c8f75b19af
fix(oidc): default response mode not validated ( #5129 )
...
This fixes an issue where the default response mode (i.e. if the mode is omitted) would skip the validations against the allowed response modes.
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-04-11 21:29:02 +10:00
157675f1f3
docs: adjust references of webauthn ( #5203 )
...
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-04-10 17:01:23 +10:00
2dcfc0b04c
feat(handlers): authz authrequest authelia url ( #5181 )
...
This adjusts the AuthRequest Authz implementation behave similarly to the other implementations in as much as Authelia can return the relevant redirection to the proxy and the proxy just utilizes it if possible. In addition it swaps the HAProxy examples over to the ForwardAuth implementation as that's now supported.
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-04-08 14:48:55 +10:00
d6a8dec0be
build(deps): unbump github.com/go-webauthn/webauthn to v0.5.0 ( #5158 )
...
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-04-02 16:09:18 +10:00
ff6be40f5e
feat(oidc): pushed authorization requests ( #4546 )
...
This implements RFC9126 OAuth 2.0 Pushed Authorization Requests. See https://datatracker.ietf.org/doc/html/rfc9126 for the specification details.
2023-03-06 14:58:50 +11:00
a345490826
feat(server): handle head method ( #5003 )
...
This implements some HEAD method handlers for various static resources and the /api/health endpoint.
2023-02-28 20:01:09 +11:00
ab01fa6bca
fix(handlers): legacy authz failure on nginx ( #4956 )
...
Since nginx doesn't do portal URL detection we have to skip returning an error on the legacy authz implementation when the portal URL isn't detected. This issue only exists in unreleased versions.
2023-02-18 16:56:53 +11:00
6499dcf210
build(deps): update module github.com/go-webauthn/webauthn to v0.7.1 ( #4920 )
...
* build(deps): update module github.com/go-webauthn/webauthn to v0.7.1
* test: fix for upstream changes
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-02-13 06:30:19 +11:00
65705a646d
feat(server): customizable authz endpoints ( #4296 )
...
This allows users to customize the authz endpoints.
Closes #2753 , Fixes #3716
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2023-01-25 20:36:40 +11:00
8b29cf7ee8
feat(session): multiple session cookie domains ( #3754 )
...
This adds support to configure multiple session cookie domains.
Closes #1198
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2023-01-12 21:57:44 +11:00
cf4010b4fb
fix(oidc): csp blocks form_post response form submit ( #4719 )
...
This fixes an issue where the form_post response never gets submitted.
Fixes #4669
2023-01-08 07:04:06 +11:00
3d6c67fa33
build(deps): update module github.com/go-webauthn/webauthn to v0.6.0 ( #4646 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-01-07 14:21:27 +11:00
2ab50c7f61
test(handlers): add additional coverage ( #4698 )
...
* test(handlers): handler_checks_safe_redirection
* test(handlers): password_policy
* test(handlers): health
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-01-05 09:37:43 +11:00
adaf069eab
feat(oidc): per-client pkce enforcement policy ( #4692 )
...
This implements a per-client PKCE enforcement policy with the ability to enforce that it's used, and the specific challenge mode.
2023-01-04 02:03:23 +11:00
f685f247cf
feat(notification): important events notifications ( #4644 )
...
This adds important event notifications.
2022-12-27 19:59:08 +11:00
a771cc6c2b
fix(notification): missing display name ( #4653 )
2022-12-27 10:54:58 +11:00
0bb657e11c
refactor(notifier): utilize smtp lib ( #4403 )
...
This drops a whole heap of code we were maintaining in favor of a SMTP library.
Closes #2678
2022-12-23 16:06:49 +11:00
d67554ab88
feat(authentication): ldap time replacements ( #4483 )
...
This adds and utilizes several time replacements for both specialized LDAP implementations.
Closes #1964 , Closes #1284
2022-12-21 21:31:21 +11:00
728902335b
refactor: const int type stringers ( #4588 )
2022-12-17 23:39:24 +11:00
d13247ce43
refactor(server): simplify templating and url derivation ( #4547 )
...
This refactors a few areas of the server templating and related functions.
2022-12-17 11:49:05 +11:00
ad68f33aeb
build(deps): update module github.com/ory/fosite to v0.43.0 ( #4269 )
...
This updates fosite and refactors our usage out of compose.
2022-11-13 14:26:10 +11:00
5a23df4544
refactor: uuid parse bytes ( #4311 )
...
Use ParseBytes instead since it supports a byte encoded string.
2022-11-01 10:31:13 +11:00
a283fda6d6
fix(oidc): handle authorization post requests ( #4270 )
...
This fixes an issue where the authorization endpoint was not handling post requests as per the specification. It also fixes the missing CORS middleware on the authorization endpoint.
2022-10-26 19:14:43 +11:00
3aaca0604f
feat(oidc): implicit consent ( #4080 )
...
This adds multiple consent modes to OpenID Connect clients. Specifically it allows configuration of a new consent mode called implicit which never asks for user consent.
2022-10-20 13:16:36 +11:00
3a70f6739b
feat(authentication): file password algorithms ( #3848 )
...
This adds significant enhancements to the file auth provider including multiple additional algorithms.
2022-10-17 21:51:59 +11:00
dc79c8ea59
refactor: any ( #4133 )
...
* refactor: any
* refactor: fix test
2022-10-05 16:05:23 +11:00
6810c91d34
feat(oidc): issuer jwk certificates ( #3989 )
...
This allows for JWKs to include certificate information, either signed via Global PKI, Enterprise PKI, or self-signed.
2022-10-02 13:07:40 +11:00
ed7092c59a
feat: envoy support ( #3793 )
...
Adds support for Envoy and Istio using the X-Authelia-URL header. The documentation will be published just before the release.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-10-01 21:47:09 +10:00
8cdf4a5624
fix(authorization): regex subj doesn't redirect anon user ( #4037 )
...
This fixes an issue with the authorization policies where if the Domain Regex or Resources criteria would incorrectly return 403 Forbidden statuses instead of 302 Found statuses.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-09-26 14:33:08 +10:00
ca85992ac6
fix(handlers): verify handler ( #3956 )
...
When an anonymous user tries to access a forbidden resource with no subject, we should response with 403.
Fixes #3084
2022-09-05 08:21:30 +10:00
2325031052
refactor: clean up uri checking functions ( #3943 )
2022-09-03 11:51:02 +10:00
319a8cf9d4
fix(notification): text emails not encoded properly ( #3854 )
...
This fixes an issue where the plain text portion of emails is not encoded with quoted printable encoding.
2022-08-27 07:39:20 +10:00
9c00104cb2
fix(utils): domain suffix improperly checked ( #3799 )
2022-08-07 21:13:56 +10:00
2d26b4e115
refactor: fix linter directives for go 1.19 and golangci-lint 1.48.0 ( #3798 )
2022-08-07 11:24:00 +10:00
b2cbcf3913
fix(handlers): consent session prevents standard flow ( #3668 )
...
This fixes an issue where consent sessions prevent the standard workflow.
2022-07-26 15:43:39 +10:00
df016be29e
fix(notification): incorrect date header format ( #3684 )
...
* fix(notification): incorrect date header format
The date header in the email envelopes was incorrectly formatted missing a space between the `Date:` header and the value of this header. This also refactors the notification templates system allowing people to manually override the envelope itself.
* test: fix tests and linting issues
* fix: misc issues
* refactor: misc refactoring
* docs: add example for envelope with message id
* refactor: organize smtp notifier
* refactor: move subject interpolation
* refactor: include additional placeholders
* docs: fix missing link
* docs: gravity
* fix: rcpt to command
* refactor: remove mid
* refactor: apply suggestions
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
* refactor: include pid
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-07-18 10:56:09 +10:00
f115f77df8
fix(web): offline_access consent description ( #3679 )
2022-07-11 16:24:09 +10:00
ce779b2533
refactor(middlewares): factorize responses ( #3628 )
2022-07-08 22:18:52 +10:00
24f5caed97
refactor: factorize verify handler ( #3662 )
...
This factorizes a few sections of the /api/verify handler and improves both the code flow and error output of the section of code.
2022-07-08 12:32:43 +10:00
da012ab2d6
fix(handlers): fix redirect with timed out sessions on rules with bypass policy ( #3599 )
...
This change replaced a returned error with a warning when the idle timeout was exceeded.
Fixes #3587
2022-07-05 09:58:35 +10:00
d9c7cd6564
fix(model): potential panic ( #3538 )
...
This fixes a potential panic in the conversion from a fosite.Requester to an *OAuth2Session object.
2022-06-17 22:25:14 +10:00
b2c60ef898
feat: major documentation refresh ( #3475 )
...
This marks the launch of the new documentation website.
2022-06-15 17:51:47 +10:00
001589cd6d
feat(metrics): implement prometheus metrics ( #3234 )
...
Adds ability to record metrics and gather them for Prometheus.
2022-06-14 17:20:13 +10:00
607bbcc324
fix(handler): oidc two factor handling ( #3512 )
2022-06-14 15:17:11 +10:00
a50d425863
refactor(middlewares): convert the bridge to a builder ( #3338 )
...
This adjusts the bridge to be utilized as a builder in order to make it more reusable.
2022-06-10 11:34:43 +10:00
a7106ad7e9
fix(handler): missing notification values ( #3321 )
...
This ensures all template types share the same template values and display them correctly regardless if text/html/other.
Fixes #3319 .
2022-05-09 08:43:12 +10:00
1db00717ee
fix(oidc): pre-conf consent skipped entirely for anon users ( #3250 )
...
This fixes an issue where pre-configured consent is entirely skipped if the process was initiated via an anonymous user.
2022-05-03 15:28:58 +10:00
abf1c86ab9
fix(oidc): subject generated for anonymous users ( #3238 )
...
Fix and issue that would prevent a correct ID Token from being generated for users who start off anonymous. This also avoids generating one in the first place for anonymous users.
2022-04-25 10:31:05 +10:00
e99fb7a08f
feat(configuration): configurable default second factor method ( #3081 )
...
This allows configuring the default second factor method.
2022-04-18 09:58:24 +10:00
4710de33a4
refactor(configuration): remove ptr for duoapi and notifier ( #3200 )
...
This adds to the ongoing effort to remove all pointers to structs in the configuration without breaking backwards compatibility.
2022-04-16 09:34:26 +10:00
James Elliott
renovate[bot]
Manuel Nuñez
Amir Zarrinkafsh