(path, block) } // PEMBlockFromX509Key turns a PublicKey or PrivateKey into a pem.Block. From 65ecfe4b9ac0488c3021a14f91c7564d79755180 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Mon, 15 May 2023 10:32:10 +1000 Subject: [PATCH 45/67] feat(oidc): private_key_jwt client auth (#5280) This adds support for the private_key_jwt client authentication method. Signed-off-by: James Elliott Co-authored-by: Amir Zarrinkafsh --- config.template.yml | 683 +++++++--------- .../identity-providers/introduction.md | 2 +- .../identity-providers/open-id-connect.md | 671 --------------- .../openid-connect/_index.md | 15 + .../openid-connect/clients.md | 413 ++++++++++ .../openid-connect/provider.md | 428 ++++++++++ .../en/configuration/methods/secrets.md | 6 +- .../miscellaneous/privacy-policy.md | 2 +- .../openid-connect/apache-guacamole/index.md | 4 +- .../openid-connect/argocd/index.md | 6 +- .../openid-connect/bookstack/index.md | 4 +- .../cloudflare-zerotrust/index.md | 4 +- .../openid-connect/firezone/index.md | 4 +- .../integration/openid-connect/gitea/index.md | 4 +- .../openid-connect/gitlab/index.md | 4 +- .../openid-connect/grafana/index.md | 4 +- .../openid-connect/harbor/index.md | 4 +- .../openid-connect/hashicorp-vault/index.md | 4 +- .../openid-connect/introduction.md | 20 +- .../openid-connect/kasm-workspaces/index.md | 2 +- .../integration/openid-connect/komga/index.md | 4 +- .../integration/openid-connect/minio/index.md | 4 +- .../openid-connect/misago/index.md | 4 +- .../openid-connect/nextcloud/index.md | 4 +- .../openid-connect/outline/index.md | 4 +- .../openid-connect/portainer/index.md | 4 +- .../openid-connect/proxmox/index.md | 4 +- .../openid-connect/seafile/index.md | 4 +- .../openid-connect/synapse/index.md | 4 +- .../openid-connect/synology-dsm/index.md | 4 +- docs/content/en/integration/proxies/swag.md | 2 +- .../authorization/openid-connect-1.0.md | 2 +- .../en/roadmap/active/openid-connect.md | 9 +- docs/data/configkeys.json | 2 +- docs/layouts/shortcodes/oidc-common.html | 6 +- internal/configuration/config.template.yml | 683 +++++++--------- internal/configuration/deprecation.go | 8 + internal/configuration/provider_test.go | 32 +- .../schema/identity_providers.go | 39 +- internal/configuration/schema/keys.go | 37 +- internal/configuration/schema/types.go | 1 + internal/configuration/schema/types_test.go | 5 + .../test_resources/config_oidc.yml | 1 + .../test_resources/config_oidc_modern.yml | 2 +- internal/configuration/validator/const.go | 107 ++- .../configuration/validator/const_test.go | 1 + .../validator/identity_providers.go | 376 ++++++--- .../validator/identity_providers_test.go | 764 ++++++++++++++---- internal/configuration/validator/notifier.go | 8 +- .../configuration/validator/notifier_test.go | 15 + internal/configuration/validator/server.go | 34 +- .../configuration/validator/server_test.go | 29 +- internal/configuration/validator/shared.go | 6 +- .../configuration/validator/shared_test.go | 30 + internal/configuration/validator/util.go | 10 +- internal/configuration/validator/util_test.go | 41 + .../handlers/handler_oidc_authorization.go | 2 +- internal/oidc/amr_test.go | 26 +- .../{client_auth.go => authentication.go} | 42 + .../authentication_test.go} | 718 ++++++++++++---- internal/oidc/client.go | 14 +- internal/oidc/client_test.go | 189 +++-- internal/oidc/config.go | 38 +- internal/oidc/config_test.go | 229 ++++++ internal/oidc/const.go | 8 +- internal/oidc/const_test.go | 71 +- internal/oidc/core_strategy_hmac.go | 55 +- ...go => core_strategy_hmac_blackbox_test.go} | 59 +- .../oidc/core_strategy_hmac_whitebox_test.go | 56 ++ internal/oidc/discovery.go | 26 +- internal/oidc/discovery_test.go | 570 +++++++++++-- internal/oidc/hasher.go | 49 -- internal/oidc/hasher_test.go | 61 -- internal/oidc/keys.go | 97 ++- .../{keys_test.go => keys_blackbox_test.go} | 193 +++-- internal/oidc/keys_whitebox_test.go | 37 + internal/oidc/provider_test.go | 310 +------ internal/oidc/store.go | 4 +- internal/oidc/store_test.go | 566 ++++++++++++- internal/oidc/types.go | 38 +- internal/oidc/types_test.go | 39 +- internal/utils/bytes_test.go | 16 + internal/utils/clocK_test.go | 48 ++ 83 files changed, 5201 insertions(+), 2934 deletions(-) delete mode 100644 docs/content/en/configuration/identity-providers/open-id-connect.md create mode 100644 docs/content/en/configuration/identity-providers/openid-connect/_index.md create mode 100644 docs/content/en/configuration/identity-providers/openid-connect/clients.md create mode 100644 docs/content/en/configuration/identity-providers/openid-connect/provider.md create mode 100644 internal/configuration/validator/shared_test.go rename internal/oidc/{client_auth.go => authentication.go} (93%) rename internal/{handlers/handler_oidc_token_test.go => oidc/authentication_test.go} (73%) create mode 100644 internal/oidc/config_test.go rename internal/oidc/{core_strategy_hmac_test.go => core_strategy_hmac_blackbox_test.go} (72%) create mode 100644 internal/oidc/core_strategy_hmac_whitebox_test.go delete mode 100644 internal/oidc/hasher.go delete mode 100644 internal/oidc/hasher_test.go rename internal/oidc/{keys_test.go => keys_blackbox_test.go} (60%) create mode 100644 internal/oidc/keys_whitebox_test.go create mode 100644 internal/utils/bytes_test.go create mode 100644 internal/utils/clocK_test.go diff --git a/config.template.yml b/config.template.yml index dbeb986f3..2f1857220 100644 --- a/config.template.yml +++ b/config.template.yml @@ -4,7 +4,16 @@ # Authelia Configuration # ############################################################################### -## Note: the container by default expects to find this file at /config/configuration.yml. +## +## Notes: +## +## - the default location of this file is assumed to be configuration.yml unless otherwise noted +## - when using docker the container expects this by default to be at /config/configuration.yml +## - the default location where this file is loaded from can be overridden with the X_AUTHELIA_CONFIG environment var +## - the comments in this configuration file are helpful but users should consult the official documentation on the +## website at https://www.authelia.com/ or https://www.authelia.com/configuration/prologue/introduction/ +## - this configuration file template is not automatically updated +## ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. @@ -357,73 +366,37 @@ authentication_backend: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## The distinguished name of the container searched for objects in the directory information tree. @@ -485,7 +458,7 @@ authentication_backend: # permit_referrals: false ## The username and password of the admin user. - # user: cn=admin,dc=example,dc=com + # user: 'cn=admin,dc=example,dc=com' ## Password can also be set using a secret: https://www.authelia.com/c/secrets # password: 'password' @@ -622,7 +595,7 @@ access_control: # networks: # - '10.10.0.0/16' # - '192.168.2.0/24' - # - name: VPN + # - name: 'VPN' # networks: '10.9.0.0/16' # rules: @@ -748,7 +721,8 @@ session: # expiration: '1h' ## The time before the cookie expires and the session is destroyed if remember me IS selected by the user. Setting - ## this value to -1 disables remember me for this session cookie domain. + ## this value to -1 disables remember me for this session cookie domain. If allowed and the user uses the remember + ## me checkbox this overrides the expiration option and disables the inactivity option. # remember_me: '1M' ## Cookie Session Domain default 'name' value. @@ -816,73 +790,37 @@ session: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## The Redis HA configuration options. @@ -997,73 +935,37 @@ regulation: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## @@ -1116,74 +1018,38 @@ regulation: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== - # -----END RSA PRIVATE KEY----- + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= + # -----END RSA PRIVATE KEY----- ## ## Notification Provider @@ -1270,73 +1136,37 @@ notifier: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## @@ -1354,80 +1184,88 @@ notifier: ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets # hmac_secret: 'this_is_a_secret_abc123abc123abc' - ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the - ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every - ## certificate included must be signed by the certificate immediately after it if provided. - # issuer_certificate_chain: | - # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= - # -----END CERTIFICATE----- - # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= - # -----END CERTIFICATE----- + ## Issuer JWKS configures multiple JSON Web Keys. It's required that at least one of these is RS256 or the + ## option issuer_private_key is configured. There must only be one key per algorithm at this time. + ## For RSA keys the minimum is a 2048 bit key. + # issuer_private_keys: + # - + ## Key ID embedded into the JWT header for key matching. Must be an alphanumeric string with 7 or less characters. + ## This value is automatically generated if not provided. It's recommended to not configure this. + # key_id: 'example' - ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. + ## The key algorithm used with this key. + # algorithm: 'RS256' + + ## The key use expected with this key. Currently only 'sig' is supported. + # use: 'sig' + + ## Required Private Key in PEM DER form. + # key: | + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= + # -----END RSA PRIVATE KEY----- + + + ## Optional matching certificate chain in PEM DER form that matches the key. All certificates within the chain + ## must be valid and current, and from top to bottom each certificate must be signed by the subsequent one. + # certificate_chain: | + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + + ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. This is in addition to the + ## issuer_private_keys option. Assumed to use the RS256 algorithm, and must not be specified if any of the + ## keys in issuer_private_keys also has the algorithm RS256 or are an RSA key without an algorithm. ## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets # issuer_private_key: | # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- + ## Optional matching certificate chain in PEM DER form that matches the issuer_private_key. All certificates within + ## the chain must be valid and current, and from top to bottom each certificate must be signed by the next + ## certificate in the chain if provided. + # issuer_certificate_chain: | + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + ## The lifespans configure the expiration for these token types in the duration common syntax. # access_token_lifespan: '1h' # authorize_code_lifespan: '1m' @@ -1499,6 +1337,11 @@ notifier: # - 'email' # - 'profile' + ## Grant Types configures which grants this client can obtain. + ## It's not recommended to define this unless you know what you're doing. + # grant_types: + # - 'authorization_code' + ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: @@ -1509,25 +1352,19 @@ notifier: # - 'form_post' # - 'query' - ## Grant Types configures which grants this client can obtain. - ## It's not recommended to define this unless you know what you're doing. - # grant_types: - # - 'authorization_code' - - ## The permitted client authentication method for the Token Endpoint for this client. - # token_endpoint_auth_method: 'client_secret_basic' - - ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using - ## the 'client_secret_jwt' token_endpoint_auth_method. - # token_endpoint_auth_signing_alg: HS256 - - ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using - ## the 'client_secret_jwt' token_endpoint_auth_method. - # token_endpoint_auth_signing_alg: HS256 - ## The policy to require for this client; one_factor or two_factor. # authorization_policy: 'two_factor' + ## The consent mode controls how consent is obtained. + # consent_mode: 'auto' + + ## This value controls the duration a consent on this client remains remembered when the consent mode is + ## configured as 'auto' or 'pre-configured' in the duration common syntax. + # pre_configured_consent_duration: '1w' + + ## Enforces the use of Pushed Authorization Requests for this client when set to true. + # enforce_par: false + ## Enforces the use of PKCE for this client when set to true. # enforce_pkce: false @@ -1535,13 +1372,69 @@ notifier: ## Options are 'plain' and 'S256'. # pkce_challenge_method: 'S256' + ## The permitted client authentication method for the Token Endpoint for this client. + # token_endpoint_auth_method: 'client_secret_basic' + + ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using + ## the 'client_secret_jwt' or 'private_key_jwt' token_endpoint_auth_method. + # token_endpoint_auth_signing_alg: 'RS256' + + ## The signing algorithm which must be used for request objects. A client JWK with a matching algorithm must be + ## included if configured. + # request_object_signing_alg: 'RS256' + + ## The signing algorithm used for ID Tokens. Am issuer JWK with a matching algorithm must be included. + # id_token_signing_alg: 'RS256' + ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. - # userinfo_signing_algorithm: 'none' + # userinfo_signing_alg: 'none' - ## The consent mode controls how consent is obtained. - # consent_mode: 'auto' + ## Trusted public keys configuration for request object signing for things such as private_key_jwt + # public_keys: - ## This value controls the duration a consent on this client remains remembered when the consent mode is - ## configured as 'auto' or 'pre-configured' in the duration common syntax. - # pre_configured_consent_duration: '1w' + ## URL of the HTTPS endpoint which serves the keys. It's recommended to manually configure them in the + ## values option below. Please note the URL and the individual values are mutually exclusive. + # uri: 'https://app.example.com/jwks.json' + + ## Values from the individual keys. + # values: + # - + ## Key ID used to match the JWT's to an individual identifier. This option is required if configured. + # key_id: 'example' + + ## The key algorithm expected with this key. + # algorithm: 'RS256' + + ## The key use expected with this key. Currently only 'sig' is supported. + # use: 'sig' + + ## Required Public Key in PEM DER form. + # key: | + # -----BEGIN RSA PUBLIC KEY----- + # MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz + # 9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE= + # -----END RSA PUBLIC KEY---- + + ## The matching certificate chain in PEM DER form that matches the key if available. + # certificate_chain: | + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- ... diff --git a/docs/content/en/configuration/identity-providers/introduction.md b/docs/content/en/configuration/identity-providers/introduction.md index f8a940a49..87ba9dbc4 100644 --- a/docs/content/en/configuration/identity-providers/introduction.md +++ b/docs/content/en/configuration/identity-providers/introduction.md @@ -16,4 +16,4 @@ aliases: ## OpenID Connect -The only identity provider implementation supported at this time is [OpenID Connect 1.0](open-id-connect.md). +The only identity provider implementation supported at this time is [OpenID Connect 1.0](openid-connect/provider.md). diff --git a/docs/content/en/configuration/identity-providers/open-id-connect.md b/docs/content/en/configuration/identity-providers/open-id-connect.md deleted file mode 100644 index 05e550e2c..000000000 --- a/docs/content/en/configuration/identity-providers/open-id-connect.md +++ /dev/null @@ -1,671 +0,0 @@ ---- -title: "OpenID Connect" -description: "OpenID Connect Configuration" -lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure this." -date: 2022-06-15T17:51:47+10:00 -draft: false -images: [] -menu: - configuration: - parent: "identity-providers" -weight: 190200 -toc: true -aliases: - - /c/oidc - - /docs/configuration/identity-providers/oidc.html ---- - -__Authelia__ currently supports the [OpenID Connect 1.0] Provider role as an open -[__beta__](../../roadmap/active/openid-connect.md) feature. We currently do not support the [OpenID Connect 1.0] Relying -Party role. This means other applications that implement the [OpenID Connect 1.0] Relying Party role can use Authelia as -an [OpenID Connect 1.0] Provider similar to how you may use social media or development platforms for login. - -The [OpenID Connect 1.0] Relying Party role is the role which allows an application to use GitHub, Google, or other -[OpenID Connect 1.0] Providers for authentication and authorization. We do not intend to support this functionality at -this moment in time. - -More information about the beta can be found in the [roadmap](../../roadmap/active/openid-connect.md). - -## Configuration - -The following snippet provides a sample-configuration for the OIDC identity provider explaining each field in detail. - -```yaml -identity_providers: - oidc: - hmac_secret: this_is_a_secret_abc123abc123abc - issuer_certificate_chain: | - -----BEGIN CERTIFICATE----- - MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- - MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - qocikt3WAdU^invalid DO NOT USE= - -----END CERTIFICATE----- - issuer_private_key: | - -----BEGIN RSA PRIVATE KEY----- - MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - DO NOT USE== - -----END RSA PRIVATE KEY----- - issuer_jwks: - - key_id: '' - algorithm: 'RS256' - key: | - - certificate_chain: | - - access_token_lifespan: 1h - authorize_code_lifespan: 1m - id_token_lifespan: 1h - refresh_token_lifespan: 90m - enable_client_debug_messages: false - enforce_pkce: public_clients_only - cors: - endpoints: - - authorization - - token - - revocation - - introspection - allowed_origins: - - https://example.com - allowed_origins_from_client_redirect_uris: false - clients: - - id: myapp - description: My Application - secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. - sector_identifier: '' - public: false - authorization_policy: two_factor - consent_mode: explicit - pre_configured_consent_duration: 1w - audience: [] - scopes: - - openid - - groups - - email - - profile - redirect_uris: - - https://oidc.example.com:8080/oauth2/callback - grant_types: - - refresh_token - - authorization_code - response_types: - - code - response_modes: - - form_post - - query - - fragment - userinfo_signing_algorithm: none -``` - -## Options - -### hmac_secret - -{{< confkey type="string" required="yes" >}} - -*__Important Note:__ This can also be defined using a [secret](../methods/secrets.md) which is __strongly recommended__ -especially for containerized deployments.* - -The HMAC secret used to sign the [JWT]'s. The provided string is hashed to a SHA256 ([RFC6234]) byte string for the -purpose of meeting the required format. - -It's __strongly recommended__ this is a -[Random Alphanumeric String](../../reference/guides/generating-secure-values.md#generating-a-random-alphanumeric-string) -with 64 or more characters. - -### issuer_private_key - -{{< confkey type="string" required="yes" >}} - -*__Important Note:__ This can also be defined using a [secret](../methods/secrets.md) which is __strongly recommended__ -especially for containerized deployments.* - -The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator -and can be done by following the -[Generating an RSA Keypair](../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide. - -The private key *__MUST__*: -* Be a PEM block encoded in the DER base64 format ([RFC4648]). -* Be an RSA Key. -* Have a key size of at least 2048 bits. - -If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public -key data for the first certificate in the chain. - -### issuer_certificate_chain - -{{< confkey type="string" required="no" >}} - -The certificate chain/bundle to be used with the [issuer_private_key](#issuer_private_key) DER base64 ([RFC4648]) -encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t] -JSON key's in the JWKs [Discoverable Endpoint](../../integration/openid-connect/introduction.md#discoverable-endpoints) -as per [RFC7517]. - -[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517 -[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 -[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8 - -The first certificate in the chain must have the public key for the [issuer_private_key](#issuerprivatekey), each -certificate in the chain must be valid for the current date, and each certificate in the chain should be signed by the -certificate immediately following it if present. - -### issuer_jwks - -{{< confkey type="list(object" required="no" >}} - -The list of JWKS instead of or in addition to the [issuer_private_key](#issuerprivatekey) and -[issuer_certificate_chain](#issuercertificatechain). Can also accept ECDSA Private Key's and Certificates. - -#### key_id - -{{< confkey type="string" default="" required="no" >}} - -Completely optional, and generally discouraged unless there is a collision between the automatically generated key id's. -If provided must be a unique string with 7 or less alphanumeric characters. - -This value is the first 7 characters of the public key thumbprint (SHA1) encoded into hexadecimal. - -#### algorithm - -{{< confkey type="string" required="no" >}} - -The algorithm for this key. This value must be unique. It's automatically detected based on the type of key. - -#### key - -{{< confkey type="string" required="yes" >}} - -The private key associated with this key entry. - -The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator -and can be done by following the -[Generating an RSA Keypair](../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide. - -The private key *__MUST__*: -* Be a PEM block encoded in the DER base64 format ([RFC4648]). -* Be one of: - * An RSA key with a key size of at least 2048 bits. - * An ECDSA private key with one of the P-256, P-384, or P-521 elliptical curves. - -If the [certificate_chain](#certificatechain) is provided the private key must include matching public -key data for the first certificate in the chain. - -#### certificate_chain - -{{< confkey type="string" required="no" >}} - -The certificate chain/bundle to be used with the [key](#key) DER base64 ([RFC4648]) -encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t] -JSON key's in the JWKs [Discoverable Endpoint](../../integration/openid-connect/introduction.md#discoverable-endpoints) -as per [RFC7517]. - -[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517 -[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 -[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8 - -The first certificate in the chain must have the public key for the [key](#key), each certificate in the chain must be -valid for the current date, and each certificate in the chain should be signed by the certificate immediately following -it if present. - -### access_token_lifespan - -{{< confkey type="duration" default="1h" required="no" >}} - -The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default. -For more information read these docs about [token lifespan]. - -### authorize_code_lifespan - -{{< confkey type="duration" default="1m" required="no" >}} - -The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to -obtain the other token types. For more information read these docs about [token lifespan]. - -### id_token_lifespan - -{{< confkey type="duration" default="1h" required="no" >}} - -The maximum lifetime of an ID token. For more information read these docs about [token lifespan]. - -### refresh_token_lifespan - -{{< confkey type="string" default="90m" required="no" >}} - -The maximum lifetime of a refresh token. The -refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an -up-to-date expiration. For more information read these docs about [token lifespan]. - -A good starting point is 50% more or 30 minutes more (which ever is less) time than the highest lifespan out of the -[access token lifespan](#access_token_lifespan), the [authorize code lifespan](#authorize_code_lifespan), and the -[id token lifespan](#id_token_lifespan). For instance the default for all of these is 60 minutes, so the default refresh -token lifespan is 90 minutes. - -### enable_client_debug_messages - -{{< confkey type="boolean" default="false" required="no" >}} - -Allows additional debug messages to be sent to the clients. - -### minimum_parameter_entropy - -{{< confkey type="integer" default="8" required="no" >}} - -This controls the minimum length of the `nonce` and `state` parameters. - -*__Security Notice:__* Changing this value is generally discouraged, reducing it from the default can theoretically -make certain scenarios less secure. It is highly encouraged that if your OpenID Connect RP does not send these -parameters or sends parameters with a lower length than the default that they implement a change rather than changing -this value. - -### enforce_pkce - -{{< confkey type="string" default="public_clients_only" required="no" >}} - -[Proof Key for Code Exchange](https://datatracker.ietf.org/doc/html/rfc7636) enforcement policy: if specified, must be -either `never`, `public_clients_only` or `always`. - -If set to `public_clients_only` (default), [PKCE] will be required for public clients using the -[Authorization Code Flow]. - -When set to `always`, [PKCE] will be required for all clients using the Authorization Code flow. - -*__Security Notice:__* Changing this value to `never` is generally discouraged, reducing it from the default can -theoretically make certain client-side applications (mobile applications, SPA) vulnerable to CSRF and authorization code -interception attacks. - -### enable_pkce_plain_challenge - -{{< confkey type="boolean" default="false" required="no" >}} - -Allows [PKCE] `plain` challenges when set to `true`. - -*__Security Notice:__* Changing this value is generally discouraged. Applications should use the `S256` [PKCE] challenge -method instead. - -### pushed_authorizations - -Controls the behaviour of [Pushed Authorization Requests]. - -#### enforce - -{{< confkey type="boolean" default="false" required="no" >}} - -When enabled all authorization requests must use the [Pushed Authorization Requests] flow. - -#### context_lifespan - -{{< confkey type="duration" default="5m" required="no" >}} - -The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated -`request_uri` being utilized by a client. - -### cors - -Some [OpenID Connect 1.0] Endpoints need to allow cross-origin resource sharing, however some are optional. This section allows -you to configure the optional parts. We reply with CORS headers when the request includes the Origin header. - -#### endpoints - -{{< confkey type="list(string)" required="no" >}} - -A list of endpoints to configure with cross-origin resource sharing headers. It is recommended that the `userinfo` -option is at least in this list. The potential endpoints which this can be enabled on are as follows: - -* authorization -* pushed-authorization-request -* token -* revocation -* introspection -* userinfo - -#### allowed_origins - -{{< confkey type="list(string)" required="no" >}} - -A list of permitted origins. - -Any origin with https is permitted unless this option is configured or the -[allowed_origins_from_client_redirect_uris](#allowed_origins_from_client_redirect_uris) option is enabled. This means -you must configure this option manually if you want http endpoints to be permitted to make cross-origin requests to the -[OpenID Connect 1.0] endpoints, however this is not recommended. - -Origins must only have the scheme, hostname and port, they may not have a trailing slash or path. - -In addition to an Origin URI, you may specify the wildcard origin in the allowed_origins. It MUST be specified by itself -and the [allowed_origins_from_client_redirect_uris](#allowedoriginsfromclientredirecturis) MUST NOT be enabled. The -wildcard origin is denoted as `*`. Examples: - -```yaml -identity_providers: - oidc: - cors: - allowed_origins: "*" -``` - -```yaml -identity_providers: - oidc: - cors: - allowed_origins: - - "*" -``` - -#### allowed_origins_from_client_redirect_uris - -{{< confkey type="boolean" default="false" required="no" >}} - -Automatically adds the origin portion of all redirect URI's on all clients to the list of -[allowed_origins](#allowed_origins), provided they have the scheme http or https and do not have the hostname of -localhost. - -### clients - -{{< confkey type="list" required="yes" >}} - -A list of clients to configure. The options for each client are described below. - -#### id - -{{< confkey type="string" required="yes" >}} - -The Client ID for this client. It must exactly match the Client ID configured in the application -consuming this client. - -#### description - -{{< confkey type="string" default="*same as id*" required="no" >}} - -A friendly description for this client shown in the UI. This defaults to the same as the ID. - -#### secret - -{{< confkey type="string" required="situational" >}} - -The shared secret between Authelia and the application consuming this client. This secret must match the secret -configured in the application. - -This secret must be generated by the administrator and can be done by following the -[How Do I Generate Client Secrets](../../integration/openid-connect/frequently-asked-questions.md#how-do-i-generate-client-secrets) FAQ. - -This must be provided when the client is a confidential client type, and must be blank when using the public client -type. To set the client type to public see the [public](#public) configuration option. - -#### sector_identifier - -{{< confkey type="string" required="no" >}} - -*__Important Note:__ because adjusting this option will inevitably change the `sub` claim of all tokens generated for -the specified client, changing this should cause the relying party to detect all future authorizations as completely new -users.* - -Must be an empty string or the host component of a URL. This is commonly just the domain name, but may also include a -port. - -Authelia utilizes UUID version 4 subject identifiers. By default the public [Subject Identifier Type] is utilized for -all clients. This means the subject identifiers will be the same for all clients. This configuration option enables -[Pairwise Identifier Algorithm] for this client, and configures the sector identifier utilized for both the storage and -the lookup of the subject identifier. - -1. All clients who do not have this configured will generate the same subject identifier for a particular user - regardless of which client obtains the ID token. -2. All clients which have the same sector identifier will: - 1. have the same subject identifier for a particular user when compared to clients with the same sector identifier. - 2. have a completely different subject identifier for a particular user whe compared to: - 1. any client with the public subject identifier type. - 2. any client with a differing sector identifier. - -In specific but limited scenarios this option is beneficial for privacy reasons. In particular this is useful when the -party utilizing the *Authelia* [OpenID Connect 1.0] Authorization Server is foreign and not controlled by the user. It would -prevent the third party utilizing the subject identifier with another third party in order to track the user. - -Keep in mind depending on the other claims they may still be able to perform this tracking and it is not a silver -bullet. There are very few benefits when utilizing this in a homelab or business where no third party is utilizing -the server. - -#### public - -{{< confkey type="bool" default="false" required="no" >}} - -This enables the public client type for this client. This is for clients that are not capable of maintaining -confidentiality of credentials, you can read more about client types in [RFC6749 Section 2.1]. This is particularly -useful for SPA's and CLI tools. This option requires setting the [client secret](#secret) to a blank string. - -#### redirect_uris - -{{< confkey type="list(string)" required="yes" >}} - -A list of valid callback URIs this client will redirect to. All other callbacks will be considered unsafe. The URIs are -case-sensitive and they differ from application to application - the community has provided -[a list of URL´s for common applications](../../integration/openid-connect/introduction.md). - -Some restrictions that have been placed on clients and -their redirect URIs are as follows: - -1. If a client attempts to authorize with Authelia and its redirect URI is not listed in the client configuration the - attempt to authorize will fail and an error will be generated. -2. The redirect URIs are case-sensitive. -3. The URI must include a scheme and that scheme must be one of `http` or `https`. - -#### audience - -{{< confkey type="list(string)" required="no" >}} - -A list of audiences this client is allowed to request. - -#### scopes - -{{< confkey type="list(string)" default="openid, groups, profile, email" required="no" >}} - -A list of scopes to allow this client to consume. See -[scope definitions](../../integration/openid-connect/introduction.md#scope-definitions) for more information. The -documentation for the application you are trying to configure [OpenID Connect 1.0] for will likely have a list of scopes -or claims required which can be matched with the above guide. - -#### response_types - -{{< confkey type="list(string)" default="code" required="no" >}} - -*__Security Note:__ It is recommended that only the `code` response type (i.e. the default) is used. The other response -types are not as secure as this response type.* - -A list of response types this client supports. If a response type not in this list is requested by a client then an -error will be returned to the client. The response type indicates the types of values that are returned to the client. - -See the [Response Types](../../integration/openid-connect/introduction.md#response-types) section of the -[OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md#response-types) for more information. - -#### response_modes - -{{< confkey type="list(string)" default="form_post, query" required="no" >}} - -*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.* - -A list of response modes this client supports. If a response mode not in this list is requested by a client then an -error will be returned to the client. The response mode controls how the response type is returned to the client. - -See the [Response Modes](../../integration/openid-connect/introduction.md#response-modes) section of the -[OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md#response-modes) for more -information. - -The default values are based on the [response_types](#responsetypes) values. When the [response_types](#responsetypes) -values include the `code` type then the `query` response mode will be included. When any other type is included the -`fragment` response mode will be included. It's important to note at this time we do not support the `none` response -type, but when it is supported it will include the `query` response mode. - -#### grant_types - -{{< confkey type="list(string)" default="authorization_code" required="no" >}} - -*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.* - -The list of grant types this client is permitted to use in order to obtain access to the relevant tokens. - -See the [Grant Types](../../integration/openid-connect/introduction.md#grant-types) section of the -[OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md#grant-types) for more information. - -#### authorization_policy - -{{< confkey type="string" default="two_factor" required="no" >}} - -The authorization policy for this client: either `one_factor` or `two_factor`. - -#### enforce_par - -{{< confkey type="boolean" default="false" required="no" >}} - -Enforces the use of a [Pushed Authorization Requests] flow for this client. - -#### enforce_pkce - -{{< confkey type="bool" default="false" required="no" >}} - -This setting enforces the use of [PKCE] for this individual client. To enforce it for all clients see the global -[enforce_pkce](#enforcepkce) setting. - -#### pkce_challenge_method - -{{< confkey type="string" default="" required="no" >}} - -This setting enforces the use of the specified [PKCE] challenge method for this individual client. This setting also -effectively enables the [enforce_pkce](#enforcepkce-1) option for this client. - -Valid values are an empty string, `plain`, or `S256`. It should be noted that `S256` is strongly recommended if the -relying party supports it. - -#### userinfo_signing_algorithm - -{{< confkey type="string" default="none" required="no" >}} - -The algorithm used to sign the userinfo endpoint responses. This can either be `none` or `RS256`. - -See the [integration guide](../../integration/openid-connect/introduction.md#user-information-signing-algorithm) for -more information. - -#### token_endpoint_auth_method - -{{< confkey type="string" default="" required="no" >}} - -The registered client authentication mechanism used by this client for the [Token Endpoint]. If no method is defined -the confidential client type will accept any supported method. The public client type defaults to `none` as this -is required by the specification. This may be required as a breaking change in future versions. -Supported values are `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, and `none`. - -See the [integration guide](../../integration/openid-connect/introduction.md#client-authentication-method) for -more information. - -#### token_endpoint_auth_signing_alg - -{{< confkey type="string" default="HS256" required="no" >}} - -The JWT signing algorithm accepted when the [token_endpoint_auth_method](#tokenendpointauthmethod) is configured as -`client_secret_jwt`. Supported values are `HS256`, `HS385`, and `HS512`. - -#### consent_mode - -{{< confkey type="string" default="auto" required="no" >}} - -*__Important Note:__ the `implicit` consent mode is not technically part of the specification. It theoretically could be -misused in certain conditions specifically with the public client type or when the client credentials (i.e. client -secret) has been exposed to an attacker. For these reasons this mode is discouraged.* - -Configures the consent mode. The following table describes the different modes: - -| Value | Description | -|:--------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:| -| auto | Automatically determined (default). Uses `explicit` unless [pre_configured_consent_duration] is specified in which case uses `pre-configured`. | -| explicit | Requires the user provide unique explicit consent for every authorization. | -| implicit | Automatically assumes consent for every authorization, never asking the user if they wish to give consent. | -| pre-configured | Allows the end-user to remember their consent for the [pre_configured_consent_duration]. | - -[pre_configured_consent_duration]: #preconfiguredconsentduration - -#### pre_configured_consent_duration - -{{< confkey type="duration" default="1w" required="no" >}} - -*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see -the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.* - -Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is -specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`. - -The period of time dictates how long a users choice to remember the pre-configured consent lasts. - -Pre-configured consents are only valid if the subject, client id are exactly the same and the requested scopes/audience -match exactly with the granted scopes/audience. - -[consent_mode]: #consentmode - -## Integration - -To integrate Authelia's [OpenID Connect 1.0] implementation with a relying party please see the -[integration docs](../../integration/openid-connect/introduction.md). - -[token lifespan]: https://docs.apigee.com/api-platform/antipatterns/oauth-long-expiration -[OpenID Connect 1.0]: https://openid.net/connect/ -[Token Endpoint]: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint -[JWT]: https://datatracker.ietf.org/doc/html/rfc7519 -[RFC6234]: https://datatracker.ietf.org/doc/html/rfc6234 -[RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648 -[RFC7468]: https://datatracker.ietf.org/doc/html/rfc7468 -[RFC6749 Section 2.1]: https://datatracker.ietf.org/doc/html/rfc6749#section-2.1 -[PKCE]: https://datatracker.ietf.org/doc/html/rfc7636 -[Authorization Code Flow]: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth -[Subject Identifier Type]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes -[Pairwise Identifier Algorithm]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg -[Pushed Authorization Requests]: https://datatracker.ietf.org/doc/html/rfc9126 diff --git a/docs/content/en/configuration/identity-providers/openid-connect/_index.md b/docs/content/en/configuration/identity-providers/openid-connect/_index.md new file mode 100644 index 000000000..575323138 --- /dev/null +++ b/docs/content/en/configuration/identity-providers/openid-connect/_index.md @@ -0,0 +1,15 @@ +--- +title: "OpenID Connect 1.0" +description: "" +lead: "" +date: 2023-05-08T13:38:08+10:00 +lastmod: 2022-01-18T20:07:56+01:00 +draft: false +images: [] +menu: + docs: + parent: "identity-providers" + identifier: "openid-connect" +weight: 190120 +toc: true +--- diff --git a/docs/content/en/configuration/identity-providers/openid-connect/clients.md b/docs/content/en/configuration/identity-providers/openid-connect/clients.md new file mode 100644 index 000000000..adec6ca20 --- /dev/null +++ b/docs/content/en/configuration/identity-providers/openid-connect/clients.md @@ -0,0 +1,413 @@ +--- +title: "OpenID Connect 1.0 Clients" +description: "OpenID Connect 1.0 Registered Clients Configuration" +lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure the registered clients." +date: 2023-05-08T13:38:08+10:00 +draft: false +images: [] +menu: + configuration: + parent: "openid-connect" +weight: 190220 +toc: true +--- + +This section covers specifics regarding configuring the providers registered clients for [OpenID Connect 1.0]. For the +provider specific configuration and information not related to clients see the [OpenID Connect 1.0 Provider](provider.md) +documentation. + +More information about OpenID Connect can be found in the [roadmap](../../../roadmap/active/openid-connect.md) and in the +[integration](../../../integration/openid-connect/introduction.md) documentation. + +## Configuration + +The following snippet provides a configuration example for the [OpenID Connect 1.0] Registered Clients. This is not +intended for production use it's used to provide context and an indentation example. + +```yaml +identity_providers: + oidc: + clients: + - id: myapp + description: My Application + secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'. + sector_identifier: '' + public: false + redirect_uris: + - https://oidc.example.com:8080/oauth2/callback + audience: [] + scopes: + - openid + - groups + - email + - profile + grant_types: + - refresh_token + - authorization_code + response_types: + - code + response_modes: + - form_post + - query + - fragment + authorization_policy: two_factor + consent_mode: explicit + pre_configured_consent_duration: 1w + enforce_par: false + enforce_pkce: false + pkce_challenge_method: S256 + token_endpoint_auth_method: '' + token_endpoint_auth_signing_alg: RS256 + id_token_signing_alg: RS256 + request_object_signing_alg: RS256 + userinfo_signing_alg: none +``` + +## Options + +### id + +{{< confkey type="string" required="yes" >}} + +The Client ID for this client. It must exactly match the Client ID configured in the application consuming this client. + +### description + +{{< confkey type="string" default="*same as id*" required="no" >}} + +A friendly description for this client shown in the UI. This defaults to the same as the ID. + +### secret + +{{< confkey type="string" required="situational" >}} + +The shared secret between Authelia and the application consuming this client. This secret must match the secret +configured in the application. + +This secret must be generated by the administrator and can be done by following the +[How Do I Generate Client Secrets](../../../integration/openid-connect/frequently-asked-questions.md#how-do-i-generate-client-secrets) FAQ. + +This must be provided when the client is a confidential client type, and must be blank when using the public client +type. To set the client type to public see the [public](#public) configuration option. + +### sector_identifier + +{{< confkey type="string" required="no" >}} + +*__Important Note:__ because adjusting this option will inevitably change the `sub` claim of all tokens generated for +the specified client, changing this should cause the relying party to detect all future authorizations as completely new +users.* + +Must be an empty string or the host component of a URL. This is commonly just the domain name, but may also include a +port. + +Authelia utilizes UUID version 4 subject identifiers. By default the public [Subject Identifier Type] is utilized for +all clients. This means the subject identifiers will be the same for all clients. This configuration option enables +[Pairwise Identifier Algorithm] for this client, and configures the sector identifier utilized for both the storage and +the lookup of the subject identifier. + +1. All clients who do not have this configured will generate the same subject identifier for a particular user + regardless of which client obtains the ID token. +2. All clients which have the same sector identifier will: + 1. have the same subject identifier for a particular user when compared to clients with the same sector identifier. + 2. have a completely different subject identifier for a particular user whe compared to: + 1. any client with the public subject identifier type. + 2. any client with a differing sector identifier. + +In specific but limited scenarios this option is beneficial for privacy reasons. In particular this is useful when the +party utilizing the *Authelia* [OpenID Connect 1.0] Authorization Server is foreign and not controlled by the user. It would +prevent the third party utilizing the subject identifier with another third party in order to track the user. + +Keep in mind depending on the other claims they may still be able to perform this tracking and it is not a silver +bullet. There are very few benefits when utilizing this in a homelab or business where no third party is utilizing +the server. + +### public + +{{< confkey type="bool" default="false" required="no" >}} + +This enables the public client type for this client. This is for clients that are not capable of maintaining +confidentiality of credentials, you can read more about client types in [RFC6749 Section 2.1]. This is particularly +useful for SPA's and CLI tools. This option requires setting the [client secret](#secret) to a blank string. + +### redirect_uris + +{{< confkey type="list(string)" required="yes" >}} + +A list of valid callback URIs this client will redirect to. All other callbacks will be considered unsafe. The URIs are +case-sensitive and they differ from application to application - the community has provided +[a list of URL´s for common applications](../../../integration/openid-connect/introduction.md). + +Some restrictions that have been placed on clients and +their redirect URIs are as follows: + +1. If a client attempts to authorize with Authelia and its redirect URI is not listed in the client configuration the + attempt to authorize will fail and an error will be generated. +2. The redirect URIs are case-sensitive. +3. The URI must include a scheme and that scheme must be one of `http` or `https`. + +### audience + +{{< confkey type="list(string)" required="no" >}} + +A list of audiences this client is allowed to request. + +### scopes + +{{< confkey type="list(string)" default="openid, groups, profile, email" required="no" >}} + +A list of scopes to allow this client to consume. See +[scope definitions](../../../integration/openid-connect/introduction.md#scope-definitions) for more information. The +documentation for the application you are trying to configure [OpenID Connect 1.0] for will likely have a list of scopes +or claims required which can be matched with the above guide. + +### grant_types + +{{< confkey type="list(string)" default="authorization_code" required="no" >}} + +*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.* + +The list of grant types this client is permitted to use in order to obtain access to the relevant tokens. + +See the [Grant Types](../../../integration/openid-connect/introduction.md#grant-types) section of the +[OpenID Connect 1.0 Integration Guide](../../../integration/openid-connect/introduction.md#grant-types) for more information. + +### response_types + +{{< confkey type="list(string)" default="code" required="no" >}} + +*__Security Note:__ It is recommended that only the `code` response type (i.e. the default) is used. The other response +types are not as secure as this response type.* + +A list of response types this client supports. If a response type not in this list is requested by a client then an +error will be returned to the client. The response type indicates the types of values that are returned to the client. + +See the [Response Types](../../../integration/openid-connect/introduction.md#response-types) section of the +[OpenID Connect 1.0 Integration Guide](../../../integration/openid-connect/introduction.md#response-types) for more information. + +### response_modes + +{{< confkey type="list(string)" default="form_post, query" required="no" >}} + +*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.* + +A list of response modes this client supports. If a response mode not in this list is requested by a client then an +error will be returned to the client. The response mode controls how the response type is returned to the client. + +See the [Response Modes](../../../integration/openid-connect/introduction.md#response-modes) section of the +[OpenID Connect 1.0 Integration Guide](../../../integration/openid-connect/introduction.md#response-modes) for more +information. + +The default values are based on the [response_types](#responsetypes) values. When the [response_types](#responsetypes) +values include the `code` type then the `query` response mode will be included. When any other type is included the +`fragment` response mode will be included. It's important to note at this time we do not support the `none` response +type, but when it is supported it will include the `query` response mode. + +### authorization_policy + +{{< confkey type="string" default="two_factor" required="no" >}} + +The authorization policy for this client: either `one_factor` or `two_factor`. + +### consent_mode + +{{< confkey type="string" default="auto" required="no" >}} + +*__Important Note:__ the `implicit` consent mode is not technically part of the specification. It theoretically could be +misused in certain conditions specifically with the public client type or when the client credentials (i.e. client +secret) has been exposed to an attacker. For these reasons this mode is discouraged.* + +Configures the consent mode. The following table describes the different modes: + +| Value | Description | +|:--------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:| +| auto | Automatically determined (default). Uses `explicit` unless [pre_configured_consent_duration] is specified in which case uses `pre-configured`. | +| explicit | Requires the user provide unique explicit consent for every authorization. | +| implicit | Automatically assumes consent for every authorization, never asking the user if they wish to give consent. | +| pre-configured | Allows the end-user to remember their consent for the [pre_configured_consent_duration]. | + +[pre_configured_consent_duration]: #preconfiguredconsentduration + +### pre_configured_consent_duration + +{{< confkey type="duration" default="1w" required="no" >}} + +*__Note:__ This setting uses the [duration notation format](../../prologue/common.md#duration-notation-format). Please see +the [common options](../../prologue/common.md#duration-notation-format) documentation for information on this format.* + +Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is +specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`. + +The period of time dictates how long a users choice to remember the pre-configured consent lasts. + +Pre-configured consents are only valid if the subject, client id are exactly the same and the requested scopes/audience +match exactly with the granted scopes/audience. + +[consent_mode]: #consentmode + +### enforce_par + +{{< confkey type="boolean" default="false" required="no" >}} + +This configuration option enforces the use of a [Pushed Authorization Requests] flow for this registered client. +To enforce it for all clients see the global [pushed_authorizations enforce](provider.md#enforce) provider configuration +option. + +### enforce_pkce + +{{< confkey type="bool" default="false" required="no" >}} + +This configuration option enforces the use of [PKCE] for this registered client. To enforce it for all clients see the +global [enforce_pkce](provider.md#enforcepkce) provider configuration option. + +### pkce_challenge_method + +{{< confkey type="string" default="" required="no" >}} + +This setting enforces the use of the specified [PKCE] challenge method for this individual client. This setting also +effectively enables the [enforce_pkce](#enforcepkce) option for this client. + +Valid values are an empty string, `plain`, or `S256`. It should be noted that `S256` is strongly recommended if the +relying party supports it. + +### token_endpoint_auth_method + +{{< confkey type="string" default="" required="no" >}} + +The registered client authentication mechanism used by this client for the [Token Endpoint]. If no method is defined +the confidential client type will accept any supported method. The public client type defaults to `none` as this +is required by the specification. This may be required as a breaking change in future versions. +Supported values are `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, and `none`. + +See the [integration guide](../../../integration/openid-connect/introduction.md#client-authentication-method) for +more information. + +### token_endpoint_auth_signing_alg + +{{< confkey type="string" default="RS256" required="no" >}} + +The JWT signing algorithm accepted when the [token_endpoint_auth_method](#tokenendpointauthmethod) is configured as +`client_secret_jwt` or `private_key_jwt`. + +See the request object section of the [integration guide](../../../integration/openid-connect/introduction.md#request-object) +for more information including the algorithm column for supported values. + +It's recommended that you specifically configure this when the following options are configured to specific values +otherwise we assume the default value: + +| Configuration Option | Value | Default | +|:----------------------------------------------------------:|:-------------------:|:-------:| +| [token_endpoint_auth_method](#tokenendpointauthsigningalg) | `private_key_jwt` | `RS256` | +| [token_endpoint_auth_method](#tokenendpointauthsigningalg) | `client_secret_jwt` | `HS256` | + +### request_object_signing_alg + +{{< confkey type="string" default="RSA256" required="no" >}} + +The JWT signing algorithm accepted for request objects. + +See the request object section of the [integration guide](../../../integration/openid-connect/introduction.md#request-object) +for more information including the algorithm column for supported values. + +### id_token_signing_alg + +{{< confkey type="string" default="RS256" required="no" >}} + +The algorithm used to sign the ID Tokens in the token responses. + +See the response object section of the [integration guide](../../../integration/openid-connect/introduction.md#response-object) +for more information including the algorithm column for supported values. In addition to the values listed we also +support `none` as a value for this endpoint. + +### userinfo_signing_alg + +{{< confkey type="string" default="none" required="no" >}} + +The algorithm used to sign the userinfo endpoint responses. + +See the response object section of the [integration guide](../../../integration/openid-connect/introduction.md#response-object) +for more information including the algorithm column for supported values. In addition to the values listed we also +support `none` as a value for this endpoint. + +### public_keys + +This section configures the trusted JSON Web Keys or JWKS for this registered client. This can either be static values +(recommended) or a URI using the `https` scheme. This section is situational required. These are used to validate the +[JWT] assertions from clients. + +Required when the following options are configured: + +- [request_object_signing_alg](#requestobjectsigningalg) +- [token_endpoint_auth_signing_alg](#tokenendpointauthsigningalg) + +Required when the following options are configured to specific values: + +- [token_endpoint_auth_method](#tokenendpointauthsigningalg): `private_key_jwt` + +#### uri + +{{< confkey type="string" required="no" >}} + +The fully qualified, `https` scheme, and appropriately signed URI for the JWKS endpoint that implements +[RFC7517 Section 5](https://datatracker.ietf.org/doc/html/rfc7517#section-5). Must not be configured at the same time +as [values](#values). It's recommended that you do not configure this option, but statically configure [values](#values) +instead. + +*__Important Note:__ the URL given in this value MUST be resolvable by Authelia and MUST present a certificate signed by +a certificate trusted by your environment. It is beyond our intentions to support anything other than this.* + +#### values + +{{< confkey type="list(object)" required="situational" >}} + +A list of static keys. + +##### key_id + +{{< confkey type="string" required="yes" >}} + +The Key ID used to match the request object's JWT header `kid` value against. + +##### key + +{{< confkey type="string" required="yes" >}} + +The public key portion of the JSON Web Key + +The public key the clients use to sign/encrypt the [OpenID Connect 1.0] asserted [JWT]'s. The key is generated by the +client application or the administrator of the client application. + +The key *__MUST__*: + +* Be a PEM block encoded in the DER base64 format ([RFC4648]). +* Be either: + * An RSA public key: + * With a key size of at least 2048 bits. + * An ECDSA public key with one of: + * A P-256 elliptical curve. + * A P-384 elliptical curve. + * A P-512 elliptical curve. + +If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public +key data for the first certificate in the chain. + + +## Integration + +To integrate Authelia's [OpenID Connect 1.0] implementation with a relying party please see the +[integration docs](../../../integration/openid-connect/introduction.md). + +[token lifespan]: https://docs.apigee.com/api-platform/antipatterns/oauth-long-expiration +[OpenID Connect 1.0]: https://openid.net/connect/ +[Token Endpoint]: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint +[JWT]: https://datatracker.ietf.org/doc/html/rfc7519 +[RFC6234]: https://datatracker.ietf.org/doc/html/rfc6234 +[RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648 +[RFC7468]: https://datatracker.ietf.org/doc/html/rfc7468 +[RFC6749 Section 2.1]: https://datatracker.ietf.org/doc/html/rfc6749#section-2.1 +[PKCE]: https://datatracker.ietf.org/doc/html/rfc7636 +[Authorization Code Flow]: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth +[Subject Identifier Type]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes +[Pairwise Identifier Algorithm]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg +[Pushed Authorization Requests]: https://datatracker.ietf.org/doc/html/rfc9126 + diff --git a/docs/content/en/configuration/identity-providers/openid-connect/provider.md b/docs/content/en/configuration/identity-providers/openid-connect/provider.md new file mode 100644 index 000000000..0aee8a2e7 --- /dev/null +++ b/docs/content/en/configuration/identity-providers/openid-connect/provider.md @@ -0,0 +1,428 @@ +--- +title: "OpenID Connect 1.0 Provider" +description: "OpenID Connect 1.0 Provider Configuration" +lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure this." +date: 2023-05-08T13:38:08+10:00 +draft: false +images: [] +menu: + configuration: + parent: "openid-connect" +weight: 190200 +toc: true +aliases: + - /c/oidc + - /docs/configuration/identity-providers/oidc.html +--- + +__Authelia__ currently supports the [OpenID Connect 1.0] Provider role as an open +[__beta__](../../../roadmap/active/openid-connect.md) feature. We currently do not support the [OpenID Connect 1.0] Relying +Party role. This means other applications that implement the [OpenID Connect 1.0] Relying Party role can use Authelia as +an [OpenID Connect 1.0] Provider similar to how you may use social media or development platforms for login. + +The [OpenID Connect 1.0] Relying Party role is the role which allows an application to use GitHub, Google, or other +[OpenID Connect 1.0] Providers for authentication and authorization. We do not intend to support this functionality at +this moment in time. + +This section covers the [OpenID Connect 1.0] Provider configuration. For information on configuring individual +registered clients see the [OpenID Connect 1.0 Clients](clients.md) documentation. + +More information about the beta can be found in the [roadmap](../../../roadmap/active/openid-connect.md) and in the +[integration](../../../integration/openid-connect/introduction.md) documentation. + +## Configuration + +The following snippet provides a configuration example for the [OpenID Connect 1.0] Provider. This is not +intended for production use it's used to provide context and an indentation example. + +```yaml +identity_providers: + oidc: + hmac_secret: this_is_a_secret_abc123abc123abc + issuer_private_keys: + - key_id: example + algorithm: RS256 + use: sig + key: | + -----BEGIN RSA PUBLIC KEY----- + MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz + 9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE= + -----END RSA PUBLIC KEY---- + certificate_chain: | + -----BEGIN CERTIFICATE----- + MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + -----END CERTIFICATE----- + issuer_private_key: | + -----BEGIN RSA PUBLIC KEY----- + MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz + 9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE= + -----END RSA PUBLIC KEY---- + issuer_certificate_chain: | + -----BEGIN CERTIFICATE----- + MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + -----END CERTIFICATE----- + access_token_lifespan: 1h + authorize_code_lifespan: 1m + id_token_lifespan: 1h + refresh_token_lifespan: 90m + enable_client_debug_messages: false + minimum_parameter_entropy: 8 + enforce_pkce: public_clients_only + enable_pkce_plain_challenge: false + pushed_authorizations: + enforce: false + context_lifespan: 5m + cors: + endpoints: + - authorization + - token + - revocation + - introspection + allowed_origins: + - https://example.com + allowed_origins_from_client_redirect_uris: false +``` + +## Options + +### hmac_secret + +{{< confkey type="string" required="yes" >}} + +*__Important Note:__ This can also be defined using a [secret](../../methods/secrets.md) which is __strongly recommended__ +especially for containerized deployments.* + +The HMAC secret used to sign the [JWT]'s. The provided string is hashed to a SHA256 ([RFC6234]) byte string for the +purpose of meeting the required format. + +It's __strongly recommended__ this is a +[Random Alphanumeric String](../../../reference/guides/generating-secure-values.md#generating-a-random-alphanumeric-string) +with 64 or more characters. + +### issuer_private_keys + +The key *__MUST__*: + +* Be a PEM block encoded in the DER base64 format ([RFC4648]). +* Be either: + * An RSA public key: + * With a key size of at least 2048 bits. + * An ECDSA public key with one of: + * A P-256 elliptical curve. + * A P-384 elliptical curve. + * A P-512 elliptical curve. + +### issuer_private_keys + +{{< confkey type="list(object" required="no" >}} + +The list of JWKS instead of or in addition to the [issuer_private_key](#issuerprivatekey) and +[issuer_certificate_chain](#issuercertificatechain). Can also accept ECDSA Private Key's and Certificates. + +#### key_id + +{{< confkey type="string" default="" required="no" >}} + +Completely optional, and generally discouraged unless there is a collision between the automatically generated key id's. +If provided must be a unique string with 7 or less alphanumeric characters. + +This value is the first 7 characters of the public key thumbprint (SHA1) encoded into hexadecimal. + +#### algorithm + +{{< confkey type="string" default="RS256" required="no" >}} + +The algorithm for this key. This value must be unique. It's automatically detected based on the type of key. + +See the response object table in the [integration guide](../../../integration/openid-connect/introduction.md#response-object) +including the algorithm column for the supported values and the key type column for the default algorithm value. + +#### use + +{{< confkey type="string" default="sig" required="no" >}} + +The key usage. Defaults to `sig` which is the only available option at this time. + +#### key + +{{< confkey type="string" required="yes" >}} + +The private key associated with this key entry. + +The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator +and can be done by following the +[Generating an RSA Keypair](../../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide. + +The private key *__MUST__*: +* Be a PEM block encoded in the DER base64 format ([RFC4648]). +* Be one of: + * An RSA key with a key size of at least 2048 bits. + * An ECDSA private key with one of the P-256, P-384, or P-521 elliptical curves. + +If the [certificate_chain](#certificatechain) is provided the private key must include matching public +key data for the first certificate in the chain. + +#### certificate_chain + +{{< confkey type="string" required="no" >}} + +The certificate chain/bundle to be used with the [key](#key) DER base64 ([RFC4648]) +encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t] +JSON key's in the JWKs [Discoverable Endpoint](../../../integration/openid-connect/introduction.md#discoverable-endpoints) +as per [RFC7517]. + +[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517 +[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 +[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8 + +The first certificate in the chain must have the public key for the [key](#key), each certificate in the chain must be +valid for the current date, and each certificate in the chain should be signed by the certificate immediately following +it if present. + +### issuer_private_key + +{{< confkey type="string" required="yes" >}} + +*__Important Note:__ This can also be defined using a [secret](../../methods/secrets.md) which is __strongly recommended__ +especially for containerized deployments.* + +The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator +and can be done by following the +[Generating an RSA Keypair](../../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide. + +This private key is automatically appended to the [issuer_private_keys](#issuerprivatekeys) and assumed to be for the +RS256 algorithm. As such no other key in this list should be RS256 if this is configured. + +The issuer private key *__MUST__*: + +* Be a PEM block encoded in the DER base64 format ([RFC4648]). +* Be an RSA private key: + * With a key size of at least 2048 bits. + +If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public +key data for the first certificate in the chain. + +### issuer_certificate_chain + +{{< confkey type="string" required="no" >}} + +The certificate chain/bundle to be used with the [issuer_private_key](#issuer_private_key) DER base64 ([RFC4648]) +encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t] +JSON key's in the JWKs [Discoverable Endpoint](../../../integration/openid-connect/introduction.md#discoverable-endpoints) +as per [RFC7517]. + +[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517 +[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 +[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8 + +The first certificate in the chain must have the public key for the [issuer_private_key](#issuerprivatekey), each +certificate in the chain must be valid for the current date, and each certificate in the chain should be signed by the +certificate immediately following it if present. + +### access_token_lifespan + +{{< confkey type="duration" default="1h" required="no" >}} + +The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default. +For more information read these docs about [token lifespan]. + +### authorize_code_lifespan + +{{< confkey type="duration" default="1m" required="no" >}} + +The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to +obtain the other token types. For more information read these docs about [token lifespan]. + +### id_token_lifespan + +{{< confkey type="duration" default="1h" required="no" >}} + +The maximum lifetime of an ID token. For more information read these docs about [token lifespan]. + +### refresh_token_lifespan + +{{< confkey type="string" default="90m" required="no" >}} + +The maximum lifetime of a refresh token. The +refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an +up-to-date expiration. For more information read these docs about [token lifespan]. + +A good starting point is 50% more or 30 minutes more (which ever is less) time than the highest lifespan out of the +[access token lifespan](#accesstokenlifespan), the [authorize code lifespan](#authorizecodelifespan), and the +[id token lifespan](#idtokenlifespan). For instance the default for all of these is 60 minutes, so the default refresh +token lifespan is 90 minutes. + +### enable_client_debug_messages + +{{< confkey type="boolean" default="false" required="no" >}} + +Allows additional debug messages to be sent to the clients. + +### minimum_parameter_entropy + +{{< confkey type="integer" default="8" required="no" >}} + +This controls the minimum length of the `nonce` and `state` parameters. + +*__Security Notice:__* Changing this value is generally discouraged, reducing it from the default can theoretically +make certain scenarios less secure. It is highly encouraged that if your OpenID Connect RP does not send these +parameters or sends parameters with a lower length than the default that they implement a change rather than changing +this value. + +### enforce_pkce + +{{< confkey type="string" default="public_clients_only" required="no" >}} + +[Proof Key for Code Exchange](https://datatracker.ietf.org/doc/html/rfc7636) enforcement policy: if specified, must be +either `never`, `public_clients_only` or `always`. + +If set to `public_clients_only` (default), [PKCE] will be required for public clients using the +[Authorization Code Flow]. + +When set to `always`, [PKCE] will be required for all clients using the Authorization Code flow. + +*__Security Notice:__* Changing this value to `never` is generally discouraged, reducing it from the default can +theoretically make certain client-side applications (mobile applications, SPA) vulnerable to CSRF and authorization code +interception attacks. + +### enable_pkce_plain_challenge + +{{< confkey type="boolean" default="false" required="no" >}} + +Allows [PKCE] `plain` challenges when set to `true`. + +*__Security Notice:__* Changing this value is generally discouraged. Applications should use the `S256` [PKCE] challenge +method instead. + +### pushed_authorizations + +Controls the behaviour of [Pushed Authorization Requests]. + +#### enforce + +{{< confkey type="boolean" default="false" required="no" >}} + +When enabled all authorization requests must use the [Pushed Authorization Requests] flow. + +#### context_lifespan + +{{< confkey type="duration" default="5m" required="no" >}} + +The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated +`request_uri` being utilized by a client. + +### cors + +Some [OpenID Connect 1.0] Endpoints need to allow cross-origin resource sharing, however some are optional. This section allows +you to configure the optional parts. We reply with CORS headers when the request includes the Origin header. + +#### endpoints + +{{< confkey type="list(string)" required="no" >}} + +A list of endpoints to configure with cross-origin resource sharing headers. It is recommended that the `userinfo` +option is at least in this list. The potential endpoints which this can be enabled on are as follows: + +* authorization +* pushed-authorization-request +* token +* revocation +* introspection +* userinfo + +#### allowed_origins + +{{< confkey type="list(string)" required="no" >}} + +A list of permitted origins. + +Any origin with https is permitted unless this option is configured or the +[allowed_origins_from_client_redirect_uris](#allowedoriginsfromclientredirecturis) option is enabled. This means +you must configure this option manually if you want http endpoints to be permitted to make cross-origin requests to the +[OpenID Connect 1.0] endpoints, however this is not recommended. + +Origins must only have the scheme, hostname and port, they may not have a trailing slash or path. + +In addition to an Origin URI, you may specify the wildcard origin in the allowed_origins. It MUST be specified by itself +and the [allowed_origins_from_client_redirect_uris](#allowedoriginsfromclientredirecturis) MUST NOT be enabled. The +wildcard origin is denoted as `*`. Examples: + +```yaml +identity_providers: + oidc: + cors: + allowed_origins: "*" +``` + +```yaml +identity_providers: + oidc: + cors: + allowed_origins: + - "*" +``` + +#### allowed_origins_from_client_redirect_uris + +{{< confkey type="boolean" default="false" required="no" >}} + +Automatically adds the origin portion of all redirect URI's on all clients to the list of +[allowed_origins](#allowed_origins), provided they have the scheme http or https and do not have the hostname of +localhost. + +### clients + +See the [OpenID Connect 1.0 Registered Clients](clients.md) documentation for configuring clients. + +## Integration + +To integrate Authelia's [OpenID Connect 1.0] implementation with a relying party please see the +[integration docs](../../integration/openid-connect/introduction.md). + +[token lifespan]: https://docs.apigee.com/api-platform/antipatterns/oauth-long-expiration +[OpenID Connect 1.0]: https://openid.net/connect/ +[Token Endpoint]: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint +[JWT]: https://datatracker.ietf.org/doc/html/rfc7519 +[RFC6234]: https://datatracker.ietf.org/doc/html/rfc6234 +[RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648 +[RFC7468]: https://datatracker.ietf.org/doc/html/rfc7468 +[RFC6749 Section 2.1]: https://datatracker.ietf.org/doc/html/rfc6749#section-2.1 +[PKCE]: https://datatracker.ietf.org/doc/html/rfc7636 +[Authorization Code Flow]: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth +[Subject Identifier Type]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes +[Pairwise Identifier Algorithm]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg +[Pushed Authorization Requests]: https://datatracker.ietf.org/doc/html/rfc9126 diff --git a/docs/content/en/configuration/methods/secrets.md b/docs/content/en/configuration/methods/secrets.md index 182c74edd..520da1de1 100644 --- a/docs/content/en/configuration/methods/secrets.md +++ b/docs/content/en/configuration/methods/secrets.md @@ -77,9 +77,9 @@ other configuration using the environment but instead of loading a file the valu [authentication_backend.ldap.password]: ../first-factor/ldap.md#password [authentication_backend.ldap.tls.certificate_chain]: ../first-factor/ldap.md#tls [authentication_backend.ldap.tls.private_key]: ../first-factor/ldap.md#tls -[identity_providers.oidc.issuer_certificate_chain]: ../identity-providers/open-id-connect.md#issuercertificatechain -[identity_providers.oidc.issuer_private_key]: ../identity-providers/open-id-connect.md#issuerprivatekey -[identity_providers.oidc.hmac_secret]: ../identity-providers/open-id-connect.md#hmacsecret +[identity_providers.oidc.issuer_certificate_chain]: ../identity-providers/openid-connect.md#issuercertificatechain +[identity_providers.oidc.issuer_private_key]: ../identity-providers/openid-connect.md#issuerprivatekey +[identity_providers.oidc.hmac_secret]: ../identity-providers/openid-connect.md#hmacsecret ## Secrets in configuration file diff --git a/docs/content/en/configuration/miscellaneous/privacy-policy.md b/docs/content/en/configuration/miscellaneous/privacy-policy.md index 327b7e821..98a057ed3 100644 --- a/docs/content/en/configuration/miscellaneous/privacy-policy.md +++ b/docs/content/en/configuration/miscellaneous/privacy-policy.md @@ -44,7 +44,7 @@ accepted is recorded and checked in the browser If the user has not accepted the policy they should not be able to interact with the Authelia UI via normal means. Administrators who are required to abide by the [GDPR] or other privacy laws should be advised that -[OpenID Connect 1.0](../identity-providers/open-id-connect.md) clients configured with the `implicit` consent mode are +[OpenID Connect 1.0](../identity-providers/openid-connect.md) clients configured with the `implicit` consent mode are unlikely to trigger the display of the Authelia UI if the user is already authenticated. We wont be adding checks like this to the `implicit` consent mode when that mode in particular is unlikely to be diff --git a/docs/content/en/integration/openid-connect/apache-guacamole/index.md b/docs/content/en/integration/openid-connect/apache-guacamole/index.md index ac21220f2..748d6144f 100644 --- a/docs/content/en/integration/openid-connect/apache-guacamole/index.md +++ b/docs/content/en/integration/openid-connect/apache-guacamole/index.md @@ -53,7 +53,7 @@ openid-groups-claim-type: groups ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Apache Guacamole] which will operate with the above example: ```yaml @@ -78,7 +78,7 @@ identity_providers: - 'id_token' grant_types: - 'implicit' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/argocd/index.md b/docs/content/en/integration/openid-connect/argocd/index.md index 43071cced..6beaec647 100644 --- a/docs/content/en/integration/openid-connect/argocd/index.md +++ b/docs/content/en/integration/openid-connect/argocd/index.md @@ -56,7 +56,7 @@ requestedScopes: ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Argo CD] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Argo CD] which will operate with the above example: ```yaml @@ -77,7 +77,7 @@ identity_providers: - 'groups' - 'email' - 'profile' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' - id: 'argocd-cli' description: 'Argo CD (CLI)' public: true @@ -90,7 +90,7 @@ identity_providers: - 'email' - 'profile' - 'offline_access' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/bookstack/index.md b/docs/content/en/integration/openid-connect/bookstack/index.md index 3d8ef133c..ea8f76aaa 100644 --- a/docs/content/en/integration/openid-connect/bookstack/index.md +++ b/docs/content/en/integration/openid-connect/bookstack/index.md @@ -58,7 +58,7 @@ To configure [BookStack] to utilize Authelia as an [OpenID Connect 1.0] Provider ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [BookStack] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [BookStack] which will operate with the above example: ```yaml @@ -78,7 +78,7 @@ identity_providers: - 'openid' - 'profile' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md b/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md index 2259f473a..e3b7b5217 100644 --- a/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md +++ b/docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md @@ -66,7 +66,7 @@ To configure [Cloudflare Zero Trust] to utilize Authelia as an [OpenID Connect 1 ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Cloudflare] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Cloudflare] which will operate with the above example: ```yaml @@ -86,7 +86,7 @@ identity_providers: - 'openid' - 'profile' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/firezone/index.md b/docs/content/en/integration/openid-connect/firezone/index.md index 121c49cc3..b562d6c78 100644 --- a/docs/content/en/integration/openid-connect/firezone/index.md +++ b/docs/content/en/integration/openid-connect/firezone/index.md @@ -67,7 +67,7 @@ descriptions. ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Firezone] which +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Firezone] which will operate with the above example: ```yaml @@ -89,7 +89,7 @@ identity_providers: - 'openid' - 'email' - 'profile' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/gitea/index.md b/docs/content/en/integration/openid-connect/gitea/index.md index ed4c691c9..2b31c12d6 100644 --- a/docs/content/en/integration/openid-connect/gitea/index.md +++ b/docs/content/en/integration/openid-connect/gitea/index.md @@ -77,7 +77,7 @@ descriptions. ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Gitea] which +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Gitea] which will operate with the above example: ```yaml @@ -97,7 +97,7 @@ identity_providers: - 'openid' - 'email' - 'profile' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/gitlab/index.md b/docs/content/en/integration/openid-connect/gitlab/index.md index 71ba8d01c..2038a5797 100644 --- a/docs/content/en/integration/openid-connect/gitlab/index.md +++ b/docs/content/en/integration/openid-connect/gitlab/index.md @@ -69,7 +69,7 @@ gitlab_rails['omniauth_providers'] = [ ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [GitLab] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [GitLab] which will operate with the above example: ```yaml @@ -90,7 +90,7 @@ identity_providers: - 'profile' - 'groups' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/grafana/index.md b/docs/content/en/integration/openid-connect/grafana/index.md index 245b588c6..7c361281e 100644 --- a/docs/content/en/integration/openid-connect/grafana/index.md +++ b/docs/content/en/integration/openid-connect/grafana/index.md @@ -87,7 +87,7 @@ Configure the following environment variables: ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Grafana] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Grafana] which will operate with the above example: ```yaml @@ -108,7 +108,7 @@ identity_providers: - 'profile' - 'groups' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/harbor/index.md b/docs/content/en/integration/openid-connect/harbor/index.md index 2c8223657..75e8d1986 100644 --- a/docs/content/en/integration/openid-connect/harbor/index.md +++ b/docs/content/en/integration/openid-connect/harbor/index.md @@ -60,7 +60,7 @@ To configure [Harbor] to utilize Authelia as an [OpenID Connect 1.0] Provider: ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Harbor] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Harbor] which will operate with the above example: ```yaml @@ -81,7 +81,7 @@ identity_providers: - 'profile' - 'groups' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/hashicorp-vault/index.md b/docs/content/en/integration/openid-connect/hashicorp-vault/index.md index 8c5a9713c..4f7bb544a 100644 --- a/docs/content/en/integration/openid-connect/hashicorp-vault/index.md +++ b/docs/content/en/integration/openid-connect/hashicorp-vault/index.md @@ -43,7 +43,7 @@ To configure [HashiCorp Vault] to utilize Authelia as an [OpenID Connect 1.0] Pr ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [HashiCorp Vault] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [HashiCorp Vault] which will operate with the above example: ```yaml @@ -65,7 +65,7 @@ identity_providers: - 'profile' - 'groups' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/introduction.md b/docs/content/en/integration/openid-connect/introduction.md index e1568acdd..b9c092386 100644 --- a/docs/content/en/integration/openid-connect/introduction.md +++ b/docs/content/en/integration/openid-connect/introduction.md @@ -18,8 +18,10 @@ Authelia can act as an [OpenID Connect 1.0] Provider as part of an open beta. Th specifics that can be used for integrating Authelia with an [OpenID Connect 1.0] Relying Party, as well as specific documentation for some [OpenID Connect 1.0] Relying Party implementations. -See the [configuration documentation](../../configuration/identity-providers/open-id-connect.md) for information on how -to configure the Authelia [OpenID Connect 1.0] Provider. +See the [OpenID Connect 1.0 Provider](../../configuration/identity-providers/openid-connect/provider.md) and +[OpenID Connect 1.0 Clients](../../configuration/identity-providers/openid-connect/clients.md) configuration guides for +information on how to configure the Authelia [OpenID Connect 1.0] Provider (note the clients guide is for configuring +the registered clients in the provider). This page is intended as an integration reference point for any implementers who wish to integrate an [OpenID Connect 1.0] Relying Party (client application) either as a developer or user of the third party Reyling Party. @@ -124,6 +126,7 @@ Authelia's response objects can have the following signature algorithms: ### Request Object +Authelia accepts a wide variety of request object types. | Algorithm | Key Type | Hashing Algorithm | Use | Notes | |:---------:|:------------------:|:-----------------:|:---------:|:--------------------------------------------------:| @@ -131,6 +134,15 @@ Authelia's response objects can have the following signature algorithms: | HS256 | HMAC Shared Secret | SHA-256 | Signature | [Client Authentication Method] `client_secret_jwt` | | HS384 | HMAC Shared Secret | SHA-384 | Signature | [Client Authentication Method] `client_secret_jwt` | | HS512 | HMAC Shared Secret | SHA-512 | Signature | [Client Authentication Method] `client_secret_jwt` | +| RS256 | RSA | SHA-256 | Signature | [Client Authentication Method] `private_key_jwt` | +| RS384 | RSA | SHA-384 | Signature | [Client Authentication Method] `private_key_jwt` | +| RS512 | RSA | SHA-512 | Signature | [Client Authentication Method] `private_key_jwt` | +| ES256 | ECDSA P-256 | SHA-256 | Signature | [Client Authentication Method] `private_key_jwt` | +| ES384 | ECDSA P-384 | SHA-384 | Signature | [Client Authentication Method] `private_key_jwt` | +| ES512 | ECDSA P-521 | SHA-512 | Signature | [Client Authentication Method] `private_key_jwt` | +| PS256 | RSA (MFG1) | SHA-256 | Signature | [Client Authentication Method] `private_key_jwt` | +| PS384 | RSA (MFG1) | SHA-384 | Signature | [Client Authentication Method] `private_key_jwt` | +| PS512 | RSA (MFG1) | SHA-512 | Signature | [Client Authentication Method] `private_key_jwt` | [Client Authentication Method]: #client-authentication-method @@ -208,7 +220,7 @@ specification and the [OAuth 2.0 - Client Types] specification for more informat | Secret via HTTP Basic Auth Scheme | `client_secret_basic` | `confidential` | N/A | N/A | | Secret via HTTP POST Body | `client_secret_post` | `confidential` | N/A | N/A | | JWT (signed by secret) | `client_secret_jwt` | `confidential` | N/A | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` | -| JWT (signed by private key) | `private_key_jwt` | Not Supported | N/A | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` | +| JWT (signed by private key) | `private_key_jwt` | `confidential` | N/A | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` | | [OAuth 2.0 Mutual-TLS] | `tls_client_auth` | Not Supported | N/A | N/A | | [OAuth 2.0 Mutual-TLS] (Self Signed) | `self_signed_tls_client_auth` | Not Supported | N/A | N/A | | No Authentication | `none` | `public` | `public` | N/A | @@ -243,7 +255,7 @@ Below is a list of the potential values we place in the [Claim] and their meanin ## User Information Signing Algorithm The following table describes the response from the [UserInfo] endpoint depending on the -[userinfo_signing_algorithm](../../configuration/identity-providers/open-id-connect.md#userinfosigningalgorithm). +[userinfo_signing_alg](../../configuration/identity-providers/openid-connect/clients.md#userinfosigningalg). | Signing Algorithm | Encoding | Content Type | |:-----------------:|:------------:|:-----------------------------------:| diff --git a/docs/content/en/integration/openid-connect/kasm-workspaces/index.md b/docs/content/en/integration/openid-connect/kasm-workspaces/index.md index 873c04098..a0d4628a4 100644 --- a/docs/content/en/integration/openid-connect/kasm-workspaces/index.md +++ b/docs/content/en/integration/openid-connect/kasm-workspaces/index.md @@ -80,7 +80,7 @@ identity_providers: - 'groups' - 'email' consent_mode: 'implicit' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/komga/index.md b/docs/content/en/integration/openid-connect/komga/index.md index 2299af893..666131506 100644 --- a/docs/content/en/integration/openid-connect/komga/index.md +++ b/docs/content/en/integration/openid-connect/komga/index.md @@ -65,7 +65,7 @@ spring: ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Komga] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Komga] which will operate with the above example: ```yaml @@ -87,7 +87,7 @@ identity_providers: - 'email' grant_types: - 'authorization_code' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/minio/index.md b/docs/content/en/integration/openid-connect/minio/index.md index 8b3067002..77d637329 100644 --- a/docs/content/en/integration/openid-connect/minio/index.md +++ b/docs/content/en/integration/openid-connect/minio/index.md @@ -63,7 +63,7 @@ To configure [MinIO] to utilize Authelia as an [OpenID Connect 1.0] Provider: ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [MinIO] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [MinIO] which will operate with the above example: ```yaml @@ -84,7 +84,7 @@ identity_providers: - 'profile' - 'email' - 'groups' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/misago/index.md b/docs/content/en/integration/openid-connect/misago/index.md index dc11c8efc..c6e3c96b3 100644 --- a/docs/content/en/integration/openid-connect/misago/index.md +++ b/docs/content/en/integration/openid-connect/misago/index.md @@ -79,7 +79,7 @@ To configure [Misago] to utilize Authelia as an [OpenID Connect 1.0](https://www ### Authelia -The following YAML configuration is an example **Authelia** [client configuration](https://www.authelia.com/configuration/identity-providers/open-id-connect/#clients) for use with [Misago] which will operate with the above example: +The following YAML configuration is an example **Authelia** [client configuration](https://www.authelia.com/configuration/identity-providers/openid-connect/#clients) for use with [Misago] which will operate with the above example: ```yaml identity_providers: @@ -104,7 +104,7 @@ identity_providers: - 'code' response_modes: - 'query' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` --- diff --git a/docs/content/en/integration/openid-connect/nextcloud/index.md b/docs/content/en/integration/openid-connect/nextcloud/index.md index 540e2069e..aec1cb971 100644 --- a/docs/content/en/integration/openid-connect/nextcloud/index.md +++ b/docs/content/en/integration/openid-connect/nextcloud/index.md @@ -86,7 +86,7 @@ $CONFIG = array ( ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Nextcloud] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Nextcloud] which will operate with the above example: ```yaml @@ -107,7 +107,7 @@ identity_providers: - 'profile' - 'email' - 'groups' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/outline/index.md b/docs/content/en/integration/openid-connect/outline/index.md index 1a330e0f8..f5e8a9109 100644 --- a/docs/content/en/integration/openid-connect/outline/index.md +++ b/docs/content/en/integration/openid-connect/outline/index.md @@ -60,7 +60,7 @@ OIDC_SCOPES="openid offline_access profile email" ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Outline] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Outline] which will operate with the above example: ```yaml @@ -81,7 +81,7 @@ identity_providers: - 'offline_access' - 'profile' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/portainer/index.md b/docs/content/en/integration/openid-connect/portainer/index.md index e50a282da..1dee69eb5 100644 --- a/docs/content/en/integration/openid-connect/portainer/index.md +++ b/docs/content/en/integration/openid-connect/portainer/index.md @@ -61,7 +61,7 @@ To configure [Portainer] to utilize Authelia as an [OpenID Connect 1.0] Provider ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Portainer] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Portainer] which will operate with the above example: ```yaml @@ -82,7 +82,7 @@ identity_providers: - 'profile' - 'groups' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/proxmox/index.md b/docs/content/en/integration/openid-connect/proxmox/index.md index 17eefafc9..0771e34fb 100644 --- a/docs/content/en/integration/openid-connect/proxmox/index.md +++ b/docs/content/en/integration/openid-connect/proxmox/index.md @@ -65,7 +65,7 @@ To configure [Proxmox] to utilize Authelia as an [OpenID Connect 1.0] Provider: ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Proxmox] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Proxmox] which will operate with the above example: ```yaml @@ -85,7 +85,7 @@ identity_providers: - 'openid' - 'profile' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/seafile/index.md b/docs/content/en/integration/openid-connect/seafile/index.md index 41b4e1482..5486f17d4 100644 --- a/docs/content/en/integration/openid-connect/seafile/index.md +++ b/docs/content/en/integration/openid-connect/seafile/index.md @@ -69,7 +69,7 @@ OAUTH_ATTRIBUTE_MAP = { ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Seafile] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Seafile] which will operate with the above example: ```yaml @@ -89,7 +89,7 @@ identity_providers: - 'openid' - 'profile' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/synapse/index.md b/docs/content/en/integration/openid-connect/synapse/index.md index 1927f306e..76d6f90d3 100644 --- a/docs/content/en/integration/openid-connect/synapse/index.md +++ b/docs/content/en/integration/openid-connect/synapse/index.md @@ -63,7 +63,7 @@ oidc_providers: ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Synapse] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Synapse] which will operate with the above example: ```yaml @@ -83,7 +83,7 @@ identity_providers: - 'openid' - 'profile' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/openid-connect/synology-dsm/index.md b/docs/content/en/integration/openid-connect/synology-dsm/index.md index a5dcd075e..a433b3ec5 100644 --- a/docs/content/en/integration/openid-connect/synology-dsm/index.md +++ b/docs/content/en/integration/openid-connect/synology-dsm/index.md @@ -65,7 +65,7 @@ To configure [Synology DSM] to utilize Authelia as an [OpenID Connect 1.0] Provi ### Authelia The following YAML configuration is an example __Authelia__ -[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Synology DSM] +[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Synology DSM] which will operate with the above example: ```yaml @@ -86,7 +86,7 @@ identity_providers: - 'profile' - 'groups' - 'email' - userinfo_signing_algorithm: 'none' + userinfo_signing_alg: 'none' ``` ## See Also diff --git a/docs/content/en/integration/proxies/swag.md b/docs/content/en/integration/proxies/swag.md index f936ac7fa..ca936527c 100644 --- a/docs/content/en/integration/proxies/swag.md +++ b/docs/content/en/integration/proxies/swag.md @@ -58,7 +58,7 @@ In addition this represents a bad user experience in some instances such as: * Users sometimes visit the `https://app.example.com/authelia` URL which doesn't automatically redirect the user to `https://app.example.com` (if they visit `https://app.example.com` then they'll be redirected to authenticate then redirected back to their original URL) -* Administrators may wish to setup [OpenID Connect 1.0](../../configuration/identity-providers/open-id-connect.md) in +* Administrators may wish to setup [OpenID Connect 1.0](../../configuration/identity-providers/openid-connect/provider.md) in which case it also doesn't represent a good user experience as the `issuer` will be `https://app.example.com/authelia` for example * Using the [SWAG] default configurations are more difficult to support as our specific familiarity is with our own diff --git a/docs/content/en/overview/authorization/openid-connect-1.0.md b/docs/content/en/overview/authorization/openid-connect-1.0.md index a8326699a..9764f6403 100644 --- a/docs/content/en/overview/authorization/openid-connect-1.0.md +++ b/docs/content/en/overview/authorization/openid-connect-1.0.md @@ -16,6 +16,6 @@ configure your applications to use Authelia as an [OpenID Connect 1.0 Provider]( currently operate as an [OpenID Connect 1.0 Relying Party](https://openid.net/connect/). This like all single-sign on technologies requires support by the protected application. -See the [OpenID Connect 1.0 Configuration Guide](../../configuration/identity-providers/open-id-connect.md) and the +See the [OpenID Connect 1.0 Provider Configuration Guide](../../configuration/identity-providers/openid-connect/provider.md), and the [OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md) for more information. diff --git a/docs/content/en/roadmap/active/openid-connect.md b/docs/content/en/roadmap/active/openid-connect.md index e49c56565..fd1b02b19 100644 --- a/docs/content/en/roadmap/active/openid-connect.md +++ b/docs/content/en/roadmap/active/openid-connect.md @@ -115,8 +115,15 @@ Feature List: {{< roadmap-status stage="in-progress" version="v4.38.0" >}} -* [OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC9126: OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126) +* [RFC7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://datatracker.ietf.org/doc/html/rfc7523): + * Client Auth Method `client_secret_jwt` + * Client Auth Method `private_key_jwt` * Per-Client [Proof Key Code Exchange (PKCE)] Policy +* Multiple Issuer JWKs: + * RS256, RS384, RS512 + * PS256, PS384, PS512 + * ES256, ES384, ES512 ### Beta 7 diff --git a/docs/data/configkeys.json b/docs/data/configkeys.json index cdbb3a02c..7c8f5bc0e 100644 --- a/docs/data/configkeys.json +++ b/docs/data/configkeys.json @@ -1 +1 @@ -[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.address","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDRESS"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.address","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_ADDRESS"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.address","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_ADDRESS"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_ADDRESS"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file +[{"path":"theme","secret":false,"env":"AUTHELIA_THEME"},{"path":"certificates_directory","secret":false,"env":"AUTHELIA_CERTIFICATES_DIRECTORY"},{"path":"jwt_secret","secret":true,"env":"AUTHELIA_JWT_SECRET_FILE"},{"path":"default_redirection_url","secret":false,"env":"AUTHELIA_DEFAULT_REDIRECTION_URL"},{"path":"default_2fa_method","secret":false,"env":"AUTHELIA_DEFAULT_2FA_METHOD"},{"path":"log.level","secret":false,"env":"AUTHELIA_LOG_LEVEL"},{"path":"log.format","secret":false,"env":"AUTHELIA_LOG_FORMAT"},{"path":"log.file_path","secret":false,"env":"AUTHELIA_LOG_FILE_PATH"},{"path":"log.keep_stdout","secret":false,"env":"AUTHELIA_LOG_KEEP_STDOUT"},{"path":"identity_providers.oidc.hmac_secret","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE"},{"path":"identity_providers.oidc.issuer_certificate_chain","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_CERTIFICATE_CHAIN_FILE"},{"path":"identity_providers.oidc.issuer_private_key","secret":true,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE"},{"path":"identity_providers.oidc.access_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ACCESS_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.authorize_code_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_AUTHORIZE_CODE_LIFESPAN"},{"path":"identity_providers.oidc.id_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ID_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.refresh_token_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_REFRESH_TOKEN_LIFESPAN"},{"path":"identity_providers.oidc.enable_client_debug_messages","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_CLIENT_DEBUG_MESSAGES"},{"path":"identity_providers.oidc.minimum_parameter_entropy","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_MINIMUM_PARAMETER_ENTROPY"},{"path":"identity_providers.oidc.enforce_pkce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENFORCE_PKCE"},{"path":"identity_providers.oidc.enable_pkce_plain_challenge","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_ENABLE_PKCE_PLAIN_CHALLENGE"},{"path":"identity_providers.oidc.pushed_authorizations.enforce","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_ENFORCE"},{"path":"identity_providers.oidc.pushed_authorizations.context_lifespan","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_PUSHED_AUTHORIZATIONS_CONTEXT_LIFESPAN"},{"path":"identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC_CORS_ALLOWED_ORIGINS_FROM_CLIENT_REDIRECT_URIS"},{"path":"identity_providers.oidc","secret":false,"env":"AUTHELIA_IDENTITY_PROVIDERS_OIDC"},{"path":"authentication_backend.password_reset.disable","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_DISABLE"},{"path":"authentication_backend.password_reset.custom_url","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_PASSWORD_RESET_CUSTOM_URL"},{"path":"authentication_backend.refresh_interval","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_REFRESH_INTERVAL"},{"path":"authentication_backend.file.path","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH"},{"path":"authentication_backend.file.watch","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_WATCH"},{"path":"authentication_backend.file.password.algorithm","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ALGORITHM"},{"path":"authentication_backend.file.password.argon2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_VARIANT"},{"path":"authentication_backend.file.password.argon2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_ITERATIONS"},{"path":"authentication_backend.file.password.argon2.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_MEMORY"},{"path":"authentication_backend.file.password.argon2.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_PARALLELISM"},{"path":"authentication_backend.file.password.argon2.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_KEY_LENGTH"},{"path":"authentication_backend.file.password.argon2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ARGON2_SALT_LENGTH"},{"path":"authentication_backend.file.password.sha2crypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_VARIANT"},{"path":"authentication_backend.file.password.sha2crypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.sha2crypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SHA2CRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.pbkdf2.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_VARIANT"},{"path":"authentication_backend.file.password.pbkdf2.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_ITERATIONS"},{"path":"authentication_backend.file.password.pbkdf2.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PBKDF2_SALT_LENGTH"},{"path":"authentication_backend.file.password.bcrypt.variant","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_VARIANT"},{"path":"authentication_backend.file.password.bcrypt.cost","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_BCRYPT_COST"},{"path":"authentication_backend.file.password.scrypt.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_ITERATIONS"},{"path":"authentication_backend.file.password.scrypt.block_size","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_BLOCK_SIZE"},{"path":"authentication_backend.file.password.scrypt.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_PARALLELISM"},{"path":"authentication_backend.file.password.scrypt.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_KEY_LENGTH"},{"path":"authentication_backend.file.password.scrypt.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SCRYPT_SALT_LENGTH"},{"path":"authentication_backend.file.password.iterations","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_ITERATIONS"},{"path":"authentication_backend.file.password.memory","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_MEMORY"},{"path":"authentication_backend.file.password.parallelism","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_PARALLELISM"},{"path":"authentication_backend.file.password.key_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_KEY_LENGTH"},{"path":"authentication_backend.file.password.salt_length","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_PASSWORD_SALT_LENGTH"},{"path":"authentication_backend.file.search.email","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_EMAIL"},{"path":"authentication_backend.file.search.case_insensitive","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_FILE_SEARCH_CASE_INSENSITIVE"},{"path":"authentication_backend.ldap.address","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDRESS"},{"path":"authentication_backend.ldap.implementation","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_IMPLEMENTATION"},{"path":"authentication_backend.ldap.timeout","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TIMEOUT"},{"path":"authentication_backend.ldap.start_tls","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_START_TLS"},{"path":"authentication_backend.ldap.tls.minimum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MINIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.maximum_version","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_MAXIMUM_VERSION"},{"path":"authentication_backend.ldap.tls.skip_verify","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SKIP_VERIFY"},{"path":"authentication_backend.ldap.tls.server_name","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_SERVER_NAME"},{"path":"authentication_backend.ldap.tls.private_key","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_PRIVATE_KEY_FILE"},{"path":"authentication_backend.ldap.tls.certificate_chain","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"authentication_backend.ldap.base_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN"},{"path":"authentication_backend.ldap.additional_users_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_USERS_DN"},{"path":"authentication_backend.ldap.users_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERS_FILTER"},{"path":"authentication_backend.ldap.additional_groups_dn","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN"},{"path":"authentication_backend.ldap.groups_filter","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUPS_FILTER"},{"path":"authentication_backend.ldap.group_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_GROUP_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.username_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USERNAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.mail_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_MAIL_ATTRIBUTE"},{"path":"authentication_backend.ldap.display_name_attribute","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_DISPLAY_NAME_ATTRIBUTE"},{"path":"authentication_backend.ldap.permit_referrals","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_REFERRALS"},{"path":"authentication_backend.ldap.permit_unauthenticated_bind","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_UNAUTHENTICATED_BIND"},{"path":"authentication_backend.ldap.permit_feature_detection_failure","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PERMIT_FEATURE_DETECTION_FAILURE"},{"path":"authentication_backend.ldap.user","secret":false,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER"},{"path":"authentication_backend.ldap.password","secret":true,"env":"AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE"},{"path":"session.secret","secret":true,"env":"AUTHELIA_SESSION_SECRET_FILE"},{"path":"session.name","secret":false,"env":"AUTHELIA_SESSION_NAME"},{"path":"session.domain","secret":false,"env":"AUTHELIA_SESSION_DOMAIN"},{"path":"session.same_site","secret":false,"env":"AUTHELIA_SESSION_SAME_SITE"},{"path":"session.expiration","secret":false,"env":"AUTHELIA_SESSION_EXPIRATION"},{"path":"session.inactivity","secret":false,"env":"AUTHELIA_SESSION_INACTIVITY"},{"path":"session.remember_me","secret":false,"env":"AUTHELIA_SESSION_REMEMBER_ME"},{"path":"session","secret":false,"env":"AUTHELIA_SESSION"},{"path":"session.redis.host","secret":false,"env":"AUTHELIA_SESSION_REDIS_HOST"},{"path":"session.redis.port","secret":false,"env":"AUTHELIA_SESSION_REDIS_PORT"},{"path":"session.redis.username","secret":false,"env":"AUTHELIA_SESSION_REDIS_USERNAME"},{"path":"session.redis.password","secret":true,"env":"AUTHELIA_SESSION_REDIS_PASSWORD_FILE"},{"path":"session.redis.database_index","secret":false,"env":"AUTHELIA_SESSION_REDIS_DATABASE_INDEX"},{"path":"session.redis.maximum_active_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MAXIMUM_ACTIVE_CONNECTIONS"},{"path":"session.redis.minimum_idle_connections","secret":false,"env":"AUTHELIA_SESSION_REDIS_MINIMUM_IDLE_CONNECTIONS"},{"path":"session.redis.tls.minimum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MINIMUM_VERSION"},{"path":"session.redis.tls.maximum_version","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_MAXIMUM_VERSION"},{"path":"session.redis.tls.skip_verify","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SKIP_VERIFY"},{"path":"session.redis.tls.server_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_TLS_SERVER_NAME"},{"path":"session.redis.tls.private_key","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_PRIVATE_KEY_FILE"},{"path":"session.redis.tls.certificate_chain","secret":true,"env":"AUTHELIA_SESSION_REDIS_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"session.redis.high_availability.sentinel_name","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_NAME"},{"path":"session.redis.high_availability.sentinel_username","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_USERNAME"},{"path":"session.redis.high_availability.sentinel_password","secret":true,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE"},{"path":"session.redis.high_availability.route_by_latency","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_BY_LATENCY"},{"path":"session.redis.high_availability.route_randomly","secret":false,"env":"AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_ROUTE_RANDOMLY"},{"path":"totp.disable","secret":false,"env":"AUTHELIA_TOTP_DISABLE"},{"path":"totp.issuer","secret":false,"env":"AUTHELIA_TOTP_ISSUER"},{"path":"totp.algorithm","secret":false,"env":"AUTHELIA_TOTP_ALGORITHM"},{"path":"totp.digits","secret":false,"env":"AUTHELIA_TOTP_DIGITS"},{"path":"totp.period","secret":false,"env":"AUTHELIA_TOTP_PERIOD"},{"path":"totp.skew","secret":false,"env":"AUTHELIA_TOTP_SKEW"},{"path":"totp.secret_size","secret":false,"env":"AUTHELIA_TOTP_SECRET_SIZE"},{"path":"duo_api.disable","secret":false,"env":"AUTHELIA_DUO_API_DISABLE"},{"path":"duo_api.hostname","secret":false,"env":"AUTHELIA_DUO_API_HOSTNAME"},{"path":"duo_api.integration_key","secret":true,"env":"AUTHELIA_DUO_API_INTEGRATION_KEY_FILE"},{"path":"duo_api.secret_key","secret":true,"env":"AUTHELIA_DUO_API_SECRET_KEY_FILE"},{"path":"duo_api.enable_self_enrollment","secret":false,"env":"AUTHELIA_DUO_API_ENABLE_SELF_ENROLLMENT"},{"path":"access_control.default_policy","secret":false,"env":"AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY"},{"path":"ntp.address","secret":false,"env":"AUTHELIA_NTP_ADDRESS"},{"path":"ntp.version","secret":false,"env":"AUTHELIA_NTP_VERSION"},{"path":"ntp.max_desync","secret":false,"env":"AUTHELIA_NTP_MAX_DESYNC"},{"path":"ntp.disable_startup_check","secret":false,"env":"AUTHELIA_NTP_DISABLE_STARTUP_CHECK"},{"path":"ntp.disable_failure","secret":false,"env":"AUTHELIA_NTP_DISABLE_FAILURE"},{"path":"regulation.max_retries","secret":false,"env":"AUTHELIA_REGULATION_MAX_RETRIES"},{"path":"regulation.find_time","secret":false,"env":"AUTHELIA_REGULATION_FIND_TIME"},{"path":"regulation.ban_time","secret":false,"env":"AUTHELIA_REGULATION_BAN_TIME"},{"path":"storage.local.path","secret":false,"env":"AUTHELIA_STORAGE_LOCAL_PATH"},{"path":"storage.mysql.address","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_ADDRESS"},{"path":"storage.mysql.database","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_DATABASE"},{"path":"storage.mysql.username","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_USERNAME"},{"path":"storage.mysql.password","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE"},{"path":"storage.mysql.timeout","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TIMEOUT"},{"path":"storage.mysql.host","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_HOST"},{"path":"storage.mysql.port","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_PORT"},{"path":"storage.mysql.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MINIMUM_VERSION"},{"path":"storage.mysql.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_MAXIMUM_VERSION"},{"path":"storage.mysql.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SKIP_VERIFY"},{"path":"storage.mysql.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_MYSQL_TLS_SERVER_NAME"},{"path":"storage.mysql.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_PRIVATE_KEY_FILE"},{"path":"storage.mysql.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_MYSQL_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.address","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_ADDRESS"},{"path":"storage.postgres.database","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_DATABASE"},{"path":"storage.postgres.username","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_USERNAME"},{"path":"storage.postgres.password","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE"},{"path":"storage.postgres.timeout","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TIMEOUT"},{"path":"storage.postgres.host","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_HOST"},{"path":"storage.postgres.port","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_PORT"},{"path":"storage.postgres.schema","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SCHEMA"},{"path":"storage.postgres.tls.minimum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MINIMUM_VERSION"},{"path":"storage.postgres.tls.maximum_version","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_MAXIMUM_VERSION"},{"path":"storage.postgres.tls.skip_verify","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SKIP_VERIFY"},{"path":"storage.postgres.tls.server_name","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_SERVER_NAME"},{"path":"storage.postgres.tls.private_key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_PRIVATE_KEY_FILE"},{"path":"storage.postgres.tls.certificate_chain","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"storage.postgres.ssl.mode","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_MODE"},{"path":"storage.postgres.ssl.root_certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_ROOT_CERTIFICATE"},{"path":"storage.postgres.ssl.certificate","secret":false,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_CERTIFICATE"},{"path":"storage.postgres.ssl.key","secret":true,"env":"AUTHELIA_STORAGE_POSTGRES_SSL_KEY_FILE"},{"path":"storage.encryption_key","secret":true,"env":"AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE"},{"path":"notifier.disable_startup_check","secret":false,"env":"AUTHELIA_NOTIFIER_DISABLE_STARTUP_CHECK"},{"path":"notifier.filesystem.filename","secret":false,"env":"AUTHELIA_NOTIFIER_FILESYSTEM_FILENAME"},{"path":"notifier.smtp.address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_ADDRESS"},{"path":"notifier.smtp.timeout","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TIMEOUT"},{"path":"notifier.smtp.username","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_USERNAME"},{"path":"notifier.smtp.password","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE"},{"path":"notifier.smtp.identifier","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_IDENTIFIER"},{"path":"notifier.smtp.sender","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SENDER"},{"path":"notifier.smtp.subject","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_SUBJECT"},{"path":"notifier.smtp.startup_check_address","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_STARTUP_CHECK_ADDRESS"},{"path":"notifier.smtp.disable_require_tls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_REQUIRE_TLS"},{"path":"notifier.smtp.disable_html_emails","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_HTML_EMAILS"},{"path":"notifier.smtp.disable_starttls","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_DISABLE_STARTTLS"},{"path":"notifier.smtp.tls.minimum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MINIMUM_VERSION"},{"path":"notifier.smtp.tls.maximum_version","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_MAXIMUM_VERSION"},{"path":"notifier.smtp.tls.skip_verify","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SKIP_VERIFY"},{"path":"notifier.smtp.tls.server_name","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_SERVER_NAME"},{"path":"notifier.smtp.tls.private_key","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_PRIVATE_KEY_FILE"},{"path":"notifier.smtp.tls.certificate_chain","secret":true,"env":"AUTHELIA_NOTIFIER_SMTP_TLS_CERTIFICATE_CHAIN_FILE"},{"path":"notifier.smtp.host","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_HOST"},{"path":"notifier.smtp.port","secret":false,"env":"AUTHELIA_NOTIFIER_SMTP_PORT"},{"path":"notifier.template_path","secret":false,"env":"AUTHELIA_NOTIFIER_TEMPLATE_PATH"},{"path":"server.address","secret":false,"env":"AUTHELIA_SERVER_ADDRESS"},{"path":"server.path","secret":false,"env":"AUTHELIA_SERVER_PATH"},{"path":"server.asset_path","secret":false,"env":"AUTHELIA_SERVER_ASSET_PATH"},{"path":"server.disable_healthcheck","secret":false,"env":"AUTHELIA_SERVER_DISABLE_HEALTHCHECK"},{"path":"server.tls.certificate","secret":false,"env":"AUTHELIA_SERVER_TLS_CERTIFICATE"},{"path":"server.tls.key","secret":true,"env":"AUTHELIA_SERVER_TLS_KEY_FILE"},{"path":"server.headers.csp_template","secret":false,"env":"AUTHELIA_SERVER_HEADERS_CSP_TEMPLATE"},{"path":"server.endpoints.enable_pprof","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_PPROF"},{"path":"server.endpoints.enable_expvars","secret":false,"env":"AUTHELIA_SERVER_ENDPOINTS_ENABLE_EXPVARS"},{"path":"server.buffers.read","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_READ"},{"path":"server.buffers.write","secret":false,"env":"AUTHELIA_SERVER_BUFFERS_WRITE"},{"path":"server.timeouts.read","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_READ"},{"path":"server.timeouts.write","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_WRITE"},{"path":"server.timeouts.idle","secret":false,"env":"AUTHELIA_SERVER_TIMEOUTS_IDLE"},{"path":"server.host","secret":false,"env":"AUTHELIA_SERVER_HOST"},{"path":"server.port","secret":false,"env":"AUTHELIA_SERVER_PORT"},{"path":"telemetry.metrics.enabled","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ENABLED"},{"path":"telemetry.metrics.address","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_ADDRESS"},{"path":"telemetry.metrics.buffers.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_READ"},{"path":"telemetry.metrics.buffers.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_BUFFERS_WRITE"},{"path":"telemetry.metrics.timeouts.read","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_READ"},{"path":"telemetry.metrics.timeouts.write","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_WRITE"},{"path":"telemetry.metrics.timeouts.idle","secret":false,"env":"AUTHELIA_TELEMETRY_METRICS_TIMEOUTS_IDLE"},{"path":"webauthn.disable","secret":false,"env":"AUTHELIA_WEBAUTHN_DISABLE"},{"path":"webauthn.display_name","secret":false,"env":"AUTHELIA_WEBAUTHN_DISPLAY_NAME"},{"path":"webauthn.attestation_conveyance_preference","secret":false,"env":"AUTHELIA_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE"},{"path":"webauthn.user_verification","secret":false,"env":"AUTHELIA_WEBAUTHN_USER_VERIFICATION"},{"path":"webauthn.timeout","secret":false,"env":"AUTHELIA_WEBAUTHN_TIMEOUT"},{"path":"password_policy.standard.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_ENABLED"},{"path":"password_policy.standard.min_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MIN_LENGTH"},{"path":"password_policy.standard.max_length","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_MAX_LENGTH"},{"path":"password_policy.standard.require_uppercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_UPPERCASE"},{"path":"password_policy.standard.require_lowercase","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_LOWERCASE"},{"path":"password_policy.standard.require_number","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_NUMBER"},{"path":"password_policy.standard.require_special","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_STANDARD_REQUIRE_SPECIAL"},{"path":"password_policy.zxcvbn.enabled","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_ENABLED"},{"path":"password_policy.zxcvbn.min_score","secret":false,"env":"AUTHELIA_PASSWORD_POLICY_ZXCVBN_MIN_SCORE"},{"path":"privacy_policy.enabled","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_ENABLED"},{"path":"privacy_policy.require_user_acceptance","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_REQUIRE_USER_ACCEPTANCE"},{"path":"privacy_policy.policy_url","secret":false,"env":"AUTHELIA_PRIVACY_POLICY_POLICY_URL"}] \ No newline at end of file diff --git a/docs/layouts/shortcodes/oidc-common.html b/docs/layouts/shortcodes/oidc-common.html index 8b6034c29..61512bf5b 100644 --- a/docs/layouts/shortcodes/oidc-common.html +++ b/docs/layouts/shortcodes/oidc-common.html @@ -1,4 +1,4 @@ -{{ $faq := "../frequently-asked-questions/" }}{{ $config := "../../../configuration/identity-providers/open-id-connect.md" }} +{{ $faq := "../frequently-asked-questions/" }}{{ $config := "../../../configuration/identity-providers/openid-connect/" }} {{- with .Get "faq" }}{{ $faq = . }}{{ end }} {{- with .Get "config" }}{{ $config = . }}{{ end }} ### Common Notes @@ -15,4 +15,6 @@ guaranteed to be supported in the future. See the [Plaintext]({{ $faq }}#plaintext) guide for more information. 3. The Configuration example for Authelia is only a portion of the required configuration and it should be used as a - guide in conjunction with the standard [OpenID Connect 1.0 Configuration]({{ $config }}) guide. \ No newline at end of file + guide in conjunction with the standard + [OpenID Connect 1.0 Provider Configuration]({{ printf "%s/provider.md" $config }}) and + [OpenID Connect 1.0 Clients Configuration]({{ printf "%s/clients.md" $config }}) guides. \ No newline at end of file diff --git a/internal/configuration/config.template.yml b/internal/configuration/config.template.yml index dbeb986f3..2f1857220 100644 --- a/internal/configuration/config.template.yml +++ b/internal/configuration/config.template.yml @@ -4,7 +4,16 @@ # Authelia Configuration # ############################################################################### -## Note: the container by default expects to find this file at /config/configuration.yml. +## +## Notes: +## +## - the default location of this file is assumed to be configuration.yml unless otherwise noted +## - when using docker the container expects this by default to be at /config/configuration.yml +## - the default location where this file is loaded from can be overridden with the X_AUTHELIA_CONFIG environment var +## - the comments in this configuration file are helpful but users should consult the official documentation on the +## website at https://www.authelia.com/ or https://www.authelia.com/configuration/prologue/introduction/ +## - this configuration file template is not automatically updated +## ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. @@ -357,73 +366,37 @@ authentication_backend: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## The distinguished name of the container searched for objects in the directory information tree. @@ -485,7 +458,7 @@ authentication_backend: # permit_referrals: false ## The username and password of the admin user. - # user: cn=admin,dc=example,dc=com + # user: 'cn=admin,dc=example,dc=com' ## Password can also be set using a secret: https://www.authelia.com/c/secrets # password: 'password' @@ -622,7 +595,7 @@ access_control: # networks: # - '10.10.0.0/16' # - '192.168.2.0/24' - # - name: VPN + # - name: 'VPN' # networks: '10.9.0.0/16' # rules: @@ -748,7 +721,8 @@ session: # expiration: '1h' ## The time before the cookie expires and the session is destroyed if remember me IS selected by the user. Setting - ## this value to -1 disables remember me for this session cookie domain. + ## this value to -1 disables remember me for this session cookie domain. If allowed and the user uses the remember + ## me checkbox this overrides the expiration option and disables the inactivity option. # remember_me: '1M' ## Cookie Session Domain default 'name' value. @@ -816,73 +790,37 @@ session: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## The Redis HA configuration options. @@ -997,73 +935,37 @@ regulation: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## @@ -1116,74 +1018,38 @@ regulation: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== - # -----END RSA PRIVATE KEY----- + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= + # -----END RSA PRIVATE KEY----- ## ## Notification Provider @@ -1270,73 +1136,37 @@ notifier: ## i.e. Mutual TLS. # certificate_chain: | # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= # -----END CERTIFICATE----- ## The private key used with the certificate_chain if the server requests TLS Client Authentication ## i.e. Mutual TLS. # private_key: | - # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- ## @@ -1354,80 +1184,88 @@ notifier: ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets # hmac_secret: 'this_is_a_secret_abc123abc123abc' - ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the - ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every - ## certificate included must be signed by the certificate immediately after it if provided. - # issuer_certificate_chain: | - # -----BEGIN CERTIFICATE----- - # MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q - # /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6 - # LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY - # 91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H - # kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR - # Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD - # AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN - # AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh - # /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4 - # lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq - # wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg - # OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i - # ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE= - # -----END CERTIFICATE----- - # -----BEGIN CERTIFICATE----- - # MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw - # EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw - # MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP - # ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S - # zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50 - # 5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou - # kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7 - # ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi - # Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD - # AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU - # Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/ - # kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf - # 71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ - # HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB - # D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj - # 2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b - # qocikt3WAdU^invalid DO NOT USE= - # -----END CERTIFICATE----- + ## Issuer JWKS configures multiple JSON Web Keys. It's required that at least one of these is RS256 or the + ## option issuer_private_key is configured. There must only be one key per algorithm at this time. + ## For RSA keys the minimum is a 2048 bit key. + # issuer_private_keys: + # - + ## Key ID embedded into the JWT header for key matching. Must be an alphanumeric string with 7 or less characters. + ## This value is automatically generated if not provided. It's recommended to not configure this. + # key_id: 'example' - ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. + ## The key algorithm used with this key. + # algorithm: 'RS256' + + ## The key use expected with this key. Currently only 'sig' is supported. + # use: 'sig' + + ## Required Private Key in PEM DER form. + # key: | + # -----BEGIN RSA PRIVATE KEY----- + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= + # -----END RSA PRIVATE KEY----- + + + ## Optional matching certificate chain in PEM DER form that matches the key. All certificates within the chain + ## must be valid and current, and from top to bottom each certificate must be signed by the subsequent one. + # certificate_chain: | + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + + ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. This is in addition to the + ## issuer_private_keys option. Assumed to use the RS256 algorithm, and must not be specified if any of the + ## keys in issuer_private_keys also has the algorithm RS256 or are an RSA key without an algorithm. ## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets # issuer_private_key: | # -----BEGIN RSA PRIVATE KEY----- - # MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1 - # T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ - # KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+ - # +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW - # LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5 - # txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um - # aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc - # Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB - # ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr - # LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG - # jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5 - # BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR - # Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV - # R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i - # tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9 - # ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR - # lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx - # 6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos - # fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ - # 9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX - # jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe - # rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84 - # n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk - # yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ - # 27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid.. - # DO NOT USE== + # MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF + # p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P + # 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh + # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH + # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg + # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg + # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE= # -----END RSA PRIVATE KEY----- + ## Optional matching certificate chain in PEM DER form that matches the issuer_private_key. All certificates within + ## the chain must be valid and current, and from top to bottom each certificate must be signed by the next + ## certificate in the chain if provided. + # issuer_certificate_chain: | + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + ## The lifespans configure the expiration for these token types in the duration common syntax. # access_token_lifespan: '1h' # authorize_code_lifespan: '1m' @@ -1499,6 +1337,11 @@ notifier: # - 'email' # - 'profile' + ## Grant Types configures which grants this client can obtain. + ## It's not recommended to define this unless you know what you're doing. + # grant_types: + # - 'authorization_code' + ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: @@ -1509,25 +1352,19 @@ notifier: # - 'form_post' # - 'query' - ## Grant Types configures which grants this client can obtain. - ## It's not recommended to define this unless you know what you're doing. - # grant_types: - # - 'authorization_code' - - ## The permitted client authentication method for the Token Endpoint for this client. - # token_endpoint_auth_method: 'client_secret_basic' - - ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using - ## the 'client_secret_jwt' token_endpoint_auth_method. - # token_endpoint_auth_signing_alg: HS256 - - ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using - ## the 'client_secret_jwt' token_endpoint_auth_method. - # token_endpoint_auth_signing_alg: HS256 - ## The policy to require for this client; one_factor or two_factor. # authorization_policy: 'two_factor' + ## The consent mode controls how consent is obtained. + # consent_mode: 'auto' + + ## This value controls the duration a consent on this client remains remembered when the consent mode is + ## configured as 'auto' or 'pre-configured' in the duration common syntax. + # pre_configured_consent_duration: '1w' + + ## Enforces the use of Pushed Authorization Requests for this client when set to true. + # enforce_par: false + ## Enforces the use of PKCE for this client when set to true. # enforce_pkce: false @@ -1535,13 +1372,69 @@ notifier: ## Options are 'plain' and 'S256'. # pkce_challenge_method: 'S256' + ## The permitted client authentication method for the Token Endpoint for this client. + # token_endpoint_auth_method: 'client_secret_basic' + + ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using + ## the 'client_secret_jwt' or 'private_key_jwt' token_endpoint_auth_method. + # token_endpoint_auth_signing_alg: 'RS256' + + ## The signing algorithm which must be used for request objects. A client JWK with a matching algorithm must be + ## included if configured. + # request_object_signing_alg: 'RS256' + + ## The signing algorithm used for ID Tokens. Am issuer JWK with a matching algorithm must be included. + # id_token_signing_alg: 'RS256' + ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. - # userinfo_signing_algorithm: 'none' + # userinfo_signing_alg: 'none' - ## The consent mode controls how consent is obtained. - # consent_mode: 'auto' + ## Trusted public keys configuration for request object signing for things such as private_key_jwt + # public_keys: - ## This value controls the duration a consent on this client remains remembered when the consent mode is - ## configured as 'auto' or 'pre-configured' in the duration common syntax. - # pre_configured_consent_duration: '1w' + ## URL of the HTTPS endpoint which serves the keys. It's recommended to manually configure them in the + ## values option below. Please note the URL and the individual values are mutually exclusive. + # uri: 'https://app.example.com/jwks.json' + + ## Values from the individual keys. + # values: + # - + ## Key ID used to match the JWT's to an individual identifier. This option is required if configured. + # key_id: 'example' + + ## The key algorithm expected with this key. + # algorithm: 'RS256' + + ## The key use expected with this key. Currently only 'sig' is supported. + # use: 'sig' + + ## Required Public Key in PEM DER form. + # key: | + # -----BEGIN RSA PUBLIC KEY----- + # MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz + # 9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE= + # -----END RSA PUBLIC KEY---- + + ## The matching certificate chain in PEM DER form that matches the key if available. + # certificate_chain: | + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- + # -----BEGIN CERTIFICATE----- + # MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT + # MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3 + # NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB + # AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00 + # z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud + # JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8 + # Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx + # 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE= + # -----END CERTIFICATE----- ... diff --git a/internal/configuration/deprecation.go b/internal/configuration/deprecation.go index 5fb997a42..b36d61a61 100644 --- a/internal/configuration/deprecation.go +++ b/internal/configuration/deprecation.go @@ -253,4 +253,12 @@ var deprecations = map[string]Deprecation{ MapFunc: nil, ErrFunc: nil, }, + "identity_providers.oidc.clients[].userinfo_signing_algorithm": { + Version: model.SemanticVersion{Major: 4, Minor: 38}, + Key: "identity_providers.oidc.clients[].userinfo_signing_algorithm", + NewKey: "identity_providers.oidc.clients[].userinfo_signing_alg", + AutoMap: true, + MapFunc: nil, + ErrFunc: nil, + }, } diff --git a/internal/configuration/provider_test.go b/internal/configuration/provider_test.go index bae07d5d5..da90574db 100644 --- a/internal/configuration/provider_test.go +++ b/internal/configuration/provider_test.go @@ -245,37 +245,6 @@ func TestShouldLoadURLList(t *testing.T) { assert.Equal(t, "https://example.com", config.IdentityProviders.OIDC.CORS.AllowedOrigins[1].String()) } -/* -func TestShouldLoadNewOIDCConfig(t *testing.T) { - val := schema.NewStructValidator() - _, config, err := Load(val, NewDefaultSources([]string{"./test_resources/config_oidc_modern.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) - - assert.NoError(t, err) - - assert.Len(t, val.Errors(), 0) - assert.Len(t, val.Warnings(), 0) - - val.Clear() - - validator.ValidateIdentityProviders(&config.IdentityProviders, val) - - assert.Len(t, val.Errors(), 0) - - assert.Len(t, config.IdentityProviders.OIDC.IssuerJWKS.Keys, 2) - assert.Equal(t, "keya", config.IdentityProviders.OIDC.IssuerJWKS.DefaultKeyID) - - assert.Equal(t, oidc.KeyUseSignature, config.IdentityProviders.OIDC.IssuerJWKS.Keys["keya"].Use) - assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, config.IdentityProviders.OIDC.IssuerJWKS.Keys["keya"].Algorithm) - - assert.Equal(t, oidc.KeyUseSignature, config.IdentityProviders.OIDC.IssuerJWKS.Keys["ec521"].Use) - assert.Equal(t, oidc.SigningAlgECDSAUsingP521AndSHA512, config.IdentityProviders.OIDC.IssuerJWKS.Keys["ec521"].Algorithm) - - assert.Contains(t, config.IdentityProviders.OIDC.Discovery.RegisteredJWKSigningAlgs, oidc.SigningAlgRSAUsingSHA256) - assert.Contains(t, config.IdentityProviders.OIDC.Discovery.RegisteredJWKSigningAlgs, oidc.SigningAlgECDSAUsingP521AndSHA512) -}. - -*/ - func TestShouldConfigureConsent(t *testing.T) { val := schema.NewStructValidator() keys, config, err := Load(val, NewDefaultSources([]string{"./test_resources/config_oidc.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...) @@ -289,6 +258,7 @@ func TestShouldConfigureConsent(t *testing.T) { require.Len(t, config.IdentityProviders.OIDC.Clients, 1) assert.Equal(t, config.IdentityProviders.OIDC.Clients[0].ConsentMode, "explicit") + assert.Equal(t, "none", config.IdentityProviders.OIDC.Clients[0].UserinfoSigningAlg) } func TestShouldValidateAndRaiseErrorsOnBadConfiguration(t *testing.T) { diff --git a/internal/configuration/schema/identity_providers.go b/internal/configuration/schema/identity_providers.go index e3713718e..b3e3fa29f 100644 --- a/internal/configuration/schema/identity_providers.go +++ b/internal/configuration/schema/identity_providers.go @@ -13,12 +13,12 @@ type IdentityProvidersConfiguration struct { // OpenIDConnectConfiguration configuration for OpenID Connect. type OpenIDConnectConfiguration struct { - HMACSecret string `koanf:"hmac_secret"` + HMACSecret string `koanf:"hmac_secret"` + IssuerPrivateKeys []JWK `koanf:"issuer_private_keys"` + IssuerCertificateChain X509CertificateChain `koanf:"issuer_certificate_chain"` IssuerPrivateKey *rsa.PrivateKey `koanf:"issuer_private_key"` - IssuerJWKS []JWK `koanf:"issuer_jwks"` - AccessTokenLifespan time.Duration `koanf:"access_token_lifespan"` AuthorizeCodeLifespan time.Duration `koanf:"authorize_code_lifespan"` IDTokenLifespan time.Duration `koanf:"id_token_lifespan"` @@ -30,8 +30,8 @@ type OpenIDConnectConfiguration struct { EnforcePKCE string `koanf:"enforce_pkce"` EnablePKCEPlainChallenge bool `koanf:"enable_pkce_plain_challenge"` - CORS OpenIDConnectCORSConfiguration `koanf:"cors"` PAR OpenIDConnectPARConfiguration `koanf:"pushed_authorizations"` + CORS OpenIDConnectCORSConfiguration `koanf:"cors"` Clients []OpenIDConnectClientConfiguration `koanf:"clients"` @@ -39,8 +39,9 @@ type OpenIDConnectConfiguration struct { } type OpenIDConnectDiscovery struct { - DefaultKeyID string - RegisteredJWKSigningAlgs []string + DefaultKeyID string + ResponseObjectSigningAlgs []string + RequestObjectSigningAlgs []string } // OpenIDConnectPARConfiguration represents an OpenID Connect PAR config. @@ -73,21 +74,31 @@ type OpenIDConnectClientConfiguration struct { ResponseTypes []string `koanf:"response_types"` ResponseModes []string `koanf:"response_modes"` - TokenEndpointAuthMethod string `koanf:"token_endpoint_auth_method"` - TokenEndpointAuthSigningAlg string `koanf:"token_endpoint_auth_signing_alg"` - - IDTokenSigningAlg string `koanf:"id_token_signing_alg"` - Policy string `koanf:"authorization_policy"` + ConsentMode string `koanf:"consent_mode"` + ConsentPreConfiguredDuration *time.Duration `koanf:"pre_configured_consent_duration"` + EnforcePAR bool `koanf:"enforce_par"` EnforcePKCE bool `koanf:"enforce_pkce"` PKCEChallengeMethod string `koanf:"pkce_challenge_method"` - UserinfoSigningAlg string `koanf:"userinfo_signing_algorithm"` - ConsentMode string `koanf:"consent_mode"` - ConsentPreConfiguredDuration *time.Duration `koanf:"pre_configured_consent_duration"` + TokenEndpointAuthMethod string `koanf:"token_endpoint_auth_method"` + + TokenEndpointAuthSigningAlg string `koanf:"token_endpoint_auth_signing_alg"` + RequestObjectSigningAlg string `koanf:"request_object_signing_alg"` + IDTokenSigningAlg string `koanf:"id_token_signing_alg"` + UserinfoSigningAlg string `koanf:"userinfo_signing_alg"` + + PublicKeys OpenIDConnectClientPublicKeys `koanf:"public_keys"` + + Discovery OpenIDConnectDiscovery +} + +type OpenIDConnectClientPublicKeys struct { + URI *url.URL `koanf:"uri"` + Values []JWK `koanf:"values"` } // DefaultOpenIDConnectConfiguration contains defaults for OIDC. diff --git a/internal/configuration/schema/keys.go b/internal/configuration/schema/keys.go index 1473226c0..9a1ffde97 100644 --- a/internal/configuration/schema/keys.go +++ b/internal/configuration/schema/keys.go @@ -18,14 +18,14 @@ var Keys = []string{ "log.file_path", "log.keep_stdout", "identity_providers.oidc.hmac_secret", + "identity_providers.oidc.issuer_private_keys", + "identity_providers.oidc.issuer_private_keys[].key_id", + "identity_providers.oidc.issuer_private_keys[]", + "identity_providers.oidc.issuer_private_keys[].algorithm", + "identity_providers.oidc.issuer_private_keys[].key", + "identity_providers.oidc.issuer_private_keys[].certificate_chain", "identity_providers.oidc.issuer_certificate_chain", "identity_providers.oidc.issuer_private_key", - "identity_providers.oidc.issuer_jwks", - "identity_providers.oidc.issuer_jwks[].key_id", - "identity_providers.oidc.issuer_jwks[]", - "identity_providers.oidc.issuer_jwks[].algorithm", - "identity_providers.oidc.issuer_jwks[].key", - "identity_providers.oidc.issuer_jwks[].certificate_chain", "identity_providers.oidc.access_token_lifespan", "identity_providers.oidc.authorize_code_lifespan", "identity_providers.oidc.id_token_lifespan", @@ -34,11 +34,11 @@ var Keys = []string{ "identity_providers.oidc.minimum_parameter_entropy", "identity_providers.oidc.enforce_pkce", "identity_providers.oidc.enable_pkce_plain_challenge", + "identity_providers.oidc.pushed_authorizations.enforce", + "identity_providers.oidc.pushed_authorizations.context_lifespan", "identity_providers.oidc.cors.endpoints", "identity_providers.oidc.cors.allowed_origins", "identity_providers.oidc.cors.allowed_origins_from_client_redirect_uris", - "identity_providers.oidc.pushed_authorizations.enforce", - "identity_providers.oidc.pushed_authorizations.context_lifespan", "identity_providers.oidc.clients", "identity_providers.oidc.clients[].id", "identity_providers.oidc.clients[].description", @@ -51,16 +51,25 @@ var Keys = []string{ "identity_providers.oidc.clients[].grant_types", "identity_providers.oidc.clients[].response_types", "identity_providers.oidc.clients[].response_modes", - "identity_providers.oidc.clients[].token_endpoint_auth_method", - "identity_providers.oidc.clients[].token_endpoint_auth_signing_alg", - "identity_providers.oidc.clients[].id_token_signing_alg", "identity_providers.oidc.clients[].authorization_policy", + "identity_providers.oidc.clients[].consent_mode", + "identity_providers.oidc.clients[].pre_configured_consent_duration", "identity_providers.oidc.clients[].enforce_par", "identity_providers.oidc.clients[].enforce_pkce", "identity_providers.oidc.clients[].pkce_challenge_method", - "identity_providers.oidc.clients[].userinfo_signing_algorithm", - "identity_providers.oidc.clients[].consent_mode", - "identity_providers.oidc.clients[].pre_configured_consent_duration", + "identity_providers.oidc.clients[].token_endpoint_auth_method", + "identity_providers.oidc.clients[].token_endpoint_auth_signing_alg", + "identity_providers.oidc.clients[].request_object_signing_alg", + "identity_providers.oidc.clients[].id_token_signing_alg", + "identity_providers.oidc.clients[].userinfo_signing_alg", + "identity_providers.oidc.clients[].public_keys.uri", + "identity_providers.oidc.clients[].public_keys.values", + "identity_providers.oidc.clients[].public_keys.values[].key_id", + "identity_providers.oidc.clients[].public_keys.values[]", + "identity_providers.oidc.clients[].public_keys.values[].algorithm", + "identity_providers.oidc.clients[].public_keys.values[].key", + "identity_providers.oidc.clients[].public_keys.values[].certificate_chain", + "identity_providers.oidc.clients[]", "identity_providers.oidc", "authentication_backend.password_reset.disable", "authentication_backend.password_reset.custom_url", diff --git a/internal/configuration/schema/types.go b/internal/configuration/schema/types.go index 6a938d781..3e5c6ac65 100644 --- a/internal/configuration/schema/types.go +++ b/internal/configuration/schema/types.go @@ -102,6 +102,7 @@ func NewX509CertificateChain(in string) (chain *X509CertificateChain, err error) return chain, nil } +// NewX509CertificateChainFromCerts returns a chain from a given list of certificates without validation. func NewX509CertificateChainFromCerts(in []*x509.Certificate) (chain X509CertificateChain) { return X509CertificateChain{certs: in} } diff --git a/internal/configuration/schema/types_test.go b/internal/configuration/schema/types_test.go index 886b9ce32..8a19edf36 100644 --- a/internal/configuration/schema/types_test.go +++ b/internal/configuration/schema/types_test.go @@ -218,6 +218,11 @@ func TestNewX509CertificateChain(t *testing.T) { } } +func TestNewX509CertificateChainFromCerts(t *testing.T) { + have := NewX509CertificateChainFromCerts(nil) + assert.NotNil(t, have) +} + func TestX509CertificateChain(t *testing.T) { chain := &X509CertificateChain{} diff --git a/internal/configuration/test_resources/config_oidc.yml b/internal/configuration/test_resources/config_oidc.yml index 076d5ae82..4ddb34421 100644 --- a/internal/configuration/test_resources/config_oidc.yml +++ b/internal/configuration/test_resources/config_oidc.yml @@ -131,4 +131,5 @@ identity_providers: - id: 'abc' secret: '123' consent_mode: 'explicit' + userinfo_signing_alg: 'none' ... diff --git a/internal/configuration/test_resources/config_oidc_modern.yml b/internal/configuration/test_resources/config_oidc_modern.yml index be63faba5..56a455505 100644 --- a/internal/configuration/test_resources/config_oidc_modern.yml +++ b/internal/configuration/test_resources/config_oidc_modern.yml @@ -127,7 +127,7 @@ notifier: identity_providers: oidc: hmac_secret: 1nb2j3kh1b23kjh1b23jh1b23j1h2b3 - issuer_jwks: + issuer_private_keys: keys: keya: key: | diff --git a/internal/configuration/validator/const.go b/internal/configuration/validator/const.go index ec29e700f..04697c889 100644 --- a/internal/configuration/validator/const.go +++ b/internal/configuration/validator/const.go @@ -142,15 +142,25 @@ const ( // OpenID Error constants. const ( - errFmtOIDCNoClientsConfigured = "identity_providers: oidc: option 'clients' must have one or " + + errFmtOIDCProviderNoClientsConfigured = "identity_providers: oidc: option 'clients' must have one or " + "more clients configured" - errFmtOIDCNoPrivateKey = "identity_providers: oidc: option 'issuer_private_key' or `issuer_jwks` is required" - errFmtOIDCInvalidPrivateKeyBitSize = "identity_providers: oidc: option 'issuer_private_key' must be an RSA private key with %d bits or more but it only has %d bits" - errFmtOIDCInvalidPrivateKeyMalformedMissingPublicKey = "identity_providers: oidc: option 'issuer_private_key' must be a valid RSA private key but the provided data is missing the public key bits" - errFmtOIDCCertificateMismatch = "identity_providers: oidc: option 'issuer_private_key' does not appear to be the private key the certificate provided by option 'issuer_certificate_chain'" - errFmtOIDCCertificateChain = "identity_providers: oidc: option 'issuer_certificate_chain' produced an error during validation of the chain: %w" - errFmtOIDCEnforcePKCEInvalidValue = "identity_providers: oidc: option 'enforce_pkce' must be 'never', " + + errFmtOIDCProviderNoPrivateKey = "identity_providers: oidc: option `issuer_private_keys` or 'issuer_private_key' is required" + errFmtOIDCProviderEnforcePKCEInvalidValue = "identity_providers: oidc: option 'enforce_pkce' must be 'never', " + "'public_clients_only' or 'always', but it's configured as '%s'" + errFmtOIDCProviderInsecureParameterEntropy = "openid connect provider: SECURITY ISSUE - minimum parameter entropy is " + + "configured to an unsafe value, it should be above 8 but it's configured to %d" + errFmtOIDCProviderPrivateKeysInvalid = "identity_providers: oidc: issuer_private_keys: key #%d: option 'key' must be a valid private key but the provided data is malformed as it's missing the public key bits" + errFmtOIDCProviderPrivateKeysCalcThumbprint = "identity_providers: oidc: issuer_private_keys: key #%d: option 'key' failed to calculate thumbprint to configure key id value: %w" + errFmtOIDCProviderPrivateKeysKeyIDLength = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option `key_id`` must be 7 characters or less" + errFmtOIDCProviderPrivateKeysAttributeNotUnique = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option '%s' must be unique" + errFmtOIDCProviderPrivateKeysKeyIDNotAlphaNumeric = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option 'key_id' must only have alphanumeric characters" + errFmtOIDCProviderPrivateKeysProperties = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option 'key' failed to get key properties: %w" + errFmtOIDCProviderPrivateKeysInvalidOptionOneOf = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option '%s' must be one of %s but it's configured as '%s'" + errFmtOIDCProviderPrivateKeysRSAKeyLessThan2048Bits = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option 'key' is an RSA %d bit private key but it must at minimum be a RSA 2048 bit private key" + errFmtOIDCProviderPrivateKeysKeyNotRSAOrECDSA = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option 'key' must be a RSA private key or ECDSA private key but it's type is %T" + errFmtOIDCProviderPrivateKeysKeyCertificateMismatch = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option 'certificate_chain' does not appear to contain the public key for the private key provided by option 'key'" + errFmtOIDCProviderPrivateKeysCertificateChainInvalid = "identity_providers: oidc: issuer_private_keys: key #%d with key id '%s': option 'certificate_chain' produced an error during validation of the chain: %w" + errFmtOIDCProviderPrivateKeysNoRS256 = "identity_providers: oidc: issuer_private_keys: keys: must at least have one key supporting the '%s' algorithm but only has %s" errFmtOIDCCORSInvalidOrigin = "identity_providers: oidc: cors: option 'allowed_origins' contains an invalid value '%s' as it has a %s: origins must only be scheme, hostname, and an optional port" errFmtOIDCCORSInvalidOriginWildcard = "identity_providers: oidc: cors: option 'allowed_origins' contains the wildcard origin '*' with more than one origin but the wildcard origin must be defined by itself" @@ -161,45 +171,61 @@ const ( errFmtOIDCClientsWithEmptyID = "identity_providers: oidc: clients: option 'id' is required but was absent on the clients in positions %s" errFmtOIDCClientsDeprecated = "identity_providers: oidc: clients: warnings for clients above indicate deprecated functionality and it's strongly suggested these issues are checked and fixed if they're legitimate issues or reported if they are not as in a future version these warnings will become errors" - errFmtOIDCClientInvalidSecret = "identity_providers: oidc: client '%s': option 'secret' is required" - errFmtOIDCClientInvalidSecretPlainText = "identity_providers: oidc: client '%s': option 'secret' is plaintext but for clients not using the 'token_endpoint_auth_method' of 'client_secret_jwt' it should be a hashed value as plaintext values are deprecated with the exception of 'client_secret_jwt' and will be removed when oidc becomes stable" - errFmtOIDCClientInvalidSecretNotPlainText = "identity_providers: oidc: client '%s': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'" - errFmtOIDCClientPublicInvalidSecret = "identity_providers: oidc: client '%s': option 'secret' is " + + errFmtOIDCClientInvalidSecret = "identity_providers: oidc: clients: client '%s': option 'secret' is required" + errFmtOIDCClientInvalidSecretPlainText = "identity_providers: oidc: clients: client '%s': option 'secret' is plaintext but for clients not using the 'token_endpoint_auth_method' of 'client_secret_jwt' it should be a hashed value as plaintext values are deprecated with the exception of 'client_secret_jwt' and will be removed when oidc becomes stable" + errFmtOIDCClientInvalidSecretNotPlainText = "identity_providers: oidc: clients: client '%s': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'" + errFmtOIDCClientPublicInvalidSecret = "identity_providers: oidc: clients: client '%s': option 'secret' is " + "required to be empty when option 'public' is true" - errFmtOIDCClientRedirectURICantBeParsed = "identity_providers: oidc: client '%s': option 'redirect_uris' has an " + + errFmtOIDCClientRedirectURICantBeParsed = "identity_providers: oidc: clients: client '%s': option 'redirect_uris' has an " + "invalid value: redirect uri '%s' could not be parsed: %v" - errFmtOIDCClientRedirectURIPublic = "identity_providers: oidc: client '%s': option 'redirect_uris' has the " + + errFmtOIDCClientRedirectURIPublic = "identity_providers: oidc: clients: client '%s': option 'redirect_uris' has the " + "redirect uri '%s' when option 'public' is false but this is invalid as this uri is not valid " + "for the openid connect confidential client type" - errFmtOIDCClientRedirectURIAbsolute = "identity_providers: oidc: client '%s': option 'redirect_uris' has an " + + errFmtOIDCClientRedirectURIAbsolute = "identity_providers: oidc: clients: client '%s': option 'redirect_uris' has an " + "invalid value: redirect uri '%s' must have a scheme but it's absent" - errFmtOIDCClientInvalidConsentMode = "identity_providers: oidc: client '%s': consent: option 'mode' must be one of " + + errFmtOIDCClientInvalidConsentMode = "identity_providers: oidc: clients: client '%s': consent: option 'mode' must be one of " + "%s but it's configured as '%s'" - errFmtOIDCClientInvalidEntries = "identity_providers: oidc: client '%s': option '%s' must only have the values " + + errFmtOIDCClientInvalidEntries = "identity_providers: oidc: clients: client '%s': option '%s' must only have the values " + "%s but the values %s are present" - errFmtOIDCClientInvalidEntryDuplicates = "identity_providers: oidc: client '%s': option '%s' must have unique values but the values %s are duplicated" - errFmtOIDCClientInvalidValue = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidEntryDuplicates = "identity_providers: oidc: clients: client '%s': option '%s' must have unique values but the values %s are duplicated" + errFmtOIDCClientInvalidValue = "identity_providers: oidc: clients: client '%s': option " + "'%s' must be one of %s but it's configured as '%s'" - errFmtOIDCClientInvalidTokenEndpointAuthMethod = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidTokenEndpointAuthMethod = "identity_providers: oidc: clients: client '%s': option " + "'token_endpoint_auth_method' must be one of %s when configured as the confidential client type unless it only includes implicit flow response types such as %s but it's configured as '%s'" - errFmtOIDCClientInvalidTokenEndpointAuthMethodPublic = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidTokenEndpointAuthMethodPublic = "identity_providers: oidc: clients: client '%s': option " + "'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as '%s'" - errFmtOIDCClientInvalidTokenEndpointAuthSigAlg = "identity_providers: oidc: client '%s': option " + - "'token_endpoint_auth_signing_alg' must be %s when option 'token_endpoint_auth_method' is %s" - errFmtOIDCClientInvalidSectorIdentifier = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidTokenEndpointAuthSigAlg = "identity_providers: oidc: clients: client '%s': option " + + "'token_endpoint_auth_signing_alg' must be one of %s when option 'token_endpoint_auth_method' is configured to '%s'" + errFmtOIDCClientInvalidTokenEndpointAuthSigAlgReg = "identity_providers: oidc: clients: client '%s': option " + + "'token_endpoint_auth_signing_alg' must be one of registered public key algorithm values %s when option 'token_endpoint_auth_method' is configured to '%s'" + errFmtOIDCClientInvalidTokenEndpointAuthSigAlgMissingPrivateKeyJWT = "identity_providers: oidc: clients: client '%s': option " + + "'token_endpoint_auth_signing_alg' is required when option 'token_endpoint_auth_method' is configured to 'private_key_jwt'" + errFmtOIDCClientInvalidPublicKeysPrivateKeyJWT = "identity_providers: oidc: clients: client '%s': option " + + "'public_keys' is required with 'token_endpoint_auth_method' set to 'private_key_jwt'" + errFmtOIDCClientInvalidSectorIdentifier = "identity_providers: oidc: clients: client '%s': option " + "'sector_identifier' with value '%s': must be a URL with only the host component for example '%s' but it has a %s with the value '%s'" - errFmtOIDCClientInvalidSectorIdentifierWithoutValue = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidSectorIdentifierWithoutValue = "identity_providers: oidc: clients: client '%s': option " + "'sector_identifier' with value '%s': must be a URL with only the host component for example '%s' but it has a %s" - errFmtOIDCClientInvalidSectorIdentifierHost = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidSectorIdentifierHost = "identity_providers: oidc: clients: client '%s': option " + "'sector_identifier' with value '%s': must be a URL with only the host component but appears to be invalid" - errFmtOIDCClientInvalidGrantTypeMatch = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidGrantTypeMatch = "identity_providers: oidc: clients: client '%s': option " + "'grant_types' should only have grant type values which are valid with the configured 'response_types' for the client but '%s' expects a response type %s such as %s but the response types are %s" - errFmtOIDCClientInvalidGrantTypeRefresh = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidGrantTypeRefresh = "identity_providers: oidc: clients: client '%s': option " + "'grant_types' should only have the 'refresh_token' value if the client is also configured with the 'offline_access' scope" - errFmtOIDCClientInvalidRefreshTokenOptionWithoutCodeResponseType = "identity_providers: oidc: client '%s': option " + + errFmtOIDCClientInvalidRefreshTokenOptionWithoutCodeResponseType = "identity_providers: oidc: clients: client '%s': option " + "'%s' should only have the values %s if the client is also configured with a 'response_type' such as %s which respond with authorization codes" - errFmtOIDCServerInsecureParameterEntropy = "openid connect provider: SECURITY ISSUE - minimum parameter entropy is " + - "configured to an unsafe value, it should be above 8 but it's configured to %d" + + errFmtOIDCClientPublicKeysBothURIAndValuesConfigured = "identity_providers: oidc: clients: client '%s': public_keys: option 'uri' must not be defined at the same time as option 'values'" + errFmtOIDCClientPublicKeysURIInvalidScheme = "identity_providers: oidc: clients: client '%s': public_keys: option 'uri' must have the 'https' scheme but the scheme is '%s'" + errFmtOIDCClientPublicKeysProperties = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d with key id '%s': option 'key' failed to get key properties: %w" + errFmtOIDCClientPublicKeysInvalidOptionOneOf = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d with key id '%s': option '%s' must be one of %s but it's configured as '%s'" + errFmtOIDCClientPublicKeysInvalidOptionMissingOneOf = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d: option '%s' must be provided" + errFmtOIDCClientPublicKeysKeyMalformed = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d: option 'key' option 'key' must be a valid private key but the provided data is malformed as it's missing the public key bits" + errFmtOIDCClientPublicKeysRSAKeyLessThan2048Bits = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d with key id '%s': option 'key' is an RSA %d bit private key but it must at minimum be a RSA 2048 bit private key" + errFmtOIDCClientPublicKeysKeyNotRSAOrECDSA = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d with key id '%s': option 'key' must be a RSA public key or ECDSA public key but it's type is %T" + errFmtOIDCClientPublicKeysCertificateChainKeyMismatch = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d with key id '%s': option 'certificate_chain' does not appear to contain the public key for the public key provided by option 'key'" + errFmtOIDCClientPublicKeysCertificateChainInvalid = "identity_providers: oidc: clients: client '%s': public_keys: values: key #%d with key id '%s': option 'certificate_chain' produced an error during validation of the chain: %w" + errFmtOIDCClientPublicKeysROSAMissingAlgorithm = "identity_providers: oidc: clients: client '%s': option 'request_object_signing_alg' must be one of %s configured in the client option 'public_keys'" ) // WebAuthn Error constants. @@ -288,11 +314,8 @@ const ( // Server Error constants. const ( - errFmtServerTLSCert = "server: tls: option 'key' must also be accompanied by option 'certificate'" - errFmtServerTLSKey = "server: tls: option 'certificate' must also be accompanied by option 'key'" - errFmtServerTLSFileNotExist = "server: tls: option '%s' the file '%s' does not exist" - errFmtServerTLSFileNotExistErr = "server: tls: option '%s' could not determine if the file '%s' exists: %w" - + errFmtServerTLSCert = "server: tls: option 'key' must also be accompanied by option 'certificate'" + errFmtServerTLSKey = "server: tls: option 'certificate' must also be accompanied by option 'key'" errFmtServerTLSClientAuthNoAuth = "server: tls: client authentication cannot be configured if no server certificate and key are provided" errFmtServerAddressLegacyAndModern = "server: option 'host' and 'port' can't be configured at the same time as 'address'" @@ -402,13 +425,17 @@ var ( var validDefault2FAMethods = []string{"totp", "webauthn", "mobile_push"} const ( + attrOIDCKey = "key" + attrOIDCKeyID = "key_id" + attrOIDCKeyUse = "use" + attrOIDCAlgorithm = "algorithm" attrOIDCScopes = "scopes" attrOIDCResponseTypes = "response_types" attrOIDCResponseModes = "response_modes" attrOIDCGrantTypes = "grant_types" attrOIDCRedirectURIs = "redirect_uris" attrOIDCTokenAuthMethod = "token_endpoint_auth_method" - attrOIDCUsrSigAlg = "userinfo_signing_algorithm" + attrOIDCUsrSigAlg = "userinfo_signing_alg" attrOIDCIDTokenSigAlg = "id_token_signing_alg" attrOIDCPKCEChallengeMethod = "pkce_challenge_method" ) @@ -425,10 +452,10 @@ var ( validOIDCClientResponseTypesRefreshToken = []string{oidc.ResponseTypeAuthorizationCodeFlow, oidc.ResponseTypeHybridFlowIDToken, oidc.ResponseTypeHybridFlowToken, oidc.ResponseTypeHybridFlowBoth} validOIDCClientGrantTypes = []string{oidc.GrantTypeImplicit, oidc.GrantTypeRefreshToken, oidc.GrantTypeAuthorizationCode} - validOIDCClientTokenEndpointAuthMethods = []string{oidc.ClientAuthMethodNone, oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic, oidc.ClientAuthMethodClientSecretJWT} - validOIDCClientTokenEndpointAuthMethodsConfidential = []string{oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic} - validOIDCClientTokenEndpointAuthSigAlgs = []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512} - validOIDCIssuerJWKSigningAlgs = []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgRSAPSSUsingSHA256, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgRSAUsingSHA384, oidc.SigningAlgRSAPSSUsingSHA384, oidc.SigningAlgECDSAUsingP384AndSHA384, oidc.SigningAlgRSAUsingSHA512, oidc.SigningAlgRSAPSSUsingSHA512, oidc.SigningAlgECDSAUsingP521AndSHA512} + validOIDCClientTokenEndpointAuthMethods = []string{oidc.ClientAuthMethodNone, oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic, oidc.ClientAuthMethodPrivateKeyJWT, oidc.ClientAuthMethodClientSecretJWT} + validOIDCClientTokenEndpointAuthMethodsConfidential = []string{oidc.ClientAuthMethodClientSecretPost, oidc.ClientAuthMethodClientSecretBasic, oidc.ClientAuthMethodPrivateKeyJWT} + validOIDCClientTokenEndpointAuthSigAlgsClientSecretJWT = []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512} + validOIDCIssuerJWKSigningAlgs = []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgRSAPSSUsingSHA256, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgRSAUsingSHA384, oidc.SigningAlgRSAPSSUsingSHA384, oidc.SigningAlgECDSAUsingP384AndSHA384, oidc.SigningAlgRSAUsingSHA512, oidc.SigningAlgRSAPSSUsingSHA512, oidc.SigningAlgECDSAUsingP521AndSHA512} ) var ( diff --git a/internal/configuration/validator/const_test.go b/internal/configuration/validator/const_test.go index 2ae760b5d..c11f928aa 100644 --- a/internal/configuration/validator/const_test.go +++ b/internal/configuration/validator/const_test.go @@ -17,6 +17,7 @@ const ( const ( exampleDotCom = "example.com" + rs256 = "rs256" ) const ( diff --git a/internal/configuration/validator/identity_providers.go b/internal/configuration/validator/identity_providers.go index a716c841f..d01afa888 100644 --- a/internal/configuration/validator/identity_providers.go +++ b/internal/configuration/validator/identity_providers.go @@ -12,7 +12,7 @@ import ( "strings" "time" - "gopkg.in/square/go-jose.v2" + jose "gopkg.in/square/go-jose.v2" "github.com/authelia/authelia/v4/internal/configuration/schema" "github.com/authelia/authelia/v4/internal/oidc" @@ -33,20 +33,23 @@ func validateOIDC(config *schema.OpenIDConnectConfiguration, val *schema.StructV validateOIDCIssuer(config, val) - sort.Sort(oidc.SortedSigningAlgs(config.Discovery.RegisteredJWKSigningAlgs)) + sort.Sort(oidc.SortedSigningAlgs(config.Discovery.ResponseObjectSigningAlgs)) if config.MinimumParameterEntropy != 0 && config.MinimumParameterEntropy < 8 { - val.PushWarning(fmt.Errorf(errFmtOIDCServerInsecureParameterEntropy, config.MinimumParameterEntropy)) + val.PushWarning(fmt.Errorf(errFmtOIDCProviderInsecureParameterEntropy, config.MinimumParameterEntropy)) } - if config.EnforcePKCE != "never" && config.EnforcePKCE != "public_clients_only" && config.EnforcePKCE != "always" { - val.Push(fmt.Errorf(errFmtOIDCEnforcePKCEInvalidValue, config.EnforcePKCE)) + switch config.EnforcePKCE { + case "always", "never", "public_clients_only": + break + default: + val.Push(fmt.Errorf(errFmtOIDCProviderEnforcePKCEInvalidValue, config.EnforcePKCE)) } validateOIDCOptionsCORS(config, val) if len(config.Clients) == 0 { - val.Push(fmt.Errorf(errFmtOIDCNoClientsConfigured)) + val.Push(fmt.Errorf(errFmtOIDCProviderNoClientsConfigured)) } else { validateOIDCClients(config, val) } @@ -55,157 +58,158 @@ func validateOIDC(config *schema.OpenIDConnectConfiguration, val *schema.StructV func validateOIDCIssuer(config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { switch { case config.IssuerPrivateKey != nil: - validateOIDCIssuerLegacy(config, val) + validateOIDCIssuerPrivateKey(config) fallthrough - case len(config.IssuerJWKS) != 0: - validateOIDCIssuerModern(config, val) + case len(config.IssuerPrivateKeys) != 0: + validateOIDCIssuerPrivateKeys(config, val) default: - val.Push(fmt.Errorf(errFmtOIDCNoPrivateKey)) + val.Push(fmt.Errorf(errFmtOIDCProviderNoPrivateKey)) } } -func validateOIDCIssuerLegacy(config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { - j := &jose.JSONWebKey{Key: &config.IssuerPrivateKey.PublicKey} - - thumbprint, err := j.Thumbprint(crypto.SHA1) - if err != nil { - val.Push(fmt.Errorf("identity_providers: oidc: option 'issuer_private_key' failed to calculate thumbprint to configure key id value: %w", err)) - - return - } - - config.IssuerJWKS = append(config.IssuerJWKS, schema.JWK{ - KeyID: fmt.Sprintf("%x", thumbprint)[:6], +func validateOIDCIssuerPrivateKey(config *schema.OpenIDConnectConfiguration) { + config.IssuerPrivateKeys = append([]schema.JWK{{ Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, Key: config.IssuerPrivateKey, CertificateChain: config.IssuerCertificateChain, - }) + }}, config.IssuerPrivateKeys...) } -//nolint:gocyclo // Refactor time permitting. -func validateOIDCIssuerModern(config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { +func jwkCalculateThumbprint(key schema.CryptographicKey) (thumbprintStr string, err error) { + j := jose.JSONWebKey{} + + switch k := key.(type) { + case schema.CryptographicPrivateKey: + j.Key = k.Public() + case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey: + j.Key = k + default: + return "", nil + } + + var thumbprint []byte + + if thumbprint, err = j.Thumbprint(crypto.SHA256); err != nil { + return "", err + } + + return fmt.Sprintf("%x", thumbprint)[:6], nil +} + +func validateOIDCIssuerPrivateKeys(config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { var ( props *JWKProperties err error ) - kids := make([]string, len(config.IssuerJWKS)) + kids := make([]string, len(config.IssuerPrivateKeys)) - for i := 0; i < len(config.IssuerJWKS); i++ { - if key, ok := config.IssuerJWKS[i].Key.(*rsa.PrivateKey); ok && key.PublicKey.N == nil { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d: option 'key' must be a valid RSA private key but the provided data is malformed as it's missing the public key bits", i+1)) + for i := 0; i < len(config.IssuerPrivateKeys); i++ { + if key, ok := config.IssuerPrivateKeys[i].Key.(*rsa.PrivateKey); ok && key.PublicKey.N == nil { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysInvalid, i+1)) continue } - switch n := len(config.IssuerJWKS[i].KeyID); { + switch n := len(config.IssuerPrivateKeys[i].KeyID); { case n == 0: - j := jose.JSONWebKey{} - - switch key := config.IssuerJWKS[i].Key.(type) { - case schema.CryptographicPrivateKey: - j.Key = key.Public() - case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey: - j.Key = key - default: - break - } - - if j.Key == nil { - break - } - - var thumbprint []byte - - if thumbprint, err = j.Thumbprint(crypto.SHA1); err != nil { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d: option 'key' failed to calculate thumbprint to configure key id value: %w", i+1, err)) + if config.IssuerPrivateKeys[i].KeyID, err = jwkCalculateThumbprint(config.IssuerPrivateKeys[i].Key); err != nil { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysCalcThumbprint, i+1, err)) continue } - - config.IssuerJWKS[i].KeyID = fmt.Sprintf("%x", thumbprint)[:6] case n > 7: - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option `key_id`` must be 7 characters or less", i+1, config.IssuerJWKS[i].KeyID)) + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysKeyIDLength, i+1, config.IssuerPrivateKeys[i].KeyID)) } - if config.IssuerJWKS[i].KeyID != "" && utils.IsStringInSlice(config.IssuerJWKS[i].KeyID, kids) { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key_id' must be unique", i+1, config.IssuerJWKS[i].KeyID)) + if config.IssuerPrivateKeys[i].KeyID != "" && utils.IsStringInSlice(config.IssuerPrivateKeys[i].KeyID, kids) { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysAttributeNotUnique, i+1, config.IssuerPrivateKeys[i].KeyID, attrOIDCKeyID)) } - kids[i] = config.IssuerJWKS[i].KeyID + kids[i] = config.IssuerPrivateKeys[i].KeyID - if !utils.IsStringAlphaNumeric(config.IssuerJWKS[i].KeyID) { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key_id' must only have alphanumeric characters", i+1, config.IssuerJWKS[i].KeyID)) + if !utils.IsStringAlphaNumeric(config.IssuerPrivateKeys[i].KeyID) { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysKeyIDNotAlphaNumeric, i+1, config.IssuerPrivateKeys[i].KeyID)) } - if props, err = schemaJWKGetProperties(config.IssuerJWKS[i]); err != nil { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' failed to get key properties: %w", i+1, config.IssuerJWKS[i].KeyID, err)) + if props, err = schemaJWKGetProperties(config.IssuerPrivateKeys[i]); err != nil { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysProperties, i+1, config.IssuerPrivateKeys[i].KeyID, err)) continue } - switch config.IssuerJWKS[i].Use { - case "": - config.IssuerJWKS[i].Use = props.Use - case oidc.KeyUseSignature: - break - default: - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option '%s' must be one of %s but it's configured as '%s'", i+1, config.IssuerJWKS[i].KeyID, "use", strJoinOr([]string{oidc.KeyUseSignature}), config.IssuerJWKS[i].Use)) - } + validateOIDCIssuerPrivateKeysUseAlg(i, props, config, val) + validateOIDCIssuerPrivateKeyPair(i, config, val) + } - switch { - case config.IssuerJWKS[i].Algorithm == "": - config.IssuerJWKS[i].Algorithm = props.Algorithm - case utils.IsStringInSlice(config.IssuerJWKS[i].Algorithm, validOIDCIssuerJWKSigningAlgs): - break - default: - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option '%s' must be one of %s but it's configured as '%s'", i+1, config.IssuerJWKS[i].KeyID, "algorithm", strJoinOr(validOIDCIssuerJWKSigningAlgs), config.IssuerJWKS[i].Algorithm)) - } + if len(config.Discovery.ResponseObjectSigningAlgs) != 0 && !utils.IsStringInSlice(oidc.SigningAlgRSAUsingSHA256, config.Discovery.ResponseObjectSigningAlgs) { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysNoRS256, oidc.SigningAlgRSAUsingSHA256, strJoinAnd(config.Discovery.ResponseObjectSigningAlgs))) + } +} - if config.IssuerJWKS[i].Algorithm != "" { - if utils.IsStringInSlice(config.IssuerJWKS[i].Algorithm, config.Discovery.RegisteredJWKSigningAlgs) { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'algorithm' must be unique but another key is using it", i+1, config.IssuerJWKS[i].KeyID)) - } else { - config.Discovery.RegisteredJWKSigningAlgs = append(config.Discovery.RegisteredJWKSigningAlgs, config.IssuerJWKS[i].Algorithm) - } - } +func validateOIDCIssuerPrivateKeysUseAlg(i int, props *JWKProperties, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + switch config.IssuerPrivateKeys[i].Use { + case "": + config.IssuerPrivateKeys[i].Use = props.Use + case oidc.KeyUseSignature: + break + default: + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysInvalidOptionOneOf, i+1, config.IssuerPrivateKeys[i].KeyID, attrOIDCKeyUse, strJoinOr([]string{oidc.KeyUseSignature}), config.IssuerPrivateKeys[i].Use)) + } - if config.IssuerJWKS[i].Algorithm == oidc.SigningAlgRSAUsingSHA256 && config.Discovery.DefaultKeyID == "" { - config.Discovery.DefaultKeyID = config.IssuerJWKS[i].KeyID - } + switch { + case config.IssuerPrivateKeys[i].Algorithm == "": + config.IssuerPrivateKeys[i].Algorithm = props.Algorithm + case utils.IsStringInSlice(config.IssuerPrivateKeys[i].Algorithm, validOIDCIssuerJWKSigningAlgs): + break + default: + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysInvalidOptionOneOf, i+1, config.IssuerPrivateKeys[i].KeyID, attrOIDCAlgorithm, strJoinOr(validOIDCIssuerJWKSigningAlgs), config.IssuerPrivateKeys[i].Algorithm)) + } - var checkEqualKey bool - - switch key := config.IssuerJWKS[i].Key.(type) { - case *rsa.PrivateKey: - checkEqualKey = true - - if key.Size() < 256 { - checkEqualKey = false - - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' is an RSA %d bit private key but it must be a RSA 2048 bit private key", i+1, config.IssuerJWKS[i].KeyID, key.Size()*8)) - } - case *ecdsa.PrivateKey: - checkEqualKey = true - default: - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' must be a *rsa.PrivateKey or *ecdsa.PrivateKey but it's a %T", i+1, config.IssuerJWKS[i].KeyID, key)) - } - - if config.IssuerJWKS[i].CertificateChain.HasCertificates() { - if checkEqualKey && !config.IssuerJWKS[i].CertificateChain.EqualKey(config.IssuerJWKS[i].Key) { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'key' does not appear to be the private key the certificate provided by option 'certificate_chain'", i+1, config.IssuerJWKS[i].KeyID)) - } - - if err = config.IssuerJWKS[i].CertificateChain.Validate(); err != nil { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: key #%d with key id '%s': option 'certificate_chain' produced an error during validation of the chain: %w", i+1, config.IssuerJWKS[i].KeyID, err)) - } + if config.IssuerPrivateKeys[i].Algorithm != "" { + if utils.IsStringInSlice(config.IssuerPrivateKeys[i].Algorithm, config.Discovery.ResponseObjectSigningAlgs) { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysAttributeNotUnique, i+1, config.IssuerPrivateKeys[i].KeyID, attrOIDCAlgorithm)) + } else { + config.Discovery.ResponseObjectSigningAlgs = append(config.Discovery.ResponseObjectSigningAlgs, config.IssuerPrivateKeys[i].Algorithm) } } - if len(config.Discovery.RegisteredJWKSigningAlgs) != 0 && !utils.IsStringInSlice(oidc.SigningAlgRSAUsingSHA256, config.Discovery.RegisteredJWKSigningAlgs) { - val.Push(fmt.Errorf("identity_providers: oidc: issuer_jwks: keys: must at least have one key supporting the '%s' algorithm but only has %s", oidc.SigningAlgRSAUsingSHA256, strJoinAnd(config.Discovery.RegisteredJWKSigningAlgs))) + if config.IssuerPrivateKeys[i].Algorithm == oidc.SigningAlgRSAUsingSHA256 && config.Discovery.DefaultKeyID == "" { + config.Discovery.DefaultKeyID = config.IssuerPrivateKeys[i].KeyID + } +} + +func validateOIDCIssuerPrivateKeyPair(i int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + var ( + checkEqualKey bool + err error + ) + + switch key := config.IssuerPrivateKeys[i].Key.(type) { + case *rsa.PrivateKey: + checkEqualKey = true + + if key.Size() < 256 { + checkEqualKey = false + + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysRSAKeyLessThan2048Bits, i+1, config.IssuerPrivateKeys[i].KeyID, key.Size()*8)) + } + case *ecdsa.PrivateKey: + checkEqualKey = true + default: + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysKeyNotRSAOrECDSA, i+1, config.IssuerPrivateKeys[i].KeyID, key)) + } + + if config.IssuerPrivateKeys[i].CertificateChain.HasCertificates() { + if checkEqualKey && !config.IssuerPrivateKeys[i].CertificateChain.EqualKey(config.IssuerPrivateKeys[i].Key) { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysKeyCertificateMismatch, i+1, config.IssuerPrivateKeys[i].KeyID)) + } + + if err = config.IssuerPrivateKeys[i].CertificateChain.Validate(); err != nil { + val.Push(fmt.Errorf(errFmtOIDCProviderPrivateKeysCertificateChainInvalid, i+1, config.IssuerPrivateKeys[i].KeyID, err)) + } } } @@ -356,7 +360,7 @@ func validateOIDCClient(c int, config *schema.OpenIDConnectConfiguration, val *s case policyOneFactor, policyTwoFactor: break default: - val.Push(fmt.Errorf(errFmtOIDCClientInvalidValue, config.Clients[c].ID, "policy", strJoinOr([]string{policyOneFactor, policyTwoFactor}), config.Clients[c].Policy)) + val.Push(fmt.Errorf(errFmtOIDCClientInvalidValue, config.Clients[c].ID, "authorization_policy", strJoinOr([]string{policyOneFactor, policyTwoFactor}), config.Clients[c].Policy)) } switch config.Clients[c].PKCEChallengeMethod { @@ -374,10 +378,113 @@ func validateOIDCClient(c int, config *schema.OpenIDConnectConfiguration, val *s validateOIDCClientGrantTypes(c, config, val, errDeprecatedFunc) validateOIDCClientRedirectURIs(c, config, val, errDeprecatedFunc) - validateOIDCClientTokenEndpointAuth(c, config, val) validateOIDDClientSigningAlgs(c, config, val) validateOIDCClientSectorIdentifier(c, config, val) + + validateOIDCClientPublicKeys(c, config, val) + validateOIDCClientTokenEndpointAuth(c, config, val) +} + +func validateOIDCClientPublicKeys(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + switch { + case config.Clients[c].PublicKeys.URI != nil && len(config.Clients[c].PublicKeys.Values) != 0: + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysBothURIAndValuesConfigured, config.Clients[c].ID)) + case config.Clients[c].PublicKeys.URI != nil: + if config.Clients[c].PublicKeys.URI.Scheme != schemeHTTPS { + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysURIInvalidScheme, config.Clients[c].ID, config.Clients[c].PublicKeys.URI.Scheme)) + } + case len(config.Clients[c].PublicKeys.Values) != 0: + validateOIDCClientJSONWebKeysList(c, config, val) + } +} + +func validateOIDCClientJSONWebKeysList(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + var ( + props *JWKProperties + err error + ) + + for i := 0; i < len(config.Clients[c].PublicKeys.Values); i++ { + if config.Clients[c].PublicKeys.Values[i].KeyID == "" { + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysInvalidOptionMissingOneOf, config.Clients[c].ID, i+1, attrOIDCKeyID)) + } + + if props, err = schemaJWKGetProperties(config.Clients[c].PublicKeys.Values[i]); err != nil { + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysProperties, config.Clients[c].ID, i+1, config.Clients[c].PublicKeys.Values[i].KeyID, err)) + + continue + } + + validateOIDCClientJSONWebKeysListKeyUseAlg(c, i, props, config, val) + + var checkEqualKey bool + + switch key := config.Clients[c].PublicKeys.Values[i].Key.(type) { + case nil: + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysInvalidOptionMissingOneOf, config.Clients[c].ID, i+1, attrOIDCKey)) + case *rsa.PublicKey: + checkEqualKey = true + + if key.N == nil { + checkEqualKey = false + + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysKeyMalformed, config.Clients[c].ID, i+1)) + } else if key.Size() < 256 { + checkEqualKey = false + + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysRSAKeyLessThan2048Bits, config.Clients[c].ID, i+1, config.Clients[c].PublicKeys.Values[i].KeyID, key.Size()*8)) + } + case *ecdsa.PublicKey: + checkEqualKey = true + default: + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysKeyNotRSAOrECDSA, config.Clients[c].ID, i+1, config.Clients[c].PublicKeys.Values[i].KeyID, key)) + } + + if config.Clients[c].PublicKeys.Values[i].CertificateChain.HasCertificates() { + if checkEqualKey && !config.Clients[c].PublicKeys.Values[i].CertificateChain.EqualKey(config.Clients[c].PublicKeys.Values[i].Key) { + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysCertificateChainKeyMismatch, config.Clients[c].ID, i+1, config.Clients[c].PublicKeys.Values[i].KeyID)) + } + + if err = config.Clients[c].PublicKeys.Values[i].CertificateChain.Validate(); err != nil { + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysCertificateChainInvalid, config.Clients[c].ID, i+1, config.Clients[c].PublicKeys.Values[i].KeyID, err)) + } + } + } + + if config.Clients[c].RequestObjectSigningAlg != "" && !utils.IsStringInSlice(config.Clients[c].RequestObjectSigningAlg, config.Clients[c].Discovery.RequestObjectSigningAlgs) { + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysROSAMissingAlgorithm, config.Clients[c].ID, strJoinOr(config.Clients[c].Discovery.RequestObjectSigningAlgs))) + } +} + +func validateOIDCClientJSONWebKeysListKeyUseAlg(c, i int, props *JWKProperties, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + switch config.Clients[c].PublicKeys.Values[i].Use { + case "": + config.Clients[c].PublicKeys.Values[i].Use = props.Use + case oidc.KeyUseSignature: + break + default: + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysInvalidOptionOneOf, config.Clients[c].ID, i+1, config.Clients[c].PublicKeys.Values[i].KeyID, attrOIDCKeyUse, strJoinOr([]string{oidc.KeyUseSignature}), config.Clients[c].PublicKeys.Values[i].Use)) + } + + switch { + case config.Clients[c].PublicKeys.Values[i].Algorithm == "": + config.Clients[c].PublicKeys.Values[i].Algorithm = props.Algorithm + case utils.IsStringInSlice(config.Clients[c].PublicKeys.Values[i].Algorithm, validOIDCIssuerJWKSigningAlgs): + break + default: + val.Push(fmt.Errorf(errFmtOIDCClientPublicKeysInvalidOptionOneOf, config.Clients[c].ID, i+1, config.Clients[c].PublicKeys.Values[i].KeyID, attrOIDCAlgorithm, strJoinOr(validOIDCIssuerJWKSigningAlgs), config.Clients[c].PublicKeys.Values[i].Algorithm)) + } + + if config.Clients[c].PublicKeys.Values[i].Algorithm != "" { + if !utils.IsStringInSlice(config.Clients[c].PublicKeys.Values[i].Algorithm, config.Discovery.RequestObjectSigningAlgs) { + config.Discovery.RequestObjectSigningAlgs = append(config.Discovery.RequestObjectSigningAlgs, config.Clients[c].PublicKeys.Values[i].Algorithm) + } + + if !utils.IsStringInSlice(config.Clients[c].PublicKeys.Values[i].Algorithm, config.Clients[c].Discovery.RequestObjectSigningAlgs) { + config.Clients[c].Discovery.RequestObjectSigningAlgs = append(config.Clients[c].Discovery.RequestObjectSigningAlgs, config.Clients[c].PublicKeys.Values[i].Algorithm) + } + } } func validateOIDCClientSectorIdentifier(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { @@ -654,11 +761,34 @@ func validateOIDCClientTokenEndpointAuth(c int, config *schema.OpenIDConnectConf case "": break case oidc.ClientAuthMethodClientSecretJWT: - switch { - case config.Clients[c].TokenEndpointAuthSigningAlg == "": - config.Clients[c].TokenEndpointAuthSigningAlg = oidc.SigningAlgHMACUsingSHA256 - case !utils.IsStringInSlice(config.Clients[c].TokenEndpointAuthSigningAlg, validOIDCClientTokenEndpointAuthSigAlgs): - val.Push(fmt.Errorf(errFmtOIDCClientInvalidTokenEndpointAuthSigAlg, config.Clients[c].ID, strJoinOr(validOIDCClientTokenEndpointAuthSigAlgs), config.Clients[c].TokenEndpointAuthMethod)) + validateOIDCClientTokenEndpointAuthClientSecretJWT(c, config, val) + case oidc.ClientAuthMethodPrivateKeyJWT: + validateOIDCClientTokenEndpointAuthPublicKeyJWT(config.Clients[c], val) + } +} + +func validateOIDCClientTokenEndpointAuthClientSecretJWT(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { + switch { + case config.Clients[c].TokenEndpointAuthSigningAlg == "": + config.Clients[c].TokenEndpointAuthSigningAlg = oidc.SigningAlgHMACUsingSHA256 + case !utils.IsStringInSlice(config.Clients[c].TokenEndpointAuthSigningAlg, validOIDCClientTokenEndpointAuthSigAlgsClientSecretJWT): + val.Push(fmt.Errorf(errFmtOIDCClientInvalidTokenEndpointAuthSigAlg, config.Clients[c].ID, strJoinOr(validOIDCClientTokenEndpointAuthSigAlgsClientSecretJWT), config.Clients[c].TokenEndpointAuthMethod)) + } +} + +func validateOIDCClientTokenEndpointAuthPublicKeyJWT(config schema.OpenIDConnectClientConfiguration, val *schema.StructValidator) { + switch { + case config.TokenEndpointAuthSigningAlg == "": + val.Push(fmt.Errorf(errFmtOIDCClientInvalidTokenEndpointAuthSigAlgMissingPrivateKeyJWT, config.ID)) + case !utils.IsStringInSlice(config.TokenEndpointAuthSigningAlg, validOIDCIssuerJWKSigningAlgs): + val.Push(fmt.Errorf(errFmtOIDCClientInvalidTokenEndpointAuthSigAlg, config.ID, strJoinOr(validOIDCIssuerJWKSigningAlgs), config.TokenEndpointAuthMethod)) + } + + if config.PublicKeys.URI == nil { + if len(config.PublicKeys.Values) == 0 { + val.Push(fmt.Errorf(errFmtOIDCClientInvalidPublicKeysPrivateKeyJWT, config.ID)) + } else if len(config.Discovery.RequestObjectSigningAlgs) != 0 && !utils.IsStringInSlice(config.TokenEndpointAuthSigningAlg, config.Discovery.RequestObjectSigningAlgs) { + val.Push(fmt.Errorf(errFmtOIDCClientInvalidTokenEndpointAuthSigAlgReg, config.ID, strJoinOr(config.Discovery.RequestObjectSigningAlgs), config.TokenEndpointAuthMethod)) } } } @@ -666,15 +796,15 @@ func validateOIDCClientTokenEndpointAuth(c int, config *schema.OpenIDConnectConf func validateOIDDClientSigningAlgs(c int, config *schema.OpenIDConnectConfiguration, val *schema.StructValidator) { if config.Clients[c].UserinfoSigningAlg == "" { config.Clients[c].UserinfoSigningAlg = schema.DefaultOpenIDConnectClientConfiguration.UserinfoSigningAlg - } else if config.Clients[c].UserinfoSigningAlg != oidc.SigningAlgNone && !utils.IsStringInSlice(config.Clients[c].UserinfoSigningAlg, config.Discovery.RegisteredJWKSigningAlgs) { + } else if config.Clients[c].UserinfoSigningAlg != oidc.SigningAlgNone && !utils.IsStringInSlice(config.Clients[c].UserinfoSigningAlg, config.Discovery.ResponseObjectSigningAlgs) { val.Push(fmt.Errorf(errFmtOIDCClientInvalidValue, - config.Clients[c].ID, attrOIDCUsrSigAlg, strJoinOr(append(config.Discovery.RegisteredJWKSigningAlgs, oidc.SigningAlgNone)), config.Clients[c].UserinfoSigningAlg)) + config.Clients[c].ID, attrOIDCUsrSigAlg, strJoinOr(append(config.Discovery.ResponseObjectSigningAlgs, oidc.SigningAlgNone)), config.Clients[c].UserinfoSigningAlg)) } if config.Clients[c].IDTokenSigningAlg == "" { config.Clients[c].IDTokenSigningAlg = schema.DefaultOpenIDConnectClientConfiguration.IDTokenSigningAlg - } else if !utils.IsStringInSlice(config.Clients[c].IDTokenSigningAlg, config.Discovery.RegisteredJWKSigningAlgs) { + } else if !utils.IsStringInSlice(config.Clients[c].IDTokenSigningAlg, config.Discovery.ResponseObjectSigningAlgs) { val.Push(fmt.Errorf(errFmtOIDCClientInvalidValue, - config.Clients[c].ID, attrOIDCIDTokenSigAlg, strJoinOr(config.Discovery.RegisteredJWKSigningAlgs), config.Clients[c].IDTokenSigningAlg)) + config.Clients[c].ID, attrOIDCIDTokenSigAlg, strJoinOr(config.Discovery.ResponseObjectSigningAlgs), config.Clients[c].IDTokenSigningAlg)) } } diff --git a/internal/configuration/validator/identity_providers_test.go b/internal/configuration/validator/identity_providers_test.go index 93178a795..9e4212df9 100644 --- a/internal/configuration/validator/identity_providers_test.go +++ b/internal/configuration/validator/identity_providers_test.go @@ -33,7 +33,7 @@ func TestShouldRaiseErrorWhenInvalidOIDCServerConfiguration(t *testing.T) { require.Len(t, validator.Errors(), 2) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: option 'issuer_private_key' or `issuer_jwks` is required") + assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: option `issuer_private_keys` or 'issuer_private_key' is required") assert.EqualError(t, validator.Errors()[1], "identity_providers: oidc: option 'clients' must have one or more clients configured") } @@ -181,7 +181,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client '': option 'secret' is required", + "identity_providers: oidc: clients: client '': option 'secret' is required", "identity_providers: oidc: clients: option 'id' is required but was absent on the clients in positions #1", }, }, @@ -198,7 +198,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-1': option 'policy' must be one of 'one_factor' or 'two_factor' but it's configured as 'a-policy'", + "identity_providers: oidc: clients: client 'client-1': option 'authorization_policy' must be one of 'one_factor' or 'two_factor' but it's configured as 'a-policy'", }, }, { @@ -234,7 +234,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-check-uri-parse': option 'redirect_uris' has an invalid value: redirect uri 'http://abc@%two' could not be parsed: parse \"http://abc@%two\": invalid URL escape \"%tw\"", + "identity_providers: oidc: clients: client 'client-check-uri-parse': option 'redirect_uris' has an invalid value: redirect uri 'http://abc@%two' could not be parsed: parse \"http://abc@%two\": invalid URL escape \"%tw\"", }, }, { @@ -250,7 +250,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-check-uri-abs': option 'redirect_uris' has an invalid value: redirect uri 'google.com' must have a scheme but it's absent", + "identity_providers: oidc: clients: client 'client-check-uri-abs': option 'redirect_uris' has an invalid value: redirect uri 'google.com' must have a scheme but it's absent", }, }, { @@ -295,12 +295,12 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a scheme with the value 'https'", - "identity_providers: oidc: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a path with the value '/path'", - "identity_providers: oidc: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a query with the value 'query=abc'", - "identity_providers: oidc: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a fragment with the value 'fragment'", - "identity_providers: oidc: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a username with the value 'user'", - "identity_providers: oidc: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a password", + "identity_providers: oidc: clients: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a scheme with the value 'https'", + "identity_providers: oidc: clients: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a path with the value '/path'", + "identity_providers: oidc: clients: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a query with the value 'query=abc'", + "identity_providers: oidc: clients: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a fragment with the value 'fragment'", + "identity_providers: oidc: clients: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a username with the value 'user'", + "identity_providers: oidc: clients: client 'client-invalid-sector': option 'sector_identifier' with value 'https://user:pass@example.com/path?query=abc#fragment': must be a URL with only the host component for example 'example.com' but it has a password", }, }, { @@ -317,7 +317,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-invalid-sector': option 'sector_identifier' with value 'example.com/path?query=abc#fragment': must be a URL with only the host component but appears to be invalid", + "identity_providers: oidc: clients: client 'client-invalid-sector': option 'sector_identifier' with value 'example.com/path?query=abc#fragment': must be a URL with only the host component but appears to be invalid", }, }, { @@ -334,7 +334,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-bad-consent-mode': consent: option 'mode' must be one of 'auto', 'implicit', 'explicit', 'pre-configured', or 'auto' but it's configured as 'cap'", + "identity_providers: oidc: clients: client 'client-bad-consent-mode': consent: option 'mode' must be one of 'auto', 'implicit', 'explicit', 'pre-configured', or 'auto' but it's configured as 'cap'", }, }, { @@ -351,7 +351,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-bad-pkce-mode': option 'pkce_challenge_method' must be one of 'plain' or 'S256' but it's configured as 'abc'", + "identity_providers: oidc: clients: client 'client-bad-pkce-mode': option 'pkce_challenge_method' must be one of 'plain' or 'S256' but it's configured as 'abc'", }, }, { @@ -368,7 +368,7 @@ func TestShouldRaiseErrorWhenOIDCServerClientBadValues(t *testing.T) { }, }, Errors: []string{ - "identity_providers: oidc: client 'client-bad-pkce-mode-s256': option 'pkce_challenge_method' must be one of 'plain' or 'S256' but it's configured as 's256'", + "identity_providers: oidc: clients: client 'client-bad-pkce-mode-s256': option 'pkce_challenge_method' must be one of 'plain' or 'S256' but it's configured as 's256'", }, }, } @@ -421,7 +421,7 @@ func TestShouldRaiseErrorWhenOIDCClientConfiguredWithBadScopes(t *testing.T) { ValidateIdentityProviders(config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: client 'good_id': option 'scopes' must only have the values 'openid', 'email', 'profile', 'groups', or 'offline_access' but the values 'bad_scope' are present") + assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: clients: client 'good_id': option 'scopes' must only have the values 'openid', 'email', 'profile', 'groups', or 'offline_access' but the values 'bad_scope' are present") } func TestShouldRaiseErrorWhenOIDCClientConfiguredWithBadGrantTypes(t *testing.T) { @@ -447,7 +447,7 @@ func TestShouldRaiseErrorWhenOIDCClientConfiguredWithBadGrantTypes(t *testing.T) ValidateIdentityProviders(config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: client 'good_id': option 'grant_types' must only have the values 'implicit', 'refresh_token', or 'authorization_code' but the values 'bad_grant_type' are present") + assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: clients: client 'good_id': option 'grant_types' must only have the values 'implicit', 'refresh_token', or 'authorization_code' but the values 'bad_grant_type' are present") } func TestShouldNotErrorOnCertificateValid(t *testing.T) { @@ -501,7 +501,7 @@ func TestShouldRaiseErrorOnCertificateNotValid(t *testing.T) { assert.Len(t, validator.Warnings(), 0) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: issuer_jwks: key #1 with key id '9c7423': option 'key' does not appear to be the private key the certificate provided by option 'certificate_chain'") + assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: issuer_private_keys: key #1 with key id 'bf1e10': option 'certificate_chain' does not appear to contain the public key for the private key provided by option 'key'") } func TestValidateIdentityProvidersShouldRaiseWarningOnSecurityIssue(t *testing.T) { @@ -566,8 +566,8 @@ func TestValidateIdentityProvidersShouldRaiseErrorsOnInvalidClientTypes(t *testi require.Len(t, validator.Errors(), 2) assert.Len(t, validator.Warnings(), 0) - assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: client 'client-with-invalid-secret': option 'secret' is required to be empty when option 'public' is true") - assert.EqualError(t, validator.Errors()[1], "identity_providers: oidc: client 'client-with-bad-redirect-uri': option 'redirect_uris' has the redirect uri 'urn:ietf:wg:oauth:2.0:oob' when option 'public' is false but this is invalid as this uri is not valid for the openid connect confidential client type") + assert.EqualError(t, validator.Errors()[0], "identity_providers: oidc: clients: client 'client-with-invalid-secret': option 'secret' is required to be empty when option 'public' is true") + assert.EqualError(t, validator.Errors()[1], "identity_providers: oidc: clients: client 'client-with-bad-redirect-uri': option 'redirect_uris' has the redirect uri 'urn:ietf:wg:oauth:2.0:oob' when option 'public' is false but this is invalid as this uri is not valid for the openid connect confidential client type") } func TestValidateIdentityProvidersShouldNotRaiseErrorsOnValidClientOptions(t *testing.T) { @@ -653,7 +653,7 @@ func TestValidateIdentityProvidersShouldRaiseWarningOnPlainTextClients(t *testin assert.Len(t, validator.Errors(), 0) require.Len(t, validator.Warnings(), 1) - assert.EqualError(t, validator.Warnings()[0], "identity_providers: oidc: client 'client-with-invalid-secret_standard': option 'secret' is plaintext but for clients not using the 'token_endpoint_auth_method' of 'client_secret_jwt' it should be a hashed value as plaintext values are deprecated with the exception of 'client_secret_jwt' and will be removed when oidc becomes stable") + assert.EqualError(t, validator.Warnings()[0], "identity_providers: oidc: clients: client 'client-with-invalid-secret_standard': option 'secret' is plaintext but for clients not using the 'token_endpoint_auth_method' of 'client_secret_jwt' it should be a hashed value as plaintext values are deprecated with the exception of 'client_secret_jwt' and will be removed when oidc becomes stable") } // All valid schemes are supported as defined in https://datatracker.ietf.org/doc/html/rfc8252#section-7.1 @@ -691,7 +691,7 @@ func TestValidateOIDCClientRedirectURIsSupportingPrivateUseURISchemes(t *testing assert.Len(t, validator.Warnings(), 0) assert.Len(t, validator.Errors(), 1) assert.ElementsMatch(t, validator.Errors(), []error{ - errors.New("identity_providers: oidc: client 'owncloud': option 'redirect_uris' has the redirect uri 'urn:ietf:wg:oauth:2.0:oob' when option 'public' is false but this is invalid as this uri is not valid for the openid connect confidential client type"), + errors.New("identity_providers: oidc: clients: client 'owncloud': option 'redirect_uris' has the redirect uri 'urn:ietf:wg:oauth:2.0:oob' when option 'public' is false but this is invalid as this uri is not valid for the openid connect confidential client type"), }) }) } @@ -901,7 +901,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeAuthorizationCode}, }, []string{ - "identity_providers: oidc: client 'test': option 'scopes' must have unique values but the values 'openid' are duplicated", + "identity_providers: oidc: clients: client 'test': option 'scopes' must have unique values but the values 'openid' are duplicated", }, nil, }, @@ -923,7 +923,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'scopes' must only have the values 'openid', 'email', 'profile', 'groups', or 'offline_access' but the values 'group' are present", + "identity_providers: oidc: clients: client 'test': option 'scopes' must only have the values 'openid', 'email', 'profile', 'groups', or 'offline_access' but the values 'group' are present", }, }, { @@ -943,8 +943,8 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeImplicit, oidc.GrantTypeRefreshToken}, }, []string{ - "identity_providers: oidc: client 'test': option 'scopes' should only have the values 'offline_access' or 'offline' if the client is also configured with a 'response_type' such as 'code', 'code id_token', 'code token', or 'code id_token token' which respond with authorization codes", - "identity_providers: oidc: client 'test': option 'grant_types' should only have the values 'refresh_token' if the client is also configured with a 'response_type' such as 'code', 'code id_token', 'code token', or 'code id_token token' which respond with authorization codes", + "identity_providers: oidc: clients: client 'test': option 'scopes' should only have the values 'offline_access' or 'offline' if the client is also configured with a 'response_type' such as 'code', 'code id_token', 'code token', or 'code id_token token' which respond with authorization codes", + "identity_providers: oidc: clients: client 'test': option 'grant_types' should only have the values 'refresh_token' if the client is also configured with a 'response_type' such as 'code', 'code id_token', 'code token', or 'code id_token token' which respond with authorization codes", }, nil, }, @@ -965,7 +965,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeAuthorizationCode, oidc.GrantTypeImplicit}, }, []string{ - "identity_providers: oidc: client 'test': option 'response_types' must have unique values but the values 'code' are duplicated", + "identity_providers: oidc: clients: client 'test': option 'response_types' must have unique values but the values 'code' are duplicated", }, nil, }, @@ -986,7 +986,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{"implicit"}, }, []string{ - "identity_providers: oidc: client 'test': option 'response_types' must only have the values 'code', 'id_token', 'token', 'id_token token', 'code id_token', 'code token', or 'code id_token token' but the values 'token id_token' are present", + "identity_providers: oidc: clients: client 'test': option 'response_types' must only have the values 'code', 'id_token', 'token', 'id_token token', 'code id_token', 'code token', or 'code id_token token' but the values 'token id_token' are present", }, nil, }, @@ -1007,7 +1007,7 @@ func TestValidateOIDCClients(t *testing.T) { nil, }, []string{ - "identity_providers: oidc: client 'test': option 'response_types' must only have the values 'code', 'id_token', 'token', 'id_token token', 'code id_token', 'code token', or 'code id_token token' but the values 'not_valid' are present", + "identity_providers: oidc: clients: client 'test': option 'response_types' must only have the values 'code', 'id_token', 'token', 'id_token token', 'code id_token', 'code token', or 'code id_token token' but the values 'not_valid' are present", }, nil, }, @@ -1029,7 +1029,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'response_modes' must only have the values 'form_post', 'query', or 'fragment' but the values 'not_valid' are present", + "identity_providers: oidc: clients: client 'test': option 'response_modes' must only have the values 'form_post', 'query', or 'fragment' but the values 'not_valid' are present", }, }, { @@ -1049,7 +1049,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeAuthorizationCode}, }, []string{ - "identity_providers: oidc: client 'test': option 'response_modes' must have unique values but the values 'query' are duplicated", + "identity_providers: oidc: clients: client 'test': option 'response_modes' must have unique values but the values 'query' are duplicated", }, nil, }, @@ -1071,7 +1071,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'grant_types' must only have the values 'implicit', 'refresh_token', or 'authorization_code' but the values 'invalid' are present", + "identity_providers: oidc: clients: client 'test': option 'grant_types' must only have the values 'implicit', 'refresh_token', or 'authorization_code' but the values 'invalid' are present", }, }, { @@ -1091,7 +1091,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeAuthorizationCode, oidc.GrantTypeAuthorizationCode}, }, []string{ - "identity_providers: oidc: client 'test': option 'grant_types' must have unique values but the values 'authorization_code' are duplicated", + "identity_providers: oidc: clients: client 'test': option 'grant_types' must have unique values but the values 'authorization_code' are duplicated", }, nil, }, @@ -1112,7 +1112,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeAuthorizationCode, oidc.GrantTypeRefreshToken}, }, []string{ - "identity_providers: oidc: client 'test': option 'grant_types' should only have the 'refresh_token' value if the client is also configured with the 'offline_access' scope", + "identity_providers: oidc: clients: client 'test': option 'grant_types' should only have the 'refresh_token' value if the client is also configured with the 'offline_access' scope", }, nil, }, @@ -1133,7 +1133,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeAuthorizationCode}, }, []string{ - "identity_providers: oidc: client 'test': option 'grant_types' should only have grant type values which are valid with the configured 'response_types' for the client but 'authorization_code' expects a response type for either the authorization code or hybrid flow such as 'code', 'code id_token', 'code token', or 'code id_token token' but the response types are 'id_token token'", + "identity_providers: oidc: clients: client 'test': option 'grant_types' should only have grant type values which are valid with the configured 'response_types' for the client but 'authorization_code' expects a response type for either the authorization code or hybrid flow such as 'code', 'code id_token', 'code token', or 'code id_token token' but the response types are 'id_token token'", }, nil, }, @@ -1154,7 +1154,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeImplicit}, }, []string{ - "identity_providers: oidc: client 'test': option 'grant_types' should only have grant type values which are valid with the configured 'response_types' for the client but 'implicit' expects a response type for either the implicit or hybrid flow such as 'id_token', 'token', 'id_token token', 'code id_token', 'code token', or 'code id_token token' but the response types are 'code'", + "identity_providers: oidc: clients: client 'test': option 'grant_types' should only have grant type values which are valid with the configured 'response_types' for the client but 'implicit' expects a response type for either the implicit or hybrid flow such as 'id_token', 'token', 'id_token token', 'code id_token', 'code token', or 'code id_token token' but the response types are 'code'", }, nil, }, @@ -1234,7 +1234,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'redirect_uris' has the redirect uri 'urn:ietf:wg:oauth:2.0:oob' when option 'public' is false but this is invalid as this uri is not valid for the openid connect confidential client type", + "identity_providers: oidc: clients: client 'test': option 'redirect_uris' has the redirect uri 'urn:ietf:wg:oauth:2.0:oob' when option 'public' is false but this is invalid as this uri is not valid for the openid connect confidential client type", }, }, { @@ -1261,7 +1261,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'redirect_uris' has an invalid value: redirect uri 'http://abc@%two' could not be parsed: parse \"http://abc@%two\": invalid URL escape \"%tw\"", + "identity_providers: oidc: clients: client 'test': option 'redirect_uris' has an invalid value: redirect uri 'http://abc@%two' could not be parsed: parse \"http://abc@%two\": invalid URL escape \"%tw\"", }, }, { @@ -1288,7 +1288,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'redirect_uris' has an invalid value: redirect uri 'google.com' must have a scheme but it's absent", + "identity_providers: oidc: clients: client 'test': option 'redirect_uris' has an invalid value: redirect uri 'google.com' must have a scheme but it's absent", }, }, { @@ -1315,7 +1315,7 @@ func TestValidateOIDCClients(t *testing.T) { []string{oidc.GrantTypeAuthorizationCode}, }, []string{ - "identity_providers: oidc: client 'test': option 'redirect_uris' must have unique values but the values 'https://google.com' are duplicated", + "identity_providers: oidc: clients: client 'test': option 'redirect_uris' must have unique values but the values 'https://google.com' are duplicated", }, nil, }, @@ -1385,7 +1385,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', 'client_secret_basic', or 'client_secret_jwt' but it's configured as 'client_credentials'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', 'client_secret_basic', 'private_key_jwt', or 'client_secret_jwt' but it's configured as 'client_credentials'", }, }, { @@ -1412,7 +1412,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as 'client_secret_basic'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as 'client_secret_basic'", }, }, { @@ -1437,7 +1437,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'client_secret_post' or 'client_secret_basic' when configured as the confidential client type unless it only includes implicit flow response types such as 'id_token', 'token', and 'id_token token' but it's configured as 'none'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be one of 'client_secret_post', 'client_secret_basic', or 'private_key_jwt' when configured as the confidential client type unless it only includes implicit flow response types such as 'id_token', 'token', and 'id_token token' but it's configured as 'none'", }, }, { @@ -1462,7 +1462,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'client_secret_post' or 'client_secret_basic' when configured as the confidential client type unless it only includes implicit flow response types such as 'id_token', 'token', and 'id_token token' but it's configured as 'none'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be one of 'client_secret_post', 'client_secret_basic', or 'private_key_jwt' when configured as the confidential client type unless it only includes implicit flow response types such as 'id_token', 'token', and 'id_token token' but it's configured as 'none'", }, }, { @@ -1510,12 +1510,12 @@ func TestValidateOIDCClients(t *testing.T) { nil, }, { - "ShouldRaiseErrorOnInvalidUserInfoAlg", + "ShouldRaiseErrorOnInvalidUserInfoSigningAlg", func(have *schema.OpenIDConnectConfiguration) { - have.Clients[0].UserinfoSigningAlg = "rs256" + have.Clients[0].UserinfoSigningAlg = rs256 }, func(t *testing.T, have *schema.OpenIDConnectConfiguration) { - assert.Equal(t, "rs256", have.Clients[0].UserinfoSigningAlg) + assert.Equal(t, rs256, have.Clients[0].UserinfoSigningAlg) }, tcv{ nil, @@ -1531,7 +1531,32 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'userinfo_signing_algorithm' must be one of 'RS256' or 'none' but it's configured as 'rs256'", + "identity_providers: oidc: clients: client 'test': option 'userinfo_signing_alg' must be one of 'RS256' or 'none' but it's configured as 'rs256'", + }, + }, + { + "ShouldRaiseErrorOnInvalidIDTokenSigningAlg", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].IDTokenSigningAlg = rs256 + }, + func(t *testing.T, have *schema.OpenIDConnectConfiguration) { + assert.Equal(t, rs256, have.Clients[0].IDTokenSigningAlg) + }, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': option 'id_token_signing_alg' must be one of 'RS256' but it's configured as 'rs256'", }, }, { @@ -1677,6 +1702,114 @@ func TestValidateOIDCClients(t *testing.T) { nil, nil, }, + { + "ShouldRaiseErrorOnTokenEndpointClientAuthMethodPrivateKeyJWTMustSetAlg", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodPrivateKeyJWT + have.Clients[0].Secret = tOpenIDConnectPBKDF2ClientSecret + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_signing_alg' is required when option 'token_endpoint_auth_method' is configured to 'private_key_jwt'", + "identity_providers: oidc: clients: client 'test': option 'public_keys' is required with 'token_endpoint_auth_method' set to 'private_key_jwt'", + }, + }, + { + "ShouldRaiseErrorOnTokenEndpointClientAuthMethodPrivateKeyJWTMustSetAlg", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodPrivateKeyJWT + have.Clients[0].TokenEndpointAuthSigningAlg = "nope" + have.Clients[0].Secret = tOpenIDConnectPBKDF2ClientSecret + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_signing_alg' must be one of 'RS256', 'PS256', 'ES256', 'RS384', 'PS384', 'ES384', 'RS512', 'PS512', or 'ES512' when option 'token_endpoint_auth_method' is configured to 'private_key_jwt'", + "identity_providers: oidc: clients: client 'test': option 'public_keys' is required with 'token_endpoint_auth_method' set to 'private_key_jwt'", + }, + }, + { + "ShouldRaiseErrorOnTokenEndpointClientAuthMethodPrivateKeyJWTMustSetKnownAlg", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodPrivateKeyJWT + have.Clients[0].TokenEndpointAuthSigningAlg = oidc.SigningAlgECDSAUsingP384AndSHA384 + have.Clients[0].Secret = tOpenIDConnectPBKDF2ClientSecret + have.Clients[0].PublicKeys.Values = []schema.JWK{ + { + KeyID: "test", + Key: keyRSA2048.Public(), + Algorithm: oidc.SigningAlgRSAUsingSHA256, + }, + } + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_signing_alg' must be one of registered public key algorithm values 'RS256' when option 'token_endpoint_auth_method' is configured to 'private_key_jwt'", + }, + }, + { + "ShouldRaiseErrorOnTokenEndpointClientAuthMethodPrivateKeyJWTMustSetKnownAlg", + func(have *schema.OpenIDConnectConfiguration) { + have.Clients[0].TokenEndpointAuthMethod = oidc.ClientAuthMethodPrivateKeyJWT + have.Clients[0].TokenEndpointAuthSigningAlg = oidc.SigningAlgECDSAUsingP384AndSHA384 + have.Clients[0].Secret = tOpenIDConnectPBKDF2ClientSecret + }, + nil, + tcv{ + nil, + nil, + nil, + nil, + }, + tcv{ + []string{oidc.ScopeOpenID, oidc.ScopeGroups, oidc.ScopeProfile, oidc.ScopeEmail}, + []string{oidc.ResponseTypeAuthorizationCodeFlow}, + []string{oidc.ResponseModeFormPost, oidc.ResponseModeQuery}, + []string{oidc.GrantTypeAuthorizationCode}, + }, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': option 'public_keys' is required with 'token_endpoint_auth_method' set to 'private_key_jwt'", + }, + }, { "ShouldRaiseErrorOnIncorrectlyConfiguredTokenEndpointClientAuthMethodClientSecretJWT", func(have *schema.OpenIDConnectConfiguration) { @@ -1698,7 +1831,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'", + "identity_providers: oidc: clients: client 'test': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'", }, }, { @@ -1744,7 +1877,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'", + "identity_providers: oidc: clients: client 'test': option 'secret' must be plaintext with option 'token_endpoint_auth_method' with a value of 'client_secret_jwt'", }, }, { @@ -1818,7 +1951,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as 'client_secret_jwt'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as 'client_secret_jwt'", }, }, { @@ -1845,7 +1978,7 @@ func TestValidateOIDCClients(t *testing.T) { }, nil, []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_signing_alg' must be 'HS256', 'HS384', or 'HS512' when option 'token_endpoint_auth_method' is client_secret_jwt", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_signing_alg' must be one of 'HS256', 'HS384', or 'HS512' when option 'token_endpoint_auth_method' is configured to 'client_secret_jwt'", }, }, } @@ -1856,7 +1989,7 @@ func TestValidateOIDCClients(t *testing.T) { t.Run(tc.name, func(t *testing.T) { have := &schema.OpenIDConnectConfiguration{ Discovery: schema.OpenIDConnectDiscovery{ - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, Clients: []schema.OpenIDConnectClientConfiguration{ { @@ -1917,17 +2050,17 @@ func TestValidateOIDCClientTokenEndpointAuthMethod(t *testing.T) { {"ShouldSetDefaultValueConfidential", "", false, "", nil}, {"ShouldErrorOnInvalidValue", "abc", false, "abc", []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', 'client_secret_basic', or 'client_secret_jwt' but it's configured as 'abc'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be one of 'none', 'client_secret_post', 'client_secret_basic', 'private_key_jwt', or 'client_secret_jwt' but it's configured as 'abc'", }, }, {"ShouldErrorOnInvalidValueForPublicClient", "client_secret_post", true, "client_secret_post", []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as 'client_secret_post'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be 'none' when configured as the public client type but it's configured as 'client_secret_post'", }, }, {"ShouldErrorOnInvalidValueForConfidentialClient", "none", false, "none", []string{ - "identity_providers: oidc: client 'test': option 'token_endpoint_auth_method' must be one of 'client_secret_post' or 'client_secret_basic' when configured as the confidential client type unless it only includes implicit flow response types such as 'id_token', 'token', and 'id_token token' but it's configured as 'none'", + "identity_providers: oidc: clients: client 'test': option 'token_endpoint_auth_method' must be one of 'client_secret_post', 'client_secret_basic', or 'private_key_jwt' when configured as the confidential client type unless it only includes implicit flow response types such as 'id_token', 'token', and 'id_token token' but it's configured as 'none'", }, }, } @@ -1961,6 +2094,309 @@ func TestValidateOIDCClientTokenEndpointAuthMethod(t *testing.T) { } } +func TestValidateOIDCClientJWKS(t *testing.T) { + frankenchain := schema.NewX509CertificateChainFromCerts([]*x509.Certificate{certRSA2048.Leaf(), certRSA1024.Leaf()}) + frankenkey := &rsa.PrivateKey{} + + *frankenkey = *keyRSA2048 + + frankenkey.PublicKey.N = nil + + testCases := []struct { + name string + haveURI *url.URL + haveJWKS []schema.JWK + setup func(config *schema.OpenIDConnectConfiguration) + expected func(t *testing.T, config *schema.OpenIDConnectConfiguration) + errs []string + }{ + { + "ShouldValidateURL", + MustParseURL("https://example.com"), + nil, + nil, + nil, + nil, + }, + { + "ShouldErrorOnHTTPURL", + MustParseURL("http://example.com"), + nil, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: option 'uri' must have the 'https' scheme but the scheme is 'http'", + }, + }, + { + "ShouldErrorOnBothDefined", + MustParseURL("http://example.com"), + []schema.JWK{ + {KeyID: "test"}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: option 'uri' must not be defined at the same time as option 'values'", + }, + }, + { + "ShouldAllowGoodKey", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048PKCS8.Public()}, + }, + nil, + nil, + nil, + }, + { + "ShouldAllowGoodKeyWithCertificate", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048.Public(), CertificateChain: certRSA2048}, + }, + nil, + nil, + nil, + }, + { + "ShouldErrorOnPrivateKey", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048PKCS8}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1 with key id 'test': option 'key' must be a RSA public key or ECDSA public key but it's type is *rsa.PrivateKey", + }, + }, + { + "ShouldErrorOnMissingKID", + nil, + []schema.JWK{ + {Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048PKCS8.Public()}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1: option 'key_id' must be provided", + }, + }, + { + "ShouldFailOnNonKey", + nil, + []schema.JWK{ + {Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: "nokey", KeyID: "KeyID"}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1 with key id 'KeyID': option 'key' failed to get key properties: the key type 'string' is unknown or not valid for the configuration", + }, + }, + { + "ShouldFailOnBadUseAlg", + nil, + []schema.JWK{ + {KeyID: "test", Use: "enc", Algorithm: "bad", Key: keyRSA2048PKCS8.Public()}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1 with key id 'test': option 'use' must be one of 'sig' but it's configured as 'enc'", + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1 with key id 'test': option 'algorithm' must be one of 'RS256', 'PS256', 'ES256', 'RS384', 'PS384', 'ES384', 'RS512', 'PS512', or 'ES512' but it's configured as 'bad'", + }, + }, + { + "ShouldFailOnEmptyKey", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: nil}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1: option 'key' must be provided", + }, + }, + { + "ShouldFailOnMalformedKey", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: frankenkey.Public()}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1: option 'key' option 'key' must be a valid private key but the provided data is malformed as it's missing the public key bits", + }, + }, + { + "ShouldFailOnBadKeySize", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA1024.Public()}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1 with key id 'test': option 'key' is an RSA 1024 bit private key but it must at minimum be a RSA 2048 bit private key", + }, + }, + { + "ShouldFailOnMismatchedKeyCert", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048PKCS8.Public(), CertificateChain: certRSA2048}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1 with key id 'test': option 'certificate_chain' does not appear to contain the public key for the public key provided by option 'key'", + }, + }, + { + "ShouldFailOnMismatchedCertChain", + nil, + []schema.JWK{ + {KeyID: "test", Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048.Public(), CertificateChain: frankenchain}, + }, + nil, + nil, + []string{ + "identity_providers: oidc: clients: client 'test': public_keys: values: key #1 with key id 'test': option 'certificate_chain' produced an error during validation of the chain: certificate #1 in chain is not signed properly by certificate #2 in chain: x509: invalid signature: parent certificate cannot sign this kind of certificate", + }, + }, + { + "ShouldSetDefaultUseAlgRSA", + nil, + []schema.JWK{ + {KeyID: "test", Use: "", Algorithm: "", Key: keyRSA2048PKCS8.Public()}, + }, + nil, + func(t *testing.T, config *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.KeyUseSignature, config.Clients[0].PublicKeys.Values[0].Use) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, config.Clients[0].PublicKeys.Values[0].Algorithm) + }, + nil, + }, + { + "ShouldSetDefaultUseAlgECDSA256", + nil, + []schema.JWK{ + {KeyID: "test", Use: "", Algorithm: "", Key: keyECDSAP256.Public()}, + }, + nil, + func(t *testing.T, config *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.KeyUseSignature, config.Clients[0].PublicKeys.Values[0].Use) + assert.Equal(t, oidc.SigningAlgECDSAUsingP256AndSHA256, config.Clients[0].PublicKeys.Values[0].Algorithm) + }, + nil, + }, + { + "ShouldSetDefaultUseAlgECDSA384", + nil, + []schema.JWK{ + {KeyID: "test", Use: "", Algorithm: "", Key: keyECDSAP384.Public()}, + }, + nil, + func(t *testing.T, config *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.KeyUseSignature, config.Clients[0].PublicKeys.Values[0].Use) + assert.Equal(t, oidc.SigningAlgECDSAUsingP384AndSHA384, config.Clients[0].PublicKeys.Values[0].Algorithm) + }, + nil, + }, + { + "ShouldSetDefaultUseAlgECDSA521", + nil, + []schema.JWK{ + {KeyID: "test", Use: "", Algorithm: "", Key: keyECDSAP521.Public()}, + }, + nil, + func(t *testing.T, config *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.KeyUseSignature, config.Clients[0].PublicKeys.Values[0].Use) + assert.Equal(t, oidc.SigningAlgECDSAUsingP521AndSHA512, config.Clients[0].PublicKeys.Values[0].Algorithm) + }, + nil, + }, + { + "ShouldConfigureRegisteredRequestObjectAlgs", + nil, + []schema.JWK{ + {KeyID: "test", Use: "", Algorithm: "", Key: keyECDSAP521.Public()}, + }, + nil, + func(t *testing.T, config *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.KeyUseSignature, config.Clients[0].PublicKeys.Values[0].Use) + assert.Equal(t, oidc.SigningAlgECDSAUsingP521AndSHA512, config.Clients[0].PublicKeys.Values[0].Algorithm) + + assert.Equal(t, []string{oidc.SigningAlgECDSAUsingP521AndSHA512}, config.Discovery.RequestObjectSigningAlgs) + }, + nil, + }, + { + "ShouldOnlyAllowRequetsObjectSigningAlgsThatTheClientHasKeysFor", + nil, + []schema.JWK{ + {KeyID: "test", Use: "", Algorithm: "", Key: keyECDSAP521.Public()}, + }, + func(config *schema.OpenIDConnectConfiguration) { + config.Clients[0].RequestObjectSigningAlg = oidc.SigningAlgRSAUsingSHA512 + }, + func(t *testing.T, config *schema.OpenIDConnectConfiguration) { + assert.Equal(t, oidc.KeyUseSignature, config.Clients[0].PublicKeys.Values[0].Use) + assert.Equal(t, oidc.SigningAlgECDSAUsingP521AndSHA512, config.Clients[0].PublicKeys.Values[0].Algorithm) + + assert.Equal(t, []string{oidc.SigningAlgECDSAUsingP521AndSHA512}, config.Discovery.RequestObjectSigningAlgs) + }, + []string{ + "identity_providers: oidc: clients: client 'test': option 'request_object_signing_alg' must be one of 'ES512' configured in the client option 'public_keys'", + }, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + config := &schema.OpenIDConnectConfiguration{ + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "test", + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + URI: tc.haveURI, + Values: tc.haveJWKS, + }, + }, + }, + } + + if tc.setup != nil { + tc.setup(config) + } + + val := schema.NewStructValidator() + + validateOIDCClientPublicKeys(0, config, val) + + if tc.expected != nil { + tc.expected(t, config) + } + + n := len(tc.errs) + + assert.Len(t, val.Warnings(), 0) + + theErrors := val.Errors() + require.Len(t, theErrors, n) + + for i := 0; i < n; i++ { + assert.EqualError(t, theErrors[i], tc.errs[i]) + } + }) + } +} + func TestValidateOIDCIssuer(t *testing.T) { frankenchain := schema.NewX509CertificateChainFromCerts([]*x509.Certificate{certRSA2048.Leaf(), certRSA1024.Leaf()}) frankenkey := &rsa.PrivateKey{} @@ -1982,12 +2418,12 @@ func TestValidateOIDCIssuer(t *testing.T) { }, schema.OpenIDConnectConfiguration{ IssuerPrivateKey: keyRSA2048, - IssuerJWKS: []schema.JWK{ - {KeyID: "e7dfdc", Key: keyRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature}, + IssuerPrivateKeys: []schema.JWK{ + {KeyID: "1f8bfc", Key: keyRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "e7dfdc", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "1f8bfc", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, nil, @@ -1995,7 +2431,7 @@ func TestValidateOIDCIssuer(t *testing.T) { { "ShouldSetDefaultKeyValues", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA2048, CertificateChain: certRSA2048}, {Key: keyECDSAP256, CertificateChain: certECDSAP256}, {Key: keyECDSAP384, CertificateChain: certECDSAP384}, @@ -2003,15 +2439,15 @@ func TestValidateOIDCIssuer(t *testing.T) { }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "e7dfdc"}, - {Key: keyECDSAP256, CertificateChain: certECDSAP256, Algorithm: oidc.SigningAlgECDSAUsingP256AndSHA256, Use: oidc.KeyUseSignature, KeyID: "29b3f2"}, - {Key: keyECDSAP384, CertificateChain: certECDSAP384, Algorithm: oidc.SigningAlgECDSAUsingP384AndSHA384, Use: oidc.KeyUseSignature, KeyID: "e968b4"}, - {Key: keyECDSAP521, CertificateChain: certECDSAP521, Algorithm: oidc.SigningAlgECDSAUsingP521AndSHA512, Use: oidc.KeyUseSignature, KeyID: "6b20c3"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "1f8bfc"}, + {Key: keyECDSAP256, CertificateChain: certECDSAP256, Algorithm: oidc.SigningAlgECDSAUsingP256AndSHA256, Use: oidc.KeyUseSignature, KeyID: "1e7788"}, + {Key: keyECDSAP384, CertificateChain: certECDSAP384, Algorithm: oidc.SigningAlgECDSAUsingP384AndSHA384, Use: oidc.KeyUseSignature, KeyID: "ba8508"}, + {Key: keyECDSAP521, CertificateChain: certECDSAP521, Algorithm: oidc.SigningAlgECDSAUsingP521AndSHA512, Use: oidc.KeyUseSignature, KeyID: "7ecbac"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "e7dfdc", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgECDSAUsingP384AndSHA384, oidc.SigningAlgECDSAUsingP521AndSHA512}, + DefaultKeyID: "1f8bfc", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgECDSAUsingP384AndSHA384, oidc.SigningAlgECDSAUsingP521AndSHA512}, }, }, nil, @@ -2019,288 +2455,288 @@ func TestValidateOIDCIssuer(t *testing.T) { { "ShouldRaiseErrorsDuplicateRSA256Keys", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA2048, CertificateChain: certRSA2048}, {Key: keyRSA4096, CertificateChain: certRSA4096}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "e7dfdc"}, - {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "1f8bfc"}, + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "bf1e10"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "e7dfdc", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "1f8bfc", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #2 with key id '9c7423': option 'algorithm' must be unique but another key is using it", + "identity_providers: oidc: issuer_private_keys: key #2 with key id 'bf1e10': option 'algorithm' must be unique", }, }, { "ShouldRaiseErrorsDuplicateRSA256Keys", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA512}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA512, Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA512, Use: oidc.KeyUseSignature, KeyID: "bf1e10"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA512}, + DefaultKeyID: "", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA512}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: keys: must at least have one key supporting the 'RS256' algorithm but only has 'RS512'", + "identity_providers: oidc: issuer_private_keys: keys: must at least have one key supporting the 'RS256' algorithm but only has 'RS512'", }, }, { "ShouldRaiseErrorOnBadCurve", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096}, {Key: keyECDSAP224, CertificateChain: certECDSAP224}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "bf1e10"}, {Key: keyECDSAP224, CertificateChain: certECDSAP224}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "9c7423", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "bf1e10", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #2: option 'key' failed to calculate thumbprint to configure key id value: square/go-jose: unsupported/unknown elliptic curve", + "identity_providers: oidc: issuer_private_keys: key #2: option 'key' failed to calculate thumbprint to configure key id value: square/go-jose: unsupported/unknown elliptic curve", }, }, { "ShouldRaiseErrorOnBadRSAKey", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA1024, CertificateChain: certRSA1024}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA1024, CertificateChain: certRSA1024, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "a9c018"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA1024, CertificateChain: certRSA1024, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "cf375e"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "a9c018", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "cf375e", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id 'a9c018': option 'key' is an RSA 1024 bit private key but it must be a RSA 2048 bit private key", + "identity_providers: oidc: issuer_private_keys: key #1 with key id 'cf375e': option 'key' is an RSA 1024 bit private key but it must at minimum be a RSA 2048 bit private key", }, }, { "ShouldRaiseErrorOnBadAlg", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: "invalid"}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: "invalid", Use: oidc.KeyUseSignature, KeyID: "9c7423"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: "invalid", Use: oidc.KeyUseSignature, KeyID: "bf1e10"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "", - RegisteredJWKSigningAlgs: []string{"invalid"}, + DefaultKeyID: "", + ResponseObjectSigningAlgs: []string{"invalid"}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id '9c7423': option 'algorithm' must be one of 'RS256', 'PS256', 'ES256', 'RS384', 'PS384', 'ES384', 'RS512', 'PS512', or 'ES512' but it's configured as 'invalid'", - "identity_providers: oidc: issuer_jwks: keys: must at least have one key supporting the 'RS256' algorithm but only has 'invalid'", + "identity_providers: oidc: issuer_private_keys: key #1 with key id 'bf1e10': option 'algorithm' must be one of 'RS256', 'PS256', 'ES256', 'RS384', 'PS384', 'ES384', 'RS512', 'PS512', or 'ES512' but it's configured as 'invalid'", + "identity_providers: oidc: issuer_private_keys: keys: must at least have one key supporting the 'RS256' algorithm but only has 'invalid'", }, }, { "ShouldRaiseErrorOnBadUse", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, Use: "invalid"}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: "invalid", KeyID: "9c7423"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: "invalid", KeyID: "bf1e10"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "9c7423", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "bf1e10", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id '9c7423': option 'use' must be one of 'sig' but it's configured as 'invalid'", + "identity_providers: oidc: issuer_private_keys: key #1 with key id 'bf1e10': option 'use' must be one of 'sig' but it's configured as 'invalid'", }, }, { "ShouldRaiseErrorOnBadKeyIDLength", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, KeyID: "thisistoolong"}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "thisistoolong"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "thisistoolong", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "thisistoolong", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id 'thisistoolong': option `key_id`` must be 7 characters or less", + "identity_providers: oidc: issuer_private_keys: key #1 with key id 'thisistoolong': option `key_id`` must be 7 characters or less", }, }, { "ShouldRaiseErrorOnBadKeyIDCharacters", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, KeyID: "x@x"}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "x@x"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "x@x", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "x@x", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id 'x@x': option 'key_id' must only have alphanumeric characters", + "identity_providers: oidc: issuer_private_keys: key #1 with key id 'x@x': option 'key_id' must only have alphanumeric characters", }, }, { "ShouldRaiseErrorOnBadKeyIDDuplicates", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, KeyID: "x"}, {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, KeyID: "x"}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA4096, CertificateChain: certRSA4096, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "x"}, {Key: keyRSA2048, CertificateChain: certRSA2048, Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "x"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "x", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgRSAPSSUsingSHA256}, + DefaultKeyID: "x", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgRSAPSSUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #2 with key id 'x': option 'key_id' must be unique", + "identity_providers: oidc: issuer_private_keys: key #2 with key id 'x': option 'key_id' must be unique", }, }, { "ShouldRaiseErrorOnEd25519Keys", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyEd2519, CertificateChain: certEd15519}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyEd2519, CertificateChain: certEd15519, KeyID: "d2dd94"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyEd2519, CertificateChain: certEd15519, KeyID: "14dfd3"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "", - RegisteredJWKSigningAlgs: []string(nil), + DefaultKeyID: "", + ResponseObjectSigningAlgs: []string(nil), }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id 'd2dd94': option 'key' must be a *rsa.PrivateKey or *ecdsa.PrivateKey but it's a ed25519.PrivateKey", + "identity_providers: oidc: issuer_private_keys: key #1 with key id '14dfd3': option 'key' must be a RSA private key or ECDSA private key but it's type is ed25519.PrivateKey", }, }, { "ShouldRaiseErrorOnCertificateAsKey", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: publicRSA2048Pair}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: publicRSA2048Pair, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "904c62"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: publicRSA2048Pair, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "9a0e71"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "904c62", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "9a0e71", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id '904c62': option 'key' must be a *rsa.PrivateKey or *ecdsa.PrivateKey but it's a *rsa.PublicKey", + "identity_providers: oidc: issuer_private_keys: key #1 with key id '9a0e71': option 'key' must be a RSA private key or ECDSA private key but it's type is *rsa.PublicKey", }, }, { "ShouldRaiseErrorOnInvalidChain", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: keyRSA2048, CertificateChain: frankenchain}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ - {Key: keyRSA2048, CertificateChain: frankenchain, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "e7dfdc"}, + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: frankenchain, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature, KeyID: "1f8bfc"}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "e7dfdc", - RegisteredJWKSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, + DefaultKeyID: "1f8bfc", + ResponseObjectSigningAlgs: []string{oidc.SigningAlgRSAUsingSHA256}, }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id 'e7dfdc': option 'certificate_chain' produced an error during validation of the chain: certificate #1 in chain is not signed properly by certificate #2 in chain: x509: invalid signature: parent certificate cannot sign this kind of certificate", + "identity_providers: oidc: issuer_private_keys: key #1 with key id '1f8bfc': option 'certificate_chain' produced an error during validation of the chain: certificate #1 in chain is not signed properly by certificate #2 in chain: x509: invalid signature: parent certificate cannot sign this kind of certificate", }, }, { "ShouldRaiseErrorOnInvalidPrivateKeyN", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: frankenkey}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: frankenkey}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "", - RegisteredJWKSigningAlgs: []string(nil), + DefaultKeyID: "", + ResponseObjectSigningAlgs: []string(nil), }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1: option 'key' must be a valid RSA private key but the provided data is malformed as it's missing the public key bits", + "identity_providers: oidc: issuer_private_keys: key #1: option 'key' must be a valid private key but the provided data is malformed as it's missing the public key bits", }, }, { "ShouldRaiseErrorOnCertForKey", schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: certRSA2048}, }, }, schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ {Key: certRSA2048}, }, Discovery: schema.OpenIDConnectDiscovery{ - DefaultKeyID: "", - RegisteredJWKSigningAlgs: []string(nil), + DefaultKeyID: "", + ResponseObjectSigningAlgs: []string(nil), }, }, []string{ - "identity_providers: oidc: issuer_jwks: key #1 with key id '': option 'key' failed to get key properties: the key type 'schema.X509CertificateChain' is unknown or not valid for the configuration", + "identity_providers: oidc: issuer_private_keys: key #1 with key id '': option 'key' failed to get key properties: the key type 'schema.X509CertificateChain' is unknown or not valid for the configuration", }, }, } @@ -2314,21 +2750,21 @@ func TestValidateOIDCIssuer(t *testing.T) { validateOIDCIssuer(&tc.have, val) assert.Equal(t, tc.expected.Discovery.DefaultKeyID, tc.have.Discovery.DefaultKeyID) - assert.Equal(t, tc.expected.Discovery.RegisteredJWKSigningAlgs, tc.have.Discovery.RegisteredJWKSigningAlgs) + assert.Equal(t, tc.expected.Discovery.ResponseObjectSigningAlgs, tc.have.Discovery.ResponseObjectSigningAlgs) assert.Equal(t, tc.expected.IssuerPrivateKey, tc.have.IssuerPrivateKey) assert.Equal(t, tc.expected.IssuerCertificateChain, tc.have.IssuerCertificateChain) - n = len(tc.expected.IssuerJWKS) + n = len(tc.expected.IssuerPrivateKeys) - require.Len(t, tc.have.IssuerJWKS, n) + require.Len(t, tc.have.IssuerPrivateKeys, n) for i := 0; i < n; i++ { t.Run(fmt.Sprintf("Key%d", i), func(t *testing.T) { - assert.Equal(t, tc.expected.IssuerJWKS[i].Algorithm, tc.have.IssuerJWKS[i].Algorithm) - assert.Equal(t, tc.expected.IssuerJWKS[i].Use, tc.have.IssuerJWKS[i].Use) - assert.Equal(t, tc.expected.IssuerJWKS[i].KeyID, tc.have.IssuerJWKS[i].KeyID) - assert.Equal(t, tc.expected.IssuerJWKS[i].Key, tc.have.IssuerJWKS[i].Key) - assert.Equal(t, tc.expected.IssuerJWKS[i].CertificateChain, tc.have.IssuerJWKS[i].CertificateChain) + assert.Equal(t, tc.expected.IssuerPrivateKeys[i].Algorithm, tc.have.IssuerPrivateKeys[i].Algorithm) + assert.Equal(t, tc.expected.IssuerPrivateKeys[i].Use, tc.have.IssuerPrivateKeys[i].Use) + assert.Equal(t, tc.expected.IssuerPrivateKeys[i].KeyID, tc.have.IssuerPrivateKeys[i].KeyID) + assert.Equal(t, tc.expected.IssuerPrivateKeys[i].Key, tc.have.IssuerPrivateKeys[i].Key) + assert.Equal(t, tc.expected.IssuerPrivateKeys[i].CertificateChain, tc.have.IssuerPrivateKeys[i].CertificateChain) }) } @@ -2387,17 +2823,6 @@ func MustLoadCertificateChain(alg, op string) schema.X509CertificateChain { } } -func MustLoadCertificate(alg, op string) *x509.Certificate { - decoded := MustLoadCrypto(alg, op, "crt") - - cert, ok := decoded.(*x509.Certificate) - if !ok { - panic(fmt.Errorf("the key was not a *x509.Certificate, it's a %T", cert)) - } - - return cert -} - func MustLoadEd15519PrivateKey(curve string, extra ...string) ed25519.PrivateKey { decoded := MustLoadCrypto("ED25519", curve, "pem", extra...) @@ -2446,7 +2871,6 @@ const ( pathCrypto = "../test_resources/crypto/%s.%s" ) -//nolint:unused var ( tOpenIDConnectPBKDF2ClientSecret, tOpenIDConnectPlainTextClientSecret *schema.PasswordDigest @@ -2464,7 +2888,7 @@ var ( // Standard ECDSA key / certificate pairs. keyECDSAP256PKCS8, keyECDSAP384PKCS8, keyECDSAP521PKCS8 *ecdsa.PrivateKey - certECDSAP224PKCS8, certECDSAP256PKCS8, certECDSAP384PKCS8, certECDSAP521PKCS8 schema.X509CertificateChain + certECDSAP224PKCS8, certECDSAP256PKCS8, certECDSAP384PKCS8, certECDSAP521PKCS8 schema.X509CertificateChain //nolint:unused // Ed15519 key / certificate pair. keyEd2519 ed25519.PrivateKey diff --git a/internal/configuration/validator/notifier.go b/internal/configuration/validator/notifier.go index eaa64508b..deb2bc24c 100644 --- a/internal/configuration/validator/notifier.go +++ b/internal/configuration/validator/notifier.go @@ -37,13 +37,7 @@ func validateNotifierTemplates(config *schema.NotifierConfiguration, validator * return } - var ( - err error - ) - - _, err = os.Stat(config.TemplatePath) - - switch { + switch _, err := os.Stat(config.TemplatePath); { case os.IsNotExist(err): validator.Push(fmt.Errorf(errFmtNotifierTemplatePathNotExist, config.TemplatePath)) return diff --git a/internal/configuration/validator/notifier_test.go b/internal/configuration/validator/notifier_test.go index e3c764153..f2d39d5f5 100644 --- a/internal/configuration/validator/notifier_test.go +++ b/internal/configuration/validator/notifier_test.go @@ -8,6 +8,7 @@ import ( "testing" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "github.com/stretchr/testify/suite" "github.com/authelia/authelia/v4/internal/configuration/schema" @@ -284,3 +285,17 @@ func (suite *NotifierSuite) TestFileShouldEnsureFilenameIsProvided() { func TestNotifierSuite(t *testing.T) { suite.Run(t, new(NotifierSuite)) } + +func TestNotifierMiscMissingTemplateTests(t *testing.T) { + config := &schema.NotifierConfiguration{ + TemplatePath: string([]byte{0x0, 0x1}), + } + + val := schema.NewStructValidator() + + validateNotifierTemplates(config, val) + + require.Len(t, val.Errors(), 1) + + assert.EqualError(t, val.Errors()[0], "notifier: option 'template_path' refers to location '\x00\x01' which couldn't be opened: stat \x00\x01: invalid argument") +} diff --git a/internal/configuration/validator/server.go b/internal/configuration/validator/server.go index 6b71a00b0..3dcfc7533 100644 --- a/internal/configuration/validator/server.go +++ b/internal/configuration/validator/server.go @@ -2,6 +2,7 @@ package validator import ( "fmt" + "os" "path" "sort" "strings" @@ -19,11 +20,11 @@ func ValidateServerTLS(config *schema.Configuration, validator *schema.StructVal } if config.Server.TLS.Key != "" { - validateFileExists(config.Server.TLS.Key, validator, "key") + validateServerTLSFileExists("key", config.Server.TLS.Key, validator) } if config.Server.TLS.Certificate != "" { - validateFileExists(config.Server.TLS.Certificate, validator, "certificate") + validateServerTLSFileExists("certificate", config.Server.TLS.Certificate, validator) } if config.Server.TLS.Key == "" && config.Server.TLS.Certificate == "" && @@ -32,7 +33,24 @@ func ValidateServerTLS(config *schema.Configuration, validator *schema.StructVal } for _, clientCertPath := range config.Server.TLS.ClientCertificates { - validateFileExists(clientCertPath, validator, "client_certificates") + validateServerTLSFileExists("client_certificates", clientCertPath, validator) + } +} + +// validateServerTLSFileExists checks whether a file exist. +func validateServerTLSFileExists(name, path string, validator *schema.StructValidator) { + var ( + info os.FileInfo + err error + ) + + switch info, err = os.Stat(path); { + case os.IsNotExist(err): + validator.Push(fmt.Errorf("server: tls: option '%s' with path '%s' refers to a file that doesn't exist", name, path)) + case err != nil: + validator.Push(fmt.Errorf("server: tls: option '%s' with path '%s' could not be verified due to a file system error: %w", name, path, err)) + case info.IsDir(): + validator.Push(fmt.Errorf("server: tls: option '%s' with path '%s' refers to a directory but it should refer to a file", name, path)) } } @@ -197,13 +215,3 @@ func validateServerEndpointsAuthzStrategies(name string, strategies []schema.Ser } } } - -// validateFileExists checks whether a file exist. -func validateFileExists(path string, validator *schema.StructValidator, opt string) { - exist, err := utils.FileExists(path) - if err != nil { - validator.Push(fmt.Errorf(errFmtServerTLSFileNotExistErr, opt, path, err)) - } else if !exist { - validator.Push(fmt.Errorf(errFmtServerTLSFileNotExist, opt, path)) - } -} diff --git a/internal/configuration/validator/server_test.go b/internal/configuration/validator/server_test.go index 8c0c9d56b..7ba5f55cf 100644 --- a/internal/configuration/validator/server_test.go +++ b/internal/configuration/validator/server_test.go @@ -1,6 +1,7 @@ package validator import ( + "fmt" "os" "testing" "time" @@ -296,7 +297,7 @@ func TestShouldRaiseErrorWhenTLSCertDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: option 'certificate' the file '/tmp/unexisting_file' does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'certificate' with path '/tmp/unexisting_file' refers to a file that doesn't exist") } func TestShouldRaiseErrorWhenTLSKeyWithoutCertIsProvided(t *testing.T) { @@ -329,7 +330,7 @@ func TestShouldRaiseErrorWhenTLSKeyDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: option 'key' the file '/tmp/unexisting_file' does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'key' with path '/tmp/unexisting_file' refers to a file that doesn't exist") } func TestShouldNotRaiseErrorWhenBothTLSCertificateAndKeyAreProvided(t *testing.T) { @@ -373,7 +374,7 @@ func TestShouldRaiseErrorWhenTLSClientCertificateDoesNotExist(t *testing.T) { ValidateServer(&config, validator) require.Len(t, validator.Errors(), 1) - assert.EqualError(t, validator.Errors()[0], "server: tls: option 'client_certificates' the file '/tmp/unexisting' does not exist") + assert.EqualError(t, validator.Errors()[0], "server: tls: option 'client_certificates' with path '/tmp/unexisting' refers to a file that doesn't exist") } func TestShouldRaiseErrorWhenTLSClientAuthIsDefinedButNotServerCertificate(t *testing.T) { @@ -569,3 +570,25 @@ func TestServerAuthzEndpointLegacyAsImplementationLegacyWhenBlank(t *testing.T) assert.Equal(t, authzImplementationLegacy, config.Server.Endpoints.Authz[legacy].Implementation) } + +func TestValidateTLSPathStatInvalidArgument(t *testing.T) { + val := schema.NewStructValidator() + + validateServerTLSFileExists("key", string([]byte{0x0, 0x1}), val) + + require.Len(t, val.Errors(), 1) + + assert.EqualError(t, val.Errors()[0], "server: tls: option 'key' with path '\x00\x01' could not be verified due to a file system error: stat \x00\x01: invalid argument") +} + +func TestValidateTLSPathIsDir(t *testing.T) { + dir := t.TempDir() + + val := schema.NewStructValidator() + + validateServerTLSFileExists("key", dir, val) + + require.Len(t, val.Errors(), 1) + + assert.EqualError(t, val.Errors()[0], fmt.Sprintf("server: tls: option 'key' with path '%s' refers to a directory but it should refer to a file", dir)) +} diff --git a/internal/configuration/validator/shared.go b/internal/configuration/validator/shared.go index 804945553..297ba0c2b 100644 --- a/internal/configuration/validator/shared.go +++ b/internal/configuration/validator/shared.go @@ -10,6 +10,10 @@ import ( // ValidateTLSConfig sets the default values and validates a schema.TLSConfig. func ValidateTLSConfig(config *schema.TLSConfig, configDefault *schema.TLSConfig) (err error) { + if configDefault == nil { + return errors.New("must provide configDefault") + } + if config == nil { return } @@ -35,7 +39,7 @@ func ValidateTLSConfig(config *schema.TLSConfig, configDefault *schema.TLSConfig } if (config.CertificateChain.HasCertificates() || config.PrivateKey != nil) && !config.CertificateChain.EqualKey(config.PrivateKey) { - return errors.New("option 'certificates' is invalid: provided certificate is not the public key for the private key provided") + return errors.New("option 'certificates' is invalid: provided certificate does not contain the public key for the private key provided") } return nil diff --git a/internal/configuration/validator/shared_test.go b/internal/configuration/validator/shared_test.go new file mode 100644 index 000000000..27e48ad75 --- /dev/null +++ b/internal/configuration/validator/shared_test.go @@ -0,0 +1,30 @@ +package validator + +import ( + "testing" + + "github.com/stretchr/testify/assert" + + "github.com/authelia/authelia/v4/internal/configuration/schema" +) + +func TestValidateTLSConfig(t *testing.T) { + var ( + config, configDefault *schema.TLSConfig + ) + + assert.EqualError(t, ValidateTLSConfig(config, configDefault), "must provide configDefault") + + configDefault = &schema.TLSConfig{} + + assert.NoError(t, ValidateTLSConfig(config, configDefault)) + + config = &schema.TLSConfig{} + + assert.NoError(t, ValidateTLSConfig(config, configDefault)) + + config.PrivateKey = keyRSA2048 + config.CertificateChain = certRSA4096 + + assert.EqualError(t, ValidateTLSConfig(config, configDefault), "option 'certificates' is invalid: provided certificate does not contain the public key for the private key provided") +} diff --git a/internal/configuration/validator/util.go b/internal/configuration/validator/util.go index e40f9ec4f..9ccf235c5 100644 --- a/internal/configuration/validator/util.go +++ b/internal/configuration/validator/util.go @@ -125,12 +125,20 @@ type JWKProperties struct { func schemaJWKGetProperties(jwk schema.JWK) (properties *JWKProperties, err error) { switch key := jwk.Key.(type) { case nil: - return nil, fmt.Errorf("private key is nil") + return nil, nil case ed25519.PrivateKey, ed25519.PublicKey: return &JWKProperties{}, nil case *rsa.PrivateKey: + if key.PublicKey.N == nil { + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgRSAUsingSHA256, 0, nil}, nil + } + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgRSAUsingSHA256, key.Size(), nil}, nil case *rsa.PublicKey: + if key.N == nil { + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgRSAUsingSHA256, 0, nil}, nil + } + return &JWKProperties{oidc.KeyUseSignature, oidc.SigningAlgRSAUsingSHA256, key.Size(), nil}, nil case *ecdsa.PublicKey: switch key.Curve { diff --git a/internal/configuration/validator/util_test.go b/internal/configuration/validator/util_test.go index 54c9bc711..2e3f14542 100644 --- a/internal/configuration/validator/util_test.go +++ b/internal/configuration/validator/util_test.go @@ -1,9 +1,14 @@ package validator import ( + "crypto/elliptic" + "crypto/rsa" "testing" "github.com/stretchr/testify/assert" + + "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/oidc" ) func TestIsCookieDomainValid(t *testing.T) { @@ -38,3 +43,39 @@ func TestIsCookieDomainValid(t *testing.T) { }) } } + +func TestBuildStringFuncsMissingTests(t *testing.T) { + assert.Equal(t, "", buildJoinedString(".", ":", "'", nil)) + assert.Equal(t, "'abc', '123'", strJoinComma("", []string{"abc", "123"})) +} + +func TestSchemaJWKGetPropertiesMissingTests(t *testing.T) { + props, err := schemaJWKGetProperties(schema.JWK{Key: keyECDSAP224}) + + assert.NoError(t, err) + assert.Equal(t, oidc.KeyUseSignature, props.Use) + assert.Equal(t, "", props.Algorithm) + assert.Equal(t, elliptic.P224(), props.Curve) + assert.Equal(t, -1, props.Bits) + + props, err = schemaJWKGetProperties(schema.JWK{Key: keyECDSAP224.Public()}) + + assert.NoError(t, err) + assert.Equal(t, oidc.KeyUseSignature, props.Use) + assert.Equal(t, "", props.Algorithm) + assert.Equal(t, elliptic.P224(), props.Curve) + assert.Equal(t, -1, props.Bits) + + rsa := &rsa.PrivateKey{} + + *rsa = *keyRSA2048 + rsa.PublicKey.N = nil + + props, err = schemaJWKGetProperties(schema.JWK{Key: rsa}) + + assert.NoError(t, err) + assert.Equal(t, oidc.KeyUseSignature, props.Use) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, props.Algorithm) + assert.Equal(t, nil, props.Curve) + assert.Equal(t, 0, props.Bits) +} diff --git a/internal/handlers/handler_oidc_authorization.go b/internal/handlers/handler_oidc_authorization.go index 9d8ea4e4e..2b1af3ed5 100644 --- a/internal/handlers/handler_oidc_authorization.go +++ b/internal/handlers/handler_oidc_authorization.go @@ -127,7 +127,7 @@ func OpenIDConnectAuthorization(ctx *middlewares.AutheliaCtx, rw http.ResponseWr ctx.Logger.Debugf("Authorization Request with id '%s' on client with id '%s' was successfully processed, proceeding to build Authorization Response", requester.GetID(), clientID) - session := oidc.NewSessionWithAuthorizeRequest(issuer, ctx.Providers.OpenIDConnect.KeyManager.GetKIDFromAlg(ctx, client.GetIDTokenSigningAlg()), + session := oidc.NewSessionWithAuthorizeRequest(issuer, ctx.Providers.OpenIDConnect.KeyManager.GetKeyIDFromAlg(ctx, client.GetIDTokenSigningAlg()), userSession.Username, userSession.AuthenticationMethodRefs.MarshalRFC8176(), extraClaims, authTime, consent, requester) ctx.Logger.Tracef("Authorization Request with id '%s' on client with id '%s' creating session for Authorization Response for subject '%s' with username '%s' with claims: %+v", diff --git a/internal/oidc/amr_test.go b/internal/oidc/amr_test.go index d1f382242..522102973 100644 --- a/internal/oidc/amr_test.go +++ b/internal/oidc/amr_test.go @@ -1,10 +1,12 @@ -package oidc +package oidc_test import ( "fmt" "testing" "github.com/stretchr/testify/assert" + + "github.com/authelia/authelia/v4/internal/oidc" ) type testAMRWant struct { @@ -17,13 +19,13 @@ type testAMRWant struct { func TestAuthenticationMethodsReferences(t *testing.T) { testCases := []struct { desc string - is AuthenticationMethodsReferences + is oidc.AuthenticationMethodsReferences want testAMRWant }{ { desc: "Username and Password", - is: AuthenticationMethodsReferences{UsernameAndPassword: true}, + is: oidc.AuthenticationMethodsReferences{UsernameAndPassword: true}, want: testAMRWant{ FactorKnowledge: true, FactorPossession: false, @@ -37,7 +39,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "TOTP", - is: AuthenticationMethodsReferences{TOTP: true}, + is: oidc.AuthenticationMethodsReferences{TOTP: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: true, @@ -51,7 +53,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "WebAuthn", - is: AuthenticationMethodsReferences{WebAuthn: true}, + is: oidc.AuthenticationMethodsReferences{WebAuthn: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: true, @@ -65,7 +67,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "WebAuthn User Presence", - is: AuthenticationMethodsReferences{WebAuthnUserPresence: true}, + is: oidc.AuthenticationMethodsReferences{WebAuthnUserPresence: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: false, @@ -79,7 +81,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "WebAuthn User Verified", - is: AuthenticationMethodsReferences{WebAuthnUserVerified: true}, + is: oidc.AuthenticationMethodsReferences{WebAuthnUserVerified: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: false, @@ -93,7 +95,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "WebAuthn with User Presence and Verified", - is: AuthenticationMethodsReferences{WebAuthn: true, WebAuthnUserVerified: true, WebAuthnUserPresence: true}, + is: oidc.AuthenticationMethodsReferences{WebAuthn: true, WebAuthnUserVerified: true, WebAuthnUserPresence: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: true, @@ -107,7 +109,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "Duo", - is: AuthenticationMethodsReferences{Duo: true}, + is: oidc.AuthenticationMethodsReferences{Duo: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: true, @@ -121,7 +123,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "Duo WebAuthn TOTP", - is: AuthenticationMethodsReferences{Duo: true, WebAuthn: true, TOTP: true}, + is: oidc.AuthenticationMethodsReferences{Duo: true, WebAuthn: true, TOTP: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: true, @@ -135,7 +137,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "Duo TOTP", - is: AuthenticationMethodsReferences{Duo: true, TOTP: true}, + is: oidc.AuthenticationMethodsReferences{Duo: true, TOTP: true}, want: testAMRWant{ FactorKnowledge: false, FactorPossession: true, @@ -149,7 +151,7 @@ func TestAuthenticationMethodsReferences(t *testing.T) { { desc: "Username and Password with Duo", - is: AuthenticationMethodsReferences{Duo: true, UsernameAndPassword: true}, + is: oidc.AuthenticationMethodsReferences{Duo: true, UsernameAndPassword: true}, want: testAMRWant{ FactorKnowledge: true, FactorPossession: true, diff --git a/internal/oidc/client_auth.go b/internal/oidc/authentication.go similarity index 93% rename from internal/oidc/client_auth.go rename to internal/oidc/authentication.go index c852153bc..f656a0eb4 100644 --- a/internal/oidc/client_auth.go +++ b/internal/oidc/authentication.go @@ -10,6 +10,8 @@ import ( "net/url" "time" + "github.com/go-crypt/crypt" + "github.com/go-crypt/crypt/algorithm" "github.com/go-crypt/crypt/algorithm/plaintext" "github.com/golang-jwt/jwt/v4" "github.com/ory/fosite" @@ -20,6 +22,46 @@ import ( "github.com/authelia/authelia/v4/internal/configuration/schema" ) +// NewHasher returns a new Hasher. +func NewHasher() (hasher *Hasher, err error) { + hasher = &Hasher{} + + if hasher.decoder, err = crypt.NewDefaultDecoder(); err != nil { + return nil, err + } + + if err = plaintext.RegisterDecoderPlainText(hasher.decoder); err != nil { + return nil, err + } + + return hasher, nil +} + +// Hasher implements the fosite.Hasher interface and adaptively compares hashes. +type Hasher struct { + decoder algorithm.DecoderRegister +} + +// Compare compares the hash with the data and returns an error if they don't match. +func (h Hasher) Compare(_ context.Context, hash, data []byte) (err error) { + var digest algorithm.Digest + + if digest, err = h.decoder.Decode(string(hash)); err != nil { + return err + } + + if digest.MatchBytes(data) { + return nil + } + + return errPasswordsDoNotMatch +} + +// Hash creates a new hash from data. +func (h Hasher) Hash(_ context.Context, data []byte) (hash []byte, err error) { + return data, nil +} + // DefaultClientAuthenticationStrategy is a copy of fosite's with the addition of the client_secret_jwt method and some // minor superficial changes. // diff --git a/internal/handlers/handler_oidc_token_test.go b/internal/oidc/authentication_test.go similarity index 73% rename from internal/handlers/handler_oidc_token_test.go rename to internal/oidc/authentication_test.go index 279cc4e3d..3c666a9db 100644 --- a/internal/handlers/handler_oidc_token_test.go +++ b/internal/oidc/authentication_test.go @@ -1,14 +1,10 @@ -package handlers +package oidc_test import ( "context" - "crypto/ecdsa" - "crypto/rsa" "crypto/sha256" - "crypto/x509" "database/sql" "encoding/base64" - "encoding/pem" "fmt" "io" "net/http" @@ -21,6 +17,8 @@ import ( "github.com/golang/mock/gomock" "github.com/google/uuid" "github.com/ory/fosite" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "github.com/stretchr/testify/suite" "github.com/valyala/fasthttp" @@ -31,6 +29,58 @@ import ( "github.com/authelia/authelia/v4/internal/oidc" ) +func TestShouldNotRaiseErrorOnEqualPasswordsPlainText(t *testing.T) { + hasher, err := oidc.NewHasher() + + require.NoError(t, err) + + a := []byte("$plaintext$abc") + b := []byte("abc") + + ctx := context.Background() + + assert.NoError(t, hasher.Compare(ctx, a, b)) +} + +func TestShouldNotRaiseErrorOnEqualPasswordsPlainTextWithSeparator(t *testing.T) { + hasher, err := oidc.NewHasher() + + require.NoError(t, err) + + a := []byte("$plaintext$abc$123") + b := []byte("abc$123") + + ctx := context.Background() + + assert.NoError(t, hasher.Compare(ctx, a, b)) +} + +func TestShouldRaiseErrorOnNonEqualPasswordsPlainText(t *testing.T) { + hasher, err := oidc.NewHasher() + + require.NoError(t, err) + + a := []byte("$plaintext$abc") + b := []byte("abcd") + + ctx := context.Background() + + assert.EqualError(t, hasher.Compare(ctx, a, b), "The provided client secret did not match the registered client secret.") +} + +func TestShouldHashPassword(t *testing.T) { + hasher := oidc.Hasher{} + + data := []byte("abc") + + ctx := context.Background() + + hash, err := hasher.Hash(ctx, data) + + assert.NoError(t, err) + assert.Equal(t, data, hash) +} + func TestClientAuthenticationStrategySuite(t *testing.T) { suite.Run(t, &ClientAuthenticationStrategySuite{}) } @@ -135,7 +185,9 @@ func (s *ClientAuthenticationStrategySuite) GetAssertionRequest(token string) (r } func (s *ClientAuthenticationStrategySuite) GetCtx() oidc.OpenIDConnectContext { - return &oidc.MockOpenIDConnectContext{ + fmt.Println(s.GetIssuerURL()) + + return &MockOpenIDConnectContext{ Context: context.Background(), MockIssuerURL: s.GetIssuerURL(), } @@ -145,13 +197,13 @@ func (s *ClientAuthenticationStrategySuite) SetupTest() { s.ctrl = gomock.NewController(s.T()) s.store = mocks.NewMockStorage(s.ctrl) - secret := MustDecodeSecret("$plaintext$client-secret") + secret := tOpenIDConnectPlainTextClientSecret s.provider = oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ - IssuerJWKS: []schema.JWK{}, - IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: MustParseRSAPrivateKey(exampleRSAPrivateKey), - HMACSecret: "abc123", + IssuerPrivateKeys: []schema.JWK{ + {Key: keyRSA2048, CertificateChain: certRSA2048, Use: oidc.KeyUseSignature, Algorithm: oidc.SigningAlgRSAUsingSHA256}, + }, + HMACSecret: "abc123", Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "hs256", @@ -184,7 +236,7 @@ func (s *ClientAuthenticationStrategySuite) SetupTest() { TokenEndpointAuthSigningAlg: oidc.SigningAlgHMACUsingSHA512, }, { - ID: "rs256", + ID: rs256, Secret: secret, Policy: authorization.OneFactor.String(), RedirectURIs: []string{ @@ -273,6 +325,142 @@ func (s *ClientAuthenticationStrategySuite) SetupTest() { TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, TokenEndpointAuthSigningAlg: oidc.SigningAlgECDSAUsingP521AndSHA512, }, + + { + ID: "rs256k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAUsingSHA256, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: rs256, Key: keyRSA2048.PublicKey, Algorithm: oidc.SigningAlgRSAUsingSHA256, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "rs384k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAUsingSHA384, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "rs384", Key: keyRSA2048.PublicKey, Algorithm: oidc.SigningAlgRSAUsingSHA384, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "rs512k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAUsingSHA512, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "rs512", Key: keyRSA2048.PublicKey, Algorithm: oidc.SigningAlgRSAUsingSHA512, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "ps256k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAPSSUsingSHA256, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "ps256", Key: keyRSA2048.PublicKey, Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "ps384k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAPSSUsingSHA384, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "ps384", Key: keyRSA2048.PublicKey, Algorithm: oidc.SigningAlgRSAPSSUsingSHA384, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "ps512k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgRSAPSSUsingSHA512, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "ps512", Key: keyRSA2048.PublicKey, Algorithm: oidc.SigningAlgRSAPSSUsingSHA512, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "es256k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgECDSAUsingP256AndSHA256, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "es256", Key: keyECDSAP256.PublicKey, Algorithm: oidc.SigningAlgECDSAUsingP256AndSHA256, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "es384k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgECDSAUsingP384AndSHA384, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "es384", Key: keyECDSAP384.PublicKey, Algorithm: oidc.SigningAlgECDSAUsingP384AndSHA384, Use: oidc.KeyUseSignature}, + }, + }, + }, + { + ID: "es512k", + Secret: secret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgECDSAUsingP521AndSHA512, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + Values: []schema.JWK{ + {KeyID: "es512", Key: keyECDSAP521.PublicKey, Algorithm: oidc.SigningAlgECDSAUsingP521AndSHA512, Use: oidc.KeyUseSignature}, + }, + }, + }, { ID: "hs5122", Secret: secret, @@ -471,7 +659,7 @@ func (s *ClientAuthenticationStrategySuite) TestShouldValidateAssertionHS512() { } func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnMismatchedAlg() { - assertion := NewAssertion("rs256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + assertion := NewAssertion(rs256, s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodHS512, assertion) @@ -507,11 +695,11 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnMismatchedAlgS } func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysRS256() { - assertion := NewAssertion("rs256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + assertion := NewAssertion(rs256, s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS256, assertion) - token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + token, err := assertionJWT.SignedString(keyRSA2048) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -524,12 +712,100 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnBadAlgRS256() { + assertion := NewAssertion("rs256k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS256, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = rs256 + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The 'client_assertion' uses signing algorithm 'PS256' but the requested OAuth 2.0 Client enforces signing algorithm 'RS256'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnBadKidRS256() { + assertion := NewAssertion("rs256k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS256, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "nokey" + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The JSON Web Token uses signing key with kid 'nokey', which could not be found.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnBadTypRS256() { + assertion := NewAssertion("rs256k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES256, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = rs256 + + token, err := assertionJWT.SignedString(keyECDSAP256) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.EqualError(ErrorToRFC6749ErrorTest(err), "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The 'client_assertion' uses signing algorithm 'ES256' but the requested OAuth 2.0 Client enforces signing algorithm 'RS256'.") + s.Nil(client) +} + +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysRS256() { + assertion := NewAssertion("rs256k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS256, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = rs256 + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("rs256k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysRS384() { assertion := NewAssertion("rs384", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS384, assertion) - token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + token, err := assertionJWT.SignedString(keyRSA2048) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -542,12 +818,46 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysRS384() { + assertion := NewAssertion("rs384k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS384, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "rs384" + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("rs384k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysRS512() { assertion := NewAssertion("rs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS512, assertion) - token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + token, err := assertionJWT.SignedString(keyRSA2048) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -560,12 +870,46 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysRS512() { + assertion := NewAssertion("rs512k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodRS512, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "rs512" + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("rs512k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysPS256() { assertion := NewAssertion("ps256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS256, assertion) - token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + token, err := assertionJWT.SignedString(keyRSA2048) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -578,12 +922,46 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysPS256() { + assertion := NewAssertion("ps256k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS256, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "ps256" + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("ps256k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysPS384() { assertion := NewAssertion("ps384", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS384, assertion) - token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + token, err := assertionJWT.SignedString(keyRSA2048) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -596,12 +974,46 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysPS384() { + assertion := NewAssertion("ps384k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS384, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "ps384" + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("ps384k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysPS512() { assertion := NewAssertion("ps512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS512, assertion) - token, err := assertionJWT.SignedString(MustParseRSAPrivateKey(exampleRSAPrivateKey)) + token, err := assertionJWT.SignedString(keyRSA2048) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -614,12 +1026,46 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysPS512() { + assertion := NewAssertion("ps512k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodPS512, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "ps512" + + token, err := assertionJWT.SignedString(keyRSA2048) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("ps512k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysES256() { assertion := NewAssertion("es256", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES256, assertion) - token, err := assertionJWT.SignedString(MustParseECPrivateKey(exampleECP256PrivateKey)) + token, err := assertionJWT.SignedString(keyECDSAP256) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -632,12 +1078,47 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysES256() { + assertion := NewAssertion("es256k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES256, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "es256" + + token, err := assertionJWT.SignedString(keyECDSAP256) + + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("es256k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysES384() { assertion := NewAssertion("es384", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES384, assertion) - token, err := assertionJWT.SignedString(MustParseECPrivateKey(exampleECP384PrivateKey)) + token, err := assertionJWT.SignedString(keyECDSAP384) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -650,12 +1131,46 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysES384() { + assertion := NewAssertion("es384k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES384, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "es384" + + token, err := assertionJWT.SignedString(keyECDSAP384) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("es384k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKeysES512() { assertion := NewAssertion("es512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES512, assertion) - token, err := assertionJWT.SignedString(MustParseECPrivateKey(exampleECP521PrivateKey)) + token, err := assertionJWT.SignedString(keyECDSAP521) s.Require().NoError(err) s.Require().NotEqual("", token) @@ -668,6 +1183,40 @@ func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnUnregisteredKe s.Nil(client) } +func (s *ClientAuthenticationStrategySuite) TestShouldAuthKeysES512() { + assertion := NewAssertion("es512k", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) + + assertionJWT := jwt.NewWithClaims(jwt.SigningMethodES512, assertion) + assertionJWT.Header[oidc.JWTHeaderKeyIdentifier] = "es512" + + token, err := assertionJWT.SignedString(keyECDSAP521) + s.Require().NoError(err) + s.Require().NotEqual("", token) + + r := s.GetAssertionRequest(token) + + sig := fmt.Sprintf("%x", sha256.Sum256([]byte(assertion.ID))) + + ctx := s.GetCtx() + + gomock.InOrder( + s.store. + EXPECT().LoadOAuth2BlacklistedJTI(ctx, sig). + Return(nil, sql.ErrNoRows), + + s.store. + EXPECT().SaveOAuth2BlacklistedJTI(ctx, model.OAuth2BlacklistedJTI{Signature: sig, ExpiresAt: assertion.ExpiresAt.Time}). + Return(nil), + ) + + client, err := s.provider.DefaultClientAuthenticationStrategy(s.GetCtx(), r, r.PostForm) + + s.NoError(err) + s.Require().NotNil(client) + + s.Equal("es512k", client.GetID()) +} + func (s *ClientAuthenticationStrategySuite) TestShouldRaiseErrorOnJTIKnown() { assertion := NewAssertion("hs512", s.GetTokenURL(), time.Now().Add(time.Second*-3), time.Unix(time.Now().Add(time.Minute).Unix(), 0)) @@ -1384,126 +1933,3 @@ func NewAssertion(clientID string, tokenURL *url.URL, iat, exp time.Time) Regist }, } } - -type RFC6749ErrorTest struct { - *fosite.RFC6749Error -} - -func (err *RFC6749ErrorTest) Error() string { - return err.WithExposeDebug(true).GetDescription() -} - -func ErrorToRFC6749ErrorTest(err error) (rfc error) { - if err == nil { - return nil - } - - ferr := fosite.ErrorToRFC6749Error(err) - - return &RFC6749ErrorTest{ferr} -} - -func MustDecodeSecret(value string) *schema.PasswordDigest { - if secret, err := schema.DecodePasswordDigest(value); err != nil { - panic(err) - } else { - return secret - } -} - -func MustParseRequestURI(input string) *url.URL { - if requestURI, err := url.ParseRequestURI(input); err != nil { - panic(err) - } else { - return requestURI - } -} - -func MustParseRSAPrivateKey(data string) *rsa.PrivateKey { - block, _ := pem.Decode([]byte(data)) - if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { - panic("not pem encoded") - } - - if block.Type != "RSA PRIVATE KEY" { - panic("not private key") - } - - key, err := x509.ParsePKCS1PrivateKey(block.Bytes) - if err != nil { - panic(err) - } - - return key -} - -func MustParseECPrivateKey(data string) *ecdsa.PrivateKey { - block, _ := pem.Decode([]byte(data)) - if block == nil || block.Bytes == nil || len(block.Bytes) == 0 { - panic("not pem encoded") - } - - if block.Type != "EC PRIVATE KEY" { - panic("not private key") - } - - key, err := x509.ParseECPrivateKey(block.Bytes) - if err != nil { - panic(err) - } - - return key -} - -const exampleRSAPrivateKey = ` ------BEGIN RSA PRIVATE KEY----- -MIIEpQIBAAKCAQEA60Vuz1N1wUHiCDIlbz8gE0dWPCmHEWnXKchEEISqIJ6j5Eah -Q/GwX3WK0UV5ATRvWhg6o7/WfrLYcAsi4w79TgMjJHLWIY/jzAS3quEtzOLlLSWZ -9FR9SomQm3T/ETOS8IvSGrksIj0WgX35jB1NnbqSTRnYx7Cg/TBJjmiaqd0b9G/8 -LlReaihwGf8tvPgnteWIdon3EI2MKDBkaesRjpL98Cz7VvD7dajseAlUh9jQWVge -sN8qnm8pNPFAYsgxf//Jf0RfsND6H70zKKybDmyct4T4o/8qjivw4ly0XkArDCUj -Qx2KUF7nN+Bo9wwnNppjdnsOPUbus8o1a9vY1QIDAQABAoIBAQDl1SBY3PlN36SF -yScUtCALdUbi4taVxkVxBbioQlFIKHGGkRD9JN/dgSApK6r36FdXNhAi40cQ4nnZ -iqd8FKqTSTFNa/mPM9ee+ITMI8nwOz8SiYcKTndPF2/yzapXDYDgCFcpz/czQ2X2 -/i+IFyA5k4dUVomVGhFLBZ71xW5BvGUBMUH0XkeR5+c4gLvgR209BlpBHlkX4tUQ -+RQoxbKpkntl0mjqf91zcOe4LJVsXZFyN+NVSzLEbGC3lVSSiyjVQH3s7ExnTaHi -PpwSoXzu5QJj5xRit/1B3/LEGpIlPGFrkhMzBDTN+HYV/VLbCHJzjg5GVJawA82E -h2BY6YWJAoGBAPmGaZL5ggnTVR2XVBLDKbwL/sesqiPZk45B+I5eObHl+v236JH9 -RPMjdE10jOR1TzfQdmE2/RboKhiVn+osS+2W6VXSo7sMsSM1bLBPYhnwrNIqzrX8 -Vgi2bCl2S8ZhVo2R8c5WUaD0Gpxs6hwPIMOQWWwxDlsbg/UoLrhD3X4XAoGBAPFg -VSvaWQdDVAqjM42ObhZtWxeLfEAcxRQDMQq7btrTwBZSrtP3S3Egu66cp/4PT4VD -Hc8tYyT2rNETiqT6b2Rm1MgeoJ8wRqte6ZXSQVVQUOd42VG04O3aaleAGhXjEkM2 -avctRdKHDhQdIt+riPgaNj4FdYpmQ5zIrcZtBr/zAoGBAOBXzBX7xMHmwxEe3NUd -qSlMM579C9+9oF/3ymzeJMtgtcBmGHEhoFtmVgvJrV8+ZaIOCFExam2tASQnaqbV -etK7q0ChaNok+CJqxzThupcN/6PaHw4aOJQOx8KjfE95dqNEQ367txqaPk7D0dy2 -cUPDRdLzbC/X1lWV8iNzyPGzAoGBAN4R2epRpYz4Fa7/vWNkAcaib6c2zmaR0YN6 -+Di+ftvW6yfehDhBkWgQTHv2ZtxoK6oYOKmuQUP1qsNkbi8gtTEzJlrDStWKbcom -tVMAsNkT3otHdPEmL7bFNwcvtVAjrF6oBztHrLBnTr2UnMwZnhdczkC7dwuQ0G3D -d5VSI16fAoGAY7eeVDkic73GbZmtZibuodvPJ/z85RIBOrzf3ColO4jGI6Ej/EnD -rMEe/mRC27CJzS9L9Jc0Kt66mGSvodDGl0nBsXGNfPog0cGwweCVN0Eo2VJZbRTT -UoU05/Pvu2h3/E8gGTBY0/WPSo06YUsICjVDWNuOIa/7IY7SyE6Xxn0= ------END RSA PRIVATE KEY-----` - -const exampleECP256PrivateKey = ` ------BEGIN EC PRIVATE KEY----- -MHcCAQEEID1fSsJ8qyEqj2DVkrshaNiXqaSDX7qViASRkyGGJFbEoAoGCCqGSM49 -AwEHoUQDQgAENnBG+bBJIaIa+bRlHaLiXD86RAy+Ef9CVdAfpPGoNRfkOTcrrIV7 -2wv3Y5e0he63Tn9iVAFYRFexK1mjFw7TfA== ------END EC PRIVATE KEY-----` - -const exampleECP384PrivateKey = ` ------BEGIN EC PRIVATE KEY----- -MIGkAgEBBDBPoOfapxtgZ8XNE7Wwdlw+9oDc6x4m57MITZyWzN62jkFUAYsvPJDF -9+g+e8CT5yqgBwYFK4EEACKhZANiAAQ2uZ0HIIxIavyjGyX13tIZVOaRB4+D64dF -s3DXDrpXcuDTSohw9xBW5sLDqRVu2LkBsCUFXtEJUHgC+O7wToNw8nh+KdDrcu/J -miNqbvEHuvlSlHWyx9HH8kAEuu1+SZg= ------END EC PRIVATE KEY-----` - -const exampleECP521PrivateKey = ` ------BEGIN EC PRIVATE KEY----- -MIHcAgEBBEIBT07AnitDd1Z01bl5W5VW8/vTWyu7w3MSqEmCeKcM19p/TAJAeS8L -6UOig2fTUeuMeA2PoOUjI2Bid927VsWcxE2gBwYFK4EEACOhgYkDgYYABAGnV9mu -xY0E7/k8b+glOOMaN0+Qt70H9OmSz6tC8tU3EayRwFlNPch9TlvEpbCS3MsDE9dN -78EpFx45MUqzzdZcOgAu+EUC9Zas1YVK+WMo0GFy+XtFq3kxubOclBb52M/63mcd -zZnA8aAu9iTK9YPfcw1YWTJliNdKUoxmGVV5Ca1W4w== ------END EC PRIVATE KEY-----` diff --git a/internal/oidc/client.go b/internal/oidc/client.go index 64d1f22b3..2950e4ca6 100644 --- a/internal/oidc/client.go +++ b/internal/oidc/client.go @@ -46,12 +46,22 @@ func NewClient(config schema.OpenIDConnectClientConfiguration) (client Client) { base.ResponseModes = append(base.ResponseModes, fosite.ResponseModeType(mode)) } - if config.TokenEndpointAuthMethod != "" && config.TokenEndpointAuthMethod != "auto" { - client = &FullClient{ + if config.TokenEndpointAuthMethod != "" || config.TokenEndpointAuthSigningAlg != "" || + len(config.PublicKeys.Values) != 0 || config.PublicKeys.URI != nil || config.RequestObjectSigningAlg != "" { + full := &FullClient{ BaseClient: base, TokenEndpointAuthMethod: config.TokenEndpointAuthMethod, TokenEndpointAuthSigningAlgorithm: config.TokenEndpointAuthSigningAlg, + RequestObjectSigningAlgorithm: config.RequestObjectSigningAlg, + + JSONWebKeys: NewPublicJSONWebKeySetFromSchemaJWK(config.PublicKeys.Values), } + + if config.PublicKeys.URI != nil { + full.JSONWebKeysURI = config.PublicKeys.URI.String() + } + + client = full } else { client = base } diff --git a/internal/oidc/client_test.go b/internal/oidc/client_test.go index 814c42a3c..b8c5d3e29 100644 --- a/internal/oidc/client_test.go +++ b/internal/oidc/client_test.go @@ -1,4 +1,4 @@ -package oidc +package oidc_test import ( "fmt" @@ -14,30 +14,31 @@ import ( "github.com/authelia/authelia/v4/internal/authorization" "github.com/authelia/authelia/v4/internal/configuration/schema" "github.com/authelia/authelia/v4/internal/model" + "github.com/authelia/authelia/v4/internal/oidc" ) func TestNewClient(t *testing.T) { config := schema.OpenIDConnectClientConfiguration{} - client := NewClient(config) + client := oidc.NewClient(config) assert.Equal(t, "", client.GetID()) assert.Equal(t, "", client.GetDescription()) assert.Len(t, client.GetResponseModes(), 0) assert.Len(t, client.GetResponseTypes(), 1) assert.Equal(t, "", client.GetSectorIdentifier()) - bclient, ok := client.(*BaseClient) + bclient, ok := client.(*oidc.BaseClient) require.True(t, ok) assert.Equal(t, "", bclient.UserinfoSigningAlg) - assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlg()) + assert.Equal(t, oidc.SigningAlgNone, client.GetUserinfoSigningAlg()) - _, ok = client.(*FullClient) + _, ok = client.(*oidc.FullClient) assert.False(t, ok) config = schema.OpenIDConnectClientConfiguration{ ID: myclient, Description: myclientdesc, Policy: twofactor, - Secret: MustDecodeSecret(badsecret), + Secret: tOpenIDConnectPlainTextClientSecret, RedirectURIs: []string{examplecom}, Scopes: schema.DefaultOpenIDConnectClientConfiguration.Scopes, ResponseTypes: schema.DefaultOpenIDConnectClientConfiguration.ResponseTypes, @@ -45,44 +46,42 @@ func TestNewClient(t *testing.T) { ResponseModes: schema.DefaultOpenIDConnectClientConfiguration.ResponseModes, } - client = NewClient(config) + client = oidc.NewClient(config) assert.Equal(t, myclient, client.GetID()) require.Len(t, client.GetResponseModes(), 1) assert.Equal(t, fosite.ResponseModeFormPost, client.GetResponseModes()[0]) assert.Equal(t, authorization.TwoFactor, client.GetAuthorizationPolicy()) config = schema.OpenIDConnectClientConfiguration{ - TokenEndpointAuthMethod: ClientAuthMethodClientSecretPost, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretPost, } - client = NewClient(config) + client = oidc.NewClient(config) - fclient, ok := client.(*FullClient) - - var niljwks *jose.JSONWebKeySet + fclient, ok := client.(*oidc.FullClient) require.True(t, ok) assert.Equal(t, "", fclient.UserinfoSigningAlg) - assert.Equal(t, SigningAlgNone, client.GetUserinfoSigningAlg()) - assert.Equal(t, SigningAlgNone, fclient.UserinfoSigningAlg) + assert.Equal(t, oidc.SigningAlgNone, client.GetUserinfoSigningAlg()) + assert.Equal(t, oidc.SigningAlgNone, fclient.UserinfoSigningAlg) assert.Equal(t, "", fclient.IDTokenSigningAlg) - assert.Equal(t, SigningAlgRSAUsingSHA256, client.GetIDTokenSigningAlg()) - assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.IDTokenSigningAlg) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, client.GetIDTokenSigningAlg()) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, fclient.IDTokenSigningAlg) - assert.Equal(t, ClientAuthMethodClientSecretPost, fclient.TokenEndpointAuthMethod) - assert.Equal(t, ClientAuthMethodClientSecretPost, fclient.GetTokenEndpointAuthMethod()) + assert.Equal(t, oidc.ClientAuthMethodClientSecretPost, fclient.TokenEndpointAuthMethod) + assert.Equal(t, oidc.ClientAuthMethodClientSecretPost, fclient.GetTokenEndpointAuthMethod()) assert.Equal(t, "", fclient.TokenEndpointAuthSigningAlgorithm) - assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.GetTokenEndpointAuthSigningAlgorithm()) - assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.TokenEndpointAuthSigningAlgorithm) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, fclient.GetTokenEndpointAuthSigningAlgorithm()) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, fclient.TokenEndpointAuthSigningAlgorithm) assert.Equal(t, "", fclient.RequestObjectSigningAlgorithm) assert.Equal(t, "", fclient.GetRequestObjectSigningAlgorithm()) - fclient.RequestObjectSigningAlgorithm = SigningAlgRSAUsingSHA256 - assert.Equal(t, SigningAlgRSAUsingSHA256, fclient.GetRequestObjectSigningAlgorithm()) + fclient.RequestObjectSigningAlgorithm = oidc.SigningAlgRSAUsingSHA256 + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, fclient.GetRequestObjectSigningAlgorithm()) assert.Equal(t, "", fclient.JSONWebKeysURI) assert.Equal(t, "", fclient.GetJSONWebKeysURI()) @@ -90,22 +89,24 @@ func TestNewClient(t *testing.T) { fclient.JSONWebKeysURI = "https://example.com" assert.Equal(t, "https://example.com", fclient.GetJSONWebKeysURI()) + var niljwks *jose.JSONWebKeySet + assert.Equal(t, niljwks, fclient.JSONWebKeys) assert.Equal(t, niljwks, fclient.GetJSONWebKeys()) - assert.Equal(t, ClientConsentMode(0), fclient.Consent.Mode) + assert.Equal(t, oidc.ClientConsentMode(0), fclient.Consent.Mode) assert.Equal(t, time.Second*0, fclient.Consent.Duration) - assert.Equal(t, ClientConsent{Mode: ClientConsentModeExplicit}, fclient.GetConsentPolicy()) + assert.Equal(t, oidc.ClientConsent{Mode: oidc.ClientConsentModeExplicit}, fclient.GetConsentPolicy()) fclient.TokenEndpointAuthMethod = "" fclient.Public = false - assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.GetTokenEndpointAuthMethod()) - assert.Equal(t, ClientAuthMethodClientSecretBasic, fclient.TokenEndpointAuthMethod) + assert.Equal(t, oidc.ClientAuthMethodClientSecretBasic, fclient.GetTokenEndpointAuthMethod()) + assert.Equal(t, oidc.ClientAuthMethodClientSecretBasic, fclient.TokenEndpointAuthMethod) fclient.TokenEndpointAuthMethod = "" fclient.Public = true - assert.Equal(t, ClientAuthMethodNone, fclient.GetTokenEndpointAuthMethod()) - assert.Equal(t, ClientAuthMethodNone, fclient.TokenEndpointAuthMethod) + assert.Equal(t, oidc.ClientAuthMethodNone, fclient.GetTokenEndpointAuthMethod()) + assert.Equal(t, oidc.ClientAuthMethodNone, fclient.TokenEndpointAuthMethod) assert.Equal(t, []string(nil), fclient.RequestURIs) assert.Equal(t, []string(nil), fclient.GetRequestURIs()) @@ -114,13 +115,13 @@ func TestNewClient(t *testing.T) { func TestBaseClient_ValidatePARPolicy(t *testing.T) { testCases := []struct { name string - client *BaseClient + client *oidc.BaseClient have *fosite.Request expected string }{ { "ShouldNotEnforcePAR", - &BaseClient{ + &oidc.BaseClient{ EnforcePAR: false, }, &fosite.Request{}, @@ -128,36 +129,36 @@ func TestBaseClient_ValidatePARPolicy(t *testing.T) { }, { "ShouldEnforcePARAndErrorWithoutCorrectRequestURI", - &BaseClient{ + &oidc.BaseClient{ EnforcePAR: true, }, &fosite.Request{ Form: map[string][]string{ - FormParameterRequestURI: {"https://google.com"}, + oidc.FormParameterRequestURI: {"https://google.com"}, }, }, "invalid_request", }, { "ShouldEnforcePARAndErrorWithEmptyRequestURI", - &BaseClient{ + &oidc.BaseClient{ EnforcePAR: true, }, &fosite.Request{ Form: map[string][]string{ - FormParameterRequestURI: {""}, + oidc.FormParameterRequestURI: {""}, }, }, "invalid_request", }, { "ShouldEnforcePARAndNotErrorWithCorrectRequestURI", - &BaseClient{ + &oidc.BaseClient{ EnforcePAR: true, }, &fosite.Request{ Form: map[string][]string{ - FormParameterRequestURI: {urnPARPrefix + "abc"}, + oidc.FormParameterRequestURI: {oidc.RedirectURIPrefixPushedAuthorizationRequestURN + "abc"}, }, }, "", @@ -166,7 +167,7 @@ func TestBaseClient_ValidatePARPolicy(t *testing.T) { for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { - err := tc.client.ValidatePARPolicy(tc.have, urnPARPrefix) + err := tc.client.ValidatePARPolicy(tc.have, oidc.RedirectURIPrefixPushedAuthorizationRequestURN) switch tc.expected { case "": @@ -179,7 +180,7 @@ func TestBaseClient_ValidatePARPolicy(t *testing.T) { } func TestIsAuthenticationLevelSufficient(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} c.Policy = authorization.Bypass assert.False(t, c.IsAuthenticationLevelSufficient(authentication.NotAuthenticated)) @@ -203,7 +204,7 @@ func TestIsAuthenticationLevelSufficient(t *testing.T) { } func TestClient_GetConsentResponseBody(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} consentRequestBody := c.GetConsentResponseBody(nil) assert.Equal(t, "", consentRequestBody.ClientID) @@ -216,10 +217,10 @@ func TestClient_GetConsentResponseBody(t *testing.T) { consent := &model.OAuth2ConsentSession{ RequestedAudience: []string{examplecom}, - RequestedScopes: []string{ScopeOpenID, ScopeGroups}, + RequestedScopes: []string{oidc.ScopeOpenID, oidc.ScopeGroups}, } - expectedScopes := []string{ScopeOpenID, ScopeGroups} + expectedScopes := []string{oidc.ScopeOpenID, oidc.ScopeGroups} expectedAudiences := []string{examplecom} consentRequestBody = c.GetConsentResponseBody(consent) @@ -230,7 +231,7 @@ func TestClient_GetConsentResponseBody(t *testing.T) { } func TestClient_GetAudience(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} audience := c.GetAudience() assert.Len(t, audience, 0) @@ -243,24 +244,24 @@ func TestClient_GetAudience(t *testing.T) { } func TestClient_GetScopes(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} scopes := c.GetScopes() assert.Len(t, scopes, 0) - c.Scopes = []string{ScopeOpenID} + c.Scopes = []string{oidc.ScopeOpenID} scopes = c.GetScopes() require.Len(t, scopes, 1) - assert.Equal(t, ScopeOpenID, scopes[0]) + assert.Equal(t, oidc.ScopeOpenID, scopes[0]) } func TestClient_GetGrantTypes(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} grantTypes := c.GetGrantTypes() require.Len(t, grantTypes, 1) - assert.Equal(t, GrantTypeAuthorizationCode, grantTypes[0]) + assert.Equal(t, oidc.GrantTypeAuthorizationCode, grantTypes[0]) c.GrantTypes = []string{"device_code"} @@ -270,30 +271,30 @@ func TestClient_GetGrantTypes(t *testing.T) { } func TestClient_Hashing(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} hashedSecret := c.GetHashedSecret() assert.Equal(t, []byte(nil), hashedSecret) - c.Secret = MustDecodeSecret(badsecret) + c.Secret = tOpenIDConnectPlainTextClientSecret - assert.True(t, c.Secret.MatchBytes([]byte("a_bad_secret"))) + assert.True(t, c.Secret.MatchBytes([]byte("client-secret"))) } func TestClient_GetHashedSecret(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} hashedSecret := c.GetHashedSecret() assert.Equal(t, []byte(nil), hashedSecret) - c.Secret = MustDecodeSecret(badsecret) + c.Secret = tOpenIDConnectPlainTextClientSecret hashedSecret = c.GetHashedSecret() - assert.Equal(t, []byte(badsecret), hashedSecret) + assert.Equal(t, []byte("$plaintext$client-secret"), hashedSecret) } func TestClient_GetID(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} id := c.GetID() assert.Equal(t, "", id) @@ -305,7 +306,7 @@ func TestClient_GetID(t *testing.T) { } func TestClient_GetRedirectURIs(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} redirectURIs := c.GetRedirectURIs() require.Len(t, redirectURIs, 0) @@ -318,7 +319,7 @@ func TestClient_GetRedirectURIs(t *testing.T) { } func TestClient_GetResponseModes(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} responseModes := c.GetResponseModes() require.Len(t, responseModes, 0) @@ -337,18 +338,18 @@ func TestClient_GetResponseModes(t *testing.T) { } func TestClient_GetResponseTypes(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} responseTypes := c.GetResponseTypes() require.Len(t, responseTypes, 1) - assert.Equal(t, ResponseTypeAuthorizationCodeFlow, responseTypes[0]) + assert.Equal(t, oidc.ResponseTypeAuthorizationCodeFlow, responseTypes[0]) - c.ResponseTypes = []string{ResponseTypeAuthorizationCodeFlow, ResponseTypeImplicitFlowIDToken} + c.ResponseTypes = []string{oidc.ResponseTypeAuthorizationCodeFlow, oidc.ResponseTypeImplicitFlowIDToken} responseTypes = c.GetResponseTypes() require.Len(t, responseTypes, 2) - assert.Equal(t, ResponseTypeAuthorizationCodeFlow, responseTypes[0]) - assert.Equal(t, ResponseTypeImplicitFlowIDToken, responseTypes[1]) + assert.Equal(t, oidc.ResponseTypeAuthorizationCodeFlow, responseTypes[0]) + assert.Equal(t, oidc.ResponseTypeImplicitFlowIDToken, responseTypes[1]) } func TestNewClientPKCE(t *testing.T) { @@ -423,7 +424,7 @@ func TestNewClientPKCE(t *testing.T) { for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { - client := NewClient(tc.have) + client := oidc.NewClient(tc.have) assert.Equal(t, tc.expectedEnforcePKCE, client.GetPKCEEnforcement()) assert.Equal(t, tc.expectedEnforcePKCEChallengeMethod, client.GetPKCEChallengeMethodEnforcement()) @@ -473,14 +474,14 @@ func TestNewClientPAR(t *testing.T) { "ShouldEnforcePARAndErrorOnNonPARRequest", schema.OpenIDConnectClientConfiguration{EnforcePAR: true}, true, - &fosite.Request{Form: map[string][]string{FormParameterRequestURI: {"https://example.com"}}}, + &fosite.Request{Form: map[string][]string{oidc.FormParameterRequestURI: {"https://example.com"}}}, "invalid_request", "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Pushed Authorization Requests are enforced for this client but no such request was sent. The request_uri parameter 'https://example.com' is malformed."}, { "ShouldEnforcePARAndNotErrorOnPARRequest", schema.OpenIDConnectClientConfiguration{EnforcePAR: true}, true, - &fosite.Request{Form: map[string][]string{FormParameterRequestURI: {fmt.Sprintf("%sabc", urnPARPrefix)}}}, + &fosite.Request{Form: map[string][]string{oidc.FormParameterRequestURI: {fmt.Sprintf("%sabc", oidc.RedirectURIPrefixPushedAuthorizationRequestURN)}}}, "", "", }, @@ -488,12 +489,12 @@ func TestNewClientPAR(t *testing.T) { for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { - client := NewClient(tc.have) + client := oidc.NewClient(tc.have) assert.Equal(t, tc.expected, client.GetPAREnforcement()) if tc.r != nil { - err := client.ValidatePARPolicy(tc.r, urnPARPrefix) + err := client.ValidatePARPolicy(tc.r, oidc.RedirectURIPrefixPushedAuthorizationRequestURN) if tc.err != "" { require.NotNil(t, err) @@ -518,25 +519,25 @@ func TestNewClientResponseModes(t *testing.T) { }{ { "ShouldEnforceResponseModePolicyAndAllowDefaultModeQuery", - schema.OpenIDConnectClientConfiguration{ResponseModes: []string{ResponseModeQuery}}, + schema.OpenIDConnectClientConfiguration{ResponseModes: []string{oidc.ResponseModeQuery}}, []fosite.ResponseModeType{fosite.ResponseModeQuery}, - &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeDefault, Request: fosite.Request{Form: map[string][]string{FormParameterResponseMode: nil}}}, + &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeDefault, Request: fosite.Request{Form: map[string][]string{oidc.FormParameterResponseMode: nil}}}, "", "", }, { "ShouldEnforceResponseModePolicyAndFailOnDefaultMode", - schema.OpenIDConnectClientConfiguration{ResponseModes: []string{ResponseModeFormPost}}, + schema.OpenIDConnectClientConfiguration{ResponseModes: []string{oidc.ResponseModeFormPost}}, []fosite.ResponseModeType{fosite.ResponseModeFormPost}, - &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeDefault, Request: fosite.Request{Form: map[string][]string{FormParameterResponseMode: nil}}}, + &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeDefault, Request: fosite.Request{Form: map[string][]string{oidc.FormParameterResponseMode: nil}}}, "unsupported_response_mode", "The authorization server does not support obtaining a response using this response mode. The request omitted the response_mode making the default response_mode 'query' based on the other authorization request parameters but registered OAuth 2.0 client doesn't support this response_mode", }, { "ShouldNotEnforceConfiguredResponseMode", - schema.OpenIDConnectClientConfiguration{ResponseModes: []string{ResponseModeFormPost}}, + schema.OpenIDConnectClientConfiguration{ResponseModes: []string{oidc.ResponseModeFormPost}}, []fosite.ResponseModeType{fosite.ResponseModeFormPost}, - &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeQuery, Request: fosite.Request{Form: map[string][]string{FormParameterResponseMode: {ResponseModeQuery}}}}, + &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeQuery, Request: fosite.Request{Form: map[string][]string{oidc.FormParameterResponseMode: {oidc.ResponseModeQuery}}}}, "", "", }, @@ -544,7 +545,7 @@ func TestNewClientResponseModes(t *testing.T) { "ShouldNotEnforceUnconfiguredResponseMode", schema.OpenIDConnectClientConfiguration{ResponseModes: []string{}}, []fosite.ResponseModeType{}, - &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeDefault, Request: fosite.Request{Form: map[string][]string{FormParameterResponseMode: {ResponseModeQuery}}}}, + &fosite.AuthorizeRequest{DefaultResponseMode: fosite.ResponseModeQuery, ResponseMode: fosite.ResponseModeDefault, Request: fosite.Request{Form: map[string][]string{oidc.FormParameterResponseMode: {oidc.ResponseModeQuery}}}}, "", "", }, @@ -552,7 +553,7 @@ func TestNewClientResponseModes(t *testing.T) { for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { - client := NewClient(tc.have) + client := oidc.NewClient(tc.have) assert.Equal(t, tc.expected, client.GetResponseModes()) @@ -572,10 +573,48 @@ func TestNewClientResponseModes(t *testing.T) { } func TestClient_IsPublic(t *testing.T) { - c := &FullClient{BaseClient: &BaseClient{}} + c := &oidc.FullClient{BaseClient: &oidc.BaseClient{}} assert.False(t, c.IsPublic()) c.Public = true assert.True(t, c.IsPublic()) } + +func TestNewClient_JSONWebKeySetURI(t *testing.T) { + var ( + client oidc.Client + clientf *oidc.FullClient + ok bool + ) + + client = oidc.NewClient(schema.OpenIDConnectClientConfiguration{ + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretPost, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + URI: MustParseRequestURI("https://google.com"), + }, + }) + + require.NotNil(t, client) + + clientf, ok = client.(*oidc.FullClient) + + require.True(t, ok) + + assert.Equal(t, "https://google.com", clientf.GetJSONWebKeysURI()) + + client = oidc.NewClient(schema.OpenIDConnectClientConfiguration{ + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretPost, + PublicKeys: schema.OpenIDConnectClientPublicKeys{ + URI: nil, + }, + }) + + require.NotNil(t, client) + + clientf, ok = client.(*oidc.FullClient) + + require.True(t, ok) + + assert.Equal(t, "", clientf.GetJSONWebKeysURI()) +} diff --git a/internal/oidc/config.go b/internal/oidc/config.go index 1db4e757a..6dbd29e34 100644 --- a/internal/oidc/config.go +++ b/internal/oidc/config.go @@ -6,7 +6,6 @@ import ( "hash" "html/template" "net/url" - "path" "time" "github.com/hashicorp/go-retryablehttp" @@ -43,7 +42,7 @@ func NewConfig(config *schema.OpenIDConnectConfiguration, templates *templates.P PAR: PARConfig{ Enforced: config.PAR.Enforce, ContextLifespan: config.PAR.ContextLifespan, - URIPrefix: urnPARPrefix, + URIPrefix: RedirectURIPrefixPushedAuthorizationRequestURN, }, Templates: templates, } @@ -90,9 +89,8 @@ type Config struct { AllowedPrompts []string RefreshTokenScopes []string - HTTPClient *retryablehttp.Client - FormPostHTMLTemplate *template.Template - MessageCatalog i18n.MessageCatalog + HTTPClient *retryablehttp.Client + MessageCatalog i18n.MessageCatalog Templates *templates.Provider } @@ -386,8 +384,8 @@ func (c *Config) GetDisableRefreshTokenValidation(ctx context.Context) (disable // GetAuthorizeCodeLifespan returns the authorization code lifespan. func (c *Config) GetAuthorizeCodeLifespan(ctx context.Context) (lifespan time.Duration) { - if c.Lifespans.AuthorizeCode <= 0 { - c.Lifespans.AccessToken = lifespanAuthorizeCodeDefault + if c.Lifespans.AuthorizeCode.Seconds() <= 0 { + c.Lifespans.AuthorizeCode = lifespanAuthorizeCodeDefault } return c.Lifespans.AuthorizeCode @@ -395,8 +393,8 @@ func (c *Config) GetAuthorizeCodeLifespan(ctx context.Context) (lifespan time.Du // GetRefreshTokenLifespan returns the refresh token lifespan. func (c *Config) GetRefreshTokenLifespan(ctx context.Context) (lifespan time.Duration) { - if c.Lifespans.RefreshToken <= 0 { - c.Lifespans.AccessToken = lifespanRefreshTokenDefault + if c.Lifespans.RefreshToken.Seconds() <= 0 { + c.Lifespans.RefreshToken = lifespanRefreshTokenDefault } return c.Lifespans.RefreshToken @@ -404,8 +402,8 @@ func (c *Config) GetRefreshTokenLifespan(ctx context.Context) (lifespan time.Dur // GetIDTokenLifespan returns the ID token lifespan. func (c *Config) GetIDTokenLifespan(ctx context.Context) (lifespan time.Duration) { - if c.Lifespans.IDToken <= 0 { - c.Lifespans.AccessToken = lifespanTokenDefault + if c.Lifespans.IDToken.Seconds() <= 0 { + c.Lifespans.IDToken = lifespanTokenDefault } return c.Lifespans.IDToken @@ -413,7 +411,7 @@ func (c *Config) GetIDTokenLifespan(ctx context.Context) (lifespan time.Duration // GetAccessTokenLifespan returns the access token lifespan. func (c *Config) GetAccessTokenLifespan(ctx context.Context) (lifespan time.Duration) { - if c.Lifespans.AccessToken <= 0 { + if c.Lifespans.AccessToken.Seconds() <= 0 { c.Lifespans.AccessToken = lifespanTokenDefault } @@ -528,15 +526,13 @@ func (c *Config) GetFormPostHTMLTemplate(ctx context.Context) (tmpl *template.Te // GetTokenURL returns the token URL. func (c *Config) GetTokenURL(ctx context.Context) (tokenURL string) { - if ctx, ok := ctx.(OpenIDConnectContext); ok { - tokenURI, err := ctx.IssuerURL() - if err != nil { + if octx, ok := ctx.(OpenIDConnectContext); ok { + switch issuerURL, err := octx.IssuerURL(); err { + case nil: + return issuerURL.JoinPath(EndpointPathToken).String() + default: return c.TokenURL } - - tokenURI.Path = path.Join(tokenURI.Path, EndpointPathToken) - - return tokenURI.String() } return c.TokenURL @@ -592,7 +588,7 @@ func (c *Config) GetResponseModeHandlerExtension(ctx context.Context) (handler f // usually 'urn:ietf:params:oauth:request_uri:'. func (c *Config) GetPushedAuthorizeRequestURIPrefix(ctx context.Context) string { if c.PAR.URIPrefix == "" { - c.PAR.URIPrefix = urnPARPrefix + c.PAR.URIPrefix = RedirectURIPrefixPushedAuthorizationRequestURN } return c.PAR.URIPrefix @@ -607,7 +603,7 @@ func (c *Config) EnforcePushedAuthorize(ctx context.Context) bool { // GetPushedAuthorizeContextLifespan is the lifespan of the short-lived PAR context. func (c *Config) GetPushedAuthorizeContextLifespan(ctx context.Context) (lifespan time.Duration) { - if c.PAR.ContextLifespan.Seconds() == 0 { + if c.PAR.ContextLifespan.Seconds() <= 0 { c.PAR.ContextLifespan = lifespanPARContextDefault } diff --git a/internal/oidc/config_test.go b/internal/oidc/config_test.go new file mode 100644 index 000000000..192cc6ce5 --- /dev/null +++ b/internal/oidc/config_test.go @@ -0,0 +1,229 @@ +package oidc_test + +import ( + "context" + "fmt" + "net/url" + "testing" + "time" + + "github.com/ory/fosite/token/jwt" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/authelia/authelia/v4/internal/oidc" + "github.com/authelia/authelia/v4/internal/templates" +) + +func TestConfig_GetAllowedPrompts(t *testing.T) { + ctx := context.Background() + + config := &oidc.Config{} + + assert.Equal(t, []string(nil), config.AllowedPrompts) + assert.Equal(t, []string{oidc.PromptNone, oidc.PromptLogin, oidc.PromptConsent}, config.GetAllowedPrompts(ctx)) + assert.Equal(t, []string{oidc.PromptNone, oidc.PromptLogin, oidc.PromptConsent}, config.AllowedPrompts) + + config.AllowedPrompts = []string{oidc.PromptNone} + assert.Equal(t, []string{oidc.PromptNone}, config.AllowedPrompts) +} + +func TestConfig_PKCE(t *testing.T) { + ctx := context.Background() + + config := &oidc.Config{} + + assert.False(t, config.GetEnforcePKCE(ctx)) + assert.False(t, config.GetEnforcePKCEForPublicClients(ctx)) + + config.ProofKeyCodeExchange.Enforce = true + assert.True(t, config.GetEnforcePKCE(ctx)) + assert.True(t, config.GetEnforcePKCEForPublicClients(ctx)) + + config.ProofKeyCodeExchange.Enforce = false + + assert.False(t, config.GetEnforcePKCEForPublicClients(ctx)) + + config.ProofKeyCodeExchange.EnforcePublicClients = true + + assert.True(t, config.GetEnforcePKCEForPublicClients(ctx)) + + assert.False(t, config.GetEnablePKCEPlainChallengeMethod(ctx)) + config.ProofKeyCodeExchange.AllowPlainChallengeMethod = true + + assert.True(t, config.GetEnablePKCEPlainChallengeMethod(ctx)) +} + +func TestConfig_GrantTypeJWTBearer(t *testing.T) { + ctx := context.Background() + + config := &oidc.Config{} + assert.False(t, config.GetGrantTypeJWTBearerIDOptional(ctx)) + assert.False(t, config.GetGrantTypeJWTBearerCanSkipClientAuth(ctx)) + assert.False(t, config.GetGrantTypeJWTBearerIssuedDateOptional(ctx)) + + config.GrantTypeJWTBearer.OptionalJTIClaim = true + assert.True(t, config.GetGrantTypeJWTBearerIDOptional(ctx)) + assert.False(t, config.GetGrantTypeJWTBearerCanSkipClientAuth(ctx)) + assert.False(t, config.GetGrantTypeJWTBearerIssuedDateOptional(ctx)) + + config.GrantTypeJWTBearer.OptionalClientAuth = true + assert.True(t, config.GetGrantTypeJWTBearerIDOptional(ctx)) + assert.True(t, config.GetGrantTypeJWTBearerCanSkipClientAuth(ctx)) + assert.False(t, config.GetGrantTypeJWTBearerIssuedDateOptional(ctx)) + + config.GrantTypeJWTBearer.OptionalIssuedDate = true + assert.True(t, config.GetGrantTypeJWTBearerIDOptional(ctx)) + assert.True(t, config.GetGrantTypeJWTBearerCanSkipClientAuth(ctx)) + assert.True(t, config.GetGrantTypeJWTBearerIssuedDateOptional(ctx)) +} + +func TestConfig_Durations(t *testing.T) { + ctx := context.Background() + + config := &oidc.Config{} + assert.Equal(t, time.Duration(0), config.JWTMaxDuration) + assert.Equal(t, time.Hour*24, config.GetJWTMaxDuration(ctx)) + assert.Equal(t, time.Hour*24, config.JWTMaxDuration) + + assert.Equal(t, time.Duration(0), config.Lifespans.IDToken) + assert.Equal(t, time.Hour, config.GetIDTokenLifespan(ctx)) + assert.Equal(t, time.Hour, config.Lifespans.IDToken) + + assert.Equal(t, time.Duration(0), config.Lifespans.AccessToken) + assert.Equal(t, time.Hour, config.GetAccessTokenLifespan(ctx)) + assert.Equal(t, time.Hour, config.Lifespans.AccessToken) + + assert.Equal(t, time.Duration(0), config.Lifespans.RefreshToken) + assert.Equal(t, time.Hour*24*30, config.GetRefreshTokenLifespan(ctx)) + assert.Equal(t, time.Hour*24*30, config.Lifespans.RefreshToken) + + assert.Equal(t, time.Duration(0), config.Lifespans.AuthorizeCode) + assert.Equal(t, time.Minute*15, config.GetAuthorizeCodeLifespan(ctx)) + assert.Equal(t, time.Minute*15, config.Lifespans.AuthorizeCode) +} + +func TestConfig_GetTokenEntropy(t *testing.T) { + ctx := context.Background() + + config := &oidc.Config{} + + assert.Equal(t, 0, config.TokenEntropy) + assert.Equal(t, 32, config.GetTokenEntropy(ctx)) + assert.Equal(t, 32, config.TokenEntropy) +} + +func TestConfig_Misc(t *testing.T) { + ctx := context.Background() + + config := &oidc.Config{} + + assert.False(t, config.DisableRefreshTokenValidation) + assert.False(t, config.GetDisableRefreshTokenValidation(ctx)) + + assert.Equal(t, "", config.Issuers.AccessToken) + assert.Equal(t, "", config.GetAccessTokenIssuer(ctx)) + + assert.Equal(t, "", config.Issuers.IDToken) + assert.Equal(t, "", config.GetIDTokenIssuer(ctx)) + + assert.Equal(t, jwt.JWTScopeFieldUnset, config.JWTScopeField) + assert.Equal(t, jwt.JWTScopeFieldList, config.GetJWTScopeField(ctx)) + assert.Equal(t, jwt.JWTScopeFieldList, config.JWTScopeField) + + assert.Equal(t, []string(nil), config.SanitationWhiteList) + assert.Equal(t, []string(nil), config.GetSanitationWhiteList(ctx)) + assert.Equal(t, []string(nil), config.SanitationWhiteList) + + assert.False(t, config.OmitRedirectScopeParameter) + assert.False(t, config.GetOmitRedirectScopeParam(ctx)) + + assert.NotNil(t, config.GetRedirectSecureChecker(ctx)) + assert.NotNil(t, config.GetHTTPClient(ctx)) + + assert.Nil(t, config.Strategy.Scope) + assert.NotNil(t, config.GetScopeStrategy(ctx)) + assert.NotNil(t, config.Strategy.Scope) + + assert.Nil(t, config.Strategy.Audience) + assert.NotNil(t, config.GetAudienceStrategy(ctx)) + assert.NotNil(t, config.Strategy.Audience) + + assert.Equal(t, []string(nil), config.RefreshTokenScopes) + assert.Equal(t, []string{oidc.ScopeOffline, oidc.ScopeOfflineAccess}, config.GetRefreshTokenScopes(ctx)) + assert.Equal(t, []string{oidc.ScopeOffline, oidc.ScopeOfflineAccess}, config.RefreshTokenScopes) + + assert.Equal(t, 0, config.MinParameterEntropy) + assert.Equal(t, 8, config.GetMinParameterEntropy(ctx)) + assert.Equal(t, 8, config.MinParameterEntropy) + + assert.False(t, config.SendDebugMessagesToClients) + assert.False(t, config.GetSendDebugMessagesToClients(ctx)) + + config.SendDebugMessagesToClients = true + + assert.True(t, config.GetSendDebugMessagesToClients(ctx)) + + assert.Nil(t, config.Strategy.JWKSFetcher) + assert.NotNil(t, config.GetJWKSFetcherStrategy(ctx)) + assert.NotNil(t, config.Strategy.JWKSFetcher) + + assert.Nil(t, config.Strategy.ClientAuthentication) + assert.Nil(t, config.GetClientAuthenticationStrategy(ctx)) + + assert.Nil(t, config.MessageCatalog) + assert.Nil(t, config.GetMessageCatalog(ctx)) + + assert.Nil(t, config.Templates) + assert.Nil(t, config.GetFormPostHTMLTemplate(ctx)) + + var err error + + config.Templates, err = templates.New(templates.Config{}) + require.NoError(t, err) + + assert.NotNil(t, config.GetFormPostHTMLTemplate(ctx)) + assert.NotNil(t, config.Templates) + + assert.False(t, config.GetUseLegacyErrorFormat(ctx)) + + assert.Nil(t, config.GetAuthorizeEndpointHandlers(ctx)) + assert.Nil(t, config.GetTokenEndpointHandlers(ctx)) + assert.Nil(t, config.GetTokenIntrospectionHandlers(ctx)) + assert.Nil(t, config.GetRevocationHandlers(ctx)) + assert.Nil(t, config.GetPushedAuthorizeEndpointHandlers(ctx)) + assert.Nil(t, config.GetResponseModeHandlerExtension(ctx)) + + assert.Equal(t, "", config.GetTokenURL(ctx)) + + octx := &MockOpenIDConnectContext{ + Context: ctx, + IssuerURLFunc: func() (issuerURL *url.URL, err error) { + return nil, fmt.Errorf("test error") + }, + } + + assert.Equal(t, "", config.GetTokenURL(octx)) +} + +func TestConfig_PAR(t *testing.T) { + ctx := context.Background() + + config := &oidc.Config{} + + assert.Equal(t, "", config.PAR.URIPrefix) + assert.Equal(t, "urn:ietf:params:oauth:request_uri:", config.GetPushedAuthorizeRequestURIPrefix(ctx)) + assert.Equal(t, "urn:ietf:params:oauth:request_uri:", config.PAR.URIPrefix) + + assert.False(t, config.PAR.Enforced) + assert.False(t, config.EnforcePushedAuthorize(ctx)) + assert.False(t, config.PAR.Enforced) + + config.PAR.Enforced = true + + assert.True(t, config.EnforcePushedAuthorize(ctx)) + + assert.Equal(t, time.Duration(0), config.PAR.ContextLifespan) + assert.Equal(t, time.Minute*5, config.GetPushedAuthorizeContextLifespan(ctx)) + assert.Equal(t, time.Minute*5, config.PAR.ContextLifespan) +} diff --git a/internal/oidc/const.go b/internal/oidc/const.go index 2143236af..911ce4175 100644 --- a/internal/oidc/const.go +++ b/internal/oidc/const.go @@ -53,7 +53,7 @@ const ( ) const ( - urnPARPrefix = "urn:ietf:params:oauth:request_uri:" + RedirectURIPrefixPushedAuthorizationRequestURN = "urn:ietf:params:oauth:request_uri:" ) const ( @@ -175,9 +175,9 @@ const ( tokenPrefixOrgAutheliaFmt = "authelia_%s_" //nolint:gosec tokenPrefixOrgOryFmt = "ory_%s_" //nolint:gosec - tokenPrefixPartAccessToken = "at" - tokenPrefixPartRefreshToken = "rt" - tokenPrefixPartAuthorizeCode = "ac" + TokenPrefixPartAccessToken = "at" + TokenPrefixPartRefreshToken = "rt" + TokenPrefixPartAuthorizeCode = "ac" ) // Paths. diff --git a/internal/oidc/const_test.go b/internal/oidc/const_test.go index 73441b964..a99279abb 100644 --- a/internal/oidc/const_test.go +++ b/internal/oidc/const_test.go @@ -1,8 +1,7 @@ -package oidc +package oidc_test import ( "crypto/ecdsa" - "crypto/ed25519" "crypto/rsa" "crypto/x509" "fmt" @@ -10,20 +9,26 @@ import ( "os" "strings" + "github.com/ory/fosite" + "github.com/authelia/authelia/v4/internal/configuration/schema" "github.com/authelia/authelia/v4/internal/utils" ) const ( - pathCrypto = "../configuration/test_resources/crypto/%s.%s" - myclient = "myclient" - myclientdesc = "My Client" - onefactor = "one_factor" - twofactor = "two_factor" - examplecom = "https://example.com" - examplecomsid = "example.com" - badsecret = "$plaintext$a_bad_secret" - badhmac = "asbdhaaskmdlkamdklasmdlkams" + pathCrypto = "../configuration/test_resources/crypto/%s.%s" + myclient = "myclient" + myclientdesc = "My Client" + onefactor = "one_factor" + twofactor = "two_factor" + examplecom = "https://example.com" + examplecomsid = "example.com" + badhmac = "asbdhaaskmdlkamdklasmdlkams" + badTokenString = "badTokenString" +) + +const ( + rs256 = "rs256" ) func MustDecodeSecret(value string) *schema.PasswordDigest { @@ -78,28 +83,6 @@ func MustLoadCertificateChain(alg, op string) schema.X509CertificateChain { } } -func MustLoadCertificate(alg, op string) *x509.Certificate { - decoded := MustLoadCrypto(alg, op, "crt") - - cert, ok := decoded.(*x509.Certificate) - if !ok { - panic(fmt.Errorf("the key was not a *x509.Certificate, it's a %T", cert)) - } - - return cert -} - -func MustLoadEd15519PrivateKey(curve string, extra ...string) ed25519.PrivateKey { - decoded := MustLoadCrypto("ED25519", curve, "pem", extra...) - - key, ok := decoded.(ed25519.PrivateKey) - if !ok { - panic(fmt.Errorf("the key was not a ed25519.PrivateKey, it's a %T", key)) - } - - return key -} - func MustLoadECDSAPrivateKey(curve string, extra ...string) *ecdsa.PrivateKey { decoded := MustLoadCrypto("ECDSA", curve, "pem", extra...) @@ -133,6 +116,24 @@ func MustLoadRSAPrivateKey(bits string, extra ...string) *rsa.PrivateKey { return key } +type RFC6749ErrorTest struct { + *fosite.RFC6749Error +} + +func (err *RFC6749ErrorTest) Error() string { + return err.WithExposeDebug(true).GetDescription() +} + +func ErrorToRFC6749ErrorTest(err error) (rfc error) { + if err == nil { + return nil + } + + ferr := fosite.ErrorToRFC6749Error(err) + + return &RFC6749ErrorTest{ferr} +} + var ( tOpenIDConnectPBKDF2ClientSecret, tOpenIDConnectPlainTextClientSecret *schema.PasswordDigest @@ -146,8 +147,8 @@ var ( ) func init() { - tOpenIDConnectPBKDF2ClientSecret = MustDecodeSecret("$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng") - tOpenIDConnectPlainTextClientSecret = MustDecodeSecret("$plaintext$example") + tOpenIDConnectPBKDF2ClientSecret = MustDecodeSecret("$pbkdf2-sha512$100000$cfNEo93VkIUIvaXHqetFoQ$O6qFLAlwCMz6.hv9XqUEPnMtrFxODw70T7bmnfTzfNPi3iXbgUEmGiyA6msybOfmj7m3QJS6lLy4DglgJifkKw") + tOpenIDConnectPlainTextClientSecret = MustDecodeSecret("$plaintext$client-secret") keyRSA1024 = MustLoadRSAPrivateKey("1024") keyRSA2048 = MustLoadRSAPrivateKey("2048") diff --git a/internal/oidc/core_strategy_hmac.go b/internal/oidc/core_strategy_hmac.go index 47d52da7a..2ad0f0a3e 100644 --- a/internal/oidc/core_strategy_hmac.go +++ b/internal/oidc/core_strategy_hmac.go @@ -22,22 +22,21 @@ type HMACCoreStrategy struct { } // AccessTokenSignature implements oauth2.AccessTokenStrategy. -func (h *HMACCoreStrategy) AccessTokenSignature(ctx context.Context, token string) string { - return h.Enigma.Signature(token) +func (h *HMACCoreStrategy) AccessTokenSignature(ctx context.Context, tokenString string) string { + return h.Enigma.Signature(tokenString) } // GenerateAccessToken implements oauth2.AccessTokenStrategy. -func (h *HMACCoreStrategy) GenerateAccessToken(ctx context.Context, _ fosite.Requester) (token string, signature string, err error) { - token, sig, err := h.Enigma.Generate(ctx) - if err != nil { +func (h *HMACCoreStrategy) GenerateAccessToken(ctx context.Context, _ fosite.Requester) (tokenString string, sig string, err error) { + if tokenString, sig, err = h.Enigma.Generate(ctx); err != nil { return "", "", err } - return h.setPrefix(token, tokenPrefixPartAccessToken), sig, nil + return h.setPrefix(tokenString, TokenPrefixPartAccessToken), sig, nil } // ValidateAccessToken implements oauth2.AccessTokenStrategy. -func (h *HMACCoreStrategy) ValidateAccessToken(ctx context.Context, r fosite.Requester, token string) (err error) { +func (h *HMACCoreStrategy) ValidateAccessToken(ctx context.Context, r fosite.Requester, tokenString string) (err error) { var exp = r.GetSession().GetExpiresAt(fosite.AccessToken) if exp.IsZero() && r.GetRequestedAt().Add(h.Config.GetAccessTokenLifespan(ctx)).Before(time.Now().UTC()) { return errorsx.WithStack(fosite.ErrTokenExpired.WithHintf("Access token expired at '%s'.", r.GetRequestedAt().Add(h.Config.GetAccessTokenLifespan(ctx)))) @@ -47,37 +46,36 @@ func (h *HMACCoreStrategy) ValidateAccessToken(ctx context.Context, r fosite.Req return errorsx.WithStack(fosite.ErrTokenExpired.WithHintf("Access token expired at '%s'.", exp)) } - return h.Enigma.Validate(ctx, h.trimPrefix(token, tokenPrefixPartAccessToken)) + return h.Enigma.Validate(ctx, h.trimPrefix(tokenString, TokenPrefixPartAccessToken)) } // RefreshTokenSignature implements oauth2.RefreshTokenStrategy. -func (h *HMACCoreStrategy) RefreshTokenSignature(ctx context.Context, token string) string { - return h.Enigma.Signature(token) +func (h *HMACCoreStrategy) RefreshTokenSignature(ctx context.Context, tokenString string) string { + return h.Enigma.Signature(tokenString) } // GenerateRefreshToken implements oauth2.RefreshTokenStrategy. -func (h *HMACCoreStrategy) GenerateRefreshToken(ctx context.Context, _ fosite.Requester) (token string, signature string, err error) { - token, sig, err := h.Enigma.Generate(ctx) - if err != nil { +func (h *HMACCoreStrategy) GenerateRefreshToken(ctx context.Context, _ fosite.Requester) (tokenString string, sig string, err error) { + if tokenString, sig, err = h.Enigma.Generate(ctx); err != nil { return "", "", err } - return h.setPrefix(token, tokenPrefixPartRefreshToken), sig, nil + return h.setPrefix(tokenString, TokenPrefixPartRefreshToken), sig, nil } // ValidateRefreshToken implements oauth2.RefreshTokenStrategy. -func (h *HMACCoreStrategy) ValidateRefreshToken(ctx context.Context, r fosite.Requester, token string) (err error) { +func (h *HMACCoreStrategy) ValidateRefreshToken(ctx context.Context, r fosite.Requester, tokenString string) (err error) { var exp = r.GetSession().GetExpiresAt(fosite.RefreshToken) if exp.IsZero() { - return h.Enigma.Validate(ctx, h.trimPrefix(token, tokenPrefixPartRefreshToken)) + return h.Enigma.Validate(ctx, h.trimPrefix(tokenString, TokenPrefixPartRefreshToken)) } if exp.Before(time.Now().UTC()) { return errorsx.WithStack(fosite.ErrTokenExpired.WithHintf("Refresh token expired at '%s'.", exp)) } - return h.Enigma.Validate(ctx, h.trimPrefix(token, tokenPrefixPartRefreshToken)) + return h.Enigma.Validate(ctx, h.trimPrefix(tokenString, TokenPrefixPartRefreshToken)) } // AuthorizeCodeSignature implements oauth2.AuthorizeCodeStrategy. @@ -86,17 +84,16 @@ func (h *HMACCoreStrategy) AuthorizeCodeSignature(ctx context.Context, token str } // GenerateAuthorizeCode implements oauth2.AuthorizeCodeStrategy. -func (h *HMACCoreStrategy) GenerateAuthorizeCode(ctx context.Context, _ fosite.Requester) (token string, signature string, err error) { - token, sig, err := h.Enigma.Generate(ctx) - if err != nil { +func (h *HMACCoreStrategy) GenerateAuthorizeCode(ctx context.Context, _ fosite.Requester) (tokenString string, sig string, err error) { + if tokenString, sig, err = h.Enigma.Generate(ctx); err != nil { return "", "", err } - return h.setPrefix(token, tokenPrefixPartAuthorizeCode), sig, nil + return h.setPrefix(tokenString, TokenPrefixPartAuthorizeCode), sig, nil } // ValidateAuthorizeCode implements oauth2.AuthorizeCodeStrategy. -func (h *HMACCoreStrategy) ValidateAuthorizeCode(ctx context.Context, r fosite.Requester, token string) (err error) { +func (h *HMACCoreStrategy) ValidateAuthorizeCode(ctx context.Context, r fosite.Requester, tokenString string) (err error) { var exp = r.GetSession().GetExpiresAt(fosite.AuthorizeCode) if exp.IsZero() && r.GetRequestedAt().Add(h.Config.GetAuthorizeCodeLifespan(ctx)).Before(time.Now().UTC()) { @@ -107,7 +104,7 @@ func (h *HMACCoreStrategy) ValidateAuthorizeCode(ctx context.Context, r fosite.R return errorsx.WithStack(fosite.ErrTokenExpired.WithHintf("Authorize code expired at '%s'.", exp)) } - return h.Enigma.Validate(ctx, h.trimPrefix(token, tokenPrefixPartAuthorizeCode)) + return h.Enigma.Validate(ctx, h.trimPrefix(tokenString, TokenPrefixPartAuthorizeCode)) } func (h *HMACCoreStrategy) getPrefix(part string) string { @@ -118,14 +115,14 @@ func (h *HMACCoreStrategy) getCustomPrefix(tokenPrefixFmt, part string) string { return fmt.Sprintf(tokenPrefixFmt, part) } -func (h *HMACCoreStrategy) setPrefix(token, part string) string { - return h.getPrefix(part) + token +func (h *HMACCoreStrategy) setPrefix(tokenString, part string) string { + return h.getPrefix(part) + tokenString } -func (h *HMACCoreStrategy) trimPrefix(token, part string) string { - if strings.HasPrefix(token, h.getCustomPrefix(tokenPrefixOrgOryFmt, part)) { - return strings.TrimPrefix(token, h.getCustomPrefix(tokenPrefixOrgOryFmt, part)) +func (h *HMACCoreStrategy) trimPrefix(tokenString, part string) string { + if strings.HasPrefix(tokenString, h.getCustomPrefix(tokenPrefixOrgOryFmt, part)) { + return strings.TrimPrefix(tokenString, h.getCustomPrefix(tokenPrefixOrgOryFmt, part)) } - return strings.TrimPrefix(token, h.getPrefix(part)) + return strings.TrimPrefix(tokenString, h.getPrefix(part)) } diff --git a/internal/oidc/core_strategy_hmac_test.go b/internal/oidc/core_strategy_hmac_blackbox_test.go similarity index 72% rename from internal/oidc/core_strategy_hmac_test.go rename to internal/oidc/core_strategy_hmac_blackbox_test.go index 57dc6a038..7e2b7df92 100644 --- a/internal/oidc/core_strategy_hmac_test.go +++ b/internal/oidc/core_strategy_hmac_blackbox_test.go @@ -1,33 +1,33 @@ -package oidc +package oidc_test import ( "context" - "fmt" "regexp" - "strings" "testing" "time" "github.com/ory/fosite" "github.com/ory/fosite/token/hmac" "github.com/stretchr/testify/assert" + + "github.com/authelia/authelia/v4/internal/oidc" ) func TestHMACStrategy(t *testing.T) { goodsecret := []byte("R7VCSUfnKc7Y5zE84q6GstYqfMGjL4wM") secreta := []byte("a") - config := &Config{ + config := &oidc.Config{ TokenEntropy: 10, GlobalSecret: secreta, - Lifespans: LifespanConfig{ + Lifespans: oidc.LifespanConfig{ AccessToken: time.Hour, RefreshToken: time.Hour, AuthorizeCode: time.Minute, }, } - strategy := &HMACCoreStrategy{ + strategy := &oidc.HMACCoreStrategy{ Enigma: &hmac.HMACStrategy{Config: config}, Config: config, } @@ -87,50 +87,3 @@ func TestHMACStrategy(t *testing.T) { assert.NoError(t, strategy.ValidateAccessToken(ctx, &fosite.Request{RequestedAt: time.Now().Add(time.Hour * -2400), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.AccessToken: time.Now().Add(100 * time.Hour)}}}, token)) assert.EqualError(t, strategy.ValidateAccessToken(ctx, &fosite.Request{RequestedAt: time.Now(), Session: &fosite.DefaultSession{ExpiresAt: map[fosite.TokenType]time.Time{fosite.AccessToken: time.Now().Add(-100 * time.Second)}}}, token), "invalid_token") } - -func TestHMACCoreStrategy_TrimPrefix(t *testing.T) { - testCases := []struct { - name string - have string - part string - expected string - }{ - {"ShouldTrimAutheliaPrefix", "authelia_at_example", tokenPrefixPartAccessToken, "example"}, - {"ShouldTrimOryPrefix", "ory_at_example", tokenPrefixPartAccessToken, "example"}, - {"ShouldTrimOnlyAutheliaPrefix", "authelia_at_ory_at_example", tokenPrefixPartAccessToken, "ory_at_example"}, - {"ShouldTrimOnlyOryPrefix", "ory_at_authelia_at_example", tokenPrefixPartAccessToken, "authelia_at_example"}, - {"ShouldNotTrimGitHubPrefix", "gh_at_example", tokenPrefixPartAccessToken, "gh_at_example"}, - } - - strategy := &HMACCoreStrategy{} - - for _, tc := range testCases { - t.Run(tc.name, func(t *testing.T) { - assert.Equal(t, tc.expected, strategy.trimPrefix(tc.have, tc.part)) - }) - } -} - -func TestHMACCoreStrategy_GetSetPrefix(t *testing.T) { - testCases := []struct { - name string - have string - expectedSet string - expectedGet string - }{ - {"ShouldAddPrefix", "example", "authelia_%s_example", "authelia_%s_"}, - } - - strategy := &HMACCoreStrategy{} - - for _, tc := range testCases { - t.Run(tc.name, func(t *testing.T) { - for _, part := range []string{tokenPrefixPartAccessToken, tokenPrefixPartAuthorizeCode, tokenPrefixPartRefreshToken} { - t.Run(strings.ToUpper(part), func(t *testing.T) { - assert.Equal(t, fmt.Sprintf(tc.expectedSet, part), strategy.setPrefix(tc.have, part)) - assert.Equal(t, fmt.Sprintf(tc.expectedGet, part), strategy.getPrefix(part)) - }) - } - }) - } -} diff --git a/internal/oidc/core_strategy_hmac_whitebox_test.go b/internal/oidc/core_strategy_hmac_whitebox_test.go new file mode 100644 index 000000000..261b22a8e --- /dev/null +++ b/internal/oidc/core_strategy_hmac_whitebox_test.go @@ -0,0 +1,56 @@ +package oidc + +import ( + "fmt" + "strings" + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestHMACCoreStrategy_TrimPrefix(t *testing.T) { + testCases := []struct { + name string + have string + part string + expected string + }{ + {"ShouldTrimAutheliaPrefix", "authelia_at_example", TokenPrefixPartAccessToken, "example"}, + {"ShouldTrimOryPrefix", "ory_at_example", TokenPrefixPartAccessToken, "example"}, + {"ShouldTrimOnlyAutheliaPrefix", "authelia_at_ory_at_example", TokenPrefixPartAccessToken, "ory_at_example"}, + {"ShouldTrimOnlyOryPrefix", "ory_at_authelia_at_example", TokenPrefixPartAccessToken, "authelia_at_example"}, + {"ShouldNotTrimGitHubPrefix", "gh_at_example", TokenPrefixPartAccessToken, "gh_at_example"}, + } + + strategy := &HMACCoreStrategy{} + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + assert.Equal(t, tc.expected, strategy.trimPrefix(tc.have, tc.part)) + }) + } +} + +func TestHMACCoreStrategy_GetSetPrefix(t *testing.T) { + testCases := []struct { + name string + have string + expectedSet string + expectedGet string + }{ + {"ShouldAddPrefix", "example", "authelia_%s_example", "authelia_%s_"}, + } + + strategy := &HMACCoreStrategy{} + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + for _, part := range []string{TokenPrefixPartAccessToken, TokenPrefixPartAuthorizeCode, TokenPrefixPartRefreshToken} { + t.Run(strings.ToUpper(part), func(t *testing.T) { + assert.Equal(t, fmt.Sprintf(tc.expectedSet, part), strategy.setPrefix(tc.have, part)) + assert.Equal(t, fmt.Sprintf(tc.expectedGet, part), strategy.getPrefix(part)) + }) + } + }) + } +} diff --git a/internal/oidc/discovery.go b/internal/oidc/discovery.go index 5410e36ad..919a5955a 100644 --- a/internal/oidc/discovery.go +++ b/internal/oidc/discovery.go @@ -66,6 +66,7 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration ClientAuthMethodClientSecretBasic, ClientAuthMethodClientSecretPost, ClientAuthMethodClientSecretJWT, + ClientAuthMethodPrivateKeyJWT, ClientAuthMethodNone, }, TokenEndpointAuthSigningAlgValuesSupported: []string{ @@ -82,6 +83,7 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration ClientAuthMethodClientSecretBasic, ClientAuthMethodClientSecretPost, ClientAuthMethodClientSecretJWT, + ClientAuthMethodPrivateKeyJWT, ClientAuthMethodNone, }, RevocationEndpointAuthSigningAlgValuesSupported: []string{ @@ -104,12 +106,12 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration SigningAlgRSAUsingSHA256, }, UserinfoSigningAlgValuesSupported: []string{ - SigningAlgNone, SigningAlgRSAUsingSHA256, + SigningAlgNone, }, RequestObjectSigningAlgValuesSupported: []string{ - SigningAlgNone, SigningAlgRSAUsingSHA256, + SigningAlgNone, }, }, OpenIDConnectFrontChannelLogoutDiscoveryOptions: &OpenIDConnectFrontChannelLogoutDiscoveryOptions{}, @@ -122,11 +124,7 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration }, } - algs := make([]string, len(c.Discovery.RegisteredJWKSigningAlgs)) - - copy(algs, c.Discovery.RegisteredJWKSigningAlgs) - - for _, alg := range algs { + for _, alg := range c.Discovery.ResponseObjectSigningAlgs { if !utils.IsStringInSlice(alg, config.IDTokenSigningAlgValuesSupported) { config.IDTokenSigningAlgValuesSupported = append(config.IDTokenSigningAlgValuesSupported, alg) } @@ -136,6 +134,20 @@ func NewOpenIDConnectWellKnownConfiguration(c *schema.OpenIDConnectConfiguration } } + for _, alg := range c.Discovery.RequestObjectSigningAlgs { + if !utils.IsStringInSlice(alg, config.RequestObjectSigningAlgValuesSupported) { + config.RequestObjectSigningAlgValuesSupported = append(config.RequestObjectSigningAlgValuesSupported, alg) + } + + if !utils.IsStringInSlice(alg, config.RevocationEndpointAuthSigningAlgValuesSupported) { + config.RevocationEndpointAuthSigningAlgValuesSupported = append(config.RevocationEndpointAuthSigningAlgValuesSupported, alg) + } + + if !utils.IsStringInSlice(alg, config.TokenEndpointAuthSigningAlgValuesSupported) { + config.TokenEndpointAuthSigningAlgValuesSupported = append(config.TokenEndpointAuthSigningAlgValuesSupported, alg) + } + } + sort.Sort(SortedSigningAlgs(config.IDTokenSigningAlgValuesSupported)) sort.Sort(SortedSigningAlgs(config.UserinfoSigningAlgValuesSupported)) sort.Sort(SortedSigningAlgs(config.RequestObjectSigningAlgValuesSupported)) diff --git a/internal/oidc/discovery_test.go b/internal/oidc/discovery_test.go index b3d880f84..e971f5ff6 100644 --- a/internal/oidc/discovery_test.go +++ b/internal/oidc/discovery_test.go @@ -1,11 +1,14 @@ -package oidc +package oidc_test import ( + "encoding/json" "testing" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/oidc" ) func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { @@ -13,91 +16,119 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { desc string pkcePlainChallenge bool enforcePAR bool - clients map[string]Client + clients map[string]oidc.Client discovery schema.OpenIDConnectDiscovery - expectCodeChallengeMethodsSupported, expectSubjectTypesSupported, expectedIDTokenSigAlgsSupported, expectedUserInfoSigAlgsSupported []string + expectCodeChallengeMethodsSupported, expectSubjectTypesSupported []string + expectedIDTokenSigAlgsSupported, expectedUserInfoSigAlgsSupported []string + + expectedRequestObjectSigAlgsSupported, expectedRevocationSigAlgsSupported, expectedTokenAuthSigAlgsSupported []string }{ { - desc: "ShouldHaveChallengeMethodsS256ANDSubjectTypesSupportedPublic", - pkcePlainChallenge: false, - clients: map[string]Client{"a": &BaseClient{}}, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + desc: "ShouldHaveChallengeMethodsS256ANDSubjectTypesSupportedPublic", + pkcePlainChallenge: false, + clients: map[string]oidc.Client{"a": &oidc.BaseClient{}}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, }, { - desc: "ShouldIncludDiscoveryInfo", + desc: "ShouldIncludeDiscoveryInfo", pkcePlainChallenge: false, - clients: map[string]Client{"a": &BaseClient{}}, + clients: map[string]oidc.Client{"a": &oidc.BaseClient{}}, discovery: schema.OpenIDConnectDiscovery{ - RegisteredJWKSigningAlgs: []string{SigningAlgECDSAUsingP521AndSHA512}, + ResponseObjectSigningAlgs: []string{oidc.SigningAlgECDSAUsingP521AndSHA512}, + RequestObjectSigningAlgs: []string{oidc.SigningAlgECDSAUsingP256AndSHA256}, }, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgECDSAUsingP521AndSHA512}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgECDSAUsingP521AndSHA512, SigningAlgNone}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgECDSAUsingP521AndSHA512}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgECDSAUsingP521AndSHA512, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512, oidc.SigningAlgECDSAUsingP256AndSHA256}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512, oidc.SigningAlgECDSAUsingP256AndSHA256}, }, { - desc: "ShouldHaveChallengeMethodsS256PlainANDSubjectTypesSupportedPublic", - pkcePlainChallenge: true, - clients: map[string]Client{"a": &BaseClient{}}, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + desc: "ShouldHaveChallengeMethodsS256PlainANDSubjectTypesSupportedPublic", + pkcePlainChallenge: true, + clients: map[string]oidc.Client{"a": &oidc.BaseClient{}}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256, oidc.PKCEChallengeMethodPlain}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, }, { - desc: "ShouldHaveChallengeMethodsS256ANDSubjectTypesSupportedPublicPairwise", - pkcePlainChallenge: false, - clients: map[string]Client{"a": &BaseClient{SectorIdentifier: "yes"}}, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + desc: "ShouldHaveChallengeMethodsS256ANDSubjectTypesSupportedPublicPairwise", + pkcePlainChallenge: false, + clients: map[string]oidc.Client{"a": &oidc.BaseClient{SectorIdentifier: "yes"}}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, }, { - desc: "ShouldHaveChallengeMethodsS256PlainANDSubjectTypesSupportedPublicPairwise", - pkcePlainChallenge: true, - clients: map[string]Client{"a": &BaseClient{SectorIdentifier: "yes"}}, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + desc: "ShouldHaveChallengeMethodsS256PlainANDSubjectTypesSupportedPublicPairwise", + pkcePlainChallenge: true, + clients: map[string]oidc.Client{"a": &oidc.BaseClient{SectorIdentifier: "yes"}}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256, oidc.PKCEChallengeMethodPlain}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, }, { - desc: "ShouldHaveTokenAuthMethodsNone", - pkcePlainChallenge: true, - clients: map[string]Client{"a": &BaseClient{SectorIdentifier: "yes"}}, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + desc: "ShouldHaveTokenAuthMethodsNone", + pkcePlainChallenge: true, + clients: map[string]oidc.Client{"a": &oidc.BaseClient{SectorIdentifier: "yes"}}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256, oidc.PKCEChallengeMethodPlain}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, }, { desc: "ShouldHaveTokenAuthMethodsNone", pkcePlainChallenge: true, - clients: map[string]Client{ - "a": &BaseClient{SectorIdentifier: "yes"}, - "b": &BaseClient{SectorIdentifier: "yes"}, + clients: map[string]oidc.Client{ + "a": &oidc.BaseClient{SectorIdentifier: "yes"}, + "b": &oidc.BaseClient{SectorIdentifier: "yes"}, }, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256, oidc.PKCEChallengeMethodPlain}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, }, { desc: "ShouldHaveTokenAuthMethodsNone", pkcePlainChallenge: true, - clients: map[string]Client{ - "a": &BaseClient{SectorIdentifier: "yes"}, - "b": &BaseClient{SectorIdentifier: "yes"}, + clients: map[string]oidc.Client{ + "a": &oidc.BaseClient{SectorIdentifier: "yes"}, + "b": &oidc.BaseClient{SectorIdentifier: "yes"}, }, - expectCodeChallengeMethodsSupported: []string{PKCEChallengeMethodSHA256, PKCEChallengeMethodPlain}, - expectSubjectTypesSupported: []string{SubjectTypePublic, SubjectTypePairwise}, - expectedIDTokenSigAlgsSupported: []string{SigningAlgRSAUsingSHA256}, - expectedUserInfoSigAlgsSupported: []string{SigningAlgRSAUsingSHA256, SigningAlgNone}, + expectCodeChallengeMethodsSupported: []string{oidc.PKCEChallengeMethodSHA256, oidc.PKCEChallengeMethodPlain}, + expectSubjectTypesSupported: []string{oidc.SubjectTypePublic, oidc.SubjectTypePairwise}, + expectedIDTokenSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256}, + expectedUserInfoSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRequestObjectSigAlgsSupported: []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgNone}, + expectedRevocationSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, + expectedTokenAuthSigAlgsSupported: []string{oidc.SigningAlgHMACUsingSHA256, oidc.SigningAlgHMACUsingSHA384, oidc.SigningAlgHMACUsingSHA512}, }, } @@ -111,7 +142,7 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { Discovery: tc.discovery, } - actual := NewOpenIDConnectWellKnownConfiguration(&c) + actual := oidc.NewOpenIDConnectWellKnownConfiguration(&c) for _, codeChallengeMethod := range tc.expectCodeChallengeMethodsSupported { assert.Contains(t, actual.CodeChallengeMethodsSupported, codeChallengeMethod) } @@ -130,6 +161,425 @@ func TestNewOpenIDConnectWellKnownConfiguration(t *testing.T) { assert.Equal(t, tc.expectedUserInfoSigAlgsSupported, actual.UserinfoSigningAlgValuesSupported) assert.Equal(t, tc.expectedIDTokenSigAlgsSupported, actual.IDTokenSigningAlgValuesSupported) + assert.Equal(t, tc.expectedRequestObjectSigAlgsSupported, actual.RequestObjectSigningAlgValuesSupported) + assert.Equal(t, tc.expectedRevocationSigAlgsSupported, actual.RevocationEndpointAuthSigningAlgValuesSupported) + assert.Equal(t, tc.expectedTokenAuthSigAlgsSupported, actual.TokenEndpointAuthSigningAlgValuesSupported) }) } } + +func TestNewOpenIDConnectProviderDiscovery(t *testing.T) { + provider := oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + IssuerCertificateChain: schema.X509CertificateChain{}, + IssuerPrivateKey: keyRSA2048, + HMACSecret: "asbdhaaskmdlkamdklasmdlkams", + EnablePKCEPlainChallenge: true, + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "a-client", + Secret: tOpenIDConnectPlainTextClientSecret, + Policy: onefactor, + RedirectURIs: []string{ + "https://google.com", + }, + }, + }, + }, nil, nil) + + a := provider.GetOpenIDConnectWellKnownConfiguration("https://auth.example.com") + + data, err := json.Marshal(&a) + assert.NoError(t, err) + + b := oidc.OpenIDConnectWellKnownConfiguration{} + + assert.NoError(t, json.Unmarshal(data, &b)) + + assert.Equal(t, a, b) + + y := provider.GetOAuth2WellKnownConfiguration("https://auth.example.com") + + data, err = json.Marshal(&y) + assert.NoError(t, err) + + z := oidc.OAuth2WellKnownConfiguration{} + + assert.NoError(t, json.Unmarshal(data, &z)) + + assert.Equal(t, y, z) +} + +func TestNewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfiguration(t *testing.T) { + provider := oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + IssuerCertificateChain: schema.X509CertificateChain{}, + IssuerPrivateKey: keyRSA2048, + HMACSecret: "asbdhaaskmdlkamdklasmdlkams", + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "a-client", + Secret: tOpenIDConnectPlainTextClientSecret, + Policy: onefactor, + RedirectURIs: []string{ + "https://google.com", + }, + }, + }, + }, nil, nil) + + require.NotNil(t, provider) + + disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) + + assert.Equal(t, examplecom, disco.Issuer) + assert.Equal(t, "https://example.com/jwks.json", disco.JWKSURI) + assert.Equal(t, "https://example.com/api/oidc/authorization", disco.AuthorizationEndpoint) + assert.Equal(t, "https://example.com/api/oidc/token", disco.TokenEndpoint) + assert.Equal(t, "https://example.com/api/oidc/userinfo", disco.UserinfoEndpoint) + assert.Equal(t, "https://example.com/api/oidc/introspection", disco.IntrospectionEndpoint) + assert.Equal(t, "https://example.com/api/oidc/revocation", disco.RevocationEndpoint) + assert.Equal(t, "", disco.RegistrationEndpoint) + + assert.Len(t, disco.CodeChallengeMethodsSupported, 1) + assert.Contains(t, disco.CodeChallengeMethodsSupported, oidc.PKCEChallengeMethodSHA256) + + assert.Len(t, disco.ScopesSupported, 5) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeOpenID) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeOfflineAccess) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeProfile) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeGroups) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeEmail) + + assert.Len(t, disco.ResponseModesSupported, 3) + assert.Contains(t, disco.ResponseModesSupported, oidc.ResponseModeFormPost) + assert.Contains(t, disco.ResponseModesSupported, oidc.ResponseModeQuery) + assert.Contains(t, disco.ResponseModesSupported, oidc.ResponseModeFragment) + + assert.Len(t, disco.SubjectTypesSupported, 2) + assert.Contains(t, disco.SubjectTypesSupported, oidc.SubjectTypePublic) + assert.Contains(t, disco.SubjectTypesSupported, oidc.SubjectTypePairwise) + + assert.Len(t, disco.ResponseTypesSupported, 7) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeAuthorizationCodeFlow) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeImplicitFlowIDToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeImplicitFlowToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeImplicitFlowBoth) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeHybridFlowIDToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeHybridFlowToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeHybridFlowBoth) + + assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 5) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretBasic) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretPost) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretJWT) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodPrivateKeyJWT) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodNone) + + assert.Len(t, disco.RevocationEndpointAuthMethodsSupported, 5) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretBasic) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretPost) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretJWT) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, oidc.ClientAuthMethodPrivateKeyJWT) + assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, oidc.ClientAuthMethodNone) + + assert.Len(t, disco.IntrospectionEndpointAuthMethodsSupported, 2) + assert.Contains(t, disco.IntrospectionEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretBasic) + assert.Contains(t, disco.IntrospectionEndpointAuthMethodsSupported, oidc.ClientAuthMethodNone) + + assert.Len(t, disco.GrantTypesSupported, 3) + assert.Contains(t, disco.GrantTypesSupported, oidc.GrantTypeAuthorizationCode) + assert.Contains(t, disco.GrantTypesSupported, oidc.GrantTypeRefreshToken) + assert.Contains(t, disco.GrantTypesSupported, oidc.GrantTypeImplicit) + + assert.Len(t, disco.RevocationEndpointAuthSigningAlgValuesSupported, 3) + assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[0], oidc.SigningAlgHMACUsingSHA256) + assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[1], oidc.SigningAlgHMACUsingSHA384) + assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[2], oidc.SigningAlgHMACUsingSHA512) + + assert.Len(t, disco.TokenEndpointAuthSigningAlgValuesSupported, 3) + assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[0], oidc.SigningAlgHMACUsingSHA256) + assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[1], oidc.SigningAlgHMACUsingSHA384) + assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[2], oidc.SigningAlgHMACUsingSHA512) + + assert.Len(t, disco.IDTokenSigningAlgValuesSupported, 1) + assert.Contains(t, disco.IDTokenSigningAlgValuesSupported, oidc.SigningAlgRSAUsingSHA256) + + assert.Len(t, disco.UserinfoSigningAlgValuesSupported, 2) + assert.Equal(t, disco.UserinfoSigningAlgValuesSupported[0], oidc.SigningAlgRSAUsingSHA256) + assert.Equal(t, disco.UserinfoSigningAlgValuesSupported[1], oidc.SigningAlgNone) + + require.Len(t, disco.RequestObjectSigningAlgValuesSupported, 2) + assert.Equal(t, oidc.SigningAlgRSAUsingSHA256, disco.RequestObjectSigningAlgValuesSupported[0]) + assert.Equal(t, oidc.SigningAlgNone, disco.RequestObjectSigningAlgValuesSupported[1]) + + assert.Len(t, disco.ClaimsSupported, 18) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAuthenticationMethodsReference) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAudience) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAuthorizedParty) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimClientIdentifier) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimExpirationTime) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimIssuedAt) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimIssuer) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimJWTID) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimRequestedAt) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimSubject) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAuthenticationTime) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimNonce) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimPreferredEmail) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimEmailVerified) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimEmailAlts) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimGroups) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimPreferredUsername) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimFullName) + + assert.Len(t, disco.PromptValuesSupported, 2) + assert.Contains(t, disco.PromptValuesSupported, oidc.PromptConsent) + assert.Contains(t, disco.PromptValuesSupported, oidc.PromptNone) +} + +func TestNewOpenIDConnectProvider_GetOAuth2WellKnownConfiguration(t *testing.T) { + provider := oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + IssuerCertificateChain: schema.X509CertificateChain{}, + IssuerPrivateKey: keyRSA2048, + HMACSecret: "asbdhaaskmdlkamdklasmdlkams", + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "a-client", + Secret: tOpenIDConnectPlainTextClientSecret, + Policy: onefactor, + RedirectURIs: []string{ + "https://google.com", + }, + }, + }, + }, nil, nil) + + require.NotNil(t, provider) + + disco := provider.GetOAuth2WellKnownConfiguration(examplecom) + + assert.Equal(t, examplecom, disco.Issuer) + assert.Equal(t, "https://example.com/jwks.json", disco.JWKSURI) + assert.Equal(t, "https://example.com/api/oidc/authorization", disco.AuthorizationEndpoint) + assert.Equal(t, "https://example.com/api/oidc/token", disco.TokenEndpoint) + assert.Equal(t, "https://example.com/api/oidc/introspection", disco.IntrospectionEndpoint) + assert.Equal(t, "https://example.com/api/oidc/revocation", disco.RevocationEndpoint) + assert.Equal(t, "", disco.RegistrationEndpoint) + + require.Len(t, disco.CodeChallengeMethodsSupported, 1) + assert.Equal(t, "S256", disco.CodeChallengeMethodsSupported[0]) + + assert.Len(t, disco.ScopesSupported, 5) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeOpenID) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeOfflineAccess) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeProfile) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeGroups) + assert.Contains(t, disco.ScopesSupported, oidc.ScopeEmail) + + assert.Len(t, disco.ResponseModesSupported, 3) + assert.Contains(t, disco.ResponseModesSupported, oidc.ResponseModeFormPost) + assert.Contains(t, disco.ResponseModesSupported, oidc.ResponseModeQuery) + assert.Contains(t, disco.ResponseModesSupported, oidc.ResponseModeFragment) + + assert.Len(t, disco.SubjectTypesSupported, 2) + assert.Contains(t, disco.SubjectTypesSupported, oidc.SubjectTypePublic) + assert.Contains(t, disco.SubjectTypesSupported, oidc.SubjectTypePairwise) + + assert.Len(t, disco.ResponseTypesSupported, 7) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeAuthorizationCodeFlow) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeImplicitFlowIDToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeImplicitFlowToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeImplicitFlowBoth) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeHybridFlowIDToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeHybridFlowToken) + assert.Contains(t, disco.ResponseTypesSupported, oidc.ResponseTypeHybridFlowBoth) + + assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 5) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretBasic) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretPost) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodClientSecretJWT) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodPrivateKeyJWT) + assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, oidc.ClientAuthMethodNone) + + assert.Len(t, disco.GrantTypesSupported, 3) + assert.Contains(t, disco.GrantTypesSupported, oidc.GrantTypeAuthorizationCode) + assert.Contains(t, disco.GrantTypesSupported, oidc.GrantTypeRefreshToken) + assert.Contains(t, disco.GrantTypesSupported, oidc.GrantTypeImplicit) + + assert.Len(t, disco.ClaimsSupported, 18) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAuthenticationMethodsReference) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAudience) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAuthorizedParty) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimClientIdentifier) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimExpirationTime) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimIssuedAt) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimIssuer) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimJWTID) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimRequestedAt) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimSubject) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimAuthenticationTime) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimNonce) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimPreferredEmail) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimEmailVerified) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimEmailAlts) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimGroups) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimPreferredUsername) + assert.Contains(t, disco.ClaimsSupported, oidc.ClaimFullName) +} + +func TestNewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfigurationWithPlainPKCE(t *testing.T) { + provider := oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + IssuerCertificateChain: schema.X509CertificateChain{}, + IssuerPrivateKey: keyRSA2048, + HMACSecret: "asbdhaaskmdlkamdklasmdlkams", + EnablePKCEPlainChallenge: true, + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "a-client", + Secret: tOpenIDConnectPlainTextClientSecret, + Policy: onefactor, + RedirectURIs: []string{ + "https://google.com", + }, + }, + }, + }, nil, nil) + + require.NotNil(t, provider) + + disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) + + require.Len(t, disco.CodeChallengeMethodsSupported, 2) + assert.Equal(t, oidc.PKCEChallengeMethodSHA256, disco.CodeChallengeMethodsSupported[0]) + assert.Equal(t, oidc.PKCEChallengeMethodPlain, disco.CodeChallengeMethodsSupported[1]) +} + +func TestNewOpenIDConnectWellKnownConfiguration_Copy(t *testing.T) { + config := &oidc.OpenIDConnectWellKnownConfiguration{ + OAuth2WellKnownConfiguration: oidc.OAuth2WellKnownConfiguration{ + CommonDiscoveryOptions: oidc.CommonDiscoveryOptions{ + Issuer: "https://example.com", + JWKSURI: "https://example.com/jwks.json", + AuthorizationEndpoint: "", + TokenEndpoint: "", + SubjectTypesSupported: nil, + ResponseTypesSupported: nil, + GrantTypesSupported: nil, + ResponseModesSupported: nil, + ScopesSupported: nil, + ClaimsSupported: nil, + UILocalesSupported: nil, + TokenEndpointAuthMethodsSupported: nil, + TokenEndpointAuthSigningAlgValuesSupported: nil, + ServiceDocumentation: "", + OPPolicyURI: "", + OPTOSURI: "", + SignedMetadata: "", + }, + OAuth2DiscoveryOptions: oidc.OAuth2DiscoveryOptions{ + IntrospectionEndpoint: "", + RevocationEndpoint: "", + RegistrationEndpoint: "", + IntrospectionEndpointAuthMethodsSupported: nil, + RevocationEndpointAuthMethodsSupported: nil, + RevocationEndpointAuthSigningAlgValuesSupported: nil, + IntrospectionEndpointAuthSigningAlgValuesSupported: nil, + CodeChallengeMethodsSupported: nil, + }, + OAuth2DeviceAuthorizationGrantDiscoveryOptions: &oidc.OAuth2DeviceAuthorizationGrantDiscoveryOptions{ + DeviceAuthorizationEndpoint: "", + }, + OAuth2MutualTLSClientAuthenticationDiscoveryOptions: &oidc.OAuth2MutualTLSClientAuthenticationDiscoveryOptions{ + TLSClientCertificateBoundAccessTokens: false, + MutualTLSEndpointAliases: oidc.OAuth2MutualTLSClientAuthenticationAliasesDiscoveryOptions{ + AuthorizationEndpoint: "", + TokenEndpoint: "", + IntrospectionEndpoint: "", + RevocationEndpoint: "", + EndSessionEndpoint: "", + UserinfoEndpoint: "", + BackChannelAuthenticationEndpoint: "", + FederationRegistrationEndpoint: "", + PushedAuthorizationRequestEndpoint: "", + RegistrationEndpoint: "", + }, + }, + OAuth2IssuerIdentificationDiscoveryOptions: &oidc.OAuth2IssuerIdentificationDiscoveryOptions{ + AuthorizationResponseIssuerParameterSupported: false, + }, + OAuth2JWTIntrospectionResponseDiscoveryOptions: &oidc.OAuth2JWTIntrospectionResponseDiscoveryOptions{ + IntrospectionSigningAlgValuesSupported: nil, + IntrospectionEncryptionAlgValuesSupported: nil, + IntrospectionEncryptionEncValuesSupported: nil, + }, + OAuth2JWTSecuredAuthorizationRequestDiscoveryOptions: &oidc.OAuth2JWTSecuredAuthorizationRequestDiscoveryOptions{ + RequireSignedRequestObject: false, + }, + OAuth2PushedAuthorizationDiscoveryOptions: &oidc.OAuth2PushedAuthorizationDiscoveryOptions{ + PushedAuthorizationRequestEndpoint: "", + RequirePushedAuthorizationRequests: false, + }, + }, + OpenIDConnectDiscoveryOptions: oidc.OpenIDConnectDiscoveryOptions{ + UserinfoEndpoint: "", + IDTokenSigningAlgValuesSupported: nil, + UserinfoSigningAlgValuesSupported: nil, + RequestObjectSigningAlgValuesSupported: nil, + IDTokenEncryptionAlgValuesSupported: nil, + UserinfoEncryptionAlgValuesSupported: nil, + RequestObjectEncryptionAlgValuesSupported: nil, + IDTokenEncryptionEncValuesSupported: nil, + UserinfoEncryptionEncValuesSupported: nil, + RequestObjectEncryptionEncValuesSupported: nil, + ACRValuesSupported: nil, + DisplayValuesSupported: nil, + ClaimTypesSupported: nil, + ClaimLocalesSupported: nil, + RequestParameterSupported: false, + RequestURIParameterSupported: false, + RequireRequestURIRegistration: false, + ClaimsParameterSupported: false, + }, + OpenIDConnectFrontChannelLogoutDiscoveryOptions: &oidc.OpenIDConnectFrontChannelLogoutDiscoveryOptions{ + FrontChannelLogoutSupported: false, + FrontChannelLogoutSessionSupported: false, + }, + OpenIDConnectBackChannelLogoutDiscoveryOptions: &oidc.OpenIDConnectBackChannelLogoutDiscoveryOptions{ + BackChannelLogoutSupported: false, + BackChannelLogoutSessionSupported: false, + }, + OpenIDConnectSessionManagementDiscoveryOptions: &oidc.OpenIDConnectSessionManagementDiscoveryOptions{ + CheckSessionIFrame: "", + }, + OpenIDConnectRPInitiatedLogoutDiscoveryOptions: &oidc.OpenIDConnectRPInitiatedLogoutDiscoveryOptions{ + EndSessionEndpoint: "", + }, + OpenIDConnectPromptCreateDiscoveryOptions: &oidc.OpenIDConnectPromptCreateDiscoveryOptions{ + PromptValuesSupported: nil, + }, + OpenIDConnectClientInitiatedBackChannelAuthFlowDiscoveryOptions: &oidc.OpenIDConnectClientInitiatedBackChannelAuthFlowDiscoveryOptions{ + BackChannelAuthenticationEndpoint: "", + BackChannelTokenDeliveryModesSupported: nil, + BackChannelAuthRequestSigningAlgValuesSupported: nil, + BackChannelUserCodeParameterSupported: false, + }, + OpenIDConnectJWTSecuredAuthorizationResponseModeDiscoveryOptions: &oidc.OpenIDConnectJWTSecuredAuthorizationResponseModeDiscoveryOptions{ + AuthorizationSigningAlgValuesSupported: nil, + AuthorizationEncryptionAlgValuesSupported: nil, + AuthorizationEncryptionEncValuesSupported: nil, + }, + OpenIDFederationDiscoveryOptions: &oidc.OpenIDFederationDiscoveryOptions{ + FederationRegistrationEndpoint: "", + ClientRegistrationTypesSupported: nil, + RequestAuthenticationMethodsSupported: nil, + RequestAuthenticationSigningAlgValuesSupproted: nil, + }, + } + + x := config.Copy() + + assert.Equal(t, config, &x) + + y := config.OAuth2WellKnownConfiguration.Copy() + + assert.Equal(t, config.OAuth2WellKnownConfiguration, y) +} diff --git a/internal/oidc/hasher.go b/internal/oidc/hasher.go deleted file mode 100644 index 1714ec688..000000000 --- a/internal/oidc/hasher.go +++ /dev/null @@ -1,49 +0,0 @@ -package oidc - -import ( - "context" - - "github.com/go-crypt/crypt" - "github.com/go-crypt/crypt/algorithm" - "github.com/go-crypt/crypt/algorithm/plaintext" -) - -// NewHasher returns a new Hasher. -func NewHasher() (hasher *Hasher, err error) { - hasher = &Hasher{} - - if hasher.decoder, err = crypt.NewDefaultDecoder(); err != nil { - return nil, err - } - - if err = plaintext.RegisterDecoderPlainText(hasher.decoder); err != nil { - return nil, err - } - - return hasher, nil -} - -// Hasher implements the fosite.Hasher interface and adaptively compares hashes. -type Hasher struct { - decoder algorithm.DecoderRegister -} - -// Compare compares the hash with the data and returns an error if they don't match. -func (h Hasher) Compare(_ context.Context, hash, data []byte) (err error) { - var digest algorithm.Digest - - if digest, err = h.decoder.Decode(string(hash)); err != nil { - return err - } - - if digest.MatchBytes(data) { - return nil - } - - return errPasswordsDoNotMatch -} - -// Hash creates a new hash from data. -func (h Hasher) Hash(_ context.Context, data []byte) (hash []byte, err error) { - return data, nil -} diff --git a/internal/oidc/hasher_test.go b/internal/oidc/hasher_test.go deleted file mode 100644 index 7f757460b..000000000 --- a/internal/oidc/hasher_test.go +++ /dev/null @@ -1,61 +0,0 @@ -package oidc - -import ( - "context" - "testing" - - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" -) - -func TestShouldNotRaiseErrorOnEqualPasswordsPlainText(t *testing.T) { - hasher, err := NewHasher() - - require.NoError(t, err) - - a := []byte("$plaintext$abc") - b := []byte("abc") - - ctx := context.Background() - - assert.NoError(t, hasher.Compare(ctx, a, b)) -} - -func TestShouldNotRaiseErrorOnEqualPasswordsPlainTextWithSeparator(t *testing.T) { - hasher, err := NewHasher() - - require.NoError(t, err) - - a := []byte("$plaintext$abc$123") - b := []byte("abc$123") - - ctx := context.Background() - - assert.NoError(t, hasher.Compare(ctx, a, b)) -} - -func TestShouldRaiseErrorOnNonEqualPasswordsPlainText(t *testing.T) { - hasher, err := NewHasher() - - require.NoError(t, err) - - a := []byte("$plaintext$abc") - b := []byte("abcd") - - ctx := context.Background() - - assert.Equal(t, errPasswordsDoNotMatch, hasher.Compare(ctx, a, b)) -} - -func TestShouldHashPassword(t *testing.T) { - hasher := Hasher{} - - data := []byte("abc") - - ctx := context.Background() - - hash, err := hasher.Hash(ctx, data) - - assert.NoError(t, err) - assert.Equal(t, data, hash) -} diff --git a/internal/oidc/keys.go b/internal/oidc/keys.go index fa367fd41..51fe0dcdc 100644 --- a/internal/oidc/keys.go +++ b/internal/oidc/keys.go @@ -26,7 +26,7 @@ func NewKeyManager(config *schema.OpenIDConnectConfiguration) (manager *KeyManag algs: map[string]*JWK{}, } - for _, sjwk := range config.IssuerJWKS { + for _, sjwk := range config.IssuerPrivateKeys { jwk := NewJWK(sjwk) manager.kids[sjwk.KeyID] = jwk @@ -47,7 +47,13 @@ type KeyManager struct { algs map[string]*JWK } -func (m *KeyManager) GetKIDFromAlgStrict(ctx context.Context, alg string) (kid string, err error) { +// GetKeyID returns the default key id. +func (m *KeyManager) GetKeyID(ctx context.Context) string { + return m.kid +} + +// GetKeyIDFromAlgStrict returns the key id given an alg or an error if it doesn't exist. +func (m *KeyManager) GetKeyIDFromAlgStrict(ctx context.Context, alg string) (kid string, err error) { if jwks, ok := m.algs[alg]; ok { return jwks.kid, nil } @@ -55,7 +61,8 @@ func (m *KeyManager) GetKIDFromAlgStrict(ctx context.Context, alg string) (kid s return "", fmt.Errorf("alg not found") } -func (m *KeyManager) GetKIDFromAlg(ctx context.Context, alg string) string { +// GetKeyIDFromAlg returns the key id given an alg or the default if it doesn't exist. +func (m *KeyManager) GetKeyIDFromAlg(ctx context.Context, alg string) string { if jwks, ok := m.algs[alg]; ok { return jwks.kid } @@ -63,6 +70,7 @@ func (m *KeyManager) GetKIDFromAlg(ctx context.Context, alg string) string { return m.kid } +// GetByAlg returns the JWK given an alg or nil if it doesn't exist. func (m *KeyManager) GetByAlg(ctx context.Context, alg string) *JWK { if jwk, ok := m.algs[alg]; ok { return jwk @@ -71,6 +79,7 @@ func (m *KeyManager) GetByAlg(ctx context.Context, alg string) *JWK { return nil } +// GetByKID returns the JWK given an key id or nil if it doesn't exist. If given a blank string it returns the default. func (m *KeyManager) GetByKID(ctx context.Context, kid string) *JWK { if kid == "" { return m.kids[m.kid] @@ -83,6 +92,7 @@ func (m *KeyManager) GetByKID(ctx context.Context, kid string) *JWK { return nil } +// GetByHeader returns the JWK a JWT header with the appropriate kid value or returns an error. func (m *KeyManager) GetByHeader(ctx context.Context, header fjwt.Mapper) (jwk *JWK, err error) { var ( kid string @@ -104,6 +114,7 @@ func (m *KeyManager) GetByHeader(ctx context.Context, header fjwt.Mapper) (jwk * return jwk, nil } +// GetByTokenString does an invalidated decode of a token to get the header, then calls GetByHeader. func (m *KeyManager) GetByTokenString(ctx context.Context, tokenString string) (jwk *JWK, err error) { var ( token *jwt.Token @@ -116,6 +127,7 @@ func (m *KeyManager) GetByTokenString(ctx context.Context, tokenString string) ( return m.GetByHeader(ctx, &fjwt.Headers{Extra: token.Header}) } +// Set returns the *jose.JSONWebKeySet. func (m *KeyManager) Set(ctx context.Context) *jose.JSONWebKeySet { keys := make([]jose.JSONWebKey, 0, len(m.kids)) @@ -130,6 +142,7 @@ func (m *KeyManager) Set(ctx context.Context) *jose.JSONWebKeySet { } } +// Generate implements the fosite jwt.Signer interface and automatically maps the underlying keys based on the JWK Header kid. func (m *KeyManager) Generate(ctx context.Context, claims fjwt.MapClaims, header fjwt.Mapper) (tokenString string, sig string, err error) { var jwk *JWK @@ -140,6 +153,7 @@ func (m *KeyManager) Generate(ctx context.Context, claims fjwt.MapClaims, header return jwk.Strategy().Generate(ctx, claims, header) } +// Validate implements the fosite jwt.Signer interface and automatically maps the underlying keys based on the JWK Header kid. func (m *KeyManager) Validate(ctx context.Context, tokenString string) (sig string, err error) { var jwk *JWK @@ -150,10 +164,12 @@ func (m *KeyManager) Validate(ctx context.Context, tokenString string) (sig stri return jwk.Strategy().Validate(ctx, tokenString) } +// Hash implements the fosite jwt.Signer interface. func (m *KeyManager) Hash(ctx context.Context, in []byte) (sum []byte, err error) { return m.GetByKID(ctx, "").Strategy().Hash(ctx, in) } +// Decode implements the fosite jwt.Signer interface and automatically maps the underlying keys based on the JWK Header kid. func (m *KeyManager) Decode(ctx context.Context, tokenString string) (token *fjwt.Token, err error) { var jwk *JWK @@ -164,14 +180,58 @@ func (m *KeyManager) Decode(ctx context.Context, tokenString string) (token *fjw return jwk.Strategy().Decode(ctx, tokenString) } +// GetSignature implements the fosite jwt.Signer interface. func (m *KeyManager) GetSignature(ctx context.Context, tokenString string) (sig string, err error) { return getTokenSignature(tokenString) } +// GetSigningMethodLength implements the fosite jwt.Signer interface. func (m *KeyManager) GetSigningMethodLength(ctx context.Context) (size int) { return m.GetByKID(ctx, "").Strategy().GetSigningMethodLength(ctx) } +// NewPublicJSONWebKeySetFromSchemaJWK creates a *jose.JSONWebKeySet from a slice of schema.JWK. +func NewPublicJSONWebKeySetFromSchemaJWK(sjwks []schema.JWK) (jwks *jose.JSONWebKeySet) { + n := len(sjwks) + + if n == 0 { + return nil + } + + keys := make([]jose.JSONWebKey, n) + + for i := 0; i < n; i++ { + jwk := jose.JSONWebKey{ + KeyID: sjwks[i].KeyID, + Algorithm: sjwks[i].Algorithm, + Use: sjwks[i].Use, + Certificates: sjwks[i].CertificateChain.Certificates(), + } + + switch key := sjwks[i].Key.(type) { + case *rsa.PublicKey: + jwk.Key = key + case rsa.PublicKey: + jwk.Key = &key + case *rsa.PrivateKey: + jwk.Key = key.PublicKey + case *ecdsa.PublicKey: + jwk.Key = key + case ecdsa.PublicKey: + jwk.Key = &key + case *ecdsa.PrivateKey: + jwk.Key = key.PublicKey + } + + keys[i] = jwk + } + + return &jose.JSONWebKeySet{ + Keys: keys, + } +} + +// NewJWK creates a *JWK f rom a schema.JWK. func NewJWK(s schema.JWK) (jwk *JWK) { jwk = &JWK{ kid: s.KeyID, @@ -198,6 +258,7 @@ func NewJWK(s schema.JWK) (jwk *JWK) { return jwk } +// JWK is a representation layer over the *jose.JSONWebKey for convenience. type JWK struct { kid string use string @@ -210,16 +271,24 @@ type JWK struct { thumbprint []byte } +// GetSigningMethod returns the jwt.SigningMethod for this *JWK. +func (j *JWK) GetSigningMethod() jwt.SigningMethod { + return j.alg +} + +// GetPrivateKey returns the Private Key for this *JWK. func (j *JWK) GetPrivateKey(ctx context.Context) (any, error) { return j.PrivateJWK(), nil } +// KeyID returns the Key ID for this *JWK. func (j *JWK) KeyID() string { return j.kid } -func (j *JWK) PrivateJWK() (jwk *jose.JSONWebKey) { - return &jose.JSONWebKey{ +// DirectJWK directly returns the *JWK as a jose.JSONWebKey with the private key if appropriate. +func (j *JWK) DirectJWK() (jwk jose.JSONWebKey) { + return jose.JSONWebKey{ Key: j.key, KeyID: j.kid, Algorithm: j.alg.Alg(), @@ -230,10 +299,23 @@ func (j *JWK) PrivateJWK() (jwk *jose.JSONWebKey) { } } -func (j *JWK) JWK() (jwk jose.JSONWebKey) { - return j.PrivateJWK().Public() +// PrivateJWK directly returns the *JWK as a *jose.JSONWebKey with the private key if appropriate. +func (j *JWK) PrivateJWK() (jwk *jose.JSONWebKey) { + value := j.DirectJWK() + + return &value } +// JWK directly returns the *JWK as a jose.JSONWebKey specifically without the private key. +func (j *JWK) JWK() (jwk jose.JSONWebKey) { + if jwk = j.DirectJWK(); jwk.IsPublic() { + return jwk + } + + return jwk.Public() +} + +// Strategy returns the fosite jwt.Signer. func (j *JWK) Strategy() (strategy fjwt.Signer) { return &Signer{ hash: j.hash, @@ -250,6 +332,7 @@ type Signer struct { GetPrivateKey fjwt.GetPrivateKeyFunc } +// GetPublicKey returns the PublicKey for this Signer. func (j *Signer) GetPublicKey(ctx context.Context) (key crypto.PublicKey, err error) { var k any diff --git a/internal/oidc/keys_test.go b/internal/oidc/keys_blackbox_test.go similarity index 60% rename from internal/oidc/keys_test.go rename to internal/oidc/keys_blackbox_test.go index 70c86e418..5bbe43336 100644 --- a/internal/oidc/keys_test.go +++ b/internal/oidc/keys_blackbox_test.go @@ -1,7 +1,8 @@ -package oidc +package oidc_test import ( "context" + "crypto" "encoding/json" "fmt" "testing" @@ -12,6 +13,7 @@ import ( "gopkg.in/square/go-jose.v2" "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/oidc" ) func TestKeyManager(t *testing.T) { @@ -19,82 +21,82 @@ func TestKeyManager(t *testing.T) { Discovery: schema.OpenIDConnectDiscovery{ DefaultKeyID: "kid-RS256-sig", }, - IssuerJWKS: []schema.JWK{ + IssuerPrivateKeys: []schema.JWK{ { - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048, CertificateChain: certRSA2048, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA384, Key: keyRSA2048, CertificateChain: certRSA2048, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA512, Key: keyRSA4096, CertificateChain: certRSA4096, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, Key: keyRSA2048, CertificateChain: certRSA2048, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA384, Key: keyRSA2048, CertificateChain: certRSA2048, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA512, Key: keyRSA4096, CertificateChain: certRSA4096, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgECDSAUsingP256AndSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgECDSAUsingP256AndSHA256, Key: keyECDSAP256, CertificateChain: certECDSAP256, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgECDSAUsingP384AndSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgECDSAUsingP384AndSHA384, Key: keyECDSAP384, CertificateChain: certECDSAP384, }, { - Use: KeyUseSignature, - Algorithm: SigningAlgECDSAUsingP521AndSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgECDSAUsingP521AndSHA512, Key: keyECDSAP521, CertificateChain: certECDSAP521, }, }, } - for i, key := range config.IssuerJWKS { - config.IssuerJWKS[i].KeyID = fmt.Sprintf("kid-%s-%s", key.Algorithm, key.Use) + for i, key := range config.IssuerPrivateKeys { + config.IssuerPrivateKeys[i].KeyID = fmt.Sprintf("kid-%s-%s", key.Algorithm, key.Use) } - manager := NewKeyManager(config) + manager := oidc.NewKeyManager(config) assert.NotNil(t, manager) - assert.Len(t, manager.kids, len(config.IssuerJWKS)) - assert.Len(t, manager.algs, len(config.IssuerJWKS)) - - assert.Equal(t, "kid-RS256-sig", manager.kid) - ctx := context.Background() + assert.Equal(t, "kid-RS256-sig", manager.GetKeyID(ctx)) + var ( - jwk *JWK - err error + jwk *oidc.JWK + tokenString, sig string + sum []byte + token *fjwt.Token + err error ) jwk = manager.GetByAlg(ctx, "notalg") @@ -107,7 +109,7 @@ func TestKeyManager(t *testing.T) { assert.NotNil(t, jwk) assert.Equal(t, config.Discovery.DefaultKeyID, jwk.KeyID()) - jwk, err = manager.GetByHeader(ctx, &fjwt.Headers{Extra: map[string]any{JWTHeaderKeyIdentifier: "notalg"}}) + jwk, err = manager.GetByHeader(ctx, &fjwt.Headers{Extra: map[string]any{oidc.JWTHeaderKeyIdentifier: "notalg"}}) assert.EqualError(t, err, "jwt header 'kid' with value 'notalg' does not match a managed jwk") assert.Nil(t, jwk) @@ -119,17 +121,17 @@ func TestKeyManager(t *testing.T) { assert.EqualError(t, err, "jwt header was nil") assert.Nil(t, jwk) - kid, err := manager.GetKIDFromAlgStrict(ctx, "notalg") + kid, err := manager.GetKeyIDFromAlgStrict(ctx, "notalg") assert.EqualError(t, err, "alg not found") assert.Equal(t, "", kid) - kid = manager.GetKIDFromAlg(ctx, "notalg") + kid = manager.GetKeyIDFromAlg(ctx, "notalg") assert.Equal(t, config.Discovery.DefaultKeyID, kid) set := manager.Set(ctx) assert.NotNil(t, set) - assert.Len(t, set.Keys, len(config.IssuerJWKS)) + assert.Len(t, set.Keys, len(config.IssuerPrivateKeys)) data, err := json.Marshal(&set) assert.NoError(t, err) @@ -139,9 +141,32 @@ func TestKeyManager(t *testing.T) { assert.NoError(t, json.Unmarshal(data, &out)) assert.Equal(t, *set, out) - for _, alg := range []string{SigningAlgRSAUsingSHA256, SigningAlgRSAUsingSHA384, SigningAlgRSAPSSUsingSHA512, SigningAlgRSAPSSUsingSHA256, SigningAlgRSAPSSUsingSHA384, SigningAlgRSAPSSUsingSHA512, SigningAlgECDSAUsingP256AndSHA256, SigningAlgECDSAUsingP384AndSHA384, SigningAlgECDSAUsingP521AndSHA512} { + jwk, err = manager.GetByTokenString(ctx, badTokenString) + assert.EqualError(t, err, "token contains an invalid number of segments") + assert.Nil(t, jwk) + + tokenString, sig, err = manager.Generate(ctx, nil, nil) + assert.EqualError(t, err, "error getting jwk from header: jwt header was nil") + assert.Equal(t, "", tokenString) + assert.Equal(t, "", sig) + + sig, err = manager.Validate(ctx, badTokenString) + assert.EqualError(t, err, "error getting jwk from token string: token contains an invalid number of segments") + assert.Equal(t, "", sig) + + token, err = manager.Decode(ctx, badTokenString) + assert.EqualError(t, err, "error getting jwk from token string: token contains an invalid number of segments") + assert.Nil(t, token) + + sum, err = manager.Hash(ctx, []byte("abc")) + assert.NoError(t, err) + assert.Equal(t, "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", fmt.Sprintf("%x", sum)) + + assert.Equal(t, crypto.SHA256.Size(), manager.GetSigningMethodLength(ctx)) + + for _, alg := range []string{oidc.SigningAlgRSAUsingSHA256, oidc.SigningAlgRSAUsingSHA384, oidc.SigningAlgRSAPSSUsingSHA512, oidc.SigningAlgRSAPSSUsingSHA256, oidc.SigningAlgRSAPSSUsingSHA384, oidc.SigningAlgRSAPSSUsingSHA512, oidc.SigningAlgECDSAUsingP256AndSHA256, oidc.SigningAlgECDSAUsingP384AndSHA384, oidc.SigningAlgECDSAUsingP521AndSHA512} { t.Run(alg, func(t *testing.T) { - expectedKID := fmt.Sprintf("kid-%s-%s", alg, KeyUseSignature) + expectedKID := fmt.Sprintf("kid-%s-%s", alg, oidc.KeyUseSignature) t.Run("ShouldGetCorrectKey", func(t *testing.T) { jwk = manager.GetByKID(ctx, expectedKID) @@ -151,17 +176,17 @@ func TestKeyManager(t *testing.T) { jwk = manager.GetByAlg(ctx, alg) assert.NotNil(t, jwk) - assert.Equal(t, alg, jwk.alg.Alg()) + assert.Equal(t, alg, jwk.GetSigningMethod().Alg()) assert.Equal(t, expectedKID, jwk.KeyID()) - kid, err = manager.GetKIDFromAlgStrict(ctx, alg) + kid, err = manager.GetKeyIDFromAlgStrict(ctx, alg) assert.NoError(t, err) assert.Equal(t, expectedKID, kid) - kid = manager.GetKIDFromAlg(ctx, alg) + kid = manager.GetKeyIDFromAlg(ctx, alg) assert.Equal(t, expectedKID, kid) - jwk, err = manager.GetByHeader(ctx, &fjwt.Headers{Extra: map[string]any{JWTHeaderKeyIdentifier: expectedKID}}) + jwk, err = manager.GetByHeader(ctx, &fjwt.Headers{Extra: map[string]any{oidc.JWTHeaderKeyIdentifier: expectedKID}}) assert.NoError(t, err) assert.NotNil(t, jwk) @@ -169,10 +194,9 @@ func TestKeyManager(t *testing.T) { }) t.Run("ShouldUseCorrectSigner", func(t *testing.T) { - var tokenString, sig, sigb string - var token *fjwt.Token + var sigb string - tokenString, sig, err = manager.Generate(ctx, fjwt.MapClaims{}, &fjwt.Headers{Extra: map[string]any{JWTHeaderKeyIdentifier: expectedKID}}) + tokenString, sig, err = manager.Generate(ctx, fjwt.MapClaims{}, &fjwt.Headers{Extra: map[string]any{oidc.JWTHeaderKeyIdentifier: expectedKID}}) assert.NoError(t, err) sigb, err = manager.GetSignature(ctx, tokenString) @@ -185,10 +209,9 @@ func TestKeyManager(t *testing.T) { token, err = manager.Decode(ctx, tokenString) assert.NoError(t, err) - assert.Equal(t, expectedKID, token.Header[JWTHeaderKeyIdentifier]) + assert.Equal(t, expectedKID, token.Header[oidc.JWTHeaderKeyIdentifier]) jwk, err = manager.GetByTokenString(ctx, tokenString) - assert.NoError(t, err) sigb, err = jwk.Strategy().Validate(ctx, tokenString) @@ -206,8 +229,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa2048-rs256", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA2048, CertificateChain: certRSA2048, }, @@ -215,8 +238,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa2048-rs384", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA384, Key: keyRSA2048, CertificateChain: certRSA2048, }, @@ -224,8 +247,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa2048-rs512", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA512, Key: keyRSA2048, CertificateChain: certRSA2048, }, @@ -233,8 +256,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa4096-rs256", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA256, Key: keyRSA4096, CertificateChain: certRSA4096, }, @@ -242,8 +265,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa4096-rs384", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA384, Key: keyRSA4096, CertificateChain: certRSA4096, }, @@ -251,8 +274,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa4096-rs512", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAUsingSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAUsingSHA512, Key: keyRSA4096, CertificateChain: certRSA4096, }, @@ -260,8 +283,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa2048-rs256", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, Key: keyRSA2048, CertificateChain: certRSA2048, }, @@ -269,8 +292,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa2048-ps384", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA384, Key: keyRSA2048, CertificateChain: certRSA2048, }, @@ -278,8 +301,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa2048-ps512", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA512, Key: keyRSA2048, CertificateChain: certRSA2048, }, @@ -287,8 +310,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa4096-ps256", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA256, Key: keyRSA4096, CertificateChain: certRSA4096, }, @@ -296,8 +319,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa4096-ps384", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA384, Key: keyRSA4096, CertificateChain: certRSA4096, }, @@ -305,8 +328,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "rsa4096-ps512", - Use: KeyUseSignature, - Algorithm: SigningAlgRSAPSSUsingSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgRSAPSSUsingSHA512, Key: keyRSA4096, CertificateChain: certRSA4096, }, @@ -314,8 +337,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "ecdsaP256", - Use: KeyUseSignature, - Algorithm: SigningAlgECDSAUsingP256AndSHA256, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgECDSAUsingP256AndSHA256, Key: keyECDSAP256, CertificateChain: certECDSAP256, }, @@ -323,8 +346,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "ecdsaP384", - Use: KeyUseSignature, - Algorithm: SigningAlgECDSAUsingP384AndSHA384, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgECDSAUsingP384AndSHA384, Key: keyECDSAP384, CertificateChain: certECDSAP384, }, @@ -332,8 +355,8 @@ func TestJWKFunctionality(t *testing.T) { { schema.JWK{ KeyID: "ecdsaP521", - Use: KeyUseSignature, - Algorithm: SigningAlgECDSAUsingP521AndSHA512, + Use: oidc.KeyUseSignature, + Algorithm: oidc.SigningAlgECDSAUsingP521AndSHA512, Key: keyECDSAP521, CertificateChain: certECDSAP521, }, @@ -344,24 +367,28 @@ func TestJWKFunctionality(t *testing.T) { t.Run(tc.have.KeyID, func(t *testing.T) { t.Run("Generating", func(t *testing.T) { var ( - jwk *JWK + jwk *oidc.JWK ) ctx := context.Background() - jwk = NewJWK(tc.have) + jwk = oidc.NewJWK(tc.have) signer := jwk.Strategy() claims := fjwt.MapClaims{} header := &fjwt.Headers{ Extra: map[string]any{ - "kid": jwk.kid, + oidc.JWTHeaderKeyIdentifier: jwk.KeyID(), }, } - tokenString, sig, err := signer.Generate(ctx, claims, header) + tokenString, sig, err := signer.Generate(ctx, nil, nil) + assert.EqualError(t, err, "either claims or header is nil") + assert.Equal(t, "", tokenString) + assert.Equal(t, "", sig) + tokenString, sig, err = signer.Generate(ctx, claims, header) assert.NoError(t, err) assert.NotEqual(t, "", tokenString) assert.NotEqual(t, "", sig) @@ -376,7 +403,7 @@ func TestJWKFunctionality(t *testing.T) { fmt.Println(tokenString) assert.True(t, token.Valid()) - assert.Equal(t, jwk.alg.Alg(), string(token.Method)) + assert.Equal(t, jwk.GetSigningMethod().Alg(), string(token.Method)) sigv, err := signer.Validate(ctx, tokenString) assert.NoError(t, err) @@ -385,19 +412,19 @@ func TestJWKFunctionality(t *testing.T) { t.Run("Marshalling", func(t *testing.T) { var ( - jwk *JWK + jwk *oidc.JWK out jose.JSONWebKey data []byte err error ) - jwk = NewJWK(tc.have) + jwk = oidc.NewJWK(tc.have) strategy := jwk.Strategy() assert.NotNil(t, strategy) - signer, ok := strategy.(*Signer) + signer, ok := strategy.(*oidc.Signer) require.True(t, ok) diff --git a/internal/oidc/keys_whitebox_test.go b/internal/oidc/keys_whitebox_test.go new file mode 100644 index 000000000..00b6607ce --- /dev/null +++ b/internal/oidc/keys_whitebox_test.go @@ -0,0 +1,37 @@ +package oidc + +import ( + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestValidateToken(t *testing.T) { + sig, err := validateToken("none", nil) + assert.Equal(t, "", sig) + assert.EqualError(t, err, "square/go-jose: compact JWS format must have three parts") +} + +func TestGetTokenSignature(t *testing.T) { + sig, err := getTokenSignature("abc.123") + assert.Equal(t, "", sig) + assert.EqualError(t, err, "header, body and signature must all be set") +} + +func TestAssign(t *testing.T) { + a := map[string]any{ + "a": "valuea", + "c": "valuea", + } + + b := map[string]any{ + "b": "valueb", + "c": "valueb", + } + + c := assign(a, b) + + assert.Equal(t, "valuea", c["a"]) + assert.Equal(t, "valueb", c["b"]) + assert.Equal(t, "valuea", c["c"]) +} diff --git a/internal/oidc/provider_test.go b/internal/oidc/provider_test.go index 335b03ab9..8e17af71e 100644 --- a/internal/oidc/provider_test.go +++ b/internal/oidc/provider_test.go @@ -1,7 +1,6 @@ -package oidc +package oidc_test import ( - "encoding/json" "net/url" "testing" @@ -9,16 +8,17 @@ import ( "github.com/stretchr/testify/require" "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/oidc" ) func TestOpenIDConnectProvider_NewOpenIDConnectProvider_NotConfigured(t *testing.T) { - provider := NewOpenIDConnectProvider(nil, nil, nil) + provider := oidc.NewOpenIDConnectProvider(nil, nil, nil) assert.Nil(t, provider) } func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing.T) { - provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + provider := oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: keyRSA2048, EnablePKCEPlainChallenge: true, @@ -26,7 +26,7 @@ func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing Clients: []schema.OpenIDConnectClientConfiguration{ { ID: myclient, - Secret: MustDecodeSecret(badsecret), + Secret: tOpenIDConnectPlainTextClientSecret, SectorIdentifier: url.URL{Host: examplecomsid}, Policy: onefactor, RedirectURIs: []string{ @@ -41,23 +41,23 @@ func TestNewOpenIDConnectProvider_ShouldEnableOptionalDiscoveryValues(t *testing disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) assert.Len(t, disco.SubjectTypesSupported, 2) - assert.Contains(t, disco.SubjectTypesSupported, SubjectTypePublic) - assert.Contains(t, disco.SubjectTypesSupported, SubjectTypePairwise) + assert.Contains(t, disco.SubjectTypesSupported, oidc.SubjectTypePublic) + assert.Contains(t, disco.SubjectTypesSupported, oidc.SubjectTypePairwise) assert.Len(t, disco.CodeChallengeMethodsSupported, 2) - assert.Contains(t, disco.CodeChallengeMethodsSupported, PKCEChallengeMethodSHA256) - assert.Contains(t, disco.CodeChallengeMethodsSupported, PKCEChallengeMethodSHA256) + assert.Contains(t, disco.CodeChallengeMethodsSupported, oidc.PKCEChallengeMethodSHA256) + assert.Contains(t, disco.CodeChallengeMethodsSupported, oidc.PKCEChallengeMethodSHA256) } func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GoodConfiguration(t *testing.T) { - provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ + provider := oidc.NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: keyRSA2048, HMACSecret: badhmac, Clients: []schema.OpenIDConnectClientConfiguration{ { ID: "a-client", - Secret: MustDecodeSecret("$plaintext$a-client-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: onefactor, RedirectURIs: []string{ "https://google.com", @@ -66,16 +66,16 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GoodConfiguration(t *tes { ID: "b-client", Description: "Normal Description", - Secret: MustDecodeSecret("$plaintext$b-client-secret"), + Secret: tOpenIDConnectPlainTextClientSecret, Policy: twofactor, RedirectURIs: []string{ "https://google.com", }, Scopes: []string{ - ScopeGroups, + oidc.ScopeGroups, }, GrantTypes: []string{ - GrantTypeRefreshToken, + oidc.GrantTypeRefreshToken, }, ResponseTypes: []string{ "token", @@ -87,285 +87,3 @@ func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GoodConfiguration(t *tes assert.NotNil(t, provider) } - -func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfiguration(t *testing.T) { - provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ - IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: keyRSA2048, - HMACSecret: "asbdhaaskmdlkamdklasmdlkams", - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "a-client", - Secret: MustDecodeSecret("$plaintext$a-client-secret"), - Policy: onefactor, - RedirectURIs: []string{ - "https://google.com", - }, - }, - }, - }, nil, nil) - - require.NotNil(t, provider) - - disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) - - assert.Equal(t, examplecom, disco.Issuer) - assert.Equal(t, "https://example.com/jwks.json", disco.JWKSURI) - assert.Equal(t, "https://example.com/api/oidc/authorization", disco.AuthorizationEndpoint) - assert.Equal(t, "https://example.com/api/oidc/token", disco.TokenEndpoint) - assert.Equal(t, "https://example.com/api/oidc/userinfo", disco.UserinfoEndpoint) - assert.Equal(t, "https://example.com/api/oidc/introspection", disco.IntrospectionEndpoint) - assert.Equal(t, "https://example.com/api/oidc/revocation", disco.RevocationEndpoint) - assert.Equal(t, "", disco.RegistrationEndpoint) - - assert.Len(t, disco.CodeChallengeMethodsSupported, 1) - assert.Contains(t, disco.CodeChallengeMethodsSupported, PKCEChallengeMethodSHA256) - - assert.Len(t, disco.ScopesSupported, 5) - assert.Contains(t, disco.ScopesSupported, ScopeOpenID) - assert.Contains(t, disco.ScopesSupported, ScopeOfflineAccess) - assert.Contains(t, disco.ScopesSupported, ScopeProfile) - assert.Contains(t, disco.ScopesSupported, ScopeGroups) - assert.Contains(t, disco.ScopesSupported, ScopeEmail) - - assert.Len(t, disco.ResponseModesSupported, 3) - assert.Contains(t, disco.ResponseModesSupported, ResponseModeFormPost) - assert.Contains(t, disco.ResponseModesSupported, ResponseModeQuery) - assert.Contains(t, disco.ResponseModesSupported, ResponseModeFragment) - - assert.Len(t, disco.SubjectTypesSupported, 2) - assert.Contains(t, disco.SubjectTypesSupported, SubjectTypePublic) - assert.Contains(t, disco.SubjectTypesSupported, SubjectTypePairwise) - - assert.Len(t, disco.ResponseTypesSupported, 7) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeAuthorizationCodeFlow) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeImplicitFlowIDToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeImplicitFlowToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeImplicitFlowBoth) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowIDToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowBoth) - - assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 4) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretPost) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretJWT) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodNone) - - assert.Len(t, disco.RevocationEndpointAuthMethodsSupported, 4) - assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) - assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodClientSecretPost) - assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodClientSecretJWT) - assert.Contains(t, disco.RevocationEndpointAuthMethodsSupported, ClientAuthMethodNone) - - assert.Len(t, disco.IntrospectionEndpointAuthMethodsSupported, 2) - assert.Contains(t, disco.IntrospectionEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) - assert.Contains(t, disco.IntrospectionEndpointAuthMethodsSupported, ClientAuthMethodNone) - - assert.Len(t, disco.GrantTypesSupported, 3) - assert.Contains(t, disco.GrantTypesSupported, GrantTypeAuthorizationCode) - assert.Contains(t, disco.GrantTypesSupported, GrantTypeRefreshToken) - assert.Contains(t, disco.GrantTypesSupported, GrantTypeImplicit) - - assert.Len(t, disco.RevocationEndpointAuthSigningAlgValuesSupported, 3) - assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[0], SigningAlgHMACUsingSHA256) - assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[1], SigningAlgHMACUsingSHA384) - assert.Equal(t, disco.RevocationEndpointAuthSigningAlgValuesSupported[2], SigningAlgHMACUsingSHA512) - - assert.Len(t, disco.TokenEndpointAuthSigningAlgValuesSupported, 3) - assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[0], SigningAlgHMACUsingSHA256) - assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[1], SigningAlgHMACUsingSHA384) - assert.Equal(t, disco.TokenEndpointAuthSigningAlgValuesSupported[2], SigningAlgHMACUsingSHA512) - - assert.Len(t, disco.IDTokenSigningAlgValuesSupported, 1) - assert.Contains(t, disco.IDTokenSigningAlgValuesSupported, SigningAlgRSAUsingSHA256) - - assert.Len(t, disco.UserinfoSigningAlgValuesSupported, 2) - assert.Equal(t, disco.UserinfoSigningAlgValuesSupported[0], SigningAlgRSAUsingSHA256) - assert.Equal(t, disco.UserinfoSigningAlgValuesSupported[1], SigningAlgNone) - - require.Len(t, disco.RequestObjectSigningAlgValuesSupported, 2) - assert.Equal(t, SigningAlgRSAUsingSHA256, disco.RequestObjectSigningAlgValuesSupported[0]) - assert.Equal(t, SigningAlgNone, disco.RequestObjectSigningAlgValuesSupported[1]) - - assert.Len(t, disco.ClaimsSupported, 18) - assert.Contains(t, disco.ClaimsSupported, ClaimAuthenticationMethodsReference) - assert.Contains(t, disco.ClaimsSupported, ClaimAudience) - assert.Contains(t, disco.ClaimsSupported, ClaimAuthorizedParty) - assert.Contains(t, disco.ClaimsSupported, ClaimClientIdentifier) - assert.Contains(t, disco.ClaimsSupported, ClaimExpirationTime) - assert.Contains(t, disco.ClaimsSupported, ClaimIssuedAt) - assert.Contains(t, disco.ClaimsSupported, ClaimIssuer) - assert.Contains(t, disco.ClaimsSupported, ClaimJWTID) - assert.Contains(t, disco.ClaimsSupported, ClaimRequestedAt) - assert.Contains(t, disco.ClaimsSupported, ClaimSubject) - assert.Contains(t, disco.ClaimsSupported, ClaimAuthenticationTime) - assert.Contains(t, disco.ClaimsSupported, ClaimNonce) - assert.Contains(t, disco.ClaimsSupported, ClaimPreferredEmail) - assert.Contains(t, disco.ClaimsSupported, ClaimEmailVerified) - assert.Contains(t, disco.ClaimsSupported, ClaimEmailAlts) - assert.Contains(t, disco.ClaimsSupported, ClaimGroups) - assert.Contains(t, disco.ClaimsSupported, ClaimPreferredUsername) - assert.Contains(t, disco.ClaimsSupported, ClaimFullName) - - assert.Len(t, disco.PromptValuesSupported, 2) - assert.Contains(t, disco.PromptValuesSupported, PromptConsent) - assert.Contains(t, disco.PromptValuesSupported, PromptNone) -} - -func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOAuth2WellKnownConfiguration(t *testing.T) { - provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ - IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: keyRSA2048, - HMACSecret: "asbdhaaskmdlkamdklasmdlkams", - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "a-client", - Secret: MustDecodeSecret("$plaintext$a-client-secret"), - Policy: onefactor, - RedirectURIs: []string{ - "https://google.com", - }, - }, - }, - }, nil, nil) - - require.NotNil(t, provider) - - disco := provider.GetOAuth2WellKnownConfiguration(examplecom) - - assert.Equal(t, examplecom, disco.Issuer) - assert.Equal(t, "https://example.com/jwks.json", disco.JWKSURI) - assert.Equal(t, "https://example.com/api/oidc/authorization", disco.AuthorizationEndpoint) - assert.Equal(t, "https://example.com/api/oidc/token", disco.TokenEndpoint) - assert.Equal(t, "https://example.com/api/oidc/introspection", disco.IntrospectionEndpoint) - assert.Equal(t, "https://example.com/api/oidc/revocation", disco.RevocationEndpoint) - assert.Equal(t, "", disco.RegistrationEndpoint) - - require.Len(t, disco.CodeChallengeMethodsSupported, 1) - assert.Equal(t, "S256", disco.CodeChallengeMethodsSupported[0]) - - assert.Len(t, disco.ScopesSupported, 5) - assert.Contains(t, disco.ScopesSupported, ScopeOpenID) - assert.Contains(t, disco.ScopesSupported, ScopeOfflineAccess) - assert.Contains(t, disco.ScopesSupported, ScopeProfile) - assert.Contains(t, disco.ScopesSupported, ScopeGroups) - assert.Contains(t, disco.ScopesSupported, ScopeEmail) - - assert.Len(t, disco.ResponseModesSupported, 3) - assert.Contains(t, disco.ResponseModesSupported, ResponseModeFormPost) - assert.Contains(t, disco.ResponseModesSupported, ResponseModeQuery) - assert.Contains(t, disco.ResponseModesSupported, ResponseModeFragment) - - assert.Len(t, disco.SubjectTypesSupported, 2) - assert.Contains(t, disco.SubjectTypesSupported, SubjectTypePublic) - assert.Contains(t, disco.SubjectTypesSupported, SubjectTypePairwise) - - assert.Len(t, disco.ResponseTypesSupported, 7) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeAuthorizationCodeFlow) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeImplicitFlowIDToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeImplicitFlowToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeImplicitFlowBoth) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowIDToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowToken) - assert.Contains(t, disco.ResponseTypesSupported, ResponseTypeHybridFlowBoth) - - assert.Len(t, disco.TokenEndpointAuthMethodsSupported, 4) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretBasic) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretPost) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodClientSecretJWT) - assert.Contains(t, disco.TokenEndpointAuthMethodsSupported, ClientAuthMethodNone) - - assert.Len(t, disco.GrantTypesSupported, 3) - assert.Contains(t, disco.GrantTypesSupported, GrantTypeAuthorizationCode) - assert.Contains(t, disco.GrantTypesSupported, GrantTypeRefreshToken) - assert.Contains(t, disco.GrantTypesSupported, GrantTypeImplicit) - - assert.Len(t, disco.ClaimsSupported, 18) - assert.Contains(t, disco.ClaimsSupported, ClaimAuthenticationMethodsReference) - assert.Contains(t, disco.ClaimsSupported, ClaimAudience) - assert.Contains(t, disco.ClaimsSupported, ClaimAuthorizedParty) - assert.Contains(t, disco.ClaimsSupported, ClaimClientIdentifier) - assert.Contains(t, disco.ClaimsSupported, ClaimExpirationTime) - assert.Contains(t, disco.ClaimsSupported, ClaimIssuedAt) - assert.Contains(t, disco.ClaimsSupported, ClaimIssuer) - assert.Contains(t, disco.ClaimsSupported, ClaimJWTID) - assert.Contains(t, disco.ClaimsSupported, ClaimRequestedAt) - assert.Contains(t, disco.ClaimsSupported, ClaimSubject) - assert.Contains(t, disco.ClaimsSupported, ClaimAuthenticationTime) - assert.Contains(t, disco.ClaimsSupported, ClaimNonce) - assert.Contains(t, disco.ClaimsSupported, ClaimPreferredEmail) - assert.Contains(t, disco.ClaimsSupported, ClaimEmailVerified) - assert.Contains(t, disco.ClaimsSupported, ClaimEmailAlts) - assert.Contains(t, disco.ClaimsSupported, ClaimGroups) - assert.Contains(t, disco.ClaimsSupported, ClaimPreferredUsername) - assert.Contains(t, disco.ClaimsSupported, ClaimFullName) -} - -func TestOpenIDConnectProvider_NewOpenIDConnectProvider_GetOpenIDConnectWellKnownConfigurationWithPlainPKCE(t *testing.T) { - provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ - IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: keyRSA2048, - HMACSecret: "asbdhaaskmdlkamdklasmdlkams", - EnablePKCEPlainChallenge: true, - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "a-client", - Secret: MustDecodeSecret("$plaintext$a-client-secret"), - Policy: onefactor, - RedirectURIs: []string{ - "https://google.com", - }, - }, - }, - }, nil, nil) - - require.NotNil(t, provider) - - disco := provider.GetOpenIDConnectWellKnownConfiguration(examplecom) - - require.Len(t, disco.CodeChallengeMethodsSupported, 2) - assert.Equal(t, PKCEChallengeMethodSHA256, disco.CodeChallengeMethodsSupported[0]) - assert.Equal(t, PKCEChallengeMethodPlain, disco.CodeChallengeMethodsSupported[1]) -} - -func TestNewOpenIDConnectProviderDiscovery(t *testing.T) { - provider := NewOpenIDConnectProvider(&schema.OpenIDConnectConfiguration{ - IssuerCertificateChain: schema.X509CertificateChain{}, - IssuerPrivateKey: keyRSA2048, - HMACSecret: "asbdhaaskmdlkamdklasmdlkams", - EnablePKCEPlainChallenge: true, - Clients: []schema.OpenIDConnectClientConfiguration{ - { - ID: "a-client", - Secret: MustDecodeSecret("$plaintext$a-client-secret"), - Policy: onefactor, - RedirectURIs: []string{ - "https://google.com", - }, - }, - }, - }, nil, nil) - - a := provider.GetOpenIDConnectWellKnownConfiguration("https://auth.example.com") - - data, err := json.Marshal(&a) - assert.NoError(t, err) - - b := OpenIDConnectWellKnownConfiguration{} - - assert.NoError(t, json.Unmarshal(data, &b)) - - assert.Equal(t, a, b) - - y := provider.GetOAuth2WellKnownConfiguration("https://auth.example.com") - - data, err = json.Marshal(&y) - assert.NoError(t, err) - - z := OAuth2WellKnownConfiguration{} - - assert.NoError(t, json.Unmarshal(data, &z)) - - assert.Equal(t, y, z) -} diff --git a/internal/oidc/store.go b/internal/oidc/store.go index 2f21b368c..23a591ea0 100644 --- a/internal/oidc/store.go +++ b/internal/oidc/store.go @@ -235,7 +235,7 @@ func (s *Store) CreatePKCERequestSession(ctx context.Context, signature string, // DeletePKCERequestSession marks the authorization request for a given PKCE request as deleted. // This implements a portion of pkce.PKCERequestStorage. func (s *Store) DeletePKCERequestSession(ctx context.Context, signature string) (err error) { - return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypeAccessToken, signature) + return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypePKCEChallenge, signature) } // GetPKCERequestSession gets the authorization request for a given PKCE request. @@ -254,7 +254,7 @@ func (s *Store) CreateOpenIDConnectSession(ctx context.Context, authorizeCode st // DeleteOpenIDConnectSession just implements the method required by fosite even though it's unused. // This implements a portion of openid.OpenIDConnectRequestStorage. func (s *Store) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) (err error) { - return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypeAccessToken, authorizeCode) + return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypeOpenIDConnect, authorizeCode) } // GetOpenIDConnectSession returns error: diff --git a/internal/oidc/store_test.go b/internal/oidc/store_test.go index bdd5f4d69..f6eb95818 100644 --- a/internal/oidc/store_test.go +++ b/internal/oidc/store_test.go @@ -1,19 +1,30 @@ -package oidc +package oidc_test import ( "context" + "database/sql" + "encoding/json" + "fmt" "testing" + "time" + "github.com/golang/mock/gomock" + "github.com/google/uuid" "github.com/ory/fosite" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "github.com/stretchr/testify/suite" "github.com/authelia/authelia/v4/internal/authorization" "github.com/authelia/authelia/v4/internal/configuration/schema" + "github.com/authelia/authelia/v4/internal/mocks" + "github.com/authelia/authelia/v4/internal/model" + "github.com/authelia/authelia/v4/internal/oidc" + "github.com/authelia/authelia/v4/internal/storage" ) func TestOpenIDConnectStore_GetClientPolicy(t *testing.T) { - s := NewStore(&schema.OpenIDConnectConfiguration{ + s := oidc.NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ @@ -21,15 +32,15 @@ func TestOpenIDConnectStore_GetClientPolicy(t *testing.T) { ID: myclient, Description: myclientdesc, Policy: onefactor, - Scopes: []string{ScopeOpenID, ScopeProfile}, - Secret: MustDecodeSecret("$plaintext$mysecret"), + Scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile}, + Secret: tOpenIDConnectPlainTextClientSecret, }, { ID: "myotherclient", Description: myclientdesc, Policy: twofactor, - Scopes: []string{ScopeOpenID, ScopeProfile}, - Secret: MustDecodeSecret("$plaintext$mysecret"), + Scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile}, + Secret: tOpenIDConnectPlainTextClientSecret, }, }, }, nil) @@ -45,7 +56,7 @@ func TestOpenIDConnectStore_GetClientPolicy(t *testing.T) { } func TestOpenIDConnectStore_GetInternalClient(t *testing.T) { - s := NewStore(&schema.OpenIDConnectConfiguration{ + s := oidc.NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ @@ -53,8 +64,8 @@ func TestOpenIDConnectStore_GetInternalClient(t *testing.T) { ID: myclient, Description: myclientdesc, Policy: onefactor, - Scopes: []string{ScopeOpenID, ScopeProfile}, - Secret: MustDecodeSecret("$plaintext$mysecret"), + Scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile}, + Secret: tOpenIDConnectPlainTextClientSecret, }, }, }, nil) @@ -76,11 +87,11 @@ func TestOpenIDConnectStore_GetInternalClient_ValidClient(t *testing.T) { ID: id, Description: myclientdesc, Policy: onefactor, - Scopes: []string{ScopeOpenID, ScopeProfile}, - Secret: MustDecodeSecret("$plaintext$mysecret"), + Scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile}, + Secret: tOpenIDConnectPlainTextClientSecret, } - s := NewStore(&schema.OpenIDConnectConfiguration{ + s := oidc.NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{c1}, @@ -92,11 +103,11 @@ func TestOpenIDConnectStore_GetInternalClient_ValidClient(t *testing.T) { assert.Equal(t, id, client.GetID()) assert.Equal(t, myclientdesc, client.GetDescription()) assert.Equal(t, fosite.Arguments(c1.Scopes), client.GetScopes()) - assert.Equal(t, fosite.Arguments([]string{GrantTypeAuthorizationCode}), client.GetGrantTypes()) - assert.Equal(t, fosite.Arguments([]string{ResponseTypeAuthorizationCodeFlow}), client.GetResponseTypes()) + assert.Equal(t, fosite.Arguments([]string{oidc.GrantTypeAuthorizationCode}), client.GetGrantTypes()) + assert.Equal(t, fosite.Arguments([]string{oidc.ResponseTypeAuthorizationCodeFlow}), client.GetResponseTypes()) assert.Equal(t, []string(nil), client.GetRedirectURIs()) assert.Equal(t, authorization.OneFactor, client.GetAuthorizationPolicy()) - assert.Equal(t, "$plaintext$mysecret", client.GetSecret().Encode()) + assert.Equal(t, "$plaintext$client-secret", client.GetSecret().Encode()) } func TestOpenIDConnectStore_GetInternalClient_InvalidClient(t *testing.T) { @@ -104,11 +115,11 @@ func TestOpenIDConnectStore_GetInternalClient_InvalidClient(t *testing.T) { ID: myclient, Description: myclientdesc, Policy: onefactor, - Scopes: []string{ScopeOpenID, ScopeProfile}, - Secret: MustDecodeSecret("$plaintext$mysecret"), + Scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile}, + Secret: tOpenIDConnectPlainTextClientSecret, } - s := NewStore(&schema.OpenIDConnectConfiguration{ + s := oidc.NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{c1}, @@ -120,7 +131,7 @@ func TestOpenIDConnectStore_GetInternalClient_InvalidClient(t *testing.T) { } func TestOpenIDConnectStore_IsValidClientID(t *testing.T) { - s := NewStore(&schema.OpenIDConnectConfiguration{ + s := oidc.NewStore(&schema.OpenIDConnectConfiguration{ IssuerCertificateChain: schema.X509CertificateChain{}, IssuerPrivateKey: keyRSA2048, Clients: []schema.OpenIDConnectClientConfiguration{ @@ -128,8 +139,8 @@ func TestOpenIDConnectStore_IsValidClientID(t *testing.T) { ID: myclient, Description: myclientdesc, Policy: onefactor, - Scopes: []string{ScopeOpenID, ScopeProfile}, - Secret: MustDecodeSecret("$plaintext$mysecret"), + Scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile}, + Secret: tOpenIDConnectPlainTextClientSecret, }, }, }, nil) @@ -140,3 +151,516 @@ func TestOpenIDConnectStore_IsValidClientID(t *testing.T) { assert.True(t, validClient) assert.False(t, invalidClient) } + +func TestStoreSuite(t *testing.T) { + suite.Run(t, &StoreSuite{}) +} + +type StoreSuite struct { + suite.Suite + + ctx context.Context + ctrl *gomock.Controller + mock *mocks.MockStorage + store *oidc.Store +} + +func (s *StoreSuite) SetupTest() { + s.ctx = context.Background() + s.ctrl = gomock.NewController(s.T()) + s.mock = mocks.NewMockStorage(s.ctrl) + s.store = oidc.NewStore(&schema.OpenIDConnectConfiguration{ + Clients: []schema.OpenIDConnectClientConfiguration{ + { + ID: "hs256", + Secret: tOpenIDConnectPBKDF2ClientSecret, + Policy: authorization.OneFactor.String(), + RedirectURIs: []string{ + "https://client.example.com", + }, + TokenEndpointAuthMethod: oidc.ClientAuthMethodClientSecretJWT, + TokenEndpointAuthSigningAlg: oidc.SigningAlgHMACUsingSHA256, + }, + }}, s.mock) +} + +func (s *StoreSuite) TestGetSubject() { + s.T().Run("GenerateNew", func(t *testing.T) { + s.mock. + EXPECT(). + LoadUserOpaqueIdentifierBySignature(s.ctx, "openid", "", "john"). + Return(nil, nil) + + s.mock. + EXPECT(). + SaveUserOpaqueIdentifier(s.ctx, gomock.Any()). + Return(nil) + + opaqueID, err := s.store.GetSubject(s.ctx, "", "john") + + assert.NoError(t, err) + assert.NotEqual(t, uint32(0), opaqueID) + }) + + s.T().Run("ReturnDatabaseErrorOnLoad", func(t *testing.T) { + s.mock. + EXPECT(). + LoadUserOpaqueIdentifierBySignature(s.ctx, "openid", "", "john"). + Return(nil, fmt.Errorf("failed to load")) + + opaqueID, err := s.store.GetSubject(s.ctx, "", "john") + + assert.EqualError(t, err, "failed to load") + assert.Equal(t, uint32(0), opaqueID.ID()) + }) + + s.T().Run("ReturnDatabaseErrorOnSave", func(t *testing.T) { + s.mock. + EXPECT(). + LoadUserOpaqueIdentifierBySignature(s.ctx, "openid", "", "john"). + Return(nil, nil) + + s.mock. + EXPECT(). + SaveUserOpaqueIdentifier(s.ctx, gomock.Any()). + Return(fmt.Errorf("failed to save")) + + opaqueID, err := s.store.GetSubject(s.ctx, "", "john") + + assert.EqualError(t, err, "failed to save") + assert.Equal(t, uint32(0), opaqueID.ID()) + }) +} + +func (s *StoreSuite) TestTx() { + gomock.InOrder( + s.mock.EXPECT().BeginTX(s.ctx).Return(s.ctx, nil), + s.mock.EXPECT().Commit(s.ctx).Return(nil), + s.mock.EXPECT().Rollback(s.ctx).Return(nil), + s.mock.EXPECT().BeginTX(s.ctx).Return(nil, fmt.Errorf("failed to begin")), + s.mock.EXPECT().Commit(s.ctx).Return(fmt.Errorf("failed to commit")), + s.mock.EXPECT().Rollback(s.ctx).Return(fmt.Errorf("failed to rollback")), + ) + + x, err := s.store.BeginTX(s.ctx) + s.Equal(s.ctx, x) + s.NoError(err) + s.NoError(s.store.Commit(s.ctx)) + s.NoError(s.store.Rollback(s.ctx)) + + x, err = s.store.BeginTX(s.ctx) + s.Equal(nil, x) + s.EqualError(err, "failed to begin") + s.EqualError(s.store.Commit(s.ctx), "failed to commit") + s.EqualError(s.store.Rollback(s.ctx), "failed to rollback") +} + +func (s *StoreSuite) TestClientAssertionJWTValid() { + gomock.InOrder( + s.mock. + EXPECT(). + LoadOAuth2BlacklistedJTI(s.ctx, "3a240379e8286a7a8ff5e99d68567e0e5e34e80168b8feffa89d3d33dea95b63"). + Return(&model.OAuth2BlacklistedJTI{ + ID: 1, + Signature: "3a240379e8286a7a8ff5e99d68567e0e5e34e80168b8feffa89d3d33dea95b63", + ExpiresAt: time.Now().Add(time.Hour), + }, nil), + s.mock. + EXPECT(). + LoadOAuth2BlacklistedJTI(s.ctx, "e7f67ad76c80d57d34b19598462817932aec21d2806a08a786a8d4b9dd476068"). + Return(&model.OAuth2BlacklistedJTI{ + ID: 1, + Signature: "e7f67ad76c80d57d34b19598462817932aec21d2806a08a786a8d4b9dd476068", + ExpiresAt: time.Now().Add(-time.Hour), + }, nil), + s.mock. + EXPECT(). + LoadOAuth2BlacklistedJTI(s.ctx, "f29ef0d85303a09411b76001c579980f1b1b7fc9deb1fa647875a724f4f231c6"). + Return(nil, fmt.Errorf("failed to load")), + ) + + s.EqualError(s.store.ClientAssertionJWTValid(s.ctx, "066ee771-e156-4886-b99f-ee09b0d3edf4"), "jti_known") + s.NoError(s.store.ClientAssertionJWTValid(s.ctx, "5dad3ff7-e4f2-41b6-98a3-b73d872076ce")) + s.EqualError(s.store.ClientAssertionJWTValid(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7202"), "failed to load") +} + +func (s *StoreSuite) TestCreateSessions() { + challenge := uuid.Must(uuid.NewRandom()) + session := &model.OpenIDSession{ + ChallengeID: challenge, + } + sessionData, _ := json.Marshal(session) + + gomock.InOrder( + s.mock. + EXPECT(). + SaveOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, model.OAuth2Session{ChallengeID: challenge, RequestID: "abc", ClientID: "example", Signature: "abc", Active: true, Session: sessionData}). + Return(nil), + s.mock. + EXPECT(). + SaveOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, model.OAuth2Session{ChallengeID: challenge, RequestID: "abc", ClientID: "example", Signature: "abc", Active: true, Session: sessionData}). + Return(fmt.Errorf("duplicate key")), + s.mock. + EXPECT(). + SaveOAuth2Session(s.ctx, storage.OAuth2SessionTypeAccessToken, model.OAuth2Session{ChallengeID: challenge, RequestID: "abc", ClientID: "example", Signature: "abc", Active: true, Session: sessionData}). + Return(nil), + s.mock. + EXPECT(). + SaveOAuth2Session(s.ctx, storage.OAuth2SessionTypeRefreshToken, model.OAuth2Session{ChallengeID: challenge, RequestID: "abc", ClientID: "example", Signature: "abc", Active: true, Session: sessionData}). + Return(nil), + s.mock. + EXPECT(). + SaveOAuth2Session(s.ctx, storage.OAuth2SessionTypeOpenIDConnect, model.OAuth2Session{ChallengeID: challenge, RequestID: "abc", ClientID: "example", Signature: "abc", Active: true, Session: sessionData}). + Return(nil), + s.mock. + EXPECT(). + SaveOAuth2Session(s.ctx, storage.OAuth2SessionTypePKCEChallenge, model.OAuth2Session{ChallengeID: challenge, RequestID: "abc", ClientID: "example", Signature: "abc", Active: true, Session: sessionData}). + Return(nil), + s.mock. + EXPECT(). + SaveOAuth2PARContext(s.ctx, model.OAuth2PARContext{Signature: "abc", RequestID: "abc", ClientID: "example", Session: sessionData}). + Return(nil), + ) + + s.NoError(s.store.CreateAuthorizeCodeSession(s.ctx, "abc", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + })) + + s.EqualError(s.store.CreateAuthorizeCodeSession(s.ctx, "abc", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + }), "duplicate key") + + s.EqualError(s.store.CreateAuthorizeCodeSession(s.ctx, "abc", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: nil, + }), "can't convert type '' to an *OAuth2Session") + + s.NoError(s.store.CreateAccessTokenSession(s.ctx, "abc", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + })) + + s.NoError(s.store.CreateRefreshTokenSession(s.ctx, "abc", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + })) + + s.NoError(s.store.CreateOpenIDConnectSession(s.ctx, "abc", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + })) + + s.NoError(s.store.CreatePKCERequestSession(s.ctx, "abc", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + })) + + s.NoError(s.store.CreatePARSession(s.ctx, "abc", &fosite.AuthorizeRequest{ + Request: fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + }})) + + s.EqualError(s.store.CreatePARSession(s.ctx, "abc", &fosite.AuthorizeRequest{ + Request: fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: nil, + }}), "can't convert type '' to an *OAuth2Session") +} + +func (s *StoreSuite) TestRevokeSessions() { + gomock.InOrder( + s.mock. + EXPECT(). + DeactivateOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, "abc1"). + Return(nil), + s.mock. + EXPECT(). + DeactivateOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, "abc2"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypeAccessToken, "at_example1"). + Return(nil), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypeAccessToken, "at_example2"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + RevokeOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeAccessToken, "65471ccb-d650-4006-a95f-cb4f4e3d7200"). + Return(nil), + s.mock. + EXPECT(). + RevokeOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeAccessToken, "65471ccb-d650-4006-a95f-cb4f4e3d7201"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + RevokeOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeAccessToken, "65471ccb-d650-4006-a95f-cb4f4e3d7202"). + Return(sql.ErrNoRows), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypeRefreshToken, "rt_example1"). + Return(nil), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypeRefreshToken, "rt_example2"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + DeactivateOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeRefreshToken, "65471ccb-d650-4006-a95f-cb4f4e3d7200"). + Return(nil), + s.mock. + EXPECT(). + DeactivateOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeRefreshToken, "65471ccb-d650-4006-a95f-cb4f4e3d7201"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + DeactivateOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeRefreshToken, "65471ccb-d650-4006-a95f-cb4f4e3d7202"). + Return(sql.ErrNoRows), + s.mock. + EXPECT(). + DeactivateOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeRefreshToken, "65471ccb-d650-4006-a95f-cb4f4e3d7200"). + Return(nil), + s.mock. + EXPECT(). + DeactivateOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeRefreshToken, "65471ccb-d650-4006-a95f-cb4f4e3d7201"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + DeactivateOAuth2SessionByRequestID(s.ctx, storage.OAuth2SessionTypeRefreshToken, "65471ccb-d650-4006-a95f-cb4f4e3d7202"). + Return(sql.ErrNoRows), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypePKCEChallenge, "pkce1"). + Return(nil), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypePKCEChallenge, "pkce2"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypeOpenIDConnect, "ac_1"). + Return(nil), + s.mock. + EXPECT(). + RevokeOAuth2Session(s.ctx, storage.OAuth2SessionTypeOpenIDConnect, "ac_2"). + Return(fmt.Errorf("not found")), + s.mock. + EXPECT(). + RevokeOAuth2PARContext(s.ctx, "urn:par1"). + Return(nil), + s.mock. + EXPECT(). + RevokeOAuth2PARContext(s.ctx, "urn:par2"). + Return(fmt.Errorf("not found")), + ) + + s.NoError(s.store.InvalidateAuthorizeCodeSession(s.ctx, "abc1")) + s.EqualError(s.store.InvalidateAuthorizeCodeSession(s.ctx, "abc2"), "not found") + + s.NoError(s.store.DeleteAccessTokenSession(s.ctx, "at_example1")) + s.EqualError(s.store.DeleteAccessTokenSession(s.ctx, "at_example2"), "not found") + + s.NoError(s.store.RevokeAccessToken(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7200")) + s.EqualError(s.store.RevokeAccessToken(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7201"), "not found") + s.EqualError(s.store.RevokeAccessToken(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7202"), "not_found") + + s.NoError(s.store.DeleteRefreshTokenSession(s.ctx, "rt_example1")) + s.EqualError(s.store.DeleteRefreshTokenSession(s.ctx, "rt_example2"), "not found") + + s.NoError(s.store.RevokeRefreshToken(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7200")) + s.EqualError(s.store.RevokeRefreshToken(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7201"), "not found") + s.EqualError(s.store.RevokeRefreshToken(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7202"), "sql: no rows in result set") + + s.NoError(s.store.RevokeRefreshTokenMaybeGracePeriod(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7200", "1")) + s.EqualError(s.store.RevokeRefreshTokenMaybeGracePeriod(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7201", "2"), "not found") + s.EqualError(s.store.RevokeRefreshTokenMaybeGracePeriod(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7202", "3"), "sql: no rows in result set") + + s.NoError(s.store.DeletePKCERequestSession(s.ctx, "pkce1")) + s.EqualError(s.store.DeletePKCERequestSession(s.ctx, "pkce2"), "not found") + + s.NoError(s.store.DeleteOpenIDConnectSession(s.ctx, "ac_1")) + s.EqualError(s.store.DeleteOpenIDConnectSession(s.ctx, "ac_2"), "not found") + + s.NoError(s.store.DeletePARSession(s.ctx, "urn:par1")) + s.EqualError(s.store.DeletePARSession(s.ctx, "urn:par2"), "not found") +} + +func (s *StoreSuite) TestGetSessions() { + challenge := uuid.Must(uuid.NewRandom()) + session := &model.OpenIDSession{ + ChallengeID: challenge, + ClientID: "hs256", + } + sessionData, _ := json.Marshal(session) + + sessionb := &model.OpenIDSession{ + ChallengeID: challenge, + ClientID: "hs256", + } + sessionDatab, _ := json.Marshal(sessionb) + + gomock.InOrder( + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, "ac_123"). + Return(&model.OAuth2Session{ClientID: "hs256", Session: sessionData, Active: true}, nil), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, "ac_456"). + Return(&model.OAuth2Session{ClientID: "hs256", Session: sessionData, Active: false}, nil), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, "ac_aaa"). + Return(nil, sql.ErrNoRows), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, "ac_130"). + Return(nil, fmt.Errorf("timeout")), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeAuthorizeCode, "ac_badclient"). + Return(&model.OAuth2Session{ClientID: "no-client", Session: sessionDatab, Active: true}, nil), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeAccessToken, "at"). + Return(&model.OAuth2Session{ClientID: "hs256", Session: sessionData, Active: true}, nil), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeRefreshToken, "rt"). + Return(&model.OAuth2Session{ClientID: "hs256", Session: sessionData, Active: true}, nil), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypePKCEChallenge, "pkce"). + Return(&model.OAuth2Session{ClientID: "hs256", Session: sessionData, Active: true}, nil), + s.mock.EXPECT().LoadOAuth2Session(s.ctx, storage.OAuth2SessionTypeOpenIDConnect, "ot"). + Return(&model.OAuth2Session{ClientID: "hs256", Session: sessionData, Active: true}, nil), + s.mock. + EXPECT(). + LoadOAuth2PARContext(s.ctx, "urn:par"). + Return(&model.OAuth2PARContext{Signature: "abc", RequestID: "abc", ClientID: "hs256", Session: sessionData}, nil), + s.mock. + EXPECT(). + LoadOAuth2PARContext(s.ctx, "urn:par"). + Return(nil, sql.ErrNoRows), + ) + + var ( + r fosite.Requester + err error + ) + + r, err = s.store.GetAuthorizeCodeSession(s.ctx, "ac_123", &model.OpenIDSession{}) + s.NotNil(r) + s.NoError(err) + + r, err = s.store.GetAuthorizeCodeSession(s.ctx, "ac_456", &model.OpenIDSession{}) + s.NotNil(r) + s.EqualError(err, "Authorization code has ben invalidated") + + r, err = s.store.GetAuthorizeCodeSession(s.ctx, "ac_aaa", &model.OpenIDSession{}) + s.Nil(r) + s.EqualError(err, "not_found") + + r, err = s.store.GetAuthorizeCodeSession(s.ctx, "ac_130", &model.OpenIDSession{}) + s.Nil(r) + s.EqualError(err, "timeout") + + r, err = s.store.GetAuthorizeCodeSession(s.ctx, "ac_badclient", &model.OpenIDSession{}) + s.Nil(r) + s.EqualError(err, "invalid_client") + + r, err = s.store.GetAccessTokenSession(s.ctx, "at", &model.OpenIDSession{}) + s.NotNil(r) + s.NoError(err) + + r, err = s.store.GetRefreshTokenSession(s.ctx, "rt", &model.OpenIDSession{}) + s.NotNil(r) + s.NoError(err) + + r, err = s.store.GetPKCERequestSession(s.ctx, "pkce", &model.OpenIDSession{}) + s.NotNil(r) + s.NoError(err) + + r, err = s.store.GetOpenIDConnectSession(s.ctx, "ot", &fosite.Request{ + ID: "abc", + Client: &oidc.BaseClient{ + ID: "example", + }, + Session: session, + }) + s.NotNil(r) + s.NoError(err) + + r, err = s.store.GetPARSession(s.ctx, "urn:par") + s.NotNil(r) + s.NoError(err) + + r, err = s.store.GetPARSession(s.ctx, "urn:par") + s.Nil(r) + s.EqualError(err, "sql: no rows in result set") +} + +func (s *StoreSuite) TestIsJWTUsed() { + gomock.InOrder( + s.mock. + EXPECT(). + LoadOAuth2BlacklistedJTI(s.ctx, "3a240379e8286a7a8ff5e99d68567e0e5e34e80168b8feffa89d3d33dea95b63"). + Return(&model.OAuth2BlacklistedJTI{ + ID: 1, + Signature: "3a240379e8286a7a8ff5e99d68567e0e5e34e80168b8feffa89d3d33dea95b63", + ExpiresAt: time.Now().Add(time.Hour), + }, nil), + s.mock. + EXPECT(). + LoadOAuth2BlacklistedJTI(s.ctx, "e7f67ad76c80d57d34b19598462817932aec21d2806a08a786a8d4b9dd476068"). + Return(&model.OAuth2BlacklistedJTI{ + ID: 1, + Signature: "e7f67ad76c80d57d34b19598462817932aec21d2806a08a786a8d4b9dd476068", + ExpiresAt: time.Now().Add(-time.Hour), + }, nil), + s.mock. + EXPECT(). + LoadOAuth2BlacklistedJTI(s.ctx, "f29ef0d85303a09411b76001c579980f1b1b7fc9deb1fa647875a724f4f231c6"). + Return(nil, fmt.Errorf("failed to load")), + ) + + used, err := s.store.IsJWTUsed(s.ctx, "066ee771-e156-4886-b99f-ee09b0d3edf4") + s.True(used) + s.EqualError(err, "jti_known") + + used, err = s.store.IsJWTUsed(s.ctx, "5dad3ff7-e4f2-41b6-98a3-b73d872076ce") + s.False(used) + s.NoError(err) + + used, err = s.store.IsJWTUsed(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7202") + s.True(used) + s.EqualError(err, "failed to load") +} + +func (s *StoreSuite) TestMarkJWTUsedForTime() { + gomock.InOrder( + s.mock.EXPECT(). + SaveOAuth2BlacklistedJTI(s.ctx, model.OAuth2BlacklistedJTI{Signature: "f29ef0d85303a09411b76001c579980f1b1b7fc9deb1fa647875a724f4f231c6", ExpiresAt: time.Unix(160000000, 0)}). + Return(nil), + s.mock.EXPECT().SaveOAuth2BlacklistedJTI(s.ctx, model.OAuth2BlacklistedJTI{Signature: "0dab0de97ed4e05da82763497448daf4f6b555c99218100e3ef5a81f36232940", ExpiresAt: time.Unix(160000000, 0)}). + Return(fmt.Errorf("already marked")), + ) + + s.NoError(s.store.MarkJWTUsedForTime(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7202", time.Unix(160000000, 0))) + s.EqualError(s.store.MarkJWTUsedForTime(s.ctx, "65471ccb-d650-4006-a95f-cb4f4e3d7201", time.Unix(160000000, 0)), "already marked") +} diff --git a/internal/oidc/types.go b/internal/oidc/types.go index ecec14e5f..720ac4fa7 100644 --- a/internal/oidc/types.go +++ b/internal/oidc/types.go @@ -515,18 +515,20 @@ type OAuth2MutualTLSClientAuthenticationDiscoveryOptions struct { within mtls_endpoint_aliases that do not define endpoints to which an OAuth client makes a direct request have no meaning and SHOULD be ignored. */ - MutualTLSEndpointAliases struct { - AuthorizationEndpoint string `json:"authorization_endpoint,omitempty"` - TokenEndpoint string `json:"token_endpoint,omitempty"` - IntrospectionEndpoint string `json:"introspection_endpoint,omitempty"` - RevocationEndpoint string `json:"revocation_endpoint,omitempty"` - EndSessionEndpoint string `json:"end_session_endpoint,omitempty"` - UserinfoEndpoint string `json:"userinfo_endpoint,omitempty"` - BackChannelAuthenticationEndpoint string `json:"backchannel_authentication_endpoint,omitempty"` - FederationRegistrationEndpoint string `json:"federation_registration_endpoint,omitempty"` - PushedAuthorizationRequestEndpoint string `json:"pushed_authorization_request_endpoint,omitempty"` - RegistrationEndpoint string `json:"registration_endpoint,omitempty"` - } `json:"mtls_endpoint_aliases"` + MutualTLSEndpointAliases OAuth2MutualTLSClientAuthenticationAliasesDiscoveryOptions `json:"mtls_endpoint_aliases"` +} + +type OAuth2MutualTLSClientAuthenticationAliasesDiscoveryOptions struct { + AuthorizationEndpoint string `json:"authorization_endpoint,omitempty"` + TokenEndpoint string `json:"token_endpoint,omitempty"` + IntrospectionEndpoint string `json:"introspection_endpoint,omitempty"` + RevocationEndpoint string `json:"revocation_endpoint,omitempty"` + EndSessionEndpoint string `json:"end_session_endpoint,omitempty"` + UserinfoEndpoint string `json:"userinfo_endpoint,omitempty"` + BackChannelAuthenticationEndpoint string `json:"backchannel_authentication_endpoint,omitempty"` + FederationRegistrationEndpoint string `json:"federation_registration_endpoint,omitempty"` + PushedAuthorizationRequestEndpoint string `json:"pushed_authorization_request_endpoint,omitempty"` + RegistrationEndpoint string `json:"registration_endpoint,omitempty"` } type OAuth2JWTSecuredAuthorizationRequestDiscoveryOptions struct { @@ -954,15 +956,3 @@ type OpenIDConnectContext interface { IssuerURL() (issuerURL *url.URL, err error) } - -// MockOpenIDConnectContext is a minimal implementation of OpenIDConnectContext for the purpose of testing. -type MockOpenIDConnectContext struct { - context.Context - - MockIssuerURL *url.URL -} - -// IssuerURL returns the MockIssuerURL. -func (m *MockOpenIDConnectContext) IssuerURL() (issuerURL *url.URL, err error) { - return m.MockIssuerURL, nil -} diff --git a/internal/oidc/types_test.go b/internal/oidc/types_test.go index a17f3e3ad..baffc3dbd 100644 --- a/internal/oidc/types_test.go +++ b/internal/oidc/types_test.go @@ -1,6 +1,7 @@ -package oidc +package oidc_test import ( + "context" "net/url" "testing" "time" @@ -11,10 +12,11 @@ import ( "github.com/stretchr/testify/require" "github.com/authelia/authelia/v4/internal/model" + "github.com/authelia/authelia/v4/internal/oidc" ) func TestNewSession(t *testing.T) { - session := NewSession() + session := oidc.NewSession() require.NotNil(t, session) @@ -34,24 +36,24 @@ func TestNewSessionWithAuthorizeRequest(t *testing.T) { formValues := url.Values{} - formValues.Set(ClaimNonce, "abc123xyzauthelia") + formValues.Set(oidc.ClaimNonce, "abc123xyzauthelia") request := &fosite.AuthorizeRequest{ Request: fosite.Request{ ID: requestID.String(), Form: formValues, - Client: &BaseClient{ID: "example"}, + Client: &oidc.BaseClient{ID: "example"}, }, } extra := map[string]any{ - ClaimPreferredUsername: "john", + oidc.ClaimPreferredUsername: "john", } requested := time.Unix(1647332518, 0) authAt := time.Unix(1647332500, 0) issuer := examplecom - amr := []string{AMRPasswordBasedAuthentication} + amr := []string{oidc.AMRPasswordBasedAuthentication} consent := &model.OAuth2ConsentSession{ ChallengeID: uuid.New(), @@ -59,7 +61,7 @@ func TestNewSessionWithAuthorizeRequest(t *testing.T) { Subject: uuid.NullUUID{UUID: subject, Valid: true}, } - session := NewSessionWithAuthorizeRequest(MustParseRequestURI(issuer), "primary", "john", amr, extra, authAt, consent, request) + session := oidc.NewSessionWithAuthorizeRequest(MustParseRequestURI(issuer), "primary", "john", amr, extra, authAt, consent, request) require.NotNil(t, session) require.NotNil(t, session.Extra) @@ -80,19 +82,36 @@ func TestNewSessionWithAuthorizeRequest(t *testing.T) { assert.Equal(t, authAt, session.Claims.AuthTime) assert.Equal(t, requested, session.Claims.RequestedAt) assert.Equal(t, issuer, session.Claims.Issuer) - assert.Equal(t, "john", session.Claims.Extra[ClaimPreferredUsername]) + assert.Equal(t, "john", session.Claims.Extra[oidc.ClaimPreferredUsername]) - assert.Equal(t, "primary", session.Headers.Get(JWTHeaderKeyIdentifier)) + assert.Equal(t, "primary", session.Headers.Get(oidc.JWTHeaderKeyIdentifier)) consent = &model.OAuth2ConsentSession{ ChallengeID: uuid.New(), RequestedAt: requested, } - session = NewSessionWithAuthorizeRequest(MustParseRequestURI(issuer), "primary", "john", nil, nil, authAt, consent, request) + session = oidc.NewSessionWithAuthorizeRequest(MustParseRequestURI(issuer), "primary", "john", nil, nil, authAt, consent, request) require.NotNil(t, session) require.NotNil(t, session.Claims) assert.NotNil(t, session.Claims.Extra) assert.Nil(t, session.Claims.AuthenticationMethodsReferences) } + +// MockOpenIDConnectContext is a minimal implementation of OpenIDConnectContext for the purpose of testing. +type MockOpenIDConnectContext struct { + context.Context + + MockIssuerURL *url.URL + IssuerURLFunc func() (issuerURL *url.URL, err error) +} + +// IssuerURL returns the MockIssuerURL. +func (m *MockOpenIDConnectContext) IssuerURL() (issuerURL *url.URL, err error) { + if m.IssuerURLFunc != nil { + return m.IssuerURLFunc() + } + + return m.MockIssuerURL, nil +} diff --git a/internal/utils/bytes_test.go b/internal/utils/bytes_test.go new file mode 100644 index 000000000..af1f32d07 --- /dev/null +++ b/internal/utils/bytes_test.go @@ -0,0 +1,16 @@ +package utils + +import ( + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestBytesJoin(t *testing.T) { + a := []byte("a") + b := []byte("b") + + assert.Equal(t, "ab", string(BytesJoin(a, b))) + assert.Equal(t, "a", string(BytesJoin(a))) + assert.Equal(t, "", string(BytesJoin())) +} diff --git a/internal/utils/clocK_test.go b/internal/utils/clocK_test.go new file mode 100644 index 000000000..3f243618b --- /dev/null +++ b/internal/utils/clocK_test.go @@ -0,0 +1,48 @@ +package utils + +import ( + "testing" + "time" + + "github.com/stretchr/testify/assert" +) + +func TestTestingClock(t *testing.T) { + c := &TestingClock{ + now: time.Unix(0, 0), + } + + assert.Equal(t, int64(0), c.Now().Unix()) + c.now = time.Unix(20, 0) + + assert.Equal(t, int64(20), c.Now().Unix()) + assert.Equal(t, int64(20000000000), c.Now().UnixNano()) + + c.Set(time.Unix(16000000, 0)) + + assert.Equal(t, int64(16000000), c.Now().Unix()) + + before := c.Now() + + <-c.After(time.Millisecond * 100) + + assert.Equal(t, before, c.Now()) +} + +func TestRealClock(t *testing.T) { + c := &RealClock{} + + assert.WithinDuration(t, time.Now(), c.Now(), time.Second) + + before := c.Now() + + <-c.After(time.Millisecond * 100) + + after := c.Now() + + assert.WithinDuration(t, before, after, time.Millisecond*120) + + diff := after.Sub(before) + + assert.GreaterOrEqual(t, diff, time.Millisecond*100) +} From d410a92ef14e297fa50963f6865feebc57381762 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 15 May 2023 16:04:04 +1000 Subject: [PATCH 46/67] build(deps): update module github.com/go-rod/rod to v0.113.0 (#5437) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 5 +++-- go.sum | 8 ++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 9569bfa4d..26c7c7803 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/go-asn1-ber/asn1-ber v1.5.4 github.com/go-crypt/crypt v0.2.7 github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 - github.com/go-rod/rod v0.112.9 + github.com/go-rod/rod v0.113.0 github.com/go-sql-driver/mysql v1.7.1 github.com/go-webauthn/webauthn v0.5.0 github.com/golang-jwt/jwt/v4 v4.5.0 @@ -112,8 +112,9 @@ require ( github.com/tinylib/msgp v1.1.8 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect github.com/x448/float16 v0.8.4 // indirect - github.com/ysmood/fetchup v0.2.2 // indirect + github.com/ysmood/fetchup v0.2.3 // indirect github.com/ysmood/goob v0.4.0 // indirect + github.com/ysmood/got v0.34.1 // indirect github.com/ysmood/gson v0.7.3 // indirect github.com/ysmood/leakless v0.8.0 // indirect golang.org/x/crypto v0.7.0 // indirect diff --git a/go.sum b/go.sum index f29d3fce2..70ad7cfb5 100644 --- a/go.sum +++ b/go.sum @@ -144,8 +144,8 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI= github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo= -github.com/go-rod/rod v0.112.9 h1:uA/yLbB+t0UlqJcLJtK2pZrCNPzd15dOKRUEOnmnt9k= -github.com/go-rod/rod v0.112.9/go.mod h1:l0or0gEnZ7E5C0L/W7iD+yXBnm/OM3avP1ji74k8N9s= +github.com/go-rod/rod v0.113.0 h1:E7+GLjYVZnScewIB2u8+66joQLaDGbOLzSOT4orNHms= +github.com/go-rod/rod v0.113.0/go.mod h1:aiedSEFg5DwG/fnNbUOTPMTTWX3MRj6vIs/a684Mthw= github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI= github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= @@ -444,8 +444,8 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q= -github.com/ysmood/fetchup v0.2.2 h1:Qn8/q5uDW7szclt4sVXCFJ1TXup3hogz94OaLf6kloo= -github.com/ysmood/fetchup v0.2.2/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns= +github.com/ysmood/fetchup v0.2.3 h1:ulX+SonA0Vma5zUFXtv52Kzip/xe7aj4vqT5AJwQ+ZQ= +github.com/ysmood/fetchup v0.2.3/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns= github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ= github.com/ysmood/goob v0.4.0/go.mod h1:u6yx7ZhS4Exf2MwciFr6nIM8knHQIE22lFpWHnfql18= github.com/ysmood/gop v0.0.2 h1:VuWweTmXK+zedLqYufJdh3PlxDNBOfFHjIZlPT2T5nw= From a60c520d1e9c7e2625fe6143ffb09d1d6c7fa9be Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 16 May 2023 03:26:02 +1000 Subject: [PATCH 47/67] build(deps): update dependency vite to v4.3.6 (#5439) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 42 +++++++++++++++++++++--------------------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/web/package.json b/web/package.json index 42f57be4c..c14bd0a12 100644 --- a/web/package.json +++ b/web/package.json @@ -96,7 +96,7 @@ "prettier": "2.8.8", "react-test-renderer": "18.2.0", "typescript": "5.0.4", - "vite": "4.3.5", + "vite": "4.3.6", "vite-plugin-eslint": "1.8.1", "vite-plugin-istanbul": "4.0.1", "vite-plugin-svgr": "3.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 6d765fb6a..b23534163 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -113,7 +113,7 @@ devDependencies: version: 5.59.5(eslint@8.40.0)(typescript@5.0.4) '@vitejs/plugin-react': specifier: 4.0.0 - version: 4.0.0(vite@4.3.5) + version: 4.0.0(vite@4.3.6) '@vitest/coverage-istanbul': specifier: 0.31.0 version: 0.31.0(vitest@0.31.0) @@ -166,20 +166,20 @@ devDependencies: specifier: 5.0.4 version: 5.0.4 vite: - specifier: 4.3.5 - version: 4.3.5(@types/node@20.1.4) + specifier: 4.3.6 + version: 4.3.6(@types/node@20.1.4) vite-plugin-eslint: specifier: 1.8.1 - version: 1.8.1(eslint@8.40.0)(vite@4.3.5) + version: 1.8.1(eslint@8.40.0)(vite@4.3.6) vite-plugin-istanbul: specifier: 4.0.1 - version: 4.0.1(vite@4.3.5) + version: 4.0.1(vite@4.3.6) vite-plugin-svgr: specifier: 3.2.0 - version: 3.2.0(vite@4.3.5) + version: 3.2.0(vite@4.3.6) vite-tsconfig-paths: specifier: 4.2.0 - version: 4.2.0(typescript@5.0.4)(vite@4.3.5) + version: 4.2.0(typescript@5.0.4)(vite@4.3.6) vitest: specifier: 0.31.0 version: 0.31.0(happy-dom@9.18.3) @@ -3111,7 +3111,7 @@ packages: eslint-visitor-keys: 3.4.1 dev: true - /@vitejs/plugin-react@4.0.0(vite@4.3.5): + /@vitejs/plugin-react@4.0.0(vite@4.3.6): resolution: {integrity: sha512-HX0XzMjL3hhOYm+0s95pb0Z7F8O81G7joUHgfDd/9J/ZZf5k4xX6QAMFkKsHFxaHlf6X7GD7+XuaZ66ULiJuhQ==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.5(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.4) transitivePeerDependencies: - supports-color dev: true @@ -7410,7 +7410,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.5(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.4) transitivePeerDependencies: - '@types/node' - less @@ -7421,7 +7421,7 @@ packages: - terser dev: true - /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.5): + /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.6): resolution: {integrity: sha512-PqdMf3Y2fLO9FsNPmMX+//2BF5SF8nEWspZdgl4kSt7UvHDRHVVfHvxsD7ULYzZrJDGRxR81Nq7TOFgwMnUang==} peerDependencies: eslint: '>=7' @@ -7431,10 +7431,10 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.5(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.4) dev: true - /vite-plugin-istanbul@4.0.1(vite@4.3.5): + /vite-plugin-istanbul@4.0.1(vite@4.3.6): resolution: {integrity: sha512-1fUCJyYvt/vkDQWR/15knwCk+nWmNbVbmZTXf/X4XD0dcdmJsYrZF5JQo7ttYxFyflGH2SVu+XRlpN06CakKPQ==} peerDependencies: vite: '>=2.9.1 <= 5' @@ -7443,12 +7443,12 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.5(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.4) transitivePeerDependencies: - supports-color dev: true - /vite-plugin-svgr@3.2.0(vite@4.3.5): + /vite-plugin-svgr@3.2.0(vite@4.3.6): resolution: {integrity: sha512-Uvq6niTvhqJU6ga78qLKBFJSDvxWhOnyfQSoKpDPMAGxJPo5S3+9hyjExE5YDj6Lpa4uaLkGc1cBgxXov+LjSw==} peerDependencies: vite: ^2.6.0 || 3 || 4 @@ -7456,13 +7456,13 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.5(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.4) transitivePeerDependencies: - rollup - supports-color dev: true - /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.5): + /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.6): resolution: {integrity: sha512-jGpus0eUy5qbbMVGiTxCL1iB9ZGN6Bd37VGLJU39kTDD6ZfULTTb1bcc5IeTWqWJKiWV5YihCaibeASPiGi8kw==} peerDependencies: vite: '*' @@ -7473,7 +7473,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.5(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.4) transitivePeerDependencies: - supports-color - typescript @@ -7513,8 +7513,8 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.5(@types/node@20.1.4): - resolution: {integrity: sha512-0gEnL9wiRFxgz40o/i/eTBwm+NEbpUeTWhzKrZDSdKm6nplj+z4lKz8ANDgildxHm47Vg8EUia0aicKbawUVVA==} + /vite@4.3.6(@types/node@20.1.4): + resolution: {integrity: sha512-cqIyLSbA6gornMS659AXTVKF7cvSHMdKmJJwQ9DXq3lwsT1uZSdktuBRlpHQ8VnOWx0QHtjDwxPpGtyo9Fh/Qg==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true peerDependencies: @@ -7618,7 +7618,7 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.5(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.4) vite-node: 0.31.0(@types/node@20.1.4) why-is-node-running: 2.2.2 transitivePeerDependencies: From f3c5e84e92982cb6e520e6b711aaabd99b9929ae Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 16 May 2023 03:40:49 +1000 Subject: [PATCH 48/67] build(deps): update typescript-eslint monorepo to v5.59.6 (#5440) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 4 +- web/pnpm-lock.yaml | 110 ++++++++++++++++++++++----------------------- 2 files changed, 57 insertions(+), 57 deletions(-) diff --git a/web/package.json b/web/package.json index c14bd0a12..fb3b39c0b 100644 --- a/web/package.json +++ b/web/package.json @@ -76,8 +76,8 @@ "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", "@types/zxcvbn": "4.4.1", - "@typescript-eslint/eslint-plugin": "5.59.5", - "@typescript-eslint/parser": "5.59.5", + "@typescript-eslint/eslint-plugin": "5.59.6", + "@typescript-eslint/parser": "5.59.6", "@vitejs/plugin-react": "4.0.0", "@vitest/coverage-istanbul": "0.31.0", "esbuild": "0.17.19", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index b23534163..d2f250e06 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -106,11 +106,11 @@ devDependencies: specifier: 4.4.1 version: 4.4.1 '@typescript-eslint/eslint-plugin': - specifier: 5.59.5 - version: 5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4) + specifier: 5.59.6 + version: 5.59.6(@typescript-eslint/parser@5.59.6)(eslint@8.40.0)(typescript@5.0.4) '@typescript-eslint/parser': - specifier: 5.59.5 - version: 5.59.5(eslint@8.40.0)(typescript@5.0.4) + specifier: 5.59.6 + version: 5.59.6(eslint@8.40.0)(typescript@5.0.4) '@vitejs/plugin-react': specifier: 4.0.0 version: 4.0.0(vite@4.3.6) @@ -134,10 +134,10 @@ devDependencies: version: 1.0.5 eslint-import-resolver-typescript: specifier: 3.5.5 - version: 3.5.5(@typescript-eslint/parser@5.59.5)(eslint-plugin-import@2.27.5)(eslint@8.40.0) + version: 3.5.5(@typescript-eslint/parser@5.59.6)(eslint-plugin-import@2.27.5)(eslint@8.40.0) eslint-plugin-import: specifier: 2.27.5 - version: 2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + version: 2.27.5(@typescript-eslint/parser@5.59.6)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) eslint-plugin-jsx-a11y: specifier: 6.7.1 version: 6.7.1(eslint@8.40.0) @@ -2906,8 +2906,8 @@ packages: resolution: {integrity: sha512-3NoqvZC2W5gAC5DZbTpCeJ251vGQmgcWIHQJGq2J240HY6ErQ9aWKkwfoKJlHLx+A83WPNTZ9+3cd2ILxbvr1w==} dev: true - /@typescript-eslint/eslint-plugin@5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-feA9xbVRWJZor+AnLNAr7A8JRWeZqHUf4T9tlP+TN04b05pFVhO5eN7/O93Y/1OUlLMHKbnJisgDURs/qvtqdg==} + /@typescript-eslint/eslint-plugin@5.59.6(@typescript-eslint/parser@5.59.6)(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-sXtOgJNEuRU5RLwPUb1jxtToZbgvq3M6FPpY4QENxoOggK+UpTxUBpj6tD8+Qh2g46Pi9We87E+eHnUw8YcGsw==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: '@typescript-eslint/parser': ^5.0.0 @@ -2918,10 +2918,10 @@ packages: optional: true dependencies: '@eslint-community/regexpp': 4.5.0 - '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) - '@typescript-eslint/scope-manager': 5.59.5 - '@typescript-eslint/type-utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.6(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.6 + '@typescript-eslint/type-utils': 5.59.6(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.6(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 eslint: 8.40.0 grapheme-splitter: 1.0.4 @@ -2947,8 +2947,8 @@ packages: - typescript dev: true - /@typescript-eslint/parser@5.59.5(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-NJXQC4MRnF9N9yWqQE2/KLRSOLvrrlZb48NGVfBa+RuPMN6B7ZcK5jZOvhuygv4D64fRKnZI4L4p8+M+rfeQuw==} + /@typescript-eslint/parser@5.59.6(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-7pCa6al03Pv1yf/dUg/s1pXz/yGMUBAw5EeWqNTFiSueKvRNonze3hma3lhdsOrQcaOXhbk5gKu2Fludiho9VA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -2957,9 +2957,9 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/scope-manager': 5.59.5 - '@typescript-eslint/types': 5.59.5 - '@typescript-eslint/typescript-estree': 5.59.5(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.6 + '@typescript-eslint/types': 5.59.6 + '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.0.4) debug: 4.3.4 eslint: 8.40.0 typescript: 5.0.4 @@ -2975,16 +2975,16 @@ packages: '@typescript-eslint/visitor-keys': 5.58.0 dev: true - /@typescript-eslint/scope-manager@5.59.5: - resolution: {integrity: sha512-jVecWwnkX6ZgutF+DovbBJirZcAxgxC0EOHYt/niMROf8p4PwxxG32Qdhj/iIQQIuOflLjNkxoXyArkcIP7C3A==} + /@typescript-eslint/scope-manager@5.59.6: + resolution: {integrity: sha512-gLbY3Le9Dxcb8KdpF0+SJr6EQ+hFGYFl6tVY8VxLPFDfUZC7BHFw+Vq7bM5lE9DwWPfx4vMWWTLGXgpc0mAYyQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: - '@typescript-eslint/types': 5.59.5 - '@typescript-eslint/visitor-keys': 5.59.5 + '@typescript-eslint/types': 5.59.6 + '@typescript-eslint/visitor-keys': 5.59.6 dev: true - /@typescript-eslint/type-utils@5.59.5(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-4eyhS7oGym67/pSxA2mmNq7X164oqDYNnZCUayBwJZIRVvKpBCMBzFnFxjeoDeShjtO6RQBHBuwybuX3POnDqg==} + /@typescript-eslint/type-utils@5.59.6(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-A4tms2Mp5yNvLDlySF+kAThV9VTBPCvGf0Rp8nl/eoDX9Okun8byTKoj3fJ52IJitjWOk0fKPNQhXEB++eNozQ==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: '*' @@ -2993,8 +2993,8 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/typescript-estree': 5.59.5(typescript@5.0.4) - '@typescript-eslint/utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.6(eslint@8.40.0)(typescript@5.0.4) debug: 4.3.4 eslint: 8.40.0 tsutils: 3.21.0(typescript@5.0.4) @@ -3008,8 +3008,8 @@ packages: engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true - /@typescript-eslint/types@5.59.5: - resolution: {integrity: sha512-xkfRPHbqSH4Ggx4eHRIO/eGL8XL4Ysb4woL8c87YuAo8Md7AUjyWKa9YMwTL519SyDPrfEgKdewjkxNCVeJW7w==} + /@typescript-eslint/types@5.59.6: + resolution: {integrity: sha512-tH5lBXZI7T2MOUgOWFdVNUILsI02shyQvfzG9EJkoONWugCG77NDDa1EeDGw7oJ5IvsTAAGVV8I3Tk2PNu9QfA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dev: true @@ -3034,8 +3034,8 @@ packages: - supports-color dev: true - /@typescript-eslint/typescript-estree@5.59.5(typescript@5.0.4): - resolution: {integrity: sha512-+XXdLN2CZLZcD/mO7mQtJMvCkzRfmODbeSKuMY/yXbGkzvA9rJyDY5qDYNoiz2kP/dmyAxXquL2BvLQLJFPQIg==} + /@typescript-eslint/typescript-estree@5.59.6(typescript@5.0.4): + resolution: {integrity: sha512-vW6JP3lMAs/Tq4KjdI/RiHaaJSO7IUsbkz17it/Rl9Q+WkQ77EOuOnlbaU8kKfVIOJxMhnRiBG+olE7f3M16DA==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: typescript: '*' @@ -3043,8 +3043,8 @@ packages: typescript: optional: true dependencies: - '@typescript-eslint/types': 5.59.5 - '@typescript-eslint/visitor-keys': 5.59.5 + '@typescript-eslint/types': 5.59.6 + '@typescript-eslint/visitor-keys': 5.59.6 debug: 4.3.4 globby: 11.1.0 is-glob: 4.0.3 @@ -3075,8 +3075,8 @@ packages: - typescript dev: true - /@typescript-eslint/utils@5.59.5(eslint@8.40.0)(typescript@5.0.4): - resolution: {integrity: sha512-sCEHOiw+RbyTii9c3/qN74hYDPNORb8yWCoPLmB7BIflhplJ65u2PBpdRla12e3SSTJ2erRkPjz7ngLHhUegxA==} + /@typescript-eslint/utils@5.59.6(eslint@8.40.0)(typescript@5.0.4): + resolution: {integrity: sha512-vzaaD6EXbTS29cVH0JjXBdzMt6VBlv+hE31XktDRMX1j3462wZCJa7VzO2AxXEXcIl8GQqZPcOPuW/Z1tZVogg==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} peerDependencies: eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -3084,9 +3084,9 @@ packages: '@eslint-community/eslint-utils': 4.4.0(eslint@8.40.0) '@types/json-schema': 7.0.11 '@types/semver': 7.3.13 - '@typescript-eslint/scope-manager': 5.59.5 - '@typescript-eslint/types': 5.59.5 - '@typescript-eslint/typescript-estree': 5.59.5(typescript@5.0.4) + '@typescript-eslint/scope-manager': 5.59.6 + '@typescript-eslint/types': 5.59.6 + '@typescript-eslint/typescript-estree': 5.59.6(typescript@5.0.4) eslint: 8.40.0 eslint-scope: 5.1.1 semver: 7.5.0 @@ -3103,11 +3103,11 @@ packages: eslint-visitor-keys: 3.4.1 dev: true - /@typescript-eslint/visitor-keys@5.59.5: - resolution: {integrity: sha512-qL+Oz+dbeBRTeyJTIy0eniD3uvqU7x+y1QceBismZ41hd4aBSRh8UAw4pZP0+XzLuPZmx4raNMq/I+59W2lXKA==} + /@typescript-eslint/visitor-keys@5.59.6: + resolution: {integrity: sha512-zEfbFLzB9ETcEJ4HZEEsCR9HHeNku5/Qw1jSS5McYJv5BR+ftYXwFFAH5Al+xkGaZEqowMwl7uoJjQb1YSPF8Q==} engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0} dependencies: - '@typescript-eslint/types': 5.59.5 + '@typescript-eslint/types': 5.59.6 eslint-visitor-keys: 3.4.1 dev: true @@ -4386,14 +4386,14 @@ packages: '@babel/core': 7.21.4 '@babel/eslint-parser': 7.21.3(@babel/core@7.21.4)(eslint@8.40.0) '@rushstack/eslint-patch': 1.2.0 - '@typescript-eslint/eslint-plugin': 5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4) - '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/eslint-plugin': 5.59.6(@typescript-eslint/parser@5.59.6)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.6(eslint@8.40.0)(typescript@5.0.4) babel-preset-react-app: 10.0.1 confusing-browser-globals: 1.0.11 eslint: 8.40.0 eslint-plugin-flowtype: 8.0.3(@babel/plugin-syntax-flow@7.21.4)(@babel/plugin-transform-react-jsx@7.21.0)(eslint@8.40.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) - eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.5)(eslint@8.40.0)(typescript@5.0.4) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.6)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-jest: 25.7.0(@typescript-eslint/eslint-plugin@5.59.6)(eslint@8.40.0)(typescript@5.0.4) eslint-plugin-jsx-a11y: 6.7.1(eslint@8.40.0) eslint-plugin-react: 7.32.2(eslint@8.40.0) eslint-plugin-react-hooks: 4.6.0(eslint@8.40.0) @@ -4422,7 +4422,7 @@ packages: - supports-color dev: true - /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.5)(eslint-plugin-import@2.27.5)(eslint@8.40.0): + /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.59.6)(eslint-plugin-import@2.27.5)(eslint@8.40.0): resolution: {integrity: sha512-TdJqPHs2lW5J9Zpe17DZNQuDnox4xo2o+0tE7Pggain9Rbc19ik8kFtXdxZ250FVx2kF4vlt2RSf4qlUpG7bhw==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -4432,8 +4432,8 @@ packages: debug: 4.3.4 enhanced-resolve: 5.12.0 eslint: 8.40.0 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) - eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.6)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.59.6)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) get-tsconfig: 4.5.0 globby: 13.1.3 is-core-module: 2.12.0 @@ -4446,7 +4446,7 @@ packages: - supports-color dev: true - /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): + /eslint-module-utils@2.7.4(@typescript-eslint/parser@5.59.6)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-j4GT+rqzCoRKHwURX7pddtIPGySnX9Si/cgMI5ztrcqOPtk5dDEeZ34CQVPphnqkJytlc97Vuk05Um2mJ3gEQA==} engines: {node: '>=4'} peerDependencies: @@ -4467,11 +4467,11 @@ packages: eslint-import-resolver-webpack: optional: true dependencies: - '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.6(eslint@8.40.0)(typescript@5.0.4) debug: 3.2.7 eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.5)(eslint-plugin-import@2.27.5)(eslint@8.40.0) + eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.59.6)(eslint-plugin-import@2.27.5)(eslint@8.40.0) transitivePeerDependencies: - supports-color dev: true @@ -4491,7 +4491,7 @@ packages: string-natural-compare: 3.0.1 dev: true - /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): + /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.59.6)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0): resolution: {integrity: sha512-LmEt3GVofgiGuiE+ORpnvP+kAm3h6MLZJ4Q5HCyHADofsb4VzXFsRiWj3c0OFiV+3DWFh0qg3v9gcPlfc3zRow==} engines: {node: '>=4'} peerDependencies: @@ -4501,7 +4501,7 @@ packages: '@typescript-eslint/parser': optional: true dependencies: - '@typescript-eslint/parser': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/parser': 5.59.6(eslint@8.40.0)(typescript@5.0.4) array-includes: 3.1.6 array.prototype.flat: 1.3.1 array.prototype.flatmap: 1.3.1 @@ -4509,7 +4509,7 @@ packages: doctrine: 2.1.0 eslint: 8.40.0 eslint-import-resolver-node: 0.3.7 - eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.5)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) + eslint-module-utils: 2.7.4(@typescript-eslint/parser@5.59.6)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.40.0) has: 1.0.3 is-core-module: 2.12.0 is-glob: 4.0.3 @@ -4524,7 +4524,7 @@ packages: - supports-color dev: true - /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.5)(eslint@8.40.0)(typescript@5.0.4): + /eslint-plugin-jest@25.7.0(@typescript-eslint/eslint-plugin@5.59.6)(eslint@8.40.0)(typescript@5.0.4): resolution: {integrity: sha512-PWLUEXeeF7C9QGKqvdSbzLOiLTx+bno7/HC9eefePfEb257QFHg7ye3dh80AZVkaa/RQsBB1Q/ORQvg2X7F0NQ==} engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0} peerDependencies: @@ -4537,7 +4537,7 @@ packages: jest: optional: true dependencies: - '@typescript-eslint/eslint-plugin': 5.59.5(@typescript-eslint/parser@5.59.5)(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/eslint-plugin': 5.59.6(@typescript-eslint/parser@5.59.6)(eslint@8.40.0)(typescript@5.0.4) '@typescript-eslint/experimental-utils': 5.58.0(eslint@8.40.0)(typescript@5.0.4) eslint: 8.40.0 transitivePeerDependencies: @@ -4626,7 +4626,7 @@ packages: peerDependencies: eslint: ^7.5.0 || ^8.0.0 dependencies: - '@typescript-eslint/utils': 5.59.5(eslint@8.40.0)(typescript@5.0.4) + '@typescript-eslint/utils': 5.59.6(eslint@8.40.0)(typescript@5.0.4) eslint: 8.40.0 transitivePeerDependencies: - supports-color From 27e5ba2858806b10133324717bc8da5ac723480a Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 16 May 2023 12:58:49 +1000 Subject: [PATCH 49/67] build(deps): update dependency @types/node to v20.1.5 (#5441) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index fb3b39c0b..7c73d8602 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.1.4", + "@types/node": "20.1.5", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index d2f250e06..e59bcbe16 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.1.4 - version: 20.1.4 + specifier: 20.1.5 + version: 20.1.5 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.6 - version: 4.3.6(@types/node@20.1.4) + version: 4.3.6(@types/node@20.1.5) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.6) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.1.4 + '@types/node': 20.1.5 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.4)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.1.4)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.5)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2195,7 +2195,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.1.4 + '@types/node': 20.1.5 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2731,7 +2731,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.1.4 + '@types/node': 20.1.5 dev: true /@types/chai-subset@1.3.3: @@ -2747,7 +2747,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.1.4 + '@types/node': 20.1.5 dev: true /@types/eslint@8.37.0: @@ -2764,7 +2764,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.1.4 + '@types/node': 20.1.5 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2821,8 +2821,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.1.4: - resolution: {integrity: sha512-At4pvmIOki8yuwLtd7BNHl3CiWNbtclUbNtScGx4OHfBd4/oWoJC8KRCIxXwkdndzhxOsPXihrsOoydxBjlE9Q==} + /@types/node@20.1.5: + resolution: {integrity: sha512-IvGD1CD/nego63ySR7vrAKEX3AJTcmrAN2kn+/sDNLi1Ff5kBzDeEdqWDplK+0HAEoLYej137Sk0cUU8OLOlMg==} dev: true /@types/normalize-package-data@2.4.1: @@ -2879,7 +2879,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.1.4 + '@types/node': 20.1.5 dev: true /@types/stack-utils@2.0.1: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.6(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.5) transitivePeerDependencies: - supports-color dev: true @@ -3742,7 +3742,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.4)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3751,9 +3751,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.1.4 + '@types/node': 20.1.5 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.1.4)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.5)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5641,7 +5641,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.1.4 + '@types/node': 20.1.5 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7183,7 +7183,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.1.4)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.5)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7202,7 +7202,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.1.4 + '@types/node': 20.1.5 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7400,7 +7400,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@20.1.4): + /vite-node@0.31.0(@types/node@20.1.5): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7410,7 +7410,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.6(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.5) transitivePeerDependencies: - '@types/node' - less @@ -7431,7 +7431,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.6(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.5) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.6): @@ -7443,7 +7443,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.6(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.5) transitivePeerDependencies: - supports-color dev: true @@ -7456,7 +7456,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.6(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.5) transitivePeerDependencies: - rollup - supports-color @@ -7473,7 +7473,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.6(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.5) transitivePeerDependencies: - supports-color - typescript @@ -7513,7 +7513,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.6(@types/node@20.1.4): + /vite@4.3.6(@types/node@20.1.5): resolution: {integrity: sha512-cqIyLSbA6gornMS659AXTVKF7cvSHMdKmJJwQ9DXq3lwsT1uZSdktuBRlpHQ8VnOWx0QHtjDwxPpGtyo9Fh/Qg==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7538,7 +7538,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.1.4 + '@types/node': 20.1.5 esbuild: 0.17.19 postcss: 8.4.23 rollup: 3.21.0 @@ -7597,7 +7597,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 20.1.4 + '@types/node': 20.1.5 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7618,8 +7618,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.6(@types/node@20.1.4) - vite-node: 0.31.0(@types/node@20.1.4) + vite: 4.3.6(@types/node@20.1.5) + vite-node: 0.31.0(@types/node@20.1.5) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 987d6775761f28853c6a50b156a242bf48e4bcad Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 17 May 2023 09:23:19 +1000 Subject: [PATCH 50/67] build(deps): update dependency @types/node to v20.1.7 (#5443) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index 7c73d8602..8daf6f930 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.1.5", + "@types/node": "20.1.7", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index e59bcbe16..61c7b3d79 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.1.5 - version: 20.1.5 + specifier: 20.1.7 + version: 20.1.7 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.6 - version: 4.3.6(@types/node@20.1.5) + version: 4.3.6(@types/node@20.1.7) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.6) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.1.5 + '@types/node': 20.1.7 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.7)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.1.5)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.7)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2195,7 +2195,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.1.5 + '@types/node': 20.1.7 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2731,7 +2731,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.1.5 + '@types/node': 20.1.7 dev: true /@types/chai-subset@1.3.3: @@ -2747,7 +2747,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.1.5 + '@types/node': 20.1.7 dev: true /@types/eslint@8.37.0: @@ -2764,7 +2764,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.1.5 + '@types/node': 20.1.7 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2821,8 +2821,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.1.5: - resolution: {integrity: sha512-IvGD1CD/nego63ySR7vrAKEX3AJTcmrAN2kn+/sDNLi1Ff5kBzDeEdqWDplK+0HAEoLYej137Sk0cUU8OLOlMg==} + /@types/node@20.1.7: + resolution: {integrity: sha512-WCuw/o4GSwDGMoonES8rcvwsig77dGCMbZDrZr2x4ZZiNW4P/gcoZXe/0twgtobcTkmg9TuKflxYL/DuwDyJzg==} dev: true /@types/normalize-package-data@2.4.1: @@ -2879,7 +2879,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.1.5 + '@types/node': 20.1.7 dev: true /@types/stack-utils@2.0.1: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.6(@types/node@20.1.5) + vite: 4.3.6(@types/node@20.1.7) transitivePeerDependencies: - supports-color dev: true @@ -3742,7 +3742,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.5)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.7)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3751,9 +3751,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.1.5 + '@types/node': 20.1.7 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.1.5)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.1.7)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5641,7 +5641,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.1.5 + '@types/node': 20.1.7 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7183,7 +7183,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.1.5)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.1.7)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7202,7 +7202,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.1.5 + '@types/node': 20.1.7 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7400,7 +7400,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@20.1.5): + /vite-node@0.31.0(@types/node@20.1.7): resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7410,7 +7410,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.6(@types/node@20.1.5) + vite: 4.3.6(@types/node@20.1.7) transitivePeerDependencies: - '@types/node' - less @@ -7431,7 +7431,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.6(@types/node@20.1.5) + vite: 4.3.6(@types/node@20.1.7) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.6): @@ -7443,7 +7443,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.6(@types/node@20.1.5) + vite: 4.3.6(@types/node@20.1.7) transitivePeerDependencies: - supports-color dev: true @@ -7456,7 +7456,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.6(@types/node@20.1.5) + vite: 4.3.6(@types/node@20.1.7) transitivePeerDependencies: - rollup - supports-color @@ -7473,7 +7473,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.6(@types/node@20.1.5) + vite: 4.3.6(@types/node@20.1.7) transitivePeerDependencies: - supports-color - typescript @@ -7513,7 +7513,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.6(@types/node@20.1.5): + /vite@4.3.6(@types/node@20.1.7): resolution: {integrity: sha512-cqIyLSbA6gornMS659AXTVKF7cvSHMdKmJJwQ9DXq3lwsT1uZSdktuBRlpHQ8VnOWx0QHtjDwxPpGtyo9Fh/Qg==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7538,7 +7538,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.1.5 + '@types/node': 20.1.7 esbuild: 0.17.19 postcss: 8.4.23 rollup: 3.21.0 @@ -7597,7 +7597,7 @@ packages: dependencies: '@types/chai': 4.3.4 '@types/chai-subset': 1.3.3 - '@types/node': 20.1.5 + '@types/node': 20.1.7 '@vitest/expect': 0.31.0 '@vitest/runner': 0.31.0 '@vitest/snapshot': 0.31.0 @@ -7618,8 +7618,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.6(@types/node@20.1.5) - vite-node: 0.31.0(@types/node@20.1.5) + vite: 4.3.6(@types/node@20.1.7) + vite-node: 0.31.0(@types/node@20.1.7) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From b1df0529e972d6456766fff26b74b6379e4ece60 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 17 May 2023 09:37:46 +1000 Subject: [PATCH 51/67] build(deps): update dependency vite to v4.3.7 (#5442) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 42 +++++++++++++++++++++--------------------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/web/package.json b/web/package.json index 8daf6f930..079251ce9 100644 --- a/web/package.json +++ b/web/package.json @@ -96,7 +96,7 @@ "prettier": "2.8.8", "react-test-renderer": "18.2.0", "typescript": "5.0.4", - "vite": "4.3.6", + "vite": "4.3.7", "vite-plugin-eslint": "1.8.1", "vite-plugin-istanbul": "4.0.1", "vite-plugin-svgr": "3.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 61c7b3d79..82ae4fc29 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -113,7 +113,7 @@ devDependencies: version: 5.59.6(eslint@8.40.0)(typescript@5.0.4) '@vitejs/plugin-react': specifier: 4.0.0 - version: 4.0.0(vite@4.3.6) + version: 4.0.0(vite@4.3.7) '@vitest/coverage-istanbul': specifier: 0.31.0 version: 0.31.0(vitest@0.31.0) @@ -166,20 +166,20 @@ devDependencies: specifier: 5.0.4 version: 5.0.4 vite: - specifier: 4.3.6 - version: 4.3.6(@types/node@20.1.7) + specifier: 4.3.7 + version: 4.3.7(@types/node@20.1.7) vite-plugin-eslint: specifier: 1.8.1 - version: 1.8.1(eslint@8.40.0)(vite@4.3.6) + version: 1.8.1(eslint@8.40.0)(vite@4.3.7) vite-plugin-istanbul: specifier: 4.0.1 - version: 4.0.1(vite@4.3.6) + version: 4.0.1(vite@4.3.7) vite-plugin-svgr: specifier: 3.2.0 - version: 3.2.0(vite@4.3.6) + version: 3.2.0(vite@4.3.7) vite-tsconfig-paths: specifier: 4.2.0 - version: 4.2.0(typescript@5.0.4)(vite@4.3.6) + version: 4.2.0(typescript@5.0.4)(vite@4.3.7) vitest: specifier: 0.31.0 version: 0.31.0(happy-dom@9.18.3) @@ -3111,7 +3111,7 @@ packages: eslint-visitor-keys: 3.4.1 dev: true - /@vitejs/plugin-react@4.0.0(vite@4.3.6): + /@vitejs/plugin-react@4.0.0(vite@4.3.7): resolution: {integrity: sha512-HX0XzMjL3hhOYm+0s95pb0Z7F8O81G7joUHgfDd/9J/ZZf5k4xX6QAMFkKsHFxaHlf6X7GD7+XuaZ66ULiJuhQ==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -3121,7 +3121,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.6(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.1.7) transitivePeerDependencies: - supports-color dev: true @@ -7410,7 +7410,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.6(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.1.7) transitivePeerDependencies: - '@types/node' - less @@ -7421,7 +7421,7 @@ packages: - terser dev: true - /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.6): + /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.7): resolution: {integrity: sha512-PqdMf3Y2fLO9FsNPmMX+//2BF5SF8nEWspZdgl4kSt7UvHDRHVVfHvxsD7ULYzZrJDGRxR81Nq7TOFgwMnUang==} peerDependencies: eslint: '>=7' @@ -7431,10 +7431,10 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.6(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.1.7) dev: true - /vite-plugin-istanbul@4.0.1(vite@4.3.6): + /vite-plugin-istanbul@4.0.1(vite@4.3.7): resolution: {integrity: sha512-1fUCJyYvt/vkDQWR/15knwCk+nWmNbVbmZTXf/X4XD0dcdmJsYrZF5JQo7ttYxFyflGH2SVu+XRlpN06CakKPQ==} peerDependencies: vite: '>=2.9.1 <= 5' @@ -7443,12 +7443,12 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.6(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.1.7) transitivePeerDependencies: - supports-color dev: true - /vite-plugin-svgr@3.2.0(vite@4.3.6): + /vite-plugin-svgr@3.2.0(vite@4.3.7): resolution: {integrity: sha512-Uvq6niTvhqJU6ga78qLKBFJSDvxWhOnyfQSoKpDPMAGxJPo5S3+9hyjExE5YDj6Lpa4uaLkGc1cBgxXov+LjSw==} peerDependencies: vite: ^2.6.0 || 3 || 4 @@ -7456,13 +7456,13 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.6(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.1.7) transitivePeerDependencies: - rollup - supports-color dev: true - /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.6): + /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.7): resolution: {integrity: sha512-jGpus0eUy5qbbMVGiTxCL1iB9ZGN6Bd37VGLJU39kTDD6ZfULTTb1bcc5IeTWqWJKiWV5YihCaibeASPiGi8kw==} peerDependencies: vite: '*' @@ -7473,7 +7473,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.6(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.1.7) transitivePeerDependencies: - supports-color - typescript @@ -7513,8 +7513,8 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.6(@types/node@20.1.7): - resolution: {integrity: sha512-cqIyLSbA6gornMS659AXTVKF7cvSHMdKmJJwQ9DXq3lwsT1uZSdktuBRlpHQ8VnOWx0QHtjDwxPpGtyo9Fh/Qg==} + /vite@4.3.7(@types/node@20.1.7): + resolution: {integrity: sha512-MTIFpbIm9v7Hh5b0wSBgkcWzSBz7SAa6K/cBTwS4kUiQJfQLFlZZRJRQgqunCVzhTPCk674tW+0Qaqh3Q00dBg==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true peerDependencies: @@ -7618,7 +7618,7 @@ packages: strip-literal: 1.0.1 tinybench: 2.4.0 tinypool: 0.5.0 - vite: 4.3.6(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.1.7) vite-node: 0.31.0(@types/node@20.1.7) why-is-node-running: 2.2.2 transitivePeerDependencies: From 7eee5fd06b2716bf8d2e4340b90bcbb4163892ff Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 17 May 2023 09:49:41 +1000 Subject: [PATCH 52/67] build(deps): update module github.com/sirupsen/logrus to v1.9.1 (#5444) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 26c7c7803..c06fb45e5 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( github.com/pkg/errors v0.9.1 github.com/pquerna/otp v1.4.0 github.com/prometheus/client_golang v1.15.1 - github.com/sirupsen/logrus v1.9.0 + github.com/sirupsen/logrus v1.9.1 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 diff --git a/go.sum b/go.sum index 70ad7cfb5..c10fddafd 100644 --- a/go.sum +++ b/go.sum @@ -385,8 +385,8 @@ github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee h1:8Iv5m6xEo1NR1Avp github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee/go.mod h1:qwtSXrKuJh/zsFQ12yEE89xfCrGKK63Rr7ctU/uCo4g= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= -github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0= -github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= +github.com/sirupsen/logrus v1.9.1 h1:Ou41VVR3nMWWmTiEUnj0OlsgOSCUFgsPAOl6jRIcVtQ= +github.com/sirupsen/logrus v1.9.1/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM= github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ= From d2ae27220e7c29b84a05cf7b68da4bc27f1ceb6e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 17 May 2023 16:32:40 +1000 Subject: [PATCH 53/67] build(deps): update dependency @mui/styles to v5.13.1 (#5447) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 52 ++++++++++++++++++++++++++++++---------------- 2 files changed, 35 insertions(+), 19 deletions(-) diff --git a/web/package.json b/web/package.json index 079251ce9..4c462ef7b 100644 --- a/web/package.json +++ b/web/package.json @@ -20,7 +20,7 @@ "@fortawesome/react-fontawesome": "0.2.0", "@mui/icons-material": "5.11.16", "@mui/material": "5.13.0", - "@mui/styles": "5.12.3", + "@mui/styles": "5.13.1", "axios": "1.4.0", "broadcast-channel": "5.1.0", "classnames": "2.3.2", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 82ae4fc29..25499bc4d 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -29,8 +29,8 @@ dependencies: specifier: 5.13.0 version: 5.13.0(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/styles': - specifier: 5.12.3 - version: 5.12.3(@types/react@18.2.6)(react@18.2.0) + specifier: 5.13.1 + version: 5.13.1(@types/react@18.2.6)(react@18.2.0) axios: specifier: 1.4.0 version: 1.4.0 @@ -1750,10 +1750,6 @@ packages: stylis: 4.2.0 dev: false - /@emotion/hash@0.9.0: - resolution: {integrity: sha512-14FtKiHhy2QoPIzdTcvh//8OyBlknNs2nXRwIhG904opCby3l+9Xaf/wuPvICBF0rc1ZCNBd3nKe9cd2mecVkQ==} - dev: false - /@emotion/hash@0.9.1: resolution: {integrity: sha512-gJB6HLm5rYwSLI6PQa+X1t5CFGrv1J1TWG+sOyMCeKz2ojaj6Fnl/rZEspogG+cvqbt4AE/2eIyD2QfLKTBNlQ==} dev: false @@ -2273,7 +2269,7 @@ packages: '@babel/runtime': 7.21.0 '@emotion/is-prop-valid': 1.2.1 '@mui/types': 7.2.4(@types/react@18.2.6) - '@mui/utils': 5.12.3(react@18.2.0) + '@mui/utils': 5.13.1(react@18.2.0) '@popperjs/core': 2.11.7 '@types/react': 18.2.6 clsx: 1.2.1 @@ -2340,8 +2336,8 @@ packages: react-transition-group: 4.4.5(react-dom@18.2.0)(react@18.2.0) dev: false - /@mui/private-theming@5.12.3(@types/react@18.2.6)(react@18.2.0): - resolution: {integrity: sha512-o1e7Z1Bp27n4x2iUHhegV4/Jp6H3T6iBKHJdLivS5GbwsuAE/5l4SnZ+7+K+e5u9TuhwcAKZLkjvqzkDe8zqfA==} + /@mui/private-theming@5.13.1(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-HW4npLUD9BAkVppOUZHeO1FOKUJWAwbpy0VQoGe3McUYTlck1HezGHQCfBQ5S/Nszi7EViqiimECVl9xi+/WjQ==} engines: {node: '>=12.0.0'} peerDependencies: '@types/react': ^17.0.0 || ^18.0.0 || 18 @@ -2351,7 +2347,7 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@mui/utils': 5.12.3(react@18.2.0) + '@mui/utils': 5.13.1(react@18.2.0) '@types/react': 18.2.6 prop-types: 15.8.1 react: 18.2.0 @@ -2379,21 +2375,21 @@ packages: react: 18.2.0 dev: false - /@mui/styles@5.12.3(@types/react@18.2.6)(react@18.2.0): - resolution: {integrity: sha512-y0GN1kTYO2FF/0LH8a0PpVxwLotlcunFqdJpCL5gza0w5Fqz9wxlwauPZW0bDt0+sF79CrohzdzWkh+fxB+oww==} + /@mui/styles@5.13.1(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-Y4Mw5O0OQCv+y+8RexSJLaHI9h9ISf5gl3oHDMKI9m3p3Af3d0I9E406psAAfeJnEUgTvELFQ5qQL0E6i9LzRw==} engines: {node: '>=12.0.0'} peerDependencies: - '@types/react': ^17.0.0 || 18 + '@types/react': ^17.0.0 || ^18.0.0 || 18 react: ^17.0.0 || 18 peerDependenciesMeta: '@types/react': optional: true dependencies: '@babel/runtime': 7.21.0 - '@emotion/hash': 0.9.0 - '@mui/private-theming': 5.12.3(@types/react@18.2.6)(react@18.2.0) + '@emotion/hash': 0.9.1 + '@mui/private-theming': 5.13.1(@types/react@18.2.6)(react@18.2.0) '@mui/types': 7.2.4(@types/react@18.2.6) - '@mui/utils': 5.12.3(react@18.2.0) + '@mui/utils': 5.13.1(react@18.2.0) '@types/react': 18.2.6 clsx: 1.2.1 csstype: 3.1.2 @@ -2429,10 +2425,10 @@ packages: '@babel/runtime': 7.21.0 '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) - '@mui/private-theming': 5.12.3(@types/react@18.2.6)(react@18.2.0) + '@mui/private-theming': 5.13.1(@types/react@18.2.6)(react@18.2.0) '@mui/styled-engine': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(react@18.2.0) '@mui/types': 7.2.4(@types/react@18.2.6) - '@mui/utils': 5.12.3(react@18.2.0) + '@mui/utils': 5.13.1(react@18.2.0) '@types/react': 18.2.6 clsx: 1.2.1 csstype: 3.1.2 @@ -2465,6 +2461,20 @@ packages: react-is: 18.2.0 dev: false + /@mui/utils@5.13.1(react@18.2.0): + resolution: {integrity: sha512-6lXdWwmlUbEU2jUI8blw38Kt+3ly7xkmV9ljzY4Q20WhsJMWiNry9CX8M+TaP/HbtuyR8XKsdMgQW7h7MM3n3A==} + engines: {node: '>=12.0.0'} + peerDependencies: + react: ^17.0.0 || ^18.0.0 || 18 + dependencies: + '@babel/runtime': 7.21.0 + '@types/prop-types': 15.7.5 + '@types/react-is': 18.2.0 + prop-types: 15.8.1 + react: 18.2.0 + react-is: 18.2.0 + dev: false + /@nicolo-ribaudo/eslint-scope-5-internals@5.1.1-v1: resolution: {integrity: sha512-54/JRvkLIzzDWshCWfuhadfrfZVPiElY8Fcgmg1HroEly/EDSszzhBAsarCux+D/kOslTRquNzuyGSmUSTTHGg==} dependencies: @@ -2855,6 +2865,12 @@ packages: '@types/react': 18.2.6 dev: false + /@types/react-is@18.2.0: + resolution: {integrity: sha512-1vz2yObaQkLL7YFe/pme2cpvDsCwI1WXIfL+5eLz0MI9gFG24Re16RzUsI8t9XZn9ZWvgLNDrJBmrqXJO7GNQQ==} + dependencies: + '@types/react': 18.2.6 + dev: false + /@types/react-transition-group@4.4.6: resolution: {integrity: sha512-VnCdSxfcm08KjsJVQcfBmhEQAPnLB8G08hAxn39azX1qYBQ/5RVQuoHuKIcfKOdncuaUvEpFKFzEvbtIMsfVew==} dependencies: From 089082f295163a6d199d8d14204c4f23816187ad Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 17 May 2023 16:49:34 +1000 Subject: [PATCH 54/67] build(deps): update dependency @mui/material to v5.13.1 (#5446) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 54 +++++++++++++++------------------------------- 2 files changed, 18 insertions(+), 38 deletions(-) diff --git a/web/package.json b/web/package.json index 4c462ef7b..7d0239d9f 100644 --- a/web/package.json +++ b/web/package.json @@ -19,7 +19,7 @@ "@fortawesome/free-solid-svg-icons": "6.4.0", "@fortawesome/react-fontawesome": "0.2.0", "@mui/icons-material": "5.11.16", - "@mui/material": "5.13.0", + "@mui/material": "5.13.1", "@mui/styles": "5.13.1", "axios": "1.4.0", "broadcast-channel": "5.1.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 25499bc4d..ce9dd96bd 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -24,10 +24,10 @@ dependencies: version: 0.2.0(@fortawesome/fontawesome-svg-core@6.4.0)(react@18.2.0) '@mui/icons-material': specifier: 5.11.16 - version: 5.11.16(@mui/material@5.13.0)(@types/react@18.2.6)(react@18.2.0) + version: 5.11.16(@mui/material@5.13.1)(@types/react@18.2.6)(react@18.2.0) '@mui/material': - specifier: 5.13.0 - version: 5.13.0(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + specifier: 5.13.1 + version: 5.13.1(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@mui/styles': specifier: 5.13.1 version: 5.13.1(@types/react@18.2.6)(react@18.2.0) @@ -2255,8 +2255,8 @@ packages: tsconfig-paths: 3.14.2 dev: true - /@mui/base@5.0.0-beta.0(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-ap+juKvt8R8n3cBqd/pGtZydQ4v2I/hgJKnvJRGjpSh3RvsvnDHO4rXov8MHQlH6VqpOekwgilFLGxMZjNTucA==} + /@mui/base@5.0.0-beta.1(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-xrkDCeu3JQE+JjJUnJnOrdQJMXwKhbV4AW+FRjMIj5i9cHK3BAuatG/iqbf1M+jklVWLk0KdbgioKwK+03aYbA==} engines: {node: '>=12.0.0'} peerDependencies: '@types/react': ^17.0.0 || ^18.0.0 || 18 @@ -2279,11 +2279,11 @@ packages: react-is: 18.2.0 dev: false - /@mui/core-downloads-tracker@5.13.0: - resolution: {integrity: sha512-5nXz2k8Rv2ZjtQY6kXirJVyn2+ODaQuAJmXSJtLDUQDKWp3PFUj6j3bILqR0JGOs9R5ejgwz3crLKsl6GwjwkQ==} + /@mui/core-downloads-tracker@5.13.1: + resolution: {integrity: sha512-qDHtNDO72NcBQMhaWBt9EZMvNiO+OXjPg5Sdk/6LgRDw6Zr3HdEZ5n2FJ/qtYsaT/okGyCuQavQkcZCOCEVf/g==} dev: false - /@mui/icons-material@5.11.16(@mui/material@5.13.0)(@types/react@18.2.6)(react@18.2.0): + /@mui/icons-material@5.11.16(@mui/material@5.13.1)(@types/react@18.2.6)(react@18.2.0): resolution: {integrity: sha512-oKkx9z9Kwg40NtcIajF9uOXhxiyTZrrm9nmIJ4UjkU2IdHpd4QVLbCc/5hZN/y0C6qzi2Zlxyr9TGddQx2vx2A==} engines: {node: '>=12.0.0'} peerDependencies: @@ -2295,13 +2295,13 @@ packages: optional: true dependencies: '@babel/runtime': 7.21.0 - '@mui/material': 5.13.0(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@mui/material': 5.13.1(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) '@types/react': 18.2.6 react: 18.2.0 dev: false - /@mui/material@5.13.0(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-ckS+9tCpAzpdJdaTF+btF0b6mF9wbXg/EVKtnoAWYi0UKXoXBAVvEUMNpLGA5xdpCdf+A6fPbVUEHs9TsfU+Yw==} + /@mui/material@5.13.1(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-qSnbJZer8lIuDYFDv19/t3s0AXYY9SxcOdhCnGvetRSfOG4gy3TkiFXNCdW5OLNveTieiMpOuv46eXUmE3ZA6A==} engines: {node: '>=12.0.0'} peerDependencies: '@emotion/react': ^11.5.0 @@ -2320,11 +2320,11 @@ packages: '@babel/runtime': 7.21.0 '@emotion/react': 11.11.0(@types/react@18.2.6)(react@18.2.0) '@emotion/styled': 11.11.0(@emotion/react@11.11.0)(@types/react@18.2.6)(react@18.2.0) - '@mui/base': 5.0.0-beta.0(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) - '@mui/core-downloads-tracker': 5.13.0 - '@mui/system': 5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0) + '@mui/base': 5.0.0-beta.1(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0) + '@mui/core-downloads-tracker': 5.13.1 + '@mui/system': 5.13.1(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0) '@mui/types': 7.2.4(@types/react@18.2.6) - '@mui/utils': 5.12.3(react@18.2.0) + '@mui/utils': 5.13.1(react@18.2.0) '@types/react': 18.2.6 '@types/react-transition-group': 4.4.6 clsx: 1.2.1 @@ -2406,8 +2406,8 @@ packages: react: 18.2.0 dev: false - /@mui/system@5.12.3(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0): - resolution: {integrity: sha512-JB/6sypHqeJCqwldWeQ1MKkijH829EcZAKKizxbU2MJdxGG5KSwZvTBa5D9qiJUA1hJFYYupjiuy9ZdJt6rV6w==} + /@mui/system@5.13.1(@emotion/react@11.11.0)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0): + resolution: {integrity: sha512-BsDUjhiO6ZVAvzKhnWBHLZ5AtPJcdT+62VjnRLyA4isboqDKLg4fmYIZXq51yndg/soDK9RkY5lYZwEDku13Ow==} engines: {node: '>=12.0.0'} peerDependencies: '@emotion/react': ^11.5.0 @@ -2447,20 +2447,6 @@ packages: '@types/react': 18.2.6 dev: false - /@mui/utils@5.12.3(react@18.2.0): - resolution: {integrity: sha512-D/Z4Ub3MRl7HiUccid7sQYclTr24TqUAQFFlxHQF8FR177BrCTQ0JJZom7EqYjZCdXhwnSkOj2ph685MSKNtIA==} - engines: {node: '>=12.0.0'} - peerDependencies: - react: ^17.0.0 || ^18.0.0 || 18 - dependencies: - '@babel/runtime': 7.21.0 - '@types/prop-types': 15.7.5 - '@types/react-is': 17.0.3 - prop-types: 15.8.1 - react: 18.2.0 - react-is: 18.2.0 - dev: false - /@mui/utils@5.13.1(react@18.2.0): resolution: {integrity: sha512-6lXdWwmlUbEU2jUI8blw38Kt+3ly7xkmV9ljzY4Q20WhsJMWiNry9CX8M+TaP/HbtuyR8XKsdMgQW7h7MM3n3A==} engines: {node: '>=12.0.0'} @@ -2859,12 +2845,6 @@ packages: '@types/react': 18.2.6 dev: true - /@types/react-is@17.0.3: - resolution: {integrity: sha512-aBTIWg1emtu95bLTLx0cpkxwGW3ueZv71nE2YFBpL8k/z5czEW8yYpOo8Dp+UUAFAtKwNaOsh/ioSeQnWlZcfw==} - dependencies: - '@types/react': 18.2.6 - dev: false - /@types/react-is@18.2.0: resolution: {integrity: sha512-1vz2yObaQkLL7YFe/pme2cpvDsCwI1WXIfL+5eLz0MI9gFG24Re16RzUsI8t9XZn9ZWvgLNDrJBmrqXJO7GNQQ==} dependencies: From 7c38c227029dcd47e69421585bcf67c8f6298e31 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 18 May 2023 02:06:36 +1000 Subject: [PATCH 55/67] build(deps): update dependency react-router-dom to v6.11.2 (#5448) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 22 +++++++++++----------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/web/package.json b/web/package.json index 7d0239d9f..426ac3bb3 100644 --- a/web/package.json +++ b/web/package.json @@ -32,7 +32,7 @@ "react-dom": "18.2.0", "react-i18next": "12.2.2", "react-loading": "2.0.3", - "react-router-dom": "6.11.1", + "react-router-dom": "6.11.2", "react18-input-otp": "1.1.3", "zxcvbn": "4.4.2" }, diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index ce9dd96bd..48d14723a 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -65,8 +65,8 @@ dependencies: specifier: 2.0.3 version: 2.0.3(prop-types@15.8.1)(react@18.2.0) react-router-dom: - specifier: 6.11.1 - version: 6.11.1(react-dom@18.2.0)(react@18.2.0) + specifier: 6.11.2 + version: 6.11.2(react-dom@18.2.0)(react@18.2.0) react18-input-otp: specifier: 1.1.3 version: 1.1.3(react-dom@18.2.0)(react@18.2.0) @@ -2504,8 +2504,8 @@ packages: resolution: {integrity: sha512-Cr4OjIkipTtcXKjAsm8agyleBuDHvxzeBoa1v543lbv1YaIwQjESsVcmjiWiPEbC1FIeHOG/Op9kdCmAmiS3Kw==} dev: false - /@remix-run/router@1.6.1: - resolution: {integrity: sha512-YUkWj+xs0oOzBe74OgErsuR3wVn+efrFhXBWrit50kOiED+pvQe2r6MWY0iJMQU/mSVKxvNzL4ZaYvjdX+G7ZA==} + /@remix-run/router@1.6.2: + resolution: {integrity: sha512-LzqpSrMK/3JBAVBI9u3NWtOhWNw5AMQfrUFYB0+bDHTSw17z++WJLsPsxAuK+oSddsxk4d7F/JcdDPM1M5YAhA==} engines: {node: '>=14'} dev: false @@ -6544,26 +6544,26 @@ packages: engines: {node: '>=0.10.0'} dev: true - /react-router-dom@6.11.1(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-dPC2MhoPeTQ1YUOt5uIK376SMNWbwUxYRWk2ZmTT4fZfwlOvabF8uduRKKJIyfkCZvMgiF0GSCQckmkGGijIrg==} + /react-router-dom@6.11.2(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-JNbKtAeh1VSJQnH6RvBDNhxNwemRj7KxCzc5jb7zvDSKRnPWIFj9pO+eXqjM69gQJ0r46hSz1x4l9y0651DKWw==} engines: {node: '>=14'} peerDependencies: react: '>=16.8 || 18' react-dom: '>=16.8' dependencies: - '@remix-run/router': 1.6.1 + '@remix-run/router': 1.6.2 react: 18.2.0 react-dom: 18.2.0(react@18.2.0) - react-router: 6.11.1(react@18.2.0) + react-router: 6.11.2(react@18.2.0) dev: false - /react-router@6.11.1(react@18.2.0): - resolution: {integrity: sha512-OZINSdjJ2WgvAi7hgNLazrEV8SGn6xrKA+MkJe9wVDMZ3zQ6fdJocUjpCUCI0cNrelWjcvon0S/QK/j0NzL3KA==} + /react-router@6.11.2(react@18.2.0): + resolution: {integrity: sha512-74z9xUSaSX07t3LM+pS6Un0T55ibUE/79CzfZpy5wsPDZaea1F8QkrsiyRnA2YQ7LwE/umaydzXZV80iDCPkMg==} engines: {node: '>=14'} peerDependencies: react: '>=16.8 || 18' dependencies: - '@remix-run/router': 1.6.1 + '@remix-run/router': 1.6.2 react: 18.2.0 dev: false From f1d30fa1752577b8308ebc95bb54f3544987b5c9 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 18 May 2023 02:18:31 +1000 Subject: [PATCH 56/67] build(deps): update vitest monorepo to v0.31.1 (#5449) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 4 +-- web/pnpm-lock.yaml | 74 +++++++++++++++++++++++----------------------- 2 files changed, 39 insertions(+), 39 deletions(-) diff --git a/web/package.json b/web/package.json index 426ac3bb3..fb8f796e0 100644 --- a/web/package.json +++ b/web/package.json @@ -79,7 +79,7 @@ "@typescript-eslint/eslint-plugin": "5.59.6", "@typescript-eslint/parser": "5.59.6", "@vitejs/plugin-react": "4.0.0", - "@vitest/coverage-istanbul": "0.31.0", + "@vitest/coverage-istanbul": "0.31.1", "esbuild": "0.17.19", "eslint": "8.40.0", "eslint-config-prettier": "8.8.0", @@ -101,7 +101,7 @@ "vite-plugin-istanbul": "4.0.1", "vite-plugin-svgr": "3.2.0", "vite-tsconfig-paths": "4.2.0", - "vitest": "0.31.0", + "vitest": "0.31.1", "vitest-preview": "0.0.1" } } diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 48d14723a..261042135 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -115,8 +115,8 @@ devDependencies: specifier: 4.0.0 version: 4.0.0(vite@4.3.7) '@vitest/coverage-istanbul': - specifier: 0.31.0 - version: 0.31.0(vitest@0.31.0) + specifier: 0.31.1 + version: 0.31.1(vitest@0.31.1) esbuild: specifier: 0.17.19 version: 0.17.19 @@ -181,8 +181,8 @@ devDependencies: specifier: 4.2.0 version: 4.2.0(typescript@5.0.4)(vite@4.3.7) vitest: - specifier: 0.31.0 - version: 0.31.0(happy-dom@9.18.3) + specifier: 0.31.1 + version: 0.31.1(happy-dom@9.18.3) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -2733,11 +2733,11 @@ packages: /@types/chai-subset@1.3.3: resolution: {integrity: sha512-frBecisrNGz+F4T6bcc+NLeolfiojh5FxW2klu669+8BARtyQv2C/GkNW6FUodVe4BroGMP/wER/YDGc7rEllw==} dependencies: - '@types/chai': 4.3.4 + '@types/chai': 4.3.5 dev: true - /@types/chai@4.3.4: - resolution: {integrity: sha512-KnRanxnpfpjUTqTCXslZSEdLfXExwgNxYPdiO2WGUj8+HDjFi8R3k5RVKPeSCzLjCcshCAtVO2QBbVuAV4kTnw==} + /@types/chai@4.3.5: + resolution: {integrity: sha512-mEo1sAde+UCE6b2hxn332f1g1E8WfYRu6p5SvTKr2ZKC1f7gFJXk4h5PyGP9Dt6gCaG8y8XhwnXWC6Iy2cmBng==} dev: true /@types/connect@3.4.35: @@ -3128,8 +3128,8 @@ packages: open: 8.4.2 dev: true - /@vitest/coverage-istanbul@0.31.0(vitest@0.31.0): - resolution: {integrity: sha512-SaTI1PSpCRtBhJ5ihBx7Z+jgrFAQlDjuI4MFmKQ/HjyYWzEoaU+I062SquRrOLjJtVOHnwJdjVJXKi0dgFiR9Q==} + /@vitest/coverage-istanbul@0.31.1(vitest@0.31.1): + resolution: {integrity: sha512-wLVROukTxWflIub4QUT5TenA2zx2ypUjRp636yiMTidN5hvRhnUNEEkRavJMEpYuWYYMN23E7EmAxo/MzRRmIA==} peerDependencies: vitest: '>=0.30.0 <1' dependencies: @@ -3139,44 +3139,44 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.0(happy-dom@9.18.3) + vitest: 0.31.1(happy-dom@9.18.3) transitivePeerDependencies: - supports-color dev: true - /@vitest/expect@0.31.0: - resolution: {integrity: sha512-Jlm8ZTyp6vMY9iz9Ny9a0BHnCG4fqBa8neCF6Pk/c/6vkUk49Ls6UBlgGAU82QnzzoaUs9E/mUhq/eq9uMOv/g==} + /@vitest/expect@0.31.1: + resolution: {integrity: sha512-BV1LyNvhnX+eNYzJxlHIGPWZpwJFZaCcOIzp2CNG0P+bbetenTupk6EO0LANm4QFt0TTit+yqx7Rxd1qxi/SQA==} dependencies: - '@vitest/spy': 0.31.0 - '@vitest/utils': 0.31.0 + '@vitest/spy': 0.31.1 + '@vitest/utils': 0.31.1 chai: 4.3.7 dev: true - /@vitest/runner@0.31.0: - resolution: {integrity: sha512-H1OE+Ly7JFeBwnpHTrKyCNm/oZgr+16N4qIlzzqSG/YRQDATBYmJb/KUn3GrZaiQQyL7GwpNHVZxSQd6juLCgw==} + /@vitest/runner@0.31.1: + resolution: {integrity: sha512-imWuc82ngOtxdCUpXwtEzZIuc1KMr+VlQ3Ondph45VhWoQWit5yvG/fFcldbnCi8DUuFi+NmNx5ehMUw/cGLUw==} dependencies: - '@vitest/utils': 0.31.0 + '@vitest/utils': 0.31.1 concordance: 5.0.4 p-limit: 4.0.0 pathe: 1.1.0 dev: true - /@vitest/snapshot@0.31.0: - resolution: {integrity: sha512-5dTXhbHnyUMTMOujZPB0wjFjQ6q5x9c8TvAsSPUNKjp1tVU7i9pbqcKPqntyu2oXtmVxKbuHCqrOd+Ft60r4tg==} + /@vitest/snapshot@0.31.1: + resolution: {integrity: sha512-L3w5uU9bMe6asrNzJ8WZzN+jUTX4KSgCinEJPXyny0o90fG4FPQMV0OWsq7vrCWfQlAilMjDnOF9nP8lidsJ+g==} dependencies: magic-string: 0.30.0 pathe: 1.1.0 pretty-format: 27.5.1 dev: true - /@vitest/spy@0.31.0: - resolution: {integrity: sha512-IzCEQ85RN26GqjQNkYahgVLLkULOxOm5H/t364LG0JYb3Apg0PsYCHLBYGA006+SVRMWhQvHlBBCyuByAMFmkg==} + /@vitest/spy@0.31.1: + resolution: {integrity: sha512-1cTpt2m9mdo3hRLDyCG2hDQvRrePTDgEJBFQQNz1ydHHZy03EiA6EpFxY+7ODaY7vMRCie+WlFZBZ0/dQWyssQ==} dependencies: tinyspy: 2.1.0 dev: true - /@vitest/utils@0.31.0: - resolution: {integrity: sha512-kahaRyLX7GS1urekRXN2752X4gIgOGVX4Wo8eDUGUkTWlGpXzf5ZS6N9RUUS+Re3XEE8nVGqNyxkSxF5HXlGhQ==} + /@vitest/utils@0.31.1: + resolution: {integrity: sha512-yFyRD5ilwojsZfo3E0BnH72pSVSuLg2356cN1tCEe/0RtDzxTPYwOomIC+eQbot7m6DRy4tPZw+09mB7NkbMmA==} dependencies: concordance: 5.0.4 loupe: 2.3.6 @@ -7140,8 +7140,8 @@ packages: resolution: {integrity: sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA==} dev: false - /tinybench@2.4.0: - resolution: {integrity: sha512-iyziEiyFxX4kyxSp+MtY1oCH/lvjH3PxFN8PGCDeqcZWAJ/i+9y+nL85w99PxVzrIvew/GSkSbDYtiGVa85Afg==} + /tinybench@2.5.0: + resolution: {integrity: sha512-kRwSG8Zx4tjF9ZiyH4bhaebu+EDz1BOx9hOigYHlUW4xxI/wKIUQUqo018UlU4ar6ATPBsaMrdbKZ+tmPdohFA==} dev: true /tinypool@0.5.0: @@ -7396,8 +7396,8 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.0(@types/node@20.1.7): - resolution: {integrity: sha512-8x1x1LNuPvE2vIvkSB7c1mApX5oqlgsxzHQesYF7l5n1gKrEmrClIiZuOFbFDQcjLsmcWSwwmrWrcGWm9Fxc/g==} + /vite-node@0.31.1(@types/node@20.1.7): + resolution: {integrity: sha512-BajE/IsNQ6JyizPzu9zRgHrBwczkAs0erQf/JRpgTIESpKvNj9/Gd0vxX905klLkb0I0SJVCKbdrl5c6FnqYKA==} engines: {node: '>=v14.18.0'} hasBin: true dependencies: @@ -7560,8 +7560,8 @@ packages: - terser dev: true - /vitest@0.31.0(happy-dom@9.18.3): - resolution: {integrity: sha512-JwWJS9p3GU9GxkG7eBSmr4Q4x4bvVBSswaCFf1PBNHiPx00obfhHRJfgHcnI0ffn+NMlIh9QGvG75FlaIBdKGA==} + /vitest@0.31.1(happy-dom@9.18.3): + resolution: {integrity: sha512-/dOoOgzoFk/5pTvg1E65WVaobknWREN15+HF+0ucudo3dDG/vCZoXTQrjIfEaWvQXmqScwkRodrTbM/ScMpRcQ==} engines: {node: '>=v14.18.0'} hasBin: true peerDependencies: @@ -7591,14 +7591,14 @@ packages: webdriverio: optional: true dependencies: - '@types/chai': 4.3.4 + '@types/chai': 4.3.5 '@types/chai-subset': 1.3.3 '@types/node': 20.1.7 - '@vitest/expect': 0.31.0 - '@vitest/runner': 0.31.0 - '@vitest/snapshot': 0.31.0 - '@vitest/spy': 0.31.0 - '@vitest/utils': 0.31.0 + '@vitest/expect': 0.31.1 + '@vitest/runner': 0.31.1 + '@vitest/snapshot': 0.31.1 + '@vitest/spy': 0.31.1 + '@vitest/utils': 0.31.1 acorn: 8.8.2 acorn-walk: 8.2.0 cac: 6.7.14 @@ -7612,10 +7612,10 @@ packages: picocolors: 1.0.0 std-env: 3.3.2 strip-literal: 1.0.1 - tinybench: 2.4.0 + tinybench: 2.5.0 tinypool: 0.5.0 vite: 4.3.7(@types/node@20.1.7) - vite-node: 0.31.0(@types/node@20.1.7) + vite-node: 0.31.1(@types/node@20.1.7) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 046a77b8953de821dc215453324a30f4a4ced799 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 18 May 2023 07:49:52 +1000 Subject: [PATCH 57/67] build(deps): update module github.com/sirupsen/logrus to v1.9.2 (#5451) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c06fb45e5..f22b7360e 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( github.com/pkg/errors v0.9.1 github.com/pquerna/otp v1.4.0 github.com/prometheus/client_golang v1.15.1 - github.com/sirupsen/logrus v1.9.1 + github.com/sirupsen/logrus v1.9.2 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 diff --git a/go.sum b/go.sum index c10fddafd..477f32bc4 100644 --- a/go.sum +++ b/go.sum @@ -385,8 +385,8 @@ github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee h1:8Iv5m6xEo1NR1Avp github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee/go.mod h1:qwtSXrKuJh/zsFQ12yEE89xfCrGKK63Rr7ctU/uCo4g= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= -github.com/sirupsen/logrus v1.9.1 h1:Ou41VVR3nMWWmTiEUnj0OlsgOSCUFgsPAOl6jRIcVtQ= -github.com/sirupsen/logrus v1.9.1/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= +github.com/sirupsen/logrus v1.9.2 h1:oxx1eChJGI6Uks2ZC4W1zpLlVgqB8ner4EuQwV4Ik1Y= +github.com/sirupsen/logrus v1.9.2/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM= github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ= From 5ce36d37cd2085b2ae729e1b9a3f79a8ee8516cd Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 18 May 2023 08:00:59 +1000 Subject: [PATCH 58/67] build(deps): update ghcr.io/k3d-io/k3d docker tag to v5.5.0 (#5450) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- internal/suites/example/compose/k3d/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/suites/example/compose/k3d/docker-compose.yml b/internal/suites/example/compose/k3d/docker-compose.yml index a9f2c28bc..b7da3e725 100644 --- a/internal/suites/example/compose/k3d/docker-compose.yml +++ b/internal/suites/example/compose/k3d/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: k3d: - image: ghcr.io/k3d-io/k3d:5.4.9-dind + image: ghcr.io/k3d-io/k3d:5.5.0-dind volumes: - './example/kube:/authelia' - './example/kube/authelia/configs/configuration.yml:/configmaps/authelia/configuration.yml' From ccd1a66f9652e36dc3b51c12d66e137300cad1c3 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 18 May 2023 10:23:26 +1000 Subject: [PATCH 59/67] build(deps): update dependency @types/node to v20.2.0 (#5452) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index fb8f796e0..18cd4c1a2 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.1.7", + "@types/node": "20.2.0", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 261042135..0cc3b06c4 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.1.7 - version: 20.1.7 + specifier: 20.2.0 + version: 20.2.0 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.7 - version: 4.3.7(@types/node@20.1.7) + version: 4.3.7(@types/node@20.2.0) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.7) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.1.7 + '@types/node': 20.2.0 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.1.7)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.2.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.1.7)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.2.0)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2191,7 +2191,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.1.7 + '@types/node': 20.2.0 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2727,7 +2727,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.1.7 + '@types/node': 20.2.0 dev: true /@types/chai-subset@1.3.3: @@ -2743,7 +2743,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.1.7 + '@types/node': 20.2.0 dev: true /@types/eslint@8.37.0: @@ -2760,7 +2760,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.1.7 + '@types/node': 20.2.0 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2817,8 +2817,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.1.7: - resolution: {integrity: sha512-WCuw/o4GSwDGMoonES8rcvwsig77dGCMbZDrZr2x4ZZiNW4P/gcoZXe/0twgtobcTkmg9TuKflxYL/DuwDyJzg==} + /@types/node@20.2.0: + resolution: {integrity: sha512-3iD2jaCCziTx04uudpJKwe39QxXgSUnpxXSvRQjRvHPxFQfmfP4NXIm/NURVeNlTCc+ru4WqjYGTmpXrW9uMlw==} dev: true /@types/normalize-package-data@2.4.1: @@ -2875,7 +2875,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.1.7 + '@types/node': 20.2.0 dev: true /@types/stack-utils@2.0.1: @@ -3117,7 +3117,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.7(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.2.0) transitivePeerDependencies: - supports-color dev: true @@ -3738,7 +3738,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.1.7)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.2.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3747,9 +3747,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.1.7 + '@types/node': 20.2.0 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.1.7)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.2.0)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5637,7 +5637,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.1.7 + '@types/node': 20.2.0 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7179,7 +7179,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.1.7)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.2.0)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7198,7 +7198,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.1.7 + '@types/node': 20.2.0 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7396,7 +7396,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.1(@types/node@20.1.7): + /vite-node@0.31.1(@types/node@20.2.0): resolution: {integrity: sha512-BajE/IsNQ6JyizPzu9zRgHrBwczkAs0erQf/JRpgTIESpKvNj9/Gd0vxX905klLkb0I0SJVCKbdrl5c6FnqYKA==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7406,7 +7406,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.7(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.2.0) transitivePeerDependencies: - '@types/node' - less @@ -7427,7 +7427,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.7(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.2.0) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.7): @@ -7439,7 +7439,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.7(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.2.0) transitivePeerDependencies: - supports-color dev: true @@ -7452,7 +7452,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.7(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.2.0) transitivePeerDependencies: - rollup - supports-color @@ -7469,7 +7469,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.7(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.2.0) transitivePeerDependencies: - supports-color - typescript @@ -7509,7 +7509,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.7(@types/node@20.1.7): + /vite@4.3.7(@types/node@20.2.0): resolution: {integrity: sha512-MTIFpbIm9v7Hh5b0wSBgkcWzSBz7SAa6K/cBTwS4kUiQJfQLFlZZRJRQgqunCVzhTPCk674tW+0Qaqh3Q00dBg==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7534,7 +7534,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.1.7 + '@types/node': 20.2.0 esbuild: 0.17.19 postcss: 8.4.23 rollup: 3.21.0 @@ -7593,7 +7593,7 @@ packages: dependencies: '@types/chai': 4.3.5 '@types/chai-subset': 1.3.3 - '@types/node': 20.1.7 + '@types/node': 20.2.0 '@vitest/expect': 0.31.1 '@vitest/runner': 0.31.1 '@vitest/snapshot': 0.31.1 @@ -7614,8 +7614,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.5.0 tinypool: 0.5.0 - vite: 4.3.7(@types/node@20.1.7) - vite-node: 0.31.1(@types/node@20.1.7) + vite: 4.3.7(@types/node@20.2.0) + vite-node: 0.31.1(@types/node@20.2.0) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 55757c6226664ad403d8a13997e5501b4e1a0893 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 18 May 2023 21:21:35 +1000 Subject: [PATCH 60/67] build(deps): update dependency vite to v4.3.8 (#5453) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 42 +++++++++++++++++++++--------------------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/web/package.json b/web/package.json index 18cd4c1a2..f4f5341c8 100644 --- a/web/package.json +++ b/web/package.json @@ -96,7 +96,7 @@ "prettier": "2.8.8", "react-test-renderer": "18.2.0", "typescript": "5.0.4", - "vite": "4.3.7", + "vite": "4.3.8", "vite-plugin-eslint": "1.8.1", "vite-plugin-istanbul": "4.0.1", "vite-plugin-svgr": "3.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 0cc3b06c4..84b489381 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -113,7 +113,7 @@ devDependencies: version: 5.59.6(eslint@8.40.0)(typescript@5.0.4) '@vitejs/plugin-react': specifier: 4.0.0 - version: 4.0.0(vite@4.3.7) + version: 4.0.0(vite@4.3.8) '@vitest/coverage-istanbul': specifier: 0.31.1 version: 0.31.1(vitest@0.31.1) @@ -166,20 +166,20 @@ devDependencies: specifier: 5.0.4 version: 5.0.4 vite: - specifier: 4.3.7 - version: 4.3.7(@types/node@20.2.0) + specifier: 4.3.8 + version: 4.3.8(@types/node@20.2.0) vite-plugin-eslint: specifier: 1.8.1 - version: 1.8.1(eslint@8.40.0)(vite@4.3.7) + version: 1.8.1(eslint@8.40.0)(vite@4.3.8) vite-plugin-istanbul: specifier: 4.0.1 - version: 4.0.1(vite@4.3.7) + version: 4.0.1(vite@4.3.8) vite-plugin-svgr: specifier: 3.2.0 - version: 3.2.0(vite@4.3.7) + version: 3.2.0(vite@4.3.8) vite-tsconfig-paths: specifier: 4.2.0 - version: 4.2.0(typescript@5.0.4)(vite@4.3.7) + version: 4.2.0(typescript@5.0.4)(vite@4.3.8) vitest: specifier: 0.31.1 version: 0.31.1(happy-dom@9.18.3) @@ -3107,7 +3107,7 @@ packages: eslint-visitor-keys: 3.4.1 dev: true - /@vitejs/plugin-react@4.0.0(vite@4.3.7): + /@vitejs/plugin-react@4.0.0(vite@4.3.8): resolution: {integrity: sha512-HX0XzMjL3hhOYm+0s95pb0Z7F8O81G7joUHgfDd/9J/ZZf5k4xX6QAMFkKsHFxaHlf6X7GD7+XuaZ66ULiJuhQ==} engines: {node: ^14.18.0 || >=16.0.0} peerDependencies: @@ -3117,7 +3117,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.7(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.0) transitivePeerDependencies: - supports-color dev: true @@ -7406,7 +7406,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.7(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.0) transitivePeerDependencies: - '@types/node' - less @@ -7417,7 +7417,7 @@ packages: - terser dev: true - /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.7): + /vite-plugin-eslint@1.8.1(eslint@8.40.0)(vite@4.3.8): resolution: {integrity: sha512-PqdMf3Y2fLO9FsNPmMX+//2BF5SF8nEWspZdgl4kSt7UvHDRHVVfHvxsD7ULYzZrJDGRxR81Nq7TOFgwMnUang==} peerDependencies: eslint: '>=7' @@ -7427,10 +7427,10 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.7(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.0) dev: true - /vite-plugin-istanbul@4.0.1(vite@4.3.7): + /vite-plugin-istanbul@4.0.1(vite@4.3.8): resolution: {integrity: sha512-1fUCJyYvt/vkDQWR/15knwCk+nWmNbVbmZTXf/X4XD0dcdmJsYrZF5JQo7ttYxFyflGH2SVu+XRlpN06CakKPQ==} peerDependencies: vite: '>=2.9.1 <= 5' @@ -7439,12 +7439,12 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.7(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.0) transitivePeerDependencies: - supports-color dev: true - /vite-plugin-svgr@3.2.0(vite@4.3.7): + /vite-plugin-svgr@3.2.0(vite@4.3.8): resolution: {integrity: sha512-Uvq6niTvhqJU6ga78qLKBFJSDvxWhOnyfQSoKpDPMAGxJPo5S3+9hyjExE5YDj6Lpa4uaLkGc1cBgxXov+LjSw==} peerDependencies: vite: ^2.6.0 || 3 || 4 @@ -7452,13 +7452,13 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.7(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.0) transitivePeerDependencies: - rollup - supports-color dev: true - /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.7): + /vite-tsconfig-paths@4.2.0(typescript@5.0.4)(vite@4.3.8): resolution: {integrity: sha512-jGpus0eUy5qbbMVGiTxCL1iB9ZGN6Bd37VGLJU39kTDD6ZfULTTb1bcc5IeTWqWJKiWV5YihCaibeASPiGi8kw==} peerDependencies: vite: '*' @@ -7469,7 +7469,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.7(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.0) transitivePeerDependencies: - supports-color - typescript @@ -7509,8 +7509,8 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.7(@types/node@20.2.0): - resolution: {integrity: sha512-MTIFpbIm9v7Hh5b0wSBgkcWzSBz7SAa6K/cBTwS4kUiQJfQLFlZZRJRQgqunCVzhTPCk674tW+0Qaqh3Q00dBg==} + /vite@4.3.8(@types/node@20.2.0): + resolution: {integrity: sha512-uYB8PwN7hbMrf4j1xzGDk/lqjsZvCDbt/JC5dyfxc19Pg8kRm14LinK/uq+HSLNswZEoKmweGdtpbnxRtrAXiQ==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true peerDependencies: @@ -7614,7 +7614,7 @@ packages: strip-literal: 1.0.1 tinybench: 2.5.0 tinypool: 0.5.0 - vite: 4.3.7(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.0) vite-node: 0.31.1(@types/node@20.2.0) why-is-node-running: 2.2.2 transitivePeerDependencies: From 14cb4202dc59e2d9f8abfebd9c6be174a8b1e749 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 01:51:47 +1000 Subject: [PATCH 61/67] build(deps): update dependency @types/node to v20.2.1 (#5454) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 62 +++++++++++++++++++++++----------------------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/web/package.json b/web/package.json index f4f5341c8..cd2d906d2 100644 --- a/web/package.json +++ b/web/package.json @@ -71,7 +71,7 @@ "@limegrass/eslint-plugin-import-alias": "1.0.6", "@testing-library/jest-dom": "5.16.5", "@testing-library/react": "14.0.0", - "@types/node": "20.2.0", + "@types/node": "20.2.1", "@types/react": "18.2.6", "@types/react-dom": "18.2.4", "@types/testing-library__jest-dom": "5.14.5", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 84b489381..b992bf12f 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -91,8 +91,8 @@ devDependencies: specifier: 14.0.0 version: 14.0.0(react-dom@18.2.0)(react@18.2.0) '@types/node': - specifier: 20.2.0 - version: 20.2.0 + specifier: 20.2.1 + version: 20.2.1 '@types/react': specifier: 18.2.6 version: 18.2.6 @@ -167,7 +167,7 @@ devDependencies: version: 5.0.4 vite: specifier: 4.3.8 - version: 4.3.8(@types/node@20.2.0) + version: 4.3.8(@types/node@20.2.1) vite-plugin-eslint: specifier: 1.8.1 version: 1.8.1(eslint@8.40.0)(vite@4.3.8) @@ -1635,15 +1635,15 @@ packages: '@commitlint/execute-rule': 17.4.0 '@commitlint/resolve-extends': 17.4.4 '@commitlint/types': 17.4.4 - '@types/node': 20.2.0 + '@types/node': 20.2.1 chalk: 4.1.2 cosmiconfig: 8.1.3 - cosmiconfig-typescript-loader: 4.3.0(@types/node@20.2.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) + cosmiconfig-typescript-loader: 4.3.0(@types/node@20.2.1)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4) lodash.isplainobject: 4.0.6 lodash.merge: 4.6.2 lodash.uniq: 4.5.0 resolve-from: 5.0.0 - ts-node: 10.9.1(@types/node@20.2.0)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.2.1)(typescript@5.0.4) typescript: 5.0.4 transitivePeerDependencies: - '@swc/core' @@ -2191,7 +2191,7 @@ packages: '@jest/schemas': 29.4.3 '@types/istanbul-lib-coverage': 2.0.4 '@types/istanbul-reports': 3.0.1 - '@types/node': 20.2.0 + '@types/node': 20.2.1 '@types/yargs': 17.0.24 chalk: 4.1.2 dev: true @@ -2727,7 +2727,7 @@ packages: resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==} dependencies: '@types/connect': 3.4.35 - '@types/node': 20.2.0 + '@types/node': 20.2.1 dev: true /@types/chai-subset@1.3.3: @@ -2743,7 +2743,7 @@ packages: /@types/connect@3.4.35: resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==} dependencies: - '@types/node': 20.2.0 + '@types/node': 20.2.1 dev: true /@types/eslint@8.37.0: @@ -2760,7 +2760,7 @@ packages: /@types/express-serve-static-core@4.17.33: resolution: {integrity: sha512-TPBqmR/HRYI3eC2E5hmiivIzv+bidAfXofM+sbonAGvyDhySGw9/PQZFt2BLOrjUUR++4eJVpx6KnLQK1Fk9tA==} dependencies: - '@types/node': 20.2.0 + '@types/node': 20.2.1 '@types/qs': 6.9.7 '@types/range-parser': 1.2.4 dev: true @@ -2817,8 +2817,8 @@ packages: resolution: {integrity: sha512-seOA34WMo9KB+UA78qaJoCO20RJzZGVXQ5Sh6FWu0g/hfT44nKXnej3/tCQl7FL97idFpBhisLYCTB50S0EirA==} dev: true - /@types/node@20.2.0: - resolution: {integrity: sha512-3iD2jaCCziTx04uudpJKwe39QxXgSUnpxXSvRQjRvHPxFQfmfP4NXIm/NURVeNlTCc+ru4WqjYGTmpXrW9uMlw==} + /@types/node@20.2.1: + resolution: {integrity: sha512-DqJociPbZP1lbZ5SQPk4oag6W7AyaGMO6gSfRwq3PWl4PXTwJpRQJhDq4W0kzrg3w6tJ1SwlvGZ5uKFHY13LIg==} dev: true /@types/normalize-package-data@2.4.1: @@ -2875,7 +2875,7 @@ packages: resolution: {integrity: sha512-NUo5XNiAdULrJENtJXZZ3fHtfMolzZwczzBbnAeBbqBwG+LaG6YaJtuwzwGSQZ2wsCrxjEhNNjAkKigy3n8teQ==} dependencies: '@types/mime': 3.0.1 - '@types/node': 20.2.0 + '@types/node': 20.2.1 dev: true /@types/stack-utils@2.0.1: @@ -3117,7 +3117,7 @@ packages: '@babel/plugin-transform-react-jsx-self': 7.21.0(@babel/core@7.21.4) '@babel/plugin-transform-react-jsx-source': 7.19.6(@babel/core@7.21.4) react-refresh: 0.14.0 - vite: 4.3.8(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.1) transitivePeerDependencies: - supports-color dev: true @@ -3738,7 +3738,7 @@ packages: browserslist: 4.21.5 dev: true - /cosmiconfig-typescript-loader@4.3.0(@types/node@20.2.0)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): + /cosmiconfig-typescript-loader@4.3.0(@types/node@20.2.1)(cosmiconfig@8.1.3)(ts-node@10.9.1)(typescript@5.0.4): resolution: {integrity: sha512-NTxV1MFfZDLPiBMjxbHRwSh5LaLcPMwNdCutmnHJCKoVnlvldPWlllonKwrsRJ5pYZBIBGRWWU2tfvzxgeSW5Q==} engines: {node: '>=12', npm: '>=6'} peerDependencies: @@ -3747,9 +3747,9 @@ packages: ts-node: '>=10' typescript: '>=3' dependencies: - '@types/node': 20.2.0 + '@types/node': 20.2.1 cosmiconfig: 8.1.3 - ts-node: 10.9.1(@types/node@20.2.0)(typescript@5.0.4) + ts-node: 10.9.1(@types/node@20.2.1)(typescript@5.0.4) typescript: 5.0.4 dev: true @@ -5637,7 +5637,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} dependencies: '@jest/types': 29.5.0 - '@types/node': 20.2.0 + '@types/node': 20.2.1 chalk: 4.1.2 ci-info: 3.8.0 graceful-fs: 4.2.11 @@ -7179,7 +7179,7 @@ packages: engines: {node: '>=8'} dev: true - /ts-node@10.9.1(@types/node@20.2.0)(typescript@5.0.4): + /ts-node@10.9.1(@types/node@20.2.1)(typescript@5.0.4): resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==} hasBin: true peerDependencies: @@ -7198,7 +7198,7 @@ packages: '@tsconfig/node12': 1.0.11 '@tsconfig/node14': 1.0.3 '@tsconfig/node16': 1.0.3 - '@types/node': 20.2.0 + '@types/node': 20.2.1 acorn: 8.8.2 acorn-walk: 8.2.0 arg: 4.1.3 @@ -7396,7 +7396,7 @@ packages: engines: {node: '>= 0.8'} dev: true - /vite-node@0.31.1(@types/node@20.2.0): + /vite-node@0.31.1(@types/node@20.2.1): resolution: {integrity: sha512-BajE/IsNQ6JyizPzu9zRgHrBwczkAs0erQf/JRpgTIESpKvNj9/Gd0vxX905klLkb0I0SJVCKbdrl5c6FnqYKA==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7406,7 +7406,7 @@ packages: mlly: 1.2.0 pathe: 1.1.0 picocolors: 1.0.0 - vite: 4.3.8(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.1) transitivePeerDependencies: - '@types/node' - less @@ -7427,7 +7427,7 @@ packages: '@types/eslint': 8.37.0 eslint: 8.40.0 rollup: 2.79.1 - vite: 4.3.8(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.1) dev: true /vite-plugin-istanbul@4.0.1(vite@4.3.8): @@ -7439,7 +7439,7 @@ packages: istanbul-lib-instrument: 5.2.1 picocolors: 1.0.0 test-exclude: 6.0.0 - vite: 4.3.8(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.1) transitivePeerDependencies: - supports-color dev: true @@ -7452,7 +7452,7 @@ packages: '@rollup/pluginutils': 5.0.2 '@svgr/core': 7.0.0 '@svgr/plugin-jsx': 7.0.0 - vite: 4.3.8(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.1) transitivePeerDependencies: - rollup - supports-color @@ -7469,7 +7469,7 @@ packages: debug: 4.3.4 globrex: 0.1.2 tsconfck: 2.1.1(typescript@5.0.4) - vite: 4.3.8(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.1) transitivePeerDependencies: - supports-color - typescript @@ -7509,7 +7509,7 @@ packages: fsevents: 2.3.2 dev: true - /vite@4.3.8(@types/node@20.2.0): + /vite@4.3.8(@types/node@20.2.1): resolution: {integrity: sha512-uYB8PwN7hbMrf4j1xzGDk/lqjsZvCDbt/JC5dyfxc19Pg8kRm14LinK/uq+HSLNswZEoKmweGdtpbnxRtrAXiQ==} engines: {node: ^14.18.0 || >=16.0.0} hasBin: true @@ -7534,7 +7534,7 @@ packages: terser: optional: true dependencies: - '@types/node': 20.2.0 + '@types/node': 20.2.1 esbuild: 0.17.19 postcss: 8.4.23 rollup: 3.21.0 @@ -7593,7 +7593,7 @@ packages: dependencies: '@types/chai': 4.3.5 '@types/chai-subset': 1.3.3 - '@types/node': 20.2.0 + '@types/node': 20.2.1 '@vitest/expect': 0.31.1 '@vitest/runner': 0.31.1 '@vitest/snapshot': 0.31.1 @@ -7614,8 +7614,8 @@ packages: strip-literal: 1.0.1 tinybench: 2.5.0 tinypool: 0.5.0 - vite: 4.3.8(@types/node@20.2.0) - vite-node: 0.31.1(@types/node@20.2.0) + vite: 4.3.8(@types/node@20.2.1) + vite-node: 0.31.1(@types/node@20.2.1) why-is-node-running: 2.2.2 transitivePeerDependencies: - less From 850bfce52f4362cfadcb165835cb06d4b58fb29a Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 05:11:35 +1000 Subject: [PATCH 62/67] build(deps): update dependency happy-dom to v9.19.0 (#5456) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/web/package.json b/web/package.json index cd2d906d2..550a0abf7 100644 --- a/web/package.json +++ b/web/package.json @@ -91,7 +91,7 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.18.3", + "happy-dom": "9.19.0", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index b992bf12f..f60cb65fd 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -151,8 +151,8 @@ devDependencies: specifier: 4.6.0 version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.18.3 - version: 9.18.3 + specifier: 9.19.0 + version: 9.19.0 husky: specifier: 8.0.3 version: 8.0.3 @@ -182,7 +182,7 @@ devDependencies: version: 4.2.0(typescript@5.0.4)(vite@4.3.8) vitest: specifier: 0.31.1 - version: 0.31.1(happy-dom@9.18.3) + version: 0.31.1(happy-dom@9.19.0) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -3139,7 +3139,7 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.1(happy-dom@9.18.3) + vitest: 0.31.1(happy-dom@9.19.0) transitivePeerDependencies: - supports-color dev: true @@ -5152,8 +5152,8 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.18.3: - resolution: {integrity: sha512-b7iMGYeIXvUryNultA0AHEVU0FPpb2djJ/xSVlMDfP7HG4z7FomdqkCEpWtSv1zDL+t1gRUoBbpqFCoUBvjYtg==} + /happy-dom@9.19.0: + resolution: {integrity: sha512-wLD2kGzyI66H7qjrxv7dRdZneeGSecETXScOjO05AQ0Gdy8HF1c6iAszoZ90XBOXyn9Q0Q1wyv3DWTafGqFbJg==} dependencies: css.escape: 1.5.1 entities: 4.5.0 @@ -7560,7 +7560,7 @@ packages: - terser dev: true - /vitest@0.31.1(happy-dom@9.18.3): + /vitest@0.31.1(happy-dom@9.19.0): resolution: {integrity: sha512-/dOoOgzoFk/5pTvg1E65WVaobknWREN15+HF+0ucudo3dDG/vCZoXTQrjIfEaWvQXmqScwkRodrTbM/ScMpRcQ==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7605,7 +7605,7 @@ packages: chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.18.3 + happy-dom: 9.19.0 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 From d7e3d9c2ad5e1d8b3e3f4757940c2a34c4ee6045 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 05:27:32 +1000 Subject: [PATCH 63/67] build(deps): update dependency happy-dom to v9.19.2 (#5458) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/web/package.json b/web/package.json index 550a0abf7..a0ea8e055 100644 --- a/web/package.json +++ b/web/package.json @@ -91,7 +91,7 @@ "eslint-plugin-prettier": "4.2.1", "eslint-plugin-react": "7.32.2", "eslint-plugin-react-hooks": "4.6.0", - "happy-dom": "9.19.0", + "happy-dom": "9.19.2", "husky": "8.0.3", "prettier": "2.8.8", "react-test-renderer": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index f60cb65fd..b7936ebc8 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -151,8 +151,8 @@ devDependencies: specifier: 4.6.0 version: 4.6.0(eslint@8.40.0) happy-dom: - specifier: 9.19.0 - version: 9.19.0 + specifier: 9.19.2 + version: 9.19.2 husky: specifier: 8.0.3 version: 8.0.3 @@ -182,7 +182,7 @@ devDependencies: version: 4.2.0(typescript@5.0.4)(vite@4.3.8) vitest: specifier: 0.31.1 - version: 0.31.1(happy-dom@9.19.0) + version: 0.31.1(happy-dom@9.19.2) vitest-preview: specifier: 0.0.1 version: 0.0.1 @@ -3139,7 +3139,7 @@ packages: istanbul-lib-source-maps: 4.0.1 istanbul-reports: 3.1.5 test-exclude: 6.0.0 - vitest: 0.31.1(happy-dom@9.19.0) + vitest: 0.31.1(happy-dom@9.19.2) transitivePeerDependencies: - supports-color dev: true @@ -5152,8 +5152,8 @@ packages: resolution: {integrity: sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==} dev: true - /happy-dom@9.19.0: - resolution: {integrity: sha512-wLD2kGzyI66H7qjrxv7dRdZneeGSecETXScOjO05AQ0Gdy8HF1c6iAszoZ90XBOXyn9Q0Q1wyv3DWTafGqFbJg==} + /happy-dom@9.19.2: + resolution: {integrity: sha512-WBey64FErn5niCLddcjXxkgDk6burN/5doiJpMUQXpgEG3TUJdbygJV1bzcj1Ey+pz+0QGCZH1pwe24uPW+WnQ==} dependencies: css.escape: 1.5.1 entities: 4.5.0 @@ -7560,7 +7560,7 @@ packages: - terser dev: true - /vitest@0.31.1(happy-dom@9.19.0): + /vitest@0.31.1(happy-dom@9.19.2): resolution: {integrity: sha512-/dOoOgzoFk/5pTvg1E65WVaobknWREN15+HF+0ucudo3dDG/vCZoXTQrjIfEaWvQXmqScwkRodrTbM/ScMpRcQ==} engines: {node: '>=v14.18.0'} hasBin: true @@ -7605,7 +7605,7 @@ packages: chai: 4.3.7 concordance: 5.0.4 debug: 4.3.4 - happy-dom: 9.19.0 + happy-dom: 9.19.2 local-pkg: 0.4.3 magic-string: 0.30.0 pathe: 1.1.0 From 88bad696a8428dae0d0deab69cc7668d9aa60682 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 09:59:59 +1000 Subject: [PATCH 64/67] build(deps): update dependency i18next-http-backend to v2.2.1 (#5455) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/web/package.json b/web/package.json index a0ea8e055..4dcfbb0e3 100644 --- a/web/package.json +++ b/web/package.json @@ -26,7 +26,7 @@ "classnames": "2.3.2", "i18next": "22.4.15", "i18next-browser-languagedetector": "7.0.1", - "i18next-http-backend": "2.2.0", + "i18next-http-backend": "2.2.1", "qrcode.react": "3.1.0", "react": "18.2.0", "react-dom": "18.2.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index b7936ebc8..02aa505f6 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -47,8 +47,8 @@ dependencies: specifier: 7.0.1 version: 7.0.1 i18next-http-backend: - specifier: 2.2.0 - version: 2.2.0 + specifier: 2.2.1 + version: 2.2.1 qrcode.react: specifier: 3.1.0 version: 3.1.0(react@18.2.0) @@ -3777,10 +3777,10 @@ packages: resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==} dev: true - /cross-fetch@3.1.5: - resolution: {integrity: sha512-lvb1SBsI0Z7GDwmuid+mU3kWVBwTVUbe7S0H52yaaAdQOXq2YktTCZdlAcNKFzE6QtRz0snpw9bNiPeOIkkQvw==} + /cross-fetch@3.1.6: + resolution: {integrity: sha512-riRvo06crlE8HiqOwIpQhxwdOk4fOeR7FVM/wXoxchFEqMNUjvbs3bfo4OTgMEMHzppd4DxFBDbyySj8Cv781g==} dependencies: - node-fetch: 2.6.7 + node-fetch: 2.6.11 transitivePeerDependencies: - encoding dev: false @@ -5269,10 +5269,10 @@ packages: '@babel/runtime': 7.21.0 dev: false - /i18next-http-backend@2.2.0: - resolution: {integrity: sha512-Z4sM7R6tzdLknSPER9GisEBxKPg5FkI07UrQniuroZmS15PHQrcCPLyuGKj8SS68tf+O2aEDYSUnmy1TZqZSbw==} + /i18next-http-backend@2.2.1: + resolution: {integrity: sha512-ZXIdn/8NJIBJ0X4hzXfc3STYxKrCKh1fYjji9HPyIpEJfvTvy8/ZlTl8RuTizzCPj2ZcWrfaecyOMKs6bQ7u5A==} dependencies: - cross-fetch: 3.1.5 + cross-fetch: 3.1.6 transitivePeerDependencies: - encoding dev: false @@ -6087,8 +6087,8 @@ packages: engines: {node: '>= 0.6'} dev: true - /node-fetch@2.6.7: - resolution: {integrity: sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==} + /node-fetch@2.6.11: + resolution: {integrity: sha512-4I6pdBY1EthSqDmJkiNk3JIT8cswwR9nfeW/cPdUagJYEQG7R95WRH74wpz7ma8Gh/9dI9FP+OU+0E4FvtA55w==} engines: {node: 4.x || >=6.0.0} peerDependencies: encoding: ^0.1.0 From ca4ae801014eadf7221bdbf43281d173b3a62a60 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 10:11:59 +1000 Subject: [PATCH 65/67] build(deps): update dependency i18next to v22.5.0 (#5459) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/web/package.json b/web/package.json index 4dcfbb0e3..d6bb8c9e0 100644 --- a/web/package.json +++ b/web/package.json @@ -24,7 +24,7 @@ "axios": "1.4.0", "broadcast-channel": "5.1.0", "classnames": "2.3.2", - "i18next": "22.4.15", + "i18next": "22.5.0", "i18next-browser-languagedetector": "7.0.1", "i18next-http-backend": "2.2.1", "qrcode.react": "3.1.0", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 02aa505f6..ecd321d46 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -41,8 +41,8 @@ dependencies: specifier: 2.3.2 version: 2.3.2 i18next: - specifier: 22.4.15 - version: 22.4.15 + specifier: 22.5.0 + version: 22.5.0 i18next-browser-languagedetector: specifier: 7.0.1 version: 7.0.1 @@ -60,7 +60,7 @@ dependencies: version: 18.2.0(react@18.2.0) react-i18next: specifier: 12.2.2 - version: 12.2.2(i18next@22.4.15)(react-dom@18.2.0)(react@18.2.0) + version: 12.2.2(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0) react-loading: specifier: 2.0.3 version: 2.0.3(prop-types@15.8.1)(react@18.2.0) @@ -5277,8 +5277,8 @@ packages: - encoding dev: false - /i18next@22.4.15: - resolution: {integrity: sha512-yYudtbFrrmWKLEhl6jvKUYyYunj4bTBCe2qIUYAxbXoPusY7YmdwPvOE6fx6UIfWvmlbCWDItr7wIs8KEBZ5Zg==} + /i18next@22.5.0: + resolution: {integrity: sha512-sqWuJFj+wJAKQP2qBQ+b7STzxZNUmnSxrehBCCj9vDOW9RDYPfqCaK1Hbh2frNYQuPziz6O2CGoJPwtzY3vAYA==} dependencies: '@babel/runtime': 7.21.0 dev: false @@ -6499,7 +6499,7 @@ packages: react: 18.2.0 scheduler: 0.23.0 - /react-i18next@12.2.2(i18next@22.4.15)(react-dom@18.2.0)(react@18.2.0): + /react-i18next@12.2.2(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0): resolution: {integrity: sha512-KBB6buBmVKXUWNxXHdnthp+38gPyBT46hJCAIQ8rX19NFL/m2ahte2KARfIDf2tMnSAL7wwck6eDOd/9zn6aFg==} peerDependencies: i18next: '>= 19.0.0' @@ -6514,7 +6514,7 @@ packages: dependencies: '@babel/runtime': 7.21.0 html-parse-stringify: 3.0.1 - i18next: 22.4.15 + i18next: 22.5.0 react: 18.2.0 react-dom: 18.2.0(react@18.2.0) dev: false From ee7022c06ad3b5a5cc8c95ca63b09fe5463816fb Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 10:23:40 +1000 Subject: [PATCH 66/67] build(deps): update module github.com/stretchr/testify to v1.8.3 (#5460) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f22b7360e..af8a1ac15 100644 --- a/go.mod +++ b/go.mod @@ -41,7 +41,7 @@ require ( github.com/sirupsen/logrus v1.9.2 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 - github.com/stretchr/testify v1.8.2 + github.com/stretchr/testify v1.8.3 github.com/trustelem/zxcvbn v1.0.1 github.com/valyala/fasthttp v1.47.0 github.com/wneessen/go-mail v0.3.9 diff --git a/go.sum b/go.sum index 477f32bc4..0ce2af4a0 100644 --- a/go.sum +++ b/go.sum @@ -421,8 +421,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= -github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY= +github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8= github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0= github.com/test-go/testify v1.1.4 h1:Tf9lntrKUMHiXQ07qBScBTSA0dhYQlu83hswqelv1iE= From 7840c8a5a0df5c9727b9b286176c367d83ce02d8 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 10:38:28 +1000 Subject: [PATCH 67/67] build(deps): update dependency react-i18next to v12.3.1 (#5457) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- web/package.json | 2 +- web/pnpm-lock.yaml | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/web/package.json b/web/package.json index d6bb8c9e0..9a5d8c6f4 100644 --- a/web/package.json +++ b/web/package.json @@ -30,7 +30,7 @@ "qrcode.react": "3.1.0", "react": "18.2.0", "react-dom": "18.2.0", - "react-i18next": "12.2.2", + "react-i18next": "12.3.1", "react-loading": "2.0.3", "react-router-dom": "6.11.2", "react18-input-otp": "1.1.3", diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index ecd321d46..03ee12832 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -59,8 +59,8 @@ dependencies: specifier: 18.2.0 version: 18.2.0(react@18.2.0) react-i18next: - specifier: 12.2.2 - version: 12.2.2(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0) + specifier: 12.3.1 + version: 12.3.1(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0) react-loading: specifier: 2.0.3 version: 2.0.3(prop-types@15.8.1)(react@18.2.0) @@ -6499,8 +6499,8 @@ packages: react: 18.2.0 scheduler: 0.23.0 - /react-i18next@12.2.2(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0): - resolution: {integrity: sha512-KBB6buBmVKXUWNxXHdnthp+38gPyBT46hJCAIQ8rX19NFL/m2ahte2KARfIDf2tMnSAL7wwck6eDOd/9zn6aFg==} + /react-i18next@12.3.1(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0): + resolution: {integrity: sha512-5v8E2XjZDFzK7K87eSwC7AJcAkcLt5xYZ4+yTPDAW1i7C93oOY1dnr4BaQM7un4Hm+GmghuiPvevWwlca5PwDA==} peerDependencies: i18next: '>= 19.0.0' react: '>= 16.8.0 || 18'