0c0e19c138
docs: add openid offline_access scope ( #3611 )
...
Adds this scope to the docs.
Closes #3607
2022-06-28 10:25:36 +10:00
fcac438637
feat(commands): enhance crypto generation capabilities ( #2842 )
...
This expands the functionality of the certificates and rsa commands and merges them into one command called cypto which can either use the cert or pair subcommands to generate certificates or key-pairs respectively. The rsa, ecdsa, and ed25519 subcommands exist for both the cert and pair commands. A new --ca-path argument for the cert subcommand allows Authelia to sign other certs with CA certs.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-06-27 18:27:57 +10:00
d6e58933e9
docs: fix frame-src ( #3593 )
...
* docs: fix frame-src
* docs: fix frame-src
2022-06-25 20:58:04 +10:00
ee86aad0ec
docs: fix skipper docs ( #3585 )
2022-06-24 12:42:27 +10:00
2ccdf6933c
docs: fix k8s yaml ( #3575 )
2022-06-22 23:25:10 +10:00
e2e1d6d30b
docs: update integration guides to reference get started ( #3573 )
2022-06-22 22:58:23 +10:00
1dbca52cab
docs: fix clipboard ( #3568 )
2022-06-22 07:57:51 +10:00
095ebae7a0
docs: update caddy example ( #3566 )
2022-06-21 21:27:48 +10:00
b102ebb6bb
docs: improve secrets documentation ( #3565 )
...
Improve documentation around secrets.
2022-06-21 19:45:08 +10:00
bcaaec834b
docs: adjust branding usage ( #3550 )
2022-06-20 18:13:49 +10:00
3d027ba1e0
docs(deps): sync ( #3551 )
2022-06-20 14:40:40 +10:00
fcf40b134d
docs: add branding reference guide ( #3549 )
...
This adds official branding in PSD/SVG/PNG format and a guide on requested usage.
Closes #3484 .
2022-06-20 10:05:55 +10:00
25b5c1ee2e
feat(authentication): unauthenticated ldap bind ( #3291 )
...
This allows configuring unauthenticated LDAP binding.
2022-06-17 21:03:47 +10:00
4fb0f289d4
docs: fix open collective links ( #3532 )
...
* docs: restructure sponsors
* docs: fix misc issues
* docs: fix naming
2022-06-17 10:55:42 +10:00
dd1949b6e6
docs: make financial sponsors consistent ( #3530 )
2022-06-17 09:56:00 +10:00
43f03ad89a
docs: set blog date ( #3522 )
2022-06-15 18:14:43 +10:00
b2c60ef898
feat: major documentation refresh ( #3475 )
...
This marks the launch of the new documentation website.
2022-06-15 17:51:47 +10:00
46d84e46b0
feat(logging): allow time replacement in log file name ( #3330 )
...
* feat(logging): allow time replacement in log file name
This allows replacing `%d` with a date time format in the log `file_name` option.
Closes #3210 .
2022-06-06 09:50:10 +10:00
11543fd0bf
docs: escape handlebars ( #3462 )
2022-06-02 19:29:15 +10:00
2037a0ee4f
fix(commands): hash-password usage instructions ( #3437 )
...
This fixes the hash-password usage instructions and ensures it uses mostly a configuration source based config. In addition it updates our recommended argon2id parameters with the RFC recommendations.
2022-06-02 09:18:45 +10:00
e1d52d57e0
build(deps): bump nokogiri from 1.13.4 to 1.13.6 in /docs ( #3404 )
...
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri ) from 1.13.4 to 1.13.6.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases )
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md )
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.4...v1.13.6 )
---
updated-dependencies:
- dependency-name: nokogiri
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-05-20 09:28:26 +10:00
2800e1436c
docs: add crowdin ( #3381 )
2022-05-16 13:42:58 +10:00
28626113b7
ci: crowdin commit lint etc ( #3372 )
2022-05-16 10:54:31 +10:00
ee7b304f66
docs: fix missing backtick in file authentication docs ( #3348 )
...
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-05-12 09:44:37 +10:00
0f9c79e80a
docs: add sql supported version info ( #3334 )
2022-05-10 13:41:07 +10:00
45df1ec7d0
docs: fix missing format char ( #3318 )
2022-05-07 14:24:28 +10:00
1060bcee06
docs: caddy integration ( #3307 )
...
This adds docs on integration with Caddy.
Closes #1241
2022-05-07 09:18:28 +10:00
dde80dda29
docs: update portainer missing scopes ( #3313 )
2022-05-06 23:16:08 +10:00
0855ea2f71
fix(server): missing cache and xss headers ( #3289 )
...
Addresses documentation and a couple of headers which were missed.
2022-05-04 14:47:23 +10:00
c7d992f341
fix(authentication): follow ldap referrals ( #3251 )
...
This ensures we are able to follow referrals for LDAP password modify operations when permit_referrals is true.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-05-02 11:51:38 +10:00
555746e771
refactor: exclude id from sqlite3 migration ( #3242 )
...
* refactor: exclude id from sqlite3 table recreate
* docs: add migration docs
2022-04-25 21:11:56 +10:00
52727f9d2c
build(deps): bump nokogiri from 1.13.3 to 1.13.4 in /docs ( #3168 )
...
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri ) from 1.13.3 to 1.13.4.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases )
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/v1.13.4/CHANGELOG.md )
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.3...v1.13.4 )
---
updated-dependencies:
- dependency-name: nokogiri
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-04-19 16:33:11 +10:00
e99fb7a08f
feat(configuration): configurable default second factor method ( #3081 )
...
This allows configuring the default second factor method.
2022-04-18 09:58:24 +10:00
de6d1698be
docs: update portainer ce and ee ( #3202 )
...
This adds some additional docs to Portainer docs specifically around Portainer EE.
Closes #3203
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-16 13:35:01 +10:00
4710de33a4
refactor(configuration): remove ptr for duoapi and notifier ( #3200 )
...
This adds to the ongoing effort to remove all pointers to structs in the configuration without breaking backwards compatibility.
2022-04-16 09:34:26 +10:00
92aba8eb0b
feat(server): zxcvbn password policy server side ( #3151 )
...
This is so the zxcvbn ppolicy is checked on the server.
2022-04-15 19:30:51 +10:00
71511a5c4f
docs: fix typo ( #3191 )
...
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-15 10:43:04 +10:00
e7112bfbd6
feat(oidc): client id claims ( #3150 )
...
Adds the authorized party (azp) and client_id registered claims to ID Tokens.
2022-04-09 16:55:24 +10:00
66a450ed38
feat(oidc): pre-configured consent ( #3118 )
...
Allows users to pre-configure consent if enabled by the client configuration by selecting a checkbox during consent.
Closes #2598
2022-04-08 15:35:21 +10:00
4503ac07be
fix(web): lowercase locales are not consistent with localization platforms ( #3141 )
...
This fixes an issue with localization platforms and the docs regarding localization, and the forcing locale names to lowercase.
2022-04-08 14:53:46 +10:00
2da50f6128
docs: add k8s important notes ( #3140 )
...
Add some implementation notes about k8s.
Fixes #2882
2022-04-08 14:15:35 +10:00
5f51dcdb51
docs: fix missing backtick ( #3136 )
...
Fix formatting error introduced in #3131
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-08 09:33:14 +10:00
9b6bcca1ba
feat(totp): secret customization ( #2681 )
...
Allow customizing the shared secrets size specifically for apps which don't support 256bit shared secrets.
2022-04-08 09:01:01 +10:00
efccf77c10
docs(oidc): seafile integration example ( #3131 )
...
- Adds description and callback URL for the Seafile file server.
- Orders the entries in the two OIDC integration tables by name.
2022-04-08 07:11:43 +10:00
ad84c8c33e
feat(oidc): opaque subject identifiers ( #3129 )
...
This is a meta commit for a feature originally implemented in 0a970aef8ahttps://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes . Relying parties which utilize the subject identifier / sub claim may need manual intervention in order to relink accounts. Users who have issues will have to consult with the documentation of their individual relying parties in order to relink accounts. Users who utilized the subject identifier as a means to provision their users are also encouraged to utilize the preferred_username claim from the profile scope.
2022-04-07 17:35:54 +10:00
8bb8207808
feat(oidc): pairwise subject identifiers ( #3116 )
...
Allows configuring clients with a sector identifier to allow pairwise subject types.
2022-04-07 16:13:01 +10:00
0a970aef8a
feat(oidc): persistent storage ( #2965 )
...
This moves the OpenID Connect storage from memory into the SQL storage, making it persistent and allowing it to be used with clustered deployments like the rest of Authelia.
2022-04-07 15:33:53 +10:00
06fd7105ea
refactor(templates): utilize more accurate naming ( #3125 )
2022-04-07 13:05:20 +10:00
4ebd8fdf4e
feat(oidc): provide cors config including options handlers ( #3005 )
...
This adjusts the CORS headers appropriately for OpenID Connect. This includes responding to OPTIONS requests appropriately. Currently this is only configured to operate when the Origin scheme is HTTPS; but can easily be expanded in the future to include additional Origins.
2022-04-07 10:58:51 +10:00
3ca438e3d5
feat: implement mutual tls in the web server ( #3065 )
...
Mutual TLS helps prevent untrusted clients communicating with services like Authelia. This can be utilized to reduce the attack surface.
Fixes #3041
2022-04-05 09:57:47 +10:00
a2eb0316c8
feat(web): password reset custom url ( #3111 )
...
This allows providing a custom URL for password resets. If provided the disable_reset_password option is ignored, the password reset API is disabled, and the button provided in the UI to reset the password redirects users to the configured endpoint.
Closes #1934 , Closes #2854
Co-authored-by: you1996 <youssri@flyweight.tech>
2022-04-04 17:46:55 +10:00
aac4c4772c
feat(web): i18n asset overrides ( #3040 )
...
This allows overriding translation files in folders with lowercase RFC5646 / BCP47 Format language codes. This also fixes an issues where languages which don't expressly match the language code specified due to having a variant will also match the existing codes.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-04-04 12:15:26 +10:00
bfd5d66ed8
feat(notification): password reset notification custom templates ( #2828 )
...
Implemented a system to allow overriding email templates, including the remote IP, and sending email notifications when the password was reset successfully.
Closes #2755 , Closes #2756
Co-authored-by: Manuel Nuñez <@mind-ar>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-03 22:24:51 +10:00
9e05066097
refactor(handlers): ppolicy ( #3103 )
...
Add tests and makes the password policy a provider so the configuration can be loaded to memory on startup.
2022-04-03 21:58:27 +10:00
36cf662458
refactor: misc password policy refactoring ( #3102 )
...
Add tests and makes the password policy a provider so the configuration can be loaded to memory on startup.
2022-04-03 10:48:26 +10:00
8659ba394d
feat(authentication): password policy ( #2723 )
...
Implement a password policy with visual feedback in the web portal.
Co-authored-by: Manuel Nuñez <@mind-ar>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-03 08:32:57 +10:00
cd2d88f9f3
docs: add oidc details for miniflux app ( #3096 )
...
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-02 17:28:48 +11:00
4d7f930e74
docs: fix regex examples ( #3094 )
2022-04-02 16:41:16 +11:00
ce69cb2414
docs: fix oidc applications table display ( #3088 )
2022-04-02 15:09:47 +11:00
3c1bb3ec19
feat(authorization): domain regex match with named groups ( #2789 )
...
This adds an option to match domains by regex including two special named matching groups. User matches the username of the user, and Group matches the groups a user is a member of. These are both case-insensitive and you can see examples in the docs.
2022-04-01 22:38:49 +11:00
0116506330
feat(oidc): implement amr claim ( #2969 )
...
This adds the amr claim which stores methods used to authenticate with Authelia by the users session.
2022-04-01 22:18:58 +11:00
b2d35d88ec
feat(configuration): allow rfc4918 http verbs in acl ( #2988 )
...
This allows the HTTP Method verbs from RFC4918 to be used. See https://datatracker.ietf.org/doc/html/rfc4918 for more information.
2022-04-01 21:53:10 +11:00
f65643caff
docs: fix missing single quote ( #3029 )
2022-03-17 16:29:43 +11:00
d393d80aee
docs: adjust acl policy example to be possible ( #3008 )
...
An access control policy with a policy of bypass and subjects is not configurable, this addresses an example in the docs which shows this misconfiguration erroneously.
Fixes #3006
2022-03-14 23:30:47 +11:00
1e549caf15
Small description fix for OIDC groups ( #3007 )
...
OIDC groups claim actually contains the user's groups, not the user's display name.
2022-03-14 23:26:10 +11:00
5af58c7df1
docs(oidc): add subject storage to storage beta ( #2987 )
2022-03-10 09:19:15 +11:00
337dd61468
docs: add docs about remember me duration ( #2979 )
...
This documents disabling remember me.
2022-03-09 13:25:11 +11:00
6d937cf6cc
refactor(model): rename from models ( #2968 )
2022-03-06 16:47:40 +11:00
7e59df6f7f
docs: updated year ( #2963 )
...
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-03-06 11:06:09 +11:00
03cf92ff48
docs: fix misleading config ( #2966 )
2022-03-06 10:15:55 +11:00
204cef4d03
fix(storage): webauthn kid too short for some devices ( #2957 )
...
This fixes an issue that may cause the kid length of a webauthn device to exceed that length allowed by the database column.
2022-03-04 21:21:08 +11:00
c9d86a9240
feat(oidc): oauth2 discovery support ( #2925 )
...
* feat(oidc): oauth2 discovery and endpoint rename
This implements the oauth2 authorization server discovery document, adds tests to the discovery documents, implements an efficiency upgrade to these docs, and renames some endpoints to be uniform.
2022-03-04 14:09:27 +11:00
8f05846e21
feat: webauthn ( #2707 )
...
This implements Webauthn. Old devices can be used to authenticate via the appid compatibility layer which should be automatic. New devices will be registered via Webauthn, and devices which do not support FIDO2 will no longer be able to be registered. At this time it does not fully support multiple devices (backend does, frontend doesn't allow registration of additional devices). Does not support passwordless.
2022-03-03 22:20:43 +11:00
6276883f04
refactor(configuration): utilize time duration decode hook ( #2938 )
...
This enhances the existing time.Duration parser to allow multiple units, and implements a decode hook which can be used by koanf to decode string/integers into time.Durations as applicable.
2022-03-02 17:40:26 +11:00
6ef6d0499a
feat(oidc): add pkce support ( #2924 )
...
Implements Proof Key for Code Exchange for OpenID Connect Authorization Code Flow. By default this is enabled for the public client type and requires the S256 challenge method.
Closes #2921
2022-03-02 15:44:05 +11:00
decc4fd05e
docs: fix missing link ( #2934 )
2022-03-01 16:06:17 +11:00
1eef78ff7b
docs: move oidc roadmap ( #2933 )
2022-03-01 16:00:27 +11:00
c479ba6386
fix(oidc): make preferred_username a profile scope claim ( #2930 )
...
This corrects an issue with the preferred_username which should be part of the profile scope as per https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims .
Introduced in ddbb21a#2829
2022-03-01 14:07:39 +11:00
3c81e75d79
feat(commands): add access-control check-policy command ( #2871 )
...
This adds an access-control command that checks the policy enforcement for a given criteria using a configuration file and refactors the configuration validation command to include all configuration sources.
2022-02-28 14:15:01 +11:00
5ff2323a7f
build(deps): bump nokogiri from 1.12.5 to 1.13.3 in /docs ( #2919 )
...
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri ) from 1.12.5 to 1.13.3.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases )
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md )
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.5...v1.13.3 )
---
updated-dependencies:
- dependency-name: nokogiri
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-02-27 15:19:10 +11:00
bed7a8ae32
feat(server): csp template ( #2856 )
...
Implements the ability for advanced users to override the CSP and easily include the required nonce.
2022-02-21 10:14:09 +11:00
6043b43d94
docs: fix roadmap item about oidc ( #2885 )
2022-02-21 08:50:20 +11:00
64adb9eb67
docs: update roadmap with new priorities based on feedbacks ( #2878 )
2022-02-18 22:35:22 +11:00
50e9ccafa1
docs: fix grammar ( #2863 )
...
Remove the gender specific examples for `default_redirection_url`
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-02-17 13:26:17 +11:00
096946bcb7
docs: add OIDC integration details about Harbor and Verdaccio ( #2867 )
...
Added Harbor (docker/helm open source registry) and verdaccio (open source NPM proxy registry)
2022-02-13 10:05:38 +01:00
ddbb21af90
fix(handlers): include preferred_username claim in meta ( #2829 )
...
This includes the preferred_username claim in the meta. Also uses the consts for all the applicable claims and scopes.
2022-02-10 09:55:28 +11:00
100d598a0e
docs: add documentation about the logout endpoint ( #2860 )
...
fix #2859
2022-02-10 09:10:35 +11:00
8fc48476c6
docs: add community example of integrating authelia with Django ( #2858 )
...
Extend the information given at #2636 about how to integrate
authelia with Django.
2022-02-09 21:50:34 +01:00
b6cffaaf50
docs: added example configs for oidc for specific services (portainer, proxmox) ( #2831 )
...
Co-authored-by: Clément Michaud <clement.michaud34@gmail.com>
2022-02-08 00:05:10 +01:00
5dd0cfb8c7
docs: add Bookstack to list of community-tested OIDC integrations ( #2849 )
...
Co-authored-by: Clément Michaud <clement.michaud34@gmail.com>
2022-02-07 22:08:48 +01:00
fcdd41ea2a
feat: oidc scope i18n ( #2799 )
...
This adds i18n for the OIDC scope descriptsions descriptions.
2022-02-08 01:18:16 +11:00
7775d2af0e
fix(ntp): disable failure ignored ( #2835 )
...
Disable failure was ignored previously, this ensures it isn't.
2022-02-03 14:04:24 +11:00
e59f571816
refactor(oidc): add client id to two factor log message ( #2816 )
...
Adds the client id to a log message where it's likely useful. Additionally adds beta stage for prompt/display handling.
2022-01-21 14:15:50 +11:00
06641cd15a
fix(oidc): add preferred username claim ( #2801 )
...
This adds the missing preferred username claim to the ID Token for OIDC.
Fixes #2798
2022-01-18 20:32:06 +11:00
8507195240
docs: add annotations for nginx ingress to k8s doc ( #2726 )
2021-12-17 09:11:36 +11:00
f05f9cf12a
docs: add link to migrations page from faq ( #2686 )
2021-12-09 18:44:40 +11:00
c1c980f107
docs: update matrix links ( #2675 )
...
This updates our matrix links to use the new Authelia homeserver.
2021-12-04 15:50:31 +11:00
255aaeb2ad
feat(storage): encrypt u2f key ( #2664 )
...
Adds encryption to the U2F public keys. While the public keys cannot be used to authenticate, only to validate someone is authenticated, if a rogue operator changed these in the database they may be able to bypass 2FA. This prevents that.
2021-12-03 11:04:11 +11:00
104a61ecd6
refactor(web): only fetch totp conf if required ( #2663 )
...
Prevents the TOTP user config from being requested when the user has not registered or is already authenticated 2FA.
2021-12-02 21:28:16 +11:00
f0119b5c75
docs: update fail2ban example ( #2661 )
...
Updates the fail2ban examples to align with new messages.
Fixes #2649 .
2021-12-02 17:09:47 +11:00
James Elliott
dependabot[bot]
Zhao Xiang Lim
Amir Zarrinkafsh
Helvio Pedreschi
Lorenz Schmid
Clément Michaud
Manuel Nuñez
bgh-github
Alestrix
Dennis Gaida
thehedgefrog
Andrew Moore
James White
Karlos
Biel Frontera
Dylan Drost
Michael Shamoon
Patrick Ruckstuhl
Shadow