71c47c7344
i18n: update sv translation of portal.json ( #3430 )
...
Correct a few issues in the Swedish translation files.
2022-05-25 21:28:40 +10:00
aa5bee68f7
i18n: update translations ( #3425 )
2022-05-25 12:46:47 +10:00
d436b800bb
build(deps): update dependency mariadb to v10.8.3 ( #3419 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-05-25 10:23:40 +10:00
a2a0c99db3
build(deps): update dependency traefik to v2.7.0 ( #3427 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-05-25 08:44:44 +10:00
77ac770585
i18n: update translations ( #3399 )
2022-05-24 22:07:24 +10:00
40bfef9aaa
i18n: add sv translation for portal.json ( #3421 )
2022-05-24 21:48:02 +10:00
5b9a40d46a
build(deps): update dependency alpine to v3.16.0 ( #3420 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-05-24 12:04:54 +10:00
2e1bfaa7db
i18n: fix ru translation ( #3384 )
...
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-05-18 15:09:23 +10:00
9cf9aae20b
build(deps): update dependency haproxy to v2.5.7 ( #3397 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-05-18 14:43:24 +10:00
5dacdd1278
i18n: add ru translation for portal.json ( #3367 )
2022-05-16 11:19:28 +10:00
c427b8f920
fix(authentication): err when user/display name same ldap attribute ( #3364 )
...
This fixes an issue when both the username and display name attributes are the same. If the username attribute is the same as the display name attribute previously we only set the display name profile value which is incorrect. We should set the username profile value instead and allow the display name to be blank.
2022-05-15 16:37:23 +10:00
1bd862a814
build(deps): update dependency golang to v1.18.2 ( #3345 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-05-11 10:23:48 +10:00
150e54c3ae
fix(authentication): utilize msad password history control ( #3256 )
...
This fixes an issue where the Microsoft Active Directory Server Policy Hints control was not being used to prevent avoidance of the PSO / FGPP applicable to the user.
2022-05-10 14:38:36 +10:00
a7106ad7e9
fix(handler): missing notification values ( #3321 )
...
This ensures all template types share the same template values and display them correctly regardless if text/html/other.
Fixes #3319 .
2022-05-09 08:43:12 +10:00
bda87db79c
test(suites): caddy ( #3305 )
2022-05-07 11:55:52 +10:00
0855ea2f71
fix(server): missing cache and xss headers ( #3289 )
...
Addresses documentation and a couple of headers which were missed.
2022-05-04 14:47:23 +10:00
cac8919f97
test: add redis restart test back to traefik2 suite ( #3298 )
...
* test: add redis restart test back to traefik2 suite
* refactor(suites): mustpress -> mustinput for totp
* refactor(suites): rename suites for test ordering
2022-05-04 11:01:36 +10:00
f8bb51da4d
build(deps): update dependency traefik to v2.6.6 ( #3296 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-05-04 09:29:51 +10:00
f88e7dd242
build(deps): update module github.com/go-rod/rod to v0.106.4 ( #3042 )
2022-05-03 22:37:56 +10:00
e6ad8fe83e
build(deps): update dependency golang to v1.18.1 ( #3019 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-05-03 19:35:44 +10:00
1db00717ee
fix(oidc): pre-conf consent skipped entirely for anon users ( #3250 )
...
This fixes an issue where pre-configured consent is entirely skipped if the process was initiated via an anonymous user.
2022-05-03 15:28:58 +10:00
556a115c83
fix(server): missing modern security headers ( #3288 )
...
This fixes an issue with missing modern security headers such as the X-Content-Type-Options, Referer-Policy, etc.
2022-05-03 12:19:30 +10:00
91c0c81818
refactor(suites): stop integration tests on first failure ( #3270 )
...
* refactor(suites): stop integration tests on first failure
* refactor(suites): remove additional nginx instance
* refactor(suites): log relevant containers
* refactor(suites): add traefik2 logs to stdout
* refactor(suites): explicitly enable traefik for tests
* refactor(suites): remove redis restart and duplicate pathprefix tests
* ci(buildkite): allow manual retry on integration tests
2022-05-02 14:50:37 +10:00
c7d992f341
fix(authentication): follow ldap referrals ( #3251 )
...
This ensures we are able to follow referrals for LDAP password modify operations when permit_referrals is true.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-05-02 11:51:38 +10:00
8ee92231ba
build(deps): update dependency haproxy to v2.5.6 ( #3255 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-04-27 16:12:44 +10:00
555746e771
refactor: exclude id from sqlite3 migration ( #3242 )
...
* refactor: exclude id from sqlite3 table recreate
* docs: add migration docs
2022-04-25 21:11:56 +10:00
06ba312c28
fix(commands): invalid opaque id service name ( #3235 )
...
This fixes the service type being openid_connect instead of openid as expected. This also allows bulk generating opaque identifiers for users.
2022-04-25 18:49:18 +10:00
861bcc898f
refactor: ensure bad consent sessions and identifiers are deleted ( #3241 )
2022-04-25 17:53:38 +10:00
abf1c86ab9
fix(oidc): subject generated for anonymous users ( #3238 )
...
Fix and issue that would prevent a correct ID Token from being generated for users who start off anonymous. This also avoids generating one in the first place for anonymous users.
2022-04-25 10:31:05 +10:00
b18eea039c
build(deps): update node.js to v18 ( #3225 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-04-21 18:28:35 +10:00
daaa16c182
refactor(suites): validate totp inputs ( #3218 )
...
This change validates the inputs for the TOTP code entry.
This was previously discarded and left unvalidated during the move to rod from within the integration tests.
2022-04-19 14:11:15 +10:00
92e219b34b
fix(suites): add missing traefik routes ( #3217 )
...
This change includes missing routes for both the Traefik and Traefik2 suites, issues would have manifested running dev mode tests for these suites when attempting to load translations.
2022-04-19 13:36:49 +10:00
e99fb7a08f
feat(configuration): configurable default second factor method ( #3081 )
...
This allows configuring the default second factor method.
2022-04-18 09:58:24 +10:00
e56690c2df
refactor(configuration): ensure all keys are validated ( #3208 )
...
This ensures keys that exist in slices are validated.
2022-04-16 20:48:07 +10:00
dc7ca6f03c
refactor: introduce config key gen ( #3206 )
...
This adjusts the validated keys to utilize a generated code section.
2022-04-16 19:00:39 +10:00
5aa25ec275
fix(configuration): missing valid keys ( #3207 )
...
This fixes an issue with three missing config keys.
2022-04-16 17:49:13 +10:00
4710de33a4
refactor(configuration): remove ptr for duoapi and notifier ( #3200 )
...
This adds to the ongoing effort to remove all pointers to structs in the configuration without breaking backwards compatibility.
2022-04-16 09:34:26 +10:00
92aba8eb0b
feat(server): zxcvbn password policy server side ( #3151 )
...
This is so the zxcvbn ppolicy is checked on the server.
2022-04-15 19:30:51 +10:00
c5cb36c526
build(deps): update dependency golang to v1.17.9 ( #3198 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-04-15 15:53:15 +10:00
6e0853a81b
build(deps): update dependency golang ( #3180 )
2022-04-13 14:28:31 +10:00
f97474f01b
fix(oidc): show detailed error reasons ( #3175 )
2022-04-12 21:39:15 +10:00
85a88de24d
test(oidc): fix disabled tests ( #3173 )
2022-04-12 13:02:12 +10:00
cf93e66391
test(suites): fix backend endpoints ( #3158 )
2022-04-10 08:05:27 +10:00
086b97d21f
test(suites): revert por binding ( #3155 )
...
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-10 07:44:47 +10:00
79935c7e2e
fix(server): locale format incorrect ( #3154 )
...
This fixes an issue where the locale would be formatted as en-en instead of en-US.
2022-04-09 21:38:17 +10:00
5a0a15f377
feat(commands): user opaque identifiers commands ( #3144 )
...
Add commands for handling user opaque identifiers.
2022-04-09 17:13:19 +10:00
e7112bfbd6
feat(oidc): client id claims ( #3150 )
...
Adds the authorized party (azp) and client_id registered claims to ID Tokens.
2022-04-09 16:55:24 +10:00
148ec1e2e0
fix(oidc): missing amr claim supported in discovery ( #3147 )
...
This adds the AMR claim to discovery.
2022-04-09 09:35:13 +10:00
9d5ac4526e
fix(configuration): remove unused password policy option ( #3149 )
...
Removes the min score option from the ZXCVBN policy and adds tests.
2022-04-09 09:21:49 +10:00
f9da940bfc
fix(web): description of profile scope is not accurate ( #3146 )
...
This adjusts the profile scope to be described as "Access your profile information" as it accesses more than the display name now.
2022-04-09 08:47:21 +10:00
44bd70712c
fix(configuration): sector identifier not parsed correctly ( #3142 )
...
This fixes an issue preventing the sector identifier for OpenID Connect clients from being parsed.
2022-04-08 17:38:38 +10:00
66a450ed38
feat(oidc): pre-configured consent ( #3118 )
...
Allows users to pre-configure consent if enabled by the client configuration by selecting a checkbox during consent.
Closes #2598
2022-04-08 15:35:21 +10:00
4503ac07be
fix(web): lowercase locales are not consistent with localization platforms ( #3141 )
...
This fixes an issue with localization platforms and the docs regarding localization, and the forcing locale names to lowercase.
2022-04-08 14:53:46 +10:00
ce6bf74c8d
fix(server): incorrect remote ip logged in error handler ( #3139 )
...
This fixes edge cases where the remote IP was not correctly logged. Generally this is not an issue as most errors do not hit this handler, but in instances where a transport error occurs this is important.
2022-04-08 14:13:47 +10:00
90edf11b88
feat(web): add user display name to oidc consent view ( #3138 )
...
This adds the current logged in users display name to the consent page as well as some other minor tweaks.
Closes #2595
2022-04-08 12:50:55 +10:00
9b6bcca1ba
feat(totp): secret customization ( #2681 )
...
Allow customizing the shared secrets size specifically for apps which don't support 256bit shared secrets.
2022-04-08 09:01:01 +10:00
8bb8207808
feat(oidc): pairwise subject identifiers ( #3116 )
...
Allows configuring clients with a sector identifier to allow pairwise subject types.
2022-04-07 16:13:01 +10:00
0a970aef8a
feat(oidc): persistent storage ( #2965 )
...
This moves the OpenID Connect storage from memory into the SQL storage, making it persistent and allowing it to be used with clustered deployments like the rest of Authelia.
2022-04-07 15:33:53 +10:00
06fd7105ea
refactor(templates): utilize more accurate naming ( #3125 )
2022-04-07 13:05:20 +10:00
4ebd8fdf4e
feat(oidc): provide cors config including options handlers ( #3005 )
...
This adjusts the CORS headers appropriately for OpenID Connect. This includes responding to OPTIONS requests appropriately. Currently this is only configured to operate when the Origin scheme is HTTPS; but can easily be expanded in the future to include additional Origins.
2022-04-07 10:58:51 +10:00
d96c93ef2b
build(deps): update module github.com/valyala/fasthttp to v1.35.0 ( #3120 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-06 07:57:23 +10:00
004490c7b1
build(deps): update dependency alpine to v3.15.4 ( #3114 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-04-05 11:15:43 +10:00
3ca438e3d5
feat: implement mutual tls in the web server ( #3065 )
...
Mutual TLS helps prevent untrusted clients communicating with services like Authelia. This can be utilized to reduce the attack surface.
Fixes #3041
2022-04-05 09:57:47 +10:00
a2eb0316c8
feat(web): password reset custom url ( #3111 )
...
This allows providing a custom URL for password resets. If provided the disable_reset_password option is ignored, the password reset API is disabled, and the button provided in the UI to reset the password redirects users to the configured endpoint.
Closes #1934 , Closes #2854
Co-authored-by: you1996 <youssri@flyweight.tech>
2022-04-04 17:46:55 +10:00
aac4c4772c
feat(web): i18n asset overrides ( #3040 )
...
This allows overriding translation files in folders with lowercase RFC5646 / BCP47 Format language codes. This also fixes an issues where languages which don't expressly match the language code specified due to having a variant will also match the existing codes.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-04-04 12:15:26 +10:00
2502d89682
fix(server): respond with 404/405 appropriately ( #3087 )
...
This adjusts the not found handler to not respond with a 404 on not found endpoints that are part of the /api or /.well-known folders, and respond with a 405 when the method isn't implemented.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-04-04 09:58:01 +10:00
7230db7cea
refactor(configuration): decode_hooks blackbox and better testing ( #3097 )
2022-04-03 22:44:52 +10:00
bfd5d66ed8
feat(notification): password reset notification custom templates ( #2828 )
...
Implemented a system to allow overriding email templates, including the remote IP, and sending email notifications when the password was reset successfully.
Closes #2755 , Closes #2756
Co-authored-by: Manuel Nuñez <@mind-ar>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-03 22:24:51 +10:00
9e05066097
refactor(handlers): ppolicy ( #3103 )
...
Add tests and makes the password policy a provider so the configuration can be loaded to memory on startup.
2022-04-03 21:58:27 +10:00
36cf662458
refactor: misc password policy refactoring ( #3102 )
...
Add tests and makes the password policy a provider so the configuration can be loaded to memory on startup.
2022-04-03 10:48:26 +10:00
8659ba394d
feat(authentication): password policy ( #2723 )
...
Implement a password policy with visual feedback in the web portal.
Co-authored-by: Manuel Nuñez <@mind-ar>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-03 08:32:57 +10:00
4d7f930e74
docs: fix regex examples ( #3094 )
2022-04-02 16:41:16 +11:00
1bae65ad33
feat(templates): display link in mails sent by authelia ( #2785 )
...
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-01 23:34:17 +11:00
3c1bb3ec19
feat(authorization): domain regex match with named groups ( #2789 )
...
This adds an option to match domains by regex including two special named matching groups. User matches the username of the user, and Group matches the groups a user is a member of. These are both case-insensitive and you can see examples in the docs.
2022-04-01 22:38:49 +11:00
0116506330
feat(oidc): implement amr claim ( #2969 )
...
This adds the amr claim which stores methods used to authenticate with Authelia by the users session.
2022-04-01 22:18:58 +11:00
b2d35d88ec
feat(configuration): allow rfc4918 http verbs in acl ( #2988 )
...
This allows the HTTP Method verbs from RFC4918 to be used. See https://datatracker.ietf.org/doc/html/rfc4918 for more information.
2022-04-01 21:53:10 +11:00
df9492ca0e
build(deps): update dependency traefik to v2.6.3 ( #3075 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-03-31 17:00:08 +11:00
56048dd199
build(deps): update dependency alpine to v3.15.3 ( #3072 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-03-29 14:08:54 +11:00
a0bffe39fc
fix(configuration): expvars and pprof mapped incorrectly ( #3068 )
...
This fixes the configuration mapping of the server enable_pprof and enable_expvars values.
2022-03-28 13:06:31 +11:00
70ab8aab15
fix(web): show appropriate default and available methods ( #2999 )
...
This ensures that; the method set when a user does not have a preference is a method that is available, that if a user has a preferred method that is not available it is changed to an enabled method with preference put on methods the user has configured, that the frontend does not show the method selection option when only one method is available.
2022-03-28 12:26:30 +11:00
b86c7b5284
build(deps): update dependency traefik to v2.6.2 ( #3059 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-03-26 20:53:04 +11:00
2d981f7916
build(deps): update dependency alpine to v3.15.2 ( #3051 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-03-26 19:46:15 +11:00
2f31db2db3
fix(server): healthcheck ipv6 format is invalid ( #3055 )
...
This fixes an issue with the healthcheck writting the IPv6 host without brackets.
2022-03-25 11:56:23 +11:00
05b8caa711
fix(configuration): incorrect key validation names ( #3033 )
...
This fixes an issue with key validation slice that has missing or extra keys that are not needed.
2022-03-17 23:20:49 +11:00
17eef2c679
fix(commands): explicitly close files ( #3031 )
...
This fixes an issue that could potentially cause problems with open files due to a deferred file close in a for loop.
2022-03-17 16:53:07 +11:00
9eb23a301b
build(deps): update dependency alpine to v3.15.1 ( #3028 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-03-17 15:53:30 +11:00
06ceafd905
refactor(authentication): simplify ldap connection interface ( #3026 )
...
This simplifies the interface to just expose the methods from the underlying connection that we need. The addition of gen.go makes creating the generated mocks easy go generate.
2022-03-17 15:02:54 +11:00
e65a64c9af
fix(configuration): missing sentinel_username key in validator ( #3027 )
...
This fixes an issue where the sentinel_username is not configurable.
2022-03-17 14:01:31 +11:00
dbe290a1c9
refactor: include url hook func ( #3022 )
...
This adds a hook func for url.URL and *url.URL types to the configuration.
2022-03-16 16:16:46 +11:00
99326c2688
build(deps): update dependency haproxy to v2.5.5 ( #3018 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-03-16 13:43:33 +11:00
14ad07ffa2
fix(oidc): userinfo jti claim potential panic ( #3017 )
...
This fixes a usage of uuid.New() which can potentially panic. Instead we use a uuid.NewRandom() which also generates a UUID V4 instead of a UUID V1. In addition all uuid.NewUUID() calls have been replaced by uuid.NewRandom().
2022-03-16 11:29:46 +11:00
9b779569f4
fix(oidc): add detailed trace/debug logs ( #3012 )
...
This adds significantly more detailed logging for most OpenID Connect handlers.
2022-03-16 09:55:38 +11:00
b43ee50368
fix(configuration): remember me duration disabled impossible ( #2997 )
...
This fixes an issue not properly resolved by db6dd32151
2022-03-13 13:51:23 +11:00
db6dd32151
fix(configuration): cannot disable remember me ( #2985 )
...
This allows users to disable remember me again.
2022-03-10 09:01:04 +11:00
337dd61468
docs: add docs about remember me duration ( #2979 )
...
This documents disabling remember me.
2022-03-09 13:25:11 +11:00
6a1c5ed533
fix(configuration): invalid password algorithm tag ( #2972 )
...
This fixes a configuration parsing issue that could potentially occur if we were to change the internal name of the struct field.
2022-03-07 00:01:46 +11:00
6d937cf6cc
refactor(model): rename from models ( #2968 )
2022-03-06 16:47:40 +11:00
1c1030c742
fix(configuration): time duration decode hook panic ( #2960 )
...
This fixes a potential panic in the time duration decode hook when the YAML value is a zero integer.
2022-03-05 16:51:41 +11:00
204cef4d03
fix(storage): webauthn kid too short for some devices ( #2957 )
...
This fixes an issue that may cause the kid length of a webauthn device to exceed that length allowed by the database column.
2022-03-04 21:21:08 +11:00
fd3a2bb1c5
fix(configuration): pkce config keys not allowed ( #2954 )
...
This fixes a bug that prevents the PKCE configuration keys from being configurable.
2022-03-04 16:46:05 +11:00
a8f5a70b03
feat(oidc): add automatic allow all cors to discovery ( #2953 )
...
This adds a Cross Origin Resource Sharing policy that automatically allows any cross-origin request to the OpenID Connect discovery documents.
2022-03-04 15:46:12 +11:00
a5c400cb1d
fix(commands): use consistent config file name ( #2952 )
...
Adjusts the default filename for all configuration files to configuration.yml.
2022-03-04 14:39:22 +11:00
c9d86a9240
feat(oidc): oauth2 discovery support ( #2925 )
...
* feat(oidc): oauth2 discovery and endpoint rename
This implements the oauth2 authorization server discovery document, adds tests to the discovery documents, implements an efficiency upgrade to these docs, and renames some endpoints to be uniform.
2022-03-04 14:09:27 +11:00
042cd21800
build(deps): utilize github.com/go-webauthn/webauthn ( #2947 )
2022-03-04 10:56:30 +11:00
8f05846e21
feat: webauthn ( #2707 )
...
This implements Webauthn. Old devices can be used to authenticate via the appid compatibility layer which should be automatic. New devices will be registered via Webauthn, and devices which do not support FIDO2 will no longer be able to be registered. At this time it does not fully support multiple devices (backend does, frontend doesn't allow registration of additional devices). Does not support passwordless.
2022-03-03 22:20:43 +11:00
1b2af90e5a
feat(commands): totp qr code in png format ( #2673 )
...
This allows exporting the TOTP QR code for easy registration when using `authelia storage totp generate` or `authelia storage totp export`.
2022-03-02 18:50:36 +11:00
6276883f04
refactor(configuration): utilize time duration decode hook ( #2938 )
...
This enhances the existing time.Duration parser to allow multiple units, and implements a decode hook which can be used by koanf to decode string/integers into time.Durations as applicable.
2022-03-02 17:40:26 +11:00
d867fa1a63
fix(storage): return reason for identity verification not being found ( #2937 )
...
This includes the reason a token was not found during the identity verification process.
2022-03-02 16:33:47 +11:00
6ef6d0499a
feat(oidc): add pkce support ( #2924 )
...
Implements Proof Key for Code Exchange for OpenID Connect Authorization Code Flow. By default this is enabled for the public client type and requires the S256 challenge method.
Closes #2921
2022-03-02 15:44:05 +11:00
f8d9c6eab7
build(deps): update dependency haproxy to v2.5.4 ( #2931 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-03-01 15:04:34 +11:00
c479ba6386
fix(oidc): make preferred_username a profile scope claim ( #2930 )
...
This corrects an issue with the preferred_username which should be part of the profile scope as per https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims .
Introduced in ddbb21a#2829
2022-03-01 14:07:39 +11:00
3c81e75d79
feat(commands): add access-control check-policy command ( #2871 )
...
This adds an access-control command that checks the policy enforcement for a given criteria using a configuration file and refactors the configuration validation command to include all configuration sources.
2022-02-28 14:15:01 +11:00
e286741357
build(deps): update dependency mariadb to v10.8.2 ( #2917 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-02-27 10:12:17 +11:00
4b1bd01167
build(deps): update dependency traefik to v2.6.1 ( #2912 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-02-24 21:13:08 +11:00
eb76de6cdc
build(deps): update dependency haproxy to v2.5.3 ( #2897 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-02-24 03:12:26 +11:00
bed7a8ae32
feat(server): csp template ( #2856 )
...
Implements the ability for advanced users to override the CSP and easily include the required nonce.
2022-02-21 10:14:09 +11:00
ddbb21af90
fix(handlers): include preferred_username claim in meta ( #2829 )
...
This includes the preferred_username claim in the meta. Also uses the consts for all the applicable claims and scopes.
2022-02-10 09:55:28 +11:00
5d4003c291
refactor: directly return error where sufficient ( #2855 )
2022-02-10 09:07:53 +11:00
fcdd41ea2a
feat: oidc scope i18n ( #2799 )
...
This adds i18n for the OIDC scope descriptsions descriptions.
2022-02-08 01:18:16 +11:00
26236f491e
fix(server): use of inconsistent methods for determining origin ( #2848 )
...
This unifies the methods to obtain the X-Forwarded-* header values and provides logical fallbacks. In addition, so we can ensure this functionality extends to the templated files we've converted the ServeTemplatedFile method into a function that operates as a middlewares.RequestHandler.
Fixes #2765
2022-02-07 00:37:28 +11:00
7775d2af0e
fix(ntp): disable failure ignored ( #2835 )
...
Disable failure was ignored previously, this ensures it isn't.
2022-02-03 14:04:24 +11:00
1772a83190
refactor: apply godot recommendations ( #2839 )
2022-01-31 16:25:15 +11:00
a7a2bc63fe
feat(configuration): support private-use redirect uris in oidc ( #2796 )
...
Private-use redirect URIs are used to redirect the user to native apps initiating the authentication flow on a device as described in https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
Fix #2742
2022-01-21 22:05:53 +11:00
e59f571816
refactor(oidc): add client id to two factor log message ( #2816 )
...
Adds the client id to a log message where it's likely useful. Additionally adds beta stage for prompt/display handling.
2022-01-21 14:15:50 +11:00
d8cf272757
build(deps): update traefik docker tag to v2.5.7 ( #2815 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2022-01-21 13:43:06 +11:00
9a8c6602dd
fix(middlewares): smart delay on reset password ( #2767 )
...
This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-21 10:46:13 +11:00
06641cd15a
fix(oidc): add preferred username claim ( #2801 )
...
This adds the missing preferred username claim to the ID Token for OIDC.
Fixes #2798
2022-01-18 20:32:06 +11:00
fe4bfc1c75
fix(configuration): mail address decode hook func ( #2790 )
...
This fixes an issue with the mail address decode hook func which previously would attempt to decode any struct type to a mail address.
2022-01-15 13:01:40 +11:00
526d71ae8c
build(deps): update module github.com/ory/fosite to v0.42.0 ( #2691 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-01-13 02:52:15 +11:00
d103585aba
fix(storage): use boolean instead of integer ( #2776 )
...
This fixes an issue where an integer is used instead of a boolean.
2022-01-13 01:42:41 +11:00
535ad2a697
build(deps): update haproxy docker tag to v2.5.1 ( #2793 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-01-12 23:54:50 +11:00
2a1e7fc793
build(deps): update traefik docker tag to v2.5.6 ( #2738 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2021-12-23 10:44:39 +11:00
93352aa36b
build(deps): update traefik docker tag to v2.5.5 ( #2706 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2021-12-12 14:47:03 +11:00
f9586b99a9
build(deps): update traefik docker tag to v1.7.34 ( #2705 )
...
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2021-12-12 11:15:01 +11:00
c01759715c
fix(models): potential panic generating jti ( #2669 )
...
This ensures that at the time the JWT is generated for identity verification requests that a panic can't occur and instead an error will be returned.
2021-12-04 15:48:22 +11:00
5a223b5a56
fix(storage): don't check exp against time using sql ( #2676 )
...
This is already checked by JWT validation. There is no need and it's leading to timezone issues.
Fixes #2672
2021-12-04 15:34:20 +11:00
95a5e326a5
fix(storage): postgres schema hardcoded for tables query ( #2667 )
...
This removes the hardcoded schema value from the PostgreSQL existing tables query, making it compatible with the new schema config option.
2021-12-03 17:29:55 +11:00
255aaeb2ad
feat(storage): encrypt u2f key ( #2664 )
...
Adds encryption to the U2F public keys. While the public keys cannot be used to authenticate, only to validate someone is authenticated, if a rogue operator changed these in the database they may be able to bypass 2FA. This prevents that.
2021-12-03 11:04:11 +11:00
104a61ecd6
refactor(web): only fetch totp conf if required ( #2663 )
...
Prevents the TOTP user config from being requested when the user has not registered or is already authenticated 2FA.
2021-12-02 21:28:16 +11:00
9045b75344
fix(storage): rebind all queries ( #2662 )
...
Fixes an issue in the new storage system. We forgot to rebind a few queries to the PostgreSQL compatible format.
2021-12-02 17:06:04 +11:00
f90ca855e3
feat(storage): postgresql schema and ssl options ( #2659 )
...
Adds the schema name and all ssl options for PostgreSQL. Also a significant refactor of the storage validation process.
2021-12-02 16:36:03 +11:00
5b3fa1fffb
docs: consistent naming for configuration file ( #2626 )
...
* change all instances (file names and docs) of "config.template.yml" to "configuration.template.yml" so its consistent with the expectations of the Dockerfile
* Keep config.template.yml named as is
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
* Update index.html
* revert filename changes and add a note about docker
* refactor: apply suggestions from code review
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2021-12-02 15:50:05 +11:00
a79e4dc592
fix(storage): duo/u2f upsert failure on postgresql ( #2658 )
...
This replaces the standard duo_devices upsert with a PostgreSQL specific one and ensures the u2f_devices upsert uses the new unique key for the ON CONFLICT check.
2021-12-02 15:16:45 +11:00
bf9ab360bd
refactor(handlers): utilize referer for auth logging rm/rd ( #2655 )
...
This utilizes the referrer query parameters instead of current request query parameters for logging the requested URI and method. Minor performance improvements to header peek/sets.
2021-12-02 13:21:46 +11:00
f3f3b31b12
refactor(storage): totp_configurations table ( #2657 )
...
Rename column totp_period to period.
2021-12-02 12:24:10 +11:00
2075e76015
fix(storage): new auth log schema request method length ( #2656 )
...
This is a fix to the authentication_logs schema that prevents the VARCHAR from being insufficient for HTTP request methods such as PATCH, DELETE, OPTIONS, CONNECT.
2021-12-02 11:36:04 +11:00
7df242f1e3
refactor: remove ioutil ( #2635 )
...
Was deprecated in 1.16 and has more performant options available.
2021-12-02 00:14:15 +11:00
8a12af97ab
refactor: remove previously deprecated options ( #2629 )
...
This removes the deprecated logging, host, port, and tls options per our deprecation policy.
2021-12-02 00:01:32 +11:00
ad8e844af6
feat(totp): algorithm and digits config ( #2634 )
...
Allow users to configure the TOTP Algorithm and Digits. This should be used with caution as many TOTP applications do not support it. Some will also fail to notify the user that there is an issue. i.e. if the algorithm in the QR code is sha512, they continue to generate one time passwords with sha1. In addition this drastically refactors TOTP in general to be more user friendly by not forcing them to register a new device if the administrator changes the period (or algorithm).
Fixes #1226 .
2021-12-01 23:11:29 +11:00
01b77384f9
feat(duo): multi device selection ( #2137 )
...
Allow users to select and save the preferred duo device and method, depending on availability in the duo account. A default enrollment URL is provided and adjusted if returned by the duo API. This allows auto-enrollment if enabled by the administrator.
Closes #594 . Closes #1039 .
2021-12-01 14:32:58 +11:00
SvanGlan
James Elliott
renovate[bot]
Auzborn123
Amir Zarrinkafsh
Manuel Nuñez
Clément Michaud
yossbg
Andrew Moore
Aram Akhavan
Philipp Staiger