Merge remote-tracking branch 'origin/master' into feat-settings-ui

# Conflicts:
#	web/package.json
#	web/pnpm-lock.yaml

.github/FUNDING.yml

@@ -3,7 +3,7 @@
 
 # github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
 # patreon: # Replace with a single Patreon username
-open_collective: authelia-sponsors
+open_collective: 'authelia-sponsors'
 # ko_fi: # Replace with a single Ko-fi username
 # tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
 # community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -1,12 +1,12 @@
 ---
-name: Bug Report
+name: 'Bug Report'
-description: Report a bug
+description: 'Report a bug'
 labels:
-  - type/bug/unconfirmed
+  - 'type/bug/unconfirmed'
-  - status/needs-triage
+  - 'status/needs-triage'
-  - priority/4/normal
+  - 'priority/4/normal'
 body:
-  - type: markdown
+  - type: 'markdown'
     attributes:
       value: |
         Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first.
@@ -25,160 +25,190 @@ body:
             - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section.
             - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section.
         7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues.
-  - type: dropdown
+  - type: 'dropdown'
-    id: version
+    id: 'version'
     attributes:
-      label: Version
+      label: |
-      description: What version(s) of Authelia can you reproduce this bug on?
+      	Version
+      description: |
+      	What version(s) of Authelia can you reproduce this bug on?
       multiple: true
       options:
-        - v4.37.5
+        - 'v4.37.5'
-        - v4.37.4
+        - 'v4.37.4'
-        - v4.37.3
+        - 'v4.37.3'
-        - v4.37.2
+        - 'v4.37.2'
-        - v4.37.1
+        - 'v4.37.1'
-        - v4.37.0
+        - 'v4.37.0'
-        - v4.36.9
+        - 'v4.36.9'
-        - v4.36.8
+        - 'v4.36.8'
-        - v4.36.7
+        - 'v4.36.7'
-        - v4.36.6
+        - 'v4.36.6'
-        - v4.36.5
+        - 'v4.36.5'
-        - v4.36.4
+        - 'v4.36.4'
-        - v4.36.3
+        - 'v4.36.3'
-        - v4.36.2
+        - 'v4.36.2'
-        - v4.36.1
+        - 'v4.36.1'
-        - v4.36.0
+        - 'v4.36.0'
-        - v4.35.6
+        - 'v4.35.6'
-        - v4.35.5
+        - 'v4.35.5'
-        - v4.35.4
+        - 'v4.35.4'
-        - v4.35.3
+        - 'v4.35.3'
-        - v4.35.2
+        - 'v4.35.2'
-        - v4.35.1
+        - 'v4.35.1'
-        - v4.35.0
+        - 'v4.35.0'
-        - v4.34.6
+        - 'v4.34.6'
-        - v4.34.5
+        - 'v4.34.5'
-        - v4.34.4
+        - 'v4.34.4'
-        - v4.34.3
+        - 'v4.34.3'
-        - v4.34.2
+        - 'v4.34.2'
-        - v4.34.1
+        - 'v4.34.1'
-        - v4.34.0
+        - 'v4.34.0'
-        - v4.33.2
+        - 'v4.33.2'
-        - v4.33.1
+        - 'v4.33.1'
-        - v4.33.0
+        - 'v4.33.0'
-        - v4.32.2
+        - 'v4.32.2'
-        - v4.32.1
+        - 'v4.32.1'
-        - v4.32.0
+        - 'v4.32.0'
     validations:
       required: true
-  - type: dropdown
+  - type: 'dropdown'
-    id: deployment
+    id: 'deployment'
     attributes:
-      label: Deployment Method
+      label: |
-      description: How are you deploying Authelia?
+      	Deployment Method
+      description: |
+      	How are you deploying Authelia?
       options:
-        - Docker
+        - 'Docker'
-        - Kubernetes
+        - 'Kubernetes'
-        - Bare-metal
+        - 'Bare-metal'
-        - Other
+        - 'Other'
     validations:
       required: true
-  - type: dropdown
+  - type: 'dropdown'
-    id: proxy
+    id: 'proxy'
     attributes:
-      label: Reverse Proxy
+      label: |
-      description: What reverse proxy are you using?
+      	Reverse Proxy
+      description: |
+      	What reverse proxy are you using?
       options:
-        - Caddy
+        - 'Caddy'
-        - Traefik
+        - 'Traefik'
-        - Envoy
+        - 'Envoy'
-        - Istio
+        - 'Istio'
-        - NGINX
+        - 'NGINX'
-        - SWAG
+        - 'SWAG'
-        - NGINX Proxy Manager
+        - 'NGINX Proxy Manager'
-        - HAProxy
+        - 'HAProxy'
     validations:
       required: true
-  - type: input
+  - type: 'input'
-    id: proxy-version
+    id: 'proxy-version'
     attributes:
-      label: Reverse Proxy Version
+      label: |
-      description: What is the version of your reverse proxy?
+      	Reverse Proxy Version
-      placeholder: x.x.x
+      description: |
+      	What is the version of your reverse proxy?
+      placeholder: 'x.x.x'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: description
+    id: 'description'
     attributes:
-      label: Description
+      label: |
-      description: Describe the bug.
+      	Description
+      description: |
+      	Describe the bug.
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: reproduction
+    id: 'reproduction'
     attributes:
-      label: Reproduction
+      label: |
-      description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
+      	Reproduction
+      description: |
+      	Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: expectations
+    id: 'expectations'
     attributes:
-      label: Expectations
+      label: |
-      description: Describe the desired or expected results.
+      	Expectations
+      description: |
+      	Describe the desired or expected results.
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: configuration
+    id: 'configuration'
     attributes:
-      label: Configuration (Authelia)
+      label: |
-      description: Provide a complete configuration file (the template will automatically put this content in a code block).
+      	Configuration (Authelia)
-      render: yaml
+      description: |
+      	Provide a complete configuration file (the template will automatically put this content in a code block).
+      render: 'yaml'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: logs
+    id: 'logs'
     attributes:
-      label: Logs (Authelia)
+      label: |
+      	Logs (Authelia)
       description: |
         Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide.
 
         The template will automatically put this content in a code block so you can just paste it.
-      render: shell
+      render: 'shell'
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: logs-other
+    id: 'logs-other'
     attributes:
-      label: Logs (Proxy / Application)
+      label: |
-      description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+      	Logs (Proxy / Application)
-      render: shell
+      description: |
+      	Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+      render: 'shell'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: documentation
+    id: 'documentation'
     attributes:
-      label: Documentation
+      label: |
-      description: Provide any relevant specification or other documentation if applicable.
+      	Documentation
+      description: |
+      	Provide any relevant specification or other documentation if applicable.
     validations:
       required: false
-  - type: checkboxes
+  - type: 'checkboxes'
-    id: checklist
+    id: 'checklist'
     attributes:
-      label: Pre-Submission Checklist
+      label: |
-      description: By submitting this issue confirm all of the following.
+      	Pre-Submission Checklist
+      description: |
+      	By submitting this issue confirm all of the following.
       options:
-        - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+        - label: |
+        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
-        - label: This is a bug report and not a support request
+        - label: |
+        	This is a bug report and not a support request
           required: true
-        - label: I have read the security policy and this bug report is not a security issue or security related issue
+        - label: |
+        	I have read the security policy and this bug report is not a security issue or security related issue
           required: true
-        - label: I have either included the complete configuration file or I am sure it's unrelated to the configuration
+        - label: |
+        	I have either included the complete configuration file or I am sure it's unrelated to the configuration
           required: true
-        - label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
+        - label: |
+        	I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
           required: true
-        - label: I have checked for related proxy or application logs and included them if available
+        - label: |
+        	I have checked for related proxy or application logs and included them if available
           required: true
-        - label: I have checked for related issues and checked the documentation
+        - label: |
+        	I have checked for related issues and checked the documentation
           required: true
 ...

.github/ISSUE_TEMPLATE/config.yml

@@ -1,22 +1,22 @@
 ---
 blank_issues_enabled: false
 contact_links:
-  - name: Idea
+  - name: 'Idea'
-    url: https://github.com/authelia/authelia/discussions/new?category=ideas
+    url: 'https://github.com/authelia/authelia/discussions/new?category=ideas'
-    about: Submit an Idea for Voting
+    about: 'Submit an Idea for Voting'
-  - name: Question
+  - name: 'Question'
-    url: https://github.com/authelia/authelia/discussions/new?category=q-a
+    url: 'https://github.com/authelia/authelia/discussions/new?category=q-a'
-    about: Ask a Question
+    about: 'Ask a Question'
-  - name: Discussion
+  - name: 'Discussion'
-    url: https://github.com/authelia/authelia/discussions/new
+    url: 'https://github.com/authelia/authelia/discussions/new'
-    about: Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics
+    about: 'Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics'
-  - name: Documentation
+  - name: 'Documentation'
-    url: https://www.authelia.com/
+    url: 'https://www.authelia.com/'
-    about: Read the Documentation
+    about: 'Read the Documentation'
-  - name: Matrix
+  - name: 'Matrix'
-    url: https://matrix.to/#/#community:authelia.com
+    url: 'https://matrix.to/#/#community:authelia.com'
-    about: Discuss Authelia with the Developers on Matrix which is the preferred method of contact
+    about: 'Discuss Authelia with the Developers on Matrix which is the preferred method of contact'
-  - name: Discord
+  - name: 'Discord'
-    url: https://discord.authelia.com
+    url: 'https://discord.authelia.com'
-    about: Discuss Authelia with the Developers on Discord which is bridged to Matrix
+    about: 'Discuss Authelia with the Developers on Discord which is bridged to Matrix'
 ...

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -1,12 +1,12 @@
 ---
-name: Feature Request
+name: 'Feature Request'
-description: Submit a Feature Request
+description: 'Submit a Feature Request'
 labels:
-  - type/feature
+  - 'type/feature'
-  - status/needs-design
+  - 'status/needs-design'
-  - priority/4/normal
+  - 'priority/4/normal'
 body:
-  - type: markdown
+  - type: 'markdown'
     attributes:
       value: |
         Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature.
@@ -16,42 +16,54 @@ body:
         1. Ensure there are no other similar feature requests.
         2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already.
         3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist.
-  - type: textarea
+  - type: 'textarea'
-    id: description
+    id: 'description'
     attributes:
-      label: Description
+      label: |
-      description: Describe the feature
+      	Description
+      description: |
+      	Describe the feature
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: use-case
+    id: 'use-case'
     attributes:
-      label: Use Case
+      label: |
-      description: Provide a use case
+      	Use Case
+      description: |
+      	Provide a use case
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: details
+    id: 'details'
     attributes:
-      label: Details
+      label: |
-      description: Describe the feature in detail
+      	Details
+      description: |
+      	Describe the feature in detail
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: documentation
+    id: 'documentation'
     attributes:
-      label: Documentation
+      label: |
-      description: Provide any relevant specification or other documentation if applicable
+      	Documentation
+      description: |
+      	Provide any relevant specification or other documentation if applicable
     validations:
       required: false
-  - type: checkboxes
+  - type: 'checkboxes'
-    id: checklist
+    id: 'checklist'
     attributes:
-      label: Pre-Submission Checklist
+      label: |
-      description: By submitting this issue confirm all of the following
+      	Pre-Submission Checklist
+      description: |
+      	By submitting this issue confirm all of the following
       options:
-        - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+        - label: |
+        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
-        - label: I have checked for related issues and checked the documentation
+        - label: |
+        	I have checked for related issues and checked the documentation
           required: true
 ...

.yamllint.yml

@@ -11,6 +11,7 @@ yaml-files:
 ignore: |
   api/openapi.yml
   docs/pnpm-lock.yaml
+  docs/node_modules/
   internal/configuration/test_resources/config_bad_quoting.yml
   web/pnpm-lock.yaml
   web/node_modules/

Dockerfile

@@ -1,7 +1,7 @@
 # ===================================
 # ===== Authelia official image =====
 # ===================================
-FROM alpine:3.17.3
+FROM alpine:3.18.0
 
 ARG TARGETOS
 ARG TARGETARCH

Dockerfile.coverage

@@ -46,7 +46,7 @@ RUN \
 # ===================================
 # ===== Authelia official image =====
 # ===================================
-FROM alpine:3.17.3
+FROM alpine:3.18.0
 
 RUN apk --no-cache add ca-certificates tzdata
 

Dockerfile.dev

@@ -43,7 +43,7 @@ RUN \
 # ===================================
 # ===== Authelia official image =====
 # ===================================
-FROM alpine:3.17.3
+FROM alpine:3.18.0
 
 WORKDIR /app
 

api/openapi.yml

@@ -200,6 +200,9 @@ paths:
             location:
               description: Redirect Location for user authorization
               example: '{{ $redir }}'
+              schema:
+                type: string
+                format: uri
             set-cookie:
               description: Sets a new cookie value
               schema:
@@ -210,6 +213,9 @@ paths:
             location:
               description: Redirect Location for user authorization
               example: '{{ $redir }}'
+              schema:
+                type: string
+                format: uri
             set-cookie:
               description: Sets a new cookie value
               schema:
@@ -273,6 +279,9 @@ paths:
             location:
               description: Redirect Location for user authorization
               example: '{{ $redir }}'
+              schema:
+                type: string
+                format: uri
             set-cookie:
               description: Sets a new cookie value
               schema:
@@ -283,6 +292,9 @@ paths:
             location:
               description: Redirect Location for user authorization
               example: '{{ $redir }}'
+              schema:
+                type: string
+                format: uri
             set-cookie:
               description: Sets a new cookie value
               schema:
@@ -342,6 +354,9 @@ paths:
             location:
               description: Redirect Location for user authorization
               example: '{{ $redir }}'
+              schema:
+                type: string
+                format: uri
             set-cookie:
               description: Sets a new cookie value
               schema:
@@ -352,6 +367,9 @@ paths:
             location:
               description: Redirect Location for user authorization
               example: '{{ $redir }}'
+              schema:
+                type: string
+                format: uri
             set-cookie:
               description: Sets a new cookie value
               schema:
@@ -411,6 +429,9 @@ paths:
             location:
               description: Redirect Location for user authorization
               example: '{{ $redir }}'
+              schema:
+                type: string
+                format: uri
             set-cookie:
               description: Sets a new cookie value
               schema:

cmd/authelia-gen/helpers.go

@@ -62,6 +62,10 @@ var decodedTypes = []reflect.Type{
 	reflect.TypeOf(url.URL{}),
 	reflect.TypeOf(time.Duration(0)),
 	reflect.TypeOf(schema.Address{}),
+	reflect.TypeOf(schema.AddressTCP{}),
+	reflect.TypeOf(schema.AddressUDP{}),
+	reflect.TypeOf(schema.AddressLDAP{}),
+	reflect.TypeOf(schema.AddressSMTP{}),
 	reflect.TypeOf(schema.X509CertificateChain{}),
 	reflect.TypeOf(schema.PasswordDigest{}),
 	reflect.TypeOf(rsa.PrivateKey{}),

cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl

@@ -1,12 +1,12 @@
 ---
-name: Bug Report
+name: 'Bug Report'
-description: Report a bug
+description: 'Report a bug'
 labels:
 {{- range .Labels }}
-  - {{ . }}
+  - '{{ . }}'
 {{- end }}
 body:
-  - type: markdown
+  - type: 'markdown'
     attributes:
       value: |
         Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first.
@@ -25,122 +25,152 @@ body:
             - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section.
             - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section.
         7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues.
-  - type: dropdown
+  - type: 'dropdown'
-    id: version
+    id: 'version'
     attributes:
-      label: Version
+      label: |
-      description: What version(s) of Authelia can you reproduce this bug on?
+      	Version
+      description: |
+      	What version(s) of Authelia can you reproduce this bug on?
       multiple: true
       options:
       {{- range .Versions }}
-        - {{ . }}
+        - '{{ . }}'
 	  {{- end }}
     validations:
       required: true
-  - type: dropdown
+  - type: 'dropdown'
-    id: deployment
+    id: 'deployment'
     attributes:
-      label: Deployment Method
+      label: |
-      description: How are you deploying Authelia?
+      	Deployment Method
+      description: |
+      	How are you deploying Authelia?
       options:
-        - Docker
+        - 'Docker'
-        - Kubernetes
+        - 'Kubernetes'
-        - Bare-metal
+        - 'Bare-metal'
-        - Other
+        - 'Other'
     validations:
       required: true
-  - type: dropdown
+  - type: 'dropdown'
-    id: proxy
+    id: 'proxy'
     attributes:
-      label: Reverse Proxy
+      label: |
-      description: What reverse proxy are you using?
+      	Reverse Proxy
+      description: |
+      	What reverse proxy are you using?
       options:
       {{- range .Proxies }}
-        - {{ . }}
+        - '{{ . }}'
 	  {{- end }}
     validations:
       required: true
-  - type: input
+  - type: 'input'
-    id: proxy-version
+    id: 'proxy-version'
     attributes:
-      label: Reverse Proxy Version
+      label: |
-      description: What is the version of your reverse proxy?
+      	Reverse Proxy Version
-      placeholder: x.x.x
+      description: |
+      	What is the version of your reverse proxy?
+      placeholder: 'x.x.x'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: description
+    id: 'description'
     attributes:
-      label: Description
+      label: |
-      description: Describe the bug.
+      	Description
+      description: |
+      	Describe the bug.
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: reproduction
+    id: 'reproduction'
     attributes:
-      label: Reproduction
+      label: |
-      description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
+      	Reproduction
+      description: |
+      	Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: expectations
+    id: 'expectations'
     attributes:
-      label: Expectations
+      label: |
-      description: Describe the desired or expected results.
+      	Expectations
+      description: |
+      	Describe the desired or expected results.
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: configuration
+    id: 'configuration'
     attributes:
-      label: Configuration (Authelia)
+      label: |
-      description: Provide a complete configuration file (the template will automatically put this content in a code block).
+      	Configuration (Authelia)
-      render: yaml
+      description: |
+      	Provide a complete configuration file (the template will automatically put this content in a code block).
+      render: 'yaml'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: logs
+    id: 'logs'
     attributes:
-      label: Logs (Authelia)
+      label: |
+      	Logs (Authelia)
       description: |
         Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide.
 
         The template will automatically put this content in a code block so you can just paste it.
-      render: shell
+      render: 'shell'
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: logs-other
+    id: 'logs-other'
     attributes:
-      label: Logs (Proxy / Application)
+      label: |
-      description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+      	Logs (Proxy / Application)
-      render: shell
+      description: |
+      	Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+      render: 'shell'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: documentation
+    id: 'documentation'
     attributes:
-      label: Documentation
+      label: |
-      description: Provide any relevant specification or other documentation if applicable.
+      	Documentation
+      description: |
+      	Provide any relevant specification or other documentation if applicable.
     validations:
       required: false
-  - type: checkboxes
+  - type: 'checkboxes'
-    id: checklist
+    id: 'checklist'
     attributes:
-      label: Pre-Submission Checklist
+      label: |
-      description: By submitting this issue confirm all of the following.
+      	Pre-Submission Checklist
+      description: |
+      	By submitting this issue confirm all of the following.
       options:
-        - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+        - label: |
+        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
-        - label: This is a bug report and not a support request
+        - label: |
+        	This is a bug report and not a support request
           required: true
-        - label: I have read the security policy and this bug report is not a security issue or security related issue
+        - label: |
+        	I have read the security policy and this bug report is not a security issue or security related issue
           required: true
-        - label: I have either included the complete configuration file or I am sure it's unrelated to the configuration
+        - label: |
+        	I have either included the complete configuration file or I am sure it's unrelated to the configuration
           required: true
-        - label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
+        - label: |
+        	I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
           required: true
-        - label: I have checked for related proxy or application logs and included them if available
+        - label: |
+        	I have checked for related proxy or application logs and included them if available
           required: true
-        - label: I have checked for related issues and checked the documentation
+        - label: |
+        	I have checked for related issues and checked the documentation
           required: true
 ...

cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl

@@ -1,12 +1,12 @@
 ---
-name: Feature Request
+name: 'Feature Request'
-description: Submit a Feature Request
+description: 'Submit a Feature Request'
 labels:
 {{- range .Labels }}
-  - {{ . }}
+  - '{{ . }}'
 {{- end }}
 body:
-  - type: markdown
+  - type: 'markdown'
     attributes:
       value: |
         Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature.
@@ -16,42 +16,54 @@ body:
         1. Ensure there are no other similar feature requests.
         2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already.
         3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist.
-  - type: textarea
+  - type: 'textarea'
-    id: description
+    id: 'description'
     attributes:
-      label: Description
+      label: |
-      description: Describe the feature
+      	Description
+      description: |
+      	Describe the feature
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: use-case
+    id: 'use-case'
     attributes:
-      label: Use Case
+      label: |
-      description: Provide a use case
+      	Use Case
+      description: |
+      	Provide a use case
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: details
+    id: 'details'
     attributes:
-      label: Details
+      label: |
-      description: Describe the feature in detail
+      	Details
+      description: |
+      	Describe the feature in detail
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: documentation
+    id: 'documentation'
     attributes:
-      label: Documentation
+      label: |
-      description: Provide any relevant specification or other documentation if applicable
+      	Documentation
+      description: |
+      	Provide any relevant specification or other documentation if applicable
     validations:
       required: false
-  - type: checkboxes
+  - type: 'checkboxes'
-    id: checklist
+    id: 'checklist'
     attributes:
-      label: Pre-Submission Checklist
+      label: |
-      description: By submitting this issue confirm all of the following
+      	Pre-Submission Checklist
+      description: |
+      	By submitting this issue confirm all of the following
       options:
-        - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+        - label: |
+        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
-        - label: I have checked for related issues and checked the documentation
+        - label: |
+        	I have checked for related issues and checked the documentation
           required: true
 ...

crowdin.yml

@@ -1,9 +1,9 @@
 ---
-pull_request_title: "i18n: update translations"
+pull_request_title: 'i18n: update translations'
-commit_message: "i18n: update translation for %original_file_name% (%language%)"
+commit_message: 'i18n: update translation for %original_file_name% (%language%)'
 append_commit_message: false
 files:
-  - source: /internal/server/locales/en/*
+  - source: '/internal/server/locales/en/*'
-    translation: /internal/server/locales/%locale%/%original_file_name%
+    translation: '/internal/server/locales/%locale%/%original_file_name%'
     skip_untranslated_files: true
 ...

docs/config/next/config.toml

@@ -1 +1 @@
-baseurl = "https://authelia-staging.netlify.app/"
+baseurl = "https://authelia-next.netlify.app/"

docs/content/en/configuration/first-factor/file.md

@@ -21,15 +21,15 @@ aliases:
 ```yaml
 authentication_backend:
   file:
-    path: /config/users.yml
+    path: '/config/users.yml'
     watch: false
     search:
       email: false
       case_insensitive: false
     password:
-      algorithm: argon2
+      algorithm: 'argon2'
       argon2:
-        variant: argon2id
+        variant: 'argon2id'
         iterations: 3
         memory: 65536
         parallelism: 4
@@ -42,15 +42,15 @@ authentication_backend:
         key_length: 32
         salt_length: 16
       pbkdf2:
-        variant: sha512
+        variant: 'sha512'
         iterations: 310000
         salt_length: 16
       sha2crypt:
-        variant: sha512
+        variant: 'sha512'
         iterations: 50000
         salt_length: 16
       bcrypt:
-        variant: standard
+        variant: 'standard'
         cost: 12
 ```
 

docs/content/en/configuration/first-factor/introduction.md

@@ -41,6 +41,9 @@ This section describes the individual configuration options.
 
 {{< confkey type="duration" default="5m" required="no" >}}
 
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
+
 This setting controls the interval at which details are refreshed from the backend. Particularly useful for
 [LDAP](#ldap).
 

docs/content/en/configuration/first-factor/ldap.md

@@ -22,15 +22,15 @@ aliases:
 ```yaml
 authentication_backend:
   ldap:
-    implementation: custom
+    address: 'ldap://127.0.0.1'
-    url: ldap://127.0.0.1
+    implementation: 'custom'
-    timeout: 5s
+    timeout: '5s'
     start_tls: false
     tls:
-      server_name: ldap.example.com
+      server_name: 'ldap.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -98,25 +98,54 @@ authentication_backend:
         27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid..
         DO NOT USE==
         -----END RSA PRIVATE KEY-----
-    base_dn: DC=example,DC=com
+    base_dn: 'DC=example,DC=com'
-    additional_users_dn: OU=users
+    additional_users_dn: 'OU=users'
-    users_filter: (&({username_attribute}={input})(objectClass=person))
+    users_filter: '(&({username_attribute}={input})(objectClass=person))'
-    username_attribute: uid
+    username_attribute: 'uid'
-    mail_attribute: mail
+    mail_attribute: 'mail'
-    display_name_attribute: displayName
+    display_name_attribute: 'displayName'
-    additional_groups_dn: OU=groups
+    additional_groups_dn: 'OU=groups'
-    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
-    group_name_attribute: cn
+    group_name_attribute: 'cn'
     permit_referrals: false
     permit_unauthenticated_bind: false
-    user: CN=admin,DC=example,DC=com
+    user: 'CN=admin,DC=example,DC=com'
-    password: password
+    password: 'password'
 ```
 
 ## Options
 
 This section describes the individual configuration options.
 
+### address
+
+{{< confkey type="string" required="yes" >}}
+
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
+
+The LDAP URL which consists of a scheme, hostname, and port. Format is `[<scheme>://]<hostname>[:<port>]`. The default
+scheme is `ldapi` if the path is absolute otherwise it's `ldaps`, and the permitted schemes are `ldap`, `ldaps`, or
+`ldapi` (a unix domain socket).
+
+If the scheme is `ldapi` it must be followed by an absolute path to an existing unix domain socket that the
+user/group the Authelia process is running as has the appropriate permissions to access. For example if the socket is
+located at `/var/run/slapd.sock` the address should be `ldapi:///var/run/slapd.sock`.
+
+__Examples:__
+
+```yaml
+authentication_backend:
+  ldap:
+    address: 'ldaps://dc1.example.com'
+```
+
+```yaml
+authentication_backend:
+  ldap:
+    address: 'ldap://[fd00:1111:2222:3333::1]'
+```
+
 ### implementation
 
 {{< confkey type="string" default="custom" required="no" >}}
@@ -125,31 +154,13 @@ Configures the LDAP implementation used by Authelia.
 
 See the [Implementation Guide](../../reference/guides/ldap.md#implementation-guide) for information.
 
-### url
-
-{{< confkey type="string" required="yes" >}}
-
-The LDAP URL which consists of a scheme, address, and port. Format is `<scheme>://<address>:<port>` or
-`<scheme>://<address>` where scheme is either `ldap` or `ldaps`.
-
-```yaml
-authentication_backend:
-  ldap:
-    url: ldaps://dc1.example.com
-```
-
-If utilising an IPv6 literal address it must be enclosed by square brackets:
-
-```yaml
-authentication_backend:
-  ldap:
-    url: ldap://[fd00:1111:2222:3333::1]
-```
-
 ### timeout
 
 {{< confkey type="duration" default="5s" required="no" >}}
 
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
+
 The timeout for dialing an LDAP connection.
 
 ### start_tls
@@ -162,8 +173,11 @@ URL's are slightly more secure.
 
 ### tls
 
-Controls the TLS connection validation process. You can see how to configure the tls
+*__Reference Note:__ This configuration option uses the
-section [here](../prologue/common.md#tls-configuration).
+[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
+[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
+
+Controls the TLS connection validation parameters for either StartTLS or the TLS socket.
 
 ### base_dn
 

docs/content/en/configuration/identity-providers/introduction.md

@@ -16,4 +16,4 @@ aliases:
 
 ## OpenID Connect
 
-The only identity provider implementation supported at this time is [OpenID Connect 1.0](open-id-connect.md).
+The only identity provider implementation supported at this time is [OpenID Connect 1.0](openid-connect/provider.md).

docs/content/en/configuration/identity-providers/open-id-connect.md

@@ -1,601 +0,0 @@
----
-title: "OpenID Connect"
-description: "OpenID Connect Configuration"
-lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure this."
-date: 2022-06-15T17:51:47+10:00
-draft: false
-images: []
-menu:
-  configuration:
-    parent: "identity-providers"
-weight: 190200
-toc: true
-aliases:
-  - /c/oidc
-  - /docs/configuration/identity-providers/oidc.html
----
-
-__Authelia__ currently supports the [OpenID Connect 1.0] Provider role as an open
-[__beta__](../../roadmap/active/openid-connect.md) feature. We currently do not support the [OpenID Connect 1.0] Relying
-Party role. This means other applications that implement the [OpenID Connect 1.0] Relying Party role can use Authelia as
-an [OpenID Connect 1.0] Provider similar to how you may use social media or development platforms for login.
-
-The [OpenID Connect 1.0] Relying Party role is the role which allows an application to use GitHub, Google, or other
-[OpenID Connect 1.0] Providers for authentication and authorization. We do not intend to support this functionality at
-this moment in time.
-
-More information about the beta can be found in the [roadmap](../../roadmap/active/openid-connect.md).
-
-## Configuration
-
-{{< config-alert-example >}}
-
-```yaml
-identity_providers:
-  oidc:
-    hmac_secret: this_is_a_secret_abc123abc123abc
-    issuer_certificate_chain: |
-      -----BEGIN CERTIFICATE-----
-      MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
-      EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw
-      MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP
-      ADCCAQoCggEBAPKv3pSyP4ozGEiVLJ14dIWFCEGEgq7WUMI0SZZqQA2ID0L59U/Q
-      /Usyy7uC9gfMUzODTpANtkOjFQcQAsxlR1FOjVBrX5QgjSvXwbQn3DtwMA7XWSl6
-      LuYx2rBYSlMSN5UZQm/RxMtXfLK2b51WgEEYDFi+nECSqKzR4R54eOPkBEWRfvuY
-      91AMjlhpivg8e4JWkq4LVQUKbmiFYwIdK8XQiN4blY9WwXwJFYs5sQ/UYMwBFi0H
-      kWOh7GEjfxgoUOPauIueZSMSlQp7zqAH39N0ZSYb6cS0Npj57QoWZSY3ak87ebcR
-      Nf4rCvZLby7LoN7qYCKxmCaDD3x2+NYpWH8CAwEAAaM1MDMwDgYDVR0PAQH/BAQD
-      AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN
-      AQELBQADggEBAHSITqIQSNzonFl3DzxHPEzr2hp6peo45buAAtu8FZHoA+U7Icfh
-      /ZXjPg7Xz+hgFwM/DTNGXkMWacQA/PaNWvZspgRJf2AXvNbMSs2UQODr7Tbv+Fb4
-      lyblmMUNYFMCFVAMU0eIxXAFq2qcwv8UMcQFT0Z/35s6PVOakYnAGGQjTfp5Ljuq
-      wsdc/xWmM0cHWube6sdRRUD7SY20KU/kWzl8iFO0VbSSrDf1AlEhnLEkp1SPaxXg
-      OdBnl98MeoramNiJ7NT6Jnyb3zZ578fjaWfThiBpagItI8GZmG4s4Ovh2JbheN8i
-      ZsjNr9jqHTjhyLVbDRlmJzcqoj4JhbKs6/I^invalid DO NOT USE=
-      -----END CERTIFICATE-----
-      -----BEGIN CERTIFICATE-----
-      MIIDBDCCAeygAwIBAgIRALJsPg21kA0zY4F1wUCIuoMwDQYJKoZIhvcNAQELBQAw
-      EzERMA8GA1UEChMIQXV0aGVsaWEwHhcNNzAwMTAxMDAwMDAwWhcNNzEwMTAxMDAw
-      MDAwWjATMREwDwYDVQQKEwhBdXRoZWxpYTCCASIwDQYJKoZIhvcNAQEBBQADggEP
-      ADCCAQoCggEBAMXHBvVxUzYk0u34/DINMSF+uiOekKOAjOrC6Mi9Ww8ytPVO7t2S
-      zfTvM+XnEJqkFQFgimERfG/eGhjF9XIEY6LtnXe8ATvOK4nTwdufzBaoeQu3Gd50
-      5VXr6OHRo//ErrGvFXwP3g8xLePABsi/fkH3oDN+ztewOBMDzpd+KgTrk8ysv2ou
-      kNRMKFZZqASvCgv0LD5KWvUCnL6wgf1oTXG7aztduA4oSkUP321GpOmBC5+5ElU7
-      ysoRzvD12o9QJ/IfEaulIX06w9yVMo60C/h6A3U6GdkT1SiyTIqR7v7KU/IWd/Qi
-      Lfftcj91VhCmJ73Meff2e2S2PrpjdXbG5FMCAwEAAaNTMFEwDgYDVR0PAQH/BAQD
-      AgKkMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
-      Z7AtA3mzFc0InSBA5fiMfeLXA3owDQYJKoZIhvcNAQELBQADggEBAEE5hm1mtlk/
-      kviCoHH4evbpw7rxPxDftIQlqYTtvMM4eWY/6icFoSZ4fUHEWYyps8SsPu/8f2tf
-      71LGgZn0FdHi1QU2H8m0HHK7TFw+5Q6RLrLdSyk0PItJ71s9en7r8pX820nAFEHZ
-      HkOSfJZ7B5hFgUDkMtVM6bardXAhoqcMk4YCU96e9d4PB4eI+xGc+mNuYvov3RbB
-      D0s8ICyojeyPVLerz4wHjZu68Z5frAzhZ68YbzNs8j2fIBKKHkHyLG1iQyF+LJVj
-      2PjCP+auJsj6fQQpMGoyGtpLcSDh+ptcTngUD8JsWipzTCjmaNqdPHAOYmcgtf4b
-      qocikt3WAdU^invalid DO NOT USE=
-      -----END CERTIFICATE-----
-    issuer_private_key: |
-      -----BEGIN RSA PRIVATE KEY-----
-      MIIEpAIBAAKCAQEA8q/elLI/ijMYSJUsnXh0hYUIQYSCrtZQwjRJlmpADYgPQvn1
-      T9D9SzLLu4L2B8xTM4NOkA22Q6MVBxACzGVHUU6NUGtflCCNK9fBtCfcO3AwDtdZ
-      KXou5jHasFhKUxI3lRlCb9HEy1d8srZvnVaAQRgMWL6cQJKorNHhHnh44+QERZF+
-      +5j3UAyOWGmK+Dx7glaSrgtVBQpuaIVjAh0rxdCI3huVj1bBfAkVizmxD9RgzAEW
-      LQeRY6HsYSN/GChQ49q4i55lIxKVCnvOoAff03RlJhvpxLQ2mPntChZlJjdqTzt5
-      txE1/isK9ktvLsug3upgIrGYJoMPfHb41ilYfwIDAQABAoIBAQDTOdFf2JjHH1um
-      aPgRAvNf9v7Nj5jytaRKs5nM6iNf46ls4QPreXnMhqSeSwj6lpNgBYxOgzC9Q+cc
-      Y4ob/paJJPaIJTxmP8K/gyWcOQlNToL1l+eJ20eQoZm23NGr5fIsunSBwLEpTrdB
-      ENqqtcwhW937K8Pxy/Q1nuLyU2bc6Tn/ivLozc8n27dpQWWKh8537VY7ancIaACr
-      LJJLYxKqhQpjtBWAyCDvZQirnAOm9KnvIHaGXIswCZ4Xbsu0Y9NL+woARPyRVQvG
-      jfxy4EmO9s1s6y7OObSukwKDSNihAKHx/VIbvVWx8g2Lv5fGOa+J2Y7o9Qurs8t5
-      BQwMTt0BAoGBAPUw5Z32EszNepAeV3E2mPFUc5CLiqAxagZJuNDO2pKtyN29ETTR
-      Ma4O1cWtGb6RqcNNN/Iukfkdk27Q5nC9VJSUUPYelOLc1WYOoUf6oKRzE72dkMQV
-      R4bf6TkjD+OVR17fAfkswkGahZ5XA7j48KIQ+YC4jbnYKSxZTYyKPjH/AoGBAP1i
-      tqXt36OVlP+y84wWqZSjMelBIVa9phDVGJmmhz3i1cMni8eLpJzWecA3pfnG6Tm9
-      ze5M4whASleEt+M00gEvNaU9ND+z0wBfi+/DwJYIbv8PQdGrBiZFrPhTPjGQUldR
-      lXccV2meeLZv7TagVxSi3DO6dSJfSEHyemd5j9mBAoGAX8Hv+0gOQZQCSOTAq8Nx
-      6dZcp9gHlNaXnMsP9eTDckOSzh636JPGvj6m+GPJSSbkURUIQ3oyokMNwFqvlNos
-      fTaLhAOfjBZI9WnDTTQxpugWjphJ4HqbC67JC/qIiw5S6FdaEvGLEEoD4zoChywZ
-      9oGAn+fz2d/0/JAH/FpFPgsCgYEAp/ipZgPzziiZ9ov1wbdAQcWRj7RaWnssPFpX
-      jXwEiXT3CgEMO4MJ4+KWIWOChrti3qFBg6i6lDyyS6Qyls7sLFbUdC7HlTcrOEMe
-      rBoTcCI1GqZNlqWOVQ65ZIEiaI7o1vPBZo2GMQEZuq8mDKFsOMThvvTrM5cAep84
-      n6HJR4ECgYABWcbsSnr0MKvVth/inxjbKapbZnp2HUCuw87Ie5zK2Of/tbC20wwk
-      yKw3vrGoE3O1t1g2m2tn8UGGASeZ842jZWjIODdSi5+icysQGuULKt86h/woz2SQ
-      27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid..
-      DO NOT USE==
-      -----END RSA PRIVATE KEY-----
-    access_token_lifespan: 1h
-    authorize_code_lifespan: 1m
-    id_token_lifespan: 1h
-    refresh_token_lifespan: 90m
-    enable_client_debug_messages: false
-    enforce_pkce: public_clients_only
-    cors:
-      endpoints:
-        - authorization
-        - token
-        - revocation
-        - introspection
-      allowed_origins:
-        - https://example.com
-      allowed_origins_from_client_redirect_uris: false
-    clients:
-      - id: myapp
-        description: My Application
-        secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
-        sector_identifier: ''
-        public: false
-        authorization_policy: two_factor
-        consent_mode: explicit
-        pre_configured_consent_duration: 1w
-        audience: []
-        scopes:
-          - openid
-          - groups
-          - email
-          - profile
-        redirect_uris:
-          - https://oidc.example.com:8080/oauth2/callback
-        grant_types:
-          - refresh_token
-          - authorization_code
-        response_types:
-          - code
-        response_modes:
-          - form_post
-          - query
-          - fragment
-        userinfo_signing_algorithm: none
-```
-
-## Options
-
-This section describes the individual configuration options.
-
-### hmac_secret
-
-{{< confkey type="string" required="yes" >}}
-
-*__Important Note:__ This can also be defined using a [secret](../methods/secrets.md) which is __strongly recommended__
-especially for containerized deployments.*
-
-The HMAC secret used to sign the [JWT]'s. The provided string is hashed to a SHA256 ([RFC6234]) byte string for the
-purpose of meeting the required format.
-
-It's __strongly recommended__ this is a
-[Random Alphanumeric String](../../reference/guides/generating-secure-values.md#generating-a-random-alphanumeric-string)
-with 64 or more characters.
-
-### issuer_certificate_chain
-
-{{< confkey type="string" required="no" >}}
-
-The certificate chain/bundle to be used with the [issuer_private_key](#issuer_private_key) DER base64 ([RFC4648])
-encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t]
-JSON key's in the JWKs [Discoverable Endpoint](../../integration/openid-connect/introduction.md#discoverable-endpoints)
-as per [RFC7517].
-
-[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517
-[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7
-[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8
-
-The first certificate in the chain must have the public key for the [issuer_private_key](#issuerprivatekey), each
-certificate in the chain must be valid for the current date, and each certificate in the chain should be signed by the
-certificate immediately following it if present.
-
-### issuer_private_key
-
-{{< confkey type="string" required="yes" >}}
-
-*__Important Note:__ This can also be defined using a [secret](../methods/secrets.md) which is __strongly recommended__
-especially for containerized deployments.*
-
-The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator
-and can be done by following the
-[Generating an RSA Keypair](../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide.
-
-The private key *__MUST__*:
-* Be a PEM block encoded in the DER base64 format ([RFC4648]).
-* Be an RSA Key.
-* Have a key size of at least 2048 bits.
-
-If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public
-key data for the first certificate in the chain.
-
-### access_token_lifespan
-
-{{< confkey type="duration" default="1h" required="no" >}}
-
-The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default.
-For more information read these docs about [token lifespan].
-
-### authorize_code_lifespan
-
-{{< confkey type="duration" default="1m" required="no" >}}
-
-The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to
-obtain the other token types. For more information read these docs about [token lifespan].
-
-### id_token_lifespan
-
-{{< confkey type="duration" default="1h" required="no" >}}
-
-The maximum lifetime of an ID token. For more information read these docs about [token lifespan].
-
-### refresh_token_lifespan
-
-{{< confkey type="string" default="90m" required="no" >}}
-
-The maximum lifetime of a refresh token. The
-refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an
-up-to-date expiration. For more information read these docs about [token lifespan].
-
-A good starting point is 50% more or 30 minutes more (which ever is less) time than the highest lifespan out of the
-[access token lifespan](#access_token_lifespan), the [authorize code lifespan](#authorize_code_lifespan), and the
-[id token lifespan](#id_token_lifespan). For instance the default for all of these is 60 minutes, so the default refresh
-token lifespan is 90 minutes.
-
-### enable_client_debug_messages
-
-{{< confkey type="boolean" default="false" required="no" >}}
-
-Allows additional debug messages to be sent to the clients.
-
-### minimum_parameter_entropy
-
-{{< confkey type="integer" default="8" required="no" >}}
-
-This controls the minimum length of the `nonce` and `state` parameters.
-
-*__Security Notice:__* Changing this value is generally discouraged, reducing it from the default can theoretically
-make certain scenarios less secure. It is highly encouraged that if your OpenID Connect RP does not send these
-parameters or sends parameters with a lower length than the default that they implement a change rather than changing
-this value.
-
-### enforce_pkce
-
-{{< confkey type="string" default="public_clients_only" required="no" >}}
-
-[Proof Key for Code Exchange](https://datatracker.ietf.org/doc/html/rfc7636) enforcement policy: if specified, must be
-either `never`, `public_clients_only` or `always`.
-
-If set to `public_clients_only` (default), [PKCE] will be required for public clients using the
-[Authorization Code Flow].
-
-When set to `always`, [PKCE] will be required for all clients using the Authorization Code flow.
-
-*__Security Notice:__* Changing this value to `never` is generally discouraged, reducing it from the default can
-theoretically make certain client-side applications (mobile applications, SPA) vulnerable to CSRF and authorization code
-interception attacks.
-
-### enable_pkce_plain_challenge
-
-{{< confkey type="boolean" default="false" required="no" >}}
-
-Allows [PKCE] `plain` challenges when set to `true`.
-
-*__Security Notice:__* Changing this value is generally discouraged. Applications should use the `S256` [PKCE] challenge
-method instead.
-
-### pushed_authorizations
-
-Controls the behaviour of [Pushed Authorization Requests].
-
-#### enforce
-
-{{< confkey type="boolean" default="false" required="no" >}}
-
-When enabled all authorization requests must use the [Pushed Authorization Requests] flow.
-
-#### context_lifespan
-
-{{< confkey type="duration" default="5m" required="no" >}}
-
-The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated
-`request_uri` being utilized by a client.
-
-### cors
-
-Some [OpenID Connect 1.0] Endpoints need to allow cross-origin resource sharing, however some are optional. This section allows
-you to configure the optional parts. We reply with CORS headers when the request includes the Origin header.
-
-#### endpoints
-
-{{< confkey type="list(string)" required="no" >}}
-
-A list of endpoints to configure with cross-origin resource sharing headers. It is recommended that the `userinfo`
-option is at least in this list. The potential endpoints which this can be enabled on are as follows:
-
-* authorization
-* pushed-authorization-request
-* token
-* revocation
-* introspection
-* userinfo
-
-#### allowed_origins
-
-{{< confkey type="list(string)" required="no" >}}
-
-A list of permitted origins.
-
-Any origin with https is permitted unless this option is configured or the
-[allowed_origins_from_client_redirect_uris](#allowed_origins_from_client_redirect_uris) option is enabled. This means
-you must configure this option manually if you want http endpoints to be permitted to make cross-origin requests to the
-[OpenID Connect 1.0] endpoints, however this is not recommended.
-
-Origins must only have the scheme, hostname and port, they may not have a trailing slash or path.
-
-In addition to an Origin URI, you may specify the wildcard origin in the allowed_origins. It MUST be specified by itself
-and the [allowed_origins_from_client_redirect_uris](#allowedoriginsfromclientredirecturis) MUST NOT be enabled. The
-wildcard origin is denoted as `*`. Examples:
-
-```yaml
-identity_providers:
-  oidc:
-    cors:
-      allowed_origins: "*"
-```
-
-```yaml
-identity_providers:
-  oidc:
-    cors:
-      allowed_origins:
-        - "*"
-```
-
-#### allowed_origins_from_client_redirect_uris
-
-{{< confkey type="boolean" default="false" required="no" >}}
-
-Automatically adds the origin portion of all redirect URI's on all clients to the list of
-[allowed_origins](#allowed_origins), provided they have the scheme http or https and do not have the hostname of
-localhost.
-
-### clients
-
-{{< confkey type="list" required="yes" >}}
-
-A list of clients to configure. The options for each client are described below.
-
-#### id
-
-{{< confkey type="string" required="yes" >}}
-
-The Client ID for this client. It must exactly match the Client ID configured in the application
-consuming this client.
-
-#### description
-
-{{< confkey type="string" default="*same as id*" required="no" >}}
-
-A friendly description for this client shown in the UI. This defaults to the same as the ID.
-
-#### secret
-
-{{< confkey type="string" required="situational" >}}
-
-The shared secret between Authelia and the application consuming this client. This secret must match the secret
-configured in the application.
-
-This secret must be generated by the administrator and can be done by following the
-[How Do I Generate Client Secrets](../../integration/openid-connect/frequently-asked-questions.md#how-do-i-generate-client-secrets) FAQ.
-
-This must be provided when the client is a confidential client type, and must be blank when using the public client
-type. To set the client type to public see the [public](#public) configuration option.
-
-#### sector_identifier
-
-{{< confkey type="string" required="no" >}}
-
-*__Important Note:__ because adjusting this option will inevitably change the `sub` claim of all tokens generated for
-the specified client, changing this should cause the relying party to detect all future authorizations as completely new
-users.*
-
-Must be an empty string or the host component of a URL. This is commonly just the domain name, but may also include a
-port.
-
-Authelia utilizes UUID version 4 subject identifiers. By default the public [Subject Identifier Type] is utilized for
-all clients. This means the subject identifiers will be the same for all clients. This configuration option enables
-[Pairwise Identifier Algorithm] for this client, and configures the sector identifier utilized for both the storage and
-the lookup of the subject identifier.
-
-1. All clients who do not have this configured will generate the same subject identifier for a particular user
-   regardless of which client obtains the ID token.
-2. All clients which have the same sector identifier will:
-   1. have the same subject identifier for a particular user when compared to clients with the same sector identifier.
-   2. have a completely different subject identifier for a particular user whe compared to:
-      1. any client with the public subject identifier type.
-      2. any client with a differing sector identifier.
-
-In specific but limited scenarios this option is beneficial for privacy reasons. In particular this is useful when the
-party utilizing the *Authelia* [OpenID Connect 1.0] Authorization Server is foreign and not controlled by the user. It would
-prevent the third party utilizing the subject identifier with another third party in order to track the user.
-
-Keep in mind depending on the other claims they may still be able to perform this tracking and it is not a silver
-bullet. There are very few benefits when utilizing this in a homelab or business where no third party is utilizing
-the server.
-
-#### public
-
-{{< confkey type="bool" default="false" required="no" >}}
-
-This enables the public client type for this client. This is for clients that are not capable of maintaining
-confidentiality of credentials, you can read more about client types in [RFC6749 Section 2.1]. This is particularly
-useful for SPA's and CLI tools. This option requires setting the [client secret](#secret) to a blank string.
-
-#### redirect_uris
-
-{{< confkey type="list(string)" required="yes" >}}
-
-A list of valid callback URIs this client will redirect to. All other callbacks will be considered unsafe. The URIs are
-case-sensitive and they differ from application to application - the community has provided
-[a list of URL´s for common applications](../../integration/openid-connect/introduction.md).
-
-Some restrictions that have been placed on clients and
-their redirect URIs are as follows:
-
-1. If a client attempts to authorize with Authelia and its redirect URI is not listed in the client configuration the
-   attempt to authorize will fail and an error will be generated.
-2. The redirect URIs are case-sensitive.
-3. The URI must include a scheme and that scheme must be one of `http` or `https`.
-
-#### audience
-
-{{< confkey type="list(string)" required="no" >}}
-
-A list of audiences this client is allowed to request.
-
-#### scopes
-
-{{< confkey type="list(string)" default="openid, groups, profile, email" required="no" >}}
-
-A list of scopes to allow this client to consume. See
-[scope definitions](../../integration/openid-connect/introduction.md#scope-definitions) for more information. The
-documentation for the application you are trying to configure [OpenID Connect 1.0] for will likely have a list of scopes
-or claims required which can be matched with the above guide.
-
-#### response_types
-
-{{< confkey type="list(string)" default="code" required="no" >}}
-
-*__Security Note:__ It is recommended that only the `code` response type (i.e. the default) is used. The other response
-types are not as secure as this response type.*
-
-A list of response types this client supports. If a response type not in this list is requested by a client then an
-error will be returned to the client. The response type indicates the types of values that are returned to the client.
-
-See the [Response Types](../../integration/openid-connect/introduction.md#response-types) section of the
-[OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md#response-types) for more information.
-
-#### response_modes
-
-{{< confkey type="list(string)" default="form_post, query" required="no" >}}
-
-*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.*
-
-A list of response modes this client supports. If a response mode not in this list is requested by a client then an
-error will be returned to the client. The response mode controls how the response type is returned to the client.
-
-See the [Response Modes](../../integration/openid-connect/introduction.md#response-modes) section of the
-[OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md#response-modes) for more
-information.
-
-The default values are based on the [response_types](#responsetypes) values. When the [response_types](#responsetypes)
-values include the `code` type then the `query` response mode will be included. When any other type is included the
-`fragment` response mode will be included. It's important to note at this time we do not support the `none` response
-type, but when it is supported it will include the `query` response mode.
-
-#### grant_types
-
-{{< confkey type="list(string)" default="authorization_code" required="no" >}}
-
-*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.*
-
-The list of grant types this client is permitted to use in order to obtain access to the relevant tokens.
-
-See the [Grant Types](../../integration/openid-connect/introduction.md#grant-types) section of the
-[OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md#grant-types) for more information.
-
-#### authorization_policy
-
-{{< confkey type="string" default="two_factor" required="no" >}}
-
-The authorization policy for this client: either `one_factor` or `two_factor`.
-
-#### enforce_par
-
-{{< confkey type="boolean" default="false" required="no" >}}
-
-Enforces the use of a [Pushed Authorization Requests] flow for this client.
-
-#### enforce_pkce
-
-{{< confkey type="bool" default="false" required="no" >}}
-
-This setting enforces the use of [PKCE] for this individual client. To enforce it for all clients see the global
-[enforce_pkce](#enforcepkce) setting.
-
-#### pkce_challenge_method
-
-{{< confkey type="string" default="" required="no" >}}
-
-This setting enforces the use of the specified [PKCE] challenge method for this individual client. This setting also
-effectively enables the [enforce_pkce](#enforcepkce-1) option for this client.
-
-Valid values are an empty string, `plain`, or `S256`. It should be noted that `S256` is strongly recommended if the
-relying party supports it.
-
-#### userinfo_signing_algorithm
-
-{{< confkey type="string" default="none" required="no" >}}
-
-The algorithm used to sign the userinfo endpoint responses. This can either be `none` or `RS256`.
-
-See the [integration guide](../../integration/openid-connect/introduction.md#user-information-signing-algorithm) for
-more information.
-
-#### token_endpoint_auth_method
-
-{{< confkey type="string" default="" required="no" >}}
-
-The registered client authentication mechanism used by this client for the [Token Endpoint]. If no method is defined
-the confidential client type will accept any supported method. The public client type defaults to `none` as this
-is required by the specification. This may be required as a breaking change in future versions.
-Supported values are `client_secret_basic`, `client_secret_post`, and `none`.
-
-See the [integration guide](../../integration/openid-connect/introduction.md#client-authentication-method) for
-more information.
-
-#### consent_mode
-
-{{< confkey type="string" default="auto" required="no" >}}
-
-*__Important Note:__ the `implicit` consent mode is not technically part of the specification. It theoretically could be
-misused in certain conditions specifically with the public client type or when the client credentials (i.e. client
-secret) has been exposed to an attacker. For these reasons this mode is discouraged.*
-
-Configures the consent mode. The following table describes the different modes:
-
-|     Value      |                                                                  Description                                                                   |
-|:--------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|
-|      auto      | Automatically determined (default). Uses `explicit` unless [pre_configured_consent_duration] is specified in which case uses `pre-configured`. |
-|    explicit    |                                   Requires the user provide unique explicit consent for every authorization.                                   |
-|    implicit    |                   Automatically assumes consent for every authorization, never asking the user if they wish to give consent.                   |
-| pre-configured |                            Allows the end-user to remember their consent for the [pre_configured_consent_duration].                            |
-
-[pre_configured_consent_duration]: #preconfiguredconsentduration
-
-#### pre_configured_consent_duration
-
-{{< confkey type="duration" default="1w" required="no" >}}
-
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
-
-Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is
-specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`.
-
-The period of time dictates how long a users choice to remember the pre-configured consent lasts.
-
-Pre-configured consents are only valid if the subject, client id are exactly the same and the requested scopes/audience
-match exactly with the granted scopes/audience.
-
-[consent_mode]: #consentmode
-
-## Integration
-
-To integrate Authelia's [OpenID Connect 1.0] implementation with a relying party please see the
-[integration docs](../../integration/openid-connect/introduction.md).
-
-[token lifespan]: https://docs.apigee.com/api-platform/antipatterns/oauth-long-expiration
-[OpenID Connect 1.0]: https://openid.net/connect/
-[Token Endpoint]: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
-[JWT]: https://datatracker.ietf.org/doc/html/rfc7519
-[RFC6234]: https://datatracker.ietf.org/doc/html/rfc6234
-[RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648
-[RFC7468]: https://datatracker.ietf.org/doc/html/rfc7468
-[RFC6749 Section 2.1]: https://datatracker.ietf.org/doc/html/rfc6749#section-2.1
-[PKCE]: https://datatracker.ietf.org/doc/html/rfc7636
-[Authorization Code Flow]: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth
-[Subject Identifier Type]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
-[Pairwise Identifier Algorithm]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
-[Pushed Authorization Requests]: https://datatracker.ietf.org/doc/html/rfc9126

docs/content/en/configuration/identity-providers/openid-connect/_index.md

@@ -0,0 +1,15 @@
+---
+title: "OpenID Connect 1.0"
+description: ""
+lead: ""
+date: 2023-05-08T13:38:08+10:00
+lastmod: 2022-01-18T20:07:56+01:00
+draft: false
+images: []
+menu:
+  docs:
+    parent: "identity-providers"
+    identifier: "openid-connect"
+weight: 190120
+toc: true
+---

docs/content/en/configuration/identity-providers/openid-connect/clients.md

@@ -0,0 +1,413 @@
+---
+title: "OpenID Connect 1.0 Clients"
+description: "OpenID Connect 1.0 Registered Clients Configuration"
+lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure the registered clients."
+date: 2023-05-08T13:38:08+10:00
+draft: false
+images: []
+menu:
+  configuration:
+    parent: "openid-connect"
+weight: 190220
+toc: true
+---
+
+This section covers specifics regarding configuring the providers registered clients for [OpenID Connect 1.0]. For the
+provider specific configuration and information not related to clients see the [OpenID Connect 1.0 Provider](provider.md)
+documentation.
+
+More information about OpenID Connect can be found in the [roadmap](../../../roadmap/active/openid-connect.md) and in the
+[integration](../../../integration/openid-connect/introduction.md) documentation.
+
+## Configuration
+
+The following snippet provides a configuration example for the [OpenID Connect 1.0] Registered Clients. This is not
+intended for production use it's used to provide context and an indentation example.
+
+```yaml
+identity_providers:
+  oidc:
+    clients:
+      - id: myapp
+        description: My Application
+        secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
+        sector_identifier: ''
+        public: false
+        redirect_uris:
+          - https://oidc.example.com:8080/oauth2/callback
+        audience: []
+        scopes:
+          - openid
+          - groups
+          - email
+          - profile
+        grant_types:
+          - refresh_token
+          - authorization_code
+        response_types:
+          - code
+        response_modes:
+          - form_post
+          - query
+          - fragment
+        authorization_policy: two_factor
+        consent_mode: explicit
+        pre_configured_consent_duration: 1w
+        enforce_par: false
+        enforce_pkce: false
+        pkce_challenge_method: S256
+        token_endpoint_auth_method: ''
+        token_endpoint_auth_signing_alg: RS256
+        id_token_signing_alg: RS256
+        request_object_signing_alg: RS256
+        userinfo_signing_alg: none
+```
+
+## Options
+
+### id
+
+{{< confkey type="string" required="yes" >}}
+
+The Client ID for this client. It must exactly match the Client ID configured in the application consuming this client.
+
+### description
+
+{{< confkey type="string" default="*same as id*" required="no" >}}
+
+A friendly description for this client shown in the UI. This defaults to the same as the ID.
+
+### secret
+
+{{< confkey type="string" required="situational" >}}
+
+The shared secret between Authelia and the application consuming this client. This secret must match the secret
+configured in the application.
+
+This secret must be generated by the administrator and can be done by following the
+[How Do I Generate Client Secrets](../../../integration/openid-connect/frequently-asked-questions.md#how-do-i-generate-client-secrets) FAQ.
+
+This must be provided when the client is a confidential client type, and must be blank when using the public client
+type. To set the client type to public see the [public](#public) configuration option.
+
+### sector_identifier
+
+{{< confkey type="string" required="no" >}}
+
+*__Important Note:__ because adjusting this option will inevitably change the `sub` claim of all tokens generated for
+the specified client, changing this should cause the relying party to detect all future authorizations as completely new
+users.*
+
+Must be an empty string or the host component of a URL. This is commonly just the domain name, but may also include a
+port.
+
+Authelia utilizes UUID version 4 subject identifiers. By default the public [Subject Identifier Type] is utilized for
+all clients. This means the subject identifiers will be the same for all clients. This configuration option enables
+[Pairwise Identifier Algorithm] for this client, and configures the sector identifier utilized for both the storage and
+the lookup of the subject identifier.
+
+1. All clients who do not have this configured will generate the same subject identifier for a particular user
+   regardless of which client obtains the ID token.
+2. All clients which have the same sector identifier will:
+   1. have the same subject identifier for a particular user when compared to clients with the same sector identifier.
+   2. have a completely different subject identifier for a particular user whe compared to:
+      1. any client with the public subject identifier type.
+      2. any client with a differing sector identifier.
+
+In specific but limited scenarios this option is beneficial for privacy reasons. In particular this is useful when the
+party utilizing the *Authelia* [OpenID Connect 1.0] Authorization Server is foreign and not controlled by the user. It would
+prevent the third party utilizing the subject identifier with another third party in order to track the user.
+
+Keep in mind depending on the other claims they may still be able to perform this tracking and it is not a silver
+bullet. There are very few benefits when utilizing this in a homelab or business where no third party is utilizing
+the server.
+
+### public
+
+{{< confkey type="bool" default="false" required="no" >}}
+
+This enables the public client type for this client. This is for clients that are not capable of maintaining
+confidentiality of credentials, you can read more about client types in [RFC6749 Section 2.1]. This is particularly
+useful for SPA's and CLI tools. This option requires setting the [client secret](#secret) to a blank string.
+
+### redirect_uris
+
+{{< confkey type="list(string)" required="yes" >}}
+
+A list of valid callback URIs this client will redirect to. All other callbacks will be considered unsafe. The URIs are
+case-sensitive and they differ from application to application - the community has provided
+[a list of URL´s for common applications](../../../integration/openid-connect/introduction.md).
+
+Some restrictions that have been placed on clients and
+their redirect URIs are as follows:
+
+1. If a client attempts to authorize with Authelia and its redirect URI is not listed in the client configuration the
+   attempt to authorize will fail and an error will be generated.
+2. The redirect URIs are case-sensitive.
+3. The URI must include a scheme and that scheme must be one of `http` or `https`.
+
+### audience
+
+{{< confkey type="list(string)" required="no" >}}
+
+A list of audiences this client is allowed to request.
+
+### scopes
+
+{{< confkey type="list(string)" default="openid, groups, profile, email" required="no" >}}
+
+A list of scopes to allow this client to consume. See
+[scope definitions](../../../integration/openid-connect/introduction.md#scope-definitions) for more information. The
+documentation for the application you are trying to configure [OpenID Connect 1.0] for will likely have a list of scopes
+or claims required which can be matched with the above guide.
+
+### grant_types
+
+{{< confkey type="list(string)" default="authorization_code" required="no" >}}
+
+*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.*
+
+The list of grant types this client is permitted to use in order to obtain access to the relevant tokens.
+
+See the [Grant Types](../../../integration/openid-connect/introduction.md#grant-types) section of the
+[OpenID Connect 1.0 Integration Guide](../../../integration/openid-connect/introduction.md#grant-types) for more information.
+
+### response_types
+
+{{< confkey type="list(string)" default="code" required="no" >}}
+
+*__Security Note:__ It is recommended that only the `code` response type (i.e. the default) is used. The other response
+types are not as secure as this response type.*
+
+A list of response types this client supports. If a response type not in this list is requested by a client then an
+error will be returned to the client. The response type indicates the types of values that are returned to the client.
+
+See the [Response Types](../../../integration/openid-connect/introduction.md#response-types) section of the
+[OpenID Connect 1.0 Integration Guide](../../../integration/openid-connect/introduction.md#response-types) for more information.
+
+### response_modes
+
+{{< confkey type="list(string)" default="form_post, query" required="no" >}}
+
+*__Important Note:__ It is recommended that this isn't configured at this time unless you know what you're doing.*
+
+A list of response modes this client supports. If a response mode not in this list is requested by a client then an
+error will be returned to the client. The response mode controls how the response type is returned to the client.
+
+See the [Response Modes](../../../integration/openid-connect/introduction.md#response-modes) section of the
+[OpenID Connect 1.0 Integration Guide](../../../integration/openid-connect/introduction.md#response-modes) for more
+information.
+
+The default values are based on the [response_types](#responsetypes) values. When the [response_types](#responsetypes)
+values include the `code` type then the `query` response mode will be included. When any other type is included the
+`fragment` response mode will be included. It's important to note at this time we do not support the `none` response
+type, but when it is supported it will include the `query` response mode.
+
+### authorization_policy
+
+{{< confkey type="string" default="two_factor" required="no" >}}
+
+The authorization policy for this client: either `one_factor` or `two_factor`.
+
+### consent_mode
+
+{{< confkey type="string" default="auto" required="no" >}}
+
+*__Important Note:__ the `implicit` consent mode is not technically part of the specification. It theoretically could be
+misused in certain conditions specifically with the public client type or when the client credentials (i.e. client
+secret) has been exposed to an attacker. For these reasons this mode is discouraged.*
+
+Configures the consent mode. The following table describes the different modes:
+
+|     Value      |                                                                  Description                                                                   |
+|:--------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|
+|      auto      | Automatically determined (default). Uses `explicit` unless [pre_configured_consent_duration] is specified in which case uses `pre-configured`. |
+|    explicit    |                                   Requires the user provide unique explicit consent for every authorization.                                   |
+|    implicit    |                   Automatically assumes consent for every authorization, never asking the user if they wish to give consent.                   |
+| pre-configured |                            Allows the end-user to remember their consent for the [pre_configured_consent_duration].                            |
+
+[pre_configured_consent_duration]: #preconfiguredconsentduration
+
+### pre_configured_consent_duration
+
+{{< confkey type="duration" default="1w" required="no" >}}
+
+*__Note:__ This setting uses the [duration notation format](../../prologue/common.md#duration-notation-format). Please see
+the [common options](../../prologue/common.md#duration-notation-format) documentation for information on this format.*
+
+Specifying this in the configuration without a consent [consent_mode] enables the `pre-configured` mode. If this is
+specified as well as the [consent_mode] then it only has an effect if the [consent_mode] is `pre-configured` or `auto`.
+
+The period of time dictates how long a users choice to remember the pre-configured consent lasts.
+
+Pre-configured consents are only valid if the subject, client id are exactly the same and the requested scopes/audience
+match exactly with the granted scopes/audience.
+
+[consent_mode]: #consentmode
+
+### enforce_par
+
+{{< confkey type="boolean" default="false" required="no" >}}
+
+This configuration option enforces the use of a [Pushed Authorization Requests] flow for this registered client.
+To enforce it for all clients see the global [pushed_authorizations enforce](provider.md#enforce) provider configuration
+option.
+
+### enforce_pkce
+
+{{< confkey type="bool" default="false" required="no" >}}
+
+This configuration option enforces the use of [PKCE] for this registered client. To enforce it for all clients see the
+global [enforce_pkce](provider.md#enforcepkce) provider configuration option.
+
+### pkce_challenge_method
+
+{{< confkey type="string" default="" required="no" >}}
+
+This setting enforces the use of the specified [PKCE] challenge method for this individual client. This setting also
+effectively enables the [enforce_pkce](#enforcepkce) option for this client.
+
+Valid values are an empty string, `plain`, or `S256`. It should be noted that `S256` is strongly recommended if the
+relying party supports it.
+
+### token_endpoint_auth_method
+
+{{< confkey type="string" default="" required="no" >}}
+
+The registered client authentication mechanism used by this client for the [Token Endpoint]. If no method is defined
+the confidential client type will accept any supported method. The public client type defaults to `none` as this
+is required by the specification. This may be required as a breaking change in future versions.
+Supported values are `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, and `none`.
+
+See the [integration guide](../../../integration/openid-connect/introduction.md#client-authentication-method) for
+more information.
+
+### token_endpoint_auth_signing_alg
+
+{{< confkey type="string" default="RS256" required="no" >}}
+
+The JWT signing algorithm accepted when the [token_endpoint_auth_method](#tokenendpointauthmethod) is configured as
+`client_secret_jwt` or `private_key_jwt`.
+
+See the request object section of the [integration guide](../../../integration/openid-connect/introduction.md#request-object)
+for more information including the algorithm column for supported values.
+
+It's recommended that you specifically configure this when the following options are configured to specific values
+otherwise we assume the default value:
+
+|                    Configuration Option                    |        Value        | Default |
+|:----------------------------------------------------------:|:-------------------:|:-------:|
+| [token_endpoint_auth_method](#tokenendpointauthsigningalg) |  `private_key_jwt`  | `RS256` |
+| [token_endpoint_auth_method](#tokenendpointauthsigningalg) | `client_secret_jwt` | `HS256` |
+
+### request_object_signing_alg
+
+{{< confkey type="string" default="RSA256" required="no" >}}
+
+The JWT signing algorithm accepted for request objects.
+
+See the request object section of the [integration guide](../../../integration/openid-connect/introduction.md#request-object)
+for more information including the algorithm column for supported values.
+
+### id_token_signing_alg
+
+{{< confkey type="string" default="RS256" required="no" >}}
+
+The algorithm used to sign the ID Tokens in the token responses.
+
+See the response object section of the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
+for more information including the algorithm column for supported values. In addition to the values listed we also
+support `none` as a value for this endpoint.
+
+### userinfo_signing_alg
+
+{{< confkey type="string" default="none" required="no" >}}
+
+The algorithm used to sign the userinfo endpoint responses.
+
+See the response object section of the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
+for more information including the algorithm column for supported values. In addition to the values listed we also
+support `none` as a value for this endpoint.
+
+### public_keys
+
+This section configures the trusted JSON Web Keys or JWKS for this registered client. This can either be static values
+(recommended) or a URI using the `https` scheme. This section is situational required. These are used to validate the
+[JWT] assertions from clients.
+
+Required when the following options are configured:
+
+- [request_object_signing_alg](#requestobjectsigningalg)
+- [token_endpoint_auth_signing_alg](#tokenendpointauthsigningalg)
+
+Required when the following options are configured to specific values:
+
+- [token_endpoint_auth_method](#tokenendpointauthsigningalg): `private_key_jwt`
+
+#### uri
+
+{{< confkey type="string" required="no" >}}
+
+The fully qualified, `https` scheme, and appropriately signed URI for the JWKS endpoint that implements
+[RFC7517 Section 5](https://datatracker.ietf.org/doc/html/rfc7517#section-5). Must not be configured at the same time
+as [values](#values). It's recommended that you do not configure this option, but statically configure [values](#values)
+instead.
+
+*__Important Note:__ the URL given in this value MUST be resolvable by Authelia and MUST present a certificate signed by
+a certificate trusted by your environment. It is beyond our intentions to support anything other than this.*
+
+#### values
+
+{{< confkey type="list(object)" required="situational" >}}
+
+A list of static keys.
+
+##### key_id
+
+{{< confkey type="string" required="yes" >}}
+
+The Key ID used to match the request object's JWT header `kid` value against.
+
+##### key
+
+{{< confkey type="string" required="yes" >}}
+
+The public key portion of the JSON Web Key
+
+The public key the clients use to sign/encrypt the [OpenID Connect 1.0] asserted [JWT]'s. The key is generated by the
+client application or the administrator of the client application.
+
+The key *__MUST__*:
+
+* Be a PEM block encoded in the DER base64 format ([RFC4648]).
+* Be either:
+  * An RSA public key:
+    * With a key size of at least 2048 bits.
+  * An ECDSA public key with one of:
+    * A P-256 elliptical curve.
+    * A P-384 elliptical curve.
+    * A P-512 elliptical curve.
+
+If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public
+key data for the first certificate in the chain.
+
+
+## Integration
+
+To integrate Authelia's [OpenID Connect 1.0] implementation with a relying party please see the
+[integration docs](../../../integration/openid-connect/introduction.md).
+
+[token lifespan]: https://docs.apigee.com/api-platform/antipatterns/oauth-long-expiration
+[OpenID Connect 1.0]: https://openid.net/connect/
+[Token Endpoint]: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
+[JWT]: https://datatracker.ietf.org/doc/html/rfc7519
+[RFC6234]: https://datatracker.ietf.org/doc/html/rfc6234
+[RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648
+[RFC7468]: https://datatracker.ietf.org/doc/html/rfc7468
+[RFC6749 Section 2.1]: https://datatracker.ietf.org/doc/html/rfc6749#section-2.1
+[PKCE]: https://datatracker.ietf.org/doc/html/rfc7636
+[Authorization Code Flow]: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth
+[Subject Identifier Type]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
+[Pairwise Identifier Algorithm]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
+[Pushed Authorization Requests]: https://datatracker.ietf.org/doc/html/rfc9126
+

docs/content/en/configuration/identity-providers/openid-connect/provider.md

@@ -0,0 +1,428 @@
+---
+title: "OpenID Connect 1.0 Provider"
+description: "OpenID Connect 1.0 Provider Configuration"
+lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure this."
+date: 2023-05-08T13:38:08+10:00
+draft: false
+images: []
+menu:
+  configuration:
+    parent: "openid-connect"
+weight: 190200
+toc: true
+aliases:
+  - /c/oidc
+  - /docs/configuration/identity-providers/oidc.html
+---
+
+__Authelia__ currently supports the [OpenID Connect 1.0] Provider role as an open
+[__beta__](../../../roadmap/active/openid-connect.md) feature. We currently do not support the [OpenID Connect 1.0] Relying
+Party role. This means other applications that implement the [OpenID Connect 1.0] Relying Party role can use Authelia as
+an [OpenID Connect 1.0] Provider similar to how you may use social media or development platforms for login.
+
+The [OpenID Connect 1.0] Relying Party role is the role which allows an application to use GitHub, Google, or other
+[OpenID Connect 1.0] Providers for authentication and authorization. We do not intend to support this functionality at
+this moment in time.
+
+This section covers the [OpenID Connect 1.0] Provider configuration. For information on configuring individual
+registered clients see the [OpenID Connect 1.0 Clients](clients.md) documentation.
+
+More information about the beta can be found in the [roadmap](../../../roadmap/active/openid-connect.md) and in the
+[integration](../../../integration/openid-connect/introduction.md) documentation.
+
+## Configuration
+
+The following snippet provides a configuration example for the [OpenID Connect 1.0] Provider. This is not
+intended for production use it's used to provide context and an indentation example.
+
+```yaml
+identity_providers:
+  oidc:
+    hmac_secret: this_is_a_secret_abc123abc123abc
+    issuer_private_keys:
+      - key_id: example
+        algorithm: RS256
+        use: sig
+        key: |
+          -----BEGIN RSA PUBLIC KEY-----
+          MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz
+          9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE=
+          -----END RSA PUBLIC KEY----
+        certificate_chain: |
+          -----BEGIN CERTIFICATE-----
+          MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
+          MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
+          NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+          AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
+          z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
+          JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
+          Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
+          1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
+          -----END CERTIFICATE-----
+          -----BEGIN CERTIFICATE-----
+          MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
+          MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
+          NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+          AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
+          z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
+          JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
+          Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
+          1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
+          -----END CERTIFICATE-----
+    issuer_private_key: |
+      -----BEGIN RSA PUBLIC KEY-----
+      MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz
+      9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE=
+      -----END RSA PUBLIC KEY----
+    issuer_certificate_chain: |
+      -----BEGIN CERTIFICATE-----
+      MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
+      MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
+      NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+      AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
+      z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
+      JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
+      Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
+      1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
+      -----END CERTIFICATE-----
+      -----BEGIN CERTIFICATE-----
+      MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
+      MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
+      NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+      AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
+      z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
+      JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
+      Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
+      1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
+      -----END CERTIFICATE-----
+    access_token_lifespan: 1h
+    authorize_code_lifespan: 1m
+    id_token_lifespan: 1h
+    refresh_token_lifespan: 90m
+    enable_client_debug_messages: false
+    minimum_parameter_entropy: 8
+    enforce_pkce: public_clients_only
+    enable_pkce_plain_challenge: false
+    pushed_authorizations:
+      enforce: false
+      context_lifespan: 5m
+    cors:
+      endpoints:
+        - authorization
+        - token
+        - revocation
+        - introspection
+      allowed_origins:
+        - https://example.com
+      allowed_origins_from_client_redirect_uris: false
+```
+
+## Options
+
+### hmac_secret
+
+{{< confkey type="string" required="yes" >}}
+
+*__Important Note:__ This can also be defined using a [secret](../../methods/secrets.md) which is __strongly recommended__
+especially for containerized deployments.*
+
+The HMAC secret used to sign the [JWT]'s. The provided string is hashed to a SHA256 ([RFC6234]) byte string for the
+purpose of meeting the required format.
+
+It's __strongly recommended__ this is a
+[Random Alphanumeric String](../../../reference/guides/generating-secure-values.md#generating-a-random-alphanumeric-string)
+with 64 or more characters.
+
+### issuer_private_keys
+
+The key *__MUST__*:
+
+* Be a PEM block encoded in the DER base64 format ([RFC4648]).
+* Be either:
+  * An RSA public key:
+    * With a key size of at least 2048 bits.
+  * An ECDSA public key with one of:
+    * A P-256 elliptical curve.
+    * A P-384 elliptical curve.
+    * A P-512 elliptical curve.
+
+### issuer_private_keys
+
+{{< confkey type="list(object" required="no" >}}
+
+The list of JWKS instead of or in addition to the [issuer_private_key](#issuerprivatekey) and
+[issuer_certificate_chain](#issuercertificatechain). Can also accept ECDSA Private Key's and Certificates.
+
+#### key_id
+
+{{< confkey type="string" default="<thumbprint of public key>" required="no" >}}
+
+Completely optional, and generally discouraged unless there is a collision between the automatically generated key id's.
+If provided must be a unique string with 7 or less alphanumeric characters.
+
+This value is the first 7 characters of the public key thumbprint (SHA1) encoded into hexadecimal.
+
+#### algorithm
+
+{{< confkey type="string" default="RS256" required="no" >}}
+
+The algorithm for this key. This value must be unique. It's automatically detected based on the type of key.
+
+See the response object table in the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
+including the algorithm column for the supported values and the key type column for the default algorithm value.
+
+#### use
+
+{{< confkey type="string" default="sig" required="no" >}}
+
+The key usage. Defaults to `sig` which is the only available option at this time.
+
+#### key
+
+{{< confkey type="string" required="yes" >}}
+
+The private key associated with this key entry.
+
+The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator
+and can be done by following the
+[Generating an RSA Keypair](../../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide.
+
+The private key *__MUST__*:
+* Be a PEM block encoded in the DER base64 format ([RFC4648]).
+* Be one of:
+  * An RSA key with a key size of at least 2048 bits.
+  * An ECDSA private key with one of the P-256, P-384, or P-521 elliptical curves.
+
+If the [certificate_chain](#certificatechain) is provided the private key must include matching public
+key data for the first certificate in the chain.
+
+#### certificate_chain
+
+{{< confkey type="string" required="no" >}}
+
+The certificate chain/bundle to be used with the [key](#key) DER base64 ([RFC4648])
+encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t]
+JSON key's in the JWKs [Discoverable Endpoint](../../../integration/openid-connect/introduction.md#discoverable-endpoints)
+as per [RFC7517].
+
+[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517
+[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7
+[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8
+
+The first certificate in the chain must have the public key for the [key](#key), each certificate in the chain must be
+valid for the current date, and each certificate in the chain should be signed by the certificate immediately following
+it if present.
+
+### issuer_private_key
+
+{{< confkey type="string" required="yes" >}}
+
+*__Important Note:__ This can also be defined using a [secret](../../methods/secrets.md) which is __strongly recommended__
+especially for containerized deployments.*
+
+The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator
+and can be done by following the
+[Generating an RSA Keypair](../../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide.
+
+This private key is automatically appended to the [issuer_private_keys](#issuerprivatekeys) and assumed to be for the
+RS256 algorithm. As such no other key in this list should be RS256 if this is configured.
+
+The issuer private key *__MUST__*:
+
+* Be a PEM block encoded in the DER base64 format ([RFC4648]).
+* Be an RSA private key:
+    * With a key size of at least 2048 bits.
+
+If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public
+key data for the first certificate in the chain.
+
+### issuer_certificate_chain
+
+{{< confkey type="string" required="no" >}}
+
+The certificate chain/bundle to be used with the [issuer_private_key](#issuer_private_key) DER base64 ([RFC4648])
+encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t]
+JSON key's in the JWKs [Discoverable Endpoint](../../../integration/openid-connect/introduction.md#discoverable-endpoints)
+as per [RFC7517].
+
+[RFC7517]: https://datatracker.ietf.org/doc/html/rfc7517
+[x5c]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.7
+[x5t]: https://datatracker.ietf.org/doc/html/rfc7517#section-4.8
+
+The first certificate in the chain must have the public key for the [issuer_private_key](#issuerprivatekey), each
+certificate in the chain must be valid for the current date, and each certificate in the chain should be signed by the
+certificate immediately following it if present.
+
+### access_token_lifespan
+
+{{< confkey type="duration" default="1h" required="no" >}}
+
+The maximum lifetime of an access token. It's generally recommended keeping this short similar to the default.
+For more information read these docs about [token lifespan].
+
+### authorize_code_lifespan
+
+{{< confkey type="duration" default="1m" required="no" >}}
+
+The maximum lifetime of an authorize code. This can be rather short, as the authorize code should only be needed to
+obtain the other token types. For more information read these docs about [token lifespan].
+
+### id_token_lifespan
+
+{{< confkey type="duration" default="1h" required="no" >}}
+
+The maximum lifetime of an ID token. For more information read these docs about [token lifespan].
+
+### refresh_token_lifespan
+
+{{< confkey type="string" default="90m" required="no" >}}
+
+The maximum lifetime of a refresh token. The
+refresh token can be used to obtain new refresh tokens as well as access tokens or id tokens with an
+up-to-date expiration. For more information read these docs about [token lifespan].
+
+A good starting point is 50% more or 30 minutes more (which ever is less) time than the highest lifespan out of the
+[access token lifespan](#accesstokenlifespan), the [authorize code lifespan](#authorizecodelifespan), and the
+[id token lifespan](#idtokenlifespan). For instance the default for all of these is 60 minutes, so the default refresh
+token lifespan is 90 minutes.
+
+### enable_client_debug_messages
+
+{{< confkey type="boolean" default="false" required="no" >}}
+
+Allows additional debug messages to be sent to the clients.
+
+### minimum_parameter_entropy
+
+{{< confkey type="integer" default="8" required="no" >}}
+
+This controls the minimum length of the `nonce` and `state` parameters.
+
+*__Security Notice:__* Changing this value is generally discouraged, reducing it from the default can theoretically
+make certain scenarios less secure. It is highly encouraged that if your OpenID Connect RP does not send these
+parameters or sends parameters with a lower length than the default that they implement a change rather than changing
+this value.
+
+### enforce_pkce
+
+{{< confkey type="string" default="public_clients_only" required="no" >}}
+
+[Proof Key for Code Exchange](https://datatracker.ietf.org/doc/html/rfc7636) enforcement policy: if specified, must be
+either `never`, `public_clients_only` or `always`.
+
+If set to `public_clients_only` (default), [PKCE] will be required for public clients using the
+[Authorization Code Flow].
+
+When set to `always`, [PKCE] will be required for all clients using the Authorization Code flow.
+
+*__Security Notice:__* Changing this value to `never` is generally discouraged, reducing it from the default can
+theoretically make certain client-side applications (mobile applications, SPA) vulnerable to CSRF and authorization code
+interception attacks.
+
+### enable_pkce_plain_challenge
+
+{{< confkey type="boolean" default="false" required="no" >}}
+
+Allows [PKCE] `plain` challenges when set to `true`.
+
+*__Security Notice:__* Changing this value is generally discouraged. Applications should use the `S256` [PKCE] challenge
+method instead.
+
+### pushed_authorizations
+
+Controls the behaviour of [Pushed Authorization Requests].
+
+#### enforce
+
+{{< confkey type="boolean" default="false" required="no" >}}
+
+When enabled all authorization requests must use the [Pushed Authorization Requests] flow.
+
+#### context_lifespan
+
+{{< confkey type="duration" default="5m" required="no" >}}
+
+The maximum amount of time between the [Pushed Authorization Requests] flow being initiated and the generated
+`request_uri` being utilized by a client.
+
+### cors
+
+Some [OpenID Connect 1.0] Endpoints need to allow cross-origin resource sharing, however some are optional. This section allows
+you to configure the optional parts. We reply with CORS headers when the request includes the Origin header.
+
+#### endpoints
+
+{{< confkey type="list(string)" required="no" >}}
+
+A list of endpoints to configure with cross-origin resource sharing headers. It is recommended that the `userinfo`
+option is at least in this list. The potential endpoints which this can be enabled on are as follows:
+
+* authorization
+* pushed-authorization-request
+* token
+* revocation
+* introspection
+* userinfo
+
+#### allowed_origins
+
+{{< confkey type="list(string)" required="no" >}}
+
+A list of permitted origins.
+
+Any origin with https is permitted unless this option is configured or the
+[allowed_origins_from_client_redirect_uris](#allowedoriginsfromclientredirecturis) option is enabled. This means
+you must configure this option manually if you want http endpoints to be permitted to make cross-origin requests to the
+[OpenID Connect 1.0] endpoints, however this is not recommended.
+
+Origins must only have the scheme, hostname and port, they may not have a trailing slash or path.
+
+In addition to an Origin URI, you may specify the wildcard origin in the allowed_origins. It MUST be specified by itself
+and the [allowed_origins_from_client_redirect_uris](#allowedoriginsfromclientredirecturis) MUST NOT be enabled. The
+wildcard origin is denoted as `*`. Examples:
+
+```yaml
+identity_providers:
+  oidc:
+    cors:
+      allowed_origins: "*"
+```
+
+```yaml
+identity_providers:
+  oidc:
+    cors:
+      allowed_origins:
+        - "*"
+```
+
+#### allowed_origins_from_client_redirect_uris
+
+{{< confkey type="boolean" default="false" required="no" >}}
+
+Automatically adds the origin portion of all redirect URI's on all clients to the list of
+[allowed_origins](#allowed_origins), provided they have the scheme http or https and do not have the hostname of
+localhost.
+
+### clients
+
+See the [OpenID Connect 1.0 Registered Clients](clients.md) documentation for configuring clients.
+
+## Integration
+
+To integrate Authelia's [OpenID Connect 1.0] implementation with a relying party please see the
+[integration docs](../../integration/openid-connect/introduction.md).
+
+[token lifespan]: https://docs.apigee.com/api-platform/antipatterns/oauth-long-expiration
+[OpenID Connect 1.0]: https://openid.net/connect/
+[Token Endpoint]: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
+[JWT]: https://datatracker.ietf.org/doc/html/rfc7519
+[RFC6234]: https://datatracker.ietf.org/doc/html/rfc6234
+[RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648
+[RFC7468]: https://datatracker.ietf.org/doc/html/rfc7468
+[RFC6749 Section 2.1]: https://datatracker.ietf.org/doc/html/rfc6749#section-2.1
+[PKCE]: https://datatracker.ietf.org/doc/html/rfc7636
+[Authorization Code Flow]: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth
+[Subject Identifier Type]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
+[Pairwise Identifier Algorithm]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
+[Pushed Authorization Requests]: https://datatracker.ietf.org/doc/html/rfc9126

docs/content/en/configuration/methods/environment.md

@@ -39,7 +39,7 @@ For example this YAML configuration:
 
 ```yaml
 log:
-  level: info
+  level: 'info'
 server:
   buffers:
     read: 4096

docs/content/en/configuration/methods/secrets.md

@@ -77,9 +77,9 @@ other configuration using the environment but instead of loading a file the valu
 [authentication_backend.ldap.password]: ../first-factor/ldap.md#password
 [authentication_backend.ldap.tls.certificate_chain]: ../first-factor/ldap.md#tls
 [authentication_backend.ldap.tls.private_key]: ../first-factor/ldap.md#tls
-[identity_providers.oidc.issuer_certificate_chain]: ../identity-providers/open-id-connect.md#issuercertificatechain
+[identity_providers.oidc.issuer_certificate_chain]: ../identity-providers/openid-connect.md#issuercertificatechain
-[identity_providers.oidc.issuer_private_key]: ../identity-providers/open-id-connect.md#issuerprivatekey
+[identity_providers.oidc.issuer_private_key]: ../identity-providers/openid-connect.md#issuerprivatekey
-[identity_providers.oidc.hmac_secret]: ../identity-providers/open-id-connect.md#hmacsecret
+[identity_providers.oidc.hmac_secret]: ../identity-providers/openid-connect.md#hmacsecret
 
 
 ## Secrets in configuration file

docs/content/en/configuration/miscellaneous/introduction.md

@@ -20,14 +20,16 @@ aliases:
 {{< config-alert-example >}}
 
 ```yaml
-certificates_directory: /config/certs/
+certificates_directory: '/config/certs/'
-default_redirection_url: https://home.example.com:8080/
+default_redirection_url: 'https://home.example.com:8080/'
-jwt_secret: v3ry_important_s3cr3t
+jwt_secret: 'v3ry_important_s3cr3t'
-theme: light
+theme: 'light'
 ```
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### certificates_directory
 
 This option defines the location of additional certificates to load into the trust chain specifically for Authelia.

docs/content/en/configuration/miscellaneous/logging.md

@@ -22,14 +22,16 @@ The logging section tunes the logging settings.
 
 ```yaml
 log:
-  level: info
+  level: 'info'
-  format: text
+  format: 'text'
-  file_path: ""
+  file_path: ''
   keep_stdout: false
 ```
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### level
 
 {{< confkey type="string" default="info" required="no" >}}

docs/content/en/configuration/miscellaneous/ntp.md

@@ -27,15 +27,17 @@ unless configured otherwise.
 
 ```yaml
 ntp:
-  address: "time.cloudflare.com:123"
+  address: 'udp://time.cloudflare.com:123'
   version: 3
-  max_desync: 3s
+  max_desync: '3s'
   disable_startup_check: false
   disable_failure: false
 ```
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### address
 
 {{< confkey type="string" default="time.cloudflare.com:123" required="no" >}}
@@ -43,6 +45,28 @@ ntp:
 Determines the address of the NTP server to retrieve the time from. The format is `<host>:<port>`, and both of these are
 required.
 
+### address
+
+{{< confkey type="address" default="udp://time.cloudflare.com:123" required="no" >}}
+
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
+
+Configures the address for the NTP Server. The address itself is a connector and the scheme must be `udp`,
+`udp4`, or `udp6`.
+
+__Examples:__
+
+```yaml
+ntp:
+  address: 'udp://127.0.0.1:123'
+```
+
+```yaml
+ntp:
+  address: 'udp6://[fd00:1111:2222:3333::1]:123'
+```
+
 ### version
 
 {{< confkey type="integer" default="4" required="no" >}}
@@ -53,8 +77,8 @@ Determines the NTP version supported. Valid values are 3 or 4.
 
 {{< confkey type="duration" default="3s" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 This is used to tune the acceptable desync from the time reported from the NTP server.
 

docs/content/en/configuration/miscellaneous/privacy-policy.md

@@ -25,6 +25,8 @@ privacy_policy:
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### enabled
 
 {{< confkey type="boolean" default="false" required="no" >}}
@@ -42,7 +44,7 @@ accepted is recorded and checked in the browser
 If the user has not accepted the policy they should not be able to interact with the Authelia UI via normal means.
 
 Administrators who are required to abide by the [GDPR] or other privacy laws should be advised that
-[OpenID Connect 1.0](../identity-providers/open-id-connect.md) clients configured with the `implicit` consent mode are
+[OpenID Connect 1.0](../identity-providers/openid-connect.md) clients configured with the `implicit` consent mode are
 unlikely to trigger the display of the Authelia UI if the user is already authenticated.
 
 We wont be adding checks like this to the `implicit` consent mode when that mode in particular is unlikely to be

docs/content/en/configuration/miscellaneous/server-endpoints-authz.md

@@ -23,16 +23,16 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
         authn_strategies: []
       ext-authz:
-        implementation: ExtAuthz
+        implementation: 'ExtAuthz'
         authn_strategies: []
       auth-request:
-        implementation: AuthRequest
+        implementation: 'AuthRequest'
         authn_strategies: []
       legacy:
-        implementation: Legacy
+        implementation: 'Legacy'
         authn_strategies: []
 ```
 

docs/content/en/configuration/miscellaneous/server.md

@@ -21,61 +21,63 @@ aliases:
 
 ```yaml
 server:
-  host: 0.0.0.0
+  address: 'tcp://:9091'
-  port: 9091
+  path: ''
-  path: ""
   disable_healthcheck: false
   tls:
-    key: ""
+    key: ''
-    certificate: ""
+    certificate: ''
     client_certificates: []
   headers:
-    csp_template: ""
+    csp_template: ''
   buffers:
     read: 4096
     write: 4096
   timeouts:
-    read: 6s
+    read: '6s'
-    write: 6s
+    write: '6s'
-    idle: 30s
+    idle: '30s'
   endpoints:
     enable_pprof: false
     enable_expvars: false
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
         authn_strategies: []
       ext-authz:
-        implementation: ExtAuthz
+        implementation: 'ExtAuthz'
         authn_strategies: []
       auth-request:
-        implementation: AuthRequest
+        implementation: 'AuthRequest'
         authn_strategies: []
       legacy:
-        implementation: Legacy
+        implementation: 'Legacy'
         authn_strategies: []
 ```
 
 ## Options
 
-## host
+### address
 
-{{< confkey type="string" default="0.0.0.0" required="no" >}}
+{{< confkey type="address" default="tcp://:9091" required="no" >}}
 
-Defines the address to listen on. See also [port](#port). Should typically be `0.0.0.0` or `127.0.0.1`, the former for
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
-containerized environments and the later for daemonized environments like init.d and systemd.
+see the [documentation](../prologue/common.md#address) on this format for more information.*
 
-Note: If utilising an IPv6 literal address it must be enclosed by square brackets and quoted:
+Configures the listener address for the Main HTTP Server. The address itself is a listener and the scheme must either be
+the `unix` scheme or one of the `tcp` schemes.
+
+__Examples:__
 
 ```yaml
-host: "[fd00:1111:2222:3333::1]"
+server:
+  address: tcp://127.0.0.1:9091
 ```
 
-### port
+```yaml
-
+server:
-{{< confkey type="integer" default="9091" required="no" >}}
+  address: unix:///var/run/authelia.sock
-
+```
-Defines the port to listen on. See also [host](#host).
 
 ### path
 
@@ -173,13 +175,19 @@ research about how browsers utilize and understand this header before attempting
 
 ### buffers
 
-Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more
+*__Reference Note:__ This configuration option uses the
-information.
+[Server buffers common structure](../prologue/common.md#server-buffers). Please see the
+[documentation](../prologue/common.md#server-buffers) on this structure for more information.*
+
+Configures the server buffers.
 
 ### timeouts
 
-Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more
+*__Reference Note:__ This configuration option uses the
-information.
+[Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the
+[documentation](../prologue/common.md#server-timeouts) on this structure for more information.*
+
+Configures the server timeouts.
 
 ### endpoints
 
@@ -194,11 +202,11 @@ Enables the go [pprof](https://pkg.go.dev/net/http/pprof) endpoints.
 
 #### enable_expvars
 
+{{< confkey type="boolean" default="false" required="no" >}}
+
 *__Security Note:__ This is a developer endpoint. __DO NOT__ enable it unless you know why you're enabling it.
 __DO NOT__ enable this in production.*
 
-{{< confkey type="boolean" default="false" required="no" >}}
-
 Enables the go [expvar](https://pkg.go.dev/expvar) endpoints.
 
 #### authz

docs/content/en/configuration/notifications/file.md

@@ -27,7 +27,7 @@ This method will use the plain text email template for readability purposes.
 notifier:
   disable_startup_check: false
   filesystem:
-    filename: /config/notification.txt
+    filename: '/config/notification.txt'
 ```
 
 ## Options

docs/content/en/configuration/notifications/smtp.md

@@ -23,23 +23,22 @@ aliases:
 notifier:
   disable_startup_check: false
   smtp:
-    host: 127.0.0.1
+    address: 'smtp://127.0.0.1:25'
-    port: 1025
+    timeout: '5s'
-    timeout: 5s
+    username: 'test'
-    username: test
+    password: 'password'
-    password: password
     sender: "Authelia <admin@example.com>"
-    identifier: localhost
+    identifier: 'localhost'
     subject: "[Authelia] {title}"
-    startup_check_address: test@authelia.com
+    startup_check_address: 'test@authelia.com'
     disable_require_tls: false
     disable_starttls: false
     disable_html_emails: false
     tls:
-      server_name: smtp.example.com
+      server_name: 'smtp.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -113,35 +112,41 @@ notifier:
 
 This section describes the individual configuration options.
 
-### host
+### address
 
-{{< confkey type="integer" required="yes" >}}
+{{< confkey type="address" required="yes" >}}
 
-The hostname of the SMTP server.
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
 
-If utilising an IPv6 literal address it must be enclosed by square brackets and quoted:
+Configures the address for the SMTP Server. The address itself is a connector and the scheme must be `smtp`,
-
+`submission`, or `submissions`. The only difference between these schemes are the default ports and `submissions`
-```yaml
+requires a TLS transport per [SMTP Ports Security Measures][docs-security-smtp-port], whereas `submission` and `smtp`
-host: "[fd00:1111:2222:3333::1]"
+use a standard TCP transport and typically enforce StartTLS.
-```
-
-### port
-
-{{< confkey type="integer" required="yes" >}}
-
-The port the SMTP service is listening on.
-
-A connection is securely established with TLS after a succesful STARTTLS negotiation.
-
-[Port 465 is an exception][docs-security-smtp-port] when supported by the mail server as a `submissions` service port.
-STARTTLS negotiation is not required for this port, the connection is implicitly established with TLS.
 
 [docs-security-smtp-port]: ../../overview/security/measures.md#smtp-ports
 
+__Examples:__
+
+```yaml
+notifier:
+  smtp:
+    address: 'smtp://127.0.0.1:25'
+```
+
+```yaml
+notifier:
+  smtp:
+    address: 'submissions://[fd00:1111:2222:3333::1]:465'
+```
+
 ### timeout
 
 {{< confkey type="duration" default="5s" required="no" >}}
 
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
+
 The SMTP connection timeout.
 
 ### username
@@ -227,8 +232,11 @@ mixed emails which contain both HTML and text so this option is rarely necessary
 
 ### tls
 
-Controls the TLS connection validation process. You can see how to configure the tls section
+*__Reference Note:__ This configuration option uses the
-[here](../prologue/common.md#tls-configuration).
+[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
+[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
+
+Controls the TLS connection validation parameters for either StartTLS or the TLS socket.
 
 ## Using Gmail
 
@@ -238,10 +246,10 @@ You need to generate an app password in order to use Gmail SMTP servers. The pro
 ```yaml
 notifier:
   smtp:
-    username: myaccount@gmail.com
+    username: 'myaccount@gmail.com'
     # Password can also be set using a secret: https://www.authelia.com/configuration/methods/secrets/
-    password: yourapppassword
+    password: 'yourapppassword'
-    sender: admin@example.com
+    sender: 'admin@example.com'
-    host: smtp.gmail.com
+    host: 'smtp.gmail.com'
     port: 587
 ```

docs/content/en/configuration/prologue/common.md

@@ -14,103 +14,181 @@ aliases:
   - /c/common
 ---
 
-## Duration Notation Format
+## Syntax
 
-We have implemented a string/integer based notation for configuration options that take a duration of time. This section
+The following represent common syntax used within the configuration which have specific format requirements that are
-describes the implementation of this. You can use this implementation in various areas of configuration such as:
+used in multiple areas. This is intended on assisting in understanding these specific values, and not as a specific
+guide on configuring any particular instance.
 
-* session:
+### Duration
-  * expiration
-  * inactivity
-  * remember_me
-* regulation:
-  * ban_time
-  * find_time
-* ntp:
-  * max_desync
-* webauthn:
-  * timeout
 
-The way this format works is you can either configure an integer or a string in the specific configuration areas. If you
+The base type for this syntax is a string, and it also handles integers however this is discouraged.
-supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in blocks
-of quantities and units (number followed by a unit letter).  For example `5h` indicates a quantity of 5 units of `h`.
 
-The following is ignored:
+If you supply an integer, it is considered a representation of seconds. If you supply a string, it parses the string in
+blocks of quantities and units (number followed by a unit letter).  For example `5h` indicates a quantity of 5 units
+of `h`.
+
+The following is ignored or stripped from the input:
   - all spaces
   - leading zeros
+  - the word `and`
 
-While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value.
+While you can use multiple of these blocks in combination, we suggest keeping it simple and use a single value. In
+addition it's important to note that the format while somewhat human readable still requires you closely follow the
+expected formats.
 
-### Unit Legend
+#### Unit Legend
 
-#### Short Units
+The following is a legend for the unit formats available in this syntax. The long form units are only available from
+v4.38.0 or newer.
 
-These values have been available for a long time.
+|     Unit     | Short Unit |   Human Readable Long Unit    |
+|:------------:|:----------:|:-----------------------------:|
+|    Years     |    `y`     |        `year`, `years`        |
+|    Months    |    `M`     |       `month`, `months`       |
+|    Weeks     |    `w`     |        `week`, `weeks`        |
+|     Days     |    `d`     |         `day`, `days`         |
+|    Hours     |    `h`     |        `hour`, `hours`        |
+|   Minutes    |    `m`     |      `minute`, `minutes`      |
+|   Seconds    |    `s`     |      `second`, `seconds`      |
+| Milliseconds |    `ms`    | `millisecond`, `milliseconds` |
 
-|  Unit   | Associated Letter |
+#### Examples
-|:-------:|:-----------------:|
-|  Years  |         y         |
-| Months  |         M         |
-|  Weeks  |         w         |
-|  Days   |         d         |
-|  Hours  |         h         |
-| Minutes |         m         |
-| Seconds |         s         |
 
-#### Long Units
+|     Desired Value     |    Configuration Examples (Short)     |     Configuration Examples (Long)      |
+|:---------------------:|:-------------------------------------:|:--------------------------------------:|
+| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` |        `1 hour and 30 minutes`         |
+|         1 day         | `1d` or `24h` or `86400` or `86400s`  |                `1 day`                 |
+|       10 hours        | `10h` or `600m` or `9h60m` or `36000` |               `10 hours`               |
 
-These values are more human readable but have only been available since v4.38.0.
+### Address
 
-|     Unit     |   Human Readable Long Unit    |
+The base type for this syntax is a string.
-|:------------:|:-----------------------------:|
-|    Years     |        `year`, `years`        |
-|    Months    |       `month`, `months`       |
-|    Weeks     |        `week`, `weeks`        |
-|     Days     |         `day`, `days`         |
-|    Hours     |        `hour`, `hours`        |
-|   Minutes    |      `minute`, `minutes`      |
-|   Seconds    |      `second`, `seconds`      |
-| Milliseconds | `millisecond`, `milliseconds` |
 
-### Examples
+The address type is a string that indicates how to configure a listener (i.e. listening for connections) or connector
+(i.e. opening remote connections), which are the two primary categories of addresses.
 
-|     Desired Value     |        Configuration Examples         |
-|:---------------------:|:-------------------------------------:|
-| 1 hour and 30 minutes | `90m` or `1h30m` or `5400` or `5400s` |
-|         1 day         | `1d` or `24h` or `86400` or `86400s`  |
-|       10 hours        | `10h` or `600m` or `9h60m` or `36000` |
 
-## Address
+#### Format
 
-The address type is a string that takes the following format:
+This section outlines the format for these strings. The formats use a conventional POSIX format to indicate optional and
-
+required elements. The square brackets `[]` surround optional portions, and the angled brackets `<>` surround required
-```text
+portions. Required portions may exist within optional portions, in which case they are often accompanied with other
-[<scheme>://]<ip>[:<port>]
+format specific text which indicates if the accompanying text exists then it is actually required, otherwise it's
-```
+entirely optional.
 
 The square brackets indicate optional sections, and the angled brackets indicate required sections. The following
 sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration
 requirement that one of these is provided.
 
-### scheme
+##### Hostname
+
+The following format represents the hostname format. It's valid for both a listener and connector in most instances.
+Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and port
+are optional. The default for these when not provided varies.
+
+```text
+[<scheme>://]<hostname>[:<port>]
+```
+
+##### Port
+
+The following format represents the port format. It's valid only for a listener in most instances.
+Refer to the individual documentation for an option for clarity. In this format as per the notation the scheme and
+hostname are optional. The default for the scheme when not provided varies, and the default for the hostname is all
+available addresses when not provided.
+
+```text
+[<scheme>://][hostname]:<port>
+```
+
+##### Unix Domain Socket
+
+The following format represents the unix domain socket format. It's valid for both a listener and connector in most
+instances. Refer to the individual documentation for an option for clarity. In this format as per the notation there
+are no optional portions.
+
+The Unix Domain Socket format also accepts a query string. The following query parameters control certain behaviour of
+this address type.
+
+| Parameter | Listeners | Connectors |                                                               Purpose                                                                |
+|:---------:|:---------:|:----------:|:------------------------------------------------------------------------------------------------------------------------------------:|
+|  `umask`  |    Yes    |     No     | Sets the umask prior to creating the socket and restores it after creating it. The value must be an octal number with 3 or 4 digits. |
+
+
+```text
+unix://<path>
+```
+
+```text
+unix://<path>?umask=0022
+```
+
+##### Examples
+
+Various examples for these formats.
+
+```text
+0.0.0.0
+tcp://0.0.0.0
+tcp://0.0.0.0:9091
+tcp://:9091
+0.0.0.0:9091
+
+udp://0.0.0.0:123
+udp://:123
+
+unix:///var/lib/authelia.sock
+```
+
+#### scheme
 
 The entire scheme is optional, but if the scheme host delimiter `://` is in the string, the scheme must be present. The
-scheme must be one of `tcp://`, or `udp://`. The default scheme is `tcp://`.
+scheme must be one of the following (the listeners and connectors columns indicate support for the scheme on the
+respective address type):
 
-### ip
+|    Scheme     | Listeners | Connectors | Default Port |                                   Notes                                   |
+|:-------------:|:---------:|:----------:|:------------:|:-------------------------------------------------------------------------:|
+|     `tcp`     |    Yes    |    Yes     |     N/A      |        Standard TCP Socket which allows IPv4 and/or IPv6 addresses        |
+|    `tcp4`     |    Yes    |    Yes     |     N/A      |           Standard TCP Socket which allows only IPv4 addresses            |
+|    `tcp6`     |    Yes    |    Yes     |     N/A      |           Standard TCP Socket which allows only IPv6 addresses            |
+|     `udp`     |    Yes    |    Yes     |     N/A      |        Standard UDP Socket which allows IPv4 and/or IPv6 addresses        |
+|    `udp4`     |    Yes    |    Yes     |     N/A      |           Standard UDP Socket which allows only IPv4 addresses            |
+|    `udp6`     |    Yes    |    Yes     |     N/A      |           Standard UDP Socket which allows only IPv6 addresses            |
+|    `unix`     |    Yes    |    Yes     |     N/A      |       Standard Unix Domain Socket which allows only absolute paths        |
+|    `ldap`     |    No     |    Yes     |     389      |       Remote LDAP connection via TCP with implicit TLS via StartTLS       |
+|    `ldaps`    |    No     |    Yes     |     636      |             Remote LDAP connection via TCP with explicit TLS              |
+|    `ldapi`    |    No     |    Yes     |     N/A      |                  LDAP connection via Unix Domain Socket                   |
+|    `smtp`     |    No     |    Yes     |      25      |      Remote SMTP connection via TCP using implicit TLS via StartTLS       |
+| `submission`  |    No     |    Yes     |     587      | Remote SMTP Submission connection via TCP using implicit TLS via StartTLS |
+| `submissions` |    No     |    Yes     |     465      |       Remote SMTP Submission connection via TCP using explicit TLS        |
 
-The IP is required. If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address
+If the scheme is absent, the default scheme is assumed. If the address has a `/` prefix it's assumed to be `unix`,
-`::1` with the `tcp://` scheme and port `80`: `tcp://[::1]:80`.
+otherwise it's assumed to be`tcp`. If the scheme is `unix` it must be suffixed with an absolute path i.e.
+`/var/local/authelia.sock` would be represented as `unix:///var/run/authelia.sock`.
 
-### port
+#### hostname
 
-The entire port is optional, but if the host port delimiter `:` exists it must also include a numeric port.
+The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [port](#port) specified. It
+can be any IP that is locally addressable or a hostname which resolves to a locally addressable IP.
 
-## Regular Expressions
+If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address `::1` with the `tcp`
+scheme and port `80` the correct address would be `tcp://[::1]:80`.
 
-We have several sections of configuration that utilize regular expressions. It's recommended to validate your regex
+#### port
-manually either via tools like [Regex 101](https://regex101.com/) (ensure you pick the `Golang` option) or some other
+
-means.
+The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [hostname](#hostname)
+specified.
+
+### Regular Expressions
+
+We have several sections of configuration that utilize regular expressions. We use the Google RE2 regular expression
+engine which is the full Go regular expression syntax engine, the syntax of which is described
+[here](https://github.com/google/re2/wiki/Syntax) by the authors. It's very similar to regular expression engines like
+PCRE, Perl, and Python; with the major exceptions being that it doesn't have backtracking.
+
+It's recommended to validate your regular expressions manually either via tools like [Regex 101](https://regex101.com/)
+(ensure you pick the `Golang` option) or some other means.
 
 It's important when attempting to utilize a backslash that it's utilized correctly. The YAML parser is likely to parse
 this as you trying to use YAML escape syntax instead of regex escape syntax. To avoid this use single quotes instead of
@@ -128,19 +206,30 @@ Bad Example:
 domain_regex: "^(admin|secure)\.example\.com$"
 ```
 
-## TLS Configuration
+## Structures
+
+The following represent common data structures used within the configuration which have specific requirements that are
+used in multiple areas. This is intended on assisting in understanding these specific structures, and not as a specific
+guide on configuring any particular instance.
+
+### TLS Configuration
 
 Various sections of the configuration use a uniform configuration section called TLS. Notably LDAP and SMTP.
 This section documents the usage.
 
-### server_name
+Various sections of the configuration use a uniform configuration section called `tls` which configure TLS socket and
+TLS verification parameters. Notably the [LDAP](../first-factor/ldap.md#tls), [SMTP](../notifications/smtp.md#tls),
+[PostgreSQL](../storage/postgres.md#tls), [MySQL](../storage/mysql.md#tls), and [Redis](../session/redis.md#tls)
+sections. This section documents the common parts of this structure.
+
+#### server_name
 
 {{< confkey type="string" required="no" >}}
 
 The key `server_name` overrides the name checked against the certificate in the verification process. Useful if you
 require an IP address for the host of the backend service but want to verify a specific certificate server name.
 
-### skip_verify
+#### skip_verify
 
 {{< confkey type="boolean" default="false" required="no" >}}
 
@@ -148,7 +237,7 @@ The key `skip_verify` completely negates validating the certificate of the backe
 instead you should tweak the `server_name` option, and the global option
 [certificates directory](../miscellaneous/introduction.md#certificatesdirectory).
 
-### minimum_version
+#### minimum_version
 
 {{< confkey type="string" default="TLS1.2" required="no" >}}
 
@@ -157,7 +246,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi
 are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing
 this value. At the time of this writing `SSL3.0` will always produce errors.
 
-### maximum_version
+#### maximum_version
 
 {{< confkey type="string" default="TLS1.3" required="no" >}}
 
@@ -166,7 +255,7 @@ The possible values are `TLS1.3`, `TLS1.2`, `TLS1.1`, `TLS1.0`, `SSL3.0`. Anythi
 are very old and deprecated. You should avoid using these and upgrade your backend service instead of decreasing
 this value. At the time of this writing `SSL3.0` will always produce errors.
 
-### certificate_chain
+#### certificate_chain
 
 {{< confkey type="string" required="no" >}}
 
@@ -175,7 +264,7 @@ the server.
 
 The value must be one or more certificates encoded in the DER base64 ([RFC4648]) encoded PEM format.
 
-### private_key
+#### private_key
 
 {{< confkey type="string" required="no" >}}
 
@@ -189,45 +278,64 @@ is provided, in top down order, each certificate must be signed by the next cert
 
 [RFC4648]: https://datatracker.ietf.org/doc/html/rfc4648
 
-## Server Buffers
+### Server Buffers
 
-### read
+Various sections of the configuration use a uniform configuration section called `buffers` which configure HTTP server
+buffers. Notably the [server](../miscellaneous/server.md#buffers) and
+[metrics telemetry](../telemetry/metrics.md#buffers) sections. This section documents the common parts of this
+structure.
+
+#### read
 
 {{< confkey type="integer" default="4096" required="no" >}}
 
 Configures the maximum request size. The default of 4096 is generally sufficient for most use cases.
 
-### write
+#### write
 
 {{< confkey type="integer" default="4096" required="no" >}}
 
 Configures the maximum response size. The default of 4096 is generally sufficient for most use cases.
 
-## Server Timeouts
+### Server Timeouts
 
-### read
+Various sections of the configuration use a uniform configuration section called `timeouts` which configure HTTP server
+timeouts. Notably the [server](../miscellaneous/server.md#timeouts) and
+[metrics telemetry](../telemetry/metrics.md#timeouts) sections. This section documents the common parts of this
+structure.
+
+#### read
 
 {{< confkey type="duration" default="6s" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the
+*__Reference Note:__ This configuration option uses the [duration common syntax](#duration).
-[common options](#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 Configures the server read timeout.
 
-### write
+#### write
 
 {{< confkey type="duration" default="6s" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the
+*__Reference Note:__ This configuration option uses the [duration common syntax](#duration).
-[common options](#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](#duration) on this format for more information.*
 
 Configures the server write timeout.
 
-### idle
+#### idle
 
 {{< confkey type="duration" default="30s" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](#duration-notation-format). Please see the
+*__Reference Note:__ This configuration option uses the [duration common syntax](#duration).
-[common options](#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](#duration) on this format for more information.*
 
 Configures the server idle timeout.
+
+## Historical References
+
+This contains links to historical anchors.
+
+##### Duration Notation Format
+
+See [duration common syntax](#duration).
+

docs/content/en/configuration/second-factor/duo.md

@@ -30,9 +30,9 @@ section of the configuration.
 ```yaml
 duo_api:
   disable: false
-  hostname: api-123456789.example.com
+  hostname: 'api-123456789.example.com'
-  integration_key: ABCDEF
+  integration_key: 'ABCDEF'
-  secret_key: 1234567890abcdefghifjkl
+  secret_key: '1234567890abcdefghifjkl'
   enable_self_enrollment: false
 ```
 

docs/content/en/configuration/second-factor/time-based-one-time-password.md

@@ -31,8 +31,8 @@ and many only support SHA1.
 ```yaml
 totp:
   disable: false
-  issuer: authelia.com
+  issuer: 'authelia.com'
-  algorithm: sha1
+  algorithm: 'sha1'
   digits: 6
   period: 30
   skew: 1
@@ -65,9 +65,8 @@ by Authelia from others.
 
 *__Important Note:__ Many TOTP applications do not support this option. It is strongly advised you find out which
 applications your users use and test them before changing this option. It is insufficient to test that the application
-can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden]
+can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the
-is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option
+[Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.*
-please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).*
 
 [Bitwarden]: https://bitwarden.com/
 
@@ -88,9 +87,8 @@ information.
 
 *__Important Note:__ Some TOTP applications do not support this option. It is strongly advised you find out which
 applications your users use and test them before changing this option. It is insufficient to test that the application
-can add the key, it must also authenticate with Authelia as some applications silently ignore these options. [Bitwarden]
+can add the key, it must also authenticate with Authelia as some applications silently ignore these options. See the
-is the only one that has been tested at this time. If you'd like to contribute to documenting support for this option
+[Reference Guide](../../reference/integrations/time-based-one-time-password-apps.md) for tested applications.*
-please see [Issue 2650](https://github.com/authelia/authelia/issues/2650).*
 
 The number of digits a user needs to input to perform authentication. It's generally not recommended for this to be
 altered as many TOTP applications do not support anything other than 6. What's worse is some TOTP applications allow

docs/content/en/configuration/second-factor/webauthn.md

@@ -21,10 +21,10 @@ aliases:
 ```yaml
 webauthn:
   disable: false
-  display_name: Authelia
+  display_name: 'Authelia'
-  attestation_conveyance_preference: indirect
+  attestation_conveyance_preference: 'indirect'
-  user_verification: preferred
+  user_verification: 'preferred'
-  timeout: 60s
+  timeout: '60s'
 ```
 
 ## Options
@@ -84,8 +84,8 @@ Available Options:
 
 {{< confkey type="duration" default="60s" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 This adjusts the requested timeout for a WebAuthn interaction.
 

docs/content/en/configuration/security/access-control.md

@@ -21,9 +21,9 @@ aliases:
 
 ```yaml
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
   networks:
-  - name: internal
+  - name: 'internal'
     networks:
     - '10.0.0.0/8'
     - '172.16.0.0/12'
@@ -31,7 +31,7 @@ access_control:
   rules:
   - domain: 'private.example.com'
     domain_regex: '^(\d+\-)?priv-img.example.com$'
-    policy: one_factor
+    policy: 'one_factor'
     networks:
     - 'internal'
     - '1.1.1.1'
@@ -40,8 +40,8 @@ access_control:
     - ['user:fred']
     - ['group:admins']
     methods:
-    - GET
+    - 'GET'
-    - HEAD
+    - 'HEAD'
     resources:
     - '^/api.*'
     query:
@@ -154,10 +154,10 @@ different ways.*
 access_control:
   rules:
   - domain: '*.example.com'
-    policy: bypass
+    policy: 'bypass'
   - domain:
     - '*.example.com'
-    policy: bypass
+    policy: 'bypass'
 ```
 
 *Multiple domains matched. These rules will match either `apple.example.com` or `orange.example.com`. All rules in this
@@ -167,11 +167,11 @@ list are effectively the same rule just expressed in different ways.*
 access_control:
   rules:
   - domain: ['apple.example.com', 'banana.example.com']
-    policy: bypass
+    policy: 'bypass'
   - domain:
-    - apple.example.com
+    - 'apple.example.com'
-    - banana.example.com
+    - 'banana.example.com'
-    policy: bypass
+    policy: 'bypass'
 ```
 
 *Multiple domains matched either via a static domain or via a [domain_regex]. This rule will match
@@ -217,7 +217,7 @@ access_control:
   - domain_regex:
     - '^user-(?P<User>\w+)\.example\.com$'
     - '^group-(?P<Group>\w+)\.example\.com$'
-    policy: one_factor
+    policy: 'one_factor'
 ```
 
 *Multiple domains example, one with a static domain and one with a regex domain. This will match requests to
@@ -228,7 +228,7 @@ access_control:
   rules:
   - domain: 'protected.example.com'
   - domain_regex: '^(img|data)-private\.example\.com'
-    policy: one_factor
+    policy: 'one_factor'
 ```
 
 #### policy
@@ -267,14 +267,14 @@ ways.*
 ```yaml
 access_control:
   rules:
-  - domain: example.com
+  - domain: 'example.com'
-    policy: two_factor
+    policy: 'two_factor'
     subject:
     - 'user:john'
     - ['group:admin', 'group:app-name']
     - 'group:super-admin'
-  - domain: example.com
+  - domain: 'example.com'
-    policy: two_factor
+    policy: 'two_factor'
     subject:
     - ['user:john']
     - ['group:admin', 'group:app-name']
@@ -287,15 +287,15 @@ expressed in different ways.*
 ```yaml
 access_control:
   rules:
-  - domain: example.com
+  - domain: 'example.com'
-    policy: one_factor
+    policy: 'one_factor'
     subject: 'group:super-admin'
-  - domain: example.com
+  - domain: 'example.com'
-    policy: one_factor
+    policy: 'one_factor'
     subject:
     - 'group:super-admin'
-  - domain: example.com
+  - domain: 'example.com'
-    policy: one_factor
+    policy: 'one_factor'
     subject:
     - ['group:super-admin']
 ```
@@ -332,10 +332,10 @@ relevant methods are listed in this table:
 ```yaml
 access_control:
   rules:
-  - domain: example.com
+  - domain: 'example.com'
-    policy: bypass
+    policy: 'bypass'
     methods:
-    - OPTIONS
+    - 'OPTIONS'
 ```
 
 #### networks
@@ -369,28 +369,28 @@ rules in this list are effectively the same rule just expressed in different way
 
 ```yaml
 access_control:
-  default_policy: two_factor
+  default_policy: 'two_factor'
   networks:
-  - name: internal
+  - name: 'internal'
     networks:
       - '10.0.0.0/8'
       - '172.16.0.0/12'
       - '192.168.0.0/18'
   rules:
-  - domain: secure.example.com
+  - domain: 'secure.example.com'
-    policy: one_factor
+    policy: 'one_factor'
     networks:
     - '10.0.0.0/8'
     - '172.16.0.0/12'
     - '192.168.0.0/18'
     - '112.134.145.167/32'
-  - domain: secure.example.com
+  - domain: 'secure.example.com'
-    policy: one_factor
+    policy: 'one_factor'
     networks:
     - 'internal'
     - '112.134.145.167/32'
-  - domain: secure.example.com
+  - domain: 'secure.example.com'
-    policy: two_factor
+    policy: 'two_factor'
 ```
 
 #### resources
@@ -425,8 +425,8 @@ likely save you a lot of time if you do it for all resource rules.
 ```yaml
 access_control:
   rules:
-  - domain: app.example.com
+  - domain: 'app.example.com'
-    policy: bypass
+    policy: 'bypass'
     resources:
     - '^/api([/?].*)?$'
 ```
@@ -471,8 +471,8 @@ defaults to `present`.
 ```yaml
 access_control:
   rules:
-    - domain: app.example.com
+    - domain: 'app.example.com'
-      policy: bypass
+      policy: 'bypass'
       query:
       - - operator: 'present'
           key: 'secure'
@@ -549,13 +549,13 @@ a match for that request.
 - domain:
     - 'example.com'
     - '*.example.com'
-  policy: bypass
+  policy: 'bypass'
   resources:
     - '^/api$'
     - '^/api/'
 - domain:
     - 'app.example.com'
-  policy: two_factor
+  policy: 'two_factor'
 ```
 
 [Rule Matching Concept 1]: #rule-matching-concept-1-sequential-order
@@ -607,25 +607,25 @@ Here is a detailed example of an example access control section:
 
 ```yaml
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
   networks:
-    - name: internal
+    - name: 'internal'
       networks:
         - '10.10.0.0/16'
         - '192.168.2.0/24'
-    - name: VPN
+    - name: 'VPN'
-      networks: 10.9.0.0/16
+      networks: '10.9.0.0/16'
   rules:
     - domain: 'public.example.com'
-      policy: bypass
+      policy: 'bypass'
 
     - domain: '*.example.com'
-      policy: bypass
+      policy: 'bypass'
       methods:
-        - OPTIONS
+        - 'OPTIONS'
 
     - domain: 'secure.example.com'
-      policy: one_factor
+      policy: 'one_factor'
       networks:
         - 'internal'
         - 'VPN'
@@ -635,37 +635,37 @@ access_control:
     - domain:
       - 'secure.example.com'
       - 'private.example.com'
-      policy: two_factor
+      policy: 'two_factor'
 
     - domain: 'singlefactor.example.com'
-      policy: one_factor
+      policy: 'one_factor'
 
     - domain: 'mx2.mail.example.com'
       subject: 'group:admins'
-      policy: deny
+      policy: 'deny'
 
     - domain: '*.example.com'
       subject:
         - 'group:admins'
         - 'group:moderators'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
       - '^/groups/dev/.*$'
       subject: 'group:dev'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
       - '^/users/john/.*$'
       subject:
       - ['group:dev', 'user:john']
       - 'group:admins'
-      policy: two_factor
+      policy: 'two_factor'
 
     - domain: '{user}.example.com'
-      policy: bypass
+      policy: 'bypass'
 ```
 
 [RFC7231]: https://datatracker.ietf.org/doc/html/rfc7231

docs/content/en/configuration/security/regulation.md

@@ -25,8 +25,8 @@ authentication attempts. This helps prevent brute-force attacks.
 ```yaml
 regulation:
   max_retries: 3
-  find_time: 2m
+  find_time: '2m'
-  ban_time: 5m
+  ban_time: '5m'
 ```
 
 ## Options
@@ -43,8 +43,8 @@ The number of failed login attempts before a user may be banned. Setting this op
 
 {{< confkey type="duration" default="2m" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The period of time analyzed for failed attempts. For
 example if you set `max_retries` to 3 and `find_time` to `2m` this means the user must have 3 failed logins in
@@ -54,8 +54,8 @@ example if you set `max_retries` to 3 and `find_time` to `2m` this means the use
 
 {{< confkey type="duration" default="5m" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The period of time the user is banned for after meeting the `max_retries` and `find_time` configuration. After this
 duration the account will be able to login again.

docs/content/en/configuration/session/introduction.md

@@ -24,22 +24,20 @@ the session cookie behaviour and the domains which Authelia can service authoriz
 
 ```yaml
 session:
-  secret: insecure_session_secret
+  secret: 'insecure_session_secret'
-
+  name: 'authelia_session'
-  name: authelia_session
+  same_site: 'lax'
-  same_site: lax
+  inactivity: '5m'
-  inactivity: 5m
+  expiration: '1h'
-  expiration: 1h
+  remember_me: '1M'
-  remember_me: 1M
-
   cookies:
-    - domain: example.com
+    - domain: 'example.com'
-      authelia_url: https://auth.example.com
+      authelia_url: 'https://auth.example.com'
-      name: authelia_session
+      name: 'authelia_session'
-      same_site: lax
+      same_site: 'lax'
-      inactivity: 5m
+      inactivity: '5m'
-      expiration: 1h
+      expiration: '1h'
-      remember_me: 1d
+      remember_me: '1d'
 ```
 
 ## Providers
@@ -99,8 +97,8 @@ The default `same_site` value for all `cookies` configurations.
 
 {{< confkey type="duration" default="5m" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The default `inactivity` value for all [cookies](#cookies) configurations.
 
@@ -108,8 +106,8 @@ The default `inactivity` value for all [cookies](#cookies) configurations.
 
 {{< confkey type="duration" default="1h" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The default `expiration` value for all [cookies](#cookies) configurations.
 
@@ -117,8 +115,8 @@ The default `expiration` value for all [cookies](#cookies) configurations.
 
 {{< confkey type="duration" default="1M" required="no" >}}
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The default `remember_me` value for all [cookies](#cookies) configurations.
 
@@ -197,8 +195,8 @@ state but it's available as an option anyway.
 
 *__Default Value:__ This option takes its default value from the [inactivity](#inactivity) setting above.*
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The period of time the user can be inactive for until the session is destroyed. Useful if you want long session timers
 but don't want unused devices to be vulnerable.
@@ -209,8 +207,8 @@ but don't want unused devices to be vulnerable.
 
 *__Default Value:__ This option takes its default value from the [expiration](#expiration) setting above.*
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The period of time before the cookie expires and the session is destroyed. This is overriden by
 [remember_me](#rememberme) when the remember me box is checked.
@@ -221,8 +219,8 @@ The period of time before the cookie expires and the session is destroyed. This
 
 *__Default Value:__ This option takes its default value from the [remember_me](#rememberme) setting above.*
 
-*__Note:__ This setting uses the [duration notation format](../prologue/common.md#duration-notation-format). Please see
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
-the [common options](../prologue/common.md#duration-notation-format) documentation for information on this format.*
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
 
 The period of time before the cookie expires and the session is destroyed when the remember me box is checked. Setting
 this to `-1` disables this feature entirely for this session cookie domain.

docs/content/en/configuration/session/redis.md

@@ -25,18 +25,18 @@ this option and we highly recommend it in production environments. It requires y
 ```yaml
 session:
   redis:
-    host: 127.0.0.1
+    host: '127.0.0.1'
     port: 6379
-    username: authelia
+    username: 'authelia'
-    password: authelia
+    password: 'authelia'
     database_index: 0
     maximum_active_connections: 8
     minimum_idle_connections: 0
     tls:
-      server_name: myredis.example.com
+      server_name: 'myredis.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -105,15 +105,15 @@ session:
         DO NOT USE==
         -----END RSA PRIVATE KEY-----
     high_availability:
-      sentinel_name: mysentinel
+      sentinel_name: 'mysentinel'
       # If `sentinel_username` is supplied, Authelia will connect using ACL-based
       # authentication. Otherwise, it will use traditional `requirepass` auth.
-      sentinel_username: sentinel_user
+      sentinel_username: 'sentinel_user'
-      sentinel_password: sentinel_specific_pass
+      sentinel_password: 'sentinel_specific_pass'
       nodes:
-        - host: sentinel-node1
+        - host: 'sentinel-node1'
           port: 26379
-        - host: sentinel-node2
+        - host: 'sentinel-node2'
           port: 26379
       route_by_latency: false
       route_randomly: false
@@ -182,8 +182,12 @@ is useful if there are long delays in establishing connections.
 
 ### tls
 
-If defined enables [redis] over TLS, and additionally controls the TLS connection validation process. You can see how to
+*__Reference Note:__ This configuration option uses the
-configure the tls section [here](../prologue/common.md#tls-configuration).
+[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
+[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
+
+If defined enables connecting to [redis] over a TLS socket, and additionally controls the TLS connection
+validation parameters.
 
 ### high_availability
 

docs/content/en/configuration/storage/introduction.md

@@ -25,7 +25,7 @@ The available storage backends are listed in the table of contents below.
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   local: {}
   mysql: {}
   postgres: {}

docs/content/en/configuration/storage/mysql.md

@@ -26,19 +26,18 @@ guide for supported version information.
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   mysql:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:3306'
-    port: 3306
+    database: 'authelia'
-    database: authelia
+    username: 'authelia'
-    username: authelia
+    password: 'mypassword'
-    password: mypassword
+    timeout: '5s'
-    timeout: 5s
     tls:
-      server_name: mysql.example.com
+      server_name: 'mysql.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -116,33 +115,35 @@ This section describes the individual configuration options.
 
 See the [encryption_key docs](introduction.md#encryption_key).
 
-### host
+### address
 
-{{< confkey type="string" default="localhost" required="no" >}}
+{{< confkey type="address" required="yes" >}}
 
-The database server host. This can also be a unix socket.
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
 
-If utilising an IPv6 literal address it must be enclosed by square brackets and quoted:
+Configures the address for the MySQL/MariaDB Server. The address itself is a connector and the scheme must either be
+the `unix` scheme or one of the `tcp` schemes.
+
+__Examples:__
 
 ```yaml
 storage:
   mysql:
-    host: "[fd00:1111:2222:3333::1]"
+    address: 'tcp://127.0.0.1:3306'
 ```
 
-If utilizing a unix socket it must have the `/` prefix:
-
 ```yaml
 storage:
   mysql:
-    host: /var/run/mysqld.sock
+    address: 'tcp://[fd00:1111:2222:3333::1]:3306'
 ```
 
-### port
+```yaml
-
+storage:
-{{< confkey type="integer" default="3306" required="no" >}}
+  mysql:
-
+    address: 'unix:///var/run/mysqld.sock'
-The port the database server is listening on.
+```
 
 ### database
 
@@ -174,12 +175,19 @@ characters and the user password is changed to this value.
 
 {{< confkey type="duration" default="5s" required="no" >}}
 
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
+
 The SQL connection timeout.
 
 ### tls
 
+*__Reference Note:__ This configuration option uses the
+[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
+[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
+
 If defined enables connecting to [MySQL] or [MariaDB] over a TLS socket, and additionally controls the TLS connection
-validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration).
+validation parameters.
 
 [MySQL]: https://www.mysql.com/
 [MariaDB]: https://mariadb.org/

docs/content/en/configuration/storage/postgres.md

@@ -25,19 +25,18 @@ guide for supported version information.
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   postgres:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:5432'
-    port: 5432
+    database: 'authelia'
-    database: authelia
+    schema: 'public'
-    schema: public
+    username: 'authelia'
-    username: authelia
+    password: 'mypassword'
-    password: mypassword
     tls:
-      server_name: postgres.example.com
+      server_name: 'postgres.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -113,35 +112,37 @@ This section describes the individual configuration options.
 
 ### encryption_key
 
-See the [encryption_key docs](introduction.md#encryption_key).
+See the [encryption_key docs](introduction.md#encryptionkey).
 
-### host
+### address
 
-{{< confkey type="string" required="yes" >}}
+{{< confkey type="address" required="yes" >}}
 
-The database server host. This can also be a unix socket.
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
 
-If utilising an IPv6 literal address it must be enclosed by square brackets and quoted:
+Configures the address for the PostgreSQL Server. The address itself is a connector and the scheme must either be
+the `unix` scheme or one of the `tcp` schemes.
+
+__Examples:__
 
 ```yaml
 storage:
   postgres:
-    host: "[fd00:1111:2222:3333::1]"
+    address: 'tcp://127.0.0.1:5432'
 ```
 
-If utilizing a unix socket it must have the `/` prefix:
-
 ```yaml
 storage:
   postgres:
-    host: /var/run/postgres.sock
+    address: 'tcp://[fd00:1111:2222:3333::1]:5432'
 ```
 
-### port
+```yaml
-
+storage:
-{{< confkey type="integer" default="5432" required="no" >}}
+  postgres:
-
+    address: 'unix:///var/run/postgres.sock'
-The port the database server is listening on.
+```
 
 ### database
 
@@ -180,11 +181,18 @@ characters and the user password is changed to this value.
 
 {{< confkey type="duration" default="5s" required="no" >}}
 
+*__Reference Note:__ This configuration option uses the [duration common syntax](../prologue/common.md#duration).
+Please see the [documentation](../prologue/common.md#duration) on this format for more information.*
+
 The SQL connection timeout.
 
 ### tls
 
+*__Reference Note:__ This configuration option uses the
+[TLS configuration common structure](../prologue/common.md#tls-configuration). Please see the
+[documentation](../prologue/common.md#tls-configuration) on this structure for more information.*
+
 If defined enables connecting to [PostgreSQL] over a TLS socket, and additionally controls the TLS connection
-validation process. You can see how to configure the tls section [here](../prologue/common.md#tls-configuration).
+validation parameters.
 
 [PostgreSQL]: https://www.postgresql.org/

docs/content/en/configuration/storage/sqlite.md

@@ -28,9 +28,9 @@ but this requires you setup an external database such as [PostgreSQL](postgres.m
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   local:
-    path: /config/db.sqlite3
+    path: '/config/db.sqlite3'
 ```
 
 ## Options

docs/content/en/configuration/telemetry/metrics.md

@@ -22,14 +22,14 @@ toc: true
 telemetry:
   metrics:
     enabled: false
-    address: "tcp://0.0.0.0:9959"
+    address: 'tcp://:9959'
     buffers:
       read: 4096
       write: 4096
     timeouts:
-      read: 6s
+      read: '6s'
-      write: 6s
+      write: '6s'
-      idle: 30s
+      idle: '30s'
 ```
 
 ## Options
@@ -44,20 +44,29 @@ Determines if the [Prometheus] HTTP Metrics Exporter is enabled.
 
 ### address
 
-{{< confkey type="address" default="tcp://0.0.0.0:9959" required="no" >}}
+{{< confkey type="address" default="tcp://:9959" required="no" >}}
 
-Configures the listener address for the [Prometheus] HTTP Metrics Exporter. This configuration key uses the
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
-[Address](../prologue/common.md#address) format. The scheme must be `tcp://` or empty.
+see the [documentation](../prologue/common.md#address) on this format for more information.*
+
+Configures the listener address for the [Prometheus] Metrics Exporter HTTP Server. The address itself is a listener and
+the scheme must either be the `unix` scheme or one of the `tcp` schemes.
 
 ### buffers
 
-Configures the server buffers. See the [Server Buffers](../prologue/common.md#server-buffers) documentation for more
+*__Reference Note:__ This configuration option uses the
-information.
+[Server buffers common structure](../prologue/common.md#server-buffers). Please see the
+[documentation](../prologue/common.md#server-buffers) on this structure for more information.*
+
+Configures the server buffers.
 
 ### timeouts
 
-Configures the server timeouts. See the [Server Timeouts](../prologue/common.md#server-timeouts) documentation for more
+*__Reference Note:__ This configuration option uses the
-information.
+[Server timeouts common structure](../prologue/common.md#server-timeouts). Please see the
+[documentation](../prologue/common.md#server-timeouts) on this structure for more information.*
+
+Configures the server timeouts.
 
 ## See More
 

docs/content/en/integration/deployment/docker.md

@@ -18,6 +18,44 @@ The [Docker] container is deployed with the following image names:
 * [docker.io/authelia/authelia](https://hub.docker.com/r/authelia/authelia)
 * [ghcr.io/authelia/authelia](https://github.com/authelia/authelia/pkgs/container/authelia)
 
+## Get Started
+
+It's __*strongly recommended*__ that users setting up *Authelia* for the first time take a look at our
+[Get Started](../prologue/get-started.md) guide. This takes you through various steps which are essential to
+bootstrapping *Authelia*.
+
+## Container
+
+### Environment Variables
+
+Several environment variables apply specifically to the official container. This table documents them. It is important
+to note these environment variables are specific to the container and have no effect on the *Authelia* daemon itself and
+this section is not meant to document the daemon environment variables.
+
+| Name  | Default |                                             Usage                                             |
+|:-----:|:-------:|:---------------------------------------------------------------------------------------------:|
+| PUID  |    0    | If the container is running as UID 0, it will drop privileges to this UID via the entrypoint  |
+| PGID  |    0    | If the container is running as UID 0, it will drop privileges to this GID via the entrypoint  |
+| UMASK |   N/A   | If set the container will run with the provided UMASK by running the `umask ${UMASK}` command |
+
+### Permission Context
+
+By default the container runs as the configured [Docker] daemon user. Users can control this behaviour in several ways.
+
+The first and recommended way is instructing the [Docker] daemon to run the *Authelia* container as another user. See
+the [docker run] or [Docker Compose file reference documentation](https://docs.docker.com/compose/compose-file/05-services/#user)
+for more information. The best part of this method is the process will never have privileged access, and the only
+negative is the user must manually configure the filesystem permissions correctly.
+
+The second method is by using the environment variables listed above. The downside to this method is that the entrypoint
+itself will run as UID 0 (root). The advantage is the container will automatically set owner and permissions on the
+filesystem correctly.
+
+The last method which is beyond our documentation or support is using the
+[user namespace](https://docs.docker.com/engine/security/userns-remap/) facility [Docker] provides.
+
+[docker run]: https://docs.docker.com/engine/reference/commandline/run/
+
 ## Docker Compose
 
 We provide two main [Docker Compose] examples which can be utilized to help test *Authelia* or can be adapted into your
@@ -27,12 +65,6 @@ existing [Docker Compose].
 * [Bundle: lite](#lite)
 * [Bundle: local](#local)
 
-### Get Started
-
-It's __*strongly recommended*__ that users setting up *Authelia* for the first time take a look at our
-[Get Started](../prologue/get-started.md) guide. This takes you through various steps which are essential to
-bootstrapping *Authelia*.
-
 ### Standalone Example
 
 The following examples are [Docker Compose] deployments with just *Authelia* and no bundled applications or

docs/content/en/integration/kubernetes/istio.md

@@ -30,8 +30,8 @@ This is an example IstioOperator manifest adjusted to authenticate with Authelia
 portions of the resource that you add as well as context. You will need to adapt it to your needs.
 
 ```yaml
-apiVersion: install.istio.io/v1alpha1
+apiVersion: 'install.istio.io/v1alpha1'
-kind: IstioOperator
+kind: 'IstioOperator'
 spec:
   meshConfig:
     extensionProviders:
@@ -63,13 +63,13 @@ spec:
 The following [Authorization Policy] applies the above filter extension provider to the `nextcloud.example.com` domain:
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: 'security.istio.io/v1beta1'
-kind: AuthorizationPolicy
+kind: 'AuthorizationPolicy'
 metadata:
-  name: nextcloud
+  name: 'nextcloud'
-  namespace: apps
+  namespace: 'apps'
 spec:
-  action: CUSTOM
+  action: 'CUSTOM'
   provider:
     name:  'authelia'
   rules:

docs/content/en/integration/kubernetes/traefik-ingress.md

@@ -51,14 +51,14 @@ __SHOULD NOT__ be applied to the Authelia [Ingress] / [IngressRoute] itself.*
 {{< details "middleware.yml" >}}
 ```yaml
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: 'traefik.containo.us/v1alpha1'
-kind: Middleware
+kind: 'Middleware'
 metadata:
-  name: forwardauth-authelia
+  name: 'forwardauth-authelia'
-  namespace: default
+  namespace: 'default'
   labels:
-    app.kubernetes.io/instance: authelia
+    app.kubernetes.io/instance: 'authelia'
-    app.kubernetes.io/name: authelia
+    app.kubernetes.io/name: 'authelia'
 spec:
   forwardAuth:
     address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth'
@@ -85,25 +85,25 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat
 {{< details "ingress.yml" >}}
 ```yaml
 ---
-apiVersion: networking.k8s.io/v1
+apiVersion: 'networking.k8s.io/v1'
-kind: Ingress
+kind: 'Ingress'
 metadata:
-  name: app
+  name: 'app'
-  namespace: default
+  namespace: 'default'
   annotations:
-    traefik.ingress.kubernetes.io/router.entryPoints: websecure
+    traefik.ingress.kubernetes.io/router.entryPoints: 'websecure'
-    traefik.ingress.kubernetes.io/router.middlewares: default-forwardauth-authelia@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: 'default-forwardauth-authelia@kubernetescrd'
-    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.tls: 'true'
 spec:
   rules:
-    - host: app.example.com
+    - host: 'app.example.com'
       http:
         paths:
-          - path: /bar
+          - path: '/bar'
-            pathType: Prefix
+            pathType: 'Prefix'
             backend:
               service:
-                name:  app
+                name:  'app'
                 port:
                   number: 80
 ...
@@ -119,27 +119,27 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat
 {{< details "ingressRoute.yml" >}}
 ```yaml
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: 'traefik.containo.us/v1alpha1'
-kind: IngressRoute
+kind: 'IngressRoute'
 metadata:
-  name: app
+  name: 'app'
-  namespace: default
+  namespace: 'default'
 spec:
   entryPoints:
-    - websecure
+    - 'websecure'
   routes:
-    - kind: Rule
+    - kind: 'Rule'
-      match: Host(`app.example.com`)
+      match: 'Host(`app.example.com`)'
       middlewares:
-        - name: forwardauth-authelia
+        - name: 'forwardauth-authelia'
-          namespace: default
+          namespace: 'default'
       services:
-        - kind: Service
+        - kind: 'Service'
-          name: app
+          name: 'app'
-          namespace: default
+          namespace: 'default'
           port: 80
-          scheme: http
+          scheme: 'http'
-          strategy: RoundRobin
+          strategy: 'RoundRobin'
           weight: 10
 ...
 ```

docs/content/en/integration/ldap/introduction.md

@@ -44,8 +44,8 @@ In your Authelia configuration you will need to enter and update the following v
 
 ```yaml
   ldap:
+    address: 'ldap://OpenLDAP:1389'
     implementation: custom
-    url: ldap://OpenLDAP:1389
     timeout: 5s
     start_tls: false
     tls:
@@ -91,8 +91,8 @@ In your Authelia configuration you will need to enter and update the following v
 
 ```yaml
  ldap:
+    address: 'ldaps://ldap.example.com'
     implementation: custom
-    url: ldaps://ldap.example.com
     timeout: 5s
     start_tls: false
     tls:
@@ -134,8 +134,8 @@ In your Authelia configuration you will need to enter and update the following v
 
 ```yaml
 ldap:
+    address: 'ldap://lldap:3890'
     implementation: custom
-    url: ldap://lldap:3890
     timeout: 5s
     start_tls: false
     base_dn: dc=example,DC=com

docs/content/en/integration/openid-connect/apache-guacamole/index.md

@@ -53,7 +53,7 @@ openid-groups-claim-type: groups
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with
 [Apache Guacamole] which will operate with the above example:
 
 ```yaml
@@ -62,23 +62,23 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: guacamole
+    - id: 'guacamole'
-      description: Apache Guacamole
+      description: 'Apache Guacamole'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://guacamole.example.com
+        - 'https://guacamole.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
       response_types:
-        - id_token
+        - 'id_token'
       grant_types:
-        - implicit
+        - 'implicit'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/argocd/index.md

@@ -56,7 +56,7 @@ requestedScopes:
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Argo CD]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Argo CD]
 which will operate with the above example:
 
 ```yaml
@@ -65,32 +65,32 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: argocd
+    - id: 'argocd'
-      description: Argo CD
+      description: 'Argo CD'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://argocd.example.com/auth/callback
+        - 'https://argocd.example.com/auth/callback'
       scopes:
-        - openid
+        - 'openid'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
-    - id: argocd-cli
+    - id: 'argocd-cli'
-      description: Argo CD (CLI)
+      description: 'Argo CD (CLI)'
       public: true
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - http://localhost:8085/auth/callback
+        - 'http://localhost:8085/auth/callback'
       scopes:
-        - openid
+        - 'openid'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-        - offline_access
+        - 'offline_access'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/bookstack/index.md

@@ -58,7 +58,7 @@ To configure [BookStack] to utilize Authelia as an [OpenID Connect 1.0] Provider
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [BookStack]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [BookStack]
 which will operate with the above example:
 
 ```yaml
@@ -67,18 +67,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: bookstack
+    - id: 'bookstack'
-      description: BookStack
+      description: 'BookStack'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://bookstack.example.com/oidc/callback
+        - 'https://bookstack.example.com/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md

@@ -66,7 +66,7 @@ To configure [Cloudflare Zero Trust] to utilize Authelia as an [OpenID Connect 1
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Cloudflare]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Cloudflare]
 which will operate with the above example:
 
 ```yaml
@@ -75,18 +75,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: cloudflare
+    - id: 'cloudflare'
-      description: Cloudflare ZeroTrust
+      description: 'Cloudflare ZeroTrust'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://example-team.cloudflareaccess.com/cdn-cgi/access/callback
+        - 'https://example-team.cloudflareaccess.com/cdn-cgi/access/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/firezone/index.md

@@ -67,7 +67,7 @@ descriptions.
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Firezone] which
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Firezone] which
 will operate with the above example:
 
 ```yaml
@@ -76,20 +76,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: firezone
+    - id: 'firezone'
-      description: Firezone
+      description: 'Firezone'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       enforce_pkce: true
-      pkce_challenge_method: S256
+      pkce_challenge_method: 'S256'
       redirect_uris:
-        - https://firezone.example.com/auth/oidc/authelia/callback
+        - 'https://firezone.example.com/auth/oidc/authelia/callback'
       scopes:
-        - openid
+        - 'openid'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/frequently-asked-questions.md

@@ -132,7 +132,7 @@ services:
       ## Mandatory that the proxy is on the same network as the application, and that it has this alias.
       proxy:
         aliases:
-          - auth.example.com
+          - 'auth.example.com'
   authelia:
     networks:
       proxy: {}
@@ -140,7 +140,7 @@ networks:
   proxy:
     ## An external network can be created manually and shared between multiple compose files. This is NOT mandatory.
     external: true
-    name: proxy-net
+    name: 'proxy-net'
 ```
 
 ```console

docs/content/en/integration/openid-connect/gitea/index.md

@@ -77,7 +77,7 @@ descriptions.
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Gitea] which
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Gitea] which
 will operate with the above example:
 
 ```yaml
@@ -86,18 +86,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: gitea
+    - id: 'gitea'
-      description: Gitea
+      description: 'Gitea'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://gitea.example.com/user/oauth2/authelia/callback
+        - 'https://gitea.example.com/user/oauth2/authelia/callback'
       scopes:
-        - openid
+        - 'openid'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/gitlab/index.md

@@ -69,7 +69,7 @@ gitlab_rails['omniauth_providers'] = [
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [GitLab]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [GitLab]
 which will operate with the above example:
 
 ```yaml
@@ -78,19 +78,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: gitlab
+    - id: 'gitlab'
-      description: GitLab
+      description: 'GitLab'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://gitlab.example.com/users/auth/openid_connect/callback
+        - 'https://gitlab.example.com/users/auth/openid_connect/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/grafana/index.md

@@ -87,7 +87,7 @@ Configure the following environment variables:
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Grafana]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Grafana]
 which will operate with the above example:
 
 ```yaml
@@ -96,19 +96,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: grafana
+    - id: 'grafana'
-      description: Grafana
+      description: 'Grafana'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://grafana.example.com/login/generic_oauth
+        - 'https://grafana.example.com/login/generic_oauth'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/harbor/index.md

@@ -60,7 +60,7 @@ To configure [Harbor] to utilize Authelia as an [OpenID Connect 1.0] Provider:
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Harbor]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Harbor]
 which will operate with the above example:
 
 ```yaml
@@ -69,19 +69,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: harbor
+    - id: 'harbor'
-      description: Harbor
+      description: 'Harbor'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://harbor.example.com/c/oidc/callback
+        - 'https://harbor.example.com/c/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/hashicorp-vault/index.md

@@ -43,7 +43,7 @@ To configure [HashiCorp Vault] to utilize Authelia as an [OpenID Connect 1.0] Pr
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [HashiCorp Vault]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [HashiCorp Vault]
 which will operate with the above example:
 
 ```yaml
@@ -52,20 +52,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: vault
+    - id: 'vault'
-      description: HashiCorp Vault
+      description: 'HashiCorp Vault'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://vault.example.com/oidc/callback
+        - 'https://vault.example.com/oidc/callback'
-        - https://vault.example.com/ui/vault/auth/oidc/oidc/callback
+        - 'https://vault.example.com/ui/vault/auth/oidc/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/introduction.md

@@ -18,8 +18,10 @@ Authelia can act as an [OpenID Connect 1.0] Provider as part of an open beta. Th
 specifics that can be used for integrating Authelia with an [OpenID Connect 1.0] Relying Party, as well as specific
 documentation for some [OpenID Connect 1.0] Relying Party implementations.
 
-See the [configuration documentation](../../configuration/identity-providers/open-id-connect.md) for information on how
+See the [OpenID Connect 1.0 Provider](../../configuration/identity-providers/openid-connect/provider.md) and
-to configure the Authelia [OpenID Connect 1.0] Provider.
+[OpenID Connect 1.0 Clients](../../configuration/identity-providers/openid-connect/clients.md) configuration guides for
+information on how to configure the Authelia [OpenID Connect 1.0] Provider (note the clients guide is for configuring
+the registered clients in the provider).
 
 This page is intended as an integration reference point for any implementers who wish to integrate an
 [OpenID Connect 1.0] Relying Party (client application) either as a developer or user of the third party Reyling Party.
@@ -101,6 +103,49 @@ This scope includes the profile information the authentication backend reports a
 | preferred_username |  string  |      username      | The username the user used to login with |
 |        name        |  string  |    display_name    |          The users display name          |
 
+## Signing and Encryption Algorithms
+
+[OpenID Connect 1.0] and OAuth 2.0 support a wide variety of signature and encryption algorithms. Authelia supports
+a subset of these.
+
+### Response Object
+
+Authelia's response objects can have the following signature algorithms:
+
+| Algorithm |  Key Type   | Hashing Algorithm |    Use    |            JWK Default Conditions            |                        Notes                         |
+|:---------:|:-----------:|:-----------------:|:---------:|:--------------------------------------------:|:----------------------------------------------------:|
+|   RS256   |     RSA     |      SHA-256      | Signature | RSA Private Key without a specific algorithm |  Requires an RSA Private Key with 2048 bits or more  |
+|   RS384   |     RSA     |      SHA-384      | Signature |                     N/A                      |  Requires an RSA Private Key with 2048 bits or more  |
+|   RS512   |     RSA     |      SHA-512      | Signature |                     N/A                      |  Requires an RSA Private Key with 2048 bits or more  |
+|   ES256   | ECDSA P-256 |      SHA-256      | Signature |    ECDSA Private Key with the P-256 curve    |                                                      |
+|   ES384   | ECDSA P-384 |      SHA-384      | Signature |    ECDSA Private Key with the P-384 curve    |                                                      |
+|   ES512   | ECDSA P-521 |      SHA-512      | Signature |    ECDSA Private Key with the P-521 curve    | Requires an ECDSA Private Key with 2048 bits or more |
+|   PS256   | RSA (MGF1)  |      SHA-256      | Signature |                     N/A                      |  Requires an RSA Private Key with 2048 bits or more  |
+|   PS384   | RSA (MGF1)  |      SHA-384      | Signature |                     N/A                      |  Requires an RSA Private Key with 2048 bits or more  |
+|   PS512   | RSA (MGF1)  |      SHA-512      | Signature |                     N/A                      |  Requires an RSA Private Key with 2048 bits or more  |
+
+### Request Object
+
+Authelia accepts a wide variety of request object types.
+
+| Algorithm |      Key Type      | Hashing Algorithm |    Use    |                       Notes                        |
+|:---------:|:------------------:|:-----------------:|:---------:|:--------------------------------------------------:|
+|   none    |        None        |       None        |    N/A    |                        N/A                         |
+|   HS256   | HMAC Shared Secret |      SHA-256      | Signature | [Client Authentication Method] `client_secret_jwt` |
+|   HS384   | HMAC Shared Secret |      SHA-384      | Signature | [Client Authentication Method] `client_secret_jwt` |
+|   HS512   | HMAC Shared Secret |      SHA-512      | Signature | [Client Authentication Method] `client_secret_jwt` |
+|   RS256   |        RSA         |      SHA-256      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   RS384   |        RSA         |      SHA-384      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   RS512   |        RSA         |      SHA-512      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   ES256   |    ECDSA P-256     |      SHA-256      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   ES384   |    ECDSA P-384     |      SHA-384      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   ES512   |    ECDSA P-521     |      SHA-512      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   PS256   |     RSA (MFG1)     |      SHA-256      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   PS384   |     RSA (MFG1)     |      SHA-384      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+|   PS512   |     RSA (MFG1)     |      SHA-512      | Signature |  [Client Authentication Method] `private_key_jwt`  |
+
+[Client Authentication Method]: #client-authentication-method
+
 ## Parameters
 
 The following section describes advanced parameters which can be used in various endpoints as well as their related
@@ -174,8 +219,8 @@ specification and the [OAuth 2.0 - Client Types] specification for more informat
 |:------------------------------------:|:-----------------------------:|:----------------------:|:-----------------------:|:--------------------------------------------------------:|
 |  Secret via HTTP Basic Auth Scheme   |     `client_secret_basic`     |     `confidential`     |           N/A           |                           N/A                            |
 |      Secret via HTTP POST Body       |     `client_secret_post`      |     `confidential`     |           N/A           |                           N/A                            |
-|        JWT (signed by secret)        |      `client_secret_jwt`      |     Not Supported      |           N/A           | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` |
+|        JWT (signed by secret)        |      `client_secret_jwt`      |     `confidential`     |           N/A           | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` |
-|     JWT (signed by private key)      |       `private_key_jwt`       |     Not Supported      |           N/A           | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` |
+|     JWT (signed by private key)      |       `private_key_jwt`       |     `confidential`     |           N/A           | `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` |
 |        [OAuth 2.0 Mutual-TLS]        |       `tls_client_auth`       |     Not Supported      |           N/A           |                           N/A                            |
 | [OAuth 2.0 Mutual-TLS] (Self Signed) | `self_signed_tls_client_auth` |     Not Supported      |           N/A           |                           N/A                            |
 |          No Authentication           |            `none`             |        `public`        |        `public`         |                           N/A                            |
@@ -210,7 +255,7 @@ Below is a list of the potential values we place in the [Claim] and their meanin
 ## User Information Signing Algorithm
 
 The following table describes the response from the [UserInfo] endpoint depending on the
-[userinfo_signing_algorithm](../../configuration/identity-providers/open-id-connect.md#userinfosigningalgorithm).
+[userinfo_signing_alg](../../configuration/identity-providers/openid-connect/clients.md#userinfosigningalg).
 
 | Signing Algorithm |   Encoding   |            Content Type             |
 |:-----------------:|:------------:|:-----------------------------------:|

docs/content/en/integration/openid-connect/kasm-workspaces/index.md

@@ -67,20 +67,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-      - id: kasm
+      - id: 'kasm'
-        description: Kasm Workspaces
+        description: 'Kasm Workspaces'
         secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
         public: false
-        authorization_policy: two_factor
+        authorization_policy: 'two_factor'
         redirect_uris:
-          - https://kasm.example.com/api/oidc_callback
+          - 'https://kasm.example.com/api/oidc_callback'
         scopes:
-          - openid
+          - 'openid'
-          - profile
+          - 'profile'
-          - groups
+          - 'groups'
-          - email
+          - 'email'
-        consent_mode: implicit
+        consent_mode: 'implicit'
-        userinfo_signing_algorithm: none
+        userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/komga/index.md

@@ -50,22 +50,22 @@ spring:
       client:
         registration:
           authelia:
-            client-id: `komga`
+            client-id: 'komga'
-            client-secret: `insecure_secret`
+            client-secret: 'insecure_secret'
-            client-name: Authelia
+            client-name: 'Authelia'
-            scope: openid,profile,email
+            scope: 'openid,profile,email'
-            authorization-grant-type: authorization_code
+            authorization-grant-type: 'authorization_code'
             redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/login/oauth2/code/authelia"
         provider:
           authelia:
-            issuer-uri: https://auth.example.com
+            issuer-uri: 'https://auth.example.com'
-            user-name-attribute: preferred_username
+            user-name-attribute: 'preferred_username'
 ````
 
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Komga]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Komga]
 which will operate with the above example:
 
 ```yaml
@@ -74,20 +74,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: komga
+    - id: 'komga'
-      description: Komga
+      description: 'Komga'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://komga.example.com/login/oauth2/code/authelia
+        - 'https://komga.example.com/login/oauth2/code/authelia'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
       grant_types:
-        - authorization_code
+        - 'authorization_code'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/minio/index.md

@@ -63,7 +63,7 @@ To configure [MinIO] to utilize Authelia as an [OpenID Connect 1.0] Provider:
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [MinIO]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [MinIO]
 which will operate with the above example:
 
 ```yaml
@@ -72,19 +72,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: minio
+    - id: 'minio'
-      description: MinIO
+      description: 'MinIO'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://minio.example.com/apps/oidc_login/oidc
+        - 'https://minio.example.com/apps/oidc_login/oidc'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-        - groups
+        - 'groups'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/misago/index.md

@@ -79,7 +79,7 @@ To configure [Misago] to utilize Authelia as an [OpenID Connect 1.0](https://www
 
 ### Authelia
 
-The following YAML configuration is an example **Authelia** [client configuration](https://www.authelia.com/configuration/identity-providers/open-id-connect/#clients) for use with [Misago] which will operate with the above example:
+The following YAML configuration is an example **Authelia** [client configuration](https://www.authelia.com/configuration/identity-providers/openid-connect/#clients) for use with [Misago] which will operate with the above example:
 
 ```yaml
 identity_providers:
@@ -87,23 +87,24 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: misago
+    - id: 'misago'
+      description: 'Misago'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
       redirect_uris:
-        - https://misago.example.com/oauth2/complete/
+        - 'https://misago.example.com/oauth2/complete/'
       grant_types:
-        - authorization_code
+        - 'authorization_code'
       response_types:
-        - code
+        - 'code'
       response_modes:
-        - query
+        - 'query'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ---

docs/content/en/integration/openid-connect/nextcloud/index.md

@@ -86,7 +86,7 @@ $CONFIG = array (
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Nextcloud]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Nextcloud]
 which will operate with the above example:
 
 ```yaml
@@ -95,19 +95,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: nextcloud
+    - id: 'nextcloud'
-      description: NextCloud
+      description: 'NextCloud'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://nextcloud.example.com/apps/oidc_login/oidc
+        - 'https://nextcloud.example.com/apps/oidc_login/oidc'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-        - groups
+        - 'groups'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/outline/index.md

@@ -60,7 +60,7 @@ OIDC_SCOPES="openid offline_access profile email"
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Outline]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Outline]
 which will operate with the above example:
 
 ```yaml
@@ -69,19 +69,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: outline
+    - id: 'outline'
-      description: Outline
+      description: 'Outline'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://outline.example.com/auth/oidc.callback
+        - 'https://outline.example.com/auth/oidc.callback'
       scopes:
-        - openid
+        - 'openid'
-        - offline_access
+        - 'offline_access'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/portainer/index.md

@@ -61,7 +61,7 @@ To configure [Portainer] to utilize Authelia as an [OpenID Connect 1.0] Provider
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Portainer]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Portainer]
 which will operate with the above example:
 
 ```yaml
@@ -70,19 +70,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: portainer
+    - id: 'portainer'
-      description: Portainer
+      description: 'Portainer'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://portainer.example.com
+        - 'https://portainer.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/proxmox/index.md

@@ -65,7 +65,7 @@ To configure [Proxmox] to utilize Authelia as an [OpenID Connect 1.0] Provider:
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Proxmox]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Proxmox]
 which will operate with the above example:
 
 ```yaml
@@ -74,18 +74,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: proxmox
+    - id: 'proxmox'
-      description: Proxmox
+      description: 'Proxmox'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://proxmox.example.com
+        - 'https://proxmox.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/seafile/index.md

@@ -69,7 +69,7 @@ OAUTH_ATTRIBUTE_MAP = {
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Seafile]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Seafile]
 which will operate with the above example:
 
 ```yaml
@@ -78,18 +78,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: seafile
+    - id: 'seafile'
-      description: Seafile
+      description: 'Seafile'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://seafile.example.com/oauth/callback/
+        - 'https://seafile.example.com/oauth/callback/'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/synapse/index.md

@@ -63,7 +63,7 @@ oidc_providers:
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Synapse]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Synapse]
 which will operate with the above example:
 
 ```yaml
@@ -72,18 +72,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: synapse
+    - id: 'synapse'
-      description: Synapse
+      description: 'Synapse'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://synapse.example.com/_synapse/client/oidc/callback
+        - 'https://synapse.example.com/_synapse/client/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/synology-dsm/index.md

@@ -65,7 +65,7 @@ To configure [Synology DSM] to utilize Authelia as an [OpenID Connect 1.0] Provi
 ### Authelia
 
 The following YAML configuration is an example __Authelia__
-[client configuration](../../../configuration/identity-providers/open-id-connect.md#clients) for use with [Synology DSM]
+[client configuration](../../../configuration/identity-providers/openid-connect/clients.md) for use with [Synology DSM]
 which will operate with the above example:
 
 ```yaml
@@ -74,19 +74,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: synology-dsm
+    - id: 'synology-dsm'
-      description: Synology DSM
+      description: 'Synology DSM'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://dsm.example.com
+        - 'https://dsm.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_alg: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/tailscale/index.md

@@ -84,15 +84,15 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: tailscale
+    - id: 'tailscale'
-      description: Tailscale SSO
+      description: 'Tailscale'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       redirect_uris:
-        - https://login.tailscale.com/a/oauth_response
+        - 'https://login.tailscale.com/a/oauth_response'
       scopes:
-        - openid
+        - 'openid'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
 ```
 
 ## See Also

docs/content/en/integration/proxies/caddy.md

@@ -101,7 +101,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration

docs/content/en/integration/proxies/envoy.md

@@ -75,7 +75,7 @@ server:
   endpoints:
     authz:
       ext-authz:
-        implementation: ExtAuthz
+        implementation: 'ExtAuthz'
 ```
 
 ## Configuration
@@ -97,47 +97,47 @@ Support for [Envoy] is possible with Authelia v4.37.0 and higher via the [Envoy]
 version: "3.8"
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 services:
   envoy:
-    container_name: envoy
+    container_name: 'envoy'
-    image: envoyproxy/envoy:v1.24
+    image: 'envoyproxy/envoy:v1.24'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     ports:
       - '80:8080'
       - '443:8443'
     volumes:
-      - ${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro
+      - '${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro'
-      - ${PWD}/data/certificates:/certificates:ro
+      - '${PWD}/data/certificates:/certificates:ro'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
 ```
 {{< /details >}}
 
@@ -145,92 +145,92 @@ services:
 ```yaml
 static_resources:
   listeners:
-    - name: listener_http
+    - name: 'listener_http'
       address:
         socket_address:
-          address: 0.0.0.0
+          address: '0.0.0.0'
           port_value: 8080
       filter_chains:
         - filters:
-            - name: envoy.filters.network.http_connection_manager
+            - name: 'envoy.filters.network.http_connection_manager'
               typed_config:
-                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager'
-                codec_type: auto
+                codec_type: 'auto'
-                stat_prefix: ingress_http
+                stat_prefix: 'ingress_http'
                 route_config:
-                  name: local_route
+                  name: 'local_route'
                   virtual_hosts:
-                    - name: backend
+                    - name: 'backend'
-                      domains: ["*"]
+                      domains: ['*']
                       routes:
                         - match:
-                            prefix: "/"
+                            prefix: '/'
                           redirect:
                             https_redirect: true
                   http_filters:
-                    - name: envoy.filters.http.router
+                    - name: 'envoy.filters.http.router'
                       typed_config:
-                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+                        "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router'
-    - name: listener_https
+    - name: 'listener_https'
       address:
         socket_address:
-          address: 0.0.0.0
+          address: '0.0.0.0'
           port_value: 8443
       filter_chains:
         - filters:
-            - name: envoy.filters.network.http_connection_manager
+            - name: 'envoy.filters.network.http_connection_manager'
               typed_config:
-                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager'
-                stat_prefix: ingress_http
+                stat_prefix: 'ingress_http'
                 use_remote_address: true
                 skip_xff_append: false
                 route_config:
-                  name: local_route
+                  name: 'local_route'
                   virtual_hosts:
-                    - name: whoami_service
+                    - name: 'whoami_service'
                       domains: ["nextcloud.example.com"]
                       routes:
                         - match:
                             prefix: "/"
                           route:
-                            cluster: nextcloud
+                            cluster: 'nextcloud'
-                    - name: authelia_service
+                    - name: 'authelia_service'
-                      domains: ["auth.example.com"]
+                      domains: ['auth.example.com']
                       typed_per_filter_config:
                         envoy.filters.http.ext_authz:
-                          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+                          "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute'
                           disabled: true
                       routes:
                         - match:
-                            prefix: "/"
+                            prefix: '/'
                           route:
-                            cluster: authelia
+                            cluster: 'authelia'
                 http_filters:
-                  - name: envoy.filters.http.ext_authz
+                  - name: 'envoy.filters.http.ext_authz'
                     typed_config:
-                      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+                      "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz'
-                      transport_api_version: v3
+                      transport_api_version: 'v3'
                       allowed_headers:
                         patterns:
-                          - exact: authorization
+                          - exact: 'authorization'
-                          - exact: proxy-authorization
+                          - exact: 'proxy-authorization'
-                          - exact: accept
+                          - exact: 'accept'
-                          - exact: cookie
+                          - exact: 'cookie'
                       http_service:
-                        path_prefix: /api/authz/ext-authz/
+                        path_prefix: '/api/authz/ext-authz/'
                         server_uri:
-                          uri: authelia:9091
+                          uri: 'authelia:9091'
-                          cluster: authelia
+                          cluster: 'authelia'
-                          timeout: 0.25s
+                          timeout: '0.25s'
                         authorization_request:
                           allowed_headers:
                             patterns:
-                              - exact: authorization
+                              - exact: 'authorization'
-                              - exact: proxy-authorization
+                              - exact: 'proxy-authorization'
-                              - exact: accept
+                              - exact: 'accept'
-                              - exact: cookie
+                              - exact: 'cookie'
                           headers_to_add:
-                            - key: X-Forwarded-Proto
+                            - key: 'X-Forwarded-Proto'
                               value: '%REQ(:SCHEME)%'
                             ## The following commented lines are for configuring the Authelia URL in the proxy. We
                             ## strongly suggest this is configured in the Session Cookies section of the Authelia configuration.
@@ -239,52 +239,52 @@ static_resources:
                         authorization_response:
                           allowed_upstream_headers:
                             patterns:
-                              - exact: authorization
+                              - exact: 'authorization'
-                              - exact: proxy-authorization
+                              - exact: 'proxy-authorization'
-                              - prefix: remote-
+                              - prefix: 'remote-'
-                              - prefix: authelia-
+                              - prefix: 'authelia-'
                           allowed_client_headers:
                             patterns:
-                              - exact: set-cookie
+                              - exact: 'set-cookie'
                           allowed_client_headers_on_success:
                             patterns:
-                              - exact: set-cookie
+                              - exact: 'set-cookie'
                       failure_mode_allow: false
-                  - name: envoy.filters.http.router
+                  - name: 'envoy.filters.http.router'
                     typed_config:
-                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+                      "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router'
   clusters:
-    - name: nextcloud
+    - name: 'nextcloud'
-      connect_timeout: 0.25s
+      connect_timeout: '0.25s'
-      type: logical_dns
+      type: 'logical_dns'
-      dns_lookup_family: v4_only
+      dns_lookup_family: 'v4_only'
-      lb_policy: round_robin
+      lb_policy: 'round_robin'
       load_assignment:
-        cluster_name: nextcloud
+        cluster_name: 'nextcloud'
         endpoints:
           - lb_endpoints:
               - endpoint:
                   address:
                     socket_address:
-                      address: nextcloud
+                      address: 'nextcloud'
                       port_value: 80
-    - name: authelia
+    - name: 'authelia'
-      connect_timeout: 0.25s
+      connect_timeout: '0.25s'
-      type: logical_dns
+      type: 'logical_dns'
-      dns_lookup_family: v4_only
+      dns_lookup_family: 'v4_only'
-      lb_policy: round_robin
+      lb_policy: 'round_robin'
       load_assignment:
-        cluster_name: authelia
+        cluster_name: 'authelia'
         endpoints:
           - lb_endpoints:
               - endpoint:
                   address:
                     socket_address:
-                      address: authelia
+                      address: 'authelia'
                       port_value: 9091
 layered_runtime:
   layers:
-    - name: static_layer_0
+    - name: 'static_layer_0'
       static_layer:
         envoy:
           resource_limits:

docs/content/en/integration/proxies/haproxy.md

@@ -104,7 +104,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration

docs/content/en/integration/proxies/nginx-proxy-manager/index.md

@@ -75,13 +75,13 @@ version: "3.8"
 
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 
 services:
   nginx:
-    container_name: nginx
+    container_name: 'nginx'
-    image: jc21/nginx-proxy-manager
+    image: 'jc21/nginx-proxy-manager'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
@@ -90,44 +90,44 @@ services:
       - '81:81'
       - '443:443'
     volumes:
-      - ${PWD}/data/nginx-proxy-manager/data:/data
+      - '${PWD}/data/nginx-proxy-manager/data:/data'
-      - ${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt
+      - '${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt'
-      - ${PWD}/data/nginx/snippets:/snippets:ro
+      - '${PWD}/data/nginx/snippets:/snippets:ro'
     environment:
       TZ: 'Australia/Melbourne'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
       TZ: 'Australia/Melbourne'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: lscr.io/linuxserver/nextcloud
+    image: 'lscr.io/linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
       PUID: '1000'
       PGID: '1000'
       TZ: 'Australia/Melbourne'
   whoami:
-    container_name: whoami
+    container_name: 'whoami'
-    image: docker.io/traefik/whoami
+    image: 'docker.io/traefik/whoami'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []

docs/content/en/integration/proxies/nginx.md

@@ -90,7 +90,7 @@ server:
   endpoints:
     authz:
       auth-request:
-        implementation: AuthRequest
+        implementation: 'AuthRequest'
 ```
 
 ## Docker Compose

docs/content/en/integration/proxies/swag.md

@@ -58,7 +58,7 @@ In addition this represents a bad user experience in some instances such as:
 * Users sometimes visit the `https://app.example.com/authelia` URL which doesn't automatically redirect the user to
   `https://app.example.com` (if they visit `https://app.example.com` then they'll be redirected to authenticate then
   redirected back to their original URL)
-* Administrators may wish to setup [OpenID Connect 1.0](../../configuration/identity-providers/open-id-connect.md) in
+* Administrators may wish to setup [OpenID Connect 1.0](../../configuration/identity-providers/openid-connect/provider.md) in
   which case it also doesn't represent a good user experience as the `issuer` will be
   `https://app.example.com/authelia` for example
 * Using the [SWAG] default configurations are more difficult to support as our specific familiarity is with our own
@@ -156,13 +156,13 @@ version: "3.8"
 
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 
 services:
   swag:
-    container_name: swag
+    container_name: 'swag'
-    image: lscr.io/linuxserver/swag
+    image: 'lscr.io/linuxserver/swag'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
@@ -170,7 +170,7 @@ services:
       - '80:80'
       - '443:443'
     volumes:
-      - ${PWD}/data/swag:/config
+      - '${PWD}/data/swag:/config'
       ## Uncomment the line below if you want to use the Authelia configuration snippets.
       #- ${PWD}/data/nginx/snippets:/snippets:ro
     environment:
@@ -184,40 +184,40 @@ services:
       ONLY_SUBDOMAINS: 'false'
       STAGING: 'true'
     cap_add:
-      - NET_ADMIN
+      - 'NET_ADMIN'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
       TZ: 'Australia/Melbourne'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: lscr.io/linuxserver/nextcloud
+    image: 'lscr.io/linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
       PUID: '1000'
       PGID: '1000'
       TZ: 'Australia/Melbourne'
   whoami:
-    container_name: whoami
+    container_name: 'whoami'
-    image: docker.io/traefik/whoami
+    image: 'docker.io/traefik/whoami'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []

docs/content/en/integration/proxies/traefik.md

@@ -75,7 +75,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration
@@ -130,9 +130,9 @@ networks:
     driver: bridge
 services:
   traefik:
-    container_name: traefik
+    container_name: 'traefik'
-    image: traefik:v2.9
+    image: 'traefik:v2.9'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     command:
       - '--api=true'
       - '--api.dashboard=true'
@@ -164,11 +164,11 @@ services:
     networks:
       net: {}
     ports:
-      - "80:8080"
+      - '80:8080'
-      - "443:8443"
+      - '443:8443'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - '/var/run/docker.sock:/var/run/docker.sock'
-      - ${PWD}/data/traefik:/config
+      - '${PWD}/data/traefik:/config'
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.api.rule=Host(`traefik.example.com`)'
@@ -177,15 +177,15 @@ services:
       - 'traefik.http.routers.api.service=api@internal'
       - 'traefik.http.routers.api.middlewares=authelia@docker'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
       TZ: "Australia/Melbourne"
     labels:
@@ -200,20 +200,20 @@ services:
       - 'traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true'
       - 'traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.nextcloud.rule=Host(`nextcloud.example.com`)'
@@ -221,19 +221,19 @@ services:
       - 'traefik.http.routers.nextcloud.tls=true'
       - 'traefik.http.routers.nextcloud.middlewares=authelia@docker'
   heimdall:
-    container_name: heimdall
+    container_name: 'heimdall'
-    image: linuxserver/heimdall
+    image: 'linuxserver/heimdall'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/heimdall/config:/config
+      - '${PWD}/data/heimdall/config:/config'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.heimdall.rule=Host(`heimdall.example.com`)'
@@ -264,12 +264,12 @@ This example uses a `docker-compose.yml` similar to the one above however it has
 version: "3.8"
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 services:
   traefik:
-    container_name: traefik
+    container_name: 'traefik'
-    image: traefik:v2.9
+    image: 'traefik:v2.9'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     command:
       - '--api=true'
       - '--api.dashboard=true'
@@ -294,74 +294,74 @@ services:
     networks:
       net: {}
     ports:
-      - "80:8080"
+      - '80:8080'
-      - "443:8443"
+      - '443:8443'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - '/var/run/docker.sock:/var/run/docker.sock'
-      - ${PWD}/data/traefik/config:/config
+      - '${PWD}/data/traefik/config:/config'
-      - ${PWD}/data/traefik/certificates:/certificates
+      - '${PWD}/data/traefik/certificates:/certificates'
     labels:
       - 'traefik.enable=true'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
-      - ${PWD}/data/authelia/certificates:/certificates
+      - '${PWD}/data/authelia/certificates:/certificates'
     environment:
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
   heimdall:
-    container_name: heimdall
+    container_name: 'heimdall'
-    image: linuxserver/heimdall
+    image: 'linuxserver/heimdall'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/heimdall/config:/config
+      - '${PWD}/data/heimdall/config:/config'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
   whoami:
-    container_name: whoami
+    container_name: 'whoami'
-    image: traefik/whoami:latest
+    image: 'traefik/whoami:latest'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 80
     environment:
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
-      - "traefik.enable=true"
+      - 'traefik.enable=true'
 ...
 ```
 {{< /details >}}
@@ -391,16 +391,16 @@ entryPoints:
 tls:
   options:
     modern:
-      minVersion: "VersionTLS13"
+      minVersion: 'VersionTLS13'
     intermediate:
-      minVersion: "VersionTLS12"
+      minVersion: 'VersionTLS12'
       cipherSuites:
-        - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+        - 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256'
-        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+        - 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'
-        - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+        - 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384'
-        - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+        - 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
-        - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
+        - 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305'
-        - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
+        - 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305'
 http:
   middlewares:
     authelia:
@@ -418,9 +418,9 @@ http:
           - 'Remote-Email'
           - 'Remote-Name'
         tls:
-          ca: /certificates/ca.public.crt
+          ca: '/certificates/ca.public.crt'
-          cert: /certificates/traefik.public.crt
+          cert: '/certificates/traefik.public.crt'
-          key: /certificates/traefik.private.pem
+          key: '/certificates/traefik.private.pem'
     authelia-basic:
       forwardAuth:
         address: 'https://authelia:9091/api/verify?auth=basic'
@@ -433,86 +433,86 @@ http:
           - 'Remote-Email'
           - 'Remote-Name'
         tls:
-          ca: /certificates/ca.public.crt
+          ca: '/certificates/ca.public.crt'
-          cert: /certificates/traefik.public.crt
+          cert: '/certificates/traefik.public.crt'
-          key: /certificates/traefik.private.pem
+          key: '/certificates/traefik.private.pem'
   routers:
     traefik:
-      rule: Host(`traefik.example.com`)
+      rule: 'Host(`traefik.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: api@internal
+      service: 'api@internal'
       middlewares:
-        - authelia@file
+        - 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     whoami:
-      rule: Host(`whoami.example.com`)
+      rule: 'Host(`whoami.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: whoami-net@docker
+      service: 'whoami-net@docker'
       middlewares:
-        - authelia@file
+        - 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     nextcloud:
-      rule: Host(`nextcloud.example.com`)
+      rule: 'Host(`nextcloud.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: nextcloud-net@docker
+      service: 'nextcloud-net@docker'
       middlewares:
-        - authelia@file
+        - 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     heimdall:
-      rule: Host(`heimdall.example.com`)
+      rule: 'Host(`heimdall.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: heimdall-net@docker
+      service: 'heimdall-net@docker'
       middlewares:
-        - authelia-basic@file
+        - 'authelia-basic@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     authelia:
-      rule: Host(`auth.example.com`)
+      rule: 'Host(`auth.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: authelia@file
+      service: 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
   services:
     authelia:
       loadBalancer:
         servers:
-          - url: https://authelia:9091/
+          - url: 'https://authelia:9091/'
-        serversTransport: autheliaMutualTLS
+        serversTransport: 'autheliaMutualTLS'
   serversTransports:
     autheliaMutualTLS:
       certificates:
-        - certFile: /certificates/traefik.public.crt
+        - certFile: '/certificates/traefik.public.crt'
-          keyFile: /certificates/traefik.private.pem
+          keyFile: '/certificates/traefik.private.pem'
       rootCAs:
-        - /certificates/ca.public.crt
+        - '/certificates/ca.public.crt'
 ...
 ```
 {{< /details >}}

docs/content/en/integration/proxies/traefikv1.md

@@ -88,7 +88,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration
@@ -119,15 +119,15 @@ version: '3'
 
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 services:
   traefik:
-    image: traefik:v1.7.34-alpine
+    image: 'traefik:v1.7.34-alpine'
-    container_name: traefik
+    container_name: 'traefik'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - '/var/run/docker.sock:/var/run/docker.sock'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:traefik.example.com'
       - 'traefik.port=8081'
@@ -135,7 +135,7 @@ services:
       - '80:80'
       - '443:443'
       - '8081:8081'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     command:
       - '--api'
       - '--api.entrypoint=api'
@@ -151,27 +151,27 @@ services:
       # - '--entryPoints=Name:https Address::443 TLS ForwardedHeaders.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7 ProxyProtocol.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7'
       - '--entryPoints=Name:api Address::8081'
   authelia:
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    container_name: authelia
+    container_name: 'authelia'
     volumes:
-      - /path/to/authelia:/config
+      - '/path/to/authelia:/config'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:auth.example.com'
     expose:
       - 9091
-    restart: unless-stopped
+    restart: 'unless-stopped'
     environment:
-      - TZ=Australia/Melbourne
+      TZ: 'Australia/Melbourne'
   nextcloud:
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    container_name: nextcloud
+    container_name: 'nextcloud'
     volumes:
-      - /path/to/nextcloud/config:/config
+      - '/path/to/nextcloud/config:/config'
-      - /path/to/nextcloud/data:/data
+      - '/path/to/nextcloud/data:/data'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:nextcloud.example.com'
       - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth'
@@ -182,18 +182,18 @@ services:
       - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
     expose:
       - 443
-    restart: unless-stopped
+    restart: 'unless-stopped'
     environment:
-      - PUID=1000
+      PUID: '1000'
-      - PGID=1000
+      PGID: '1000'
-      - TZ=Australia/Melbourne
+      TZ: 'Australia/Melbourne'
   heimdall:
-    image: linuxserver/heimdall
+    image: 'linuxserver/heimdall'
-    container_name: heimdall
+    container_name: 'heimdall'
     volumes:
-      - /path/to/heimdall/config:/config
+      - '/path/to/heimdall/config:/config'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:heimdall.example.com'
       - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth/basic'
@@ -201,11 +201,11 @@ services:
       - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
     expose:
       - 443
-    restart: unless-stopped
+    restart: 'unless-stopped'
     environment:
-      - PUID=1000
+      PUID: '1000'
-      - PGID=1000
+      PGID: '1000'
-      - TZ=Australia/Melbourne
+      TZ: 'Australia/Melbourne'
 ```
 
 ## See Also

docs/content/en/overview/authorization/openid-connect-1.0.md

@@ -16,6 +16,6 @@ configure your applications to use Authelia as an [OpenID Connect 1.0 Provider](
 currently operate as an [OpenID Connect 1.0 Relying Party](https://openid.net/connect/). This like all single-sign on
 technologies requires support by the protected application.
 
-See the [OpenID Connect 1.0 Configuration Guide](../../configuration/identity-providers/open-id-connect.md) and the
+See the [OpenID Connect 1.0 Provider Configuration Guide](../../configuration/identity-providers/openid-connect/provider.md),  and the
 [OpenID Connect 1.0 Integration Guide](../../integration/openid-connect/introduction.md) for more information.
 

docs/content/en/overview/security/measures.md

@@ -160,7 +160,7 @@ values.
 
 As such all SMTP connections require the following:
 
-1. A TLS Connection (STARTTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated
+1. A TLS Connection (StartTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated
  connections require it as well_)
 2. Valid X509 Certificate presented to the client during the TLS handshake
 
@@ -207,22 +207,22 @@ for SMTP servers that allow unauthenticated relaying (bad practice).
 
 ### SMTP Ports
 
-All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via STARTTLS.
+All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via StartTLS.
 
 The [`submissions` service][service-submissions] (_typically port 465_) is an exception to this rule, where the
-connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [port for
+connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [scheme for
-SMTP][docs-config-smtp-port] is set to `465`, Authelia will initiate TLS connections without requiring STARTTLS
+SMTP][docs-config-smtp-port] is set to `submissions`, Authelia will initiate TLS connections without requiring StartTLS
 negotiation.
 
-When the `submissions` service port is available, it [should be preferred][port-465] over any STARTTLS port for
+When the `submissions` service port is available, it [should be preferred][port-465] over any StartTLS port for
 submitting mail.
 
 **NOTE:** Prior to 2018, port 465 was previously assigned for a similar purpose known as [`smtps`][port-465] (_A TLS
 only equivalent of the `smtp` port 25_), which it had been deprecated for. Port 465 has since been re-assigned for only
 supporting mail submission (_which unlike SMTP transfers via port 25, [requires authentication][smtp-auth]_), similar
-to port 587 (_the `submission` port, a common alternative that uses STARTTLS instead_).
+to port 587 (_the `submission` port, a common alternative that uses StartTLS instead_).
 
-[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#port
+[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#address
 [cleartext]: https://cwe.mitre.org/data/definitions/312.html
 [service-submissions]: https://datatracker.ietf.org/doc/html/rfc8314#section-7.3
 [port-465]: https://datatracker.ietf.org/doc/html/rfc8314#section-3.3

docs/content/en/reference/guides/passwords.md

@@ -26,30 +26,31 @@ The format of the [YAML] file is as follows:
 users:
   john:
     disabled: false
-    displayname: "John Doe"
+    displayname: 'John Doe'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: john.doe@authelia.com
+    email: 'john.doe@authelia.com'
     groups:
-      - admins
+      - 'admins'
-      - dev
+      - 'dev'
   harry:
     disabled: false
-    displayname: "Harry Potter"
+    displayname: 'Harry Potter'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: harry.potter@authelia.com
+    email: 'harry.potter@authelia.com'
     groups: []
   bob:
     disabled: false
-    displayname: "Bob Dylan"
+    displayname: 'Bob Dylan'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: bob.dylan@authelia.com
+    email: 'bob.dylan@authelia.com'
     groups:
-      - dev
+      - 'dev'
   james:
     disabled: false
-    displayname: "James Dean"
+    displayname: 'James Dean'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: james.dean@authelia.com
+    email: 'james.dean@authelia.com'
+    groups: []
 ```
 
 ## Passwords

docs/content/en/reference/guides/troubleshooting.md

@@ -2,7 +2,7 @@
 title: "Troubleshooting"
 description: "This guide describes and helps users provide information during troubleshooting including sanitization etc"
 lead: "This guide describes and helps users provide troubleshooting information."
-date: 2023-05-01T11:30:07+10:00
+date: 2023-05-01T12:36:02+10:00
 draft: false
 images: []
 menu:

docs/content/en/reference/integrations/time-based-one-time-password-apps.md

@@ -0,0 +1,25 @@
+---
+title: "Time-based OTP Applications"
+description: "A Time-based OTP Application integration reference guide"
+lead: "This section contains a Time-based OTP Application integration reference guide for Authelia."
+date: 2023-05-07T17:52:47+10:00
+draft: false
+images: []
+menu:
+  reference:
+    parent: "integrations"
+weight: 320
+toc: true
+---
+
+## Settings
+
+Authelia allows for a wide variety of time-based OTP settings. There are several applications which can support these
+algorithms and this matrix is a guide on applications that have been tested that work. It should not be assumed if an
+application is on this list that the information is correct for the current version of a product and it's likely they
+may now support some that were not previously supported, or in rare cases they may support less than they previously
+did.
+
+{{< table-totp-support >}}
+
+

docs/content/en/roadmap/active/openid-connect.md

@@ -115,8 +115,15 @@ Feature List:
 
 {{< roadmap-status stage="in-progress" version="v4.38.0" >}}
 
-* [OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126)
+* [RFC9126: OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126)
+* [RFC7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://datatracker.ietf.org/doc/html/rfc7523):
+  * Client Auth Method `client_secret_jwt`
+  * Client Auth Method `private_key_jwt`
 * Per-Client [Proof Key Code Exchange (PKCE)] Policy
+* Multiple Issuer JWKs:
+  * RS256, RS384, RS512
+  * PS256, PS384, PS512
+  * ES256, ES384, ES512
 
 ### Beta 7
 

docs/data/support.json

@@ -0,0 +1,12 @@
+{
+  "totp": [
+    {"name": "Google Authenticator", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US&pli=1"},
+    {"name": "Bitwarden", "clear": true, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://bitwarden.com/"},
+    {"name": "Yubico Authenticator", "clear": true, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": true}, "url": "https://www.yubico.com/products/yubico-authenticator/"},
+    {"name": "Authenticator Plus", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://www.authenticatorplus.com/"},
+    {"name": "1Password", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://1password.com/"},
+    {"name": "Ravio", "clear": false, "algorithms": {"SHA1": true, "SHA256": true, "SHA512": false}, "digits": {"six": true, "eight": false}, "url": "https://raivo-otp.com/"},
+    {"name": "Authy", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": false}, "digits": {"six": false, "eight": true}, "url": "https://authy.com/"},
+    {"name": "Aegis", "clear": false, "algorithms": {"SHA1": true, "SHA256": false, "SHA512": true}, "digits": {"six": true, "eight": true}, "url": "https://getaegis.app/"}
+  ]
+}

docs/i18n/en.yaml

@@ -1,19 +1,19 @@
 ---
-- id: get-started
+- id: 'get-started'
-  translation: "Get Started"
+  translation: 'Get Started'
 
-- id: on-this-page
+- id: 'on-this-page'
-  translation: "On this page"
+  translation: 'On this page'
 
-- id: search-text
+- id: 'search-text'
-  translation: "Search..."
+  translation: 'Search...'
 
-- id: 404-title
+- id: '404-title'
-  translation: "Page not found :("
+  translation: 'Page not found :('
 
-- id: 404-text
+- id: '404-text'
   translation: "The page you are looking for doesn't exist or has been moved. If you followed a link to get to this page please report it if it was on this site, the official GitHub repository, or the logs on the latest version."  # yamllint disable-line rule:line-length
 
-- id: browse
+- id: 'browse'
-  translation: "Browse"
+  translation: 'Browse'
 ...

docs/layouts/shortcodes/oidc-common.html

@@ -1,4 +1,4 @@
-{{ $faq := "../frequently-asked-questions/" }}{{ $config := "../../../configuration/identity-providers/open-id-connect.md" }}
+{{ $faq := "../frequently-asked-questions/" }}{{ $config := "../../../configuration/identity-providers/openid-connect/" }}
 {{- with .Get "faq" }}{{ $faq = . }}{{ end }}
 {{- with .Get "config" }}{{ $config = . }}{{ end }}
 ### Common Notes
@@ -15,4 +15,6 @@
        guaranteed to be supported in the future. See the [Plaintext]({{ $faq }}#plaintext) guide for more
        information.
 3. The Configuration example for Authelia is only a portion of the required configuration and it should be used as a
-   guide in conjunction with the standard [OpenID Connect 1.0 Configuration]({{ $config }}) guide.
+   guide in conjunction with the standard
+   [OpenID Connect 1.0 Provider Configuration]({{ printf "%s/provider.md" $config }}) and
+   [OpenID Connect 1.0 Clients Configuration]({{ printf "%s/clients.md" $config }}) guides.

docs/layouts/shortcodes/table-totp-support.html

@@ -0,0 +1,28 @@
+<table class="table table-hover">
+  <thead>
+  <tr>
+    <th style="text-align: center;" rowspan="2">Application</th>
+    <th style="text-align: center;" colspan="3" class="border-end">Algorithm</th>
+    <th style="text-align: center;" colspan="2">Digits</th>
+  </tr>
+  <tr>
+    <th style="text-align: center;">SHA1</th>
+    <th style="text-align: center;">SHA256</th>
+    <th style="text-align: center;" class="border-end">SHA512</th>
+    <th style="text-align: center;">6</th>
+    <th style="text-align: center;">8</th>
+  </tr>
+  </thead>
+  <tbody>
+  {{- range $.Site.Data.support.totp }}
+  <tr>
+    <td style="text-align: center;"><a href="{{ .url }}" target="_blank">{{ .name }}</a></td>
+    <td style="text-align: center;"><i class="{{ cond .algorithms.SHA1 "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .algorithms.SHA1 "" "Not " }}Supported"></i></td>
+    <td style="text-align: center;"><i class="{{ cond .algorithms.SHA256 "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .algorithms.SHA256 "" "Not " }}Supported"></i></td>
+    <td style="text-align: center;" class="border-end"><i class="{{ cond .algorithms.SHA512 "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .algorithms.SHA512 "" "Not " }}Supported"></i></td>
+    <td style="text-align: center;"><i class="{{ cond .digits.six "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .digits.six "" "Not " }}Supported"></i></td>
+    <td style="text-align: center;"><i class="{{ cond .digits.eight "icon-support-full" "icon-support-none" }}" data-toggle="tooltip" data-placement="top" title="{{ cond .digits.eight "" "Not " }}Supported"></i></td>
+  </tr>
+  {{- end }}
+  </tbody>
+</table>

entrypoint.sh

@@ -1,5 +1,7 @@
 #!/bin/sh
 
+[[ ! -z ${UMASK} ]] && umask ${UMASK}
+
 if [[ ! -z ${1} ]] && [[ ${1} != "--config" ]]; then
   exec "$@"
 elif [[ $(id -u) != 0 ]] || [[ $(id -g) != 0 ]]; then

examples/compose/lite/authelia/configuration.yml

@@ -8,8 +8,7 @@ jwt_secret: a_very_important_secret
 default_redirection_url: https://public.example.com
 
 server:
-  host: 0.0.0.0
+  address: 'tcp://:9091'
-  port: 9091
 
 log:
   level: debug

examples/compose/local/authelia/configuration.yml

@@ -7,8 +7,7 @@ jwt_secret: a_very_important_secret
 default_redirection_url: https://public.example.com
 
 server:
-  host: 0.0.0.0
+  address: 'tcp://:9091'
-  port: 9091
 
 log:
   level: debug

go.mod

@@ -7,13 +7,13 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/deckarep/golang-set/v2 v2.3.0
 	github.com/duosecurity/duo_api_golang v0.0.0-20230418202038-096d3306c029
-	github.com/fasthttp/router v1.4.18
+	github.com/fasthttp/router v1.4.19
-	github.com/fasthttp/session/v2 v2.4.17
+	github.com/fasthttp/session/v2 v2.5.0
 	github.com/fsnotify/fsnotify v1.6.0
 	github.com/go-asn1-ber/asn1-ber v1.5.4
 	github.com/go-crypt/crypt v0.2.7
-	github.com/go-ldap/ldap/v3 v3.4.4
+	github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835
-	github.com/go-rod/rod v0.112.9
+	github.com/go-rod/rod v0.113.0
 	github.com/go-sql-driver/mysql v1.7.1
 	github.com/go-webauthn/webauthn v0.8.2
 	github.com/golang-jwt/jwt/v4 v4.5.0
@@ -33,19 +33,19 @@ require (
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
 	github.com/ory/fosite v0.44.0
 	github.com/ory/herodot v0.10.2
-	github.com/ory/x v0.0.554
+	github.com/ory/x v0.0.555
 	github.com/otiai10/copy v1.11.0
 	github.com/pkg/errors v0.9.1
 	github.com/pquerna/otp v1.4.0
 	github.com/prometheus/client_golang v1.15.1
-	github.com/sirupsen/logrus v1.9.0
+	github.com/sirupsen/logrus v1.9.2
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.8.2
+	github.com/stretchr/testify v1.8.3
 	github.com/trustelem/zxcvbn v1.0.1
 	github.com/valyala/fasthttp v1.47.0
 	github.com/wneessen/go-mail v0.3.9
-	golang.org/x/net v0.9.0
+	golang.org/x/net v0.10.0
 	golang.org/x/sync v0.2.0
 	golang.org/x/term v0.8.0
 	golang.org/x/text v0.9.0
@@ -54,7 +54,7 @@ require (
 )
 
 require (
-	github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/andybalholm/brotli v1.0.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
@@ -83,7 +83,7 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
 	github.com/jandelgado/gcov2lcov v1.0.5 // indirect
-	github.com/klauspost/compress v1.16.3 // indirect
+	github.com/klauspost/compress v1.16.5 // indirect
 	github.com/knadh/koanf/maps v0.1.1 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/goveralls v0.0.11 // indirect
@@ -100,6 +100,7 @@ require (
 	github.com/prometheus/client_model v0.3.0 // indirect
 	github.com/prometheus/common v0.42.0 // indirect
 	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/redis/go-redis/v9 v9.0.4 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee // indirect
 	github.com/spf13/afero v1.9.5 // indirect
@@ -111,8 +112,9 @@ require (
 	github.com/tinylib/msgp v1.1.8 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/ysmood/fetchup v0.2.2 // indirect
+	github.com/ysmood/fetchup v0.2.3 // indirect
 	github.com/ysmood/goob v0.4.0 // indirect
+	github.com/ysmood/got v0.34.1 // indirect
 	github.com/ysmood/gson v0.7.3 // indirect
 	github.com/ysmood/leakless v0.8.0 // indirect
 	golang.org/x/crypto v0.7.0 // indirect

go.sum

@@ -36,8 +36,8 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft7pkxDf6WoUvEZJ/uOKsvtpjLnn8MU=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4 h1:vdT7QwBhJJEVNFMBNhRSFDRCB6O16T28VhvqRgqFyn8=
@@ -45,6 +45,8 @@ github.com/Gurpartap/logrus-stack v0.0.0-20170710170904-89c00d8a28f4/go.mod h1:S
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs=
 github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
@@ -56,6 +58,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/bsm/ginkgo/v2 v2.7.0 h1:ItPMPH90RbmZJt5GtkcNvIRuGEdwlBItdNVoyzaNQao=
+github.com/bsm/gomega v1.26.0 h1:LhQm+AFcgV2M0WyKroMASzAzCAJVpAxQXv4SaI9a69Y=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -112,10 +116,10 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojtoVVWjGfOF9635RETekkoH6Cc9SX0A=
 github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg=
-github.com/fasthttp/router v1.4.18 h1:elMnlFq527oZd8MHsuUpO6uLDup1exv8rXPfIjClDHk=
+github.com/fasthttp/router v1.4.19 h1:RLE539IU/S4kfb4MP56zgP0TIBU9kEg0ID9GpWO0vqk=
-github.com/fasthttp/router v1.4.18/go.mod h1:ZmC20Mn0VgCBbUWFDmnYzFbQYRfdGeKgpkBy0+JioKA=
+github.com/fasthttp/router v1.4.19/go.mod h1:+Fh3YOd8x1+he6ZS+d2iUDBH9MGGZ1xQFUor0DE9rKE=
-github.com/fasthttp/session/v2 v2.4.17 h1:jcS21Xoi1fE/4Ikz5Nm37x6FjpMUPnPQPVJWxKnQ8FE=
+github.com/fasthttp/session/v2 v2.5.0 h1:Vt+U2yKCmBxnEZ4v6rjEsO4YeTSaCpz/HPEI4DTN59M=
-github.com/fasthttp/session/v2 v2.4.17/go.mod h1:+pr8HLEQp6h9X70KLBY/Y4NrdJR2ts7VERydkMkiZaI=
+github.com/fasthttp/session/v2 v2.5.0/go.mod h1:gmUptI/jKL7qTfFtBHU3us36nv2Bm7U4jazt9pnBPLY=
 github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
@@ -134,14 +138,14 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
+github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 h1:XgBmN9yZXIh9vJGzs2qYPb5ee8/VnOWLHHYcKXGXKME=
-github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
+github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-rod/rod v0.112.9 h1:uA/yLbB+t0UlqJcLJtK2pZrCNPzd15dOKRUEOnmnt9k=
+github.com/go-rod/rod v0.113.0 h1:E7+GLjYVZnScewIB2u8+66joQLaDGbOLzSOT4orNHms=
-github.com/go-rod/rod v0.112.9/go.mod h1:l0or0gEnZ7E5C0L/W7iD+yXBnm/OM3avP1ji74k8N9s=
+github.com/go-rod/rod v0.113.0/go.mod h1:aiedSEFg5DwG/fnNbUOTPMTTWX3MRj6vIs/a684Mthw=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
 github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
@@ -264,8 +268,8 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.16.3 h1:XuJt9zzcnaz6a16/OU53ZjWp/v7/42WcR5t2a0PcNQY=
+github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
-github.com/klauspost/compress v1.16.3/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs=
 github.com/knadh/koanf/maps v0.1.1/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
 github.com/knadh/koanf/parsers/yaml v0.1.0 h1:ZZ8/iGfRLvKSaMEECEBPM1HQslrZADk8fP1XFUxVI5w=
@@ -289,7 +293,7 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
@@ -327,8 +331,8 @@ github.com/ory/go-convenience v0.1.0 h1:zouLKfF2GoSGnJwGq+PE/nJAE6dj2Zj5QlTgmMTs
 github.com/ory/go-convenience v0.1.0/go.mod h1:uEY/a60PL5c12nYz4V5cHY03IBmwIAEm8TWB0yn9KNs=
 github.com/ory/herodot v0.10.2 h1:gGvNMHgAwWzdP/eo+roSiT5CGssygHSjDU7MSQNlJ4E=
 github.com/ory/herodot v0.10.2/go.mod h1:MMNmY6MG1uB6fnXYFaHoqdV23DTWctlPsmRCeq/2+wc=
-github.com/ory/x v0.0.554 h1:w4GQ74uZpxEzKSeIfKBRIiX4LHrAS3zuEexdKyRtBaE=
+github.com/ory/x v0.0.555 h1:Etg6yUnrXP5YVTlpgipRh+hDLMavldbTURj+Mb0kdIY=
-github.com/ory/x v0.0.554/go.mod h1:oRVemI3SQQOLvOCJWIRinHQKlgmay/NbwSyRUIsS/Yk=
+github.com/ory/x v0.0.555/go.mod h1:oRVemI3SQQOLvOCJWIRinHQKlgmay/NbwSyRUIsS/Yk=
 github.com/otiai10/copy v1.11.0 h1:OKBD80J/mLBrwnzXqGtFCzprFSGioo30JcmR4APsNwc=
 github.com/otiai10/copy v1.11.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww=
 github.com/otiai10/mint v1.5.1 h1:XaPLeE+9vGbuyEHem1JNk3bYc7KKqyI/na0/mLd/Kks=
@@ -368,6 +372,8 @@ github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7z
 github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
 github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/redis/go-redis/v9 v9.0.4 h1:FC82T+CHJ/Q/PdyLW++GeCO+Ol59Y4T7R4jbgjvktgc=
+github.com/redis/go-redis/v9 v9.0.4/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
@@ -379,8 +385,8 @@ github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee h1:8Iv5m6xEo1NR1Avp
 github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee/go.mod h1:qwtSXrKuJh/zsFQ12yEE89xfCrGKK63Rr7ctU/uCo4g=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.2 h1:oxx1eChJGI6Uks2ZC4W1zpLlVgqB8ner4EuQwV4Ik1Y=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.2/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
@@ -413,11 +419,10 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/test-go/testify v1.1.4 h1:Tf9lntrKUMHiXQ07qBScBTSA0dhYQlu83hswqelv1iE=
@@ -439,8 +444,8 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/ysmood/fetchup v0.2.2 h1:Qn8/q5uDW7szclt4sVXCFJ1TXup3hogz94OaLf6kloo=
+github.com/ysmood/fetchup v0.2.3 h1:ulX+SonA0Vma5zUFXtv52Kzip/xe7aj4vqT5AJwQ+ZQ=
-github.com/ysmood/fetchup v0.2.2/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
+github.com/ysmood/fetchup v0.2.3/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
 github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ=
 github.com/ysmood/goob v0.4.0/go.mod h1:u6yx7ZhS4Exf2MwciFr6nIM8knHQIE22lFpWHnfql18=
 github.com/ysmood/gop v0.0.2 h1:VuWweTmXK+zedLqYufJdh3PlxDNBOfFHjIZlPT2T5nw=
@@ -478,7 +483,6 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
@@ -518,6 +522,7 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
 golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -558,8 +563,10 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -634,11 +641,15 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -650,6 +661,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -707,6 +720,7 @@ golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=
 golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

internal/authentication/const_test.go

@@ -0,0 +1,24 @@
+package authentication
+
+import (
+	"github.com/authelia/authelia/v4/internal/configuration/schema"
+)
+
+const (
+	testLDAPURL  = "ldap://127.0.0.1:389"
+	testLDAPSURL = "ldaps://127.0.0.1:389"
+)
+
+var (
+	testLDAPAddress  = MustParseAddress(testLDAPURL)
+	testLDAPSAddress = MustParseAddress(testLDAPSURL)
+)
+
+func MustParseAddress(input string) *schema.AddressLDAP {
+	address, err := schema.NewAddress(input)
+	if err != nil {
+		panic(err)
+	}
+
+	return &schema.AddressLDAP{Address: *address}
+}

internal/authentication/ldap_client_mock.go

@@ -65,9 +65,11 @@ func (mr *MockLDAPClientMockRecorder) Bind(arg0, arg1 interface{}) *gomock.Call
 }
 
 // Close mocks base method.
-func (m *MockLDAPClient) Close() {
+func (m *MockLDAPClient) Close() error {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Close")
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
 }
 
 // Close indicates an expected call of Close.
@@ -334,18 +336,6 @@ func (mr *MockLDAPClientMockRecorder) SimpleBind(arg0 interface{}) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SimpleBind", reflect.TypeOf((*MockLDAPClient)(nil).SimpleBind), arg0)
 }
 
-// Start mocks base method.
-func (m *MockLDAPClient) Start() {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Start")
-}
-
-// Start indicates an expected call of Start.
-func (mr *MockLDAPClientMockRecorder) Start() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Start", reflect.TypeOf((*MockLDAPClient)(nil).Start))
-}
-
 // StartTLS mocks base method.
 func (m *MockLDAPClient) StartTLS(arg0 *tls.Config) error {
 	m.ctrl.T.Helper()